@dooer/dooer-test-env 1.14.0 → 1.15.0

package/lib/command/user.js

@@ -1,6 +1,7 @@
 const chalk = require('chalk')
 const u = require('../users')
-const { targetOptions, writeOptions, label, printTable } = require('./target')
+const remote = require('../remote')
+const { envOption, writeOption, printTable, detail } = require('./target')
 
 const date = (d) => (d ? new Date(d).toISOString().slice(0, 10) : null)
 
@@ -13,27 +14,25 @@ module.exports = {
         command: 'search [query]',
         describe: 'find users by email, name, personnummer or id (no query = the most recent users)',
         builder: (y2) =>
-          targetOptions(y2)
+          envOption(y2)
             .positional('query', { type: 'string', describe: 'substring to match' })
             .option('role', { choices: u.USER_ROLES, describe: 'only users of this role' })
             .option('limit', { type: 'number', default: 20, describe: 'max rows' }),
         handler: async (argv) => {
-          const ns = u.targetOf(argv)
-          const rows = await u.withDb(ns, (db) =>
-            u.searchUsers(db, { query: argv.query, role: argv.role, limit: argv.limit })
-          )
+          const env = remote.resolveEnv(argv.env)
+          const rows = await u.searchUsers(env, { query: argv.query, role: argv.role, limit: argv.limit })
           console.log(
-            chalk.bold(`\n${rows.length} user(s) in ${label(ns)}`) +
-              (argv.query ? chalk.gray(` matching "${argv.query}"`) : '') +
+            chalk.bold(`\n${rows.length} user(s) in ${env.label}`) +
+              (argv.query ? ` matching "${argv.query}"` : '') +
               '\n'
           )
           printTable(rows, [
             ['ID', (r) => r.id],
             ['EMAIL', (r) => r.email],
-            ['NAME', (r) => `${r.first_name} ${r.last_name}`],
-            ['ROLE', (r) => r.role],
-            ['CREATED', (r) => date(r.inserted_at)],
-            ['STATUS', (r) => (r.inactivated_at ? `inactivated ${date(r.inactivated_at)}` : 'active')],
+            ['NAME', (r) => `${r.firstName} ${r.lastName}`],
+            ['TYPE', (r) => r.userType],
+            ['CREATED', (r) => date(r.createdAt)],
+            ['STATUS', (r) => (r.isInactivated ? `inactivated ${date(r.inactivatedAt)}` : 'active')],
           ])
           console.log()
         },
@@ -41,33 +40,25 @@ module.exports = {
       .command({
         command: 'get <user>',
         describe: 'show one user (by id or email) and the partners they belong to',
-        builder: (y2) => targetOptions(y2).positional('user', { type: 'string', describe: 'user id or email' }),
+        builder: (y2) => envOption(y2).positional('user', { type: 'string', describe: 'user id or email' }),
         handler: async (argv) => {
-          const ns = u.targetOf(argv)
-          const { user, partners } = await u.withDb(ns, async (db) => {
-            const user = await u.findUser(db, argv.user)
-            return { user, partners: await u.partnersForUser(db, user.id) }
-          })
-          console.log(chalk.bold(`\n${user.first_name} ${user.last_name}`) + chalk.gray(`  (${label(ns)})\n`))
-          const line = (k, v) => console.log(`  ${k.padEnd(14)}${v === null || v === undefined ? '-' : v}`)
-          line('id', user.id)
-          line(
-            'email',
-            `${user.email}${user.email_verified ? chalk.gray(' (verified)') : chalk.yellow(' (unverified)')}`
-          )
-          line('role', user.role)
-          line('personnummer', user.personnummer)
-          line('password', user.has_password ? 'set' : chalk.yellow('none — cannot log in with a password'))
-          line('language', user.language)
-          line('created', date(user.inserted_at))
-          line('status', user.inactivated_at ? chalk.yellow(`inactivated ${date(user.inactivated_at)}`) : 'active')
-          if (user.internal) line('internal', 'yes')
+          const env = remote.resolveEnv(argv.env)
+          const user = await u.findUser(env, argv.user)
+          const partners = await u.partnersForUser(env, user.id)
+          console.log(chalk.bold(`\n${user.firstName} ${user.lastName}`) + `  (${env.label})\n`)
+          detail('id', user.id)
+          detail('email', `${user.email}${user.isEmailVerified ? ' (verified)' : chalk.yellow(' (unverified)')}`)
+          detail('user type', user.userType)
+          detail('personnummer', user.sePersonnummer || '-')
+          detail('language', user.language || '-')
+          detail('created', date(user.createdAt))
+          detail('status', user.isInactivated ? chalk.yellow(`inactivated ${date(user.inactivatedAt)}`) : 'active')
+          if (user.internal) detail('internal', 'yes')
           console.log(chalk.bold(`\n  partners (${partners.length})`))
           printTable(partners, [
