@dooer/dooer-test-env 1.12.0 → 1.14.0

package/docs/getting-access.md

@@ -6,7 +6,8 @@ fetch the BankID cert. That needs two things, in this order:
 1. **VPN** — the cluster API is not reachable from the open internet.
 2. **kubectl access** — a client certificate identifying you to the cluster.
 
-The VPN part is self-service. The kubectl part needs an admin to sign your certificate — see
+**Both come from an admin**: they create your VPN tunnel and your cluster credential, and send you two
+files — a WireGuard `.conf` and a `kubeconfig`. You install them and check they work. See
 [issuing-access.md](./issuing-access.md) for their side.
 
 ---
@@ -14,98 +15,50 @@ The VPN part is self-service. The kubectl part needs an admin to sign your certi
 ## 0. Prerequisites
 
 ```bash
-brew install wireguard-tools go jq kubernetes-cli
+brew install wireguard-tools kubernetes-cli
 ```
 
 `openssl` ships with macOS. Check everything is there:
 
 ```bash
-wg --version && go version && jq --version && kubectl version --client && openssl version
+wg --version && kubectl version --client && openssl version
 ```
 
 ---
 
 ## 1. VPN
 
-### 1a. Get a Robo10 token
+**Your admin creates the tunnel and sends you a `.conf` file.** You do not create it yourself and you do
+not need a Robo10 token for this — ask an admin, who follows
+[issuing-access.md § 1](./issuing-access.md#1-vpn--create-and-hand-over-a-tunnel).
 
-The VPN API is authenticated with a Robo10 access token. This opens a browser — **log in with your
-`@robo10.com` email**.
+The file they send you contains a **private key**. Treat it like a password: keep it out of chat, tickets
+and git, install it, and delete the copy they sent you.
 
-```bash
-TOKEN="$(go run github.com/strehle/cmdline-openid-client/openid-client@latest \
-  -issuer https://oidc-provider-backend.api.staging.roboten-dev.com \
-  -client_id ro_authentication_cl_id \
-  -port 34466 | awk '/===/ { if (start) nextfile; start = 1; next } start { print }' | jq -r .access_token)"
-
-[ -n "$TOKEN" ] && echo "token acquired" || echo "no token — did the browser login complete?"
-```
-
-Keep using **this same terminal** for the next steps: `$TOKEN` only exists in this shell.
-
-<details>
-<summary>Alternative if the Go client will not run</summary>
+### 1a. Install the config
 
-1. Open <https://chat.roboten.com> and log in.
-2. DevTools → **Application** → **Storage → Cookies**.
-3. Copy the value of the `x-op-token` cookie.
-4. In your terminal: `TOKEN=<the-cookie-value>`
-</details>
-
-### 1b. Create your tunnel
-
-One tunnel per person per machine. Name it after yourself so admins can tell them apart:
+`wg-quick` takes the interface name from the **filename**, so the name you pick here is the name you use in
+every later command. Check first what is already there — **do not overwrite an existing tunnel**:
 
 ```bash
-NAME="$(whoami)-$(hostname -s)"
-curl -sS -H "Authorization: Bearer $TOKEN" \
-  -H 'Content-Type: application/json' \
-  -d "{ \"name\": \"$NAME\" }" \
-  https://vpn.api.staging.roboten-dev.com/v1/vpn-tunnels
-```
-
-The response contains the tunnel's **id** — you need it next. To find it again later:
-
-```bash
-curl -sS -H "Authorization: Bearer $TOKEN" https://vpn.api.staging.roboten-dev.com/v1/vpn-tunnels
-```
-
-### 1c. Download the tunnel config
-
-```bash
-ID=<the id from the previous step>
-curl -sS -X POST -H "Authorization: Bearer $TOKEN" \
-  https://vpn.api.staging.roboten-dev.com/v1/vpn-tunnels/$ID/actions/get-config \
-  > ~/roboten.conf
+ls /opt/homebrew/etc/wireguard/
 ```
 
-> This file contains your **private key**. Treat it like a password: never commit it, never paste it into
-> chat or a ticket.
-
-### 1d. Install it
-
-`wg-quick` takes the interface name from the **filename**, so the name you choose here is the name you use
-in every later command. Pick something that will not collide with a tunnel you already have:
+Then install it (using `roboten` as the interface name):
 
 ```bash
 sudo mkdir -p /opt/homebrew/etc/wireguard
-sudo cp ~/roboten.conf /opt/homebrew/etc/wireguard/roboten.conf
+sudo cp ~/Downloads/<the-file-they-sent>.conf /opt/homebrew/etc/wireguard/roboten.conf
 sudo chmod 600 /opt/homebrew/etc/wireguard/roboten.conf
-rm ~/roboten.conf          # the copy under /opt/homebrew is the one wg-quick reads
+rm ~/Downloads/<the-file-they-sent>.conf     # the copy under /opt/homebrew is the one wg-quick reads
 ```
 
-Check first whether that name is already taken — **do not overwrite someone else's tunnel**:
-
-```bash
-ls /opt/homebrew/etc/wireguard/
-```
-
-### 1e. Connect, disconnect, restart
+### 1b. Connect, disconnect, restart
 
 ```bash
 sudo wg-quick up roboten       # connect
 sudo wg-quick down roboten     # disconnect
-sudo wg-quick down roboten && sudo wg-quick up roboten   # restart (after a config change or a sleep/wake)
+sudo wg-quick down roboten && sudo wg-quick up roboten   # restart (after a config change or sleep/wake)
 
 sudo wg show                   # status: handshake time + transfer counters
 ```
@@ -122,75 +75,59 @@ sudo brew services start wireguard-tools   # starts wg0 by default
 
 That service is hard-wired to the `wg0` interface, so it only helps if you named your file `wg0.conf`.
 
-### 1f. Verify the VPN works
+### 1c. Verify the VPN works
 
 ```bash
 sudo wg show                                    # expect a recent "latest handshake"
 nc -vz k8s.roboten-infra.com 64430              # expect: succeeded / open
 ```
 
-If `nc` hangs or is refused, the tunnel is not carrying traffic — restart it (1e). Until this passes, no
+If `nc` hangs or is refused, the tunnel is not carrying traffic — restart it (1b). Until this passes, no
 amount of kubectl configuration will help.
 
+> The tunnel routes the cluster network (including the API server) through WireGuard. If you already have
+> another VPN claiming those ranges, they will fight over the routes — bring only one up at a time.
+
 ---
 
 ## 2. kubectl access
 
-Authentication is a **client certificate**. You generate the key and the signing request; only the request
-leaves your machine. Your private key never does.
+**Your admin sends you a ready-made `kubeconfig` file.** You do not generate keys or assemble anything —
+they create the credential and hand it over
+([issuing-access.md § 2](./issuing-access.md#2-kubectl--create-their-credential)).
 
-### 2a. Generate your key and CSR
+Like the VPN config, that file contains a **private key**. Same handling: install it, then delete the copy
+they sent you.
 
