@dooer/dooer-test-env 1.13.0 → 1.15.0

package/lib/remote.js

@@ -0,0 +1,357 @@
+/* global fetch */
+// remote.js — talking to a Dooer environment through its PUBLIC GraphQL endpoint.
+//
+// Everything here goes over ordinary HTTPS to the public facade, so none of it needs kubectl, a VPN or
+// cluster credentials — the same entrypoint the frontends use. (Jimmy 2026-09-04: "use graphql instead
+// since that does not require any k8s, just call the public api endpoint". The k8s-based paths elsewhere
+// in this CLI are expected to move to another mechanism later.)
+//
+// A session is one JWT per environment, kept in the macOS keychain, obtained exactly the way the products
+// obtain it:
+//   * password — `loginWithEmail`, what back-office's shared <Login> component calls
+//     (@dooer/react-internal-components/dist/components/login/mutations.js)
+//   * BankID   — `loginWithBankIdV2` + polling `bankIdSessionV2`, the same 1000 ms cadence HQ uses; the
+//     `bankIdQRImage` field is the raw animated-QR payload (`bankid.<token>.<seconds>.<hmac>`), which we
+//     render as a real QR in the terminal and refresh each poll.
+const { spawnSync } = require('child_process')
+
+const KEYCHAIN_ACCOUNT = require('os').userInfo().username
+
+// Public GraphQL endpoints, from the environments' own manifests (DOOER_PUBLIC_FACADE_HOST /
+// public-facade route hostnames). `local` is this CLI's own stack on the host.
+const ENVIRONMENTS = {
+  local: { url: 'http://localhost:4000/graphql', label: 'local env', production: false },
+  staging: { url: 'https://api.s-e032.com/graphql', label: 'staging (s-e032)', production: false },
+  production: { url: 'https://api.dooer.com/graphql', label: 'PRODUCTION (l-e033)', production: true },
+}
+// Accept the names used elsewhere in this CLI and in conversation, so nobody has to remember a new word.
+const ALIASES = {
+  live: 'production',
+  prod: 'production',
+  'dooer-production': 'production',
+  'l-e033': 'production',
+  'dooer-staging': 'staging',
+  's-e032': 'staging',
+  stage: 'staging',
+}
+
+function resolveEnv(name) {
+  const key = ALIASES[name] || name || 'local'
+  const env = ENVIRONMENTS[key]
+  if (!env) {
+    throw new Error(`unknown environment "${name}" — one of: ${Object.keys(ENVIRONMENTS).join(', ')}`)
+  }
+  return { name: key, ...env }
+}
+
+const envNames = () => Object.keys(ENVIRONMENTS)
+
+// ── keychain ────────────────────────────────────────────────────────────────
+function sh(cmd, args, input) {
+  const r = spawnSync(cmd, args, { encoding: 'utf8', input })
+  return { status: r.status, stdout: (r.stdout || '').trim(), stderr: (r.stderr || '').trim() }
+}
+
+const keychainService = (envName) => `dooer-test-env-session:${envName}`
+
+// `security -w` prints longer values as lowercase hex (the same behaviour that bit the BankID PFX), so
+// decode when the output is pure even-length hex. A JWT is base64url with dots — never pure hex.
+function tokenGet(envName) {
+  const r = sh('security', ['find-generic-password', '-a', KEYCHAIN_ACCOUNT, '-s', keychainService(envName), '-w'])
+  if (r.status !== 0) return null
+  const out = r.stdout
+  if (out && out.length % 2 === 0 && /^[0-9a-f]+$/.test(out)) return Buffer.from(out, 'hex').toString('utf8')
+  return out || null
+}
+
+// -U upserts. The value goes on argv, which is briefly visible in the process list — same trade-off the
+// BankID store already makes on a single-user dev machine, and the keychain is the durable store.
