@dooer/dooer-test-env 1.14.0 → 1.16.0

package/lib/command/remote-environment.js

@@ -0,0 +1,292 @@
+const readline = require('readline')
+const chalk = require('chalk')
+const qrcode = require('qrcode-terminal')
+const remote = require('../remote')
+
+// Log in to a remote Dooer environment over its public GraphQL endpoint and keep the session in the
+// keychain, so the other commands (user / partner) can act as you without any cluster access.
+
+// Everything this command prints is information you need to read, so it goes out in the terminal's own
+// foreground colour. chalk.gray renders as near-invisible on a dark profile (Jimmy 2026-09-04).
+const plain = (s) => s
+
+const envOption = (y) =>
+  y.option('env', {
+    type: 'string',
+    default: 'local',
+    describe: `environment: ${remote.envNames().join(' | ')}`,
+  })
+
+// ── prompts ─────────────────────────────────────────────────────────────────
+function ask(question) {
+  return new Promise((resolve, reject) => {
+    if (!process.stdin.isTTY) {
+      reject(new Error(`need a terminal to ask for "${question.trim()}" — pass it as a flag instead`))
+      return
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true })
+    rl.question(question, (answer) => {
+      rl.close()
+      resolve(answer.trim())
+    })
+  })
+}
+
+// Hidden input by reading raw keystrokes rather than overriding readline's internal `_writeToOutput`.
+// That override races with input that arrives before the prompt is drawn and leaves the line half-erased;
+// raw mode simply never echoes, which is both simpler and what it looks like it does.
+function askHidden(question) {
+  return new Promise((resolve, reject) => {
+    const { stdin, stdout } = process
+    if (!stdin.isTTY) {
+      reject(new Error(`need a terminal to ask for "${question.trim()}" — pass it as a flag instead`))
+      return
+    }
+    stdout.write(question)
+    let value = ''
+    const wasRaw = stdin.isRaw
+    stdin.setRawMode(true)
+    stdin.resume()
+    stdin.setEncoding('utf8')
+    const done = (err, out) => {
+      stdin.removeListener('data', onData)
+      stdin.setRawMode(wasRaw)
+      stdin.pause()
+      stdout.write('\n')
+      err ? reject(err) : resolve(out)
+    }
+    const onData = (chunk) => {
+      for (const ch of chunk) {
+        if (ch === '\r' || ch === '\n' || ch === '') return done(null, value)
+        if (ch === '') return done(new Error('cancelled')) // Ctrl-C
+        if (ch === '' || ch === '\b') value = value.slice(0, -1)
+        else if (ch >= ' ') value += ch
+      }
+    }
+    stdin.on('data', onData)
+  })
+}
+
+// ── terminal QR ─────────────────────────────────────────────────────────────
+// The BankID payload changes every second, so the QR is redrawn in place: render, remember how many lines
+// it occupied, then move the cursor back up over them before the next frame. Falls back to plain appending
+// when stdout is not a terminal (piped output, CI) so the log stays readable.
+function qrRenderer() {
+  let lastLines = 0
+  return (payload, statusLine) => {
+    qrcode.generate(payload, { small: true }, (art) => {
+      const block = `${art}\n${statusLine}\n`
+      const lines = block.split('\n').length - 1
+      if (process.stdout.isTTY && lastLines) process.stdout.write(`[${lastLines}A`)
+      process.stdout.write(block)
+      lastLines = process.stdout.isTTY ? lines : 0
+    })
+  }
+}
+
+// ── shared: store a token and report who it belongs to ──────────────────────
+// Detail lines are printed in the terminal's default colour: chalk.gray renders as near-invisible on a
+// dark profile, and everything below is information you need to read (Jimmy 2026-09-04).
+const detail = (k, v) => console.log(`  ${chalk.cyan(k.padEnd(12))}${v}`)
+
+async function storeAndReport(env, token) {
+  remote.tokenSet(env.name, token)
+  const me = await remote.currentUser(env, token)
+  const exp = remote.expiry(token)
+  console.log(
+    chalk.green(`\nlogged in to ${env.label}`) +
+      (me ? ` as ${chalk.bold(`${me.firstName} ${me.lastName}`)} <${me.email}>` : '')
+  )
+  if (me) {
+    detail('user id', me.id)
+    // Which of your accounts this is. `admin` is required to create users; partner operations need a
+    // partner-level session; a `customer` token can do neither.
+    detail('user type', me.userType === 'admin' ? chalk.bold(me.userType) : me.userType)
+  }
+  detail('session', `stored in keychain${exp ? `, valid until ${exp.at.toISOString()}` : ''}`)
