Release 0.6.2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

CHANGELOG.md

@@ -4,6 +4,15 @@ One line per change, grouped by the release that shipped it. Newest
 first. A release is a Cargo.toml bump plus a `v<version>` tag; the
 content repos pin the tag they run (see the end of this file).
 
+## 0.6.2 (2026-09-30)
+
+- The header knows who is here: on a site with sign-in, a link top right to sign in, or the person's name and the way out. A page with a `slideshow` gets the wordmark as a bar of its own, the strip full width under it, and the question after.
+- "My cases": `where: { field: email, equals: "{user.email}" }` lists the records that carry the signed-in person's own address, filled from the session and never from the caller; nobody signed in matches nothing. An attachment is fetched only through a list that shows its record, so a list of my cases opens my files and nobody else's.
+- A stored file on a listed record shows as the name it was sent with and opens from the row, for whoever the list shows the record to. It used to show as its storage key, a string nobody could open.
+- Form controls scale with the text around them (em, not rem): fields, pills, buttons and labels follow a site's body size. The date picker's calendar icon is the size of the text beside it, and the file picker's button takes the field's colours instead of the browser's.
+- `KANIDM_GROUP_PREFIX`: a site on a Kanidm it shares with others keeps plain group names in its content; the prefix is put on when portal adds or removes a member, and the client's claim map takes it off.
+- Fixed: `maps` never reached the browser (`serde(skip)`), so a page with a map drew it on the server and dropped it on hydration.
+
 ## 0.6.1 (2026-09-30)
 
 - Trainer: `documents` in a plan. A text the site carries word for word (bylaws, terms) becomes a page of its own where every section is one alternative: its heading the card's, its paragraphs the card's words, from a markdown file beside the plan. No model touches it.

Cargo.lock

@@ -3357,7 +3357,7 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.6.1"
+version = "0.6.2"
 dependencies = [
  "anyhow",
  "arc-swap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.6.1"
+version = "0.6.2"
 edition = "2021"
 
 [lib]

docs/content-reference.md

@@ -263,6 +263,10 @@ A spec with neither `public: true` nor `requires_group` is
 unreachable: reads fail closed, and mutations always need a group
 whatever `public` says.
 
+`where: { field: email, equals: "{user.email}" }` is "my cases": the
+records carrying the signed-in person's own address, read from the
+session. A file on such a record is theirs alone to open.
+
 `states` and `where` narrow a listing. They matter most for a register
 that is public by law — public about what was decided, not about what
 was withdrawn — while the desk working the same bucket is a different

docs/operations.md

@@ -71,6 +71,7 @@ values.
 | `KANIDM_URL`, `OAUTH2_CLIENT_ID`, `OAUTH2_CLIENT_SECRET` | sign-in |
 | `PEOPLE_BACKEND` | `kanidm` or `memberships` (see [Memberships](memberships.md)); unset, Kanidm when `KANIDM_API_TOKEN` is set, memberships otherwise |
 | `KANIDM_API_TOKEN` | invites and `grants:` through Kanidm |
+| `KANIDM_GROUP_PREFIX` | for a Kanidm shared with other sites: the content's `kunder` is the group `<prefix>kunder` there, and the OAuth2 client's claim map gives it back to portal as `kunder` |
 | `PHONE_COUNTRY` | the calling code a bare phone number gets, `+47` unless set |
 | `OIDC_EXTRA_SCOPES` | scopes to ask the provider for besides `openid profile email`: `phoneNumber` for Vipps. Not for Kanidm, which denies a sign-in that asks for a scope the person does not hold |
 | `SEED_ADMIN_EMAIL` or `SEED_ADMIN_PHONE`, `SEED_ADMIN_NAME`, `SEED_GROUP` | the first person in, invited once at start into the most privileged group (or `SEED_GROUP`) |

src/app.rs

@@ -396,61 +396,9 @@ fn QuestionView(
             landing=question_id == "/"
             site=site.clone()
             current_id=question_id.clone()
+            user=user.clone()
+            slideshow=question.slideshow.clone()
         />
-        // Pictures across the page: the full width of the screen, each
-        // as wide as its own shape at the strip's height, the caption
-        // laid over its foot. Inert until the Swiper bundle upgrades
-        // the elements; without it, a row that scrolls sideways.
-        {question
-            .slideshow
-            .clone()
-            .map(|show| {
-                let height = format!("--slideshow-height: {}svh", show.max_height);
-                view! {
-                    // In the page itself, so the strip works from the
-                    // server's HTML alone; the head's copy above covers
-                    // arriving here by a link within the site.
-                    <script src="/swiper-element-bundle.min.js" defer=true></script>
-                    <swiper-container
-                        class="slideshow"
-                        style=height
-                        slides-per-view="auto"
-                        space-between="6"
-                        grab-cursor="true"
-                        free-mode="true"
-                        mousewheel-force-to-axis="true"
-                        keyboard="true"
-                        navigation="true"
-                    >
-                        <For
-                            each={move || show.slides.clone().into_iter().enumerate().collect::<Vec<_>>()}
-                            key=|(_, slide)| slide.image.clone()
-                            children=|(n, slide): (usize, crate::content::Slide)| {
-                                let caption = slide.caption.clone();
-                                // The first screenful loads with the
-                                // page; the rest when swiped to.
-                                let loading = if n < 4 { "eager" } else { "lazy" };
-                                view! {
-                                    <swiper-slide>
-                                        <figure class="slide">
-                                            <img
-                                                src=slide.src()
-                                                alt=slide.caption.clone()
-                                                width=slide.width.map(|w| w.to_string())
-                                                height=slide.height.map(|h| h.to_string())
-                                                loading=loading
-                                                decoding="async"
-                                            />
-                                            {(!caption.trim().is_empty()).then(|| view! { <figcaption>{caption}</figcaption> })}
-                                        </figure>
-                                    </swiper-slide>
-                                }
-                                .into_any()
-                            }
-                        />
-                    </swiper-container>
-                }
-            })}
         // A page that is about somewhere says where, under the
         // question: a still from this origin, and the place in words
         // for anyone who cannot see it.
@@ -895,7 +843,15 @@ mod gesture {
 }
 
