Skip to content

Re-scope step 8: Help Desk Admin through a group #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rachmo wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Re-scope step 8: Help Desk Admin through a group #64

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1225c91
Re-scope step 8: Help Desk Admin through a group
Oct 2, 2026
a646fe7
Step 8: grp-helpdesk, changed only by a Super Admin's click
Oct 2, 2026
559d78a
Step 8: an RA or Super Admin may apply grp-helpdesk changes
Oct 2, 2026
11bd1b4
Step 8: say what a refused group edit would mean for RAs
Oct 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions docs/google-setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,10 +164,12 @@ Done for Red Hawk on 2026-09-28. Four parts, in this order.
- `https://www.googleapis.com/auth/admin.directory.user.readonly` (step 6)
— check each RHR Email is a real account; `admin.directory.user` (step 7)
to suspend or restore one after an admin approves it
- `https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly`
(step 8) — to report who holds Groups Admin and Help Desk Admin.
Read-only: only a Super Admin can grant those roles, so hawk-mod reports
and a person acts

Step 8 adds no scope. It was to have added
`admin.directory.rolemanagement.readonly`, to report who holds which
admin role, but Google lets only a Super Admin read that; step 8 puts
Help Desk Admin on a group instead, which the group scopes already reach
(re-scoped 2026-10-02, `lifecycle-sync.md`).

3. **An account to act as, with a narrow role.** hawk-mod acts as
`hawk-mod@redhawkrobotics.org`, so every change it makes appears in the
Expand Down
14 changes: 7 additions & 7 deletions docs/lifecycle-sheet.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,12 +153,12 @@ A mentor joins Google Groups and is invited to Slack only once their CORI is cur

### `Mentor_Admin_Roles` (PK: `Person ID`, one row per delegated admin role held)

| Column | Notes |
| ---------- | ----------------------------------------------------------------- |
| Person ID | |
| Admin Role | Dropdown (`Reference_Lists!B`): `Groups Admin`, `Help Desk Admin` |
| Column | Notes |
| ---------- | ------------------------------------------------- |
| Person ID | |
| Admin Role | Dropdown (`Reference_Lists!B`): `Help Desk Admin` |

Only add a row for someone who is actually granted a delegated admin role — most mentors don't get one. **Super Admin is intentionally not tracked here** — it's managed directly in Google Workspace, not via this sheet.
Only add a row for someone who should hold a delegated admin role — most mentors don't get one. **Help Desk Admin is the only one** (decided 2026-10-02): it comes with membership of a security group, which hawk-mod keeps in line with this tab once an administrator clicks, for Active Mentors whose CORI is current. `Groups Admin` is no longer given out, because group membership comes from this sheet. **Super Admin is intentionally not tracked here** — it's managed directly in Google Workspace, not via this sheet.

### `Student_Details` (PK: `Person ID`, one row per student)

Expand Down Expand Up @@ -227,7 +227,7 @@ One column per dropdown, values top-to-bottom. This is the **only** place free-t
| Column | Backs | Values |
| ---------------------------- | ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| A — Roles | `People_Roles.Role` | Mentor, Volunteer, Alumni, Student |
| B — Admin Roles | `Mentor_Admin_Roles.Admin Role` | Groups Admin, Help Desk Admin |
| B — Admin Roles | `Mentor_Admin_Roles.Admin Role` | Help Desk Admin |
| C — Relationship | `Emergency_Contacts.Relationship` | Parent/Guardian, Grandparent, Spouse, Sibling, Friend, Other |
| D — Active/Inactive | `People.Active/Inactive` | Active, Inactive |
| E — Y/N | Mentor Lead, RA, Student Lead columns | Y, N |
Expand Down Expand Up @@ -257,7 +257,7 @@ One column per dropdown, values top-to-bottom. This is the **only** place free-t
2. If genuinely new, generate the next `Person ID` and add a `People` row, including `Rookie Year`. Emergency contact info for mentors goes in `Emergency_Contacts`, not on the `People` row.
3. Add a `People_Roles` row: `Role = Mentor`.
4. Agree the mentor's `@redhawkrobotics.org` address with them (not everyone wants `firstname@`), and add a `Mentor_Details` row with it as `RHR Email`. hawk-mod then asks, in the onboarding channel, for a Super Admin to create the Google account at that address; the request closes once the account exists. If the address is not agreed yet, leave `RHR Email` blank and hawk-mod asks for both. Fill in each requirement date as it's completed (blank = not started yet): `YPT Expiry`, `Background Screening Expiry`, `CORI Expiry`, `Consent & Release Expiry`, `Data Privacy Expiry` (each copied from FIRST or the state, never calculated), and `Mentor Ready Completed` (the date the badge was earned). `RHR Media Release Completed` is the date the one-time form was done; set `Media Release Scope` from what they selected on that form. Set `Mentor Lead (Y/N)` and `RA (Y/N)` — both default to `N` unless told otherwise; `RA` is a manual judgment call, not derived from anything else. Leave `Slack User ID` blank — hawk-mod fills it in. The mentor joins Google Groups and is invited to Slack only once their CORI is current; hawk-mod posts the invite request then.
5. Only add a `Mentor_Admin_Roles` row if they're granted a delegated admin role — most mentors don't get one.
5. Only add a `Mentor_Admin_Roles` row if they should help with password resets (`Help Desk Admin`) — most mentors don't get one.

### New volunteer

Expand Down
Loading
Loading