+  detail('check with', `dooer-test-env remote-environment status --env ${env.name}`)
+  console.log()
+}
+
+module.exports = {
+  command: 'remote-environment <command>',
+  aliases: ['remote'],
+  describe: 'log in to an environment through its public GraphQL API (session kept in the keychain)',
+  builder: (y) =>
+    y
+      .command({
+        command: 'login',
+        describe: 'log in with BankID (default) or email + password',
+        builder: (y2) =>
+          envOption(y2)
+            .option('bankid', { type: 'boolean', describe: 'log in with BankID (default when no --email)' })
+            .option('customer', {
+              type: 'boolean',
+              describe: 'BankID: sign in as your CUSTOMER account instead of your professional one',
+            })
+            .option('personnummer', { type: 'string', describe: 'BankID: your personnummer (default: any, via QR)' })
+            .option('email', { type: 'string', describe: 'log in with this email + password instead of BankID' })
+            .option('password', { type: 'string', describe: 'password (omit to be prompted, which is safer)' }),
+        handler: async (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const usePassword = Boolean(argv.email || argv.password) && !argv.bankid
+
+          if (usePassword) {
+            const email = argv.email || (await ask('email: '))
+            const password = argv.password || (await askHidden('password: '))
+            console.log(plain(`\nauthenticating against ${env.url} …`))
+            await storeAndReport(env, await remote.loginWithPassword(env, email, password))
+            return
+          }
+
+          // Default to HQ's flow — the partner authentication session, which resolves your professional
+          // (`hi`) account. `loginWithBankIdV2` is the other route, but service-accounts pins it to
+          // user_type 'customer' (lib/login-with-bank-id.js:199), so it can only ever return that account.
+          const asCustomer = Boolean(argv.customer)
+          console.log(
+            chalk.bold(`\nBankID login — ${env.label}`) +
+              plain(
+                `\n${env.url}\n` +
+                  (asCustomer ? 'signing in as your customer account\n' : '') +
+                  `\nOpen the BankID app and scan this code (it refreshes every second):\n`
+              )
+          )
+          const draw = qrRenderer()
+          const onFrame = ({ qr, hintCode }) => {
+            if (!qr) return
+            draw(qr, plain(`  ${remote.HINTS[hintCode] || hintCode || 'starting…'}  (Ctrl-C to abort)`))
+          }
+          const token = asCustomer
+            ? await remote.loginWithBankId(env, { sePersonnummer: argv.personnummer, onFrame })
+            : await remote.loginWithPartnerBankId(env, { idNumber: argv.personnummer, onFrame })
+          await storeAndReport(env, token)
+        },
+      })
+      .command({
+        command: 'become [user]',
+        describe: 'as an ADMIN, assume a partner user to get a partner-level session (back-office “Become user”)',
+        builder: (y2) =>
+          envOption(y2)
+            .positional('user', { type: 'string', describe: 'user id or email of the partner user' })
+            .option('partner', { type: 'string', describe: 'which partner (needed only if they belong to several)' })
+            .option('revert', { type: 'boolean', describe: 'restore the session you had before becoming' }),
+        handler: async (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const u = require('../users')
+
+          if (argv.revert) {
+            const restored = remote.unstashToken(env.name)
+            if (!restored) throw new Error(`no stashed session for ${env.name} — nothing to revert to`)
+            const me = await remote.currentUser(env, restored)
+            console.log(chalk.green(`\nback to ${me.email} (${me.userType}) on ${env.label}\n`))
+            return
+          }
+
+          if (!argv.user) throw new Error('which user? pass a user id or email (or --revert)')
+          const user = await u.findUser(env, argv.user)
+          const partners = await u.partnersForUser(env, user.id)
+          if (!partners.length) throw new Error(`${user.email} does not belong to any partner`)
+          const partner = argv.partner
+            ? await u.findPartner(env, argv.partner)
+            : partners.length === 1
+            ? partners[0]
