User Commands¶

./rag-cli users list [OPTIONS]

./rag-cli users list

./rag-cli users list --role admin --format json

./rag-cli users list --sort last_login --order desc --include-stats

./rag-cli users list --filter "john" --limit 10

./rag-cli users get USER_ID [OPTIONS]

./rag-cli users get user_123abc

./rag-cli users get john.doe@company.com

./rag-cli users get user_123abc \
  --include-activity \
  --include-permissions \
  --include-collections \
  --format json

./rag-cli users create [OPTIONS]

./rag-cli users create \
  --name "Alice Johnson" \
  --email "alice.johnson@company.com" \
  --role editor

./rag-cli users create \
  --name "System Administrator" \
  --email "sysadmin@company.com" \
  --role admin \
  --team team_engineering \
  --send-invite

./rag-cli users create \
  --name "Content Manager" \
  --email "content@company.com" \
  --role editor \
  --collections "col_123abc,col_456def" \
  --password "TempPass123!"

./rag-cli users create \
  --name "External Contractor" \
  --email "contractor@external.com" \
  --role user \
  --temporary \
  --collections "col_project_x"

./rag-cli users update USER_ID [OPTIONS]

./rag-cli users update user_123abc --role admin

./rag-cli users update user_123abc \
  --name "John Smith-Doe" \
  --email "john.smithdoe@company.com"

./rag-cli users update user_123abc \
  --add-team team_ml_research \
  --remove-team team_old_project

./rag-cli users update user_123abc \
  --add-collection col_confidential \
  --role editor

./rag-cli users update user_123abc --status suspended

./rag-cli users delete USER_ID [OPTIONS]

./rag-cli users delete user_123abc

./rag-cli users delete user_departing \
  --transfer-ownership user_manager \
  --backup

./rag-cli users delete user_123abc --deactivate-only

./rag-cli users delete user_inactive --force

#!/bin/bash
csv_file="new_users.csv"

echo "👥 Bulk User Import"
echo "=================="

# Skip header line, process CSV
tail -n +2 "$csv_file" | while IFS=',' read -r name email role team; do
    echo "Creating user: $name ($email)"

    user_id=$(./rag-cli users create \
      --name "$name" \
      --email "$email" \
      --role "$role" \
      --team "$team" \
      --format json | jq -r '.id')

    if [ "$user_id" != "null" ]; then
        echo "✅ Created: $user_id"
    else
        echo "❌ Failed to create user: $name"
    fi
done

echo "✅ Bulk import completed"

#!/bin/bash
# Promote all editors to admin role
echo "🔄 Bulk Role Update: Editors → Admins"

./rag-cli users list --role editor --format json | \
jq -r '.users[].id' | \
while read user_id; do
    echo "Promoting user: $user_id"
    ./rag-cli users update "$user_id" --role admin
done

#!/bin/bash
echo "📊 User Activity Audit"
echo "===================="

cutoff_date="2024-01-01"

echo "Users inactive since $cutoff_date:"
./rag-cli users list --include-stats --format json | \
jq --arg cutoff "$cutoff_date" -r '
  .users[] |
  select(.stats.last_activity < $cutoff) |
  [.name, .email, .stats.last_activity, .stats.total_queries] |
  @tsv' | \
while IFS=$'\t' read -r name email last_activity queries; do
    echo "  - $name ($email): Last active $last_activity, $queries queries"
done

echo ""
echo "Recommended actions:"
echo "1. Contact inactive users to verify continued need"
echo "2. Consider deactivating accounts with no recent activity"
echo "3. Transfer ownership of resources from departing users"

#!/bin/bash
echo "📊 Collection Access Matrix"
echo "==========================="

# Get all collections
collections=$(./rag-cli collections list --format json | jq -r '.collections[] | [.id, .name] | @tsv')

echo "$collections" | while IFS=$'\t' read -r col_id col_name; do
    echo ""
    echo "📚 Collection: $col_name ($col_id)"
    echo "$(printf '%.0s-' {1..50})"

    # Get users with access to this collection
    ./rag-cli users list --format json | \
    jq --arg col_id "$col_id" -r '
      .users[] |
      select(.collections[]? == $col_id) |
      [.name, .email, .role] |
      @tsv' | \
    while IFS=$'\t' read -r name email role; do
        echo "  ✅ $name ($email) - Role: $role"
    done
done