+function tokenSet(envName, token) {
+  const r = sh('security', [
+    'add-generic-password',
+    '-U',
+    '-a',
+    KEYCHAIN_ACCOUNT,
+    '-s',
+    keychainService(envName),
+    '-D',
+    'dooer-test-env session token',
+    '-w',
+    token,
+  ])
+  if (r.status !== 0) throw new Error(`keychain store failed for ${envName}: ${r.stderr}`)
+}
+
+function tokenDelete(envName) {
+  return (
+    sh('security', ['delete-generic-password', '-a', KEYCHAIN_ACCOUNT, '-s', keychainService(envName)]).status === 0
+  )
+}
+
+// ── JWT ─────────────────────────────────────────────────────────────────────
+function decodeJwt(token) {
+  try {
+    const [, payload] = token.split('.')
+    return JSON.parse(Buffer.from(payload.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8'))
+  } catch (_) {
+    return null
+  }
+}
+
+function expiry(token) {
+  const p = decodeJwt(token)
+  if (!p || !p.exp) return null
+  return { at: new Date(p.exp * 1000), expired: p.exp * 1000 <= Date.now() }
+}
+
+// ── the token a command should use ──────────────────────────────────────────
+// Stored session first. For `local` only, fall back to minting a service token with the shared dev
+// keypair the local stack is generated with — logging in to your own throwaway stack is pointless
+// friction, and that keypair is worthless anywhere else.
+function tokenFor(envName) {
+  const stored = tokenGet(envName)
+  if (stored) {
+    const exp = expiry(stored)
+    if (exp && exp.expired) {
+      throw new Error(
+        `your ${envName} session expired ${exp.at.toISOString().slice(0, 16).replace('T', ' ')} — ` +
+          `run: dooer-test-env remote-environment login --env ${envName}`
+      )
+    }
+    return stored
+  }
+  if (envName === 'local') return require('./api').serviceToken()
+  throw new Error(`not logged in to ${envName} — run: dooer-test-env remote-environment login --env ${envName}`)
+}
+
+// ── GraphQL ─────────────────────────────────────────────────────────────────
+// One transport for every remote call. Errors come back as a readable sentence rather than a JSON dump.
+async function gql(env, query, variables, { token, anonymous } = {}) {
+  const headers = { 'content-type': 'application/json', 'x-dooer-client': 'dooer-test-env@0' }
+  if (!anonymous) headers.authorization = `Bearer ${token || tokenFor(env.name)}`
+  let res
+  try {
+    res = await fetch(env.url, { method: 'POST', headers, body: JSON.stringify({ query, variables }) })
+  } catch (e) {
+    throw new Error(`cannot reach ${env.label} at ${env.url}: ${e.message}`)
+  }
+  const text = await res.text()
+  let json
+  try {
+    json = JSON.parse(text)
+  } catch (_) {
+    throw new Error(`${env.label} returned ${res.status} (not JSON): ${text.slice(0, 200)}`)
+  }
+  if (json.errors && json.errors.length) {
+    const first = json.errors[0]
+    const code = first.code || (first.extensions && first.extensions.code) || ''
+    const err = new Error(`${env.label}${code ? ` [${code}]` : ''}: ${first.message}`)
+    // Keep the machine-readable parts. A denial carries `extra.resourceType` ("admin"/"partner"/…) and the
+    // gateway stamps a transactionId — callers should branch on those rather than re-parse the prose, and
+    // the transactionId is what you quote when asking why a call was refused.
+    err.code = code
+    err.resourceType = (first.extra && first.extra.resourceType) || null
+    err.transactionId = (first.extensions && first.extensions.transactionId) || null
+    err.graphqlPath = Array.isArray(first.path) ? first.path.join('.') : null
+    throw err
+  }
+  return json.data
+}
+
+// ── login: password ─────────────────────────────────────────────────────────
+const LOGIN_WITH_EMAIL = `mutation ($email: String!, $password: String!) {
+  loginWithEmail(email: $email, password: $password)
+}`
+
+async function loginWithPassword(env, email, password) {
+  const data = await gql(env, LOGIN_WITH_EMAIL, { email, password }, { anonymous: true })
+  return data.loginWithEmail
+}
+
+// ── login: BankID ───────────────────────────────────────────────────────────
+// sePersonnummer is optional: omitted, BankID resolves the identity from whichever device scans the QR.
