Release 0.5.9

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

CHANGELOG.md

@@ -4,6 +4,14 @@ One line per change, grouped by the release that shipped it. Newest
 first. A release is a Cargo.toml bump plus a `v<version>` tag; the
 content repos pin the tag they run (see the end of this file).
 
+## 0.5.9 (2026-09-30)
+
+- With memberships as the people backend and a Kanidm token still set, an invite makes the Kanidm account as well (no group, the one-time link in the mail): Kanidm makes people, portal makes members, and a site can switch to memberships before its sign-in provider is one everyone already has.
+
+## 0.5.8 (2026-09-30)
+
+- Fixed: 0.5.7 asked every provider for the `phoneNumber` scope, and Kanidm denies a sign-in that asks for a scope the person does not hold, so nobody could sign in. The scope is asked for only with `OIDC_EXTRA_SCOPES=phoneNumber` (Vipps). 0.5.7 must not be deployed on a Kanidm site.
+
 ## 0.5.7 (2026-09-30)
 
 - Memberships: groups kept by portal itself (`src/memberships.rs`, `docs/memberships.md`). A membership is a case in the built-in `portal_memberships` bucket - `invited` by a desk, a `grants`, the seed or the responsible pass; `active` from the person's first sign-in, when the provider's subject, phone number or address matches; `removed` by a desk. A person is their phone number first (`+4791234567`, `PHONE_COUNTRY` for bare numbers), their address second, the provider's subject third, and one record per group and person however it was keyed. At sign-in the active memberships join the `groups` claim, so Cedar sees the same parents as before. `PEOPLE_BACKEND=memberships` switches a site; unset, a `KANIDM_API_TOKEN` means Kanidm and no token means memberships. `SEED_ADMIN_PHONE` seeds by number. The sign-in asks for the `phoneNumber` scope and reads `phone_number` from userinfo.
@@ -388,4 +396,4 @@ hosts now, since kasse's runner deploys its own instances.
 | redoal.com | ergo | `app@redoal-portal` | v0.5.2 |
 | westra.klingenbergbygg.no | kasse | `app@westra-portal` | v0.5.2 |
 | portal.klingenbergbygg.no | kasse | `app@klingenberg-portal` | v0.5.2 |
-| vel.klingenbergbygg.no | kasse | `tomtervel-portal-1` (podman, tomtervel/infrastructure) | v0.5.6 |
+| vel.klingenbergbygg.no | kasse | `tomtervel-portal-1` (podman, tomtervel/infrastructure) | v0.5.8 |

Cargo.lock

@@ -3357,7 +3357,7 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.5.7"
+version = "0.5.9"
 dependencies = [
  "anyhow",
  "arc-swap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.5.7"
+version = "0.5.9"
 edition = "2021"
 
 [lib]

docs/memberships.md

@@ -64,10 +64,11 @@ Unset, a `KANIDM_API_TOKEN` means Kanidm and no token means
 memberships. With memberships:
 
 - A desk invite writes an `invited` record and mails "log in at the
-  site, and your place is there". No account is made: the provider
+  site, and your place is there". The provider makes people, portal
-  makes people, portal makes members. So the provider has to be one
+  makes members: with Vipps Login everyone can already sign in. A
-  everyone can already sign in to, which is what Vipps Login is for a
+  Kanidm still configured beside memberships (`KANIDM_API_TOKEN`)
-  Norwegian association, and what Kanidm is not.
+  makes the account too, with no group and the one-time link in the
+  mail, so a site can switch to memberships before its provider does.
 - `grants` writes a record for the person the case is about, from the
   form's name and phone number or address.
 - `SEED_ADMIN_PHONE` or `SEED_ADMIN_EMAIL` writes the first person's.
@@ -76,9 +77,10 @@ memberships. With memberships:
 - The `groups` claim, if the provider sends one, still counts: a
   person's groups are the union.
 
