From 1f4f47070f6ad2cbc42c1c429ef51c5a52e190b7 Mon Sep 17 00:00:00 2001
From: "c1-dev-bot[bot]" <2740113+c1-dev-bot[bot]@users.noreply.github.com>
Date: Fri, 20 Feb 2026 17:37:28 +0000
Subject: [PATCH] Skip grant listing for empty Google Workspace groups

Add SkipGrants annotation to groups with DirectMembersCount == 0 during
groupToResource(). This prevents the SDK from calling Members.List() for
empty groups, avoiding unnecessary API calls and transient errors (e.g.,
TLS handshake timeouts) that can fail the entire sync.

When a group has no direct members, there are no grants to list, so
skipping the grants step is both an optimization and a resilience
improvement.

Ref: EPD-1604
---
 pkg/connector/group.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkg/connector/group.go b/pkg/connector/group.go
index 24855f3e..7dc4dd7b 100644
--- a/pkg/connector/group.go
+++ b/pkg/connector/group.go
@@ -229,6 +229,14 @@ func groupToResource(ctx context.Context, group *admin.Group) (*v2.Resource, err
 			Id: group.Id,
 		}),
 	}
+
+	// Skip grant listing for groups with no direct members to avoid unnecessary API calls
+	// and transient errors (e.g., TLS handshake timeouts) that can fail the entire sync.
+	if group.DirectMembersCount == 0 {
+		l.Debug("skipping grants for empty group", zap.String("group_id", group.Id), zap.String("group_name", group.Name))
+		resourceOpts = append(resourceOpts, rs.WithAnnotation(&v2.SkipGrants{}))
+	}
+
 	return rs.NewGroupResource(group.Name, resourceTypeGroup, group.Id, traitOpts, resourceOpts...)
 }