+const LOGIN_WITH_BANKID = `mutation ($sePersonnummer: SwedishPersonalIdentificationNumber) {
+  loginWithBankIdV2(sePersonnummer: $sePersonnummer) {
+    id
+    bankIdQRImage
+    autoStartToken
+    status
+    hintCode
+  }
+}`
+
+const POLL_BANKID = `query ($id: ID!) {
+  bankIdSessionV2(id: $id) {
+    id
+    bankIdQRImage
+    status
+    hintCode
+    token
+  }
+}`
+
+// Human wording for the BankID hint codes that actually show up while waiting.
+const HINTS = {
+  outstandingTransaction: 'waiting for the BankID app',
+  noClient: 'waiting for the BankID app',
+  started: 'BankID app started — choose your ID',
+  userSign: 'confirm in the BankID app',
+  expiredTransaction: 'the BankID order expired',
+  userCancel: 'you cancelled in the BankID app',
+  cancelled: 'the order was cancelled',
+  startFailed: 'the BankID app did not start',
+  certificateErr: 'that BankID cannot be used (revoked, invalid, or too many wrong codes)',
+}
+
+// Start an order and poll it to completion. `onFrame({ qr, status, hintCode })` fires once per poll so the
+// caller can redraw the QR — it changes every second by design (the payload is an HMAC over elapsed
+// seconds), so a static QR goes stale and stops scanning.
+async function loginWithBankId(env, { sePersonnummer, onFrame, intervalMs = 1000, timeoutMs = 180000 }) {
+  const start = await gql(env, LOGIN_WITH_BANKID, { sePersonnummer: sePersonnummer || null }, { anonymous: true })
+  const session = start.loginWithBankIdV2
+  if (onFrame) onFrame({ qr: session.bankIdQRImage, status: session.status, hintCode: session.hintCode })
+
+  const deadline = Date.now() + timeoutMs
+  for (;;) {
+    if (Date.now() > deadline) throw new Error('BankID login timed out after 3 minutes')
+    await new Promise((r) => setTimeout(r, intervalMs))
+    const data = await gql(env, POLL_BANKID, { id: session.id }, { anonymous: true })
+    const s = data.bankIdSessionV2
+    if (!s) throw new Error('the BankID session disappeared')
+    if (onFrame) onFrame({ qr: s.bankIdQRImage, status: s.status, hintCode: s.hintCode })
+    if (s.status === 'complete') {
+      if (!s.token) throw new Error('BankID completed but returned no token')
+      return s.token
+    }
+    if (s.status === 'failed') {
+      throw new Error(`BankID failed: ${HINTS[s.hintCode] || s.hintCode || 'unknown reason'}`)
+    }
+  }
+}
+
+// ── login: BankID via the partner flow (what HQ does) ───────────────────────
+// `loginWithBankIdV2` hardcodes `user_type: 'customer'` in service-accounts
+// (lib/login-with-bank-id.js:199), so it can ONLY ever return the customer account — which is why a
+// BankID login lands on your customer user even when you meant your professional one. HQ authenticates
+// through the PARTNER session instead, which resolves the `hi` user belonging to that partner. It needs
+// the partner's `domain` (e.g. `dooer`, `dooer-devteam`) to know which partner you are signing in to.
+const LOGIN_PARTNER = `mutation ($input: PartnerAuthenticationSessionInput!) {
+  partners {
+    login(input: $input) {
+      id
+      bankIdQRImage
+      autoStartToken
+      status
+      bankidProgressStatus
+    }
+  }
+}`
+
+const POLL_PARTNER = `query ($id: ID!) {
+  partnerAuthenticationSession(id: $id) {
+    session {
+      id
+      status
+      bankidProgressStatus
+      bankIdQRImage
+    }
+    token
+  }
+}`
+
+// `domain` is '' because that is exactly what HQ sends: its login form submits `{ domain: '' }`
+// (frontend-hq/src/apps/auth/components/partner-login-form.tsx) and never asks which partner you are
+// signing in to — the server resolves that from the BankID identity.