 #[component]
-fn Hero(title: String, description: String, landing: bool, site: SiteConfig, current_id: String) -> impl IntoView {
+fn Hero(
+    title: String,
+    description: String,
+    landing: bool,
+    site: SiteConfig,
+    current_id: String,
+    #[prop(optional_no_strip)] user: Option<User>,
+    #[prop(optional_no_strip)] slideshow: Option<crate::content::Slideshow>,
+) -> impl IntoView {
     // Only the landing page gets a piece - it's the one page a hero is
     // actually "the" hero for; every other page gets the plain header.
     // WHAT the piece is belongs to the content repo: site.yaml's
@@ -994,9 +950,37 @@ fn Hero(title: String, description: String, landing: bool, site: SiteConfig, cur
         )
     });
 
+    // Who is here, and the way in or out, at the top of every page of
+    // a site that has sign-in at all.
+    let session = site.sign_in.then(|| {
+        let redirect = current_id.clone();
+        match user {
+            Some(user) => view! {
+                <nav class="session">
+                    <span class="session-name">{user.display_name}</span>
+                    <a href="/auth/logout" rel="external">{move || t(&lang().get(), "sign_out")}</a>
+                </nav>
+            }
+            .into_any(),
+            None => view! {
+                <nav class="session">
+                    <a href=format!("/auth/login?redirect={redirect}") rel="external">{move || t(&lang().get(), "sign_in")}</a>
+                </nav>
+            }
+            .into_any(),
+        }
+    });
+    let has_slides = slideshow.is_some();
+    let mark = move || view! {
+        <a class="wordmark" class:wordmark-house=house_wordmark href="/">
+            <img src=wordmark.clone() alt=site_title.clone() style=wordmark_style.clone()/>
+        </a>
+    };
+
     view! {
-        <header class="hero" class:hero-module=has_module>
+        <header class="hero" class:hero-module=has_module class:hero-slides=has_slides>
             <Announcements current_id=current_id/>
+            {session}
             {has_module
                 .then(|| {
                     view! {
@@ -1004,10 +988,13 @@ fn Hero(title: String, description: String, landing: bool, site: SiteConfig, cur
                         <script type="module" inner_html=early_script.unwrap_or_default()></script>
                     }
                 })}
+            // With pictures, the wordmark is a bar of its own above
+            // them and the question comes under; without, the wordmark
+            // heads the copy as it always has.
+            {has_slides.then(|| view! { <div class="hero-bar">{mark()}</div> })}
+            {slideshow.map(|show| view! { <SlideStrip show=show/> })}
             <div class="hero-copy">
-                <a class="wordmark" class:wordmark-house=house_wordmark href="/">
-                    <img src=wordmark alt=site_title style=wordmark_style/>
-                </a>
+                {(!has_slides).then(|| mark())}
                 <h1>{title}</h1>
                 <p inner_html=render_inline_markdown(&description)></p>
             </div>
@@ -1015,6 +1002,59 @@ fn Hero(title: String, description: String, landing: bool, site: SiteConfig, cur
     }
 }
 
+/// Pictures across the page (`slideshow`): the full width of the
+/// screen, each picture as wide as its own shape at the strip's height,
+/// the caption laid over its foot. Inert until the Swiper bundle
+/// upgrades the elements; without it, a row that scrolls sideways.
+#[component]
+fn SlideStrip(show: crate::content::Slideshow) -> impl IntoView {
+    let height = format!("--slideshow-height: {}svh", show.max_height);
+    view! {
+                    // In the page itself, so the strip works from the
+                    // server's HTML alone; the head's copy above covers
+                    // arriving here by a link within the site.
+                    <script src="/swiper-element-bundle.min.js" defer=true></script>
+                    <swiper-container
+                        class="slideshow"
+                        style=height
+                        slides-per-view="auto"
+                        space-between="6"
+                        grab-cursor="true"
+                        free-mode="true"
+                        mousewheel-force-to-axis="true"
+                        keyboard="true"
+                        navigation="true"
+                    >
+                        <For
+                            each={move || show.slides.clone().into_iter().enumerate().collect::<Vec<_>>()}
+                            key=|(_, slide)| slide.image.clone()
+                            children=|(n, slide): (usize, crate::content::Slide)| {
+                                let caption = slide.caption.clone();
+                                // The first screenful loads with the
+                                // page; the rest when swiped to.
+                                let loading = if n < 4 { "eager" } else { "lazy" };
+                                view! {
+                                    <swiper-slide>
+                                        <figure class="slide">
+                                            <img
+                                                src=slide.src()
+                                                alt=slide.caption.clone()
+                                                width=slide.width.map(|w| w.to_string())
+                                                height=slide.height.map(|h| h.to_string())
+                                                loading=loading
+                                                decoding="async"
+                                            />
+                                            {(!caption.trim().is_empty()).then(|| view! { <figcaption>{caption}</figcaption> })}
+                                        </figure>
+                                    </swiper-slide>
+                                }
+                                .into_any()
+                            }
+                        />
+                    </swiper-container>
+    }
+}
+
 /// An alternative's banner imagery: nothing, a plain image, or - for
 /// several urls - a Swiper Element card deck. The `swiper-container`/
 /// `swiper-slide` custom elements render inert server-side and upgrade
@@ -1360,6 +1400,7 @@ fn AlternativeCard(
                                                 feature_name=feature_name.clone()
                                                 transitions=spec.transitions.clone()
                                                 link=spec.link.clone()
+                                                bucket=spec.bucket().map(str::to_string)
                                                 empty=spec.empty.clone()
                                                 pending_transitions=pending_transitions
                                                 transition_batch=transition_batch
@@ -1813,6 +1854,7 @@ fn ResourceFeature(
     feature_name: String,
     transitions: Vec<Transition>,
     link: Option<RowLink>,
+    bucket: Option<String>,
     empty: Option<String>,
     pending_transitions: RwSignal<std::collections::HashMap<(String, String), String>>,
     transition_batch: ServerAction<TransitionAnswers>,
@@ -1848,6 +1890,7 @@ fn ResourceFeature(
                     let feature_name = feature_name.clone();
                     let transitions = transitions.clone();
                     let link = link.clone();
+                    let bucket = bucket.clone();
                     let empty = empty.clone().unwrap_or_else(|| t(&lang().get(), "nothing_here_yet").to_string());
                     data.get()
                         .map(|res| match res {
@@ -1857,6 +1900,7 @@ fn ResourceFeature(
                                         feature_name=feature_name
                                         transitions=transitions
                                         link=link
+                                        bucket=bucket
                                         empty=empty
                                         value=value
                                         pending_transitions=pending_transitions
@@ -1885,6 +1929,7 @@ fn ResourceValue(
     feature_name: String,
     transitions: Vec<Transition>,
     link: Option<RowLink>,
+    bucket: Option<String>,
     empty: String,
     value: serde_json::Value,
     pending_transitions: RwSignal<std::collections::HashMap<(String, String), String>>,
@@ -1917,12 +1962,14 @@ fn ResourceValue(
                             let feature_name = feature_name.clone();
                             let transitions = transitions.clone();
                             let link = link.clone();
+                            let bucket = bucket.clone();
                             move |answer: Answer| {
                                 view! {
                                     <AnswerRow
                                         feature_name=feature_name.clone()
                                         transitions=transitions.clone()
                                         link=link.clone()
+                                        bucket=bucket.clone()
                                         answer=answer
                                         pending_transitions=pending_transitions
                                         transition_batch=transition_batch
@@ -2177,11 +2224,20 @@ fn SelectField(
     }
 }
 
