@dooer/dooer-test-env 1.13.0 → 1.14.0

package/lib/cli.js

@@ -15,6 +15,8 @@ module.exports = async function cli() {
     .command(require('./command/service')) // service start|stop|restart|deploy|local|unlocal|version
     .command(require('./command/db')) // db build|pull|snapshot|rollback
     .command(require('./command/customer')) // customer copy|purge
+    .command(require('./command/user')) // user search|get|create|partners
+    .command(require('./command/partner')) // partner list|users|assign|unassign
     .command(require('./command/shred')) // shred (localhost only)
     .command(require('./command/bankid')) // bankid pull|status|clear (staging certs → keychain)
     .command(require('./command/validation')) // validation on|off|status (output-schema checks)

package/lib/command/partner.js

@@ -0,0 +1,120 @@
+const chalk = require('chalk')
+const u = require('../users')
+const { targetOptions, writeOptions, label, printTable } = require('./target')
+
+module.exports = {
+  command: 'partner <command>',
+  describe: 'list partners and manage their user membership (local env by default)',
+  builder: (y) =>
+    y
+      .command({
+        command: 'list',
+        describe: 'list every partner in the environment',
+        builder: targetOptions,
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          const rows = await u.withDb(ns, (db) => u.listPartners(db))
+          console.log(chalk.bold(`\n${rows.length} partner(s) in ${label(ns)}\n`))
+          printTable(rows, [
+            ['NAME', (r) => r.name],
+            ['DOMAIN', (r) => r.domain],
+            ['USERS', (r) => r.users],
+            ['STATUS', (r) => r.status],
+            ['DEFAULT', (r) => (r.isDefaultPartner ? 'yes' : '')],
+            ['ID', (r) => r.id],
+          ])
+          console.log()
+        },
+      })
+      .command({
+        command: 'users <partner>',
+        describe: 'list the users of one partner and their level',
+        builder: (y2) =>
+          targetOptions(y2).positional('partner', { type: 'string', describe: 'partner id, name or domain' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          const { partner, rows } = await u.withDb(ns, async (db) => {
+            const partner = await u.findPartner(db, argv.partner)
+            const { rows } = await db.query(
+              `SELECT us.users_pk AS id, us.email, us.first_name, us.last_name,
+                      pu.role AS level, pu.status, pu."defaultRepresentative"
+               FROM "service_accounts"."partnerUser" pu
+               JOIN "service_accounts".users us ON us.users_pk = pu."userId"
+               WHERE pu."partnerId" = $1 ORDER BY us.email`,
+              [partner.id]
+            )
+            return { partner, rows }
+          })
+          console.log(chalk.bold(`\n${partner.name} — ${rows.length} user(s)`) + chalk.gray(`  (${label(ns)})\n`))
+          printTable(rows, [
+            ['EMAIL', (r) => r.email],
+            ['NAME', (r) => `${r.first_name} ${r.last_name}`],
+            ['LEVEL', (r) => r.level],
+            ['STATUS', (r) => r.status],
+            ['DEFAULT REP', (r) => (r.defaultRepresentative ? 'yes' : 'no')],
+            ['ID', (r) => r.id],
+          ])
+          console.log()
+        },
+      })
+      .command({
+        command: 'assign <user> <partner>',
+        describe: 'add a user to a partner (or change their level). Dry-run by default.',
+        builder: (y2) =>
+          writeOptions(y2)
+            .positional('user', { type: 'string', describe: 'user id or email' })
+            .positional('partner', { type: 'string', describe: 'partner id, name or domain' })
+            .option('level', { choices: u.PARTNER_LEVELS, default: 'member', describe: 'level within the partner' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          u.guardWrite(ns, argv)
+          const { user, partner, res } = await u.withDb(ns, async (db) => {
+            const user = await u.findUser(db, argv.user)
+            const partner = await u.findPartner(db, argv.partner)
+            const res = await u.assignPartner(db, { user, partner, level: argv.level, execute: argv.execute })
+            return { user, partner, res }
+          })
+          const what =
+            res.previous && res.previous !== argv.level
+              ? `level ${res.previous} → ${argv.level}`
+              : res.previous
+              ? `already a ${argv.level} (no change)`
+              : `added as ${argv.level}`
+          console.log(
+            (argv.execute ? chalk.green('\n' + what) : chalk.yellow(`\nDRY RUN — would be ${what}`)) +
+              `: ${user.email} @ ${partner.name}` +
+              chalk.gray(`  (${label(ns)})`)
+          )
+          if (!argv.execute) console.log(chalk.gray('  Re-run with --execute to apply.'))
