thinkwork-cli 0.12.16 → 0.13.0

package/dist/plugins/twenty/scripts/lib/members-ensure.ts

@@ -0,0 +1,381 @@
+/**
+ * Workspace-member provisioning via the invite-token flow (plan U4, KTD4).
+ *
+ * As the admin user: sendInvitations(emails) → read the personal invite tokens
+ * back → signUpInWorkspace(email, password, workspaceId, token) per rep with
+ * the shared test password (R5, value from env — never in the repo). Email
+ * delivery is irrelevant, which neutralizes TEI's SES sandbox.
+ *
+ * The auth/invitation mutations live on Twenty's core schema, which requires a
+ * logged-in user token (UserAuthGuard) — the workspace API key is not enough.
+ */
+
+import { TwentyClient, TwentyGraphqlError } from "./twenty-client";
+
+export interface RepToProvision {
+  /** LastMile sales_rep.id — the value owner refs on CRM rows point at. */
+  repId: string;
+  email: string | null;
+  firstName: string | null;
+  lastName: string | null;
+  archived: boolean;
+}
+
+export interface WorkspaceMember {
+  id: string;
+  userEmail: string;
+}
+
+const WORKSPACE_MEMBERS_QUERY = `
+  query MigrationWorkspaceMembers($after: String) {
+    workspaceMembers(first: 200, after: $after) {
+      edges { node { id userEmail } cursor }
+      pageInfo { hasNextPage endCursor }
+    }
+  }
+`;
+
+export async function listWorkspaceMembers(
+  client: TwentyClient,
+): Promise<WorkspaceMember[]> {
+  const members: WorkspaceMember[] = [];
+  let after: string | null = null;
+  for (;;) {
+    const data: {
+      workspaceMembers: {
+        edges: Array<{ node: WorkspaceMember }>;
+        pageInfo: { hasNextPage: boolean; endCursor: string | null };
+      };
+    } = await client.requestWithRetry(
+      "/graphql",
+      WORKSPACE_MEMBERS_QUERY,
+      after ? { after } : {},
+    );
+    members.push(...data.workspaceMembers.edges.map((edge) => edge.node));
+    if (!data.workspaceMembers.pageInfo.hasNextPage) break;
+    after = data.workspaceMembers.pageInfo.endCursor;
+  }
+  return members;
+}
+
+/**
+ * Obtain an admin user access token via password sign-in on the core schema.
+ * Twenty's flow is getLoginTokenFromCredentials → getAuthTokensFromLoginToken.
+ */
+export async function adminSignIn(options: {
+  baseUrl: string;
+  email: string;
+  password: string;
+  fetchImpl?: typeof fetch;
+}): Promise<{ accessToken: string; workspaceId: string | null }> {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const origin = options.baseUrl;
+
+  async function core<T>(
+    query: string,
+    variables: Record<string, unknown>,
+  ): Promise<T> {
+    const response = await fetchImpl(`${options.baseUrl}/graphql`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ query, variables }),
+    });
+    const body = (await response.json()) as {
+      data?: T;
+      errors?: Array<{ message: string }>;
+    };
+    if (body.errors?.length) {
+      throw new TwentyGraphqlError(
+        `Twenty core auth errors: ${JSON.stringify(body.errors)}`,
+        {
+          errors: body.errors,
+        },
+      );
+    }
+    if (!body.data)
+      throw new TwentyGraphqlError("Twenty core auth returned no data.");
+    return body.data;
+  }
+
+  const loginData = await core<{
+    getLoginTokenFromCredentials: { loginToken: { token: string } };
+  }>(
+    `mutation MigrationLogin($email: String!, $password: String!, $origin: String!) {
+      getLoginTokenFromCredentials(email: $email, password: $password, origin: $origin) {
+        loginToken { token }
+      }
+    }`,
+    { email: options.email, password: options.password, origin },
+  );
+
+  const tokensData = await core<{
+    getAuthTokensFromLoginToken: {
+      tokens: { accessOrWorkspaceAgnosticToken: { token: string } };
+    };
+  }>(
+    `mutation MigrationAuthTokens($loginToken: String!, $origin: String!) {
+      getAuthTokensFromLoginToken(loginToken: $loginToken, origin: $origin) {
+        tokens { accessOrWorkspaceAgnosticToken { token } }
+      }
+    }`,
+    {
+      loginToken: loginData.getLoginTokenFromCredentials.loginToken.token,
+      origin,
+    },
+  );
+
+  const accessToken =
+    tokensData.getAuthTokensFromLoginToken.tokens.accessOrWorkspaceAgnosticToken
+      .token;
+  // The workspaceId claim rides inside the JWT payload.
