@dooer/dooer-test-env 1.13.0 → 1.15.0

package/lib/cli.js

@@ -6,23 +6,40 @@ const pkg = require('../package.json')
 // customers), copy/purge customers between environments, and shred — see ENVIRONMENT-PLAN.md.
 // Command groups are wired as modules under ./command.
 module.exports = async function cli() {
-  return yargs(hideBin(process.argv))
-    .scriptName('dooer-test-env')
-    .usage('$0 <group> <command> [options]')
-    .version(pkg.version)
-    .command(require('./command/setup')) // prerequisites + registry login + compose generation
-    .command(require('./command/env')) // up / down / start / stop / status
-    .command(require('./command/service')) // service start|stop|restart|deploy|local|unlocal|version
-    .command(require('./command/db')) // db build|pull|snapshot|rollback
-    .command(require('./command/customer')) // customer copy|purge
-    .command(require('./command/shred')) // shred (localhost only)
-    .command(require('./command/bankid')) // bankid pull|status|clear (staging certs → keychain)
-    .command(require('./command/validation')) // validation on|off|status (output-schema checks)
-    .command(require('./command/logs')) // search logs across all local services (transactionId, errors, …)
-    .command(require('./command/measure')) // resource-usage report for the running env
-    .demandCommand(1, 'Pick a command group. Try --help.')
-    .strict()
-    .help()
-    .wrap(Math.min(120, yargs().terminalWidth()))
-    .parseAsync()
+  return (
+    yargs(hideBin(process.argv))
+      .scriptName('dooer-test-env')
+      .usage('$0 <group> <command> [options]')
+      .version(pkg.version)
+      .command(require('./command/setup')) // prerequisites + registry login + compose generation
+      .command(require('./command/env')) // up / down / start / stop / status
+      .command(require('./command/service')) // service start|stop|restart|deploy|local|unlocal|version
+      .command(require('./command/db')) // db build|pull|snapshot|rollback
+      .command(require('./command/customer')) // customer copy|purge
+      .command(require('./command/remote-environment')) // login/status/logout/list against a public GraphQL API
+      .command(require('./command/user')) // user search|get|create|partners
+      .command(require('./command/partner')) // partner list|users|assign|unassign
+      .command(require('./command/shred')) // shred (localhost only)
+      .command(require('./command/bankid')) // bankid pull|status|clear (staging certs → keychain)
+      .command(require('./command/validation')) // validation on|off|status (output-schema checks)
+      .command(require('./command/logs')) // search logs across all local services (transactionId, errors, …)
+      .command(require('./command/measure')) // resource-usage report for the running env
+      .demandCommand(1, 'Pick a command group. Try --help.')
+      .strict()
+      // yargs prints the full usage block for a HANDLER failure too, which buries the actual message under
+      // an option list that has nothing to do with it (a permission error is not a usage error). Print the
+      // usage only when yargs itself rejected the arguments; otherwise just the message.
