Accept plural WIF_ADMIN_SUBJECTS in the revocation wrapper (multi-Workspace)

[akuzminsky]

Puppet's (small) part of extending Google directory revocation to multiple Google Workspace tenants. The per-Workspace looping lives entirely in infrahouse-toolkit's ih-openvpn sync-google-users; here the only change is the wrapper's required-var precheck. Design notes: .claude/plans/TASK-multi-workspace-revocation.md.

The change

terraform-aws-openvpn will write a new plural WIF_ADMIN_SUBJECTS (comma-separated, one admin per tenant) into wif.env, keeping the singular WIF_ADMIN_SUBJECT for back-compat:

export WIF_ADMIN_SUBJECT=admin@acme.io                    # DEPRECATED: first element, back-compat
export WIF_ADMIN_SUBJECTS=admin@acme.io,admin@acme.dev    # NEW: authoritative, comma-separated

The wrapper hard-required the singular, so it would wrongly fail if a future wif.env emitted only the plural. Now it requires the always-present vars unconditionally, then at least one admin-subject var:

for required_var in GOOGLE_APPLICATION_CREDENTIALS WIF_SA_EMAIL; do
    [ -n "${!required_var:-}" ] || misconfigured "$required_var is not set in $WIF_ENV_FILE"
done
[ -n "${WIF_ADMIN_SUBJECTS:-}" ] || [ -n "${WIF_ADMIN_SUBJECT:-}" ] \
    || misconfigured "neither WIF_ADMIN_SUBJECTS nor WIF_ADMIN_SUBJECT is set in $WIF_ENV_FILE"

The wrapper doesn't parse the list — it sources wif.env and runs the tool, which reads the env itself.

Scope

• No change to the cron resource, the compile-time fact gate, or the fact handling — the fact stays a boolean enable-signal; the Workspace count lives in wif.env. Confirmed: no .pp touched.
• Applied byte-identically to development, sandbox, and global copies (repo convention).
• Un-upgraded toolkit degrades gracefully (reads the singular, covers the first tenant), so no version pin is added — relies on ensure => latest + release ordering.

Testing

Desk-checked all four precheck cases against the rendered wrapper:

wif.env has	Result
only WIF_ADMIN_SUBJECT (old)	passes → sync runs
only WIF_ADMIN_SUBJECTS (new)	passes → sync runs
both	passes → sync runs
neither	misconfigured → exit 1, cron mails

bash -n clean; puppet-lint clean (no manifest changed). Everything else — the EFS flock, index.txt not-ready → quiet exit 0, exit-78 → misconfigured, other non-zero → real failure — is unchanged.

Rollout order (three repos)

1. infrahouse-toolkit ≥ 2.62.0 ships first (ensure => latest pulls it).
2. terraform-aws-openvpn emits WIF_ADMIN_SUBJECTS into wif.env.
3. This repo — safe to land any time; the module keeps emitting the singular too, so the current wrapper keeps working throughout the transition.

🤖 Generated with Claude Code