+/// The file's own name, if a field's value is an upload's key: a
+/// uuid, a dash, and the name it was sent with (`upload.rs`).
+pub fn uploaded_filename(value: &str) -> Option<&str> {
+    let (id, rest) = value.split_at_checked(36)?;
+    let shaped = id.char_indices().all(|(i, c)| if matches!(i, 8 | 13 | 18 | 23) { c == '-' } else { c.is_ascii_hexdigit() });
+    rest.strip_prefix('-').filter(|name| shaped && !name.is_empty())
+}
+
 #[component]
 fn AnswerRow(
     feature_name: String,
     transitions: Vec<Transition>,
     link: Option<RowLink>,
+    bucket: Option<String>,
     answer: Answer,
     pending_transitions: RwSignal<std::collections::HashMap<(String, String), String>>,
     transition_batch: ServerAction<TransitionAnswers>,
@@ -2215,6 +2271,9 @@ fn AnswerRow(
     let item_id = answer.id.clone();
     let key = (feature_name.clone(), item_id.clone());
     let link = link.map(|l| (l.href(&answer.id, &answer.responses), l.label));
+    // Where a stored file on this record is fetched from: the record
+    // names it, never the key (see `upload::attachment`).
+    let attachment_base = bucket.map(|b| format!("/attachment/{b}/{}", answer.id));
 
     view! {
         <article class="answer-row" class:decided=move || decided>
@@ -2248,6 +2307,17 @@ fn AnswerRow(
                                 .into_any();
                         }
                         let text = value.as_str().map(str::to_string).unwrap_or_else(|| value.to_string());
+                        // A stored file shows as its name, and opens.
+                        if let (Some(base), Some(filename)) = (attachment_base.clone(), uploaded_filename(&text)) {
+                            let href = format!("{base}/{key}");
+                            return view! {
+                                <div class="answer-field">
+                                    <span class="answer-field-key">{key}</span>
+                                    <a class="answer-field-value answer-file" href=href rel="external">{filename.to_string()}</a>
+                                </div>
+                            }
+                            .into_any();
+                        }
                         view! {
                             <div class="answer-field">
                                 <span class="answer-field-key">{key}</span>
@@ -2461,6 +2531,7 @@ pub async fn get_site() -> Result<SiteConfig, ServerFnError> {
     // own configuration, and the browser has to know before it decides
     // whether to draw a map or ask for two numbers.
     site.maps = crate::maps::enabled();
+    site.sign_in = state.oidc.enabled();
     Ok(site)
 }
 
@@ -2987,6 +3058,14 @@ mod responsible_tests {
         Responsible { name: "R".into(), contact: contact.into(), group: group.map(String::from) }
     }
 
+    #[test]
+    fn an_uploads_key_shows_as_the_name_it_was_sent_with() {
+        assert_eq!(super::uploaded_filename("3f2b8c1e-9a4d-4e7b-8c21-0a1b2c3d4e5f-rapport 2026.pdf"), Some("rapport 2026.pdf"));
+        assert_eq!(super::uploaded_filename("rapport.pdf"), None);
+        assert_eq!(super::uploaded_filename("3f2b8c1e-9a4d-4e7b-8c21-0a1b2c3d4e5f-"), None);
+        assert_eq!(super::uploaded_filename("Storgata 1, 1850 Mysen - se vedlegg i e-post fra oss"), None);
+    }
+
     #[test]
     fn only_the_person_a_page_names_may_suggest_a_change_to_it() {
         assert!(is_responsible(Some(&user(Some("kari@vel.no"), &[])), &named("mailto:Kari@Vel.no", None)));

src/content/mod.rs

@@ -779,8 +779,13 @@ pub struct SiteConfig {
     /// the way to the browser (see `get_site`), never from content, so
     /// a `type: location` field knows whether to offer a map or two
     /// number inputs.
-    #[serde(skip)]
+    #[serde(default)]
     pub maps: bool,
+    /// Whether this instance has sign-in at all (a provider is
+    /// configured): set on the way to the browser like `maps`, so the
+    /// header knows whether to offer it.
+    #[serde(default)]
+    pub sign_in: bool,
     /// Who this site's mail comes from. Absent means the site sends
     /// nothing: a state's `mail:` and the invite mail are logged and
     /// skipped, never half-sent (see `mail.rs`).

