Member sync

Member Sync keeps CF Access policies on every box / capability Access app in lock-step with D1 membership tables. Primarily event-driven; an hourly drift sweep backstops missed events. Full runbook: member-sync.runbook.md · drift sweep: member-sync-drift-sweep.runbook.md.

Pipeline (short)

membership change → MEMBERSHIP_EVENTS_QUEUE
  → n1d membership drain
  → reconcile-scope → CF Access PATCH
  → Analytics Engine (member_sync_*)

CLI-first recipes

# Manually enqueue reconcile for one scope
nayaone-admin api adminRepairMemberSync --body '{
  "scope": "org",
  "scopeId": "<org-ulid>"
}'

# Drift sweep — one org or every org (omit orgId for fleet-wide)
nayaone-admin api adminSweepMemberSync --body '{
  "orgId": "<org-ulid>",
  "scope": "org"
}'

REST fallback: POST /admin-api/member-sync/repair · POST /admin-api/member-sync/sweep.

Area listing: CLI reference → member-sync.

Related

• Troubleshooting: member-sync-troubleshooting.runbook.md.
• RBAC overview: platform-permissions-and-rbac.runbook.md.