+  let workspaceId: string | null = null;
+  try {
+    const payload = JSON.parse(
+      Buffer.from(accessToken.split(".")[1], "base64url").toString("utf8"),
+    ) as { workspaceId?: string };
+    workspaceId = payload.workspaceId ?? null;
+  } catch {
+    workspaceId = null;
+  }
+  return { accessToken, workspaceId };
+}
+
+export interface MemberProvisionReportRow {
+  repId: string;
+  email: string | null;
+  action:
+    | "existing"
+    | "invited+signedUp"
+    | "unprovisionable"
+    | "failed"
+    | "planned"
+    | "merged-duplicate-email";
+  error?: string;
+}
+
+export interface MembersEnsureResult {
+  /** LastMile rep id → Twenty workspaceMemberId, for owner resolution (R6). */
+  ownerMap: Map<string, string>;
+  report: MemberProvisionReportRow[];
+  /** True when any rep failed to provision (partial-failure exit code, U4). */
+  hadFailures: boolean;
+}
+
+export interface MembersEnsureOptions {
+  dataClient: TwentyClient;
+  /** Client authed with the ADMIN USER token; required only when applying. */
+  adminClient: TwentyClient | null;
+  reps: RepToProvision[];
+  repPassword: string;
+  workspaceId: string | null;
+  dryRun: boolean;
+}
+
+export async function ensureMembers(
+  options: MembersEnsureOptions,
+): Promise<MembersEnsureResult> {
+  const { dataClient, adminClient, reps, repPassword, workspaceId, dryRun } =
+    options;
+  const report: MemberProvisionReportRow[] = [];
+  const ownerMap = new Map<string, string>();
+  let hadFailures = false;
+
+  // Duplicate emails across reps collapse into ONE login: email is the login
+  // identity (Twenty cannot hold two members with one email), so every rep id
+  // sharing the email maps to the same workspace member. Observed live: a
+  // "house" sales_rep row reusing a real rep's email. The merge is reported
+  // per secondary rep so it is visible, never silent.
+  const primaryRepByEmail = new Map<string, RepToProvision>();
+  const mergedReps: RepToProvision[] = [];
+  for (const rep of reps) {
+    if (!rep.email) continue;
+    const primary = primaryRepByEmail.get(rep.email);
+    if (!primary) primaryRepByEmail.set(rep.email, rep);
+    else mergedReps.push(rep);
+  }
+
+  const existingMembers = await listWorkspaceMembers(dataClient);
+  const membersByEmail = new Map(
+    existingMembers.map((member) => [member.userEmail.toLowerCase(), member]),
+  );
+
+  const mergedRepIds = new Set(mergedReps.map((rep) => rep.repId));
+  const toInvite: RepToProvision[] = [];
+  for (const rep of reps) {
+    if (!rep.email) {
+      report.push({ repId: rep.repId, email: null, action: "unprovisionable" });
+      continue;
+    }
+    if (mergedRepIds.has(rep.repId)) continue; // resolved after primaries below
+    const existing = membersByEmail.get(rep.email);
+    if (existing) {
+      ownerMap.set(rep.repId, existing.id);
+      report.push({ repId: rep.repId, email: rep.email, action: "existing" });
+      continue;
+    }
+    toInvite.push(rep);
+  }
+
+  const resolveMergedReps = () => {
+    for (const rep of mergedReps) {
+      const primary = primaryRepByEmail.get(
+        rep.email as string,
+      ) as RepToProvision;
+      const memberId = ownerMap.get(primary.repId);
+      if (memberId) ownerMap.set(rep.repId, memberId);
+      report.push({
+        repId: rep.repId,
+        email: rep.email,
+        action: "merged-duplicate-email",
+      });
+    }
+  };
+
+  if (dryRun) {
+    for (const rep of toInvite) {
+      report.push({ repId: rep.repId, email: rep.email, action: "planned" });
+    }
+    resolveMergedReps();