+async function loginWithPartnerBankId(env, { idNumber, onFrame, intervalMs = 1000, timeoutMs = 180000 } = {}) {
+  const start = await gql(
+    env,
+    LOGIN_PARTNER,
+    { input: { domain: '', idNumber: idNumber || null } },
+    { anonymous: true }
+  )
+  const session = start.partners.login
+  if (onFrame) onFrame({ qr: session.bankIdQRImage, hintCode: session.bankidProgressStatus })
+
+  const deadline = Date.now() + timeoutMs
+  for (;;) {
+    if (Date.now() > deadline) throw new Error('BankID login timed out after 3 minutes')
+    await new Promise((r) => setTimeout(r, intervalMs))
+    const data = await gql(env, POLL_PARTNER, { id: session.id }, { anonymous: true })
+    const res = data.partnerAuthenticationSession
+    if (!res || !res.session) throw new Error('the partner authentication session disappeared')
+    const s = res.session
+    if (onFrame) onFrame({ qr: s.bankIdQRImage, hintCode: s.bankidProgressStatus })
+    // This flow's own status enum: pending | fulfilled | rejected.
+    if (s.status === 'fulfilled') {
+      if (!res.token) throw new Error('partner login completed but returned no token')
+      return res.token
+    }
+    if (s.status === 'rejected') {
+      throw new Error(
+        `partner BankID login rejected: ${HINTS[s.bankidProgressStatus] || s.bankidProgressStatus || 'unknown reason'}`
+      )
+    }
+  }
+}
+
+// ── become a partner user (back-office "Become user in X") ──────────────────
+// The other way to hold a partner-level session: sign in with your ADMIN account and assume a partner
+// user, rather than authenticating as them with BankID. `PartnerUserMutation.become` →
+// POST /v1/partners/actions/become, which is itself `levels: ['admin']`, and hands back a real token for
+// that partner user.
+const BECOME_PARTNER_USER = `mutation ($pid: ID!, $uid: ID!) {
+  partner(id: $pid) { user(userId: $uid) { become { redirectUrl token } } }
+}`
+
+async function becomePartnerUser(env, { partnerId, userId }) {
+  const data = await gql(env, BECOME_PARTNER_USER, { pid: partnerId, uid: userId })
+  return data.partner.user.become
+}
+
+// Becoming replaces the stored session, so the admin token that authorised it is stashed first —
+// otherwise you would have to log in again just to get back to where you were.
+const stashService = (envName) => `${envName}:before-become`
+
+function stashToken(envName) {
+  const current = tokenGet(envName)
+  if (current) tokenSet(stashService(envName), current)
+}
+
+function unstashToken(envName) {
+  const previous = tokenGet(stashService(envName))
+  if (!previous) return null
+  tokenSet(envName, previous)
+  tokenDelete(stashService(envName))
+  return previous
+}
+
+// ── whoami ──────────────────────────────────────────────────────────────────
+// userType is included deliberately: one person has several user rows (customer / hi / admin) and each
+// login route resolves to a different one, so "who am I" is not complete without "as which account".
+const CURRENT_USER = `query { currentUser { id firstName lastName email userType } }`
+
+async function currentUser(env, token) {
+  const data = await gql(env, CURRENT_USER, {}, token ? { token } : {})
+  return data.currentUser
+}
+
+module.exports = {
+  ENVIRONMENTS,
+  envNames,
+  resolveEnv,
+  tokenGet,
+  tokenSet,
+  tokenDelete,
+  decodeJwt,
+  expiry,
+  tokenFor,
+  gql,
+  loginWithPassword,
+  loginWithBankId,
+  loginWithPartnerBankId,
+  becomePartnerUser,
+  stashToken,
+  unstashToken,
+  currentUser,
+  HINTS,
+}

package/lib/users.js

@@ -0,0 +1,279 @@
+// users.js — user and partner-membership operations against any environment, over its PUBLIC GraphQL
+// endpoint (see lib/remote.js). No SQL, no kubectl: these are the same mutations the products call, so
+// every rule the API enforces — input validation, password hashing, the `hi`-only partner check — applies
+// here for free rather than being reimplemented and drifting.
