Memberships: groups kept by portal itself, a person by phone number first

A membership is a case in the built-in portal_memberships bucket:
invited by a desk, a grants, the seed or the responsible pass; active
from the person's first sign-in, when the provider's subject, phone
number or address matches the record; removed by a desk, and invited
again after that. One record per group and person however it was
keyed, and at sign-in every record that matched learns what the
provider verified. The active memberships join the groups claim, so
Cedar sees the same parents as before.

PEOPLE_BACKEND picks Kanidm or memberships; unset, a KANIDM_API_TOKEN
means Kanidm. The NATS access service looks a person's groups up when
a question names them by sub, phone or email and lists none. The
sign-in asks for the phoneNumber scope and reads it from userinfo.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

src/access.rs

@@ -51,7 +51,17 @@ action invite appliesTo { principal: [User], resource: [Group] };
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum Principal {
     /// A signed-in person, or nobody (`groups` empty, `sub` "anonymous").
-    User { sub: String, groups: Vec<String> },
+    /// Over NATS, a question may name the person by phone number or
+    /// address instead of listing their groups, and portal looks their
+    /// memberships up (see `serve`).
+    User {
+        sub: String,
+        groups: Vec<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        phone: Option<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        email: Option<String>,
+    },
     /// Whoever holds one record's own link and knows the email on it.
     Submitter { record: String, email: String },
     /// A machine with a shared token.
@@ -60,12 +70,12 @@ pub enum Principal {
 
 impl Principal {
     pub fn anonymous() -> Self {
-        Principal::User { sub: "anonymous".into(), groups: Vec::new() }
+        Principal::User { sub: "anonymous".into(), groups: Vec::new(), phone: None, email: None }
     }
 
     pub fn from_user(user: Option<&crate::auth::User>) -> Self {
         match user {
-            Some(u) => Principal::User { sub: u.sub.clone(), groups: u.groups.clone() },
+            Some(u) => Principal::User { sub: u.sub.clone(), groups: u.groups.clone(), phone: u.phone.clone(), email: u.email.clone() },
             None => Principal::anonymous(),
         }
     }
@@ -311,7 +321,7 @@ impl Policy {
         };
         let mut entities: Vec<Entity> = Vec::new();
         let principal_uid = match principal {
-            Principal::User { sub, groups } => {
+            Principal::User { sub, groups, .. } => {
                 let parents: HashSet<EntityUid> = groups.iter().map(|g| uid("Group", g)).collect();
                 for g in &parents {
                     entities.push(Entity::new_no_attrs(g.clone(), HashSet::new()));
@@ -444,6 +454,7 @@ pub async fn serve(
     nats: async_nats::Client,
     site: String,
     access: std::sync::Arc<arc_swap::ArcSwap<Policy>>,
+    state: Option<crate::server::AppState>,
 ) {
     use futures::StreamExt;
     let subject = subject_for(&site);
@@ -458,7 +469,22 @@ pub async fn serve(
     while let Some(msg) = sub.next().await {
         let Some(reply) = msg.reply else { continue };
         let decision = match serde_json::from_slice::<Query>(&msg.payload) {
-            Ok(q) => decide_and_publish(&nats, &access.load(), &q.principal, q.action, &q.resource, q.context),
+            Ok(mut q) => {
+                // A question that names a person and lists no groups is
+                // asking portal what they belong to: their memberships,
+                // matched on subject, phone number or address.
+                if let (Principal::User { sub, groups, phone, email }, Some(state)) = (&mut q.principal, &state) {
+                    if groups.is_empty() && sub != "anonymous" {
+                        let who = crate::memberships::Identity {
+                            sub: Some(sub.clone()),
+                            phone: phone.as_deref().and_then(|p| crate::memberships::normalize_phone(p, &std::env::var("PHONE_COUNTRY").unwrap_or_else(|_| "+47".into()))),
+                            email: email.as_deref().map(|e| e.trim().to_lowercase()),
+                        };
+                        *groups = crate::memberships::groups_of(&crate::memberships::all(state).await, &who);
+                    }
+                }
+                decide_and_publish(&nats, &access.load(), &q.principal, q.action, &q.resource, q.context)
+            }
             Err(e) => Decision { allow: false, reasons: vec![format!("malformed question: {e}")] },
         };
         let bytes = serde_json::to_vec(&decision).unwrap_or_else(|_| b"{\"allow\":false,\"reasons\":[]}".to_vec());
@@ -487,7 +513,7 @@ mod tests {
     }
 
     fn user(groups: &[&str]) -> Principal {
-        Principal::User { sub: "u".into(), groups: groups.iter().map(|g| g.to_string()).collect() }
+        Principal::User { sub: "u".into(), groups: groups.iter().map(|g| g.to_string()).collect(), phone: None, email: None }
     }
 
     #[test]

src/app.rs

@@ -2652,6 +2652,16 @@ pub async fn my_suggestions(question_id: String) -> Result<Vec<MySuggestion>, Se
     Ok(mine)
 }
 