-Use `<firstname>-admin` as the name — that string becomes your username in the cluster, and it is what the
-admin binds permissions to.
+### 2a. Install it
 
-```bash
-USER_NAME=<firstname>-admin
-mkdir -p ~/.kube/roboten && cd ~/.kube/roboten
+**If you have no other clusters** — simplest, just put it in place:
 
-openssl genrsa -out "$USER_NAME.key" 2048
-openssl req -new -key "$USER_NAME.key" -out "$USER_NAME.csr" -subj "/CN=$USER_NAME"
-chmod 600 "$USER_NAME.key"
+```bash
+mkdir -p ~/.kube
+cp ~/Downloads/<yourname>.kubeconfig ~/.kube/config
+chmod 600 ~/.kube/config
+rm ~/Downloads/<yourname>.kubeconfig
 ```
 
-### 2b. Send the CSR to an admin
-
-Send **only** `<firstname>-admin.csr`. It is not secret — but the `.key` next to it is, and must never
-leave your machine.
-
-Ask them for three things back:
-
-| | |
-| --- | --- |
-| `<firstname>-admin.crt` | your signed certificate |
-| `ca.crt` | the cluster CA certificate |
-| the API server URL | currently `https://k8s.roboten-infra.com:64430` |
-
-### 2c. Assemble your kubeconfig
-
-Put the two `.crt` files next to your key in `~/.kube/roboten`, then:
+**If you already use kubectl for something else**, merge instead of overwriting:
 
 ```bash
-cd ~/.kube/roboten
-USER_NAME=<firstname>-admin
-SERVER=https://k8s.roboten-infra.com:64430
-
-KUBECONFIG=~/.kube/config kubectl config set-cluster kubernetes \
-  --server="$SERVER" --certificate-authority=ca.crt --embed-certs=true
-
-KUBECONFIG=~/.kube/config kubectl config set-credentials "$USER_NAME" \
-  --client-certificate="$USER_NAME.crt" --client-key="$USER_NAME.key" --embed-certs=true
+cp ~/.kube/config ~/.kube/config.backup            # always back up first
+KUBECONFIG=~/.kube/config:~/Downloads/<yourname>.kubeconfig \
+  kubectl config view --flatten > /tmp/merged && mv /tmp/merged ~/.kube/config
+chmod 600 ~/.kube/config
+rm ~/Downloads/<yourname>.kubeconfig
+```
 
-KUBECONFIG=~/.kube/config kubectl config set-context "$USER_NAME@kubernetes" \
-  --cluster=kubernetes --user="$USER_NAME"
+Then select the context (the admin will tell you its name, `<firstname>-admin@kubernetes`):
 
-KUBECONFIG=~/.kube/config kubectl config use-context "$USER_NAME@kubernetes"
+```bash
+kubectl config get-contexts
+kubectl config use-context <firstname>-admin@kubernetes
 ```
 
-`--embed-certs=true` copies the certificates *into* `~/.kube/config`, so the files in `~/.kube/roboten` are
-only a backup after this point. Keep the `.key` anyway — you need it if you ever rebuild the config.
-
-### 2d. Verify
+### 2b. Verify
 
 With the VPN up:
 
@@ -228,12 +165,11 @@ npx @dooer/dooer-test-env@latest setup
 
 | Symptom | Cause |
 | --- | --- |
-| `dial tcp … i/o timeout` from kubectl | VPN is down — `sudo wg show`, then restart it (1e) |
+| `dial tcp … i/o timeout` from kubectl | VPN is down — `sudo wg show`, then restart it (1b) |
 | `nc` to the API server hangs | Tunnel is up but not carrying traffic; restart it |
-| `error: You must be logged in to the server (Unauthorized)` | Certificate is wrong/expired, or the cluster does not know that CN — back to 2b |
-| `Error from server (Forbidden)` | You *are* authenticated; your user has no permissions bound yet — ask the admin to complete their step 3 |
-| `no token — did the browser login complete?` | The OIDC flow did not finish; make sure you used your `@robo10.com` account |
+| `error: You must be logged in to the server (Unauthorized)` | The certificate in your kubeconfig is expired or unknown to the cluster — ask for a re-issue |
+| `Error from server (Forbidden)` | You *are* authenticated; your user has no permissions bound yet — ask the admin to complete their § 2e (bind permissions) |
 | `wg-quick: 'roboten' already exists` | The interface is already up — `sudo wg-quick down roboten` first |
 
-Certificates are issued for **one year**. When yours expires you repeat section 2 — the admin only has to
-re-sign; your permissions (step 3 on their side) stay in place.
+Certificates are issued for **one year**. When yours expires, ask your admin for a new kubeconfig and
+repeat section 2 — your permissions stay in place, so they only have to re-issue the credential.

package/docs/issuing-access.md

@@ -4,66 +4,133 @@ The other side of [getting-access.md](./getting-access.md). Two independent thin
 
 | | Who does it | What you do |
 | --- | --- | --- |
-| **VPN tunnel** | self-service | make sure they have a Robo10 login; nothing to hand out |
-| **kubectl credential** | needs you | sign their CSR and bind their permissions |
+| **VPN tunnel** | you | create it and send them the config |
+| **kubectl credential** | you | create the certificate, bind permissions, send a kubeconfig |
 
-You need `kubectl` with cluster-admin (`system:masters`) and the VPN up.
+You need a Robo10 token (§1a), `kubectl` with cluster-admin (`system:masters`), and your own VPN up.
 
 ---
 
-## 1. VPN — what you actually have to do
+## 1. VPN — create and hand over a tunnel
 
-Tunnels are **self-service**: any valid Robo10 token can create one, and the config is generated on demand
-by the VPN API. So there is no artefact for you to produce or send.
+You create the tunnel and send the developer its config. They do not need a Robo10 token, which matters:
+a brand-new joiner often has no working login yet, and the VPN API generates the keypair **server-side**
+anyway — the config comes back with the private key in it either way, so there is no custody advantage to
+making them do it.
 
-Your only job is to make sure the person can log in at <https://chat.roboten.com> with their
-**`@robo10.com`** account — that same identity is what the token flow authenticates. If they cannot log in,
-that is an account-provisioning issue in Robo10, not something this guide covers.
+### 1a. Get a Robo10 token (yours)
+
+Opens a browser — log in with **your `@robo10.com` account**:
+
+```bash
+TOKEN="$(go run github.com/strehle/cmdline-openid-client/openid-client@latest \
+  -issuer https://oidc-provider-backend.api.staging.roboten-dev.com \
+  -client_id ro_authentication_cl_id \
+  -port 34466 | awk '/===/ { if (start) nextfile; start = 1; next } start { print }' | jq -r .access_token)"
+
+[ -n "$TOKEN" ] && echo "token acquired" || echo "no token — did the browser login complete?"
+```
+
+Needs `go` and `jq` (`brew install go jq`). Keep using **this same terminal**: `$TOKEN` lives only in this
+shell, and everything below needs it.
+
+<details>
+<summary>Alternative if the Go client will not run</summary>
+
+1. Open <https://chat.roboten.com> and log in.
+2. DevTools → **Application** → **Storage → Cookies**.
+3. Copy the value of the `x-op-token` cookie.
+4. In your terminal: `TOKEN=<the-cookie-value>`
+</details>
+
+### 1b. Create their tunnel
+
+Name it after the person (and their machine if they need more than one) so the list stays readable:
+
+```bash
+NAME="Firstname Lastname"
+curl -sS -H "Authorization: Bearer $TOKEN" \
+  -H 'Content-Type: application/json' \
+  -d "{ \"name\": \"$NAME\" }" \
+  https://vpn.api.staging.roboten-dev.com/v1/vpn-tunnels
+```
+
+The response contains the tunnel's **id**. To find it again later, list them (1d).
+
+### 1c. Download the config and hand it over
+
+```bash
+ID=<the id from the previous step>
+curl -sS -X POST -H "Authorization: Bearer $TOKEN" \
+  https://vpn.api.staging.roboten-dev.com/v1/vpn-tunnels/$ID/actions/get-config \
+  > ~/Downloads/$NAME.conf
+```
+
+> **This file contains a private key.** Send it over a channel you would send a password over — a shared
+> vault entry or an expiring secure link — not email, Slack or a ticket. Tell them to install it and delete
+> the copy you sent, and delete your own copy once they confirm.
 
 Then point them at [getting-access.md § 1](./getting-access.md#1-vpn).
 
-**Never** create the tunnel on their behalf and send them the config: the config embeds a private key, so a
-tunnel they generated themselves is the only one only they hold.
+One tunnel per person per machine: two devices sharing one config will fight over the session, so create a
+second tunnel rather than re-sending the first.
 
-To see who has tunnels (with your own token, as in the dev guide):
+### 1d. List tunnels
 