+//
+//   users.create            back-office /users/new (UsersMutation.create → POST /v1/users)
+//   partner.users.set       PartnerUsersMutation.set → PUT /v1/partners/:id/users/:userId
+//   partner.user.delete     PartnerUserMutation.delete
+const crypto = require('crypto')
+const remote = require('./remote')
+
+// service_accounts.user_roles_at_dooer, as exposed by the GraphQL UserType enum. `hiab` exists in the
+// table but is legacy — not offered as a choice.
+const USER_ROLES = ['hi', 'customer', 'admin']
+// PartnerUserRole — the "level" within a partner, distinct from the user's role at Dooer.
+const PARTNER_LEVELS = ['member', 'admin']
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+// ── password ────────────────────────────────────────────────────────────────
+// Ambiguous glyphs (0/O, 1/l/I) are left out — these get read off a screen and typed into a login form.
+// The service hashes it; this CLI never sees a hash.
+const ALPHABET = 'abcdefghjkmnpqrstuvwxyzABCDEFGHJKMNPQRSTUVWXYZ23456789'
+
+function generatePassword(groups = 4, size = 5) {
+  const chunk = () => Array.from({ length: size }, () => ALPHABET[crypto.randomInt(ALPHABET.length)]).join('')
+  return Array.from({ length: groups }, chunk).join('-')
+}
+
+// ── personnummer ────────────────────────────────────────────────────────────
+// The API's `SwedishPersonalIdentificationNumber` scalar wants 12 bare digits AND a correct Luhn check
+// digit over the last 10 (@dooer/json-validator: is-my-svenskt-personnummer-valid). Checking both here
+// turns "is not svenskt-personnummer format" — a GraphQL variable-coercion dump that does not say WHICH
+// rule failed — into a sentence, and catches an invented number before it costs a round trip.
+function luhnOk(tenDigits) {
+  let sum = 0
+  for (let i = 0; i < 10; i++) {
+    const double = i % 2 === 0
+    let d = Number(tenDigits[i]) * (double ? 2 : 1)
+    if (d > 9) d -= 9
+    sum += d
+  }
+  return sum % 10 === 0
+}
+
+function normalizePersonnummer(input) {
+  const digits = String(input).replace(/\D/g, '')
+  let full
+  if (digits.length === 12) full = digits
+  else if (digits.length === 10) {
+    // YY greater than the current two-digit year means last century — the usual short-form expansion.
+    const yy = Number(digits.slice(0, 2))
+    full = (yy > new Date().getFullYear() % 100 ? '19' : '20') + digits
+  } else {
+    throw new Error(`personnummer must be 10 or 12 digits (got ${digits.length}): ${input}`)
+  }
+  const [, m, d] = /^\d{4}(\d{2})(\d{2})/.exec(full)
+  if (Number.isNaN(Date.parse(`${full.slice(0, 4)}-${m}-${d}`))) {
+    throw new Error(`personnummer ${full} is not a real date`)
+  }
+  if (!luhnOk(full.slice(2))) {
+    throw new Error(
+      `personnummer ${full} has an invalid check digit — the API validates it, so an invented number is rejected`
+    )
+  }
+  return full
+}
+
+// ── name defaults ───────────────────────────────────────────────────────────
+// firstName/lastName are required by UserInput; derive something sane so the common case is just --email.
+function namesFromEmail(email) {
+  const parts = email
+    .split('@')[0]
+    .split(/[._+-]+/)
+    .filter(Boolean)
+  const cap = (s) => s.charAt(0).toUpperCase() + s.slice(1)
+  return { firstName: cap(parts[0] || 'Test'), lastName: cap(parts.slice(1).join(' ') || 'User') }
+}
+
+// ── permission errors ───────────────────────────────────────────────────────
+// A denial comes back as `Forbidden: No access allowed for resource 'admin:<uuid>'`, which says nothing
+// about what to do next. Rewrite it into the actual problem: this operation needs a different one of your
+// accounts than the one you are signed in as.