+            : null
+          if (!partner) {
+            throw new Error(
+              `${user.email} belongs to ${partners.length} partners — pick one with --partner:\n` +
+                partners.map((p) => `    ${p.name} (${p.domain})`).join('\n')
+            )
+          }
+          // Keep the admin token: becoming replaces the session, and you will want it back.
+          remote.stashToken(env.name)
+          const { token } = await remote.becomePartnerUser(env, { partnerId: partner.id, userId: user.id })
+          await storeAndReport(env, token)
+          console.log(`  Revert with: dooer-test-env remote-environment become --revert --env ${env.name}\n`)
+        },
+      })
+      .command({
+        command: 'token',
+        describe: 'print the stored token for an environment — bare, for scripts',
+        builder: envOption,
+        handler: (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          // Deliberately the ONLY thing on stdout: no colour, no label, no trailing prose, so
+          // `$(… token)` and `| pbcopy` both do the obvious thing. Failures go to stderr via cli.js.
+          process.stdout.write(remote.tokenFor(env.name) + '\n')
+        },
+      })
+      .command({
+        command: 'status',
+        describe: 'who you are logged in as, and until when',
+        builder: (y2) => envOption(y2).option('all', { type: 'boolean', describe: 'report every environment' }),
+        handler: async (argv) => {
+          const names = argv.all ? remote.envNames() : [remote.resolveEnv(argv.env).name]
+          console.log()
+          for (const name of names) {
+            const env = remote.resolveEnv(name)
+            const token = remote.tokenGet(name)
+            const head = `${chalk.bold(env.label.padEnd(22))}`
+            if (!token) {
+              // The local stack needs no login — it is signed with the shared dev keypair this CLI holds.
+              const note =
+                name === 'local' ? plain('no session — uses a minted service token') : chalk.yellow('not logged in')
+              console.log(`${head}${note}`)
+              continue
+            }
+            const exp = remote.expiry(token)
+            if (exp && exp.expired) {
+              console.log(`${head}${chalk.yellow(`session EXPIRED ${exp.at.toISOString()}`)}`)
+              continue
+            }
+            let me = null
+            try {
+              me = await remote.currentUser(env, token)
+            } catch (e) {
+              console.log(`${head}${chalk.red(`session rejected — ${e.message}`)}`)
+              continue
+            }
+            console.log(
+              `${head}${chalk.green(me ? `${me.firstName} ${me.lastName} <${me.email}>` : 'valid session')}` +
+                plain(exp ? `  until ${exp.at.toISOString()}` : '')
+            )
+            // The account type decides what this session may do, so it belongs in the whoami line.
+            if (me) console.log(`${''.padEnd(22)}${me.id}  ${chalk.cyan(me.userType || 'unknown type')}`)
+          }
+          console.log()
+        },
+      })
+      .command({
+        command: 'logout',
+        describe: 'forget the stored session for an environment',
+        builder: (y2) => envOption(y2),
+        handler: (argv) => {
+          const env = remote.resolveEnv(argv.env)
+          const had = remote.tokenDelete(env.name)
+          console.log(had ? chalk.green(`\nforgot the ${env.label} session\n`) : plain(`\nno ${env.label} session\n`))
+        },
+      })
+      .command({
+        command: 'list',
+        describe: 'the environments this CLI knows and where they point',
+        handler: () => {
+          console.log()
+          for (const name of remote.envNames()) {
+            const env = remote.resolveEnv(name)
+            const token = remote.tokenGet(name)
+            const exp = token ? remote.expiry(token) : null
+            const state = !token
+              ? name === 'local'
+                ? plain('service token')
+                : chalk.yellow('not logged in')
+              : exp && exp.expired
+              ? chalk.yellow('expired')
+              : chalk.green('logged in')
+            console.log(`  ${name.padEnd(12)}${env.url.padEnd(36)}${state}`)
+          }
+          console.log()
+        },
+      })
+      .demandCommand(1, 'Use: remote-environment login | status | logout | list')
+      .strict(),
+  handler: () => {},
+}