 ```bash
 curl -sS -H "Authorization: Bearer $TOKEN" https://vpn.api.staging.roboten-dev.com/v1/vpn-tunnels
 ```
 
-To revoke one — `DELETE` is not in the VPN service's own docs, but it works (verified 2026-09-04, returns
-`204` and the tunnel disappears from the list):
+### 1e. Revoke a tunnel
+
+`DELETE` is not in the VPN service's own docs, but it works (verified 2026-09-04 — returns `204` and the
+tunnel disappears from the list):
 
 ```bash
 curl -sS -X DELETE -H "Authorization: Bearer $TOKEN" \
   https://vpn.api.staging.roboten-dev.com/v1/vpn-tunnels/$ID
 ```
 
-That invalidates the tunnel's key server-side, so it is the real off-switch for VPN access when someone
-leaves — do it *and* revoke their kubectl permissions (§3).
+That invalidates the tunnel server-side, so it is the real off-switch for VPN access when someone leaves —
+do it *and* revoke their kubectl permissions (§3).
 
 ---
 
-## 2. kubectl — sign their certificate
+## 2. kubectl — create their credential
 
 The cluster authenticates users with **x509 client certificates** signed by the cluster CA. The username is
 the certificate's **Common Name (CN)**; RBAC is bound to that string.
 
-You never see their private key. They send you a `.csr`; you send back a `.crt`.
+You do all of it and hand over a finished `kubeconfig`.
 
-### 2a. Submit their CSR to the cluster
+> Everything below was verified end to end against the live cluster (2026-09-04) with a throwaway
+> `guidetest-admin`: the resulting kubeconfig read `dooer-production` and `dooer-staging`, including
+> secrets. The test user was then removed.
 
 ```bash
-USER_NAME=<firstname>-admin          # must match the CN in their CSR
-CSR_FILE=~/Downloads/$USER_NAME.csr  # what they sent you
+USER_NAME=<firstname>-admin        # becomes their cluster username
+WORKDIR=$(mktemp -d) && cd "$WORKDIR"
+```
 
+Work in a temp directory — it holds their private key until you hand it over, and you delete it at the end.
+
+### 2a. Generate their key and CSR
+
+```bash
+openssl genrsa -out "$USER_NAME.key" 2048
+openssl req -new -key "$USER_NAME.key" -out "$USER_NAME.csr" -subj "/CN=$USER_NAME"
+```
+
+### 2b. Submit it as a CertificateSigningRequest
+
+```bash
 cat <<EOF | kubectl apply -f -
 apiVersion: certificates.k8s.io/v1
 kind: CertificateSigningRequest
 metadata:
   name: $USER_NAME
 spec:
-  request: $(base64 -i "$CSR_FILE" | tr -d '\n')
+  request: $(base64 -i "$USER_NAME.csr" | tr -d '\n')
   signerName: kubernetes.io/kube-apiserver-client
   expirationSeconds: 31536000   # 1 year
   usages:
@@ -71,15 +138,10 @@ spec:
 EOF
 ```
 
-Sanity-check the CN is what you expect before approving — the CN is the identity you are about to grant
-admin to:
-
-```bash
-openssl req -in "$CSR_FILE" -noout -subject
-# subject=CN=<firstname>-admin
-```
+If the name already exists (a renewal), delete the old object first:
+`kubectl delete csr "$USER_NAME" --ignore-not-found`.
 
-### 2b. Approve and extract the certificate
+### 2c. Approve and extract the certificate
 
 ```bash
 kubectl certificate approve "$USER_NAME"
@@ -90,18 +152,16 @@ openssl x509 -in "$USER_NAME.crt" -noout -subject -issuer -dates
 
 Expect `subject=CN=<firstname>-admin`, `issuer=CN=kubernetes`, and a one-year window.
 
-If `.status.certificate` is empty, the signer has not run yet — wait a couple of seconds and repeat. If it
-stays empty, the CSR was approved but not signed; check `kubectl describe csr "$USER_NAME"`.
-
-### 2c. Extract the cluster CA
+If `.status.certificate` is empty the signer has not run yet — wait a couple of seconds and repeat. If it
+stays empty, check `kubectl describe csr "$USER_NAME"`.
 
-The same file for everyone:
+### 2d. Extract the cluster CA
 
 ```bash
 kubectl config view --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d > ca.crt
 ```
 
-### 2d. Bind permissions
+### 2e. Bind permissions
 
 This is what makes the certificate useful — without it they authenticate but can do nothing. These are the
 same five ClusterRoles the existing admins (`jimmy-admin`, `sam-admin`, `trajko-admin`) hold:
@@ -125,25 +185,54 @@ The declarative equivalent lives in
 is enough for the cluster, but that file is the record of who has access — **add the new user there and
 commit it**, or the next person reading it will get a false picture.
 