src/i18n.rs

@@ -22,6 +22,7 @@ fn lookup(lang: &str, key: &str) -> Option<&'static str> {
         ("en", "if_stuck") => " if you get stuck.",
         ("en", "send") => "Send",
         ("en", "sign_in") => "Sign in",
+        ("en", "sign_out") => "Sign out",
         ("en", "nothing_here_yet") => "Nothing here yet.",
         ("en", "nothing_here") => "Nothing here",
         ("en", "back_to_start") => "back to the start",
@@ -51,6 +52,7 @@ fn lookup(lang: &str, key: &str) -> Option<&'static str> {
         ("no", "if_stuck") => " om du står fast.",
         ("no", "send") => "Send",
         ("no", "sign_in") => "Logg inn",
+        ("no", "sign_out") => "Logg ut",
         ("no", "nothing_here_yet") => "Ingenting her ennå.",
         ("no", "nothing_here") => "Ingenting her",
         ("no", "back_to_start") => "tilbake til start",
@@ -98,6 +100,7 @@ mod tests {
             "if_stuck",
             "send",
             "sign_in",
+            "sign_out",
             "nothing_here_yet",
             "nothing_here",
             "back_to_start",

src/people.rs

@@ -184,6 +184,12 @@ fn name_from_search(body: &str) -> Option<String> {
 pub struct Kanidm {
     base: String,
     token: String,
+    /// What this site's groups are called in a Kanidm it shares with
+    /// other sites: `KANIDM_GROUP_PREFIX=klingenberg_` makes the
+    /// content's `kunder` the group `klingenberg_kunder` there. The
+    /// OAuth2 client's claim map takes the prefix off again, so content
+    /// and policy never see it. Empty for a Kanidm of the site's own.
+    group_prefix: String,
 }
 
 impl Kanidm {
@@ -192,7 +198,8 @@ impl Kanidm {
     pub fn from_env() -> Option<Self> {
         let base = std::env::var("KANIDM_URL").ok()?.trim_end_matches('/').to_string();
         let token = std::env::var("KANIDM_API_TOKEN").ok().filter(|t| !t.is_empty())?;
-        Some(Kanidm { base, token })
+        let group_prefix = std::env::var("KANIDM_GROUP_PREFIX").unwrap_or_default().trim().to_string();
+        Some(Kanidm { base, token, group_prefix })
     }
 
     async fn call(&self, method: openidconnect::reqwest::Method, path: &str, body: Option<serde_json::Value>) -> anyhow::Result<(u16, String)> {
@@ -262,7 +269,7 @@ impl Kanidm {
 
     /// Who is in a group, by account name.
     pub async fn members(&self, group: &str) -> anyhow::Result<Vec<String>> {
-        let (status, text) = self.call(openidconnect::reqwest::Method::GET, &format!("/v1/group/{group}/_attr/member"), None).await?;
+        let (status, text) = self.call(openidconnect::reqwest::Method::GET, &format!("/v1/group/{}{group}/_attr/member", self.group_prefix), None).await?;
         if !(200..300).contains(&status) {
             anyhow::bail!("kanidm: reading the members of {group}: http {status}: {text}");
         }
@@ -273,7 +280,7 @@ impl Kanidm {
     /// service account manages, like adding them was.
     pub async fn remove_member(&self, group: &str, username: &str) -> anyhow::Result<()> {
         let (status, text) = self
-            .call(openidconnect::reqwest::Method::DELETE, &format!("/v1/group/{group}/_attr/member"), Some(serde_json::json!([username])))
+            .call(openidconnect::reqwest::Method::DELETE, &format!("/v1/group/{}{group}/_attr/member", self.group_prefix), Some(serde_json::json!([username])))
             .await?;
         if !(200..300).contains(&status) {
             anyhow::bail!("kanidm: removing {username} from {group}: http {status}: {text}");
@@ -340,7 +347,7 @@ impl Kanidm {
             // tidying up after itself.
             already_member = !created && self.members(group).await.is_ok_and(|m| m.contains(&username));
             let (status, text) = self
-                .call(openidconnect::reqwest::Method::POST, &format!("/v1/group/{group}/_attr/member"), Some(serde_json::json!([username])))
+                .call(openidconnect::reqwest::Method::POST, &format!("/v1/group/{}{group}/_attr/member", self.group_prefix), Some(serde_json::json!([username])))
                 .await?;
             if !(200..300).contains(&status) {
                 anyhow::bail!("kanidm: adding {username} to {group}: http {status}: {text}");

src/resource.rs

@@ -39,7 +39,7 @@ pub async fn get_resource(
         .as_ref()
         .ok_or_else(|| ServerFnError::new("feature has no resource"))?;
     authorize_resource(&state, &question_id, &alternative, &feature_name).await?;
-    fetch_resource_value(&state, resource, &params).await
+    fetch_resource_value(&state, resource, &as_the_person_asking(params).await).await
 }
 
 /// The `Requirement.resource`-backed counterpart to `get_resource` -
@@ -83,7 +83,7 @@ pub async fn get_requirement_options(
         .as_ref()
         .ok_or_else(|| ServerFnError::new("requirement has no resource"))?;
     authorize_resource(&state, &question_id, &alternative, &format!("{feature_name}|{requirement_name}")).await?;
-    fetch_resource_value(&state, resource, &params).await
+    fetch_resource_value(&state, resource, &as_the_person_asking(params).await).await
 }
 