+      .fail((msg, err, yargsInstance) => {
+        if (!err) {
+          console.error(yargsInstance.help())
+          console.error(`\n${msg}\n`)
+        } else {
+          console.error(`\n${err.message}\n`)
+        }
+        process.exit(1)
+      })
+      .help()
+      .wrap(Math.min(120, yargs().terminalWidth()))
+      .parseAsync()
+  )
 }

package/lib/command/partner.js

@@ -0,0 +1,97 @@
+const chalk = require('chalk')
+const u = require('../users')
+const remote = require('../remote')
+const { envOption, writeOption, printTable } = require('./target')
+
+module.exports = {
+  command: 'partner <command>',
+  describe: 'list partners and manage their user membership (local env by default)',
+  builder: (y) =>
+    y
+      .command({
+        command: 'list',
+        describe: 'list every partner in the environment',
+        builder: envOption,
+        handler: async (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const rows = await u.listPartners(env)
+          console.log(chalk.bold(`\n${rows.length} partner(s) in ${env.label}\n`))
+          printTable(rows, [
+            ['NAME', (r) => r.name],
+            ['DOMAIN', (r) => r.domain],
+            ['STATUS', (r) => r.status],
+            ['ID', (r) => r.id],
+          ])
+          console.log()
+        },
+      })
+      .command({
+        command: 'users <partner>',
+        describe: 'list the users of one partner and their level',
+        builder: (y2) =>
+          envOption(y2).positional('partner', { type: 'string', describe: 'partner id, name or domain' }),
+        handler: async (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const partner = await u.findPartner(env, argv.partner)
+          const rows = await u.partnerUsers(env, partner.id)
+          console.log(chalk.bold(`\n${partner.name} — ${rows.length} user(s)`) + `  (${env.label})\n`)
+          printTable(rows, [
+            ['EMAIL', (r) => r.user && r.user.email],
+            ['NAME', (r) => (r.user ? `${r.user.firstName} ${r.user.lastName}` : null)],
+            ['LEVEL', (r) => r.role],
+            ['STATUS', (r) => r.status],
+            ['DEFAULT REP', (r) => (r.defaultRepresentative ? 'yes' : 'no')],
+            ['ID', (r) => r.userId],
+          ])
+          console.log()
+        },
+      })
+      .command({
+        command: 'assign <user> <partner>',
+        describe: 'add a user to a partner (or change their level). Dry-run by default.',
+        builder: (y2) =>
+          writeOption(envOption(y2))
+            .positional('user', { type: 'string', describe: 'user id or email' })
+            .positional('partner', { type: 'string', describe: 'partner id, name or domain' })
+            .option('level', { choices: u.PARTNER_LEVELS, default: 'member', describe: 'level within the partner' }),
+        handler: async (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const user = await u.findUser(env, argv.user)
+          const partner = await u.findPartner(env, argv.partner)
+          // The API refuses a non-`hi` user (invalid-user-type); say so before spending a round trip.
+          if (user.userType !== 'hi') {
+            throw new Error(`only "hi" users can belong to a partner — ${user.email} is "${user.userType}"`)
+          }
+          if (argv.execute) await u.assignPartner(env, { userId: user.id, partnerId: partner.id, level: argv.level })
+          console.log(
+            (argv.execute ? chalk.green(`\nset ${argv.level}`) : chalk.yellow(`\nDRY RUN — would set ${argv.level}`)) +
+              `: ${user.email} @ ${partner.name}  (${env.label})`
+          )
+          if (!argv.execute) console.log('  Re-run with --execute to apply.')
+          console.log()
+        },
+      })
+      .command({
+        command: 'unassign <user> <partner>',
+        describe: 'remove a user from a partner. Dry-run by default.',
+        builder: (y2) =>
+          writeOption(envOption(y2))
+            .positional('user', { type: 'string', describe: 'user id or email' })
+            .positional('partner', { type: 'string', describe: 'partner id, name or domain' }),
+        handler: async (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const user = await u.findUser(env, argv.user)
+          const partner = await u.findPartner(env, argv.partner)
+          if (argv.execute) await u.unassignPartner(env, { userId: user.id, partnerId: partner.id })
+          console.log(
+            (argv.execute ? chalk.green('\nremoved') : chalk.yellow('\nDRY RUN — would remove')) +
+              ` ${user.email} from ${partner.name}  (${env.label})`
+          )
+          if (!argv.execute) console.log('  Re-run with --execute to apply.')
+          console.log()
+        },
+      })
+      .demandCommand(1, 'Use: partner list | partner users | partner assign | partner unassign')
+      .strict(),
+  handler: () => {},
+}

package/lib/command/remote-environment.js

@@ -0,0 +1,281 @@
+const readline = require('readline')
+const chalk = require('chalk')
+const qrcode = require('qrcode-terminal')
+const remote = require('../remote')
+
+// Log in to a remote Dooer environment over its public GraphQL endpoint and keep the session in the
+// keychain, so the other commands (user / partner) can act as you without any cluster access.