package/lib/command/target.js

@@ -1,24 +1,27 @@
 const chalk = require('chalk')
+const remote = require('../remote')
 
-// Shared bits for the environment-addressed commands (user / partner). The LOCAL env is the default —
-// these are day-to-day local-dev commands — and a k8s namespace is the deliberate opt-in.
-const targetOptions = (y) =>
-  y
-    .option('target-local', { type: 'boolean', describe: 'act on the LOCAL env (default)' })
-    .option('target-namespace', { type: 'string', describe: 'act on a k8s namespace instead, e.g. dooer-staging' })
+// Shared bits for the environment-addressed commands (user / partner). These reach an environment through
+// its PUBLIC GraphQL endpoint, so the target is an ENVIRONMENT, not a k8s namespace — same `--env` word
+// the remote-environment commands use. The local stack is the default.
+const envOption = (y) =>
+  y.option('env', {
+    type: 'string',
+    default: 'local',
+    describe: `environment: ${remote.envNames().join(' | ')}`,
+  })
 
-const writeOptions = (y) =>
-  targetOptions(y)
-    .option('confirm-production', { type: 'boolean', describe: 'REQUIRED to write to dooer-production' })
-    .option('execute', { type: 'boolean', default: false, describe: 'actually write (default: dry-run)' })
+const writeOption = (y) =>
+  y.option('execute', { type: 'boolean', default: false, describe: 'actually write (default: dry-run)' })
 
-const label = (ns) => (ns === 'local' ? 'local env' : `namespace ${ns}`)
+// Label + value, value in the terminal's own foreground colour — chalk.gray is unreadable on a dark
+// profile and these lines carry the information (Jimmy 2026-09-04).
+const detail = (k, v) => console.log(`  ${chalk.cyan(k.padEnd(14))}${v === null || v === undefined ? '-' : v}`)
 
-// Minimal column-aligned printer: `columns` is [[header, rowFn], …]. Values are stringified, null shown
-// as a dim dash so an empty column still lines up.
+// Minimal column-aligned printer: `columns` is [[header, rowFn], …].
 function printTable(rows, columns) {
   if (!rows.length) {
-    console.log(chalk.gray('  (none)'))
+    console.log('  (none)')
     return
   }
   const cell = (v) => (v === null || v === undefined || v === '' ? '-' : String(v))
@@ -28,4 +31,4 @@ function printTable(rows, columns) {
   for (const b of body) console.log('  ' + b.map((v, i) => v.padEnd(widths[i])).join('  '))
 }
 
-module.exports = { targetOptions, writeOptions, label, printTable }
+module.exports = { envOption, writeOption, detail, printTable }

package/lib/command/user.js

@@ -1,6 +1,7 @@
 const chalk = require('chalk')
 const u = require('../users')
-const { targetOptions, writeOptions, label, printTable } = require('./target')
+const remote = require('../remote')
+const { envOption, writeOption, printTable, detail } = require('./target')
 
 const date = (d) => (d ? new Date(d).toISOString().slice(0, 10) : null)
 
