Release 0.3.46

An invite finds an existing account by its email and only adds it to
the group.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

CHANGELOG.md

@@ -4,6 +4,18 @@ One line per change, grouped by the release that shipped it. Newest
 first. A release is a Cargo.toml bump plus a `v<version>` tag; the
 content repos pin the tag they run (see the end of this file).
 
+## 0.3.46 (2026-09-23)
+
+- An invite first looks the email up in Kanidm (`/v1/raw/search` on `mail`, when the service account may read people: `idm_people_pii_read`) and only adds an existing account, under whatever username, to the group; no second account, no reset link.
+
+## 0.3.45 (2026-09-23)
+
+- A mail stream that cannot be created at boot (subjects owned by an older stream) is a warning, not a failed start; 0.3.44 took the kasse sites down for two minutes on the rename.
+
+## 0.3.44 (2026-09-23)
+
+- The mail stream is named `mail` (was `WORMHOLE`); gdo 0.1.2 matches. Delete the old stream on each NATS after upgrading both.
+
 ## 0.3.43 (2026-09-23)
 
 - Mail is content: `mail: { to, subject, body }` on a state in aggregates.yaml sends when a record enters that state (`to: submitter` or one address; `{field}`, `{site}`, `{chain}`, `{email}` in the templates), and an invite mails its one-time link built in; `site.yaml` gains `mail: { from, reply_to, invite }`. Portal renders and publishes on `portal.mail.send` in the `WORMHOLE` stream; uhhm/gdo delivers. The lint requires a required `email` field on every form recording into a bucket that mails the submitter.

Cargo.lock

@@ -3265,7 +3265,7 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.3.43"
+version = "0.3.46"
 dependencies = [
  "anyhow",
  "arc-swap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.3.43"
+version = "0.3.46"
 edition = "2021"
 
 [lib]

src/mail.rs

@@ -16,7 +16,7 @@ use std::time::Duration;
 
 /// The stream both sides create on boot, with the same config, so
 /// whichever starts first owns nothing the other lacks.
-pub const STREAM: &str = "WORMHOLE";
+pub const STREAM: &str = "mail";
 pub const SUBJECTS: &str = "portal.mail.>";
 pub const SUBJECT: &str = "portal.mail.send";
 /// Bumped when `Outgoing` changes shape; gdo refuses what it does not

src/main.rs

@@ -62,7 +62,12 @@ async fn main() -> anyhow::Result<()> {
     portal::events::store::ensure_stream(&jetstream).await?;
     // Outgoing mail waits here for gdo; a mail is never lost to gdo
     // being down, and never sent by portal itself.
-    portal::mail::ensure_stream(&jetstream).await?;
+    // Best-effort: a stream that already owns these subjects under an
+    // older name (a rename mid-upgrade) must not keep a site from
+    // booting; mail waits until the old stream is removed.
+    if let Err(e) = portal::mail::ensure_stream(&jetstream).await {
+        tracing::warn!("the mail stream could not be created: {e} - outgoing mail is off until a stream owns portal.mail.>");
+    }
 
     let oidc_state = Arc::new(oidc::Oidc::from_env().await?);
 

src/people.rs

@@ -44,6 +44,13 @@ fn person_lookup_found(status: u16, body: &str) -> Option<bool> {
     }
 }
 
+/// The first entry's `name` in a `/v1/raw/search` answer, which is
+/// `{"entries": [{"attrs": {"name": ["…"], …}}]}`.
+fn name_from_search(body: &str) -> Option<String> {
+    let v: serde_json::Value = serde_json::from_str(body).ok()?;
+    v.get("entries")?.as_array()?.first()?.get("attrs")?.get("name")?.as_array()?.first()?.as_str().map(str::to_string)
+}
+
 pub struct Kanidm {
     base: String,
     token: String,
@@ -77,11 +84,34 @@ impl Kanidm {
         person_lookup_found(status, &text).ok_or_else(|| anyhow::anyhow!("kanidm: looking up {username}: http {status}"))
     }
 
+    /// The account that already carries this email, if the token may
+    /// see it (the service account in `idm_people_pii_read`). None
+    /// when nobody has it, or when the search is not permitted: then
+    /// the username derived from the email decides, as before.
+    async fn find_by_mail(&self, email: &str) -> anyhow::Result<Option<String>> {
+        let (status, text) = self
+            .call(
+                openidconnect::reqwest::Method::POST,
+                "/v1/raw/search",
+                Some(serde_json::json!({ "filter": { "eq": ["mail", email.trim().to_lowercase()] } })),
+            )
+            .await?;
+        if !(200..300).contains(&status) {
+            tracing::warn!(status, "kanidm: searching people by mail is not permitted for this token; matching by username instead");
+            return Ok(None);
+        }
+        Ok(name_from_search(&text))
+    }
+
     /// The whole onboarding, in the order that leaves the least behind
-    /// if a step fails: create, then email, then group, then the link.
+    /// if a step fails: find or create, then email, then group, then
+    /// the link. A person who already has an account, under whatever
+    /// username, is only added to the group; their credentials are
+    /// left alone and no link is made.
     pub async fn invite(&self, name: &str, email: &str, group: &str) -> anyhow::Result<Invited> {
-        let username = username_for(email);
-        let created = if self.person_exists(&username).await? {
+        let existing = self.find_by_mail(email).await?;
+        let username = existing.clone().unwrap_or_else(|| username_for(email));
+        let created = if existing.is_some() || self.person_exists(&username).await? {
             false
         } else {
             let (status, text) = self
@@ -171,6 +201,14 @@ mod tests {
         assert_eq!(username_for("Ærlig@x.no"), "rlig");
     }
 
+    #[test]
+    fn a_search_by_mail_yields_the_accounts_own_name() {
+        assert_eq!(name_from_search(r#"{"entries":[{"attrs":{"name":["ole.n"],"mail":["ole@x.no"]}}]}"#), Some("ole.n".into()));
+        assert_eq!(name_from_search(r#"{"entries":[]}"#), None);
+        assert_eq!(name_from_search("null"), None);
+        assert_eq!(name_from_search("not json"), None);
+    }
+
     #[test]
     fn a_null_person_answer_means_nobody_there() {
         assert_eq!(person_lookup_found(200, "null"), Some(false));