 /// The `Requirement.bind`-backed counterpart to
@@ -114,7 +114,7 @@ pub async fn get_requirement_binding(
         .as_ref()
         .ok_or_else(|| ServerFnError::new("requirement has no binding"))?;
     authorize_resource(&state, &question_id, &alternative, &format!("{feature_name}|{requirement_name}|bind")).await?;
-    fetch_resource_value(&state, &bind.resource, &params).await
+    fetch_resource_value(&state, &bind.resource, &as_the_person_asking(params).await).await
 }
 
 /// Scoped to the named alternative first, not flattened across all of
@@ -211,8 +211,12 @@ fn shows_state(resource: &crate::content::ResourceSpec, value: &serde_json::Valu
 /// stamped on it. A missing field never matches: "everything that did
 /// not say" is not something a page should be able to ask for by
 /// accident.
+///
+/// `equals: "{user.email}"` is the signed-in person's own address: a
+/// list of "my cases". It is filled from the session, never from the
+/// caller, and with nobody signed in it matches nothing.
 #[cfg(feature = "ssr")]
-fn matches_filter(
+pub(crate) fn matches_filter(
     resource: &crate::content::ResourceSpec,
     value: &serde_json::Value,
     params: &std::collections::HashMap<String, String>,
@@ -220,19 +224,54 @@ fn matches_filter(
     let Some(filter) = &resource.filter else {
         return true;
     };
-    let wanted = crate::content::template_action(&filter.equals, &serde_json::json!(params))
-        .unwrap_or_else(|| filter.equals.clone());
+    let equals = if filter.equals.contains("{user.email}") {
+        match params.get(USER_EMAIL).filter(|e| !e.is_empty()) {
+            Some(email) => filter.equals.replace("{user.email}", email),
+            None => return false,
+        }
+    } else {
+        filter.equals.clone()
+    };
+    let wanted = crate::content::template_action(&equals, &serde_json::json!(params)).unwrap_or(equals);
+    // Addresses compare without case; everything else as written.
+    let same = |found: &str| if filter.equals.contains("{user.email}") { found.trim().eq_ignore_ascii_case(&wanted) } else { found == wanted };
     let found = value
         .get("responses")
         .and_then(|r| r.get(&filter.field))
         .or_else(|| value.get(&filter.field));
     match found {
-        Some(serde_json::Value::String(s)) => s == &wanted,
-        Some(other) => other.to_string() == wanted,
+        Some(serde_json::Value::String(s)) => same(s),
+        Some(other) => same(&other.to_string()),
         None => false,
     }
 }
 
+/// The parameter a `where` reads the signed-in person's address from.
+/// Set by the server from the session; a caller's own is thrown away.
+#[cfg(feature = "ssr")]
+pub(crate) const USER_EMAIL: &str = "__user_email";
+
+/// The caller's parameters with the session's person put in and
+/// anything pretending to be them taken out.
+#[cfg(feature = "ssr")]
+pub(crate) fn with_person(mut params: std::collections::HashMap<String, String>, user: Option<&crate::auth::User>) -> std::collections::HashMap<String, String> {
+    params.retain(|k, _| !k.starts_with("__"));
+    if let Some(email) = user.and_then(|u| u.email.as_deref()).filter(|e| !e.trim().is_empty()) {
+        params.insert(USER_EMAIL.to_string(), email.trim().to_lowercase());
+    }
+    params
+}
+
+#[cfg(feature = "ssr")]
+async fn as_the_person_asking(params: std::collections::HashMap<String, String>) -> std::collections::HashMap<String, String> {
+    use crate::auth::{User, SESSION_USER_KEY};
+    let user = match leptos_axum::extract::<tower_sessions::Session>().await {
+        Ok(session) => session.get::<User>(SESSION_USER_KEY).await.ok().flatten(),
+        Err(_) => None,
+    };
+    with_person(params, user.as_ref())
+}
+
 #[cfg(feature = "ssr")]
 async fn fetch_resource_value(
     state: &crate::server::AppState,
@@ -559,6 +598,18 @@ mod tests {
         assert!(!matches_filter(&children, &theirs, &params));
         // A record that did not say is not everyone's child.
         assert!(!matches_filter(&children, &neither, &params));
+
+        // "My cases": the session's address, never the caller's.
+        let own = spec("source: { kind: kv, bucket: cases }\nrequires_group: customers\nwhere: { field: email, equals: \"{user.email}\" }\n");
+        let hers = serde_json::json!({ "responses": { "email": "Kari@Vel.no" } });
+        let his = serde_json::json!({ "responses": { "email": "ola@vel.no" } });
+        let kari = crate::auth::User { sub: "s".into(), username: "kari".into(), display_name: "Kari".into(), groups: vec![], phone: None, email: Some("kari@vel.no".into()) };
+        let forged: std::collections::HashMap<String, String> = [(USER_EMAIL.to_string(), "ola@vel.no".to_string())].into_iter().collect();
+        let asked = with_person(forged.clone(), Some(&kari));
+        assert!(matches_filter(&own, &hers, &asked) && !matches_filter(&own, &his, &asked));
+        // Nobody signed in: the forged parameter is dropped, and nothing matches.
+        let anonymous = with_person(forged, None);
+        assert!(!matches_filter(&own, &hers, &anonymous) && !matches_filter(&own, &his, &anonymous));
         // No filter, no narrowing: every resource written before this
         // existed still lists its whole bucket.
         let plain = spec("source: { kind: kv, bucket: objections }\npublic: true\n");

src/server/oidc.rs

@@ -50,6 +50,11 @@ const NONCE_KEY: &str = "oidc_nonce";
 const REDIRECT_KEY: &str = "oidc_post_login_redirect";
 
 impl Oidc {
+    /// Whether a provider is configured.
+    pub fn enabled(&self) -> bool {
+        self.inner.is_some()
+    }
+
     /// Sign-in disabled: what a content-only instance has, and what a
     /// test builds an `AppState` with.
     pub fn disabled() -> Self {