+
+// Everything this command prints is information you need to read, so it goes out in the terminal's own
+// foreground colour. chalk.gray renders as near-invisible on a dark profile (Jimmy 2026-09-04).
+const plain = (s) => s
+
+const envOption = (y) =>
+  y.option('env', {
+    type: 'string',
+    default: 'local',
+    describe: `environment: ${remote.envNames().join(' | ')}`,
+  })
+
+// ── prompts ─────────────────────────────────────────────────────────────────
+function ask(question) {
+  return new Promise((resolve, reject) => {
+    if (!process.stdin.isTTY) {
+      reject(new Error(`need a terminal to ask for "${question.trim()}" — pass it as a flag instead`))
+      return
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true })
+    rl.question(question, (answer) => {
+      rl.close()
+      resolve(answer.trim())
+    })
+  })
+}
+
+// Hidden input by reading raw keystrokes rather than overriding readline's internal `_writeToOutput`.
+// That override races with input that arrives before the prompt is drawn and leaves the line half-erased;
+// raw mode simply never echoes, which is both simpler and what it looks like it does.
+function askHidden(question) {
+  return new Promise((resolve, reject) => {
+    const { stdin, stdout } = process
+    if (!stdin.isTTY) {
+      reject(new Error(`need a terminal to ask for "${question.trim()}" — pass it as a flag instead`))
+      return
+    }
+    stdout.write(question)
+    let value = ''
+    const wasRaw = stdin.isRaw
+    stdin.setRawMode(true)
+    stdin.resume()
+    stdin.setEncoding('utf8')
+    const done = (err, out) => {
+      stdin.removeListener('data', onData)
+      stdin.setRawMode(wasRaw)
+      stdin.pause()
+      stdout.write('\n')
+      err ? reject(err) : resolve(out)
+    }
+    const onData = (chunk) => {
+      for (const ch of chunk) {
+        if (ch === '\r' || ch === '\n' || ch === '') return done(null, value)
+        if (ch === '') return done(new Error('cancelled')) // Ctrl-C
+        if (ch === '' || ch === '\b') value = value.slice(0, -1)
+        else if (ch >= ' ') value += ch
+      }
+    }
+    stdin.on('data', onData)
+  })
+}
+
+// ── terminal QR ─────────────────────────────────────────────────────────────
+// The BankID payload changes every second, so the QR is redrawn in place: render, remember how many lines
+// it occupied, then move the cursor back up over them before the next frame. Falls back to plain appending
+// when stdout is not a terminal (piped output, CI) so the log stays readable.
+function qrRenderer() {
+  let lastLines = 0
+  return (payload, statusLine) => {
+    qrcode.generate(payload, { small: true }, (art) => {
+      const block = `${art}\n${statusLine}\n`
+      const lines = block.split('\n').length - 1
+      if (process.stdout.isTTY && lastLines) process.stdout.write(`[${lastLines}A`)
+      process.stdout.write(block)
+      lastLines = process.stdout.isTTY ? lines : 0
+    })
+  }
+}
+
+// ── shared: store a token and report who it belongs to ──────────────────────
+// Detail lines are printed in the terminal's default colour: chalk.gray renders as near-invisible on a
+// dark profile, and everything below is information you need to read (Jimmy 2026-09-04).
+const detail = (k, v) => console.log(`  ${chalk.cyan(k.padEnd(12))}${v}`)
+
+async function storeAndReport(env, token) {
+  remote.tokenSet(env.name, token)
+  const me = await remote.currentUser(env, token)
+  const exp = remote.expiry(token)
+  console.log(
+    chalk.green(`\nlogged in to ${env.label}`) +
+      (me ? ` as ${chalk.bold(`${me.firstName} ${me.lastName}`)} <${me.email}>` : '')
+  )
+  if (me) {
+    detail('user id', me.id)
+    // Which of your accounts this is. `admin` is required to create users; partner operations need a
+    // partner-level session; a `customer` token can do neither.