+/// Who a principal is, for a record: the username, or the service.
+#[cfg(feature = "ssr")]
+fn principal_name(principal: &crate::access::Principal) -> String {
+    match principal {
+        crate::access::Principal::User { sub, .. } => sub.clone(),
+        crate::access::Principal::Submitter { email, .. } => email.clone(),
+        crate::access::Principal::Service { name } => name.clone(),
+    }
+}
+
 #[server(endpoint = "submit_answer")]
 pub async fn submit_answer(
     question_id: String,
@@ -2743,21 +2753,22 @@ pub async fn submit_answer(
         if !may.allow {
             return Err(ServerFnError::new("not authorized to invite into this group"));
         }
-        let kanidm = crate::people::Kanidm::from_env()
-            .ok_or_else(|| ServerFnError::new("invites are not configured on this instance (KANIDM_API_TOKEN)"))?;
-        let field = |name: &str| responses.get(name).and_then(|v| v.as_str()).map(str::trim).filter(|s| !s.is_empty()).map(String::from);
-        let (name, email) = match (field("name"), field("email")) {
-            (Some(n), Some(e)) => (n, e),
-            _ => return Err(ServerFnError::new("an invite needs a name and an email")),
+        let people = crate::people::People::from_env().ok_or_else(|| ServerFnError::new(crate::people::People::NOT_CONFIGURED))?;
+        let Some((name, who)) = crate::people::who_for(&responses) else {
+            return Err(ServerFnError::new("an invite needs a name, and a phone number or an email"));
         };
-        let invited = kanidm
-            .invite(&name, &email, &invite.group)
+        let invited = people
+            .invite(&state, &name, &who, &invite.group, &principal_name(&principal))
             .await
             .map_err(|e| ServerFnError::new(format!("invite failed: {e}")))?;
         if let Some(map) = responses.as_object_mut() {
             map.insert("invited".to_string(), serde_json::to_value(&invited).unwrap_or_default());
         }
-        record_as.get_or_insert_with(|| crate::people::INVITES_BUCKET.to_string());
+        // Through Kanidm the invite is its own case, with a link that
+        // runs out; a membership is the case already.
+        if people.is_kanidm() {
+            record_as.get_or_insert_with(|| crate::people::INVITES_BUCKET.to_string());
+        }
         if let Ok(bytes) = serde_json::to_vec(&invited) {
             let _ = state.nats.publish(crate::people::INVITED_SUBJECT, bytes.into()).await;
         }
@@ -2908,7 +2919,7 @@ mod responsible_tests {
     use crate::content::Responsible;
 
     fn user(email: Option<&str>, groups: &[&str]) -> User {
-        User { sub: "s".into(), username: "kari".into(), display_name: "Kari".into(), groups: groups.iter().map(|g| g.to_string()).collect(), email: email.map(String::from) }
+        User { sub: "s".into(), username: "kari".into(), display_name: "Kari".into(), groups: groups.iter().map(|g| g.to_string()).collect(), phone: None, email: email.map(String::from) }
     }
 
     fn named(contact: &str, group: Option<&str>) -> Responsible {

src/auth.rs

@@ -14,6 +14,10 @@ pub struct User {
     /// live, so a group change only takes effect on the next login.
     #[serde(default)]
     pub groups: Vec<String>,
+    /// The phone number the provider verified (`phone_number`, from
+    /// userinfo), when it gives one: what a membership is keyed by first.
+    #[serde(default)]
+    pub phone: Option<String>,
     /// The address Kanidm holds for them (the `email` claim), so a page
     /// can know it is talking to the person it names as responsible.
     #[serde(default)]

src/content/mod.rs

@@ -1865,7 +1865,7 @@ alternatives:
     fn a_signed_in_person_is_not_asked_who_they_are() {
         let yaml = "id: /oppslag/[key]\nname: P\nalternatives:\n  - name: A\n    features:\n      - name: F\n        requirements:\n          - name: email\n            type: email\n            value: \"{user.email}\"\n          - name: navn\n            value: \"{user.name}\"\n          - name: hva\n            type: textarea\n            value: \"{user.email} says\"\n";
         let q: Question = serde_yaml::from_str(yaml).unwrap();
-        let user = crate::auth::User { sub: "s".into(), username: "kari".into(), display_name: "Kari N".into(), groups: vec![], email: Some("kari@vel.no".into()) };
+        let user = crate::auth::User { sub: "s".into(), username: "kari".into(), display_name: "Kari N".into(), groups: vec![], phone: None, email: Some("kari@vel.no".into()) };
         let mut signed_in = q.clone();
         fill_from_user(&mut signed_in, Some(&user));
         let reqs = &signed_in.alternatives[0].features[0].requirements;

src/content/validate.rs

@@ -64,6 +64,17 @@ aggregates:
     transitions:
       open: [done, expired]
       expired: [open, done]
+  - bucket: portal_memberships
+    attended_by: the desks that list who is in a group; portal itself moves invited to active at sign-in
+    initial: invited
+    states:
+      invited: { event: invited }
+      active: { event: active }
+      removed: { event: removed }
+    transitions:
+      invited: [active, removed]
+      active: [removed]
+      removed: [invited, active]
   - bucket: portal_edit_suggestions
     attended_by: whoever keeps the content; every suggestion is mailed to the site's inbox too
     initial: open

src/lib.rs

@@ -33,6 +33,8 @@ pub mod mail;
 
 #[cfg(feature = "ssr")]
 pub mod seed;
+#[cfg(feature = "ssr")]
+pub mod memberships;
 
 pub mod maps;
 

src/mail.rs

@@ -565,7 +565,7 @@ pub async fn on_invite(state: &crate::server::AppState, invited: &crate::people:
         ),
         (None, false, true) => (
             "Du har fått plass i {group} på {site_name}".to_string(),
-            "Hei {name},\n\nKontoen din på {site} har nå plass i {group}. Logg inn som vanlig.".to_string(),
+            "Hei {name},\n\nDu har fått plass i {group} på {site_name}. Logg inn på {site}, så er plassen din der.".to_string(),
         ),
         (None, true, false) => (
             "You are invited into {group} at {site_name}".to_string(),
@@ -573,7 +573,7 @@ pub async fn on_invite(state: &crate::server::AppState, invited: &crate::people:
         ),
         (None, false, false) => (
             "You now have a place in {group} at {site_name}".to_string(),
-            "Hello {name},\n\nYour account at {site} now has a place in {group}. Sign in as usual.".to_string(),
+            "Hello {name},\n\nYou now have a place in {group} at {site_name}. Sign in at {site}, and it is there.".to_string(),
         ),
     };
     let now_ms = chrono::Utc::now().timestamp_millis();