+          console.log()
+        },
+      })
+      .command({
+        command: 'unassign <user> <partner>',
+        describe: 'remove a user from a partner. Dry-run by default.',
+        builder: (y2) =>
+          writeOptions(y2)
+            .positional('user', { type: 'string', describe: 'user id or email' })
+            .positional('partner', { type: 'string', describe: 'partner id, name or domain' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          u.guardWrite(ns, argv)
+          const { user, partner, res } = await u.withDb(ns, async (db) => {
+            const user = await u.findUser(db, argv.user)
+            const partner = await u.findPartner(db, argv.partner)
+            const res = await u.unassignPartner(db, { user, partner, execute: argv.execute })
+            return { user, partner, res }
+          })
+          console.log(
+            (argv.execute ? chalk.green('\nremoved') : chalk.yellow('\nDRY RUN — would remove')) +
+              ` ${user.email} (${res.level}) from ${partner.name}` +
+              chalk.gray(`  (${label(ns)})`)
+          )
+          if (!argv.execute) console.log(chalk.gray('  Re-run with --execute to apply.'))
+          console.log()
+        },
+      })
+      .demandCommand(1, 'Use: partner list | partner users | partner assign | partner unassign')
+      .strict(),
+  handler: () => {},
+}

package/lib/command/target.js

@@ -0,0 +1,31 @@
+const chalk = require('chalk')
+
+// Shared bits for the environment-addressed commands (user / partner). The LOCAL env is the default —
+// these are day-to-day local-dev commands — and a k8s namespace is the deliberate opt-in.
+const targetOptions = (y) =>
+  y
+    .option('target-local', { type: 'boolean', describe: 'act on the LOCAL env (default)' })
+    .option('target-namespace', { type: 'string', describe: 'act on a k8s namespace instead, e.g. dooer-staging' })
+
+const writeOptions = (y) =>
+  targetOptions(y)
+    .option('confirm-production', { type: 'boolean', describe: 'REQUIRED to write to dooer-production' })
+    .option('execute', { type: 'boolean', default: false, describe: 'actually write (default: dry-run)' })
+
+const label = (ns) => (ns === 'local' ? 'local env' : `namespace ${ns}`)
+
+// Minimal column-aligned printer: `columns` is [[header, rowFn], …]. Values are stringified, null shown
+// as a dim dash so an empty column still lines up.
+function printTable(rows, columns) {
+  if (!rows.length) {
+    console.log(chalk.gray('  (none)'))
+    return
+  }
+  const cell = (v) => (v === null || v === undefined || v === '' ? '-' : String(v))
+  const body = rows.map((r) => columns.map(([, fn]) => cell(fn(r))))
+  const widths = columns.map(([h], i) => Math.max(h.length, ...body.map((b) => b[i].length)))
+  console.log('  ' + columns.map(([h], i) => chalk.bold(h.padEnd(widths[i]))).join('  '))
+  for (const b of body) console.log('  ' + b.map((v, i) => v.padEnd(widths[i])).join('  '))
+}
+
+module.exports = { targetOptions, writeOptions, label, printTable }

package/lib/command/user.js

@@ -0,0 +1,172 @@
+const chalk = require('chalk')
+const u = require('../users')
+const { targetOptions, writeOptions, label, printTable } = require('./target')
+
+const date = (d) => (d ? new Date(d).toISOString().slice(0, 10) : null)
+
+module.exports = {
+  command: 'user <command>',
+  describe: 'find, inspect and create users (local env by default)',
+  builder: (y) =>
+    y
+      .command({
+        command: 'search [query]',
+        describe: 'find users by email, name, personnummer or id (no query = the most recent users)',
+        builder: (y2) =>
+          targetOptions(y2)
+            .positional('query', { type: 'string', describe: 'substring to match' })
+            .option('role', { choices: u.USER_ROLES, describe: 'only users of this role' })
+            .option('limit', { type: 'number', default: 20, describe: 'max rows' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          const rows = await u.withDb(ns, (db) =>
+            u.searchUsers(db, { query: argv.query, role: argv.role, limit: argv.limit })