+//
+// The branch is on the server's STRUCTURED `extra.resourceType`, not on the prose — the sentence is a
+// human-facing string that can be reworded, and matching it would silently stop working when it is.
+async function withLevel(env, need, fn) {
+  try {
+    return await fn()
+  } catch (e) {
+    const required = e.code === 'forbidden' ? e.resourceType : null
+    if (!required) throw e
+    let asWho = ''
+    try {
+      const me = await remote.currentUser(env)
+      if (me) asWho = ` You are signed in to ${env.name} as ${me.email} (${me.userType}).`
+    } catch (_) {
+      /* whoami is a nicety; never let it mask the real error */
+    }
+    const how =
+      required === 'admin'
+        ? `dooer-test-env remote-environment login --env ${env.name} --email <your-admin-email>`
+        : `dooer-test-env remote-environment login --env ${env.name}`
+    throw new Error(
+      `${need} needs ${
+        /^[aeiou]/.test(required) ? 'an' : 'a'
+      } "${required}" session.${asWho}\n\n  Log in as an account that has it:\n    ${how}\n`
+    )
+  }
+}
+
+// ── reads ───────────────────────────────────────────────────────────────────
+const USER_FIELDS = `id email firstName lastName userType sePersonnummer isEmailVerified
+  isInactivated inactivatedAt createdAt language internal`
+
+async function searchUsers(env, { query, role, limit }) {
+  const filter = role ? `userType eq "${role}"` : null
+  const data = await withLevel(env, 'listing users', () =>
+    remote.gql(
+      env,
+      `query ($q: String, $filter: String, $first: Int) {
+      users(q: $q, filter: $filter, first: $first) { edges { node { ${USER_FIELDS} } } }
+    }`,
+      { q: query || null, filter, first: limit }
+    )
+  )
+  return data.users.edges.map((e) => e.node)
+}
+
+// Addressable by uuid or email — nobody remembers uuids.
+async function findUser(env, ref) {
+  if (UUID_RE.test(ref)) {
+    const data = await withLevel(env, 'reading a user', () =>
+      remote.gql(env, `query ($id: ID!) { user(id: $id) { ${USER_FIELDS} } }`, { id: ref })
+    )
+    if (!data.user) throw new Error(`no user with id ${ref}`)
+    return data.user
+  }
+  const data = await withLevel(env, 'looking a user up by email', () =>
+    remote.gql(
+      env,
+      `query ($filter: String) { users(filter: $filter, first: 10) { edges { node { ${USER_FIELDS} } } } }`,
+      { filter: `email eq "${ref.replace(/"/g, '\\"')}"` }
+    )
+  )
+  const rows = data.users.edges.map((e) => e.node)
+  if (!rows.length) throw new Error(`no user matching "${ref}"`)
+  if (rows.length > 1) {
+    // One address can exist once per user type, so an ambiguous email must be resolved by the caller.
+    throw new Error(
+      `"${ref}" matches ${rows.length} users (${rows.map((r) => r.userType).join(', ')}) — ` +
+        `address it by id: ${rows.map((r) => r.id).join(', ')}`
+    )
+  }
+  return rows[0]
+}
+
+async function listPartners(env) {
+  const data = await withLevel(env, 'listing every partner', () =>
+    remote.gql(env, `query { partners(first: 200) { edges { node { id name domain status } } } }`)
+  )
+  return data.partners.edges.map((e) => e.node)
+}
+
+// The partners one user belongs to, with the level from each partner's membership row.
+async function partnersForUser(env, userId) {
+  const data = await withLevel(env, 'reading a user’s partners', () =>
+    remote.gql(env, `query ($id: ID!) { user(id: $id) { partners { id name domain } } }`, { id: userId })
+  )
+  const partners = (data.user && data.user.partners) || []
+  return Promise.all(
+    partners.map(async (p) => {
+      try {
+        const d = await remote.gql(
+          env,
+          `query ($pid: ID!, $uid: ID!) { partner(id: $pid) { user(userId: $uid) { role status defaultRepresentative } } }`,
+          { pid: p.id, uid: userId }
+        )
+        const pu = d.partner && d.partner.user
+        return {
+          ...p,
+          level: pu && pu.role,
+          status: pu && pu.status,
+          defaultRepresentative: pu && pu.defaultRepresentative,
+        }
+      } catch (_) {
+        // Membership detail needs partner level for THAT partner; the membership itself is still true.