@@ -13,27 +14,25 @@ module.exports = {
         command: 'search [query]',
         describe: 'find users by email, name, personnummer or id (no query = the most recent users)',
         builder: (y2) =>
-          targetOptions(y2)
+          envOption(y2)
             .positional('query', { type: 'string', describe: 'substring to match' })
             .option('role', { choices: u.USER_ROLES, describe: 'only users of this role' })
             .option('limit', { type: 'number', default: 20, describe: 'max rows' }),
         handler: async (argv) => {
-          const ns = u.targetOf(argv)
-          const rows = await u.withDb(ns, (db) =>
-            u.searchUsers(db, { query: argv.query, role: argv.role, limit: argv.limit })
-          )
+          const env = remote.resolveEnv(argv.env)
+          const rows = await u.searchUsers(env, { query: argv.query, role: argv.role, limit: argv.limit })
           console.log(
-            chalk.bold(`\n${rows.length} user(s) in ${label(ns)}`) +
-              (argv.query ? chalk.gray(` matching "${argv.query}"`) : '') +
+            chalk.bold(`\n${rows.length} user(s) in ${env.label}`) +
+              (argv.query ? ` matching "${argv.query}"` : '') +
               '\n'
           )
           printTable(rows, [
             ['ID', (r) => r.id],
             ['EMAIL', (r) => r.email],
-            ['NAME', (r) => `${r.first_name} ${r.last_name}`],
-            ['ROLE', (r) => r.role],
-            ['CREATED', (r) => date(r.inserted_at)],
-            ['STATUS', (r) => (r.inactivated_at ? `inactivated ${date(r.inactivated_at)}` : 'active')],
+            ['NAME', (r) => `${r.firstName} ${r.lastName}`],
+            ['TYPE', (r) => r.userType],
+            ['CREATED', (r) => date(r.createdAt)],
+            ['STATUS', (r) => (r.isInactivated ? `inactivated ${date(r.inactivatedAt)}` : 'active')],
           ])
           console.log()
         },
@@ -41,33 +40,25 @@ module.exports = {
       .command({
         command: 'get <user>',
         describe: 'show one user (by id or email) and the partners they belong to',
-        builder: (y2) => targetOptions(y2).positional('user', { type: 'string', describe: 'user id or email' }),
+        builder: (y2) => envOption(y2).positional('user', { type: 'string', describe: 'user id or email' }),
         handler: async (argv) => {
-          const ns = u.targetOf(argv)
-          const { user, partners } = await u.withDb(ns, async (db) => {
-            const user = await u.findUser(db, argv.user)
-            return { user, partners: await u.partnersForUser(db, user.id) }
-          })
-          console.log(chalk.bold(`\n${user.first_name} ${user.last_name}`) + chalk.gray(`  (${label(ns)})\n`))
-          const line = (k, v) => console.log(`  ${k.padEnd(14)}${v === null || v === undefined ? '-' : v}`)
-          line('id', user.id)
-          line(
-            'email',
-            `${user.email}${user.email_verified ? chalk.gray(' (verified)') : chalk.yellow(' (unverified)')}`
-          )
-          line('role', user.role)
-          line('personnummer', user.personnummer)
-          line('password', user.has_password ? 'set' : chalk.yellow('none — cannot log in with a password'))
-          line('language', user.language)
-          line('created', date(user.inserted_at))
-          line('status', user.inactivated_at ? chalk.yellow(`inactivated ${date(user.inactivated_at)}`) : 'active')
-          if (user.internal) line('internal', 'yes')
+          const env = remote.resolveEnv(argv.env)
+          const user = await u.findUser(env, argv.user)
+          const partners = await u.partnersForUser(env, user.id)
+          console.log(chalk.bold(`\n${user.firstName} ${user.lastName}`) + `  (${env.label})\n`)
+          detail('id', user.id)
+          detail('email', `${user.email}${user.isEmailVerified ? ' (verified)' : chalk.yellow(' (unverified)')}`)
+          detail('user type', user.userType)
+          detail('personnummer', user.sePersonnummer || '-')
+          detail('language', user.language || '-')
+          detail('created', date(user.createdAt))
+          detail('status', user.isInactivated ? chalk.yellow(`inactivated ${date(user.inactivatedAt)}`) : 'active')
+          if (user.internal) detail('internal', 'yes')
           console.log(chalk.bold(`\n  partners (${partners.length})`))
           printTable(partners, [
             ['PARTNER', (r) => r.name],
             ['LEVEL', (r) => r.level],
             ['STATUS', (r) => r.status],
-            ['LAST LOGIN', (r) => date(r.lastLoginAt)],
             ['ID', (r) => r.id],
           ])
           console.log()
@@ -77,7 +68,7 @@ module.exports = {
         command: 'create',
         describe: 'create a user (password generated unless given). Dry-run by default.',
         builder: (y2) =>
-          writeOptions(y2)
+          writeOption(envOption(y2))
             .option('email', { type: 'string', demandOption: true, describe: 'email address (the login)' })
             .option('password', { type: 'string', describe: 'password to set (default: generated, printed once)' })
             .option('role', { choices: u.USER_ROLES, default: 'hi', describe: 'user role at dooer' })
@@ -87,8 +78,7 @@ module.exports = {
             .option('partner', { type: 'string', describe: 'also add to this partner (id, name or domain)' })
             .option('level', { choices: u.PARTNER_LEVELS, default: 'member', describe: 'level in --partner' }),
         handler: async (argv) => {
-          const ns = u.targetOf(argv)
-          u.guardWrite(ns, argv)
+          const env = remote.resolveEnv(argv.env)
           const derived = u.namesFromEmail(argv.email)
           const firstName = argv.firstName || derived.firstName
           const lastName = argv.lastName || derived.lastName
@@ -96,71 +86,57 @@ module.exports = {
           const generated = !argv.password
           const personnummer = argv.personnummer ? u.normalizePersonnummer(argv.personnummer) : null
 