src/trainer/build.rs

@@ -343,6 +343,14 @@ pub struct PlanNeed {
     /// Groups that see these cases on their desk and move nothing.
     #[serde(default)]
     pub watched_by: Vec<String>,
+    /// Groups whose members each see *their own* cases and nobody
+    /// else's: the ones that carry the address they are signed in
+    /// with. A customer follows their assignment; a member sees what
+    /// they sent. The form must collect a required `email`, and the
+    /// group is usually one a stage `grants`, so the person who sent
+    /// the case is who ends up able to follow it.
+    #[serde(default)]
+    pub followed_by: Vec<String>,
     /// The event name a stage is entered by, where it must not be the
     /// builder's default (the stage's own name; `received` for the
     /// first). A live site replays its records by event name, so a
@@ -432,7 +440,7 @@ impl Field {
     /// What a public listing may show: everything but contact details
     /// and what the plan marks private.
     pub fn is_public(&self) -> bool {
-        !self.private && self.kind != "email" && self.kind != "tel"
+        !self.private && self.kind != "email" && self.kind != "tel" && self.kind != "file"
     }
 }
 
@@ -474,7 +482,7 @@ impl Plan {
     }
 }
 
-const FIELD_TYPES: &[&str] = &["text", "email", "tel", "textarea", "date", "select", "location"];
+const FIELD_TYPES: &[&str] = &["text", "email", "tel", "textarea", "date", "select", "location", "file"];
 
 fn is_id(s: &str) -> bool {
     !s.is_empty() && s.chars().all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '_' || c == '-')
@@ -687,6 +695,14 @@ impl Plan {
                     bail!(at("a stage that grants a group makes an account for the person, so the form must collect a required `name` (text) and a required `email` (type email)"));
                 }
             }
+            for group in &need.followed_by {
+                if !is_id(group) || group == PUBLIC || group == SUBMITTER {
+                    bail!(at(&format!("followed_by must name groups, not {group:?}")));
+                }
+                if !need.collects.iter().any(|f| f.name == "email" && f.kind == "email" && !f.optional) {
+                    bail!(at("followed_by shows a person the cases that carry their address, so the form must collect a required `email` of type email"));
+                }
+            }
             for (stage, e) in &need.escalate {
                 if e.days == 0 {
                     bail!(at(&format!("escalate from {stage:?} must wait at least one day")));
@@ -1184,7 +1200,9 @@ pub fn fallback_words(plan: &Plan) -> BTreeMap<String, Value> {
                 // The list itself says what a row is and what the
                 // buttons under it do; the card's own description says
                 // what the cases are.
-                let note = if moves.is_empty() {
+                let note = if follows_own(needs[0], &group) {
+                    loc(lang, "Each row is one of your own cases and the stage it has reached.", "Hver rad er én av dine egne saker og hvor langt den har kommet.")
+                } else if moves.is_empty() {
                     loc(lang, "Each row is one case and the stage it has reached. Another desk moves these.", "Hver rad er én sak og hvor langt den har kommet. En annen pult flytter disse.")
                 } else {
                     loc(lang, "Each row is one case. The buttons record what you have just done with it.", "Hver rad er én sak. Knappene fører opp det du nettopp har gjort med den.")
@@ -1480,7 +1498,16 @@ fn escalated_states_for(need: &PlanNeed, group: &str) -> Vec<String> {
 /// A group's desk shows a bucket when it moves something in it, is
 /// answerable for it, or watches it.
 fn on_desk(need: &PlanNeed, group: &str) -> bool {
-    group != PUBLIC && (need.handled_by == group || need.watched_by.iter().any(|g| g == group) || !moves_of(need, group).is_empty())
+    group != PUBLIC && (need.handled_by == group || need.watched_by.iter().any(|g| g == group) || need.followed_by.iter().any(|g| g == group) || !moves_of(need, group).is_empty())
+}
+
+/// A group that has the bucket only to follow its own cases: its list
+/// is narrowed to the signed-in person's address.
+fn follows_own(need: &PlanNeed, group: &str) -> bool {
+    need.followed_by.iter().any(|g| g == group)
+        && need.handled_by != group
+        && !need.watched_by.iter().any(|g| g == group)
+        && !need.moves_by.values().flatten().any(|m| m == group)
 }
 
 fn groups(plan: &Plan) -> BTreeSet<String> {
@@ -1493,6 +1520,7 @@ fn groups(plan: &Plan) -> BTreeSet<String> {
                 .chain(n.watched_by.iter().filter(|g| *g != PUBLIC).cloned())
                 .chain(n.moves_by.values().flatten().filter(|m| *m != SUBMITTER).cloned())
                 .chain(n.escalate.values().map(|e| e.to.clone()))
+                .chain(n.followed_by.iter().cloned())
         })
         .collect()
 }
@@ -2154,6 +2182,10 @@ pub fn render(plan: &Plan, words: &BTreeMap<String, Value>) -> anyhow::Result<BT
             if !escalated.is_empty() {
                 resource["states"] = json!(escalated);
             }
+            // A group that follows its own cases sees those alone.
+            if follows_own(needs[0], &group) {
+                resource["where"] = json!({ "field": "email", "equals": "{user.email}" });
+            }
             alternatives.push(json!({
                 "name": text(&bw["heading"]),
                 "description": text(&bw["description"]),
@@ -2570,7 +2602,7 @@ mod tests {
             lands_in: "b".into(), handled_by: "g".into(),
             stages: v(stages), done_when: v(done), success: v(success), skippable: v(skippable),
             moves_by: BTreeMap::new(), watched_by: vec![],
-            events: BTreeMap::new(), attended_by: None, mails: BTreeMap::new(), stages_text: BTreeMap::new(), turned_down_from: vec![], reached_from: BTreeMap::new(), requires: String::new(),
+            events: BTreeMap::new(), attended_by: None, mails: BTreeMap::new(), stages_text: BTreeMap::new(), turned_down_from: vec![], reached_from: BTreeMap::new(), requires: String::new(), followed_by: vec![],
             grants: BTreeMap::new(), deadlines: BTreeMap::new(), escalate: BTreeMap::new(), public_states: vec![],
             collects: vec![], max_fields: 3,
         }
@@ -3385,6 +3417,27 @@ mod invite_tests {
         assert!(blank.validate().unwrap_err().to_string().contains("tones"));
     }
 