+        return { ...p, level: null, status: null, defaultRepresentative: null }
+      }
+    })
+  )
+}
+
+async function findPartner(env, ref) {
+  if (UUID_RE.test(ref)) {
+    const data = await withLevel(env, 'reading a partner', () =>
+      remote.gql(env, `query ($id: ID!) { partner(id: $id) { id name domain status } }`, { id: ref })
+    )
+    if (!data.partner) throw new Error(`no partner with id ${ref}`)
+    return data.partner
+  }
+  const all = await listPartners(env)
+  const hit = all.filter(
+    (p) => p.name.toLowerCase() === ref.toLowerCase() || p.domain.toLowerCase() === ref.toLowerCase()
+  )
+  if (!hit.length) throw new Error(`no partner matching "${ref}" (see: dooer-test-env partner list --env ${env.name})`)
+  if (hit.length > 1) throw new Error(`"${ref}" matches ${hit.length} partners — address it by id`)
+  return hit[0]
+}
+
+async function partnerUsers(env, partnerId) {
+  const data = await withLevel(env, 'listing a partner’s users', () =>
+    remote.gql(
+      env,
+      `query ($id: ID!) {
+      partner(id: $id) { users(first: 500) { edges { node {
+        userId role status defaultRepresentative user { email firstName lastName }
+      } } } }
+    }`,
+      { id: partnerId }
+    )
+  )
+  return data.partner.users.edges.map((e) => e.node)
+}
+
+// ── writes ──────────────────────────────────────────────────────────────────
+async function createUser(env, { email, password, role, personnummer, firstName, lastName }) {
+  const input = { email, password, userType: role, firstName, lastName }
+  if (personnummer) input.sePersonnummer = personnummer
+  const data = await withLevel(env, 'creating a user', () =>
+    remote.gql(
+      env,
+      `mutation ($input: UserInput!) {
+      users { create(input: $input) { id email userType } }
+    }`,
+      { input }
+    )
+  )
+  return data.users.create
+}
+
+async function assignPartner(env, { userId, partnerId, level }) {
+  const data = await withLevel(env, 'changing partner membership', () =>
+    remote.gql(
+      env,
+      `mutation ($pid: ID!, $uid: ID!, $input: PartnerUserInput!) {
+      partner(id: $pid) { users { set(userId: $uid, input: $input) { userId role status } } }
+    }`,
+      { pid: partnerId, uid: userId, input: { role: level, status: 'enabled' } }
+    )
+  )
+  return data.partner.users.set
+}
+
+async function unassignPartner(env, { userId, partnerId }) {
+  await withLevel(env, 'removing partner membership', () =>
+    remote.gql(env, `mutation ($pid: ID!, $uid: ID!) { partner(id: $pid) { user(userId: $uid) { delete } } }`, {
+      pid: partnerId,
+      uid: userId,
+    })
+  )
+}
+
+module.exports = {
+  USER_ROLES,
+  PARTNER_LEVELS,
+  generatePassword,
+  normalizePersonnummer,
+  namesFromEmail,
+  searchUsers,
+  findUser,
+  listPartners,
+  partnersForUser,
+  findPartner,
+  partnerUsers,
+  createUser,
+  assignPartner,
+  unassignPartner,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dooer/dooer-test-env",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "Run the whole Dooer backend locally (staging DB minus customers), copy/purge customers between environments, and shred — one CLI.",
   "license": "UNLICENSED",
   "repository": "Dooer/cli-dooer-test-env",
@@ -32,6 +32,7 @@
     "pg": "^8.23.0",
     "pg-copy-streams": "^6.0.0",
     "pg-cursor": "^2.11.0",
+    "qrcode-terminal": "^0.12.0",
     "yargs": "^17.7.2"
   },
   "devDependencies": {