-The sign-in flow asks for the `phoneNumber` scope and reads
+With `OIDC_EXTRA_SCOPES=phoneNumber` the sign-in asks the provider for
-`phone_number` from userinfo; a provider without either gives nothing,
+the number and reads `phone_number` from userinfo. Set it for Vipps;
-and matching falls back to the address.
+not for Kanidm, which denies a sign-in that asks for a scope the
+person does not hold. Without it, matching falls back to the address.
 
 ## Asking who belongs
 

docs/operations.md

@@ -72,6 +72,7 @@ values.
 | `PEOPLE_BACKEND` | `kanidm` or `memberships` (see [Memberships](memberships.md)); unset, Kanidm when `KANIDM_API_TOKEN` is set, memberships otherwise |
 | `KANIDM_API_TOKEN` | invites and `grants:` through Kanidm |
 | `PHONE_COUNTRY` | the calling code a bare phone number gets, `+47` unless set |
+| `OIDC_EXTRA_SCOPES` | scopes to ask the provider for besides `openid profile email`: `phoneNumber` for Vipps. Not for Kanidm, which denies a sign-in that asks for a scope the person does not hold |
 | `SEED_ADMIN_EMAIL` or `SEED_ADMIN_PHONE`, `SEED_ADMIN_NAME`, `SEED_GROUP` | the first person in, invited once at start into the most privileged group (or `SEED_GROUP`) |
 | `RESPONSIBLE_GROUP` | the group every person a page names as `responsible` joins, at start and whenever the content changes, and leaves when no page names them any more; they get an account either way |
 | `PUBLIC_URL`, `SITE_NAME` | what the site calls itself in links and mail |

src/people.rs

@@ -61,7 +61,25 @@ impl People {
                 let email = who.email.as_deref().ok_or_else(|| anyhow::anyhow!("Kanidm knows people by their address, and this one has none"))?;
                 kanidm.invite(name, email, group).await
             }
-            People::Memberships => crate::memberships::grant(state, group, name, who, by).await,
+            People::Memberships => {
+                let mut invited = crate::memberships::grant(state, group, name, who, by).await?;
+                // A Kanidm beside memberships makes the person, not the
+                // member: an account with no group, and the one-time
+                // link, so someone invited by address can sign in
+                // before the provider is one everyone already has.
+                if let (Some(kanidm), Some(email)) = (Kanidm::from_env(), who.email.as_deref()) {
+                    match kanidm.account(name, email).await {
+                        Ok(account) => {
+                            invited.username = account.username;
+                            invited.reset_link = account.reset_link;
+                            invited.link_expires_ms = account.link_expires_ms;
+                            invited.created = account.created;
+                        }
+                        Err(e) => tracing::warn!(group, %email, "the membership is on file, but no Kanidm account could be made: {e}"),
+                    }
+                }
+                Ok(invited)
+            }
         }
     }
 

src/server/oidc.rs

@@ -149,7 +149,7 @@ pub async fn login(
     let oidc = state.oidc.configured()?;
     let (pkce_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();
 
-    let (auth_url, csrf_state, nonce) = oidc
+    let mut request = oidc
         .client
         .authorize_url(
             CoreAuthenticationFlow::AuthorizationCode,
@@ -159,11 +159,14 @@ pub async fn login(
         .add_scope(Scope::new("openid".to_string()))
         .add_scope(Scope::new("profile".to_string()))
         .add_scope(Scope::new("email".to_string()))
-        // A provider that verifies phone numbers (Vipps) gives one for
+        .set_pkce_challenge(pkce_challenge);
-        // this scope; Kanidm ignores a scope it does not know.
+    // What else to ask the provider for: `phoneNumber` for one that
-        .add_scope(Scope::new("phoneNumber".to_string()))
+    // verifies numbers (Vipps). Only when asked, because Kanidm denies
-        .set_pkce_challenge(pkce_challenge)
+    // a sign-in that requests a scope the person does not hold.
-        .url();
+    for scope in std::env::var("OIDC_EXTRA_SCOPES").unwrap_or_default().split_whitespace() {
+        request = request.add_scope(Scope::new(scope.to_string()));
+    }
+    let (auth_url, csrf_state, nonce) = request.url();
 
     session
         .insert(PKCE_KEY, pkce_verifier.secret())