Memberships: groups kept by portal itself, a person by phone number first

A membership is a case in the built-in portal_memberships bucket:
invited by a desk, a grants, the seed or the responsible pass; active
from the person's first sign-in, when the provider's subject, phone
number or address matches the record; removed by a desk, and invited
again after that. One record per group and person however it was
keyed, and at sign-in every record that matched learns what the
provider verified. The active memberships join the groups claim, so
Cedar sees the same parents as before.

PEOPLE_BACKEND picks Kanidm or memberships; unset, a KANIDM_API_TOKEN
means Kanidm. The NATS access service looks a person's groups up when
a question names them by sub, phone or email and lists none. The
sign-in asks for the phoneNumber scope and reads it from userinfo.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

src/seed.rs

@@ -208,9 +208,9 @@ async fn responsible(state: &crate::server::AppState) -> usize {
     if people.is_empty() && group.is_none() {
         return 0;
     }
-    let Some(kanidm) = crate::people::Kanidm::from_env() else {
+    let Some(people_backend) = crate::people::People::from_env() else {
         if !people.is_empty() {
-            tracing::info!(people = people.len(), "the content names responsible people, but invites are not configured (KANIDM_API_TOKEN) - no accounts made");
+            tracing::info!(people = people.len(), "the content names responsible people, but {} - no accounts made", crate::people::People::NOT_CONFIGURED);
         }
         return 0;
     };
@@ -222,13 +222,15 @@ async fn responsible(state: &crate::server::AppState) -> usize {
             continue;
         }
         let name = if name.is_empty() { email.split('@').next().unwrap_or("").to_string() } else { name.clone() };
+        let who = crate::memberships::Identity::from_contact(email);
         // With a group, one call makes the account if there is none and
         // adds them either way; without one, only a missing account is
-        // made. Either way a person is mailed only when an account was
-        // made for them: someone who had one already has their way in.
-        let made = match &group {
-            Some(group) => kanidm.invite(&name, email, group).await,
-            None => match kanidm.has_person_with_mail(email).await {
+        // made (Kanidm; a membership is nothing without a group). Either
+        // way a person is mailed only when an account was made for
+        // them: someone who had one already has their way in.
+        let made = match (&group, &people_backend) {
+            (Some(group), people_backend) => people_backend.invite(state, &name, &who, group, "responsible").await,
+            (None, crate::people::People::Kanidm(kanidm)) => match kanidm.has_person_with_mail(email).await {
                 Ok(true) => {
                     let _ = store.put(&key, "existing".into()).await;
                     continue;
@@ -236,6 +238,7 @@ async fn responsible(state: &crate::server::AppState) -> usize {
                 Ok(false) => kanidm.account(&name, email).await,
                 Err(e) => Err(e),
             },
+            (None, crate::people::People::Memberships) => continue,
         };
         match made {
             Ok(invited) => {
@@ -277,7 +280,8 @@ async fn responsible(state: &crate::server::AppState) -> usize {
     }
     for (key, invited) in no_longer_responsible(&on_file, &people, seed_admin_email().as_deref()) {
         if !invited.already_member {
-            if let Err(e) = kanidm.remove_member(&group, &invited.username).await {
+            let who = crate::memberships::Identity::from_contact(&invited.email);
+            if let Err(e) = people_backend.remove(state, &who, &invited.username, &group, "responsible").await {
                 left += 1;
                 tracing::warn!(user = %invited.username, group, "could not take someone no longer responsible out of the group: {e}");
                 continue;
@@ -290,11 +294,23 @@ async fn responsible(state: &crate::server::AppState) -> usize {
     left
 }
 
-/// The first person in, once, if `SEED_ADMIN_EMAIL` asks for one.
+/// The first person in, once, if `SEED_ADMIN_EMAIL` asks for one -
+/// or `SEED_ADMIN_PHONE`, for a site whose provider knows people by
+/// their number.
 async fn seed_admin(state: &crate::server::AppState) {
-    let Some(email) = std::env::var("SEED_ADMIN_EMAIL").ok().map(|e| e.trim().to_string()).filter(|e| e.contains('@')) else {
+    let phone = std::env::var("SEED_ADMIN_PHONE").ok().map(|p| p.trim().to_string()).filter(|p| !p.is_empty());
+    let email = std::env::var("SEED_ADMIN_EMAIL").ok().map(|e| e.trim().to_string()).filter(|e| e.contains('@'));
+    let (Some(contact), who) = (
+        phone.clone().or_else(|| email.clone()),
+        crate::memberships::Identity {
+            sub: None,
+            phone: phone.as_deref().and_then(|p| crate::memberships::normalize_phone(p, &std::env::var("PHONE_COUNTRY").unwrap_or_else(|_| "+47".into()))),
+            email: email.as_deref().map(|e| e.to_lowercase()),
+        },
+    ) else {
         return;
     };
+    let email = contact;
     let name = std::env::var("SEED_ADMIN_NAME")
         .ok()
         .map(|n| n.trim().to_string())
@@ -316,15 +332,15 @@ async fn seed_admin(state: &crate::server::AppState) {
         tracing::info!(group, "the first person was already invited into this group; not again");
         return;
     }
-    let Some(kanidm) = crate::people::Kanidm::from_env() else {
-        tracing::warn!(group, "SEED_ADMIN_EMAIL is set, but invites are not configured on this instance (KANIDM_URL, KANIDM_API_TOKEN) - nobody was seeded");
+    let Some(people) = crate::people::People::from_env() else {
+        tracing::warn!(group, "SEED_ADMIN_EMAIL is set, but {} - nobody was seeded", crate::people::People::NOT_CONFIGURED);
         return;
     };
 
     let mut attempt = 0;
     let invited = loop {
         attempt += 1;
-        match kanidm.invite(&name, &email, &group).await {
+        match people.invite(state, &name, &who, &group, "seed").await {
             Ok(invited) => break invited,
             Err(e) if attempt < ATTEMPTS => {
                 tracing::warn!(group, attempt, "seeding the first person failed, trying again in a minute: {e}");