#!/bin/bash
echo "🔐 Permission Audit Report"
echo "========================="

# Users with admin privileges
echo "👨‍💼 Administrative Users:"
./rag-cli users list --role admin --format json | \
jq -r '.users[] | "  - " + .name + " (" + .email + ")"'

echo ""
echo "👥 Users by Role Distribution:"
for role in user editor admin; do
    count=$(./rag-cli users list --role "$role" --format json | jq '.total')
    echo "  - ${role^}: $count users"
done

echo ""
echo "📚 Collection Ownership:"
./rag-cli collections list --format json | \
jq -r '.collections[] | "  - " + .name + " (Owner: " + (.owner // "System") + ")"'

echo ""
echo "⚠️  Security Recommendations:"
echo "1. Regularly review admin user list"
echo "2. Audit collection access permissions"
echo "3. Remove inactive user accounts"
echo "4. Implement least-privilege access"

#!/bin/bash
team_id="team_engineering"
action="$1" # add, remove, list
user_id="$2"

case "$action" in
    "add")
        if [ -z "$user_id" ]; then
            echo "Usage: $0 add USER_ID"
            exit 1
        fi
        ./rag-cli users update "$user_id" --add-team "$team_id"
        echo "✅ Added $user_id to $team_id"
        ;;

    "remove")
        if [ -z "$user_id" ]; then
            echo "Usage: $0 remove USER_ID"
            exit 1
        fi
        ./rag-cli users update "$user_id" --remove-team "$team_id"
        echo "✅ Removed $user_id from $team_id"
        ;;

    "list")
        echo "👥 Team Members: $team_id"
        echo "========================"
        ./rag-cli users list --format json | \
        jq --arg team "$team_id" -r '
          .users[] |
          select(.teams[]? == $team) |
          "  - " + .name + " (" + .email + ") - " + .role'
        ;;

    *)
        echo "Usage: $0 {add|remove|list} [USER_ID]"
        echo "  add USER_ID    - Add user to team"
        echo "  remove USER_ID - Remove user from team"
        echo "  list          - List team members"
        ;;
esac

#!/bin/bash
# Sync users from LDAP to RAG system

ldap_server="ldap://your-ldap-server.com"
base_dn="ou=users,dc=company,dc=com"
bind_dn="cn=rag-sync,ou=service-accounts,dc=company,dc=com"

echo "🔄 LDAP User Sync"
echo "================="

# Query LDAP for users (requires ldapsearch)
ldapsearch -x -H "$ldap_server" -D "$bind_dn" -W \
  -b "$base_dn" \
  "(objectClass=person)" \
  cn mail department | \
while read line; do
    if [[ "$line" =~ ^cn:\ (.*)$ ]]; then
        name="${BASH_REMATCH[1]}"
    elif [[ "$line" =~ ^mail:\ (.*)$ ]]; then
        email="${BASH_REMATCH[1]}"
    elif [[ "$line" =~ ^department:\ (.*)$ ]]; then
        department="${BASH_REMATCH[1]}"
    elif [[ "$line" == "" ]] && [[ -n "$name" ]] && [[ -n "$email" ]]; then
        # Process complete user record
        echo "Syncing: $name ($email) - $department"

        # Check if user exists
        if ./rag-cli users get "$email" --format json > /dev/null 2>&1; then
            echo "  User exists, updating..."
            ./rag-cli users update "$email" --name "$name"
        else
            echo "  Creating new user..."
            role="user"
            [[ "$department" == "IT" ]] && role="admin"
            [[ "$department" == "Management" ]] && role="editor"

            ./rag-cli users create \
              --name "$name" \
              --email "$email" \
              --role "$role"
        fi

        # Reset variables
        name=""
        email=""
        department=""
    fi
done

echo "✅ LDAP sync completed"

#!/bin/bash
# Automated user onboarding script

new_user_email="$1"
department="$2"
manager_email="$3"

if [ -z "$new_user_email" ] || [ -z "$department" ] || [ -z "$manager_email" ]; then
    echo "Usage: $0 USER_EMAIL DEPARTMENT MANAGER_EMAIL"
    exit 1
fi

echo "🚀 User Onboarding: $new_user_email"
echo "==================================="

