3 Commits

Include renames

Author	SHA1	Message	Date
Bendik Aagaard LynghaugandClaude Fable 5.1	c4e2de5efa	Memberships beside Kanidm: the invite makes the account too ... Kanidm makes people, portal makes members. A site can switch to memberships before its sign-in provider is one everyone already has. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt	2026-09-30 14:06:55 +02:00
Bendik Aagaard LynghaugandClaude Fable 5.1	6c86dc47a2	The phone scope is asked for only when told to: Kanidm denies a scope the person lacks ... 0.5.7 asked every provider for phoneNumber, so a Kanidm site could not sign anyone in. OIDC_EXTRA_SCOPES=phoneNumber asks for it (Vipps). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt	2026-09-30 13:40:12 +02:00
Bendik Aagaard LynghaugandClaude Fable 5.1	f047e21c4a	Memberships: groups kept by portal itself, a person by phone number first ... A membership is a case in the built-in portal_memberships bucket: invited by a desk, a grants, the seed or the responsible pass; active from the person's first sign-in, when the provider's subject, phone number or address matches the record; removed by a desk, and invited again after that. One record per group and person however it was keyed, and at sign-in every record that matched learns what the provider verified. The active memberships join the groups claim, so Cedar sees the same parents as before. PEOPLE_BACKEND picks Kanidm or memberships; unset, a KANIDM_API_TOKEN means Kanidm. The NATS access service looks a person's groups up when a question names them by sub, phone or email and lists none. The sign-in asks for the phoneNumber scope and reads it from userinfo. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt	2026-09-30 13:28:28 +02:00