+          )
+          console.log(
+            chalk.bold(`\n${rows.length} user(s) in ${label(ns)}`) +
+              (argv.query ? chalk.gray(` matching "${argv.query}"`) : '') +
+              '\n'
+          )
+          printTable(rows, [
+            ['ID', (r) => r.id],
+            ['EMAIL', (r) => r.email],
+            ['NAME', (r) => `${r.first_name} ${r.last_name}`],
+            ['ROLE', (r) => r.role],
+            ['CREATED', (r) => date(r.inserted_at)],
+            ['STATUS', (r) => (r.inactivated_at ? `inactivated ${date(r.inactivated_at)}` : 'active')],
+          ])
+          console.log()
+        },
+      })
+      .command({
+        command: 'get <user>',
+        describe: 'show one user (by id or email) and the partners they belong to',
+        builder: (y2) => targetOptions(y2).positional('user', { type: 'string', describe: 'user id or email' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          const { user, partners } = await u.withDb(ns, async (db) => {
+            const user = await u.findUser(db, argv.user)
+            return { user, partners: await u.partnersForUser(db, user.id) }
+          })
+          console.log(chalk.bold(`\n${user.first_name} ${user.last_name}`) + chalk.gray(`  (${label(ns)})\n`))
+          const line = (k, v) => console.log(`  ${k.padEnd(14)}${v === null || v === undefined ? '-' : v}`)
+          line('id', user.id)
+          line(
+            'email',
+            `${user.email}${user.email_verified ? chalk.gray(' (verified)') : chalk.yellow(' (unverified)')}`
+          )
+          line('role', user.role)
+          line('personnummer', user.personnummer)
+          line('password', user.has_password ? 'set' : chalk.yellow('none — cannot log in with a password'))
+          line('language', user.language)
+          line('created', date(user.inserted_at))
+          line('status', user.inactivated_at ? chalk.yellow(`inactivated ${date(user.inactivated_at)}`) : 'active')
+          if (user.internal) line('internal', 'yes')
+          console.log(chalk.bold(`\n  partners (${partners.length})`))
+          printTable(partners, [
+            ['PARTNER', (r) => r.name],
+            ['LEVEL', (r) => r.level],
+            ['STATUS', (r) => r.status],
+            ['LAST LOGIN', (r) => date(r.lastLoginAt)],
+            ['ID', (r) => r.id],
+          ])
+          console.log()
+        },
+      })
+      .command({
+        command: 'create',
+        describe: 'create a user (password generated unless given). Dry-run by default.',
+        builder: (y2) =>
+          writeOptions(y2)
+            .option('email', { type: 'string', demandOption: true, describe: 'email address (the login)' })
+            .option('password', { type: 'string', describe: 'password to set (default: generated, printed once)' })
+            .option('role', { choices: u.USER_ROLES, default: 'hi', describe: 'user role at dooer' })
+            .option('personnummer', { type: 'string', describe: 'Swedish personnummer, 10 or 12 digits' })
+            .option('first-name', { type: 'string', describe: 'default: derived from the email' })
+            .option('last-name', { type: 'string', describe: 'default: derived from the email' })
+            .option('partner', { type: 'string', describe: 'also add to this partner (id, name or domain)' })
+            .option('level', { choices: u.PARTNER_LEVELS, default: 'member', describe: 'level in --partner' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          u.guardWrite(ns, argv)
+          const derived = u.namesFromEmail(argv.email)
+          const firstName = argv.firstName || derived.firstName
+          const lastName = argv.lastName || derived.lastName
+          const password = argv.password || u.generatePassword()
+          const generated = !argv.password
+          const personnummer = argv.personnummer ? u.normalizePersonnummer(argv.personnummer) : null
+
+          const res = await u.withDb(ns, async (db) => {
+            // Resolve the partner BEFORE creating anything, so a typo fails without leaving a half-made user.
