3 Commits

Include renames

Author	SHA1	Message	Date
Bendik Aagaard LynghaugandClaude Opus 5.5	cfb050d3ef	A slideshow across a page: pictures the full width of the screen, captions over them ... slideshow on a page: max_height in svh, slides with an image (a path in the content repo or https), a caption laid over the picture's foot, and optionally the picture's size so its place is held before it loads. Swiper upgrades it; before that it is a row that scrolls. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt	2026-09-30 17:16:50 +02:00
Bendik Aagaard LynghaugandClaude Fable 5.1	eeeb89b217	One access policy from content; onboarding into Kanidm as a form ... Who may do what to what was five checks in five files: `qualifies` on a page, `requires_group`/`public` on a resource, a desk's transition allow-list, a self_transition's email check, the automation token. They are now compiled from content on every load into one Cedar policy set (src/access.rs), and every server entry point asks it: open and submit a page, read a resource, move a record, fire a self transition, read a bucket as the automation service, extend an invite. Each decision names the rules that granted it; refusals and every mutation are published on portal.access.decided, and portal.access.<site>.may answers the same question for other apps over request-reply (proven live against uhhm's content). The policy validates against a fixed schema, so a content shape the compiler cannot express fails instead of granting nothing. Identity is still Kanidm's; the browser keeps is_qualified as a rendering hint only. `invite: {group}` on an alternative of a gated page onboards a person: src/people.rs creates the account, records the email, adds the group and mints a one-time credential link through Kanidm's REST API with a service-account token (KANIDM_API_TOKEN, in idm_people_on_boarding). The result is recorded with the answer into the runtime's portal_invites bucket and announced on portal.people.invited. Validated: an invite needs a gated page and required name and email fields. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH	2026-09-23 11:44:39 +02:00
Bendik Aagaard LynghaugandClaude Fable 5.1	f909657c14	content: split by concern, every path still content::x ... content.rs was 2,373 lines doing five jobs. It is now a directory: mod.rs keeps the types and the resolution rules (router, refs, reachability, build_questions) and the tests; gitea.rs loads from Gitea and watches for reload, through crate::http; validate.rs holds the checks a repo must pass; markdown.rs the inline markdown; handlers.rs the Axum routes. Each submodule is re-exported from content, so no caller changes. The loader module is server-only and gated as such. No behaviour change; 65 unit tests unchanged and green. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH	2026-09-22 16:51:15 +02:00