-### 2e. Hand back
+On a renewal, skip this step: the bindings are attached to the username, not to the certificate.
+
+### 2f. Assemble the kubeconfig
 
-Send them three things (none are secret — the secret half never left their machine):
+`--embed-certs=true` inlines the key and certificates, so the file you hand over is self-contained:
 
-1. `<firstname>-admin.crt`
-2. `ca.crt`
-3. the API server URL — currently `https://k8s.roboten-infra.com:64430`
+```bash
+SERVER=https://k8s.roboten-infra.com:64430
+KC="$WORKDIR/$USER_NAME.kubeconfig"
+
+KUBECONFIG="$KC" kubectl config set-cluster kubernetes \
+  --server="$SERVER" --certificate-authority=ca.crt --embed-certs=true
 
-Then they follow [getting-access.md § 2c](./getting-access.md#2c-assemble-your-kubeconfig).
+KUBECONFIG="$KC" kubectl config set-credentials "$USER_NAME" \
+  --client-certificate="$USER_NAME.crt" --client-key="$USER_NAME.key" --embed-certs=true
 
-### 2f. Verify before you tell them it is done
+KUBECONFIG="$KC" kubectl config set-context "$USER_NAME@kubernetes" \
+  --cluster=kubernetes --user="$USER_NAME"
+
+KUBECONFIG="$KC" kubectl config use-context "$USER_NAME@kubernetes"
+```
+
+### 2g. Verify it before handing it over
+
+Test the actual file, not just the RBAC — with your own VPN up:
 
 ```bash
-kubectl get clusterrolebinding | grep "$USER_NAME"     # expect 5 rows
-kubectl auth can-i get pods -n dooer-production --as "$USER_NAME"
-kubectl auth can-i get secrets -n dooer-staging --as "$USER_NAME"
+KUBECONFIG="$KC" kubectl auth whoami                                  # Username: <firstname>-admin
+KUBECONFIG="$KC" kubectl get pods -n dooer-staging | head -3
+KUBECONFIG="$KC" kubectl get pods -n dooer-production | head -3
+KUBECONFIG="$KC" kubectl auth can-i get secrets -n dooer-staging      # yes
 ```
 
-`--as` impersonates the user, so you are testing the real RBAC without needing their certificate.
+If `whoami` works but the reads say `Forbidden`, step 2e did not take.
+
+### 2h. Hand it over, then clean up
+
+> **The kubeconfig contains their private key.** Send it the same way as the VPN config — a shared vault
+> entry or an expiring secure link, never email, Slack or a ticket.
+
+Tell them the context name (`<firstname>-admin@kubernetes`) and point them at
+[getting-access.md § 2](./getting-access.md#2-kubectl-access).
+
+Once they confirm it works, destroy your copy — you are holding their key until you do:
+
+```bash
+rm -rf "$WORKDIR"
+```
 
 ---
 
@@ -169,9 +258,11 @@ Also remove them from `clusterrole-admin.yaml` and commit.
 
 ## Renewals
 
-A certificate expiring is routine: the user repeats [getting-access.md § 2a–2c](./getting-access.md#2a-generate-your-key-and-csr)
-and you repeat **2a–2c and 2e** here. Skip 2d — their ClusterRoleBindings are bound to the username, not to
-the certificate, so they survive a re-issue untouched.
+A certificate expiring is routine. Repeat **§2a–2d and 2f–2h** and send them a fresh kubeconfig; they
+re-run [getting-access.md § 2](./getting-access.md#2-kubectl-access).
+
+Skip **2e** — ClusterRoleBindings are bound to the username, not to the certificate, so they survive a
+re-issue untouched.
 
 Delete the old CSR object first, or the new one collides on the name:
 

package/lib/cli.js

@@ -15,6 +15,8 @@ module.exports = async function cli() {
     .command(require('./command/service')) // service start|stop|restart|deploy|local|unlocal|version
     .command(require('./command/db')) // db build|pull|snapshot|rollback
     .command(require('./command/customer')) // customer copy|purge
+    .command(require('./command/user')) // user search|get|create|partners
+    .command(require('./command/partner')) // partner list|users|assign|unassign
     .command(require('./command/shred')) // shred (localhost only)
     .command(require('./command/bankid')) // bankid pull|status|clear (staging certs → keychain)
     .command(require('./command/validation')) // validation on|off|status (output-schema checks)

package/lib/command/partner.js

@@ -0,0 +1,120 @@
+const chalk = require('chalk')
+const u = require('../users')
+const { targetOptions, writeOptions, label, printTable } = require('./target')
+
+module.exports = {
+  command: 'partner <command>',
+  describe: 'list partners and manage their user membership (local env by default)',
+  builder: (y) =>
+    y
+      .command({
+        command: 'list',
+        describe: 'list every partner in the environment',
+        builder: targetOptions,
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          const rows = await u.withDb(ns, (db) => u.listPartners(db))
+          console.log(chalk.bold(`\n${rows.length} partner(s) in ${label(ns)}\n`))
+          printTable(rows, [
+            ['NAME', (r) => r.name],
+            ['DOMAIN', (r) => r.domain],
+            ['USERS', (r) => r.users],
+            ['STATUS', (r) => r.status],
+            ['DEFAULT', (r) => (r.isDefaultPartner ? 'yes' : '')],
+            ['ID', (r) => r.id],
+          ])
+          console.log()
+        },
+      })
+      .command({
+        command: 'users <partner>',
+        describe: 'list the users of one partner and their level',
+        builder: (y2) =>
+          targetOptions(y2).positional('partner', { type: 'string', describe: 'partner id, name or domain' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          const { partner, rows } = await u.withDb(ns, async (db) => {
+            const partner = await u.findPartner(db, argv.partner)
+            const { rows } = await db.query(
+              `SELECT us.users_pk AS id, us.email, us.first_name, us.last_name,
+                      pu.role AS level, pu.status, pu."defaultRepresentative"
+               FROM "service_accounts"."partnerUser" pu
+               JOIN "service_accounts".users us ON us.users_pk = pu."userId"
+               WHERE pu."partnerId" = $1 ORDER BY us.email`,
+              [partner.id]
+            )
+            return { partner, rows }
+          })
+          console.log(chalk.bold(`\n${partner.name} — ${rows.length} user(s)`) + chalk.gray(`  (${label(ns)})\n`))
+          printTable(rows, [
+            ['EMAIL', (r) => r.email],
+            ['NAME', (r) => `${r.first_name} ${r.last_name}`],
+            ['LEVEL', (r) => r.level],
+            ['STATUS', (r) => r.status],
+            ['DEFAULT REP', (r) => (r.defaultRepresentative ? 'yes' : 'no')],
+            ['ID', (r) => r.id],
+          ])
+          console.log()
+        },
+      })
+      .command({
+        command: 'assign <user> <partner>',
+        describe: 'add a user to a partner (or change their level). Dry-run by default.',
+        builder: (y2) =>
+          writeOptions(y2)
+            .positional('user', { type: 'string', describe: 'user id or email' })
+            .positional('partner', { type: 'string', describe: 'partner id, name or domain' })
+            .option('level', { choices: u.PARTNER_LEVELS, default: 'member', describe: 'level within the partner' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          u.guardWrite(ns, argv)
+          const { user, partner, res } = await u.withDb(ns, async (db) => {
+            const user = await u.findUser(db, argv.user)
+            const partner = await u.findPartner(db, argv.partner)
+            const res = await u.assignPartner(db, { user, partner, level: argv.level, execute: argv.execute })
+            return { user, partner, res }
+          })
+          const what =
+            res.previous && res.previous !== argv.level
+              ? `level ${res.previous} → ${argv.level}`
+              : res.previous
+              ? `already a ${argv.level} (no change)`
+              : `added as ${argv.level}`
+          console.log(
+            (argv.execute ? chalk.green('\n' + what) : chalk.yellow(`\nDRY RUN — would be ${what}`)) +
+              `: ${user.email} @ ${partner.name}` +
+              chalk.gray(`  (${label(ns)})`)
+          )
+          if (!argv.execute) console.log(chalk.gray('  Re-run with --execute to apply.'))
+          console.log()
+        },
+      })
+      .command({
+        command: 'unassign <user> <partner>',
+        describe: 'remove a user from a partner. Dry-run by default.',
+        builder: (y2) =>
+          writeOptions(y2)
+            .positional('user', { type: 'string', describe: 'user id or email' })
+            .positional('partner', { type: 'string', describe: 'partner id, name or domain' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          u.guardWrite(ns, argv)
+          const { user, partner, res } = await u.withDb(ns, async (db) => {
+            const user = await u.findUser(db, argv.user)
+            const partner = await u.findPartner(db, argv.partner)
+            const res = await u.unassignPartner(db, { user, partner, execute: argv.execute })
+            return { user, partner, res }
+          })
+          console.log(
+            (argv.execute ? chalk.green('\nremoved') : chalk.yellow('\nDRY RUN — would remove')) +
+              ` ${user.email} (${res.level}) from ${partner.name}` +
+              chalk.gray(`  (${label(ns)})`)
+          )
+          if (!argv.execute) console.log(chalk.gray('  Re-run with --execute to apply.'))
+          console.log()
+        },
+      })
+      .demandCommand(1, 'Use: partner list | partner users | partner assign | partner unassign')
+      .strict(),
+  handler: () => {},
+}