src/main.rs

@@ -86,9 +86,6 @@ async fn main() -> anyhow::Result<()> {
         site.clone(),
         access.clone(),
     ));
-    // The same decisions, answerable by other apps over NATS.
-    tokio::spawn(portal::access::serve(nats.clone(), site_name_for_subjects(), access.clone()));
-
     let state = AppState {
         leptos_options: leptos_options.clone(),
         nats,
@@ -104,6 +101,9 @@ async fn main() -> anyhow::Result<()> {
         garage,
     };
 
+    // The same decisions, answerable by other apps over NATS, for a
+    // person named by phone number or address as well as by groups.
+    tokio::spawn(portal::access::serve(state.nats.clone(), site_name_for_subjects(), state.access.clone(), Some(state.clone())));
     // Announced pages: keep their desk records current, close ended
     // windows (see announce.rs).
     tokio::spawn(portal::announce::run(state.clone()));

src/memberships.rs

@@ -0,0 +1,399 @@
+//! Who belongs to which group, kept by portal itself.
+//!
+//! A membership is a case: one record per (group, person) in the
+//! built-in `portal_memberships` bucket, `invited` until the person is
+//! seen, `active` from then on, `removed` when a desk takes them out.
+//! A desk invite writes one, a state that `grants` a group writes one,
+//! the first person and the people the content names as responsible
+//! get theirs at start. Nothing here talks to an identity provider:
+//! the provider says who someone is, and this says what they belong
+//! to. At sign-in, the person's active memberships become their groups,
+//! and the access policy (Cedar, `access.rs`) sees them as the parents
+//! of the `User` entity, exactly as it saw a `groups` claim before.
+//!
+//! **A person is their phone number first, their email second.** A
+//! provider that verifies phone numbers (Vipps) makes the number the
+//! surest thing a record can hold; a form that collected an address
+//! still matches on it. A record's key is the group and whichever of
+//! the two it has, so a second invite of the same person into the same
+//! group finds the first.
+#![cfg(feature = "ssr")]
+
+use serde::{Deserialize, Serialize};
+
+use crate::answers::Answer;
+
+pub const BUCKET: &str = "portal_memberships";
+pub const INVITED: &str = "invited";
+pub const ACTIVE: &str = "active";
+pub const REMOVED: &str = "removed";
+/// Stamped on moves nobody at a desk made.
+pub const BY: &str = "portal";
+
+/// The country a phone number without one is in, as a calling code.
+fn default_country() -> String {
+    std::env::var("PHONE_COUNTRY").ok().filter(|c| !c.trim().is_empty()).unwrap_or_else(|| "+47".to_string())
+}
+
+/// Who a person is, as far as a record or a session knows.
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct Identity {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub sub: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub phone: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub email: Option<String>,
+}
+
+/// A phone number as one string for everyone: digits with a leading
+/// `+` and a country code, `+4791234567`. Spaces, dots and dashes go;
+/// `00` becomes `+`; a bare national number gets the site's country.
+/// `None` for anything that is not a number.
+pub fn normalize_phone(raw: &str, country: &str) -> Option<String> {
+    let mut digits: String = raw.trim().chars().filter(|c| c.is_ascii_digit()).collect();
+    let trimmed = raw.trim();
+    if digits.is_empty() || digits.len() < 5 || digits.len() > 15 {
+        return None;
+    }
+    if trimmed.starts_with('+') {
+        return Some(format!("+{digits}"));
+    }
+    if let Some(rest) = digits.strip_prefix("00") {
+        return Some(format!("+{rest}"));
+    }
+    if trimmed.starts_with('(') && !trimmed.contains('+') {
+        digits = digits.trim_start_matches('0').to_string();
+    }
+    Some(format!("{}{digits}", country.trim()))
+}
+
+fn normalize_email(raw: &str) -> Option<String> {
+    let e = raw.trim().trim_start_matches("mailto:").trim().to_lowercase();
+    (e.contains('@') && !e.contains(char::is_whitespace)).then_some(e)
+}
+
+impl Identity {
+    /// From what a form collected: the first phone-like field and the
+    /// first email-like field, by the names forms use for them.
+    pub fn from_responses(responses: &serde_json::Value) -> Self {
+        let field = |names: &[&str]| {
+            names
+                .iter()
+                .find_map(|n| responses.get(*n).and_then(|v| v.as_str()))
+                .map(str::trim)
+                .filter(|s| !s.is_empty())
+                .map(String::from)
+        };
+        let country = default_country();
+        Identity {
+            sub: None,
+            phone: field(&["phone", "telefon", "tel", "mobil", "mobile", "phone_number"]).and_then(|p| normalize_phone(&p, &country)),
+            email: field(&["email", "epost", "e-post", "mail"]).and_then(|e| normalize_email(&e)),
+        }
+    }
+
+    pub fn from_user(user: &crate::auth::User) -> Self {
+        let country = default_country();
+        Identity {
+            sub: Some(user.sub.clone()),
+            phone: user.phone.as_deref().and_then(|p| normalize_phone(p, &country)),
+            email: user.email.as_deref().and_then(normalize_email),
+        }
+    }
+
+    /// One person given as one string: a phone number if it reads as
+    /// one, else an address.
+    pub fn from_contact(contact: &str) -> Self {
+        let country = default_country();
+        match normalize_email(contact) {
+            Some(email) => Identity { sub: None, phone: None, email: Some(email) },
+            None => Identity { sub: None, phone: normalize_phone(contact, &country), email: None },
+        }
+    }
+
+    /// What a membership record is keyed by: the phone number, else the
+    /// address, else the provider's subject. `None` when there is
+    /// nothing to know the person by.
+    pub fn key(&self) -> Option<String> {
+        self.phone
+            .as_deref()
+            .or(self.email.as_deref())
+            .or(self.sub.as_deref())
+            .map(|k| k.chars().map(|c| if c.is_ascii_alphanumeric() || c == '-' || c == '_' { c } else { '_' }).collect())
+    }
+
+    /// Whether a record about `other` is about this person: the same