+            const partner = argv.partner ? await u.findPartner(db, argv.partner) : null
+            if (partner && argv.role !== 'hi') {
+              throw new Error(`--partner needs a "hi" user; role "${argv.role}" cannot belong to a partner`)
+            }
+            const created = await u.createUser(db, {
+              email: argv.email,
+              password,
+              role: argv.role,
+              personnummer,
+              firstName,
+              lastName,
+              execute: argv.execute,
+            })
+            // Only on --execute: a dry-run has no user id to attach the membership to, and the partner
+            // itself (plus the hi-only rule) has already been validated above.
+            if (partner && argv.execute) {
+              await u.assignPartner(db, {
+                user: { id: created.id, email: argv.email, role: argv.role },
+                partner,
+                level: argv.level,
+                execute: argv.execute,
+              })
+            }
+            return { created, partner }
+          })
+
+          console.log(
+            (argv.execute ? chalk.green('\ncreated user') : chalk.yellow('\nDRY RUN — nothing written')) +
+              chalk.gray(`  (${label(ns)})\n`)
+          )
+          const line = (k, v) => console.log(`  ${k.padEnd(14)}${v}`)
+          if (argv.execute) line('id', res.created.id)
+          line('email', argv.email)
+          line('name', `${firstName} ${lastName}`)
+          line('role', argv.role)
+          if (personnummer) line('personnummer', personnummer)
+          line('password', chalk.bold(password) + (generated ? chalk.gray('  (generated)') : ''))
+          if (res.partner) line('partner', `${res.partner.name} — level ${argv.level}`)
+          if (generated && argv.execute) {
+            console.log(chalk.gray('\n  The password is stored as a bcrypt hash — this is the only time it is shown.'))
+          }
+          if (!argv.execute) console.log(chalk.gray('\n  Re-run with --execute to create it.'))
+          console.log()
+        },
+      })
+      .command({
+        command: 'partners <user>',
+        describe: 'list the partners a user belongs to, and at what level',
+        builder: (y2) => targetOptions(y2).positional('user', { type: 'string', describe: 'user id or email' }),
+        handler: async (argv) => {
+          const ns = u.targetOf(argv)
+          const { user, partners } = await u.withDb(ns, async (db) => {
+            const user = await u.findUser(db, argv.user)
+            return { user, partners: await u.partnersForUser(db, user.id) }
+          })
+          console.log(
+            chalk.bold(`\n${user.email} belongs to ${partners.length} partner(s)`) + chalk.gray(`  (${label(ns)})\n`)
+          )
+          printTable(partners, [
+            ['PARTNER', (r) => r.name],
+            ['LEVEL', (r) => r.level],
+            ['STATUS', (r) => r.status],
+            ['DEFAULT REP', (r) => (r.defaultRepresentative ? 'yes' : 'no')],
+            ['ID', (r) => r.id],
+          ])
+          console.log()
+        },
+      })
+      .demandCommand(1, 'Use: user search | user get | user create | user partners')
+      .strict(),
+  handler: () => {},
+}

package/lib/users.js

@@ -0,0 +1,285 @@
+// users.js — user + partner-membership operations against a target environment (the local env by
+// default, or any k8s namespace). Reads and writes go straight to the service_accounts schema over the
+// same self-healing connection the copy engine uses (lib/engine/seed.js `connect`), which already knows
+// how to reach both the local Postgres and a namespace's dooer-database.
+//
+// Why SQL and not the service-accounts HTTP API:
+//   * there is NO user-create route at all — users only ever appear via the signup flows, which also
+//     create a company; that is exactly what we do NOT want here.
+//   * nothing subscribes to a user-created event (checked across every service's eventStream.handle),
+//     so a plain INSERT leaves no consumer un-notified. Contrast `customer new`, which goes through the
+//     ledger API precisely because service-closing builds its periods off the emitted event.
+//   * the partner-membership route (PUT /v1/partners/:partnerId/users/:userId) is a bare upsert with one
+//     guard — the user must be of type `hi`. We reproduce that guard below rather than dropping it, so
+//     the CLI cannot create rows the product would have refused.