             ['PARTNER', (r) => r.name],
             ['LEVEL', (r) => r.level],
             ['STATUS', (r) => r.status],
-            ['LAST LOGIN', (r) => date(r.lastLoginAt)],
             ['ID', (r) => r.id],
           ])
           console.log()
@@ -77,7 +68,7 @@ module.exports = {
         command: 'create',
         describe: 'create a user (password generated unless given). Dry-run by default.',
         builder: (y2) =>
-          writeOptions(y2)
+          writeOption(envOption(y2))
             .option('email', { type: 'string', demandOption: true, describe: 'email address (the login)' })
             .option('password', { type: 'string', describe: 'password to set (default: generated, printed once)' })
             .option('role', { choices: u.USER_ROLES, default: 'hi', describe: 'user role at dooer' })
@@ -87,8 +78,7 @@ module.exports = {
             .option('partner', { type: 'string', describe: 'also add to this partner (id, name or domain)' })
             .option('level', { choices: u.PARTNER_LEVELS, default: 'member', describe: 'level in --partner' }),
         handler: async (argv) => {
-          const ns = u.targetOf(argv)
-          u.guardWrite(ns, argv)
+          const env = remote.resolveEnv(argv.env)
           const derived = u.namesFromEmail(argv.email)
           const firstName = argv.firstName || derived.firstName
           const lastName = argv.lastName || derived.lastName
@@ -96,71 +86,57 @@ module.exports = {
           const generated = !argv.password
           const personnummer = argv.personnummer ? u.normalizePersonnummer(argv.personnummer) : null
 
-          const res = await u.withDb(ns, async (db) => {
-            // Resolve the partner BEFORE creating anything, so a typo fails without leaving a half-made user.
-            const partner = argv.partner ? await u.findPartner(db, argv.partner) : null
-            if (partner && argv.role !== 'hi') {
-              throw new Error(`--partner needs a "hi" user; role "${argv.role}" cannot belong to a partner`)
-            }
-            const created = await u.createUser(db, {
+          // Resolve the partner BEFORE creating anything, so a typo fails without leaving a half-made user.
+          const partner = argv.partner ? await u.findPartner(env, argv.partner) : null
+          if (partner && argv.role !== 'hi') {
+            throw new Error(`--partner needs a "hi" user; role "${argv.role}" cannot belong to a partner`)
+          }
+
+          let created = null
+          if (argv.execute) {
+            created = await u.createUser(env, {
               email: argv.email,
               password,
               role: argv.role,
               personnummer,
               firstName,
               lastName,
-              execute: argv.execute,
             })
-            // Only on --execute: a dry-run has no user id to attach the membership to, and the partner
-            // itself (plus the hi-only rule) has already been validated above.
-            if (partner && argv.execute) {
-              await u.assignPartner(db, {
-                user: { id: created.id, email: argv.email, role: argv.role },
-                partner,
-                level: argv.level,
-                execute: argv.execute,
-              })
-            }
-            return { created, partner }
-          })
+            if (partner) await u.assignPartner(env, { userId: created.id, partnerId: partner.id, level: argv.level })
+          }
 
           console.log(
             (argv.execute ? chalk.green('\ncreated user') : chalk.yellow('\nDRY RUN — nothing written')) +
-              chalk.gray(`  (${label(ns)})\n`)
+              `  (${env.label})\n`
           )
-          const line = (k, v) => console.log(`  ${k.padEnd(14)}${v}`)
-          if (argv.execute) line('id', res.created.id)
-          line('email', argv.email)
-          line('name', `${firstName} ${lastName}`)
-          line('role', argv.role)
-          if (personnummer) line('personnummer', personnummer)
-          line('password', chalk.bold(password) + (generated ? chalk.gray('  (generated)') : ''))
-          if (res.partner) line('partner', `${res.partner.name} — level ${argv.level}`)
+          if (created) detail('id', created.id)
+          detail('email', argv.email)
+          detail('name', `${firstName} ${lastName}`)
+          detail('user type', argv.role)
+          if (personnummer) detail('personnummer', personnummer)
+          detail('password', chalk.bold(password) + (generated ? '  (generated)' : ''))
+          if (partner) detail('partner', `${partner.name} — level ${argv.level}`)
           if (generated && argv.execute) {
-            console.log(chalk.gray('\n  The password is stored as a bcrypt hash — this is the only time it is shown.'))