+    /// subject, phone number or address, any one of them.
+    pub fn matches(&self, other: &Identity) -> bool {
+        let same = |a: &Option<String>, b: &Option<String>| a.is_some() && a == b;
+        same(&self.sub, &other.sub) || same(&self.phone, &other.phone) || same(&self.email, &other.email)
+    }
+
+    /// What is worth writing on a record from a login: everything the
+    /// provider verified that the record did not have.
+    fn merged_from(&self, seen: &Identity) -> Identity {
+        Identity {
+            sub: self.sub.clone().or_else(|| seen.sub.clone()),
+            phone: self.phone.clone().or_else(|| seen.phone.clone()),
+            email: self.email.clone().or_else(|| seen.email.clone()),
+        }
+    }
+}
+
+/// One record's id: the group and the person's key.
+pub fn record_id(group: &str, key: &str) -> String {
+    format!("{}.{key}", group.trim())
+}
+
+/// The identity a record holds.
+pub fn identity_of(answer: &Answer) -> Identity {
+    Identity {
+        sub: answer.responses.get("sub").and_then(|v| v.as_str()).filter(|s| !s.is_empty()).map(String::from),
+        phone: answer.responses.get("phone").and_then(|v| v.as_str()).filter(|s| !s.is_empty()).map(String::from),
+        email: answer.responses.get("email").and_then(|v| v.as_str()).filter(|s| !s.is_empty()).map(String::from),
+    }
+}
+
+pub fn group_of(answer: &Answer) -> String {
+    answer.responses.get("group").and_then(|v| v.as_str()).unwrap_or_default().to_string()
+}
+
+/// The groups `who` is an active member of, from every record.
+pub fn groups_of(records: &[Answer], who: &Identity) -> Vec<String> {
+    let mut groups: Vec<String> = records
+        .iter()
+        .filter(|a| a.state == ACTIVE && identity_of(a).matches(who))
+        .map(group_of)
+        .filter(|g| !g.is_empty())
+        .collect();
+    groups.sort();
+    groups.dedup();
+    groups
+}
+
+async fn store(state: &crate::server::AppState) -> anyhow::Result<async_nats::jetstream::kv::Store> {
+    match state.jetstream.get_key_value(BUCKET).await {
+        Ok(store) => Ok(store),
+        Err(_) => Ok(state
+            .jetstream
+            .create_key_value(async_nats::jetstream::kv::Config { bucket: BUCKET.to_string(), ..Default::default() })
+            .await?),
+    }
+}
+
+/// Every membership record.
+pub async fn all(state: &crate::server::AppState) -> Vec<Answer> {
+    let Ok(store) = state.jetstream.get_key_value(BUCKET).await else { return Vec::new() };
+    let keys: Vec<String> = {
+        use futures::TryStreamExt;
+        match store.keys().await {
+            Ok(keys) => keys.try_collect().await.unwrap_or_default(),
+            Err(_) => Vec::new(),
+        }
+    };
+    let mut out = Vec::new();
+    for key in keys {
+        if let Ok(Some(bytes)) = store.get(&key).await {
+            if let Ok(answer) = serde_json::from_slice::<Answer>(&bytes) {
+                out.push(answer);
+            }
+        }
+    }
+    out
+}
+
+/// Moves one record the way a desk button would: through the event
+/// log, onto the projection, out on the answers subject.
+async fn move_to(state: &crate::server::AppState, store: &async_nats::jetstream::kv::Store, mut answer: Answer, target: &str, by: &str) -> anyhow::Result<Answer> {
+    let aggregates = state.aggregates.load();
+    let schema = aggregates.get(BUCKET).ok_or_else(|| anyhow::anyhow!("no {BUCKET} schema"))?;
+    let now_ms = chrono::Utc::now().timestamp_millis();
+    let payload = serde_json::json!({ "to": target, "item": answer.id, "by": by });
+    crate::answers::transition_or_reseed(&state.jetstream, schema, &answer.id, target, &answer.state, payload.clone(), now_ms)
+        .await
+        .map_err(|e| anyhow::anyhow!("{e}"))?;
+    answer.state = target.to_string();
+    answer.decided_ms = Some(now_ms);
+    answer.decided_by = Some(by.to_string());
+    store.put(&answer.id, serde_json::to_vec(&answer)?.into()).await?;
+    let parent_hashes = vec![answer.id.clone()];
+    let chain_hash = crate::chain::hash_node(&answer.question_id, &parent_hashes, &payload, now_ms);
+    let event = crate::events::AnswerSubmitted {
+        chain_hash,
+        parent_hashes,
+        question_id: answer.question_id.clone(),
+        alternative: target.to_string(),
+        responses: payload,
+        timestamp_ms: now_ms,
+    };
+    let _ = crate::events::emit_answer_submitted(&state.nats, &event).await;
+    Ok(answer)
+}
+
+/// Puts a person in a group, or finds them there. A new record starts
+/// `invited`; a removed one is invited again; an invited or active one
+/// is left as it is, so a second grant costs nothing. `created` in
+/// what comes back says whether the person had a place already.
+pub async fn grant(state: &crate::server::AppState, group: &str, name: &str, who: &Identity, by: &str) -> anyhow::Result<crate::people::Invited> {
+    let key = who.key().ok_or_else(|| anyhow::anyhow!("a membership needs a phone number or an address to know the person by"))?;
+    let store = store(state).await?;
+    // The person's record in this group, however it was keyed: a desk
+    // that invited by address and a decision that granted by phone
+    // number are talking about one person once a sign-in has joined
+    // the two, and must not make two.
+    let existing: Option<Answer> = all(state).await.into_iter().find(|a| group_of(a) == group.trim() && identity_of(a).matches(who));
+    let id = existing.as_ref().map(|a| a.id.clone()).unwrap_or_else(|| record_id(group, &key));
+    let now_ms = chrono::Utc::now().timestamp_millis();
+    let invited = |created: bool| crate::people::Invited {
+        username: key.clone(),
+        display_name: name.to_string(),
+        email: who.email.clone().unwrap_or_default(),
+        group: group.to_string(),
+        reset_link: None,
+        link_expires_ms: None,
+        created,
+        already_member: !created,
+    };
+    match existing {
+        Some(answer) if answer.state == REMOVED => {
+            move_to(state, &store, answer, INVITED, by).await?;
+            Ok(invited(true))
+        }
+        Some(_) => Ok(invited(false)),
+        None => {
+            let responses = serde_json::json!({
+                "name": name, "group": group, "by": by,