+    #[test]
+    fn a_group_that_follows_sees_its_own_cases_and_a_form_may_take_a_file() {
+        let yaml = "business: B\ncontact: { name: I, email: i@b.example }\nmail: { from: post@b.example }\nneeds:\n  - id: job\n    who: an owner\n    wants: a report\n    lands_in: jobs\n    handled_by: office\n    followed_by: [customers]\n    stages: [open, accepted, delivered]\n    done_when: [delivered]\n    grants: { accepted: customers }\n    max_fields: 3\n    collects:\n      - { name: name }\n      - { name: email, type: email }\n      - { name: drawings, type: file, optional: true }\n";
+        let plan: Plan = serde_yaml::from_str(yaml).unwrap();
+        plan.validate().unwrap();
+        let files = render(&plan, &fallback_words(&plan)).unwrap();
+        let mine: Value = serde_yaml::from_str(&files["questions/customers/index.yaml"]).unwrap();
+        let resource = &mine["alternatives"][0]["features"][0]["resource"];
+        assert_eq!(resource["where"], json!({ "field": "email", "equals": "{user.email}" }));
+        assert_eq!(resource["transitions"], json!([]));
+        // The office sees everything.
+        let office: Value = serde_yaml::from_str(&files["questions/office/index.yaml"]).unwrap();
+        assert!(office["alternatives"][0]["features"][0]["resource"].get("where").is_none());
+        // The form takes the file.
+        assert!(files["questions/index.yaml"].contains("type: file"));
+        // A group the case grants does not invite into itself.
+        assert!(!files["questions/customers/index.yaml"].contains("invite:"));
+        let no_mail: Plan = serde_yaml::from_str(&yaml.replace("      - { name: email, type: email }\n", "").replace("    grants: { accepted: customers }\n", "")).unwrap();
+        assert!(no_mail.validate().unwrap_err().to_string().contains("followed_by"));
+    }
+
     #[test]
     fn a_document_is_a_page_with_one_card_per_section_word_for_word() {
         let text = "# Vedtekter\n\n### av 23.04.2018\n\n##### § 1\n\nTomter vel er upolitisk. Foreningen har som\nformål å virke for stedets velferd.\n\n##### § 4.\n\nEkstraordinært årsmøte holdes når styret krever det.\n\nGjennomføringen følger samme prosedyre.\n";

src/trainer/plan.rs

@@ -175,6 +175,12 @@ rest. Each is one line in the plan, and the builder does the wiring:
   each brought in. Two is plenty; name them as a person would ("plain,
   like a good notice on the door"; "warm, as a neighbour would put
   it"). Leave it out to tell one story.
+- **Let a person follow their own.** `followed_by: [customers]` gives
+  a group a desk that lists each member's own cases and nobody else's
+  (the ones carrying the address they sign in with), and the files on
+  them. With `grants` on the stage where a customer says yes, the
+  person who sent the case is the one who ends up able to follow it.
+  A `file` field takes drawings, photos, a report.
 - **Carry a text word for word.** `documents` puts bylaws or terms on
   a page of their own, one card per section, from a markdown file
   beside the plan. Nothing rewords them.

src/upload.rs

@@ -277,13 +277,15 @@ pub async fn attachment(
     // cannot be used to learn which buckets, records or fields exist.
     let missing = || (StatusCode::NOT_FOUND, "not found".to_string());
 
-    if !may_read_bucket(&state, &session, &bucket).await {
-        return Err(missing());
-    }
-
     let store = state.jetstream.get_key_value(&bucket).await.map_err(|_| missing())?;
     let bytes = store.get(&record).await.map_err(|_| missing())?.ok_or_else(missing)?;
-    let answer: crate::answers::Answer = serde_json::from_slice(&bytes).map_err(|_| missing())?;
+    let as_listed: serde_json::Value = serde_json::from_slice(&bytes).map_err(|_| missing())?;
+    // Through a list the caller may read, and one that shows this
+    // record: a list of "my cases" opens my files and nobody else's.
+    if !may_read_record(&state, &session, &bucket, &as_listed).await {
+        return Err(missing());
+    }
+    let answer: crate::answers::Answer = serde_json::from_value(as_listed).map_err(|_| missing())?;
     let key = answer
         .responses
         .get(&field)
@@ -331,20 +333,23 @@ pub async fn attachment(
 /// Whether this caller may see this bucket at all: whether any feature
 /// in the loaded content lists it and the policy lets them read that
 /// feature. The desk that shows the record is what grants the file.
-async fn may_read_bucket(
+async fn may_read_record(
     state: &AppState,
     session: &tower_sessions::Session,
     bucket: &str,
+    record: &serde_json::Value,
 ) -> bool {
     use crate::auth::{User, SESSION_USER_KEY};
 
     let user = session.get::<User>(SESSION_USER_KEY).await.ok().flatten();
     let principal = crate::access::Principal::from_user(user.as_ref());
+    let params = crate::resource::with_person(Default::default(), user.as_ref());
     let access = state.access.load();
     state.questions.load().values().any(|question| {
         question.alternatives.iter().any(|alternative| {
             alternative.features.iter().any(|feature| {
                 feature.resource.as_ref().and_then(|r| r.bucket()) == Some(bucket)
+                    && feature.resource.as_ref().is_some_and(|r| crate::resource::matches_filter(r, record, &params))
                     && access.allows(
                         &principal,
                         crate::access::Action::Read,

