Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt
This commit is contained in:
co-authored by
Claude Fable 5.1
parent
96b3746643
commit
48cba5cd8e
@@ -32,11 +32,11 @@ Three things in the content decide who needs an account:
|
||||
|---|---|---|
|
||||
| `responsible: { name, contact }` on a page | the person answering for that question | an account, and a mail saying they are listed as responsible for asking it |
|
||||
| `responsible: { name, contact, group }` | a group answering for it | nothing: the inbox is not a person; the group's members have the desk, and each of them may suggest changes to the page |
|
||||
| `qualifies: styret` on a page or `_section.yaml` | members of that group | the pages and desks under it |
|
||||
| `invite: { group: kasserer }` on a desk page | the desk's own group | the right to bring people into `kasserer` |
|
||||
| `qualifies: board` on a page or `_section.yaml` | members of that group | the pages and desks under it |
|
||||
| `invite: { group: treasurer }` on a desk page | the desk's own group | the right to bring people into `treasurer` |
|
||||
|
||||
The desk whose group may invite into the most groups is the site's most
|
||||
privileged one; on a vel that is the board. Portal works that out from
|
||||
privileged one; for an association that is the board. Portal works that out from
|
||||
the content (see step 4).
|
||||
|
||||
## 2. Set up Kanidm for portal
|
||||
@@ -58,7 +58,7 @@ $K group add-members idm_people_pii_read portal-onboarding
|
||||
|
||||
# One group per `qualifies:` in the content, managed by that account:
|
||||
# adding a member to a group takes the right to manage it.
|
||||
for g in styret kasserer trafikk; do
|
||||
for g in board treasurer traffic; do
|
||||
$K group create "$g" portal-onboarding
|
||||
done
|
||||
|
||||
@@ -67,7 +67,7 @@ done
|
||||
$K system oauth2 create portal "My site" https://site.example.no
|
||||
$K system oauth2 add-redirect-url portal https://site.example.no/auth/callback
|
||||
$K system oauth2 update-scope-map portal idm_all_persons openid profile email
|
||||
for g in styret kasserer trafikk; do
|
||||
for g in board treasurer traffic; do
|
||||
$K system oauth2 update-claim-map portal groups "$g" "$g"
|
||||
done
|
||||
$K system oauth2 update-claim-map-join portal groups array
|
||||
@@ -94,7 +94,7 @@ and on an empty Kanidm there is no desk anyone can open yet.
|
||||
| `SEED_ADMIN_EMAIL` | the first person's address |
|
||||
| `SEED_ADMIN_NAME` | their name, as it should appear (optional) |
|
||||
| `SEED_GROUP` | a group to put them in, if not the most privileged one (optional) |
|
||||
| `RESPONSIBLE_GROUP` | a group every responsible person joins, e.g. `redaktor` (optional) |
|
||||
| `RESPONSIBLE_GROUP` | a group every responsible person joins, e.g. `editors` (optional) |
|
||||
|
||||
## 4. Start portal
|
||||
|
||||
@@ -151,7 +151,7 @@ A desk that lists the bucket offers the way back with a transition from
|
||||
```yaml
|
||||
resource:
|
||||
source: { kind: kv, bucket: portal_invites }
|
||||
requires_group: styret
|
||||
requires_group: board
|
||||
transitions:
|
||||
- { from: open, to: done, label: Is in }
|
||||
- { from: expired, to: open, label: Send again }
|
||||
@@ -172,7 +172,7 @@ list, and whoever sits there takes it up and settles it:
|
||||
```yaml
|
||||
resource:
|
||||
source: { kind: kv, bucket: portal_edit_suggestions }
|
||||
requires_group: styret
|
||||
requires_group: board
|
||||
transitions:
|
||||
- { from: open, to: discussed, label: Looking at it }
|
||||
- { from: open, to: done, label: Changed }
|
||||
@@ -187,7 +187,7 @@ where each one stands. A content repo that declares the bucket itself
|
||||
in `aggregates.yaml`, with a `mail:` on a state, sends that instead.
|
||||
|
||||
Their group can also be the way into other tools. The vel's
|
||||
`redaktor` group signs in to the project Gitea with the same account:
|
||||
`editors` group signs in to the project Gitea with the same account:
|
||||
a second OAuth2 client scoped to that group alone.
|
||||
|
||||
## When it does not work
|
||||
|
||||
Reference in New Issue
Block a user