+    detail('user type', me.userType === 'admin' ? chalk.bold(me.userType) : me.userType)
+  }
+  detail('session', `stored in keychain${exp ? `, valid until ${exp.at.toISOString()}` : ''}`)
+  detail('check with', `dooer-test-env remote-environment status --env ${env.name}`)
+  console.log()
+}
+
+module.exports = {
+  command: 'remote-environment <command>',
+  aliases: ['remote'],
+  describe: 'log in to an environment through its public GraphQL API (session kept in the keychain)',
+  builder: (y) =>
+    y
+      .command({
+        command: 'login',
+        describe: 'log in with BankID (default) or email + password',
+        builder: (y2) =>
+          envOption(y2)
+            .option('bankid', { type: 'boolean', describe: 'log in with BankID (default when no --email)' })
+            .option('customer', {
+              type: 'boolean',
+              describe: 'BankID: sign in as your CUSTOMER account instead of your professional one',
+            })
+            .option('personnummer', { type: 'string', describe: 'BankID: your personnummer (default: any, via QR)' })
+            .option('email', { type: 'string', describe: 'log in with this email + password instead of BankID' })
+            .option('password', { type: 'string', describe: 'password (omit to be prompted, which is safer)' }),
+        handler: async (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const usePassword = Boolean(argv.email || argv.password) && !argv.bankid
+
+          if (usePassword) {
+            const email = argv.email || (await ask('email: '))
+            const password = argv.password || (await askHidden('password: '))
+            console.log(plain(`\nauthenticating against ${env.url} …`))
+            await storeAndReport(env, await remote.loginWithPassword(env, email, password))
+            return
+          }
+
+          // Default to HQ's flow — the partner authentication session, which resolves your professional
+          // (`hi`) account. `loginWithBankIdV2` is the other route, but service-accounts pins it to
+          // user_type 'customer' (lib/login-with-bank-id.js:199), so it can only ever return that account.
+          const asCustomer = Boolean(argv.customer)
+          console.log(
+            chalk.bold(`\nBankID login — ${env.label}`) +
+              plain(
+                `\n${env.url}\n` +
+                  (asCustomer ? 'signing in as your customer account\n' : '') +
+                  `\nOpen the BankID app and scan this code (it refreshes every second):\n`
+              )
+          )
+          const draw = qrRenderer()
+          const onFrame = ({ qr, hintCode }) => {
+            if (!qr) return
+            draw(qr, plain(`  ${remote.HINTS[hintCode] || hintCode || 'starting…'}  (Ctrl-C to abort)`))
+          }
+          const token = asCustomer
+            ? await remote.loginWithBankId(env, { sePersonnummer: argv.personnummer, onFrame })
+            : await remote.loginWithPartnerBankId(env, { idNumber: argv.personnummer, onFrame })
+          await storeAndReport(env, token)
+        },
+      })
+      .command({
+        command: 'become [user]',
+        describe: 'as an ADMIN, assume a partner user to get a partner-level session (back-office “Become user”)',
+        builder: (y2) =>
+          envOption(y2)
+            .positional('user', { type: 'string', describe: 'user id or email of the partner user' })
+            .option('partner', { type: 'string', describe: 'which partner (needed only if they belong to several)' })
+            .option('revert', { type: 'boolean', describe: 'restore the session you had before becoming' }),
+        handler: async (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const u = require('../users')
+
+          if (argv.revert) {
+            const restored = remote.unstashToken(env.name)
+            if (!restored) throw new Error(`no stashed session for ${env.name} — nothing to revert to`)
+            const me = await remote.currentUser(env, restored)
+            console.log(chalk.green(`\nback to ${me.email} (${me.userType}) on ${env.label}\n`))
+            return
+          }
+
+          if (!argv.user) throw new Error('which user? pass a user id or email (or --revert)')
+          const user = await u.findUser(env, argv.user)
+          const partners = await u.partnersForUser(env, user.id)
+          if (!partners.length) throw new Error(`${user.email} does not belong to any partner`)
+          const partner = argv.partner
+            ? await u.findPartner(env, argv.partner)
+            : partners.length === 1
+            ? partners[0]
+            : null
+          if (!partner) {
+            throw new Error(
+              `${user.email} belongs to ${partners.length} partners — pick one with --partner:\n` +
+                partners.map((p) => `    ${p.name} (${p.domain})`).join('\n')
+            )
+          }
+          // Keep the admin token: becoming replaces the session, and you will want it back.
