fix(tasks): temporary tool to detect and merge codebar auth duplicate members

[mroderick]

Problem

When the codebar auth flow was merged on 2026-08-06, members with an existing GitHub account whose email differed from their stored email could not be matched automatically. The codebar auth flow created new member accounts instead of linking to existing ones (#2805).

Solution

Add a temporary rake task and Makefile targets to detect and safely merge duplicate members.

Detection strategies

• name+surname — exact case-insensitive match
• email — exact case-insensitive match
• first-name+uid-surname — first name matches; duplicate has no surname, but the codebar auth UID contains the original's surname
• domain+local-part — non-generic domain with overlapping local parts

Plus hard-coded manual overrides for edge cases the heuristics cannot detect.

Safety

• Dry run by default — must pass APPLY=1 to change data.
• Idempotent — re-running after a merge reports no duplicates.
• Deactivates, not deletes — duplicate emails are renamed to duplicate.<id>.merged-into.<id>@codebar.io, auth services and roles are removed, and a MemberNote preserves audit history.
• Logged — every real run writes to a new timestamped JSON log at log/merge_duplicate_members/run_YYYYMMDDTHHMMSSZ.json.

Usage

make detect_duplicate_members   # list duplicates
make fix_duplicate_members      # dry run
make fix_duplicate_members APPLY=1  # execute
make verify_duplicate_members   # confirm none remain

Production:

heroku run rake member:duplicates:fix APPLY=1 --app codebar-production

Files

• lib/tasks/merge_duplicate_members.rake — detection and merge logic
• Makefile — convenience targets for local and Heroku operation
• docs/merge_duplicate_members.md — operator documentation

Testing

• Run against a fresh production dump (make dump_production).
• Dry run shows all actions without modifying data.
• Verify task exits 0 when no duplicates remain.

---

This is a temporary tool. Once the existing duplicates are resolved, it can be removed.

[mroderick]

Applied to production. 12 duplicate members merged successfully. All verified clean afterwards — no duplicates remain.

Log:

{
  "timestamp": "2026-08-21T10:44:25+02:00",
  "dry_run": false,
  "environment": "development",
  "merges": [
    { "dup_id": 31262, "orig_id": 553, "strategies": "name+surname", "status": "success" },
    { "dup_id": 31263, "orig_id": 655, "strategies": "first-name+uid-surname", "status": "success" },
    { "dup_id": 31230, "orig_id": 5583, "strategies": "name+surname", "status": "success" },
    { "dup_id": 31224, "orig_id": 17284, "strategies": "name+surname", "status": "success" },
    { "dup_id": 31243, "orig_id": 22921, "strategies": "name+surname", "status": "success" },
    { "dup_id": 31233, "orig_id": 24686, "strategies": "name+surname", "status": "success" },
    { "dup_id": 31232, "orig_id": 25640, "strategies": "name+surname", "status": "success" },
    { "dup_id": 31258, "orig_id": 27714, "strategies": "domain+local-part", "status": "success" },
    { "dup_id": 31257, "orig_id": 27714, "strategies": "manual", "status": "success" },
    { "dup_id": 31261, "orig_id": 29893, "strategies": "email", "status": "success" },
    { "dup_id": 31229, "orig_id": 30581, "strategies": "name+surname", "status": "success" },
    { "dup_id": 31218, "orig_id": 31192, "strategies": "email", "status": "success" }
  ],
  "errors": [],
  "total_merges": 12
}