# Extract name from email (simple heuristic)
name=$(echo "$new_user_email" | sed 's/@.*//' | sed 's/\./ /g' | sed 's/\b\w/\U&/g')

# Determine role based on department
role="user"
team_id=""
collections=""

case "$department" in
    "engineering")
        role="editor"
        team_id="team_engineering"
        collections="col_technical,col_documentation"
        ;;
    "management")
        role="admin"
        team_id="team_management"
        collections="col_business,col_reports"
        ;;
    "research")
        role="editor"
        team_id="team_research"
        collections="col_research,col_papers"
        ;;
    *)
        role="user"
        collections="col_general"
        ;;
esac

echo "Creating user profile..."
user_id=$(./rag-cli users create \
    --name "$name" \
    --email "$new_user_email" \
    --role "$role" \
    --team "$team_id" \
    --collections "$collections" \
    --format json | jq -r '.id')

if [ "$user_id" != "null" ]; then
    echo "✅ User created: $user_id"

    echo "Setting up manager relationship..."
    # Note: This would require additional CLI commands for manager relationships
    # ./rag-cli users update "$user_id" --manager "$manager_email"

    echo "Sending welcome information..."
    # Send welcome email with getting started guide
    echo "Welcome to RAG System!" | mail -s "Welcome to RAG System" "$new_user_email"

    echo "✅ Onboarding completed for $name"
    echo ""
    echo "Next steps:"
    echo "1. User will receive activation email"
    echo "2. Manager has been notified"
    echo "3. User has access to appropriate collections"
    echo "4. Team permissions are configured"
else
    echo "❌ Failed to create user"
    exit 1
fi

#!/bin/bash
echo "🔐 Security Audit Report"
echo "======================="
echo "Generated: $(date)"
echo ""

# Check for users without recent activity
echo "👻 Inactive Users (30+ days):"
cutoff_date=$(date -d "30 days ago" +%Y-%m-%d)
./rag-cli users list --include-stats --format json | \
jq --arg cutoff "$cutoff_date" -r '
  .users[] |
  select(.stats.last_activity < $cutoff) |
  "  ⚠️  " + .name + " (" + .email + ") - Last seen: " + .stats.last_activity'

echo ""
echo "👨‍💼 Administrative Access:"
admin_count=$(./rag-cli users list --role admin --format json | jq '.total')
echo "  Total admins: $admin_count"
if [ "$admin_count" -gt 5 ]; then
    echo "  ⚠️  High number of admin users - review recommended"
fi

echo ""
echo "📚 Collection Permissions:"
# Check for collections with too many admins
./rag-cli collections list --format json | \
jq -r '.collections[] | select(.admin_count > 3) |
  "  ⚠️  " + .name + " has " + (.admin_count | tostring) + " admins"'

echo ""
echo "🔄 Recent Permission Changes (7 days):"
# This would require audit log functionality
echo "  (Audit log integration required)"

echo ""
echo "📋 Compliance Checklist:"
echo "  ✅ Regular access reviews"
echo "  ✅ Inactive user monitoring"
echo "  ✅ Admin user tracking"
echo "  ⚠️  Implement audit logging"
echo "  ⚠️  Add permission change notifications"

$ ./rag-cli users list
❌ Access denied

This command requires administrative privileges.
Current user role: user
Required role: admin

Contact your administrator to request elevated access.

$ ./rag-cli users get invalid-user
❌ User not found

User 'invalid-user' does not exist in the system.

Search for users: ./rag-cli users list --filter "partial-name"

$ ./rag-cli users create --name "New User" --email "existing@company.com"
❌ User creation failed

A user with email 'existing@company.com' already exists.
User ID: user_existing123

Update existing user: ./rag-cli users update user_existing123
View user details: ./rag-cli users get user_existing123

$ ./rag-cli users delete user_lastadmin
❌ Deletion not allowed

Cannot delete the last administrative user in the system.
Promote another user to admin first, then retry deletion.

Promote user to admin: ./rag-cli users update USER_ID --role admin