From b9680bf39c89e4c0b1775c0601782d415f49cc66 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?= <81782+aureliensibiril@users.noreply.github.com> Date: Sun, 12 Jul 2026 19:54:25 +0200 Subject: [PATCH] Explain why the Google Analytics driver keys on email MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ExternalID is normally a stable provider-side ID, not an email. GA4 access bindings identify a user only by email — no per-user ID and no display name are exposed — so email is the only stable key available. Document that on googleAnalyticsRecords so the choice reads as deliberate. Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com> --- pkg/accessreview/drivers/google_analytics.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkg/accessreview/drivers/google_analytics.go b/pkg/accessreview/drivers/google_analytics.go index 086bf3689..6d7c555da 100644 --- a/pkg/accessreview/drivers/google_analytics.go +++ b/pkg/accessreview/drivers/google_analytics.go @@ -270,7 +270,9 @@ func addGoogleAnalyticsBinding(members map[string]*googleAnalyticsMember, user s } // googleAnalyticsRecords turns the merged member map into a deterministically -// ordered slice of AccountRecords. Active is left nil: GA4 access bindings +// ordered slice of AccountRecords. GA4 access bindings identify a user only by +// email — there is no stable per-user ID and no display name exposed — so the +// email is used as both ExternalID and FullName. Active is left nil: bindings // carry no account-status signal. func googleAnalyticsRecords(members map[string]*googleAnalyticsMember) []AccountRecord { emails := make([]string, 0, len(members))