+const crypto = require('crypto')
+const bcrypt = require('bcryptjs')
+const { connect } = require('./engine/seed')
+
+const SCHEMA = 'service_accounts'
+const T_USERS = `"${SCHEMA}".users`
+const T_PARTNER = `"${SCHEMA}".partner`
+const T_PARTNER_USER = `"${SCHEMA}"."partnerUser"`
+
+// service_accounts.user_roles_at_dooer. `hi` = the accounting-professional user a partner can employ;
+// `hiab` exists in the table but is legacy — not offered as a choice.
+const USER_ROLES = ['hi', 'customer', 'admin']
+// service_accounts."partnerUser_role_enum" — the "level" within a partner.
+const PARTNER_LEVELS = ['member', 'admin']
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+// ── target environment ───────────────────────────────────────────────────────
+// Default is the LOCAL env. `local` is a pseudo-namespace inside the engine, not a k8s one, so it is
+// addressed with --target-local and rejected as a --target-namespace value (same split as customer copy).
+function targetOf(argv) {
+  if (argv.targetNamespace === 'local') {
+    throw new Error('use --target-local for the local env, not --target-namespace local')
+  }
+  if (argv.targetLocal && argv.targetNamespace) {
+    throw new Error('pass either --target-local or --target-namespace, not both')
+  }
+  return argv.targetNamespace || 'local'
+}
+
+// Writing users into the production cluster is possible but must never be a slip of the shell.
+function guardWrite(namespace, argv) {
+  if (namespace === 'dooer-production' && !argv.confirmProduction) {
+    throw new Error('refusing to write to dooer-production without --confirm-production')
+  }
+}
+
+// ── password ────────────────────────────────────────────────────────────────
+// Ambiguous glyphs (0/O, 1/l/I) are left out — these get read off a screen and typed into a login form.
+const ALPHABET = 'abcdefghjkmnpqrstuvwxyzABCDEFGHJKMNPQRSTUVWXYZ23456789'
+
+function generatePassword(groups = 4, size = 5) {
+  const chunk = () => Array.from({ length: size }, () => ALPHABET[crypto.randomInt(ALPHABET.length)]).join('')
+  return Array.from({ length: groups }, chunk).join('-')
+}
+
+// service-accounts' own rule (lib/verify-password.js) is length >= 8 and nothing else; enforce exactly
+// that so a password this CLI accepts is a password the login accepts.
+function hashPassword(password) {
+  if (password.length < 8) throw new Error('password must be at least 8 characters (service-accounts rule)')
+  // bcryptjs, not bcrypt: identical wire format, but pure JS — a native build would break `npx`.
+  // get-login-user.js rewrites a stored `$2b$` prefix to `$2a$` before comparing, so either emits fine.
+  return bcrypt.hashSync(password, 10)
+}
+
+// ── personnummer ────────────────────────────────────────────────────────────
+// Stored as 12 bare digits (verified against staging: every non-null id_number is length 12).
+function normalizePersonnummer(input) {
+  const digits = String(input).replace(/\D/g, '')
+  if (digits.length === 12) return digits
+  if (digits.length === 10) {
+    // YY > current two-digit year means last century — the usual short-form expansion.
+    const yy = Number(digits.slice(0, 2))
+    const nowYY = new Date().getFullYear() % 100
+    return (yy > nowYY ? '19' : '20') + digits
+  }
+  throw new Error(`personnummer must be 10 or 12 digits (got ${digits.length}): ${input}`)
+}
+
+// ── name defaults ───────────────────────────────────────────────────────────
+// first_name/last_name are NOT NULL with no default. Derive something sane from the address so the
+// common case is just `--email`.
+function namesFromEmail(email) {
+  const local = email.split('@')[0]
+  const parts = local.split(/[._-]+/).filter(Boolean)
+  const cap = (s) => s.charAt(0).toUpperCase() + s.slice(1)
+  return {
+    firstName: cap(parts[0] || 'Test'),
+    lastName: cap(parts.slice(1).join(' ') || 'User'),
+  }
+}
+
+// ── reads ───────────────────────────────────────────────────────────────────
+const USER_COLUMNS = `users_pk AS id, email, first_name, last_name,
+  fk_user_roles_at_dooer_pk AS role, id_number AS personnummer, email_verified,
+  inactivated_at, internal, language, inserted_at, (password_hash IS NOT NULL) AS has_password`
+
+// A user is addressed by uuid or by email — nobody remembers uuids.