+            console.log('\n  The service stores only a hash — this is the only time the password is shown.')
           }
-          if (!argv.execute) console.log(chalk.gray('\n  Re-run with --execute to create it.'))
+          if (!argv.execute) console.log('\n  Re-run with --execute to create it.')
           console.log()
         },
       })
       .command({
         command: 'partners <user>',
         describe: 'list the partners a user belongs to, and at what level',
-        builder: (y2) => targetOptions(y2).positional('user', { type: 'string', describe: 'user id or email' }),
+        builder: (y2) => envOption(y2).positional('user', { type: 'string', describe: 'user id or email' }),
         handler: async (argv) => {
-          const ns = u.targetOf(argv)
-          const { user, partners } = await u.withDb(ns, async (db) => {
-            const user = await u.findUser(db, argv.user)
-            return { user, partners: await u.partnersForUser(db, user.id) }
-          })
-          console.log(
-            chalk.bold(`\n${user.email} belongs to ${partners.length} partner(s)`) + chalk.gray(`  (${label(ns)})\n`)
-          )
+          const env = remote.resolveEnv(argv.env)
+          const user = await u.findUser(env, argv.user)
+          const partners = await u.partnersForUser(env, user.id)
+          console.log(chalk.bold(`\n${user.email} belongs to ${partners.length} partner(s)`) + `  (${env.label})\n`)
           printTable(partners, [
             ['PARTNER', (r) => r.name],
+            ['DOMAIN', (r) => r.domain],
             ['LEVEL', (r) => r.level],
             ['STATUS', (r) => r.status],
-            ['DEFAULT REP', (r) => (r.defaultRepresentative ? 'yes' : 'no')],
             ['ID', (r) => r.id],
           ])
           console.log()

package/lib/remote.js

@@ -0,0 +1,357 @@
+/* global fetch */
+// remote.js — talking to a Dooer environment through its PUBLIC GraphQL endpoint.
+//
+// Everything here goes over ordinary HTTPS to the public facade, so none of it needs kubectl, a VPN or
+// cluster credentials — the same entrypoint the frontends use. (Jimmy 2026-09-04: "use graphql instead
+// since that does not require any k8s, just call the public api endpoint". The k8s-based paths elsewhere
+// in this CLI are expected to move to another mechanism later.)
+//
+// A session is one JWT per environment, kept in the macOS keychain, obtained exactly the way the products
+// obtain it:
+//   * password — `loginWithEmail`, what back-office's shared <Login> component calls
+//     (@dooer/react-internal-components/dist/components/login/mutations.js)
+//   * BankID   — `loginWithBankIdV2` + polling `bankIdSessionV2`, the same 1000 ms cadence HQ uses; the
+//     `bankIdQRImage` field is the raw animated-QR payload (`bankid.<token>.<seconds>.<hmac>`), which we
+//     render as a real QR in the terminal and refresh each poll.
+const { spawnSync } = require('child_process')
+
+const KEYCHAIN_ACCOUNT = require('os').userInfo().username
+
+// Public GraphQL endpoints, from the environments' own manifests (DOOER_PUBLIC_FACADE_HOST /
+// public-facade route hostnames). `local` is this CLI's own stack on the host.
+const ENVIRONMENTS = {
+  local: { url: 'http://localhost:4000/graphql', label: 'local env', production: false },
+  staging: { url: 'https://api.s-e032.com/graphql', label: 'staging (s-e032)', production: false },
+  production: { url: 'https://api.dooer.com/graphql', label: 'PRODUCTION (l-e033)', production: true },
+}
+// Accept the names used elsewhere in this CLI and in conversation, so nobody has to remember a new word.
