Docs: the examples in English
Test / test (pull_request) Successful in 1m5s

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt
This commit is contained in:
Bendik Aagaard Lynghaug
2026-09-30 15:31:59 +02:00
co-authored by Claude Fable 5.1
parent 96b3746643
commit 48cba5cd8e
5 changed files with 24 additions and 24 deletions
+9 -9
View File
@@ -32,11 +32,11 @@ Three things in the content decide who needs an account:
|---|---|---|
| `responsible: { name, contact }` on a page | the person answering for that question | an account, and a mail saying they are listed as responsible for asking it |
| `responsible: { name, contact, group }` | a group answering for it | nothing: the inbox is not a person; the group's members have the desk, and each of them may suggest changes to the page |
| `qualifies: styret` on a page or `_section.yaml` | members of that group | the pages and desks under it |
| `invite: { group: kasserer }` on a desk page | the desk's own group | the right to bring people into `kasserer` |
| `qualifies: board` on a page or `_section.yaml` | members of that group | the pages and desks under it |
| `invite: { group: treasurer }` on a desk page | the desk's own group | the right to bring people into `treasurer` |
The desk whose group may invite into the most groups is the site's most
privileged one; on a vel that is the board. Portal works that out from
privileged one; for an association that is the board. Portal works that out from
the content (see step 4).
## 2. Set up Kanidm for portal
@@ -58,7 +58,7 @@ $K group add-members idm_people_pii_read portal-onboarding
# One group per `qualifies:` in the content, managed by that account:
# adding a member to a group takes the right to manage it.
for g in styret kasserer trafikk; do
for g in board treasurer traffic; do
$K group create "$g" portal-onboarding
done
@@ -67,7 +67,7 @@ done
$K system oauth2 create portal "My site" https://site.example.no
$K system oauth2 add-redirect-url portal https://site.example.no/auth/callback
$K system oauth2 update-scope-map portal idm_all_persons openid profile email
for g in styret kasserer trafikk; do
for g in board treasurer traffic; do
$K system oauth2 update-claim-map portal groups "$g" "$g"
done
$K system oauth2 update-claim-map-join portal groups array
@@ -94,7 +94,7 @@ and on an empty Kanidm there is no desk anyone can open yet.
| `SEED_ADMIN_EMAIL` | the first person's address |
| `SEED_ADMIN_NAME` | their name, as it should appear (optional) |
| `SEED_GROUP` | a group to put them in, if not the most privileged one (optional) |
| `RESPONSIBLE_GROUP` | a group every responsible person joins, e.g. `redaktor` (optional) |
| `RESPONSIBLE_GROUP` | a group every responsible person joins, e.g. `editors` (optional) |
## 4. Start portal
@@ -151,7 +151,7 @@ A desk that lists the bucket offers the way back with a transition from
```yaml
resource:
source: { kind: kv, bucket: portal_invites }
requires_group: styret
requires_group: board
transitions:
- { from: open, to: done, label: Is in }
- { from: expired, to: open, label: Send again }
@@ -172,7 +172,7 @@ list, and whoever sits there takes it up and settles it:
```yaml
resource:
source: { kind: kv, bucket: portal_edit_suggestions }
requires_group: styret
requires_group: board
transitions:
- { from: open, to: discussed, label: Looking at it }
- { from: open, to: done, label: Changed }
@@ -187,7 +187,7 @@ where each one stands. A content repo that declares the bucket itself
in `aggregates.yaml`, with a `mail:` on a state, sends that instead.
Their group can also be the way into other tools. The vel's
`redaktor` group signs in to the project Gitea with the same account:
`editors` group signs in to the project Gitea with the same account:
a second OAuth2 client scoped to that group alone.
## When it does not work