+async function findUser(db, ref) {
+  const byId = UUID_RE.test(ref)
+  const { rows } = await db.query(
+    `SELECT ${USER_COLUMNS} FROM ${T_USERS} WHERE ${byId ? 'users_pk = $1' : 'lower(email) = lower($1)'}
+     ORDER BY inserted_at`,
+    [ref]
+  )
+  if (!rows.length) throw new Error(`no user matching "${ref}"`)
+  if (rows.length > 1) {
+    // email is unique per ROLE (users_email_fk_user_roles_at_dooer_pk_key), so one address can legitimately
+    // exist as both a `customer` and an `hi`. Make the caller say which.
+    throw new Error(
+      `"${ref}" matches ${rows.length} users (one per role: ${rows.map((r) => r.role).join(', ')}) — ` +
+        `address it by id: ${rows.map((r) => r.id).join(', ')}`
+    )
+  }
+  return rows[0]
+}
+
+async function searchUsers(db, { query, role, limit }) {
+  const where = []
+  const params = []
+  if (query) {
+    params.push(`%${query}%`)
+    where.push(`(email ILIKE $${params.length} OR first_name ILIKE $${params.length}
+                 OR last_name ILIKE $${params.length} OR id_number ILIKE $${params.length}
+                 OR users_pk::text ILIKE $${params.length})`)
+  }
+  if (role) {
+    params.push(role)
+    where.push(`fk_user_roles_at_dooer_pk = $${params.length}`)
+  }
+  params.push(limit)
+  const { rows } = await db.query(
+    `SELECT ${USER_COLUMNS} FROM ${T_USERS}
+     ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+     ORDER BY inserted_at DESC LIMIT $${params.length}`,
+    params
+  )
+  return rows
+}
+
+async function listPartners(db) {
+  const { rows } = await db.query(
+    `SELECT p.id, p.name, p.domain, p.status, p."isDefaultPartner",
+            count(pu.id)::int AS users
+     FROM ${T_PARTNER} p LEFT JOIN ${T_PARTNER_USER} pu ON pu."partnerId" = p.id
+     GROUP BY p.id ORDER BY p.name`
+  )
+  return rows
+}
+
+// Same shape as GET /v1/partners/views/by-user/:userId, plus the membership level.
+async function partnersForUser(db, userId) {
+  const { rows } = await db.query(
+    `SELECT p.id, p.name, p.domain, pu.role AS level, pu.status,
+            pu."inProduction", pu."defaultRepresentative", pu."lastLoginAt"
+     FROM ${T_PARTNER_USER} pu JOIN ${T_PARTNER} p ON p.id = pu."partnerId"
+     WHERE pu."userId" = $1 ORDER BY p.name`,
+    [userId]
+  )
+  return rows
+}
+
+async function findPartner(db, ref) {
+  const byId = UUID_RE.test(ref)
+  const { rows } = await db.query(
+    `SELECT id, name, domain, status FROM ${T_PARTNER}
+     WHERE ${byId ? 'id = $1' : '(lower(name) = lower($1) OR lower(domain) = lower($1))'} ORDER BY name`,
+    [ref]
+  )
+  if (!rows.length) throw new Error(`no partner matching "${ref}" (see: dooer-test-env partner list)`)
+  if (rows.length > 1) {
+    throw new Error(`"${ref}" matches ${rows.length} partners — address it by id: ${rows.map((r) => r.id).join(', ')}`)
+  }
+  return rows[0]
+}
+
+// ── writes ──────────────────────────────────────────────────────────────────
+async function createUser(db, { email, password, role, personnummer, firstName, lastName, execute }) {
+  // Enforced by users_email_fk_user_roles_at_dooer_pk_key — check first so the failure is a sentence
+  // rather than a constraint-violation dump.
