feat(2meet-data-optimizer): set an entity bridge mode from the CLI under the Promotion Guard

- New `wp tmdo bridge-mode <entity> <mode>` goes through TMDO_Mode_Manager::set(): unsafe jumps and aeav_only promotions refused by the Promotion Guard exit with the reason and leave the mode unchanged. Named apart from the Feature Flags `mode-set`.
- member-sso-sync and member-force-logout warn that they are deprecated: the user sso group they work on is no longer registered.
- Verify: CliBridgeModeTest (RED: method missing); dev36 bridge-mode user aeav_only refused (unsafe jump), term dual_write → shadow_read → aeav_only refused by the HivePress guard → back to disabled, wpdo_bridge_modes identical to before.
- PR: PR-069
This commit is contained in:
2026-09-26 23:36:55 +08:00
parent 2022cf1d08
commit 382786cb9d
3 changed files with 103 additions and 2 deletions
+10 -2
View File
@@ -9,8 +9,8 @@
* wp wpdo member-shadow-report — Recent entity_type=user diff records.
* wp wpdo member-cutover — Switch user mode to aeav_only.
* wp wpdo member-points-check — Show balance + recent ledger for a user.
* wp wpdo member-sso-sync — Sync Hub membership claims to flat table.
* wp wpdo member-force-logout — Set token_expires_at to past → re-auth.
* wp wpdo member-sso-sync — (deprecated) Sync Hub membership claims to flat table.
* wp wpdo member-force-logout — (deprecated) Set token_expires_at to past → re-auth.
*
* @package WP_Data_Optimizer
* @since 2.5.5
@@ -358,6 +358,9 @@ class TMDO_CLI_Member {
/**
* Sync Hub membership claims into the user flat table.
*
* Deprecated since 1.2.0: the user `sso` group is no longer registered, so
* its flat table is never created on new installs. Will be removed.
*
* Reads _tmso_refresh_token / _tmso_picture_url / _tmso_last_id_token
* from usermeta and writes them into the sso group flat table.
* Intended as a one-shot sync until 2meet-spoke-sso v1.14+ starts writing
@@ -383,6 +386,7 @@ class TMDO_CLI_Member {
* @param array $assoc_args Named arguments.
*/
public function member_sso_sync( $args, $assoc_args ): void {
WP_CLI::warning( 'member-sso-sync is deprecated since 1.2.0 (the user sso group is no longer registered) and will be removed.' );
global $wpdb;
$user_id = isset( $assoc_args['user-id'] ) ? (int) $assoc_args['user-id'] : 0;
@@ -468,6 +472,9 @@ class TMDO_CLI_Member {
/**
* Force re-authentication by setting token_expires_at to a past datetime.
*
* Deprecated since 1.2.0: works on the user `sso` flat table, which is no
* longer registered. Will be removed.
*
* The Spoke silent-refresh logic detects an expired token_expires_at and
* redirects the user to re-authenticate against the Hub. If the Hub has
* the account blocked, the user is logged out from all Spokes.
@@ -492,6 +499,7 @@ class TMDO_CLI_Member {
* @param array $assoc_args Named arguments.
*/
public function member_force_logout( $args, $assoc_args ): void {
WP_CLI::warning( 'member-force-logout is deprecated since 1.2.0 (the user sso group is no longer registered) and will be removed.' );
if ( ! isset( $assoc_args['confirm'] ) ) {
WP_CLI::error( 'This invalidates live SSO tokens. Add --confirm to proceed.' );
}