Management Command to Sync Issued Date for User Credentials

[zandre-eng]

Technical Summary

Link to ticket here

This is a release path 1 feature — Improvements to existing features & quick wins.

Builds on the ze/credential-issued-date base branch, which added a per-user UserCredential.created_at. Because that column was added with auto_now_add, existing rows were stamped with the migration run time rather than the real issue date, so this adds a sync_usercredential_created_at management command to backfill the accurate per-user dates from a Connect prod export of issued_on. It optionally (--fix-issuer) also repoints credentials that were historically mis-attributed to the staging issuer (Connect prod pushed them via the generic/staging client) onto the production issuer, using a split-per-user approach so staging-only holders are preserved.

Logging and monitoring

The command is a dry run by default and prints a reconciliation summary before any writes — counts of to_update, already_correct, no_pid_match, pid_unmatched_by_export, and, with --fix-issuer, issuer repoints and the number of staging credentials left orphaned. It is a one-off operational tool and adds no runtime logging.

Safety Assurance

Safety story

This is an opt-in management command, not runtime code, so it has no effect until deliberately run. It defaults to a dry run, requires both --apply and an interactive y confirmation (with --no-input for scripted runs), executes within a single transaction, and is idempotent on re-run. Matching is restricted to CONNECT-issued credentials on the join key (username, type, level, slug). --fix-issuer creates production-issuer credentials while leaving staging credentials intact and never deletes data — orphaned staging credentials are only reported.

• I am confident that this change will not break current and/or previous versions of CommCare apps

Automated test coverage

Tests exercise the command end-to-end: loading/parsing the export file, dry-run vs apply, the matching rules (CONNECT-only, int/string opportunity-id coercion), skip/already-correct/no-match/unmatched reporting, bad issued_on handling, the confirmation prompt (apply vs abort), input validation, and the optional issuer repointing including the shared-credential split and idempotency.

QA Plan

No QA planned for this change.

Labels & Review

• The set of people pinged as reviewers is appropriate for the level of risk of the change