+  const {
+    rows: clash,
+  } = await db.query(
+    `SELECT users_pk FROM ${T_USERS} WHERE lower(email) = lower($1) AND fk_user_roles_at_dooer_pk = $2`,
+    [email, role]
+  )
+  if (clash.length) throw new Error(`a "${role}" user with email ${email} already exists (${clash[0].users_pk})`)
+
+  const hash = hashPassword(password)
+  const apiUuid = crypto.randomUUID()
+  // email_verified: these are test accounts — an unverified address puts a verification wall in front of
+  // every flow you actually wanted to exercise.
+  const values = [role, firstName, lastName, email, personnummer || null, hash, apiUuid]
+  // No id yet on a dry-run — the caller must not go on to use it as one (a placeholder string blew up the
+  // partner lookup's uuid parameter).
+  if (!execute) return { id: null, apiUuid }
+  const { rows } = await db.query(
+    `INSERT INTO ${T_USERS}
+       (fk_user_roles_at_dooer_pk, first_name, last_name, email, id_number, password_hash, api_uuid,
+        email_verified)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, true)
+     RETURNING users_pk AS id, api_uuid`,
+    values
+  )
+  return { id: rows[0].id, apiUuid: rows[0].api_uuid }
+}
+
+async function assignPartner(db, { user, partner, level, execute }) {
+  // The guard from setPartnerUser: partner membership is for accounting professionals only. Without it
+  // the CLI would happily write a row that HQ then trips over.
+  if (user.role !== 'hi') {
+    throw new Error(
+      `only "hi" users can belong to a partner (${user.email} is "${user.role}") — ` +
+        `this is the same invalid-user-type check the service-accounts API applies`
+    )
+  }
+  const {
+    rows: existing,
+  } = await db.query(`SELECT role AS level FROM ${T_PARTNER_USER} WHERE "partnerId" = $1 AND "userId" = $2`, [
+    partner.id,
+    user.id,
+  ])
+  if (!execute) return { previous: existing[0] ? existing[0].level : null }
+  const { rows } = await db.query(
+    `INSERT INTO ${T_PARTNER_USER} ("partnerId", "userId", role, status)
+     VALUES ($1, $2, $3, 'enabled')
+     ON CONFLICT ("partnerId", "userId")
+       DO UPDATE SET role = EXCLUDED.role, status = EXCLUDED.status, "updatedAt" = now()
+     RETURNING role AS level`,
+    [partner.id, user.id, level]
+  )
+  return { previous: existing[0] ? existing[0].level : null, level: rows[0].level }
+}
+
+async function unassignPartner(db, { user, partner, execute }) {
+  const {
+    rows: existing,
+  } = await db.query(`SELECT role AS level FROM ${T_PARTNER_USER} WHERE "partnerId" = $1 AND "userId" = $2`, [
+    partner.id,
+    user.id,
+  ])
+  if (!existing.length) throw new Error(`${user.email} is not a member of ${partner.name}`)
+  if (execute) {
+    await db.query(`DELETE FROM ${T_PARTNER_USER} WHERE "partnerId" = $1 AND "userId" = $2`, [partner.id, user.id])
+  }
+  return { level: existing[0].level }
+}
+
+// Every command opens one connection and closes it, so the CLI never leaves a socket to the cluster open.
+async function withDb(namespace, fn) {
+  const db = await connect(namespace)
+  try {
+    return await fn(db)
+  } finally {
+    try {
+      await db.client.end()
+    } catch (_) {
+      /* already gone */
+    }
+  }
+}
+
+module.exports = {
+  USER_ROLES,
+  PARTNER_LEVELS,
+  targetOf,
+  guardWrite,
+  generatePassword,
+  hashPassword,
+  normalizePersonnummer,
+  namesFromEmail,
+  findUser,
+  searchUsers,
+  listPartners,
+  partnersForUser,
+  findPartner,
+  createUser,
+  assignPartner,
+  unassignPartner,
+  withDb,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dooer/dooer-test-env",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Run the whole Dooer backend locally (staging DB minus customers), copy/purge customers between environments, and shred — one CLI.",
   "license": "UNLICENSED",
   "repository": "Dooer/cli-dooer-test-env",
@@ -27,6 +27,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.600.0",
     "@dooer/package-info": "^1.6.7",
+    "bcryptjs": "^3.0.3",
     "chalk": "^4.1.2",
     "js-yaml": "^3.14.1",
     "pg": "^8.23.0",

package/readme.md

@@ -53,6 +53,8 @@ db roles                                          (re)create per-service DB role
 db snapshot <name> | db rollback <name>          local restore points
 customer new "<name>" --owner <userId> --execute empty functional account: company + Owner + subscriptions + partner dooer
 customer copy | customer purge                    copy / delete one org between environments (emails anonymized)
+user search | get | create | partners             find/inspect/create users (local env unless --target-namespace)
+partner list | users | assign | unassign          partners and who belongs to them, at which level
 shred                                             anonymize the LOCAL db (localhost only)
 bankid pull | status | clear                      BankID cert (staging → keychain), used by service-accounts
 validation on | off | status                      output-schema validation (default OFF, like staging/live)
@@ -109,13 +111,66 @@ reads (`fiscalYear`, `hasVatRegistration`, `hasCompanyTax`, `hasEmployeeRegistra
 `vatPeriod`/`vatDue`). `--no-fiscal-year` leaves all of that blank.