+                "phone": who.phone, "email": who.email, "sub": who.sub,
+            });
+            crate::answers::store_answer(&state.jetstream, &state.aggregates.load(), BUCKET, id, "/", "Membership", &responses, now_ms).await?;
+            Ok(invited(true))
+        }
+    }
+}
+
+/// Takes a person out of a group: the record moves to `removed` and
+/// stays, so the desk can see who was in and put them back.
+pub async fn revoke(state: &crate::server::AppState, group: &str, who: &Identity, by: &str) -> anyhow::Result<bool> {
+    let Some(key) = who.key() else { return Ok(false) };
+    let store = store(state).await?;
+    let id = record_id(group, &key);
+    let Some(answer) = store.get(&id).await?.and_then(|b| serde_json::from_slice::<Answer>(&b).ok()) else {
+        return Ok(false);
+    };
+    if answer.state == REMOVED {
+        return Ok(false);
+    }
+    move_to(state, &store, answer, REMOVED, by).await?;
+    Ok(true)
+}
+
+/// Someone signed in: every invitation that was for them is now a
+/// membership, with what the provider verified written on the record,
+/// and their active groups come back to be their groups for the
+/// session. Their `sub` is remembered, so the next login matches on
+/// it before anything else.
+pub async fn on_signed_in(state: &crate::server::AppState, user: &crate::auth::User) -> Vec<String> {
+    let who = Identity::from_user(user);
+    let records = all(state).await;
+    let Ok(store) = store(state).await else { return groups_of(&records, &who) };
+    let mut settled = Vec::with_capacity(records.len());
+    for answer in records {
+        let held = identity_of(&answer);
+        if !held.matches(&who) {
+            settled.push(answer);
+            continue;
+        }
+        let merged = held.merged_from(&who);
+        let mut answer = answer;
+        if merged != held {
+            if let Some(map) = answer.responses.as_object_mut() {
+                map.insert("sub".into(), serde_json::json!(merged.sub));
+                map.insert("phone".into(), serde_json::json!(merged.phone));
+                map.insert("email".into(), serde_json::json!(merged.email));
+            }
+            if let Ok(bytes) = serde_json::to_vec(&answer) {
+                let _ = store.put(&answer.id, bytes.into()).await;
+            }
+        }
+        if answer.state == INVITED {
+            match move_to(state, &store, answer.clone(), ACTIVE, BY).await {
+                Ok(active) => {
+                    tracing::info!(group = %group_of(&active), user = %user.username, "an invitation became a membership");
+                    settled.push(active);
+                }
+                Err(e) => {
+                    tracing::warn!(id = %answer.id, "an invitation could not become a membership: {e}");
+                    settled.push(answer);
+                }
+            }
+        } else {
+            settled.push(answer);
+        }
+    }
+    groups_of(&settled, &who)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn record(group: &str, state: &str, phone: Option<&str>, email: Option<&str>, sub: Option<&str>) -> Answer {
+        Answer {
+            id: record_id(group, "k"),
+            question_id: "/".into(),
+            alternative: "Membership".into(),
+            responses: serde_json::json!({ "group": group, "phone": phone, "email": email, "sub": sub, "name": "X" }),
+            state: state.into(),
+            submitted_ms: 0,
+            decided_ms: None,
+            decided_by: None,
+            notes: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn a_phone_number_is_one_string_for_everyone() {
+        assert_eq!(normalize_phone("912 34 567", "+47"), Some("+4791234567".into()));
+        assert_eq!(normalize_phone("+47 912-34-567", "+47"), Some("+4791234567".into()));
+        assert_eq!(normalize_phone("004791234567", "+47"), Some("+4791234567".into()));
+        assert_eq!(normalize_phone("91234567", "+46"), Some("+4691234567".into()));
+        assert_eq!(normalize_phone("kari@vel.no", "+47"), None);
+        assert_eq!(normalize_phone("123", "+47"), None);
+    }
+
+    #[test]
+    fn a_person_is_their_phone_first_and_their_address_second() {
+        let both = Identity::from_responses(&serde_json::json!({ "name": "Kari", "telefon": "912 34 567", "email": "Kari@Vel.no" }));
+        assert_eq!(both.key().as_deref(), Some("_4791234567"));
+        assert_eq!(both.email.as_deref(), Some("kari@vel.no"));
+        let mail_only = Identity::from_responses(&serde_json::json!({ "epost": "Kari@Vel.no" }));
+        assert_eq!(mail_only.key().as_deref(), Some("kari_vel_no"));
+        assert_eq!(Identity::from_contact("mailto:Post@Vel.no").email.as_deref(), Some("post@vel.no"));
+        assert_eq!(Identity::from_contact("912 34 567").phone.as_deref(), Some("+4791234567"));
+        assert!(Identity::default().key().is_none());
+    }
+
+    #[test]
+    fn a_record_is_about_a_person_by_any_one_of_sub_phone_or_email() {
+        let kari = Identity { sub: Some("abc".into()), phone: Some("+4791234567".into()), email: Some("kari@vel.no".into()) };
+        assert!(Identity { sub: None, phone: Some("+4791234567".into()), email: None }.matches(&kari));
+        assert!(Identity { sub: None, phone: None, email: Some("kari@vel.no".into()) }.matches(&kari));
+        assert!(Identity { sub: Some("abc".into()), phone: None, email: Some("old@vel.no".into()) }.matches(&kari));
+        assert!(!Identity { sub: None, phone: Some("+4799999999".into()), email: Some("ola@vel.no".into()) }.matches(&kari));
+        assert!(!Identity::default().matches(&kari));
+    }
+
+    #[test]
+    fn only_active_memberships_are_groups() {
+        let kari = Identity { sub: None, phone: Some("+4791234567".into()), email: Some("kari@vel.no".into()) };
+        let records = vec![
+            record("styret", ACTIVE, Some("+4791234567"), None, None),
+            record("kasserer", INVITED, None, Some("kari@vel.no"), None),
+            record("trafikk", REMOVED, Some("+4791234567"), None, None),
+            record("medlemmer", ACTIVE, None, Some("kari@vel.no"), None),
+            record("styret", ACTIVE, Some("+4799999999"), None, None),
+        ];
+        assert_eq!(groups_of(&records, &kari), vec!["medlemmer", "styret"]);
+    }
+}

