CS-168 Filter employees based on org unit and filter mode in employee-access check

[github-actions]

This is an automated pull request to merge chas/google-workspace-users into dev.
It was created by the [Auto Pull Request] action.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	Mar 23, 2026 3:21am
comp-framework-editor	Ready	Preview, Comment	Mar 23, 2026 3:21am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal	Skipped		Mar 23, 2026 3:21am

[cursor]

PR Summary

Medium Risk
Changes which Google Workspace users are evaluated by security checks by applying org-unit and include/exclude email rules (and suspended handling) consistently; misconfiguration or logic edge cases could cause users to be incorrectly included/excluded from check results.

Overview
Adds a shared Google Workspace user-filtering utility (OU scoping, suspended/archived handling, and sync-style include/exclude email terms) and unit tests for it.

Updates the two-factor-auth and employee-access checks to use this centralized filter, and expands employee-access to accept target_org_units so both checks follow the same selection rules as employee sync.

^{Written by Cursor Bugbot for commit 0408858. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[linear]

CS-168 [Bug] - GWS integration now respecting respecting selected org units

[tofikwest]

good