+const ALIASES = {
+  live: 'production',
+  prod: 'production',
+  'dooer-production': 'production',
+  'l-e033': 'production',
+  'dooer-staging': 'staging',
+  's-e032': 'staging',
+  stage: 'staging',
+}
+
+function resolveEnv(name) {
+  const key = ALIASES[name] || name || 'local'
+  const env = ENVIRONMENTS[key]
+  if (!env) {
+    throw new Error(`unknown environment "${name}" — one of: ${Object.keys(ENVIRONMENTS).join(', ')}`)
+  }
+  return { name: key, ...env }
+}
+
+const envNames = () => Object.keys(ENVIRONMENTS)
+
+// ── keychain ────────────────────────────────────────────────────────────────
+function sh(cmd, args, input) {
+  const r = spawnSync(cmd, args, { encoding: 'utf8', input })
+  return { status: r.status, stdout: (r.stdout || '').trim(), stderr: (r.stderr || '').trim() }
+}
+
+const keychainService = (envName) => `dooer-test-env-session:${envName}`
+
+// `security -w` prints longer values as lowercase hex (the same behaviour that bit the BankID PFX), so
+// decode when the output is pure even-length hex. A JWT is base64url with dots — never pure hex.
+function tokenGet(envName) {
+  const r = sh('security', ['find-generic-password', '-a', KEYCHAIN_ACCOUNT, '-s', keychainService(envName), '-w'])
+  if (r.status !== 0) return null
+  const out = r.stdout
+  if (out && out.length % 2 === 0 && /^[0-9a-f]+$/.test(out)) return Buffer.from(out, 'hex').toString('utf8')
+  return out || null
+}
+
+// -U upserts. The value goes on argv, which is briefly visible in the process list — same trade-off the
+// BankID store already makes on a single-user dev machine, and the keychain is the durable store.
+function tokenSet(envName, token) {
+  const r = sh('security', [
+    'add-generic-password',
+    '-U',
+    '-a',
+    KEYCHAIN_ACCOUNT,
+    '-s',
+    keychainService(envName),
+    '-D',
+    'dooer-test-env session token',
+    '-w',
+    token,
+  ])
+  if (r.status !== 0) throw new Error(`keychain store failed for ${envName}: ${r.stderr}`)
+}
+
+function tokenDelete(envName) {
+  return (
+    sh('security', ['delete-generic-password', '-a', KEYCHAIN_ACCOUNT, '-s', keychainService(envName)]).status === 0
+  )
+}
+
+// ── JWT ─────────────────────────────────────────────────────────────────────
+function decodeJwt(token) {
+  try {
+    const [, payload] = token.split('.')
+    return JSON.parse(Buffer.from(payload.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8'))
+  } catch (_) {
+    return null
+  }
+}
+
+function expiry(token) {
+  const p = decodeJwt(token)
+  if (!p || !p.exp) return null
+  return { at: new Date(p.exp * 1000), expired: p.exp * 1000 <= Date.now() }
+}
+
+// ── the token a command should use ──────────────────────────────────────────
+// Stored session first. For `local` only, fall back to minting a service token with the shared dev
+// keypair the local stack is generated with — logging in to your own throwaway stack is pointless
+// friction, and that keypair is worthless anywhere else.
+function tokenFor(envName) {
+  const stored = tokenGet(envName)
+  if (stored) {
+    const exp = expiry(stored)
+    if (exp && exp.expired) {
+      throw new Error(
+        `your ${envName} session expired ${exp.at.toISOString().slice(0, 16).replace('T', ' ')} — ` +
+          `run: dooer-test-env remote-environment login --env ${envName}`
+      )
+    }
+    return stored
+  }
+  if (envName === 'local') return require('./api').serviceToken()
+  throw new Error(`not logged in to ${envName} — run: dooer-test-env remote-environment login --env ${envName}`)
+}
+
+// ── GraphQL ─────────────────────────────────────────────────────────────────
+// One transport for every remote call. Errors come back as a readable sentence rather than a JSON dump.
+async function gql(env, query, variables, { token, anonymous } = {}) {
+  const headers = { 'content-type': 'application/json', 'x-dooer-client': 'dooer-test-env@0' }
+  if (!anonymous) headers.authorization = `Bearer ${token || tokenFor(env.name)}`
+  let res
+  try {
+    res = await fetch(env.url, { method: 'POST', headers, body: JSON.stringify({ query, variables }) })
+  } catch (e) {
+    throw new Error(`cannot reach ${env.label} at ${env.url}: ${e.message}`)
+  }
+  const text = await res.text()
+  let json
+  try {
+    json = JSON.parse(text)
+  } catch (_) {
+    throw new Error(`${env.label} returned ${res.status} (not JSON): ${text.slice(0, 200)}`)
+  }
+  if (json.errors && json.errors.length) {
+    const first = json.errors[0]
+    const code = first.code || (first.extensions && first.extensions.code) || ''
+    const err = new Error(`${env.label}${code ? ` [${code}]` : ''}: ${first.message}`)
+    // Keep the machine-readable parts. A denial carries `extra.resourceType` ("admin"/"partner"/…) and the
+    // gateway stamps a transactionId — callers should branch on those rather than re-parse the prose, and
+    // the transactionId is what you quote when asking why a call was refused.