+          remote.stashToken(env.name)
+          const { token } = await remote.becomePartnerUser(env, { partnerId: partner.id, userId: user.id })
+          await storeAndReport(env, token)
+          console.log(`  Revert with: dooer-test-env remote-environment become --revert --env ${env.name}\n`)
+        },
+      })
+      .command({
+        command: 'status',
+        describe: 'who you are logged in as, and until when',
+        builder: (y2) => envOption(y2).option('all', { type: 'boolean', describe: 'report every environment' }),
+        handler: async (argv) => {
+          const names = argv.all ? remote.envNames() : [remote.resolveEnv(argv.env).name]
+          console.log()
+          for (const name of names) {
+            const env = remote.resolveEnv(name)
+            const token = remote.tokenGet(name)
+            const head = `${chalk.bold(env.label.padEnd(22))}`
+            if (!token) {
+              // The local stack needs no login — it is signed with the shared dev keypair this CLI holds.
+              const note =
+                name === 'local' ? plain('no session — uses a minted service token') : chalk.yellow('not logged in')
+              console.log(`${head}${note}`)
+              continue
+            }
+            const exp = remote.expiry(token)
+            if (exp && exp.expired) {
+              console.log(`${head}${chalk.yellow(`session EXPIRED ${exp.at.toISOString()}`)}`)
+              continue
+            }
+            let me = null
+            try {
+              me = await remote.currentUser(env, token)
+            } catch (e) {
+              console.log(`${head}${chalk.red(`session rejected — ${e.message}`)}`)
+              continue
+            }
+            console.log(
+              `${head}${chalk.green(me ? `${me.firstName} ${me.lastName} <${me.email}>` : 'valid session')}` +
+                plain(exp ? `  until ${exp.at.toISOString()}` : '')
+            )
+            // The account type decides what this session may do, so it belongs in the whoami line.
+            if (me) console.log(`${''.padEnd(22)}${me.id}  ${chalk.cyan(me.userType || 'unknown type')}`)
+          }
+          console.log()
+        },
+      })
+      .command({
+        command: 'logout',
+        describe: 'forget the stored session for an environment',
+        builder: (y2) => envOption(y2),
+        handler: (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const had = remote.tokenDelete(env.name)
+          console.log(had ? chalk.green(`\nforgot the ${env.label} session\n`) : plain(`\nno ${env.label} session\n`))
+        },
+      })
+      .command({
+        command: 'list',
+        describe: 'the environments this CLI knows and where they point',
+        handler: () => {
+          console.log()
+          for (const name of remote.envNames()) {
+            const env = remote.resolveEnv(name)
+            const token = remote.tokenGet(name)
+            const exp = token ? remote.expiry(token) : null
+            const state = !token
+              ? name === 'local'
+                ? plain('service token')
+                : chalk.yellow('not logged in')
+              : exp && exp.expired
+              ? chalk.yellow('expired')
+              : chalk.green('logged in')
+            console.log(`  ${name.padEnd(12)}${env.url.padEnd(36)}${state}`)
+          }
+          console.log()
+        },
+      })
+      .demandCommand(1, 'Use: remote-environment login | status | logout | list')
+      .strict(),
+  handler: () => {},
+}

package/lib/command/target.js

@@ -0,0 +1,34 @@
+const chalk = require('chalk')
+const remote = require('../remote')
+
+// Shared bits for the environment-addressed commands (user / partner). These reach an environment through
+// its PUBLIC GraphQL endpoint, so the target is an ENVIRONMENT, not a k8s namespace — same `--env` word
+// the remote-environment commands use. The local stack is the default.