+    return { ownerMap, report, hadFailures };
+  }
+
+  if (toInvite.length > 0) {
+    if (!adminClient) {
+      throw new Error(
+        "Provisioning new members requires TWENTY_ADMIN_EMAIL/TWENTY_ADMIN_PASSWORD (admin user token).",
+      );
+    }
+    if (!workspaceId) {
+      throw new Error(
+        "workspaceId could not be resolved from the admin session; set TWENTY_WORKSPACE_ID.",
+      );
+    }
+
+    await adminClient.requestOnce(
+      "/graphql",
+      `mutation MigrationInvite($emails: [String!]!) {
+        sendInvitations(emails: $emails) {
+          success
+          result { id email }
+        }
+      }`,
+      { emails: toInvite.map((rep) => rep.email) },
+    );
+
+    const invitationsData = await adminClient.requestWithRetry<{
+      findWorkspaceInvitations: Array<{ id: string; email: string }>;
+    }>(
+      "/graphql",
+      `query MigrationInvitations {
+        findWorkspaceInvitations { id email }
+      }`,
+    );
+
+    // The personal invite token is read back per invitation.
+    for (const rep of toInvite) {
+      try {
+        const invitation = invitationsData.findWorkspaceInvitations.find(
+          (candidate) => candidate.email.toLowerCase() === rep.email,
+        );
+        if (!invitation) {
+          throw new Error(
+            `no invitation found for ${rep.email} after sendInvitations`,
+          );
+        }
+        const tokenData = await adminClient.requestWithRetry<{
+          getWorkspaceInvitationToken: { token: string } | string;
+        }>(
+          "/graphql",
+          `query MigrationInviteToken($invitationId: String!) {
+            getWorkspaceInvitationToken(invitationId: $invitationId)
+          }`,
+          { invitationId: invitation.id },
+        );
+        const rawToken = tokenData.getWorkspaceInvitationToken;
+        const inviteToken =
+          typeof rawToken === "string" ? rawToken : rawToken.token;
+
+        await signUpRepInWorkspace({
+          baseUrl: dataClient.endpoint("/graphql").replace(/\/graphql$/, ""),
+          email: rep.email as string,
+          password: repPassword,
+          workspaceId,
+          inviteToken,
+        });
+        // Membership materializes after signup; resolve the member id.
+        const refreshed = await listWorkspaceMembers(dataClient);
+        const member = refreshed.find(
+          (candidate) => candidate.userEmail.toLowerCase() === rep.email,
+        );
+        if (!member)
+          throw new Error(`member for ${rep.email} not visible after signup`);
+        ownerMap.set(rep.repId, member.id);
+        report.push({
+          repId: rep.repId,
+          email: rep.email,
+          action: "invited+signedUp",
+        });
+      } catch (error) {
+        hadFailures = true;
+        report.push({
+          repId: rep.repId,
+          email: rep.email,
+          action: "failed",
+          error: error instanceof Error ? error.message : String(error),
+        });
+      }
+    }
+  }
+
+  resolveMergedReps();
+  return { ownerMap, report, hadFailures };
+}
+
+async function signUpRepInWorkspace(options: {
+  baseUrl: string;
+  email: string;
+  password: string;
+  workspaceId: string;
+  inviteToken: string;
+  fetchImpl?: typeof fetch;
+}): Promise<void> {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const response = await fetchImpl(`${options.baseUrl}/graphql`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      query: `mutation MigrationSignUp(
+        $email: String!
+        $password: String!
+        $workspaceId: String!