-          const res = await u.withDb(ns, async (db) => {
-            // Resolve the partner BEFORE creating anything, so a typo fails without leaving a half-made user.
-            const partner = argv.partner ? await u.findPartner(db, argv.partner) : null
-            if (partner && argv.role !== 'hi') {
-              throw new Error(`--partner needs a "hi" user; role "${argv.role}" cannot belong to a partner`)
-            }
-            const created = await u.createUser(db, {
+          // Resolve the partner BEFORE creating anything, so a typo fails without leaving a half-made user.
+          const partner = argv.partner ? await u.findPartner(env, argv.partner) : null
+          if (partner && argv.role !== 'hi') {
+            throw new Error(`--partner needs a "hi" user; role "${argv.role}" cannot belong to a partner`)
+          }
+
+          let created = null
+          if (argv.execute) {
+            created = await u.createUser(env, {
               email: argv.email,
               password,
               role: argv.role,
               personnummer,
               firstName,
               lastName,
-              execute: argv.execute,
             })
-            // Only on --execute: a dry-run has no user id to attach the membership to, and the partner
-            // itself (plus the hi-only rule) has already been validated above.
-            if (partner && argv.execute) {
-              await u.assignPartner(db, {
-                user: { id: created.id, email: argv.email, role: argv.role },
-                partner,
-                level: argv.level,
-                execute: argv.execute,
-              })
-            }
-            return { created, partner }
-          })
+            if (partner) await u.assignPartner(env, { userId: created.id, partnerId: partner.id, level: argv.level })
+          }
 
           console.log(
             (argv.execute ? chalk.green('\ncreated user') : chalk.yellow('\nDRY RUN — nothing written')) +
-              chalk.gray(`  (${label(ns)})\n`)
+              `  (${env.label})\n`
           )
-          const line = (k, v) => console.log(`  ${k.padEnd(14)}${v}`)
-          if (argv.execute) line('id', res.created.id)
-          line('email', argv.email)
-          line('name', `${firstName} ${lastName}`)
-          line('role', argv.role)
-          if (personnummer) line('personnummer', personnummer)
-          line('password', chalk.bold(password) + (generated ? chalk.gray('  (generated)') : ''))
-          if (res.partner) line('partner', `${res.partner.name} — level ${argv.level}`)
+          if (created) detail('id', created.id)
+          detail('email', argv.email)
+          detail('name', `${firstName} ${lastName}`)
+          detail('user type', argv.role)
+          if (personnummer) detail('personnummer', personnummer)
+          detail('password', chalk.bold(password) + (generated ? '  (generated)' : ''))
+          if (partner) detail('partner', `${partner.name} — level ${argv.level}`)
           if (generated && argv.execute) {
-            console.log(chalk.gray('\n  The password is stored as a bcrypt hash — this is the only time it is shown.'))
+            console.log('\n  The service stores only a hash — this is the only time the password is shown.')
           }
-          if (!argv.execute) console.log(chalk.gray('\n  Re-run with --execute to create it.'))
+          if (!argv.execute) console.log('\n  Re-run with --execute to create it.')
           console.log()
         },
       })
       .command({
         command: 'partners <user>',
         describe: 'list the partners a user belongs to, and at what level',
-        builder: (y2) => targetOptions(y2).positional('user', { type: 'string', describe: 'user id or email' }),
+        builder: (y2) => envOption(y2).positional('user', { type: 'string', describe: 'user id or email' }),
         handler: async (argv) => {
-          const ns = u.targetOf(argv)
-          const { user, partners } = await u.withDb(ns, async (db) => {
-            const user = await u.findUser(db, argv.user)
-            return { user, partners: await u.partnersForUser(db, user.id) }
-          })
-          console.log(
-            chalk.bold(`\n${user.email} belongs to ${partners.length} partner(s)`) + chalk.gray(`  (${label(ns)})\n`)
-          )
+          const env = remote.resolveEnv(argv.env)
+          const user = await u.findUser(env, argv.user)
+          const partners = await u.partnersForUser(env, user.id)
+          console.log(chalk.bold(`\n${user.email} belongs to ${partners.length} partner(s)`) + `  (${env.label})\n`)
           printTable(partners, [
             ['PARTNER', (r) => r.name],
+            ['DOMAIN', (r) => r.domain],
             ['LEVEL', (r) => r.level],
             ['STATUS', (r) => r.status],
-            ['DEFAULT REP', (r) => (r.defaultRepresentative ? 'yes' : 'no')],
             ['ID', (r) => r.id],
           ])
           console.log()