From 216a04a99e416a7d4e6995f7e524d5b48c916541 Mon Sep 17 00:00:00 2001
From: Jiri Semmler <jirka.semmler@gmail.com>
Date: Thu, 27 Aug 2026 16:18:35 +0200
Subject: [PATCH] feat: report workspaceId, backend and loginType in the
 organization report

`manage:describe-organization-workspaces` described what each workspace is for
but not how its backend user authenticates, so auditing an organization ahead of
the Snowflake password-authentication deprecation meant joining the report
against a separate export of Snowflake users just to tell password workspaces
from key-pair ones. `loginType` answers that directly.

`workspaceId` is added for the same reason: it is what
`manage:delete-project-workspaces-by-id` takes as input, so a row of this report
can now be fed straight into the deletion step instead of being looked up again.
`backend` comes along because it is free and the report already spans backends.

Also fixes a typo that made the command unusable: `lismkdirtWorkspaces()` is not
a method on the Workspaces client, so every invocation died with a fatal error.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 README.md                                                | 9 ++++++++-
 .../Console/Command/DescribeOrganizationWorkspaces.php   | 6 ++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 8690cc5..b054dd6 100644
--- a/README.md
+++ b/README.md
@@ -181,11 +181,18 @@ Destroys: nothing, this command is read-only.
 
 The output CSV has the header:
 ```
-projectId,projectName,branchId,branchName,componentId,configurationId,creatorEmail,activeUser,createdDate,snowflakeSchema,readOnlyStorageAccess
+projectId,projectName,branchId,branchName,workspaceId,componentId,configurationId,creatorEmail,activeUser,createdDate,snowflakeSchema,backend,loginType,readOnlyStorageAccess
 ```
 `activeUser` is `true` when the workspace's creator email still matches a current user of the project,
 which is the same signal the `*-ownerless-*` commands act on.
 
+`loginType` is the authentication mode of the workspace's backend user (e.g.
+`snowflake-legacy-service` = password, `snowflake-service-keypair` = key pair). It is the column to
+filter on when auditing an organization ahead of the Snowflake password-authentication deprecation;
+it is empty for backends that do not report a login type. `workspaceId` is the ID that
+`manage:delete-project-workspaces-by-id` takes as input, so a row of this report can be fed straight
+into the deletion step without a second lookup.
+
 ### Check the state of a list of workspaces
 Read-only. Takes a list of workspaces you already care about (typically left over from an earlier
 cleanup) and reports, per row, whether the workspace is still live, whether its configuration is
diff --git a/src/Keboola/Console/Command/DescribeOrganizationWorkspaces.php b/src/Keboola/Console/Command/DescribeOrganizationWorkspaces.php
index fb520a8..51c39ac 100644
--- a/src/Keboola/Console/Command/DescribeOrganizationWorkspaces.php
+++ b/src/Keboola/Console/Command/DescribeOrganizationWorkspaces.php
@@ -78,12 +78,15 @@ protected function execute(InputInterface $input, OutputInterface $output): int
             'projectName',
             'branchId',
             'branchName',
+            'workspaceId',
             'componentId',
             'configurationId',
             'creatorEmail',
             'activeUser',
             'createdDate',
             'snowflakeSchema',
+            'backend',
+            'loginType',
             'readOnlyStorageAccess'
         ]);
 
@@ -138,12 +141,15 @@ protected function execute(InputInterface $input, OutputInterface $output): int
                         $project['name'],
                         $branch['id'],
                         $branch['name'],
+                        $workspace['id'],
                         $workspace['component'],
                         $workspace['configurationId'],
                         $workspace['creatorToken']['description'],
                         $userInProject > 0 ? 'true' : 'false',
                         $workspace['created'],
                         $workspace['name'],
+                        $workspace['connection']['backend'],
+                        $workspace['connection']['loginType'] ?? '',
                         $workspace['readOnlyStorageAccess']
                     ];
                     $csvFile->writeRow($row);