sync: Auto-sync from ACG-M-L5090 at 2026-03-10 19:11:00

Synced files:
- Quote wizard frontend (all components, hooks, types, config)
- API updates (config, models, routers, schemas, services)
- Client work (bg-builders, gurushow)
- Scripts (BGB Lesley termination, CIPP, Datto, migration)
- Temp files (Bardach contacts, VWP investigation, misc)
- Credentials and session logs
- Email service, PHP API, session logs

Machine: ACG-M-L5090
Timestamp: 2026-03-10 19:11:00

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

credentials.md

@@ -1117,6 +1117,51 @@ users = requests.get("https://graph.microsoft.com/v1.0/users", headers=headers)
 
 ---
 
+### ACG-MSP-Access (Google Workspace - Multi-Tenant)
+- **Service:** Google Workspace API access for investigations and remediation
+- **Google Cloud Project:** acg-msp-access
+- **Service Account Email:** acg-msp-access@acg-msp-access.iam.gserviceaccount.com
+- **Client ID:** 102231607889615995452
+- **Key File:** `temp/acg-msp-access-8f72339997e5.json`
+- **Private Key ID:** 8f72339997e510cb3bf3c01aa658a09a4bce97ba
+- **Created:** 2026-03-10
+- **Purpose:** Domain-wide delegation for Google Workspace client investigations
+- **Scopes:**
+  - `admin.directory.user` (user management)
+  - `admin.directory.user.security` (password reset, 2FA, revoke sessions)
+  - `admin.reports.audit.readonly` (audit/sign-in logs)
+  - `gmail.readonly` (mailbox investigation)
+  - `gmail.settings.basic` (forwarding rules)
+  - `drive.readonly` (drive audit)
+  - `admin.directory.domain.readonly` (domain info)
+- **Onboarded Tenants:**
+  - lonestarelectrical.net (sysadmin@lonestarelectrical.net) - added 2026-03-10
+
+#### Usage (Python)
+```python
+from google.oauth2 import service_account
+from googleapiclient.discovery import build
+
+SCOPES = [
+    'https://www.googleapis.com/auth/admin.directory.user',
+    'https://www.googleapis.com/auth/admin.directory.user.security',
+    'https://www.googleapis.com/auth/admin.reports.audit.readonly',
+    'https://www.googleapis.com/auth/gmail.readonly',
+    'https://www.googleapis.com/auth/gmail.settings.basic',
+    'https://www.googleapis.com/auth/drive.readonly',
+    'https://www.googleapis.com/auth/admin.directory.domain.readonly',
+]
+
+creds = service_account.Credentials.from_service_account_file(
+    'temp/acg-msp-access-8f72339997e5.json', scopes=SCOPES
+)
+# Impersonate the admin user in the target tenant
+delegated = creds.with_subject('sysadmin@lonestarelectrical.net')
+service = build('admin', 'reports_v1', credentials=delegated)
+```
+
+---
+
 ## Tailscale Network
 
 | Tailscale IP | Hostname | Owner | OS | Notes |