+        $workspacePersonalInviteToken: String
+      ) {
+        signUpInWorkspace(
+          email: $email
+          password: $password
+          workspaceId: { id: $workspaceId }
+          workspacePersonalInviteToken: $workspacePersonalInviteToken
+        ) {
+          loginToken { token }
+        }
+      }`,
+      variables: {
+        email: options.email,
+        password: options.password,
+        workspaceId: options.workspaceId,
+        workspacePersonalInviteToken: options.inviteToken,
+      },
+    }),
+  });
+  const body = (await response.json()) as {
+    errors?: Array<{ message: string }>;
+  };
+  if (body.errors?.length) {
+    throw new TwentyGraphqlError(
+      `signUpInWorkspace failed: ${JSON.stringify(body.errors)}`,
+      {
+        errors: body.errors,
+      },
+    );
+  }
+}

package/dist/plugins/twenty/scripts/lib/provision-members-db.ts

@@ -0,0 +1,191 @@
+/**
+ * Direct-Postgres workspace-member provisioning for TEI's Twenty.
+ *
+ * WHY THIS EXISTS (2026-07-10): TEI's Twenty deployment does not serve the
+ * auth GraphQL schema over its ALB — `sendInvitations`, `signUpInWorkspace`,
+ * and `getLoginTokenFromCredentials` all return "Cannot query field" on
+ * `/graphql` and `/metadata`, on every header/origin combination, and `/rest`
+ * exposes object CRUD only ("object 'auth' not found"). The workspace API key
+ * reaches only the workspace-object schema. There is therefore NO API path to
+ * create a user. The migration plan names direct Twenty-Postgres writes a stop
+ * condition; Eric authorized this route explicitly after that was surfaced.
+ *
+ * SAFETY POSTURE
+ * - INSERT-only. Never updates or deletes an existing row.
+ * - Idempotent: a rep whose email already exists in `core.user` is skipped.
+ * - One transaction per rep; a failure rolls that rep back and the run
+ *   continues, reporting the failure.
+ * - Row shapes are copied from the two users the running Twenty created
+ *   itself (bcrypt `$2b$10$`, Admin/Member role via `core.roleTarget`,
+ *   `workspaceMember` in the workspace schema).
+ * - Removal is a plain `DELETE FROM core."user" WHERE email = ...` — the
+ *   userWorkspace/roleTarget/workspaceMember rows cascade or are deleted here.
+ */
+
+import bcrypt from "bcryptjs";
+import pg from "pg";
+
+export interface ProvisionRep {
+  repId: string;
+  email: string;
+  firstName: string | null;
+  lastName: string | null;
+}
+
+export interface ProvisionRow {
+  email: string;
+  action: "created" | "exists" | "failed";
+  workspaceMemberId?: string;
+  error?: string;
+}
+
+export interface ProvisionResult {
+  rows: ProvisionRow[];
+  created: number;
+  existing: number;
+  failed: number;
+}
+
+/**
+ * Twenty stores bcrypt `$2b$` hashes. bcryptjs emits the `$2a$` prefix; the
+ * two are the same algorithm for passwords under 256 bytes, and bcryptjs
+ * itself verifies the rewritten hash. Rewriting keeps the stored shape
+ * byte-identical to what Twenty's own signup writes.
+ */
+export function hashPassword(password: string, rounds = 10): string {
+  if (Buffer.byteLength(password, "utf8") > 72) {
+    // bcrypt silently truncates past 72 bytes — refuse rather than create a
+    // login whose password is not what the operator thinks it is.
+    throw new Error("Password exceeds bcrypt's 72-byte limit.");
+  }
+  const hash = bcrypt.hashSync(password, rounds);
+  const rewritten = hash.replace(/^\$2a\$/, "$2b$");
+  if (!bcrypt.compareSync(password, rewritten)) {
+    throw new Error("bcrypt self-check failed — refusing to write the hash.");
+  }
+  return rewritten;
+}
+
+export interface ProvisionOptions {
+  databaseUrl: string;
+  workspaceId: string;
+  /** Role granted to every provisioned rep — the workspace's default role. */
+  roleId: string;
+  /** applicationId reused from the workspace's existing roleTarget rows. */
+  applicationId: string;
+  /** Workspace data schema, e.g. workspace_brl3ypdat40udm5gtn95sozcg. */
+  workspaceSchema: string;
+  password: string;
+  reps: ProvisionRep[];
+  dryRun: boolean;
+  log?: (message: string) => void;
+}
+
+export async function provisionMembers(
+  options: ProvisionOptions,
+): Promise<ProvisionResult> {
+  const { databaseUrl, workspaceId, roleId, applicationId, workspaceSchema } =
+    options;
+  const log = options.log ?? (() => {});
+  const rows: ProvisionRow[] = [];
+
+  // Hash once: every rep shares the validation-window password, and bcrypt at
+  // cost 10 is ~100ms — 91 reps would otherwise cost ~10s for no benefit.