style/main.css

@@ -173,6 +173,61 @@ main.not-found {
   gap: 1rem;
 }
 
+/* Who is here and the way in or out: top right of every page, on a
+   site that has sign-in. */
+.session {
+  position: absolute;
+  top: 1rem;
+  right: 1.5rem;
+  z-index: 5;
+  display: flex;
+  gap: 0.9rem;
+  align-items: baseline;
+  font-size: 0.88rem;
+}
+
+.session a {
+  color: var(--ink);
+  text-decoration: none;
+  border-bottom: 0.06rem solid var(--line);
+}
+
+.session a:hover {
+  color: var(--accent);
+  border-bottom-color: var(--accent);
+}
+
+.session-name {
+  color: var(--ink-dim);
+}
+
+/* A page with pictures: the wordmark is a bar of its own, the strip
+   runs the full width under it, and the question follows. */
+.hero-slides {
+  max-width: none;
+  padding: 0 0 2rem;
+  align-items: stretch;
+  gap: 0;
+}
+
+.hero-bar {
+  display: flex;
+  align-items: center;
+  padding: 0.9rem 1.5rem;
+}
+
+.hero-slides .slideshow {
+  margin-bottom: 2rem;
+}
+
+.hero-slides .hero-copy {
+  width: 100%;
+  max-width: 46rem;
+  margin: 0 auto;
+  padding: 0 1.5rem;
+  box-sizing: border-box;
+}
+
 .wordmark {
   display: inline-flex;
   opacity: 0.85;
@@ -742,7 +797,7 @@ main.not-found {
 
 .feature p {
   color: var(--ink-dim);
-  font-size: 0.95rem;
+  font-size: 0.95em;
 }
 
 .field {
@@ -753,7 +808,7 @@ main.not-found {
 }
 
 .field-label {
-  font-size: 0.85rem;
+  font-size: 0.85em;
   font-weight: 600;
   color: var(--ink-dim);
 }
@@ -763,17 +818,74 @@ main.not-found {
   margin-left: 0.2em;
 }
 
+/* Controls take their size from the text around them (em, not rem):
+   a site that sets its body larger, or a card that sets itself
+   smaller, gets fields, pills and buttons to match, and everything
+   inside a control - the date picker's icon, the file picker's button
+   - scales with the control. */
 input,
 textarea {
   font: inherit;
   color: var(--ink);
   background: var(--paper);
   border: 0.06rem solid var(--line);
-  border-radius: 0.6rem;
-  padding: 0.65rem 0.8rem;
+  border-radius: 0.6em;
+  padding: 0.65em 0.8em;
   width: 100%;
 }
 
+/* The calendar icon at the size of the text it sits beside, and a
+   target worth aiming at. */
+input[type="date"],
+input[type="time"],
+input[type="datetime-local"] {
+  min-height: 2.9em;
+}
+
+input[type="date"]::-webkit-calendar-picker-indicator,
+input[type="time"]::-webkit-calendar-picker-indicator,
+input[type="datetime-local"]::-webkit-calendar-picker-indicator {
+  width: 1.35em;
+  height: 1.35em;
+  padding: 0.2em;
+  margin-left: 0.4em;
+  cursor: pointer;
+  opacity: 0.75;
+}
+
+input[type="date"]::-webkit-calendar-picker-indicator:hover,
+input[type="time"]::-webkit-calendar-picker-indicator:hover,
+input[type="datetime-local"]::-webkit-calendar-picker-indicator:hover {
+  opacity: 1;
+}
+
+/* The file picker's own button, in the field's colours rather than
+   the browser's: it follows whatever ink the field has, so it holds
+   on a light field and a dark one alike. */
+input[type="file"] {
+  padding: 0.45em;
+  cursor: pointer;
+}
+
+input[type="file"]::file-selector-button {
+  font: inherit;
+  font-size: 0.85em;
+  font-weight: 600;
+  color: inherit;
+  background: color-mix(in srgb, currentColor 9%, transparent);
+  border: 0.06rem solid color-mix(in srgb, currentColor 28%, transparent);
+  border-radius: 999rem;
+  padding: 0.4em 1em;
+  margin-right: 0.8em;
+  cursor: pointer;
+  transition: border-color 120ms, background 120ms;
+}
+
+input[type="file"]::file-selector-button:hover {
+  background: var(--accent-soft);
+  border-color: var(--accent);
+}
+
 textarea {
   min-height: 5rem;
   resize: vertical;
@@ -1034,14 +1146,14 @@ textarea:focus {
 }
 
 .alt-submit {
-  font-family: var(--sans);
+  font-family: inherit;
   font-weight: 600;
-  font-size: 0.95rem;
+  font-size: 0.95em;
   color: var(--paper);
   background: var(--accent);
   border: none;
-  border-radius: 0.7rem;
-  padding: 0.75rem 1.4rem;
+  border-radius: 0.7em;
+  padding: 0.75em 1.4em;
   cursor: pointer;
   transition: filter 120ms, transform 120ms;
   /* A gateway alternative renders this as an <a> (navigation, no POST);
@@ -1157,6 +1269,13 @@ textarea:focus {
   color: var(--accent);
 }
 
+/* A stored file on a record: its name, and it opens. */
+.answer-file {
+  color: var(--accent);
+  text-decoration: none;
+  border-bottom: 0.06rem solid var(--accent);
+}
+
 /* The page about a listed record, when the list offers one. */
 .answer-link {
   display: inline-block;
@@ -1247,13 +1366,13 @@ textarea:focus {
 }
 
 .select-option {
-  font-family: var(--sans);
-  font-size: 0.85rem;
+  font-family: inherit;
+  font-size: 0.85em;
   color: var(--ink);
   background: var(--paper);
   border: 0.06rem solid var(--line);
   border-radius: 999rem;
-  padding: 0.4rem 0.9rem;
+  padding: 0.45em 1em;
   cursor: pointer;
   transition: border-color 120ms, color 120ms, background 120ms;
 }