+const envOption = (y) =>
+  y.option('env', {
+    type: 'string',
+    default: 'local',
+    describe: `environment: ${remote.envNames().join(' | ')}`,
+  })
+
+const writeOption = (y) =>
+  y.option('execute', { type: 'boolean', default: false, describe: 'actually write (default: dry-run)' })
+
+// Label + value, value in the terminal's own foreground colour — chalk.gray is unreadable on a dark
+// profile and these lines carry the information (Jimmy 2026-09-04).
+const detail = (k, v) => console.log(`  ${chalk.cyan(k.padEnd(14))}${v === null || v === undefined ? '-' : v}`)
+
+// Minimal column-aligned printer: `columns` is [[header, rowFn], …].
+function printTable(rows, columns) {
+  if (!rows.length) {
+    console.log('  (none)')
+    return
+  }
+  const cell = (v) => (v === null || v === undefined || v === '' ? '-' : String(v))
+  const body = rows.map((r) => columns.map(([, fn]) => cell(fn(r))))
+  const widths = columns.map(([h], i) => Math.max(h.length, ...body.map((b) => b[i].length)))
+  console.log('  ' + columns.map(([h], i) => chalk.bold(h.padEnd(widths[i]))).join('  '))
+  for (const b of body) console.log('  ' + b.map((v, i) => v.padEnd(widths[i])).join('  '))
+}
+
+module.exports = { envOption, writeOption, detail, printTable }

package/lib/command/user.js

@@ -0,0 +1,148 @@
+const chalk = require('chalk')
+const u = require('../users')
+const remote = require('../remote')
+const { envOption, writeOption, printTable, detail } = require('./target')
+
+const date = (d) => (d ? new Date(d).toISOString().slice(0, 10) : null)
+
+module.exports = {
+  command: 'user <command>',
+  describe: 'find, inspect and create users (local env by default)',
+  builder: (y) =>
+    y
+      .command({
+        command: 'search [query]',
+        describe: 'find users by email, name, personnummer or id (no query = the most recent users)',
+        builder: (y2) =>
+          envOption(y2)
+            .positional('query', { type: 'string', describe: 'substring to match' })
+            .option('role', { choices: u.USER_ROLES, describe: 'only users of this role' })
+            .option('limit', { type: 'number', default: 20, describe: 'max rows' }),
+        handler: async (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const rows = await u.searchUsers(env, { query: argv.query, role: argv.role, limit: argv.limit })
+          console.log(
+            chalk.bold(`\n${rows.length} user(s) in ${env.label}`) +
+              (argv.query ? ` matching "${argv.query}"` : '') +
+              '\n'
+          )
+          printTable(rows, [
+            ['ID', (r) => r.id],
+            ['EMAIL', (r) => r.email],
+            ['NAME', (r) => `${r.firstName} ${r.lastName}`],
+            ['TYPE', (r) => r.userType],
+            ['CREATED', (r) => date(r.createdAt)],
+            ['STATUS', (r) => (r.isInactivated ? `inactivated ${date(r.inactivatedAt)}` : 'active')],
+          ])
+          console.log()
+        },
+      })
+      .command({
+        command: 'get <user>',
+        describe: 'show one user (by id or email) and the partners they belong to',
+        builder: (y2) => envOption(y2).positional('user', { type: 'string', describe: 'user id or email' }),
+        handler: async (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const user = await u.findUser(env, argv.user)
+          const partners = await u.partnersForUser(env, user.id)
+          console.log(chalk.bold(`\n${user.firstName} ${user.lastName}`) + `  (${env.label})\n`)
+          detail('id', user.id)
+          detail('email', `${user.email}${user.isEmailVerified ? ' (verified)' : chalk.yellow(' (unverified)')}`)
+          detail('user type', user.userType)
+          detail('personnummer', user.sePersonnummer || '-')
+          detail('language', user.language || '-')
+          detail('created', date(user.createdAt))
+          detail('status', user.isInactivated ? chalk.yellow(`inactivated ${date(user.inactivatedAt)}`) : 'active')
+          if (user.internal) detail('internal', 'yes')
+          console.log(chalk.bold(`\n  partners (${partners.length})`))
+          printTable(partners, [
+            ['PARTNER', (r) => r.name],
+            ['LEVEL', (r) => r.level],
+            ['STATUS', (r) => r.status],
