thinkwork-cli 0.13.1 → 1.0.0

package/dist/plugins/twenty/scripts/lib/members-ensure.ts

@@ -1,16 +1,19 @@
 /**
- * Workspace-member provisioning via the invite-token flow (plan U4, KTD4).
+ * Resolve LastMile reps to existing Twenty workspace members (plan U4, R6).
  *
- * As the admin user: sendInvitations(emails) → read the personal invite tokens
- * back → signUpInWorkspace(email, password, workspaceId, token) per rep with
- * the shared test password (R5, value from env — never in the repo). Email
- * delivery is irrelevant, which neutralizes TEI's SES sandbox.
+ * This module does NOT create members. TEI's Twenty does not serve the auth
+ * GraphQL schema over its ALB — `sendInvitations`, `signUpInWorkspace`, and
+ * `getLoginTokenFromCredentials` all return "Cannot query field" — so there is
+ * no API path to create a user. Creation lives in
+ * `scripts/provision-twenty-members.ts`, which writes to Twenty's Postgres
+ * directly (superseding decision S5 in the plan). Run it before the migration.
  *
- * The auth/invitation mutations live on Twenty's core schema, which requires a
- * logged-in user token (UserAuthGuard) — the workspace API key is not enough.
+ * What remains here: list the workspace's members, match reps to them by email
+ * (case-insensitive), collapse reps that share an email onto one login, and
+ * emit the `repId -> workspaceMemberId` owner map.
  */
 
-import { TwentyClient, TwentyGraphqlError } from "./twenty-client";
+import type { TwentyClient } from "./twenty-client";
 
 export interface RepToProvision {
   /** LastMile sales_rep.id — the value owner refs on CRM rows point at. */
@@ -58,97 +61,13 @@ export async function listWorkspaceMembers(
   return members;
 }
 
-/**
- * Obtain an admin user access token via password sign-in on the core schema.
- * Twenty's flow is getLoginTokenFromCredentials → getAuthTokensFromLoginToken.
- */
-export async function adminSignIn(options: {
-  baseUrl: string;
-  email: string;
-  password: string;
-  fetchImpl?: typeof fetch;
-}): Promise<{ accessToken: string; workspaceId: string | null }> {
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const origin = options.baseUrl;
-
-  async function core<T>(
-    query: string,
-    variables: Record<string, unknown>,
-  ): Promise<T> {
-    const response = await fetchImpl(`${options.baseUrl}/graphql`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ query, variables }),
-    });
-    const body = (await response.json()) as {
-      data?: T;
-      errors?: Array<{ message: string }>;
-    };
-    if (body.errors?.length) {
-      throw new TwentyGraphqlError(
-        `Twenty core auth errors: ${JSON.stringify(body.errors)}`,
-        {
-          errors: body.errors,
-        },
-      );
-    }
-    if (!body.data)
-      throw new TwentyGraphqlError("Twenty core auth returned no data.");
-    return body.data;
-  }
-
-  const loginData = await core<{
-    getLoginTokenFromCredentials: { loginToken: { token: string } };
-  }>(
-    `mutation MigrationLogin($email: String!, $password: String!, $origin: String!) {
-      getLoginTokenFromCredentials(email: $email, password: $password, origin: $origin) {
-        loginToken { token }
-      }
-    }`,
-    { email: options.email, password: options.password, origin },
-  );
-
-  const tokensData = await core<{
-    getAuthTokensFromLoginToken: {
-      tokens: { accessOrWorkspaceAgnosticToken: { token: string } };
-    };
-  }>(
-    `mutation MigrationAuthTokens($loginToken: String!, $origin: String!) {
-      getAuthTokensFromLoginToken(loginToken: $loginToken, origin: $origin) {
-        tokens { accessOrWorkspaceAgnosticToken { token } }
-      }
-    }`,
-    {
-      loginToken: loginData.getLoginTokenFromCredentials.loginToken.token,
-      origin,
-    },
-  );
-
-  const accessToken =
-    tokensData.getAuthTokensFromLoginToken.tokens.accessOrWorkspaceAgnosticToken
-      .token;
-  // The workspaceId claim rides inside the JWT payload.
-  let workspaceId: string | null = null;
-  try {
-    const payload = JSON.parse(
-      Buffer.from(accessToken.split(".")[1], "base64url").toString("utf8"),
-    ) as { workspaceId?: string };
-    workspaceId = payload.workspaceId ?? null;
-  } catch {
-    workspaceId = null;
-  }
-  return { accessToken, workspaceId };
-}
-
 export interface MemberProvisionReportRow {
   repId: string;
   email: string | null;
   action:
     | "existing"
-    | "invited+signedUp"
     | "unprovisionable"
-    | "failed"
-    | "planned"
+    | "missing-member"
     | "merged-duplicate-email";
   error?: string;
 }
@@ -157,34 +76,29 @@ export interface MembersEnsureResult {
   /** LastMile rep id → Twenty workspaceMemberId, for owner resolution (R6). */
   ownerMap: Map<string, string>;
   report: MemberProvisionReportRow[];
-  /** True when any rep failed to provision (partial-failure exit code, U4). */
+  /** Retained for the caller's exit-code contract; this module never fails a rep. */
   hadFailures: boolean;
+  /** Reps with an email but no Twenty member yet — run provision-twenty-members.ts. */
+  missingMembers: number;
 }
 