package/lib/command/target.js

@@ -0,0 +1,31 @@
+const chalk = require('chalk')
+
+// Shared bits for the environment-addressed commands (user / partner). The LOCAL env is the default —
+// these are day-to-day local-dev commands — and a k8s namespace is the deliberate opt-in.
+const targetOptions = (y) =>
+  y
+    .option('target-local', { type: 'boolean', describe: 'act on the LOCAL env (default)' })
+    .option('target-namespace', { type: 'string', describe: 'act on a k8s namespace instead, e.g. dooer-staging' })
+
+const writeOptions = (y) =>
+  targetOptions(y)
+    .option('confirm-production', { type: 'boolean', describe: 'REQUIRED to write to dooer-production' })
+    .option('execute', { type: 'boolean', default: false, describe: 'actually write (default: dry-run)' })
+
+const label = (ns) => (ns === 'local' ? 'local env' : `namespace ${ns}`)
+
+// Minimal column-aligned printer: `columns` is [[header, rowFn], …]. Values are stringified, null shown
+// as a dim dash so an empty column still lines up.
+function printTable(rows, columns) {
+  if (!rows.length) {
+    console.log(chalk.gray('  (none)'))
+    return
+  }
+  const cell = (v) => (v === null || v === undefined || v === '' ? '-' : String(v))
+  const body = rows.map((r) => columns.map(([, fn]) => cell(fn(r))))
+  const widths = columns.map(([h], i) => Math.max(h.length, ...body.map((b) => b[i].length)))
+  console.log('  ' + columns.map(([h], i) => chalk.bold(h.padEnd(widths[i]))).join('  '))
+  for (const b of body) console.log('  ' + b.map((v, i) => v.padEnd(widths[i])).join('  '))
+}
+
+module.exports = { targetOptions, writeOptions, label, printTable }

package/lib/command/user.js

@@ -0,0 +1,172 @@
+const chalk = require('chalk')
+const u = require('../users')
+const { targetOptions, writeOptions, label, printTable } = require('./target')
+
+const date = (d) => (d ? new Date(d).toISOString().slice(0, 10) : null)
+
+module.exports = {
+  command: 'user <command>',
+  describe: 'find, inspect and create users (local env by default)',
+  builder: (y) =>
+    y
+      .command({
+        command: 'search [query]',
+        describe: 'find users by email, name, personnummer or id (no query = the most recent users)',
+        builder: (y2) =>
+          targetOptions(y2)
+            .positional('query', { type: 'string', describe: 'substring to match' })
+            .option('role', { choices: u.USER_ROLES, describe: 'only users of this role' })
+            .option('limit', { type: 'number', default: 20, describe: 'max rows' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          const rows = await u.withDb(ns, (db) =>
+            u.searchUsers(db, { query: argv.query, role: argv.role, limit: argv.limit })
+          )
+          console.log(
+            chalk.bold(`\n${rows.length} user(s) in ${label(ns)}`) +
+              (argv.query ? chalk.gray(` matching "${argv.query}"`) : '') +
+              '\n'
+          )
+          printTable(rows, [
+            ['ID', (r) => r.id],
+            ['EMAIL', (r) => r.email],
+            ['NAME', (r) => `${r.first_name} ${r.last_name}`],
+            ['ROLE', (r) => r.role],
+            ['CREATED', (r) => date(r.inserted_at)],
+            ['STATUS', (r) => (r.inactivated_at ? `inactivated ${date(r.inactivated_at)}` : 'active')],
+          ])
+          console.log()
+        },
+      })
+      .command({
+        command: 'get <user>',
+        describe: 'show one user (by id or email) and the partners they belong to',
+        builder: (y2) => targetOptions(y2).positional('user', { type: 'string', describe: 'user id or email' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          const { user, partners } = await u.withDb(ns, async (db) => {
+            const user = await u.findUser(db, argv.user)
+            return { user, partners: await u.partnersForUser(db, user.id) }
+          })
+          console.log(chalk.bold(`\n${user.first_name} ${user.last_name}`) + chalk.gray(`  (${label(ns)})\n`))
+          const line = (k, v) => console.log(`  ${k.padEnd(14)}${v === null || v === undefined ? '-' : v}`)
+          line('id', user.id)
+          line(
+            'email',
+            `${user.email}${user.email_verified ? chalk.gray(' (verified)') : chalk.yellow(' (unverified)')}`
+          )
+          line('role', user.role)
+          line('personnummer', user.personnummer)
+          line('password', user.has_password ? 'set' : chalk.yellow('none — cannot log in with a password'))
+          line('language', user.language)
+          line('created', date(user.inserted_at))
+          line('status', user.inactivated_at ? chalk.yellow(`inactivated ${date(user.inactivated_at)}`) : 'active')
+          if (user.internal) line('internal', 'yes')
+          console.log(chalk.bold(`\n  partners (${partners.length})`))
+          printTable(partners, [
+            ['PARTNER', (r) => r.name],
+            ['LEVEL', (r) => r.level],
+            ['STATUS', (r) => r.status],
+            ['LAST LOGIN', (r) => date(r.lastLoginAt)],
+            ['ID', (r) => r.id],
+          ])
+          console.log()
+        },
+      })
+      .command({
+        command: 'create',
+        describe: 'create a user (password generated unless given). Dry-run by default.',
+        builder: (y2) =>
+          writeOptions(y2)
+            .option('email', { type: 'string', demandOption: true, describe: 'email address (the login)' })
+            .option('password', { type: 'string', describe: 'password to set (default: generated, printed once)' })
+            .option('role', { choices: u.USER_ROLES, default: 'hi', describe: 'user role at dooer' })
+            .option('personnummer', { type: 'string', describe: 'Swedish personnummer, 10 or 12 digits' })
+            .option('first-name', { type: 'string', describe: 'default: derived from the email' })
+            .option('last-name', { type: 'string', describe: 'default: derived from the email' })
+            .option('partner', { type: 'string', describe: 'also add to this partner (id, name or domain)' })
+            .option('level', { choices: u.PARTNER_LEVELS, default: 'member', describe: 'level in --partner' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          u.guardWrite(ns, argv)
+          const derived = u.namesFromEmail(argv.email)
+          const firstName = argv.firstName || derived.firstName
+          const lastName = argv.lastName || derived.lastName
+          const password = argv.password || u.generatePassword()
+          const generated = !argv.password
+          const personnummer = argv.personnummer ? u.normalizePersonnummer(argv.personnummer) : null
+
+          const res = await u.withDb(ns, async (db) => {
+            // Resolve the partner BEFORE creating anything, so a typo fails without leaving a half-made user.
+            const partner = argv.partner ? await u.findPartner(db, argv.partner) : null
+            if (partner && argv.role !== 'hi') {
+              throw new Error(`--partner needs a "hi" user; role "${argv.role}" cannot belong to a partner`)
+            }
+            const created = await u.createUser(db, {
+              email: argv.email,
+              password,
+              role: argv.role,
+              personnummer,
+              firstName,
+              lastName,
+              execute: argv.execute,
+            })
+            // Only on --execute: a dry-run has no user id to attach the membership to, and the partner
+            // itself (plus the hi-only rule) has already been validated above.
+            if (partner && argv.execute) {
+              await u.assignPartner(db, {
+                user: { id: created.id, email: argv.email, role: argv.role },
+                partner,
+                level: argv.level,
+                execute: argv.execute,
+              })
+            }
+            return { created, partner }
+          })
+
+          console.log(
+            (argv.execute ? chalk.green('\ncreated user') : chalk.yellow('\nDRY RUN — nothing written')) +
+              chalk.gray(`  (${label(ns)})\n`)
+          )
+          const line = (k, v) => console.log(`  ${k.padEnd(14)}${v}`)
+          if (argv.execute) line('id', res.created.id)
+          line('email', argv.email)
+          line('name', `${firstName} ${lastName}`)
+          line('role', argv.role)
+          if (personnummer) line('personnummer', personnummer)
+          line('password', chalk.bold(password) + (generated ? chalk.gray('  (generated)') : ''))
+          if (res.partner) line('partner', `${res.partner.name} — level ${argv.level}`)
+          if (generated && argv.execute) {
+            console.log(chalk.gray('\n  The password is stored as a bcrypt hash — this is the only time it is shown.'))
+          }
+          if (!argv.execute) console.log(chalk.gray('\n  Re-run with --execute to create it.'))
+          console.log()
+        },
+      })
+      .command({
+        command: 'partners <user>',
+        describe: 'list the partners a user belongs to, and at what level',
+        builder: (y2) => targetOptions(y2).positional('user', { type: 'string', describe: 'user id or email' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          const { user, partners } = await u.withDb(ns, async (db) => {
+            const user = await u.findUser(db, argv.user)
+            return { user, partners: await u.partnersForUser(db, user.id) }
+          })
+          console.log(
+            chalk.bold(`\n${user.email} belongs to ${partners.length} partner(s)`) + chalk.gray(`  (${label(ns)})\n`)
+          )
+          printTable(partners, [
+            ['PARTNER', (r) => r.name],
+            ['LEVEL', (r) => r.level],
+            ['STATUS', (r) => r.status],
+            ['DEFAULT REP', (r) => (r.defaultRepresentative ? 'yes' : 'no')],
+            ['ID', (r) => r.id],
+          ])
+          console.log()
+        },
+      })
+      .demandCommand(1, 'Use: user search | user get | user create | user partners')
+      .strict(),
+  handler: () => {},
+}