+            ['ID', (r) => r.id],
+          ])
+          console.log()
+        },
+      })
+      .command({
+        command: 'create',
+        describe: 'create a user (password generated unless given). Dry-run by default.',
+        builder: (y2) =>
+          writeOption(envOption(y2))
+            .option('email', { type: 'string', demandOption: true, describe: 'email address (the login)' })
+            .option('password', { type: 'string', describe: 'password to set (default: generated, printed once)' })
+            .option('role', { choices: u.USER_ROLES, default: 'hi', describe: 'user role at dooer' })
+            .option('personnummer', { type: 'string', describe: 'Swedish personnummer, 10 or 12 digits' })
+            .option('first-name', { type: 'string', describe: 'default: derived from the email' })
+            .option('last-name', { type: 'string', describe: 'default: derived from the email' })
+            .option('partner', { type: 'string', describe: 'also add to this partner (id, name or domain)' })
+            .option('level', { choices: u.PARTNER_LEVELS, default: 'member', describe: 'level in --partner' }),
+        handler: async (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const derived = u.namesFromEmail(argv.email)
+          const firstName = argv.firstName || derived.firstName
+          const lastName = argv.lastName || derived.lastName
+          const password = argv.password || u.generatePassword()
+          const generated = !argv.password
+          const personnummer = argv.personnummer ? u.normalizePersonnummer(argv.personnummer) : null
+
+          // Resolve the partner BEFORE creating anything, so a typo fails without leaving a half-made user.
+          const partner = argv.partner ? await u.findPartner(env, argv.partner) : null
+          if (partner && argv.role !== 'hi') {
+            throw new Error(`--partner needs a "hi" user; role "${argv.role}" cannot belong to a partner`)
+          }
+
+          let created = null
+          if (argv.execute) {
+            created = await u.createUser(env, {
+              email: argv.email,
+              password,
+              role: argv.role,
+              personnummer,
+              firstName,
+              lastName,
+            })
+            if (partner) await u.assignPartner(env, { userId: created.id, partnerId: partner.id, level: argv.level })
+          }
+
+          console.log(
+            (argv.execute ? chalk.green('\ncreated user') : chalk.yellow('\nDRY RUN — nothing written')) +
+              `  (${env.label})\n`
+          )
+          if (created) detail('id', created.id)
+          detail('email', argv.email)
+          detail('name', `${firstName} ${lastName}`)
+          detail('user type', argv.role)
+          if (personnummer) detail('personnummer', personnummer)
+          detail('password', chalk.bold(password) + (generated ? '  (generated)' : ''))
+          if (partner) detail('partner', `${partner.name} — level ${argv.level}`)
+          if (generated && argv.execute) {
+            console.log('\n  The service stores only a hash — this is the only time the password is shown.')
+          }
+          if (!argv.execute) console.log('\n  Re-run with --execute to create it.')
+          console.log()
+        },
+      })
+      .command({
+        command: 'partners <user>',
+        describe: 'list the partners a user belongs to, and at what level',
+        builder: (y2) => envOption(y2).positional('user', { type: 'string', describe: 'user id or email' }),
+        handler: async (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const user = await u.findUser(env, argv.user)
+          const partners = await u.partnersForUser(env, user.id)
+          console.log(chalk.bold(`\n${user.email} belongs to ${partners.length} partner(s)`) + `  (${env.label})\n`)
+          printTable(partners, [
+            ['PARTNER', (r) => r.name],
+            ['DOMAIN', (r) => r.domain],
+            ['LEVEL', (r) => r.level],
+            ['STATUS', (r) => r.status],
+            ['ID', (r) => r.id],
+          ])
+          console.log()
+        },
+      })
+      .demandCommand(1, 'Use: user search | user get | user create | user partners')
+      .strict(),
+  handler: () => {},
+}