For developers: scripts and CI #

Every command takes --format=json and ends with a dependable exit code. Options and keys are a permanent contract: new ones may be added, none is renamed or removed.

What you'll have at the end #

Scripts that create, check and report accounts without screen-scraping and without a password on a command line.

The output #

--format=json prints one JSON object with the schema exp-user/1:

{
    "schema": "exp-user/1",
    "command": "exp:user:disable",
    "mode": "disable",
    "dry_run": true,
    "user": { "id": 1234, "login": "jane", "email": "[email protected]", "name": "Jane Doe", "enabled": true },
    "changes": [ "disable the account jane and end its sessions" ],
    "applied": false,
    "errors": [],
    "warnings": [],
    "exit": 0
}

Every key, per command: exp:user JSON output.

Examples #

Fail a deploy when a service account is missing or disabled:

./console exp:user:show ci-bot --format=json | jq -e '.account.enabled' > /dev/null

Create a service account once, with its password from a CI secret:

if ! ./console exp:user:show ci-bot --format=json > /dev/null; then
    printf '%s\n' "$CI_BOT_PASSWORD" | ./console exp:user:create --login=ci-bot --email[email protected] \
        --group=Editors --password-stdin --apply --format=json
fi

Check that the password still works, without counting a failed sign-in:

printf '%s\n' "$CI_BOT_PASSWORD" | ./console exp:user:check-login ci-bot --password-stdin --format=json \
    | jq -r '.valid, .reason'

Report the accounts that wait, as id and login:

./console exp:user:pending --format=json --limit=500 | jq -r '.accounts[] | "\(.id) \(.login)"'

Count the accounts per state for a dashboard:

./console exp:user:hygiene --format=json | jq '.counts'

Stop a pipeline when a dry run would refuse something:

./console exp:user:bulk disable --state=inactive --days=730 --format=json > var/tmp/plan.json || exit 1
jq -r '.matched' var/tmp/plan.json

Rules for scripts #

• Run the dry run first and check errors before you run with --apply.
• Pass a password only on standard input (--password-stdin). Never put it in a variable that is printed.
• generated_password is in the output of the run that set it, and never again. Store it at once, or do not generate one.
• --as=<service account> makes the audit name the automation, not the UserCreatorID user.
• Add --siteaccess=<siteaccess> when the links in mails must point at a particular site.

Related pages #

• exp:user JSON output
• For agencies and hosting
• Console commands