package/lib/users.js

@@ -0,0 +1,285 @@
+// users.js — user + partner-membership operations against a target environment (the local env by
+// default, or any k8s namespace). Reads and writes go straight to the service_accounts schema over the
+// same self-healing connection the copy engine uses (lib/engine/seed.js `connect`), which already knows
+// how to reach both the local Postgres and a namespace's dooer-database.
+//
+// Why SQL and not the service-accounts HTTP API:
+//   * there is NO user-create route at all — users only ever appear via the signup flows, which also
+//     create a company; that is exactly what we do NOT want here.
+//   * nothing subscribes to a user-created event (checked across every service's eventStream.handle),
+//     so a plain INSERT leaves no consumer un-notified. Contrast `customer new`, which goes through the
+//     ledger API precisely because service-closing builds its periods off the emitted event.
+//   * the partner-membership route (PUT /v1/partners/:partnerId/users/:userId) is a bare upsert with one
+//     guard — the user must be of type `hi`. We reproduce that guard below rather than dropping it, so
+//     the CLI cannot create rows the product would have refused.
+const crypto = require('crypto')
+const bcrypt = require('bcryptjs')
+const { connect } = require('./engine/seed')
+
+const SCHEMA = 'service_accounts'
+const T_USERS = `"${SCHEMA}".users`
+const T_PARTNER = `"${SCHEMA}".partner`
+const T_PARTNER_USER = `"${SCHEMA}"."partnerUser"`
+
+// service_accounts.user_roles_at_dooer. `hi` = the accounting-professional user a partner can employ;
+// `hiab` exists in the table but is legacy — not offered as a choice.
+const USER_ROLES = ['hi', 'customer', 'admin']
+// service_accounts."partnerUser_role_enum" — the "level" within a partner.
+const PARTNER_LEVELS = ['member', 'admin']
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+// ── target environment ───────────────────────────────────────────────────────
+// Default is the LOCAL env. `local` is a pseudo-namespace inside the engine, not a k8s one, so it is
+// addressed with --target-local and rejected as a --target-namespace value (same split as customer copy).
+function targetOf(argv) {
+  if (argv.targetNamespace === 'local') {
+    throw new Error('use --target-local for the local env, not --target-namespace local')
+  }
+  if (argv.targetLocal && argv.targetNamespace) {
+    throw new Error('pass either --target-local or --target-namespace, not both')
+  }
+  return argv.targetNamespace || 'local'
+}
+
+// Writing users into the production cluster is possible but must never be a slip of the shell.
+function guardWrite(namespace, argv) {
+  if (namespace === 'dooer-production' && !argv.confirmProduction) {
+    throw new Error('refusing to write to dooer-production without --confirm-production')
+  }
+}
+
+// ── password ────────────────────────────────────────────────────────────────
+// Ambiguous glyphs (0/O, 1/l/I) are left out — these get read off a screen and typed into a login form.
+const ALPHABET = 'abcdefghjkmnpqrstuvwxyzABCDEFGHJKMNPQRSTUVWXYZ23456789'
+
+function generatePassword(groups = 4, size = 5) {
+  const chunk = () => Array.from({ length: size }, () => ALPHABET[crypto.randomInt(ALPHABET.length)]).join('')
+  return Array.from({ length: groups }, chunk).join('-')
+}
+
+// service-accounts' own rule (lib/verify-password.js) is length >= 8 and nothing else; enforce exactly
+// that so a password this CLI accepts is a password the login accepts.
+function hashPassword(password) {
+  if (password.length < 8) throw new Error('password must be at least 8 characters (service-accounts rule)')
+  // bcryptjs, not bcrypt: identical wire format, but pure JS — a native build would break `npx`.
+  // get-login-user.js rewrites a stored `$2b$` prefix to `$2a$` before comparing, so either emits fine.
+  return bcrypt.hashSync(password, 10)
+}
+
+// ── personnummer ────────────────────────────────────────────────────────────
+// Stored as 12 bare digits (verified against staging: every non-null id_number is length 12).
+function normalizePersonnummer(input) {
+  const digits = String(input).replace(/\D/g, '')
+  if (digits.length === 12) return digits
+  if (digits.length === 10) {
+    // YY > current two-digit year means last century — the usual short-form expansion.
+    const yy = Number(digits.slice(0, 2))
+    const nowYY = new Date().getFullYear() % 100
+    return (yy > nowYY ? '19' : '20') + digits
+  }
+  throw new Error(`personnummer must be 10 or 12 digits (got ${digits.length}): ${input}`)
+}
+
+// ── name defaults ───────────────────────────────────────────────────────────
+// first_name/last_name are NOT NULL with no default. Derive something sane from the address so the
+// common case is just `--email`.
+function namesFromEmail(email) {
+  const local = email.split('@')[0]
+  const parts = local.split(/[._-]+/).filter(Boolean)
+  const cap = (s) => s.charAt(0).toUpperCase() + s.slice(1)
+  return {
+    firstName: cap(parts[0] || 'Test'),
+    lastName: cap(parts.slice(1).join(' ') || 'User'),
+  }
+}
+
+// ── reads ───────────────────────────────────────────────────────────────────
+const USER_COLUMNS = `users_pk AS id, email, first_name, last_name,
+  fk_user_roles_at_dooer_pk AS role, id_number AS personnummer, email_verified,
+  inactivated_at, internal, language, inserted_at, (password_hash IS NOT NULL) AS has_password`
+
+// A user is addressed by uuid or by email — nobody remembers uuids.
+async function findUser(db, ref) {
+  const byId = UUID_RE.test(ref)
+  const { rows } = await db.query(
+    `SELECT ${USER_COLUMNS} FROM ${T_USERS} WHERE ${byId ? 'users_pk = $1' : 'lower(email) = lower($1)'}
+     ORDER BY inserted_at`,
+    [ref]
+  )
+  if (!rows.length) throw new Error(`no user matching "${ref}"`)
+  if (rows.length > 1) {
+    // email is unique per ROLE (users_email_fk_user_roles_at_dooer_pk_key), so one address can legitimately
+    // exist as both a `customer` and an `hi`. Make the caller say which.
+    throw new Error(
+      `"${ref}" matches ${rows.length} users (one per role: ${rows.map((r) => r.role).join(', ')}) — ` +
+        `address it by id: ${rows.map((r) => r.id).join(', ')}`
+    )
+  }
+  return rows[0]
+}
+
+async function searchUsers(db, { query, role, limit }) {
+  const where = []
+  const params = []
+  if (query) {
+    params.push(`%${query}%`)
