Chase Bitwarden two-factor gaps and unaccepted invites

On a cron trigger every Monday at 9am, run a Bitwarden compliance check on my organization and nudge the people who are keeping us out of compliance.

Start with the Bitwarden List Members operation to pull the full organization roster. Each member record already carries everything I need, so no per-member lookups are required. Split the roster into two cohorts: members whose two-factor authentication flag is false, and members whose status is 0, which is the Invited state, meaning they were sent an invitation but never accepted it. Member status is an integer enum, so filter on the number 0 and not on a string like "Invited".

Next, resolve each person to a Slack account using the slackbot List Users operation. Pull the workspace roster once and build an email to Slack user ID map, then match Bitwarden member emails against it case-insensitively. Do not call a lookup once per person; one roster pull and a local match is cheaper and avoids rate limits.

Send the direct messages with the Send a Message operation on the slackbot service, not the slack service. Use two templates: one that reminds people to turn on two-factor authentication, and a separate one that asks people with an unaccepted invitation to accept it. Important: a member can appear in both cohorts. Send exactly one direct message per person. If someone is in both cohorts, send a single message that covers both asks rather than two separate messages.

Keep the direct message copy friendly, short, and low pressure, since this fires every single week and should not read like an escalation.

If a Bitwarden member has no matching Slack account, skip that person instead of failing the run. Collect them in a list of unmatched people and keep going.

Once the direct messages are out, post a single count summary to our IT channel using Send a Message. One message only, containing how many members still have two-factor disabled, how many invitations are still unaccepted, how many direct messages were sent, and the names and emails of anyone who could not be matched to a Slack account, so nobody silently escapes the nudge.

Finally, append one dated row to a Google Sheets tracker using the Append Values operation. The row is a fixed shape: run date, count of members with two-factor disabled, count of unaccepted invitations, number of direct messages sent, and number of unmatched people. One row per run, appended below the existing rows, so we can watch both numbers trend down week over week.