Smart.

Manually tested

TODO:

• FIgure out if this is actually compatible with existing deployments
• Do we have to use withEnvTenantContext in various places?

Call the right command

Missed something

I suppose doing this during a migration is a bad idea because this also depends on the configuration to be available.

Deduplicate the creation of the client

Fix rebase error

Don't create the user, test the supposedly existing one instead

Addressed comments

In D5046#63456, @machniak wrote:

BTW, none of the other registered passport clients are added via the migration. Maybe they should too. However, as all of them depend on existing-in-config client secrets and Ids, I'm still not sure migration is the correct place. Maybe we should have something like a "global seeder".

Check for existence first

We should probably contemplate a standard mechanism for cases like this, so we don't copy paste these definitions around.

move the migration to the environment specific overlay