 export interface MembersEnsureOptions {
   dataClient: TwentyClient;
-  /** Client authed with the ADMIN USER token; required only when applying. */
-  adminClient: TwentyClient | null;
   reps: RepToProvision[];
-  repPassword: string;
-  workspaceId: string | null;
-  dryRun: boolean;
 }
 
 export async function ensureMembers(
   options: MembersEnsureOptions,
 ): Promise<MembersEnsureResult> {
-  const { dataClient, adminClient, reps, repPassword, workspaceId, dryRun } =
-    options;
+  const { dataClient, reps } = options;
   const report: MemberProvisionReportRow[] = [];
   const ownerMap = new Map<string, string>();
-  let hadFailures = false;
 
   // Duplicate emails across reps collapse into ONE login: email is the login
   // identity (Twenty cannot hold two members with one email), so every rep id
   // sharing the email maps to the same workspace member. Observed live: a
-  // "house" sales_rep row reusing a real rep's email. The merge is reported
-  // per secondary rep so it is visible, never silent.
+  // "house" sales_rep row reusing a real rep's email, and Sal Carrizales
+  // duplicated. The merge is reported per secondary rep, never silent.
   const primaryRepByEmail = new Map<string, RepToProvision>();
   const mergedReps: RepToProvision[] = [];
   for (const rep of reps) {
@@ -193,189 +107,50 @@ export async function ensureMembers(
     if (!primary) primaryRepByEmail.set(rep.email, rep);
     else mergedReps.push(rep);
   }
+  const mergedRepIds = new Set(mergedReps.map((rep) => rep.repId));
 
   const existingMembers = await listWorkspaceMembers(dataClient);
   const membersByEmail = new Map(
     existingMembers.map((member) => [member.userEmail.toLowerCase(), member]),
   );
 
-  const mergedRepIds = new Set(mergedReps.map((rep) => rep.repId));
-  const toInvite: RepToProvision[] = [];
   for (const rep of reps) {
     if (!rep.email) {
       report.push({ repId: rep.repId, email: null, action: "unprovisionable" });
       continue;
     }
-    if (mergedRepIds.has(rep.repId)) continue; // resolved after primaries below
+    if (mergedRepIds.has(rep.repId)) continue; // resolved from its primary below
     const existing = membersByEmail.get(rep.email);
     if (existing) {
       ownerMap.set(rep.repId, existing.id);
       report.push({ repId: rep.repId, email: rep.email, action: "existing" });
       continue;
     }
-    toInvite.push(rep);
-  }
-
-  const resolveMergedReps = () => {
-    for (const rep of mergedReps) {
-      const primary = primaryRepByEmail.get(
-        rep.email as string,
-      ) as RepToProvision;
-      const memberId = ownerMap.get(primary.repId);
-      if (memberId) ownerMap.set(rep.repId, memberId);
-      report.push({
-        repId: rep.repId,
-        email: rep.email,
-        action: "merged-duplicate-email",
-      });
-    }
-  };
-
-  if (dryRun) {
-    for (const rep of toInvite) {
-      report.push({ repId: rep.repId, email: rep.email, action: "planned" });
-    }
-    resolveMergedReps();
-    return { ownerMap, report, hadFailures };
+    // No member for this rep: provision-twenty-members.ts has not run, or the
+    // rep is new since it did. Their records load with a null owner and heal on
+    // the next run once the member exists.
+    report.push({
+      repId: rep.repId,
+      email: rep.email,
+      action: "missing-member",
+    });
   }
 
