Memberships beside Kanidm: the invite makes the account too

Kanidm makes people, portal makes members. A site can switch to
memberships before its sign-in provider is one everyone already has.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

src/people.rs

@@ -61,7 +61,25 @@ impl People {
                 let email = who.email.as_deref().ok_or_else(|| anyhow::anyhow!("Kanidm knows people by their address, and this one has none"))?;
                 kanidm.invite(name, email, group).await
             }
-            People::Memberships => crate::memberships::grant(state, group, name, who, by).await,
+            People::Memberships => {
+                let mut invited = crate::memberships::grant(state, group, name, who, by).await?;
+                // A Kanidm beside memberships makes the person, not the
+                // member: an account with no group, and the one-time
+                // link, so someone invited by address can sign in
+                // before the provider is one everyone already has.
+                if let (Some(kanidm), Some(email)) = (Kanidm::from_env(), who.email.as_deref()) {
+                    match kanidm.account(name, email).await {
+                        Ok(account) => {
+                            invited.username = account.username;
+                            invited.reset_link = account.reset_link;
+                            invited.link_expires_ms = account.link_expires_ms;
+                            invited.created = account.created;
+                        }
+                        Err(e) => tracing::warn!(group, %email, "the membership is on file, but no Kanidm account could be made: {e}"),
+                    }
+                }
+                Ok(invited)
+            }
         }
     }