src/people.rs

@@ -23,6 +23,61 @@
 use serde::{Deserialize, Serialize};
 
 pub const INVITES_BUCKET: &str = "portal_invites";
+
+/// Where people are kept. Kanidm makes accounts and holds groups; with
+/// memberships (`memberships.rs`) portal holds the groups itself and
+/// the identity provider only says who someone is. `PEOPLE_BACKEND`
+/// picks; unset, a `KANIDM_API_TOKEN` means Kanidm and its absence
+/// means memberships, so a site with no Kanidm token can still invite.
+pub enum People {
+    Kanidm(Kanidm),
+    Memberships,
+}
+
+impl People {
+    /// `None` only when Kanidm is asked for and not configured.
+    pub fn from_env() -> Option<Self> {
+        match std::env::var("PEOPLE_BACKEND").ok().map(|b| b.trim().to_lowercase()).as_deref() {
+            Some("memberships") => Some(People::Memberships),
+            Some("kanidm") => Kanidm::from_env().map(People::Kanidm),
+            Some(other) => {
+                tracing::warn!(backend = other, "PEOPLE_BACKEND is neither kanidm nor memberships; using memberships");
+                Some(People::Memberships)
+            }
+            None => Some(Kanidm::from_env().map(People::Kanidm).unwrap_or(People::Memberships)),
+        }
+    }
+
+    /// What is missing when `from_env` says no.
+    pub const NOT_CONFIGURED: &'static str = "invites are not configured on this instance (PEOPLE_BACKEND=kanidm needs KANIDM_URL and KANIDM_API_TOKEN)";
+
+    /// Puts a person in a group, making them known if they were not:
+    /// through Kanidm an account and a one-time link, through
+    /// memberships a record that becomes theirs when they sign in.
+    /// `by` is who asked, for the record.
+    pub async fn invite(&self, state: &crate::server::AppState, name: &str, who: &crate::memberships::Identity, group: &str, by: &str) -> anyhow::Result<Invited> {
+        match self {
+            People::Kanidm(kanidm) => {
+                let email = who.email.as_deref().ok_or_else(|| anyhow::anyhow!("Kanidm knows people by their address, and this one has none"))?;
+                kanidm.invite(name, email, group).await
+            }
+            People::Memberships => crate::memberships::grant(state, group, name, who, by).await,
+        }
+    }
+
+    /// Takes a person out of a group. Through Kanidm only what portal
+    /// put there (see `Invited.already_member`); memberships remember.
+    pub async fn remove(&self, state: &crate::server::AppState, who: &crate::memberships::Identity, username: &str, group: &str, by: &str) -> anyhow::Result<()> {
+        match self {
+            People::Kanidm(kanidm) => kanidm.remove_member(group, username).await,
+            People::Memberships => crate::memberships::revoke(state, group, who, by).await.map(|_| ()),
+        }
+    }
+
+    pub fn is_kanidm(&self) -> bool {
+        matches!(self, People::Kanidm(_))
+    }
+}
 pub const INVITED_SUBJECT: &str = "portal.people.invited";
 /// The states an invite moves between, besides the schema's initial
 /// `open` (see `BUILTIN_AGGREGATES_YAML`).
@@ -515,21 +570,21 @@ pub fn username_for(email: &str) -> String {
     }
 }
 