+  // Distinct salts per rep are not a security gain here because the password
+  // is shared and slated for rotation at cutover.
+  const passwordHash = hashPassword(options.password);
+
+  const pool = new pg.Pool({ connectionString: databaseUrl, max: 2 });
+  try {
+    const existing = await pool.query<{ email: string }>(
+      `select lower(email) as email from core."user" where "deletedAt" is null`,
+    );
+    const existingEmails = new Set(existing.rows.map((row) => row.email));
+
+    for (const rep of options.reps) {
+      const email = rep.email.toLowerCase();
+      if (existingEmails.has(email)) {
+        rows.push({ email, action: "exists" });
+        continue;
+      }
+      if (options.dryRun) {
+        rows.push({ email, action: "created" });
+        continue;
+      }
+
+      const client = await pool.connect();
+      try {
+        await client.query("begin");
+        const user = await client.query<{ id: string }>(
+          `insert into core."user" ("firstName", "lastName", email, "passwordHash", "isEmailVerified")
+           values ($1, $2, $3, $4, true)
+           returning id`,
+          [rep.firstName ?? "", rep.lastName ?? "", email, passwordHash],
+        );
+        const userId = user.rows[0].id;
+
+        const userWorkspace = await client.query<{ id: string }>(
+          `insert into core."userWorkspace" ("userId", "workspaceId")
+           values ($1, $2)
+           returning id`,
+          [userId, workspaceId],
+        );
+        const userWorkspaceId = userWorkspace.rows[0].id;
+
+        await client.query(
+          `insert into core."roleTarget"
+             (id, "workspaceId", "roleId", "userWorkspaceId", "createdAt", "updatedAt", "universalIdentifier", "applicationId")
+           values (uuid_generate_v4(), $1, $2, $3, now(), now(), uuid_generate_v4(), $4)`,
+          [workspaceId, roleId, userWorkspaceId, applicationId],
+        );
+
+        const member = await client.query<{ id: string }>(
+          `insert into ${quoteIdent(workspaceSchema)}."workspaceMember"
+             ("nameFirstName", "nameLastName", "userEmail", "userId")
+           values ($1, $2, $3, $4)
+           returning id`,
+          [rep.firstName ?? "", rep.lastName ?? "", email, userId],
+        );
+
+        await client.query("commit");
+        existingEmails.add(email);
+        rows.push({
+          email,
+          action: "created",
+          workspaceMemberId: member.rows[0].id,
+        });
+        log(`provisioned ${email}`);
+      } catch (error) {
+        await client.query("rollback").catch(() => {});
+        rows.push({
+          email,
+          action: "failed",
+          error:
+            error instanceof Error
+              ? error.message.slice(0, 300)
+              : String(error),
+        });
+      } finally {
+        client.release();
+      }
+    }
+  } finally {
+    await pool.end();
+  }
+
+  return {
+    rows,
+    created: rows.filter((row) => row.action === "created").length,
+    existing: rows.filter((row) => row.action === "exists").length,
+    failed: rows.filter((row) => row.action === "failed").length,
+  };
+}
+
+/** Workspace schema names are `workspace_<id>`; reject anything else rather
+ * than interpolate an arbitrary identifier into SQL. */
+export function quoteIdent(schema: string): string {
+  if (!/^workspace_[a-z0-9]+$/.test(schema)) {
+    throw new Error(`Refusing unexpected workspace schema name: ${schema}`);
+  }
+  return `"${schema}"`;
+}