-  if (toInvite.length > 0) {
-    if (!adminClient) {
-      throw new Error(
-        "Provisioning new members requires TWENTY_ADMIN_EMAIL/TWENTY_ADMIN_PASSWORD (admin user token).",
-      );
-    }
-    if (!workspaceId) {
-      throw new Error(
-        "workspaceId could not be resolved from the admin session; set TWENTY_WORKSPACE_ID.",
-      );
-    }
-
-    await adminClient.requestOnce(
-      "/graphql",
-      `mutation MigrationInvite($emails: [String!]!) {
-        sendInvitations(emails: $emails) {
-          success
-          result { id email }
-        }
-      }`,
-      { emails: toInvite.map((rep) => rep.email) },
-    );
-
-    const invitationsData = await adminClient.requestWithRetry<{
-      findWorkspaceInvitations: Array<{ id: string; email: string }>;
-    }>(
-      "/graphql",
-      `query MigrationInvitations {
-        findWorkspaceInvitations { id email }
-      }`,
-    );
-
-    // The personal invite token is read back per invitation.
-    for (const rep of toInvite) {
-      try {
-        const invitation = invitationsData.findWorkspaceInvitations.find(
-          (candidate) => candidate.email.toLowerCase() === rep.email,
-        );
-        if (!invitation) {
-          throw new Error(
-            `no invitation found for ${rep.email} after sendInvitations`,
-          );
-        }
-        const tokenData = await adminClient.requestWithRetry<{
-          getWorkspaceInvitationToken: { token: string } | string;
-        }>(
-          "/graphql",
-          `query MigrationInviteToken($invitationId: String!) {
-            getWorkspaceInvitationToken(invitationId: $invitationId)
-          }`,
-          { invitationId: invitation.id },
-        );
-        const rawToken = tokenData.getWorkspaceInvitationToken;
-        const inviteToken =
-          typeof rawToken === "string" ? rawToken : rawToken.token;
-
-        await signUpRepInWorkspace({
-          baseUrl: dataClient.endpoint("/graphql").replace(/\/graphql$/, ""),
-          email: rep.email as string,
-          password: repPassword,
-          workspaceId,
-          inviteToken,
-        });
-        // Membership materializes after signup; resolve the member id.
-        const refreshed = await listWorkspaceMembers(dataClient);
-        const member = refreshed.find(
-          (candidate) => candidate.userEmail.toLowerCase() === rep.email,
-        );
-        if (!member)
-          throw new Error(`member for ${rep.email} not visible after signup`);
-        ownerMap.set(rep.repId, member.id);
-        report.push({
-          repId: rep.repId,
-          email: rep.email,
-          action: "invited+signedUp",
-        });
-      } catch (error) {
-        hadFailures = true;
-        report.push({
-          repId: rep.repId,
-          email: rep.email,
-          action: "failed",
-          error: error instanceof Error ? error.message : String(error),
-        });
-      }
-    }
+  for (const rep of mergedReps) {
+    const primary = primaryRepByEmail.get(
+      rep.email as string,
+    ) as RepToProvision;
+    const memberId = ownerMap.get(primary.repId);
+    if (memberId) ownerMap.set(rep.repId, memberId);
+    report.push({
+      repId: rep.repId,
+      email: rep.email,
+      action: "merged-duplicate-email",
+    });
   }
 