+    err.code = code
+    err.resourceType = (first.extra && first.extra.resourceType) || null
+    err.transactionId = (first.extensions && first.extensions.transactionId) || null
+    err.graphqlPath = Array.isArray(first.path) ? first.path.join('.') : null
+    throw err
+  }
+  return json.data
+}
+
+// ── login: password ─────────────────────────────────────────────────────────
+const LOGIN_WITH_EMAIL = `mutation ($email: String!, $password: String!) {
+  loginWithEmail(email: $email, password: $password)
+}`
+
+async function loginWithPassword(env, email, password) {
+  const data = await gql(env, LOGIN_WITH_EMAIL, { email, password }, { anonymous: true })
+  return data.loginWithEmail
+}
+
+// ── login: BankID ───────────────────────────────────────────────────────────
+// sePersonnummer is optional: omitted, BankID resolves the identity from whichever device scans the QR.
+const LOGIN_WITH_BANKID = `mutation ($sePersonnummer: SwedishPersonalIdentificationNumber) {
+  loginWithBankIdV2(sePersonnummer: $sePersonnummer) {
+    id
+    bankIdQRImage
+    autoStartToken
+    status
+    hintCode
+  }
+}`
+
+const POLL_BANKID = `query ($id: ID!) {
+  bankIdSessionV2(id: $id) {
+    id
+    bankIdQRImage
+    status
+    hintCode
+    token
+  }
+}`
+
+// Human wording for the BankID hint codes that actually show up while waiting.
+const HINTS = {
+  outstandingTransaction: 'waiting for the BankID app',
+  noClient: 'waiting for the BankID app',
+  started: 'BankID app started — choose your ID',
+  userSign: 'confirm in the BankID app',
+  expiredTransaction: 'the BankID order expired',
+  userCancel: 'you cancelled in the BankID app',
+  cancelled: 'the order was cancelled',
+  startFailed: 'the BankID app did not start',
+  certificateErr: 'that BankID cannot be used (revoked, invalid, or too many wrong codes)',
+}
+
+// Start an order and poll it to completion. `onFrame({ qr, status, hintCode })` fires once per poll so the
+// caller can redraw the QR — it changes every second by design (the payload is an HMAC over elapsed
+// seconds), so a static QR goes stale and stops scanning.
+async function loginWithBankId(env, { sePersonnummer, onFrame, intervalMs = 1000, timeoutMs = 180000 }) {
+  const start = await gql(env, LOGIN_WITH_BANKID, { sePersonnummer: sePersonnummer || null }, { anonymous: true })
+  const session = start.loginWithBankIdV2
+  if (onFrame) onFrame({ qr: session.bankIdQRImage, status: session.status, hintCode: session.hintCode })
+
+  const deadline = Date.now() + timeoutMs
+  for (;;) {
+    if (Date.now() > deadline) throw new Error('BankID login timed out after 3 minutes')
+    await new Promise((r) => setTimeout(r, intervalMs))
+    const data = await gql(env, POLL_BANKID, { id: session.id }, { anonymous: true })
+    const s = data.bankIdSessionV2
+    if (!s) throw new Error('the BankID session disappeared')
+    if (onFrame) onFrame({ qr: s.bankIdQRImage, status: s.status, hintCode: s.hintCode })
+    if (s.status === 'complete') {
+      if (!s.token) throw new Error('BankID completed but returned no token')
+      return s.token
+    }
+    if (s.status === 'failed') {
+      throw new Error(`BankID failed: ${HINTS[s.hintCode] || s.hintCode || 'unknown reason'}`)
+    }
+  }
+}
+
+// ── login: BankID via the partner flow (what HQ does) ───────────────────────
+// `loginWithBankIdV2` hardcodes `user_type: 'customer'` in service-accounts
+// (lib/login-with-bank-id.js:199), so it can ONLY ever return the customer account — which is why a
+// BankID login lands on your customer user even when you meant your professional one. HQ authenticates
+// through the PARTNER session instead, which resolves the `hi` user belonging to that partner. It needs
+// the partner's `domain` (e.g. `dooer`, `dooer-devteam`) to know which partner you are signing in to.
