Memberships: groups kept by portal itself, a person by phone number first

A membership is a case in the built-in portal_memberships bucket:
invited by a desk, a grants, the seed or the responsible pass; active
from the person's first sign-in, when the provider's subject, phone
number or address matches the record; removed by a desk, and invited
again after that. One record per group and person however it was
keyed, and at sign-in every record that matched learns what the
provider verified. The active memberships join the groups claim, so
Cedar sees the same parents as before.

PEOPLE_BACKEND picks Kanidm or memberships; unset, a KANIDM_API_TOKEN
means Kanidm. The NATS access service looks a person's groups up when
a question names them by sub, phone or email and lists none. The
sign-in asks for the phoneNumber scope and reads it from userinfo.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

src/content/mod.rs

@@ -1865,7 +1865,7 @@ alternatives:
     fn a_signed_in_person_is_not_asked_who_they_are() {
         let yaml = "id: /oppslag/[key]\nname: P\nalternatives:\n  - name: A\n    features:\n      - name: F\n        requirements:\n          - name: email\n            type: email\n            value: \"{user.email}\"\n          - name: navn\n            value: \"{user.name}\"\n          - name: hva\n            type: textarea\n            value: \"{user.email} says\"\n";
         let q: Question = serde_yaml::from_str(yaml).unwrap();
-        let user = crate::auth::User { sub: "s".into(), username: "kari".into(), display_name: "Kari N".into(), groups: vec![], email: Some("kari@vel.no".into()) };
+        let user = crate::auth::User { sub: "s".into(), username: "kari".into(), display_name: "Kari N".into(), groups: vec![], phone: None, email: Some("kari@vel.no".into()) };
         let mut signed_in = q.clone();
         fill_from_user(&mut signed_in, Some(&user));
         let reqs = &signed_in.alternatives[0].features[0].requirements;

src/content/validate.rs

@@ -64,6 +64,17 @@ aggregates:
     transitions:
       open: [done, expired]
       expired: [open, done]
+  - bucket: portal_memberships
+    attended_by: the desks that list who is in a group; portal itself moves invited to active at sign-in
+    initial: invited
+    states:
+      invited: { event: invited }
+      active: { event: active }
+      removed: { event: removed }
+    transitions:
+      invited: [active, removed]
+      active: [removed]
+      removed: [invited, active]
   - bucket: portal_edit_suggestions
     attended_by: whoever keeps the content; every suggestion is mailed to the site's inbox too
     initial: open