pairit 0.1.8 → 0.1.9

package/README.md

@@ -12,6 +12,7 @@ A lightweight command line utility for working with Pairit experiment configurat
 - `media list` — list media objects in Cloud Storage
 - `media delete` — delete a media object from Cloud Storage
 - `data export` — export sessions, events, and chat messages for a config as CSV/JSON/JSONL
+- `admin add-user` / `admin remove-user` / `admin list-users` — manage the manager allowlist (admin role required)
 
 ## Install
    
@@ -77,6 +78,24 @@ bun run apps/manager/cli/src/index.ts media delete onboarding/logo.png --force
 
 `config compile` writes `configs/simple-survey-basic.json` next to the source YAML. `config upload` defaults the config id to a 16-character base64url string derived from the SHA-256 hash of the compiled JSON (unless `--config-id` overrides it).
 
+## Manager allowlist (admin)
+
+Manager sign-ins are gated on a Mongo allowlist. Anyone who isn't on it lands on `/access-denied` after Google sign-in. Use these commands to manage who can sign in. The calling CLI user must be an admin.
+
+```bash
+pairit admin list-users                            # Show everyone on the allowlist
+pairit admin add-user alice@example.com            # Add as researcher
+pairit admin add-user bob@example.com --admin      # Add as admin (can manage the allowlist)
+pairit admin remove-user alice@example.com         # Remove and revoke their sessions
+pairit admin remove-user alice@example.com --force # Skip confirmation prompt
+```
+
+Notes:
+- Bootstrap: `MANAGER_BOOTSTRAP_ADMIN_EMAIL` is seeded as admin on every manager boot. Set it before the first deploy or you'll have no admins.
+- Day-1 migration: on first boot, existing config owners are backfilled as researchers (not the entire user collection, which is shared with lab participants).
+- Self-removal is blocked.
+- The rejection page contact is set by `MANAGER_ADMIN_CONTACT_EMAIL` (defaults to `harang@pairium.ai`).
+
 ## Per-experiment LLM credentials
 
 If your config uses AI agents, attach provider credentials when uploading:

package/dist/index.js

@@ -9666,7 +9666,7 @@ async function loadKeytar() {
 
 // src/index.ts
 var program2 = new Command;
-program2.name("pairit").description("CLI for Pairit experiment configs").version("0.1.8");
+program2.name("pairit").description("CLI for Pairit experiment configs").version("0.1.9");
 program2.command("login").description("Login to Pairit Manager").action(async () => {
   try {
     await login();
@@ -9817,6 +9817,57 @@ dataCommand.command("export").argument("<configId>", "Config ID to export data f
     reportCliError("Export failed", error);
   }
 });
+var adminCommand = program2.command("admin").description("Manage manager allowlist (admin only)");
+adminCommand.command("add-user").argument("<email>", "Email to allow").option("--admin", "Grant admin privileges").description("Add a user to the manager allowlist").action(async (email, options) => {
+  try {
+    const response = await callFunctions("/admin/users", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email, isAdmin: Boolean(options.admin) })
+    });
+    const entry = response?.user;
+    if (!entry)
+      throw new Error("No user returned");
+    console.log(`✓ Added ${entry.email} (${entry.isAdmin ? "admin" : "researcher"})`);
+  } catch (error) {
+    reportCliError("Add user failed", error);
+  }
+});
+adminCommand.command("remove-user").argument("<email>", "Email to remove").option("--force", "Skip confirmation").description("Remove a user from the manager allowlist and revoke sessions").action(async (email, options) => {
+  try {
+    if (!options.force) {
+      const confirmed = await promptConfirm(`Remove ${email} from allowlist? (y/N)`);
+      if (!confirmed) {
+        console.log("Removal aborted");
+        return;
+      }
+    }
+    await callFunctions(`/admin/users/${encodeURIComponent(email)}`, {
+      method: "DELETE"
+    });
+    console.log(`✓ Removed ${email}`);
+  } catch (error) {
+    reportCliError("Remove user failed", error);
+  }
+});
+adminCommand.command("list-users").description("List users on the manager allowlist").action(async () => {
+  try {
+    const response = await callFunctions("/admin/users", {
+      method: "GET"
+    });
+    const users = response?.users ?? [];
+    if (!users.length) {
+      console.log("No users on the allowlist");
+      return;
+    }
+    users.forEach((u) => {
+      const role = u.isAdmin ? "admin" : "researcher";
+      console.log(`${u.email} | ${role} | addedBy=${u.addedBy} | addedAt=${u.addedAt}`);
+    });
+  } catch (error) {
+    reportCliError("List users failed", error);
+  }
+});
 program2.parseAsync(process9.argv).catch((err) => {
   console.error(err);
   process9.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pairit",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "CLI for the Pairit behavioral science experiment platform",
   "type": "module",
   "bin": {