+    where.push(`(email ILIKE $${params.length} OR first_name ILIKE $${params.length}
+                 OR last_name ILIKE $${params.length} OR id_number ILIKE $${params.length}
+                 OR users_pk::text ILIKE $${params.length})`)
+  }
+  if (role) {
+    params.push(role)
+    where.push(`fk_user_roles_at_dooer_pk = $${params.length}`)
+  }
+  params.push(limit)
+  const { rows } = await db.query(
+    `SELECT ${USER_COLUMNS} FROM ${T_USERS}
+     ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+     ORDER BY inserted_at DESC LIMIT $${params.length}`,
+    params
+  )
+  return rows
+}
+
+async function listPartners(db) {
+  const { rows } = await db.query(
+    `SELECT p.id, p.name, p.domain, p.status, p."isDefaultPartner",
+            count(pu.id)::int AS users
+     FROM ${T_PARTNER} p LEFT JOIN ${T_PARTNER_USER} pu ON pu."partnerId" = p.id
+     GROUP BY p.id ORDER BY p.name`
+  )
+  return rows
+}
+
+// Same shape as GET /v1/partners/views/by-user/:userId, plus the membership level.
+async function partnersForUser(db, userId) {
+  const { rows } = await db.query(
+    `SELECT p.id, p.name, p.domain, pu.role AS level, pu.status,
+            pu."inProduction", pu."defaultRepresentative", pu."lastLoginAt"
+     FROM ${T_PARTNER_USER} pu JOIN ${T_PARTNER} p ON p.id = pu."partnerId"
+     WHERE pu."userId" = $1 ORDER BY p.name`,
+    [userId]
+  )
+  return rows
+}
+
+async function findPartner(db, ref) {
+  const byId = UUID_RE.test(ref)
+  const { rows } = await db.query(
+    `SELECT id, name, domain, status FROM ${T_PARTNER}
+     WHERE ${byId ? 'id = $1' : '(lower(name) = lower($1) OR lower(domain) = lower($1))'} ORDER BY name`,
+    [ref]
+  )
+  if (!rows.length) throw new Error(`no partner matching "${ref}" (see: dooer-test-env partner list)`)
+  if (rows.length > 1) {
+    throw new Error(`"${ref}" matches ${rows.length} partners — address it by id: ${rows.map((r) => r.id).join(', ')}`)
+  }
+  return rows[0]
+}
+
+// ── writes ──────────────────────────────────────────────────────────────────
+async function createUser(db, { email, password, role, personnummer, firstName, lastName, execute }) {
+  // Enforced by users_email_fk_user_roles_at_dooer_pk_key — check first so the failure is a sentence
+  // rather than a constraint-violation dump.
+  const {
+    rows: clash,
+  } = await db.query(
+    `SELECT users_pk FROM ${T_USERS} WHERE lower(email) = lower($1) AND fk_user_roles_at_dooer_pk = $2`,
+    [email, role]
+  )
+  if (clash.length) throw new Error(`a "${role}" user with email ${email} already exists (${clash[0].users_pk})`)
+
+  const hash = hashPassword(password)
+  const apiUuid = crypto.randomUUID()
+  // email_verified: these are test accounts — an unverified address puts a verification wall in front of
+  // every flow you actually wanted to exercise.
+  const values = [role, firstName, lastName, email, personnummer || null, hash, apiUuid]
+  // No id yet on a dry-run — the caller must not go on to use it as one (a placeholder string blew up the
+  // partner lookup's uuid parameter).
+  if (!execute) return { id: null, apiUuid }
+  const { rows } = await db.query(
+    `INSERT INTO ${T_USERS}
+       (fk_user_roles_at_dooer_pk, first_name, last_name, email, id_number, password_hash, api_uuid,
+        email_verified)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, true)
+     RETURNING users_pk AS id, api_uuid`,
+    values
+  )
+  return { id: rows[0].id, apiUuid: rows[0].api_uuid }
+}
+
+async function assignPartner(db, { user, partner, level, execute }) {
+  // The guard from setPartnerUser: partner membership is for accounting professionals only. Without it
+  // the CLI would happily write a row that HQ then trips over.
+  if (user.role !== 'hi') {
+    throw new Error(
+      `only "hi" users can belong to a partner (${user.email} is "${user.role}") — ` +
+        `this is the same invalid-user-type check the service-accounts API applies`
+    )
+  }
+  const {
+    rows: existing,
+  } = await db.query(`SELECT role AS level FROM ${T_PARTNER_USER} WHERE "partnerId" = $1 AND "userId" = $2`, [
+    partner.id,
+    user.id,
+  ])
+  if (!execute) return { previous: existing[0] ? existing[0].level : null }
+  const { rows } = await db.query(
+    `INSERT INTO ${T_PARTNER_USER} ("partnerId", "userId", role, status)
+     VALUES ($1, $2, $3, 'enabled')
+     ON CONFLICT ("partnerId", "userId")
+       DO UPDATE SET role = EXCLUDED.role, status = EXCLUDED.status, "updatedAt" = now()
+     RETURNING role AS level`,
+    [partner.id, user.id, level]
+  )
+  return { previous: existing[0] ? existing[0].level : null, level: rows[0].level }
+}
+
+async function unassignPartner(db, { user, partner, execute }) {
+  const {
+    rows: existing,
+  } = await db.query(`SELECT role AS level FROM ${T_PARTNER_USER} WHERE "partnerId" = $1 AND "userId" = $2`, [
+    partner.id,
+    user.id,
+  ])
+  if (!existing.length) throw new Error(`${user.email} is not a member of ${partner.name}`)
+  if (execute) {
+    await db.query(`DELETE FROM ${T_PARTNER_USER} WHERE "partnerId" = $1 AND "userId" = $2`, [partner.id, user.id])
+  }
+  return { level: existing[0].level }
+}
+
+// Every command opens one connection and closes it, so the CLI never leaves a socket to the cluster open.
+async function withDb(namespace, fn) {
+  const db = await connect(namespace)
+  try {
+    return await fn(db)
+  } finally {
+    try {
+      await db.client.end()
+    } catch (_) {
+      /* already gone */
+    }
+  }
+}
+
+module.exports = {
+  USER_ROLES,
+  PARTNER_LEVELS,
+  targetOf,
+  guardWrite,
+  generatePassword,
+  hashPassword,
+  normalizePersonnummer,
+  namesFromEmail,
+  findUser,
+  searchUsers,
+  listPartners,
+  partnersForUser,
+  findPartner,
+  createUser,
+  assignPartner,
+  unassignPartner,
+  withDb,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dooer/dooer-test-env",
-  "version": "1.12.0",
+  "version": "1.14.0",
   "description": "Run the whole Dooer backend locally (staging DB minus customers), copy/purge customers between environments, and shred — one CLI.",
   "license": "UNLICENSED",
   "repository": "Dooer/cli-dooer-test-env",
@@ -27,6 +27,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.600.0",
     "@dooer/package-info": "^1.6.7",
+    "bcryptjs": "^3.0.3",
     "chalk": "^4.1.2",
     "js-yaml": "^3.14.1",
     "pg": "^8.23.0",

