## Summary
**QA / load-test tooling** for the Google Workspace IdP integration —
lets QA exercise the real sync path at scale without a Google Workspace
tenant.
- **`tools/gw-directory-fake`** — a standalone fake of the Google Admin
SDK Directory API (not production code):
- `generate` — writes an editable JSON fixture (`-users`, `-groups`,
`-members-per-group`, `-domain`).
- `serve` — serves users/groups/members with real pagination from the
fixture, **hot-reloading** the file on change (poll modtime), plus
`-latency` / `-error-rate` (429/503) knobs. Responses are built from the
real `directory` SDK structs so the schema can't drift.
- **Fleet-side seam** (`ee/server/googleworkspace/google_workspace.go`):
- honors `token_uri` from the service-account JSON (falls back to
Google's endpoint),
- `FLEET_TEST_GOOGLE_WORKSPACE_ENDPOINT` redirects the Directory API
base to the fake (logs a warning each sync; never set in production),
- `seam_test.go` proves the loop end to end (JWT token exchange +
paginated Directory calls against a local fake over plain HTTP).
### QA workflow
```
go run ./tools/gw-directory-fake generate -users 50000 -groups 2000 -domain qa.example.com -out fixture.json
go run ./tools/gw-directory-fake serve -fixture fixture.json -addr :8091
```
Set `FLEET_TEST_GOOGLE_WORKSPACE_ENDPOINT=http://<host>:8091` on Fleet
and configure the integration with a throwaway service-account JSON
whose `token_uri` is `http://<host>:8091/token`. Edit `fixture.json`
anytime to change directory state mid-test.
> 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-5-frontend` (top of the
feature code stack, #48168).
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Google Workspace directory access now supports custom OAuth token
endpoints and a configurable API base endpoint for testing and special
environments.
* Added a local fake Google Workspace Directory server tool for
generating sample data and serving directory responses, including
pagination and optional fault injection.
* **Bug Fixes**
* Improved handling for Google Workspace API calls when alternate
endpoints are required.
* **Tests**
* Added coverage for overriding the Google Workspace directory endpoint.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Lucas Manuel Rodriguez
9f3f198e08