+const LOGIN_PARTNER = `mutation ($input: PartnerAuthenticationSessionInput!) {
+  partners {
+    login(input: $input) {
+      id
+      bankIdQRImage
+      autoStartToken
+      status
+      bankidProgressStatus
+    }
+  }
+}`
+
+const POLL_PARTNER = `query ($id: ID!) {
+  partnerAuthenticationSession(id: $id) {
+    session {
+      id
+      status
+      bankidProgressStatus
+      bankIdQRImage
+    }
+    token
+  }
+}`
+
+// `domain` is '' because that is exactly what HQ sends: its login form submits `{ domain: '' }`
+// (frontend-hq/src/apps/auth/components/partner-login-form.tsx) and never asks which partner you are
+// signing in to — the server resolves that from the BankID identity.
+async function loginWithPartnerBankId(env, { idNumber, onFrame, intervalMs = 1000, timeoutMs = 180000 } = {}) {
+  const start = await gql(
+    env,
+    LOGIN_PARTNER,
+    { input: { domain: '', idNumber: idNumber || null } },
+    { anonymous: true }
+  )
+  const session = start.partners.login
+  if (onFrame) onFrame({ qr: session.bankIdQRImage, hintCode: session.bankidProgressStatus })
+
+  const deadline = Date.now() + timeoutMs
+  for (;;) {
+    if (Date.now() > deadline) throw new Error('BankID login timed out after 3 minutes')
+    await new Promise((r) => setTimeout(r, intervalMs))
+    const data = await gql(env, POLL_PARTNER, { id: session.id }, { anonymous: true })
+    const res = data.partnerAuthenticationSession
+    if (!res || !res.session) throw new Error('the partner authentication session disappeared')
+    const s = res.session
+    if (onFrame) onFrame({ qr: s.bankIdQRImage, hintCode: s.bankidProgressStatus })
+    // This flow's own status enum: pending | fulfilled | rejected.
+    if (s.status === 'fulfilled') {
+      if (!res.token) throw new Error('partner login completed but returned no token')
+      return res.token
+    }
+    if (s.status === 'rejected') {
+      throw new Error(
+        `partner BankID login rejected: ${HINTS[s.bankidProgressStatus] || s.bankidProgressStatus || 'unknown reason'}`
+      )
+    }
+  }
+}
+
+// ── become a partner user (back-office "Become user in X") ──────────────────
+// The other way to hold a partner-level session: sign in with your ADMIN account and assume a partner
+// user, rather than authenticating as them with BankID. `PartnerUserMutation.become` →
+// POST /v1/partners/actions/become, which is itself `levels: ['admin']`, and hands back a real token for
+// that partner user.
+const BECOME_PARTNER_USER = `mutation ($pid: ID!, $uid: ID!) {
+  partner(id: $pid) { user(userId: $uid) { become { redirectUrl token } } }
+}`
+
+async function becomePartnerUser(env, { partnerId, userId }) {
+  const data = await gql(env, BECOME_PARTNER_USER, { pid: partnerId, uid: userId })
+  return data.partner.user.become
+}
+
+// Becoming replaces the stored session, so the admin token that authorised it is stashed first —
+// otherwise you would have to log in again just to get back to where you were.
+const stashService = (envName) => `${envName}:before-become`
+
+function stashToken(envName) {
+  const current = tokenGet(envName)
+  if (current) tokenSet(stashService(envName), current)
+}
+
+function unstashToken(envName) {
+  const previous = tokenGet(stashService(envName))
+  if (!previous) return null
+  tokenSet(envName, previous)
+  tokenDelete(stashService(envName))
+  return previous
+}
+
+// ── whoami ──────────────────────────────────────────────────────────────────
+// userType is included deliberately: one person has several user rows (customer / hi / admin) and each
+// login route resolves to a different one, so "who am I" is not complete without "as which account".
+const CURRENT_USER = `query { currentUser { id firstName lastName email userType } }`
+
+async function currentUser(env, token) {
+  const data = await gql(env, CURRENT_USER, {}, token ? { token } : {})
+  return data.currentUser
+}
+
+module.exports = {
+  ENVIRONMENTS,
+  envNames,
+  resolveEnv,
+  tokenGet,
+  tokenSet,
+  tokenDelete,
+  decodeJwt,
+  expiry,
+  tokenFor,
+  gql,
+  loginWithPassword,
+  loginWithBankId,
+  loginWithPartnerBankId,
+  becomePartnerUser,
+  stashToken,
+  unstashToken,
+  currentUser,
+  HINTS,
+}