package/readme.md

@@ -53,6 +53,8 @@ db roles                                          (re)create per-service DB role
 db snapshot <name> | db rollback <name>          local restore points
 customer new "<name>" --owner <userId> --execute empty functional account: company + Owner + subscriptions + partner dooer
 customer copy | customer purge                    copy / delete one org between environments (emails anonymized)
+user search | get | create | partners             find/inspect/create users (local env unless --target-namespace)
+partner list | users | assign | unassign          partners and who belongs to them, at which level
 shred                                             anonymize the LOCAL db (localhost only)
 bankid pull | status | clear                      BankID cert (staging → keychain), used by service-accounts
 validation on | off | status                      output-schema validation (default OFF, like staging/live)
@@ -109,13 +111,66 @@ reads (`fiscalYear`, `hasVatRegistration`, `hasCompanyTax`, `hasEmployeeRegistra
 `vatPeriod`/`vatDue`). `--no-fiscal-year` leaves all of that blank.
 
 The owner must be a **`customer`** user — a `hi`/admin owner cannot accept Terms of Service and the command
-warns you. Find one with:
+warns you. Find one:
 
-```sql
-SELECT users_pk, email FROM service_accounts.users
-WHERE fk_user_roles_at_dooer_pk = 'customer' AND inactivated_at IS NULL LIMIT 5;
+```bash
+npx @dooer/dooer-test-env@latest user search --role customer
+```
+
+### Create a user you can actually log in as
+
+```bash
+# an accounting professional (role `hi`) in the local env, password generated and printed once
+npx @dooer/dooer-test-env@latest user create --email anna@dooer.com --execute
+
+# …a customer instead, with your own password and a personnummer
+npx @dooer/dooer-test-env@latest user create --email kim@example.com \
+  --role customer --password 'hunter2hunter2' --personnummer 19900101-1234 --execute
+
+# …or an `hi` user placed straight into a partner
+npx @dooer/dooer-test-env@latest user create --email anna@dooer.com \
+  --partner "Dooer Devteam" --level admin --execute
+```
+
+The password is stored the way signup stores it (bcrypt, cost 10), so it works on the ordinary
+email+password login — no BankID needed. It is shown **once**; there is no way to read it back. `--role`
+defaults to `hi` (other choices: `customer`, `admin`), names default to something derived from the address,
+and the account is created with its email pre-verified so no verification wall gets in the way.
+
+Look users up by email **or** id, and see where they belong:
+
+```bash
+npx @dooer/dooer-test-env@latest user search anna          # email, name, personnummer or id
+npx @dooer/dooer-test-env@latest user get anna@dooer.com   # details + partner memberships
 ```
 
+### Partners and who belongs to them
+
+```bash
+npx @dooer/dooer-test-env@latest partner list                        # every partner + user counts
+npx @dooer/dooer-test-env@latest partner users "Dooer Devteam"       # its users and their level
+
+# add / promote / remove (a partner is addressable by id, name or domain)
+npx @dooer/dooer-test-env@latest partner assign anna@dooer.com "Dooer Devteam" --level admin --execute
+npx @dooer/dooer-test-env@latest partner unassign anna@dooer.com "Dooer Devteam" --execute
+```
+
+`--level` is the membership level inside the partner (`member` or `admin`) — not the same thing as the
+user's `--role` at Dooer. Only **`hi`** users can belong to a partner; the CLI applies the same
+`invalid-user-type` check the service-accounts API does rather than writing a row HQ would choke on.
+
+### Look at (or fix) users in a real environment
+
+These commands default to the local env. Point them at a cluster with `--target-namespace`:
+
+```bash
+npx @dooer/dooer-test-env@latest user search someone@dooer.com --target-namespace dooer-staging
+npx @dooer/dooer-test-env@latest partner list --target-namespace dooer-production
+```
+
+Writes there are still dry-run until `--execute`, and `dooer-production` additionally demands
+`--confirm-production`.
+
 ### Copy a real customer into the local env
 
 `--target-local` addresses this stack (Postgres on 55432 + MinIO); the source can be any k8s namespace