4 Commits

Include renames

Author	SHA1	Message	Date
Bendik Aagaard LynghaugandClaude Fable 5.1	f047e21c4a	Memberships: groups kept by portal itself, a person by phone number first ... A membership is a case in the built-in portal_memberships bucket: invited by a desk, a grants, the seed or the responsible pass; active from the person's first sign-in, when the provider's subject, phone number or address matches the record; removed by a desk, and invited again after that. One record per group and person however it was keyed, and at sign-in every record that matched learns what the provider verified. The active memberships join the groups claim, so Cedar sees the same parents as before. PEOPLE_BACKEND picks Kanidm or memberships; unset, a KANIDM_API_TOKEN means Kanidm. The NATS access service looks a person's groups up when a question names them by sub, phone or email and lists none. The sign-in asks for the phoneNumber scope and reads it from userinfo. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt	2026-09-30 13:28:28 +02:00
Bendik Aagaard LynghaugandClaude Fable 5.1	014594283a	A group may hold a page's responsibility ... responsible: { name, contact, group } says the address is a group's inbox, not a person: no account or mail is made for it, and any signed-in member of the group gets the suggest-a-change card. A board's shared address was onboarded as a person before this. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt	2026-09-30 08:17:27 +02:00
Bendik Aagaard LynghaugandClaude Fable 5.1	ef4789f9b2	Invites and suggestions are cases; the responsible follow the content ... Five things the first cut of accounts-from-content left open. The first person and the responsible people are set up side by side, and both try again a minute apart: a seed that waited twenty minutes on Kanidm used to hold everyone else up, and a responsible person who failed waited for the next restart. The responsible are gone over again whenever the content changes. watch_for_reload publishes portal.content.reloaded once new content is in place, and seed.rs listens. Being responsible ends when the content stops saying so: someone no page names any more leaves RESPONSIBLE_GROUP in the same pass, if portal is who put them there (Invited.already_member). The account stays. An invite keeps itself current. portal_invites has an expired state; signing in closes a person's invites, a sweep moves the ones whose link ran out, and a desk's move from expired back to open makes a fresh link and mails it. Invites made at start are on file with the desks'. A suggested edit is a case in the built-in portal_edit_suggestions bucket, the person who made it is mailed at each move, and the card lists what they sent and where it stands. Found on the way, against Kanidm 1.11.2: a link's end comes as seconds since the epoch, which portal did not read, so invite mails said "until" and nothing; and a mail search answered with a 5xx was taken for a refusal. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt	2026-09-29 21:00:10 +02:00
Bendik Aagaard LynghaugandClaude Opus 5.5	0886869607	Accounts the content mandates, a seed for the first person, and edits suggested by who is responsible ... Every person a page names as responsible gets a Kanidm account at start if they have none, and a mail saying they are listed as responsible for asking that question, with the link to sign in; RESPONSIBLE_GROUP puts them in one group. SEED_ADMIN_EMAIL invites the first person into the most privileged group - the one whose desk may invite into the most - once. Signed in, a responsible person may suggest a change to their own pages; checked on the server, kept, published, and mailed to the site's inbox. Fixes an invite of someone new on a Kanidm with only the onboarding account: the person is created with their address in one call, since idm_people_on_boarding may create but not modify (it answered 403). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt	2026-09-29 15:44:20 +02:00