org-admin

Utilities to handle the organization's permissions

Installation

npm install @fastify-org/org-admin

Commands

Onboard a user

This command adds a user to the specified teams in the GitHub organization.

node --env-file=.env index.js onboard --org <org> --username <user> --team <team_1> --team <team_n> [--dryRun]

For the fastify organization, the command would look like:

node --env-file=.env index.js onboard --username <user> --team collaborators --team plugins --team website --team frontend

Offboard a user

This command removes a user from the active teams in the GitHub organization and npm teams and adds the user to the emeritus team if it exists.

node --env-file=.env index.js offboard --org <org> --username <user> [--dryRun]

Check emeritus members

This command checks the last contribution date of org's members. It creates an issue listing the users that have been inactive for more than a specified number of months.

node --env-file=.env index.js emeritus --org <org> [--monthsInactiveThreshold] [--dryRun]

For the fastify organization, the command would look like:

node --env-file=.env index.js emeritus --monthsInactiveThreshold 24

List sponsors

This command reads the organization's sponsors from both GitHub Sponsors and Open Collective and lists the recurring tier sponsors — those whose normalized monthly contribution reaches at least the lowest tier. Each sponsor is tagged with its tier (the highest tier its monthly amount meets, rounding down) and the combined list is ordered by monthly contribution descending. Recurring sponsors that stopped paying (cancelled or overdue) are flagged as lapsed.

The default tiers are tier 1 = $5/mo, tier 2 = $50/mo, tier 3 = $100/mo and tier 4 = $300/mo (configurable in commands/sponsors.js). One-time payments and sub-tier contributions are excluded. The result is logged and written to a sponsors.json file with three keys: tiers (the tier definitions), sponsors (the combined tier list) and flagged (the lapsed tier sponsors).

node --env-file=.env index.js sponsors --org <org>

For the fastify organization, the command would look like:

node --env-file=.env index.js sponsors

Reading Open Collective backers is public and needs no token. Open Collective exposes per-charge data, so a lapsed contribution shows its lastChargedAt / nextChargeDate. GitHub does not expose individual charges, so a GitHub sponsor is only flagged as lapsed when a recurring sponsorship has been cancelled (its lastChargedAt is always null). To raise the Open Collective rate limit you may optionally set OC_PERSONAL_TOKEN in .env (a personal token from your own account — Open Collective has no org-level token).

Sync the npm org teams

This command reconciles the npm org teams with the GitHub topics of each package's repository. It never writes to npm: it downloads the org's package list, resolves each package's repository and deprecation status, classifies it into the bucket it should belong to and diffs that against the team it currently belongs to.

Buckets are driven by the repository's GitHub topic:

• fastify-core → core
• fastify-library → libraries
• fastify-plugin → plugins

while packages deprecated on npm are routed to the deprecated team. A package whose repository carries none of those topics falls into an unknown bucket and is only reported.

The engine flags packages that:

• are not in any team (added to developers as read-only plus their bucket)
• have been deprecated (moved to deprecated)
• no longer belong to a team after a topic change (revoked)
• or should be added to a team after a topic change (granted)

It prints an aggregated summary and writes two files:

1. npm-org-sync.json (the full report)
2. npm-org-sync.sh (the npm access commands to review and run manually)

For the fastify organization, the command would look like:

node --env-file=.env index.js sync-npm-org

npm authentication for bulk operations

Reading the org (this command) and running the generated write commands both need an npm token. If your account has 2FA set to Authorization and writes, every write operation prompts for a one-time password — unworkable for the dozens of commands this produces. Use a granular access token instead, which bypasses the OTP prompt:

• Create it at npmjs.com → Access Tokens → Granular Access Token, scoped to the fastify org with read/write on packages and team management.
• Give it the shortest expiration you can (e.g. 1–7 days) — it is a temporary credential just for this bulk run, so a short-lived token limits the blast radius if it leaks.
• Revoke it as soon as you are done, even before it expires.

Keep the token out of version control. Store it in a git-ignored .env.npm and load it into the shell before running:

# .env.npm (git-ignored)
NPM_CONFIG_TOKEN=npm_yourTemporaryGranularToken

source .env.npm
node --env-file=.env index.js sync-npm-org   # read-only, generates the script
bash npm-org-sync.sh                          # the actual writes — review first

The repository's .npmrc reads this token via //registry.npmjs.org/:_authToken=${NPM_CONFIG_TOKEN}, overriding your interactive login for the duration of the shell session.

License

Licensed under MIT.