 
 The owner must be a **`customer`** user — a `hi`/admin owner cannot accept Terms of Service and the command
-warns you. Find one with:
+warns you. Find one:
 
-```sql
-SELECT users_pk, email FROM service_accounts.users
-WHERE fk_user_roles_at_dooer_pk = 'customer' AND inactivated_at IS NULL LIMIT 5;
+```bash
+npx @dooer/dooer-test-env@latest user search --role customer
+```
+
+### Create a user you can actually log in as
+
+```bash
+# an accounting professional (role `hi`) in the local env, password generated and printed once
+npx @dooer/dooer-test-env@latest user create --email anna@dooer.com --execute
+
+# …a customer instead, with your own password and a personnummer
+npx @dooer/dooer-test-env@latest user create --email kim@example.com \
+  --role customer --password 'hunter2hunter2' --personnummer 19900101-1234 --execute
+
+# …or an `hi` user placed straight into a partner
+npx @dooer/dooer-test-env@latest user create --email anna@dooer.com \
+  --partner "Dooer Devteam" --level admin --execute
+```
+
+The password is stored the way signup stores it (bcrypt, cost 10), so it works on the ordinary
+email+password login — no BankID needed. It is shown **once**; there is no way to read it back. `--role`
+defaults to `hi` (other choices: `customer`, `admin`), names default to something derived from the address,
+and the account is created with its email pre-verified so no verification wall gets in the way.
+
+Look users up by email **or** id, and see where they belong:
+
+```bash
+npx @dooer/dooer-test-env@latest user search anna          # email, name, personnummer or id
+npx @dooer/dooer-test-env@latest user get anna@dooer.com   # details + partner memberships
 ```
 
+### Partners and who belongs to them
+
+```bash
+npx @dooer/dooer-test-env@latest partner list                        # every partner + user counts
+npx @dooer/dooer-test-env@latest partner users "Dooer Devteam"       # its users and their level
+
+# add / promote / remove (a partner is addressable by id, name or domain)
+npx @dooer/dooer-test-env@latest partner assign anna@dooer.com "Dooer Devteam" --level admin --execute
+npx @dooer/dooer-test-env@latest partner unassign anna@dooer.com "Dooer Devteam" --execute
+```
+
+`--level` is the membership level inside the partner (`member` or `admin`) — not the same thing as the
+user's `--role` at Dooer. Only **`hi`** users can belong to a partner; the CLI applies the same
+`invalid-user-type` check the service-accounts API does rather than writing a row HQ would choke on.
+
+### Look at (or fix) users in a real environment
+
+These commands default to the local env. Point them at a cluster with `--target-namespace`:
+
+```bash
+npx @dooer/dooer-test-env@latest user search someone@dooer.com --target-namespace dooer-staging
+npx @dooer/dooer-test-env@latest partner list --target-namespace dooer-production
+```
+
+Writes there are still dry-run until `--execute`, and `dooer-production` additionally demands
+`--confirm-production`.
+
 ### Copy a real customer into the local env
 
 `--target-local` addresses this stack (Postgres on 55432 + MinIO); the source can be any k8s namespace