-/// The person a record is about, for a state that grants a group.
-/// Both are required by the lint of any form that fills such a bucket
-/// (see `validate_questions`), so a record missing either is one that
-/// predates the rule, and is reported rather than guessed at.
-pub fn who_for(responses: &serde_json::Value) -> Option<(String, String)> {
-    let field = |name: &str| {
-        responses
-            .get(name)
-            .and_then(|v| v.as_str())
-            .map(str::trim)
-            .filter(|s| !s.is_empty())
-            .map(String::from)
-    };
-    let email = field("email").filter(|e| e.contains('@'))?;
-    Some((field("name")?, email))
+/// The person a record is about, for a state that grants a group: their
+/// name, and a phone number or an address to know them by. Required by
+/// the lint of any form that fills such a bucket (see
+/// `validate_questions`), so a record missing them is one that predates
+/// the rule, and is reported rather than guessed at.
+pub fn who_for(responses: &serde_json::Value) -> Option<(String, crate::memberships::Identity)> {
+    let name = responses
+        .get("name")
+        .or_else(|| responses.get("navn"))
+        .and_then(|v| v.as_str())
+        .map(str::trim)
+        .filter(|s| !s.is_empty())
+        .map(String::from)?;
+    let who = crate::memberships::Identity::from_responses(responses);
+    who.key().is_some().then_some((name, who))
 }
 
 /// A record entered `state`: if that state grants a group, put the
@@ -555,15 +610,15 @@ pub async fn on_state(
     else {
         return;
     };
-    let Some(kanidm) = Kanidm::from_env() else {
-        tracing::warn!(bucket, id, to_state, group, "this state grants a group, but invites are not configured on this instance (KANIDM_API_TOKEN) - nobody was added");
+    let Some(people) = People::from_env() else {
+        tracing::warn!(bucket, id, to_state, group, "this state grants a group, but {} - nobody was added", People::NOT_CONFIGURED);
         return;
     };
-    let Some((name, email)) = who_for(responses) else {
-        tracing::warn!(bucket, id, to_state, group, "this state grants a group, but the record carries no name and email - nobody was added");
+    let Some((name, who)) = who_for(responses) else {
+        tracing::warn!(bucket, id, to_state, group, "this state grants a group, but the record carries no name and no phone number or email - nobody was added");
         return;
     };
-    let invited = match kanidm.invite(&name, &email, &group).await {
+    let invited = match people.invite(state, &name, &who, &group, &format!("{bucket}:{id}")).await {
         Ok(invited) => invited,
         Err(e) => {
             tracing::error!(bucket, id, to_state, group, "granting the group failed: {e}");
@@ -662,6 +717,7 @@ mod tests {
             username: username.into(),
             display_name: String::new(),
             groups: vec![],
+            phone: None,
             email: email.map(String::from),
         };
         assert!(is_for(&invited, &user("kari", None)));

src/seed.rs

@@ -208,9 +208,9 @@ async fn responsible(state: &crate::server::AppState) -> usize {
     if people.is_empty() && group.is_none() {
         return 0;
     }
-    let Some(kanidm) = crate::people::Kanidm::from_env() else {
+    let Some(people_backend) = crate::people::People::from_env() else {
         if !people.is_empty() {
-            tracing::info!(people = people.len(), "the content names responsible people, but invites are not configured (KANIDM_API_TOKEN) - no accounts made");
+            tracing::info!(people = people.len(), "the content names responsible people, but {} - no accounts made", crate::people::People::NOT_CONFIGURED);
         }
         return 0;
     };
@@ -222,13 +222,15 @@ async fn responsible(state: &crate::server::AppState) -> usize {
             continue;
         }
         let name = if name.is_empty() { email.split('@').next().unwrap_or("").to_string() } else { name.clone() };
+        let who = crate::memberships::Identity::from_contact(email);
         // With a group, one call makes the account if there is none and
         // adds them either way; without one, only a missing account is
-        // made. Either way a person is mailed only when an account was
-        // made for them: someone who had one already has their way in.
-        let made = match &group {
-            Some(group) => kanidm.invite(&name, email, group).await,
-            None => match kanidm.has_person_with_mail(email).await {
+        // made (Kanidm; a membership is nothing without a group). Either
+        // way a person is mailed only when an account was made for
+        // them: someone who had one already has their way in.
+        let made = match (&group, &people_backend) {
+            (Some(group), people_backend) => people_backend.invite(state, &name, &who, group, "responsible").await,
+            (None, crate::people::People::Kanidm(kanidm)) => match kanidm.has_person_with_mail(email).await {
                 Ok(true) => {
                     let _ = store.put(&key, "existing".into()).await;
                     continue;
@@ -236,6 +238,7 @@ async fn responsible(state: &crate::server::AppState) -> usize {
                 Ok(false) => kanidm.account(&name, email).await,
                 Err(e) => Err(e),
             },
+            (None, crate::people::People::Memberships) => continue,
         };
         match made {
             Ok(invited) => {
@@ -277,7 +280,8 @@ async fn responsible(state: &crate::server::AppState) -> usize {
     }
     for (key, invited) in no_longer_responsible(&on_file, &people, seed_admin_email().as_deref()) {
         if !invited.already_member {
-            if let Err(e) = kanidm.remove_member(&group, &invited.username).await {
+            let who = crate::memberships::Identity::from_contact(&invited.email);
+            if let Err(e) = people_backend.remove(state, &who, &invited.username, &group, "responsible").await {
                 left += 1;
                 tracing::warn!(user = %invited.username, group, "could not take someone no longer responsible out of the group: {e}");
                 continue;
@@ -290,11 +294,23 @@ async fn responsible(state: &crate::server::AppState) -> usize {
     left
 }
 
