Add workspace creation option to copy + new migrate-users command

[chasefortier]

Currently cometx can help migrate data, but does NOT migrate user permissions or workspaces, which can require manual effort if doing a migration. I have made the below updates to address this:

• cometx copy --create-workspaces: Added a --create-workspaces flag to the copy command. When the destination workspace does not exist, cometx will attempt to create it via the Comet REST API (POST /api/rest/v2/write/workspace/new). If creation fails (e.g., insufficient permissions), a clear error message is shown. Without the flag, the existing behavior is preserved — an error is raised suggesting the user pass --create-workspaces or create the workspace via the UI.

• cometx migrate-users: New command to migrate workspace membership from a source Comet environment to a destination environment. It reads a chargeback report (fetched from the source admin API or provided as a local JSON file) and invites each user to the corresponding workspace in the destination by email. Supports:

--create-workspaces to auto-create missing workspaces on the destination before adding members
--dry-run to preview all operations without making changes
--chargeback-report to use a pre-downloaded report file instead of fetching from the source
Detailed per-workspace and summary logging of added, skipped, already-member, and failed users
Failures are saved to bulk_add_failures_by_email.json for follow-up

Tests Completed
[ ] Run cometx copy SOURCE DEST without the flag when workspace doesn't exist — verify it errors with a message suggesting --create-workspaces
[ ] Run cometx copy SOURCE DEST --create-workspaces when workspace doesn't exist — verify it creates the workspace and proceeds
[ ] Run cometx copy SOURCE DEST --create-workspaces when workspace already exists — verify it proceeds normally
[ ] Run cometx migrate-users --api-key KEY --source-api-key KEY --dry-run — verify it previews without making changes
[ ] Run cometx migrate-users --api-key KEY --chargeback-report /path/to/report.json — verify it loads from file
[ ] Run cometx migrate-users --api-key KEY --source-api-key KEY --create-workspaces — verify workspaces are created before adding members
[ ] Verify failures are written to bulk_add_failures_by_email.json
[ ] Run cometx migrate-users --help and cometx copy --help to verify argument documentation

[chasefortier]

Hey @dsblank any chance you could do a final review of this in the next day or two? A customer has a need to migrate users, so ideally could merge in these changes with the new migrate-users command!

[dsblank]

Two small fixes already pushed to the branch:

• Removed the dead COMET_CLOUD_URL constant left over after the silent-fallback removal
• Replaced the hand-rolled assertRaises context manager in the test with pytest.raises

One question that needs an answer before merge:

_add_member always passes "admin": True (migrate_users.py, _add_member function):

payload = {
    "userEmail": email,
    "workspaceName": workspace_name,
    "admin": True,
}

This adds every migrated user as a workspace admin regardless of their role in the source environment. The chargeback report members objects may contain role information. Was this intentional — i.e., the migration is specifically for workspace owners/admins only — or should the role be read from the report? If it's intentional, a comment explaining why would help future readers.

[chasefortier]

@dsblank looks like chargeback reports actually do not contain info on user workspace role.

The main permissions that workspace ownership gives a user is the ability to add additional users - I would like to default to setting users to owners so that they can invite colleagues! Otherwise will cause friction post migration.

[dsblank]

@chasefortier said:

The main permissions that workspace ownership gives a user is the ability to add additional users - I would like to default to setting users to owners so that they can invite colleagues!

Is "setting users to owners" the same as the current status:

payload = {
    "userEmail": email,
    "workspaceName": workspace_name,
    "admin": True,
}