-  resolveMergedReps();
-  return { ownerMap, report, hadFailures };
-}
-
-async function signUpRepInWorkspace(options: {
-  baseUrl: string;
-  email: string;
-  password: string;
-  workspaceId: string;
-  inviteToken: string;
-  fetchImpl?: typeof fetch;
-}): Promise<void> {
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const response = await fetchImpl(`${options.baseUrl}/graphql`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      query: `mutation MigrationSignUp(
-        $email: String!
-        $password: String!
-        $workspaceId: String!
-        $workspacePersonalInviteToken: String
-      ) {
-        signUpInWorkspace(
-          email: $email
-          password: $password
-          workspaceId: { id: $workspaceId }
-          workspacePersonalInviteToken: $workspacePersonalInviteToken
-        ) {
-          loginToken { token }
-        }
-      }`,
-      variables: {
-        email: options.email,
-        password: options.password,
-        workspaceId: options.workspaceId,
-        workspacePersonalInviteToken: options.inviteToken,
-      },
-    }),
-  });
-  const body = (await response.json()) as {
-    errors?: Array<{ message: string }>;
-  };
-  if (body.errors?.length) {
-    throw new TwentyGraphqlError(
-      `signUpInWorkspace failed: ${JSON.stringify(body.errors)}`,
-      {
-        errors: body.errors,
-      },
-    );
-  }
+  const missing = report.filter(
+    (row) => row.action === "missing-member",
+  ).length;
+  return { ownerMap, report, hadFailures: false, missingMembers: missing };
 }

package/dist/plugins/twenty/scripts/lib/provision-members-db.ts

@@ -181,6 +181,63 @@ export async function provisionMembers(
   };
 }
 
+export interface RotateResult {
+  rotated: number;
+  notFound: string[];
+}
+
+/**
+ * Rotate the shared validation-window password (plan R5). Every rep account
+ * this migration created gets a fresh bcrypt hash; nothing else is touched.
+ *
+ * Required on cutover, on abort, and on an over-long validation window alike —
+ * the shared credential must never outlive the phase that needed it. Pass a
+ * per-rep password map to give each rep a distinct one, or a single password to
+ * re-share (still shared: prefer the map, or follow with a forced reset).
+ */
+export async function rotateMemberPasswords(options: {
+  databaseUrl: string;
+  /** Emails of the accounts to rotate — the migration's provisioned reps. */
+  emails: readonly string[];
+  passwordFor: (email: string) => string;
+  dryRun: boolean;
+  log?: (message: string) => void;
+}): Promise<RotateResult> {
+  const log = options.log ?? (() => {});
+  const pool = new pg.Pool({ connectionString: options.databaseUrl, max: 2 });
+  const notFound: string[] = [];
+  let rotated = 0;
+  try {
+    for (const rawEmail of options.emails) {
+      const email = rawEmail.toLowerCase();
+      const existing = await pool.query<{ id: string }>(
+        `select id from core."user" where lower(email) = $1 and "deletedAt" is null`,
+        [email],
+      );
+      if (existing.rows.length === 0) {
+        notFound.push(email);
+        continue;
+      }
+      if (options.dryRun) {
+        rotated += 1;
+        continue;
+      }
+      // Hash per user: rotation is the moment the shared secret dies, so the
+      // salts must not be shared either.
+      const hash = hashPassword(options.passwordFor(email));
+      await pool.query(
+        `update core."user" set "passwordHash" = $2, "updatedAt" = now() where id = $1`,
+        [existing.rows[0].id, hash],
+      );
+      rotated += 1;
+      log(`rotated ${email}`);
+    }
+  } finally {
+    await pool.end();
+  }
+  return { rotated, notFound };
+}
+
 /** Workspace schema names are `workspace_<id>`; reject anything else rather
  * than interpolate an arbitrary identifier into SQL. */
 export function quoteIdent(schema: string): string {