-/// The first person in, once, if `SEED_ADMIN_EMAIL` asks for one.
+/// The first person in, once, if `SEED_ADMIN_EMAIL` asks for one -
+/// or `SEED_ADMIN_PHONE`, for a site whose provider knows people by
+/// their number.
 async fn seed_admin(state: &crate::server::AppState) {
-    let Some(email) = std::env::var("SEED_ADMIN_EMAIL").ok().map(|e| e.trim().to_string()).filter(|e| e.contains('@')) else {
+    let phone = std::env::var("SEED_ADMIN_PHONE").ok().map(|p| p.trim().to_string()).filter(|p| !p.is_empty());
+    let email = std::env::var("SEED_ADMIN_EMAIL").ok().map(|e| e.trim().to_string()).filter(|e| e.contains('@'));
+    let (Some(contact), who) = (
+        phone.clone().or_else(|| email.clone()),
+        crate::memberships::Identity {
+            sub: None,
+            phone: phone.as_deref().and_then(|p| crate::memberships::normalize_phone(p, &std::env::var("PHONE_COUNTRY").unwrap_or_else(|_| "+47".into()))),
+            email: email.as_deref().map(|e| e.to_lowercase()),
+        },
+    ) else {
         return;
     };
+    let email = contact;
     let name = std::env::var("SEED_ADMIN_NAME")
         .ok()
         .map(|n| n.trim().to_string())
@@ -316,15 +332,15 @@ async fn seed_admin(state: &crate::server::AppState) {
         tracing::info!(group, "the first person was already invited into this group; not again");
         return;
     }
-    let Some(kanidm) = crate::people::Kanidm::from_env() else {
-        tracing::warn!(group, "SEED_ADMIN_EMAIL is set, but invites are not configured on this instance (KANIDM_URL, KANIDM_API_TOKEN) - nobody was seeded");
+    let Some(people) = crate::people::People::from_env() else {
+        tracing::warn!(group, "SEED_ADMIN_EMAIL is set, but {} - nobody was seeded", crate::people::People::NOT_CONFIGURED);
         return;
     };
 
     let mut attempt = 0;
     let invited = loop {
         attempt += 1;
-        match kanidm.invite(&name, &email, &group).await {
+        match people.invite(state, &name, &who, &group, "seed").await {
             Ok(invited) => break invited,
             Err(e) if attempt < ATTEMPTS => {
                 tracing::warn!(group, attempt, "seeding the first person failed, trying again in a minute: {e}");

src/server/oidc.rs

@@ -11,10 +11,10 @@ use axum::{
     response::Redirect,
 };
 use openidconnect::{
-    core::{CoreAuthenticationFlow, CoreClient, CoreProviderMetadata},
+    core::{CoreAuthenticationFlow, CoreClient, CoreProviderMetadata, CoreUserInfoClaims},
     AuthorizationCode, ClientId, ClientSecret, CsrfToken, EndpointMaybeSet, EndpointNotSet,
     EndpointSet, IssuerUrl, Nonce, PkceCodeChallenge, PkceCodeVerifier, RedirectUrl, Scope,
-    TokenResponse,
+    OAuth2TokenResponse, TokenResponse,
 };
 use serde::Deserialize;
 use tower_sessions::Session;
@@ -50,6 +50,12 @@ const NONCE_KEY: &str = "oidc_nonce";
 const REDIRECT_KEY: &str = "oidc_post_login_redirect";
 
 impl Oidc {
+    /// Sign-in disabled: what a content-only instance has, and what a
+    /// test builds an `AppState` with.
+    pub fn disabled() -> Self {
+        Self { inner: None }
+    }
+
     /// Discovers the provider and builds the client from environment:
     /// `KANIDM_URL`, `OAUTH2_CLIENT_ID`, `OAUTH2_CLIENT_SECRET`, `PUBLIC_URL`.
     /// With `KANIDM_URL` unset, sign-in is disabled instead of fatal -
@@ -153,6 +159,9 @@ pub async fn login(
         .add_scope(Scope::new("openid".to_string()))
         .add_scope(Scope::new("profile".to_string()))
         .add_scope(Scope::new("email".to_string()))
+        // A provider that verifies phone numbers (Vipps) gives one for
+        // this scope; Kanidm ignores a scope it does not know.
+        .add_scope(Scope::new("phoneNumber".to_string()))
         .set_pkce_challenge(pkce_challenge)
         .url();
 
@@ -242,13 +251,33 @@ pub async fn callback(
     let groups = extract_groups_claim(&id_token);
 
     let email = claims.email().map(|e| e.as_str().trim().to_lowercase());
-    let user = User {
+    // The verified phone number lives at userinfo, not in the ID token,
+    // for providers that give one (Vipps). A provider that has none, or
+    // no userinfo endpoint, leaves it empty; nothing depends on it.
+    let phone = match oidc.client.user_info(token_response.access_token().clone(), None) {
+        Ok(request) => request
+            .request_async(&oidc.http)
+            .await
+            .ok()
+            .and_then(|info: CoreUserInfoClaims| info.phone_number().map(|p| p.as_str().to_string())),
+        Err(_) => None,
+    };
+    let mut user = User {
         sub: claims.subject().as_str().to_string(),
         username,
         display_name,
         groups,
+        phone,
         email,
     };
+    // What they belong to, as portal keeps it: every invitation for
+    // them becomes a membership now, and their active memberships join
+    // whatever groups the provider itself asserted.
+    for group in crate::memberships::on_signed_in(&state, &user).await {
+        if !user.groups.contains(&group) {
+            user.groups.push(group);
+        }
+    }
 
     // Rotate the session id on privilege change, then store the user.
     session.cycle_id().await.map_err(internal)?;