ON HOLD feature: management of Google Play testers list

[madebydavid]

Context

We recently added an iOS-only command to allow the user to add new users as testers of their game in TestFlight – this was done in #54.

Goal

We would like to be able to do this for Android too, but with some differences:

• Create a Google Group for each game's testers, for example testers-<gameId>@shipth.is
• Attach that group to the game's Internal testing track in Google Play
• Manage membership (adding and removing tester emails) using the Admin SDK Directory API

Prerequisites

• Backend changes
• Confirm CLI commands / flags syntax
• Update docs with usage examples

[madebydavid]

I think there are some restrictions on the Internal Testing group

https://support.google.com/googleplay/android-developer/answer/9845334?hl=en#internal_test

• Only 100 testers per app
• Must be a google account (gmail or workspace)

[madebydavid]

The syntax for iOS would be:

shipthis game ios app addTester --email john.doe@fakeemail.com --firstName John --lastName Doe

Perhaps for android (keeping it in line with the other topics)

shipthis game android apiKey addTester --email someone@gmail.com

We don't have an "app" topic in Android as, unlike with iOS, the cli tool cannot manage the app object itself within Google Play.

[madebydavid]

Something to think about: the task is "management of..." rather than just adding to.

We could also add the ability to list the members of the group, and the ability to remove people from the group.

The iOS command can only add, it cannot "manage" - so perhaps we want to expand that part too?

[madebydavid]

I have been experimenting with the backend part of this feature. It is straightforward, however we will need to persist the users's Google Play Developer Account ID. It is needed for certain calls to the Google API.

We have some text in the privacy policy which may need to be changed:

Google User Data We Collect

ShipThis collects and processes the following Google user data:

• Short-lived OAuth Token: Used temporarily for API authentication.
• Service Account Key (JSON format): Stored securely for deployment.
• Service Account Email: Used for authentication.
• Google Play Developer Account ID: Used during setup but not stored.

In the policy we are saying we do not save the account id. This will need to be changed.

[madebydavid]

I think we will need to implement #79 before this or in the same release.

[madebydavid]

If we wanted to expand to management of tester lists, we may want to expand / reorganise the iOS commands too:

# to manage google play testers
shipthis game android testers list
shipthis game android testers add --email someone@gmail.com
shipthis game android testers remove aa57b06b

# to manage testflight testers
shipthis game ios testers list
shipthis game ios testers add --email apple.developer@whatever.com
shipthis game ios testers remove b29dad09

[madebydavid]

Privacy policy change is ready in the frontend here https://gitlab.com/shipthis.cc/frontend/-/merge_requests/80

[madebydavid]

Policy warning change #79 has been merged to main. We are waiting for:

• Backend changes (endpoint to add testers to Internal Testing group)
• Confirm CLI commands / flags syntax

[madebydavid]

I feel like we should ignore iOS for now and build out the Android commands here in a way that can be replicated in the iOS commands (as we only have the addTester one there for the moment). This would satisfy the goal of this issue and would let us know what structure we should aim for when we implement iOS.

[madebydavid]

After reviewing this further, the Play Developer Account Users API only manages Play Console users (team members with console access), not app testers. Using that API would give people unnecessary permissions, so we will not use it.

Next approach

• Create a Google Group for each game's testers, for example testers-<gameId>@shipth.is
• Attach that group to the game's Internal testing track in Google Play
• Manage membership (adding and removing tester emails) using the Admin SDK Directory API
• These groups will live under the shipth.is Workspace account
• A service account with domain-wide delegation, managed internally by ShipThis, will handle membership changes programmatically

APIs and scopes

• Google Play Developer API to attach the group to the internal testing track (edits.testers.patch)
  Scope:

  • https://www.googleapis.com/auth/androidpublisher

• Admin SDK Directory API to create and manage tester groups and membership
  Scopes (restricted):

  • https://www.googleapis.com/auth/admin.directory.group
  • https://www.googleapis.com/auth/admin.directory.group.member