Accounts the content mandates, a seed for the first person, and edits suggested by who is responsible #2

Merged

bl merged 4 commits from seed-admin into main 2026-09-29 19:10:40 +00:00

Conversation 0 Commits 4 Files Changed 17

+1667 -33

4 Commits

Author	SHA1	Message	Date
Bendik Aagaard LynghaugandClaude Fable 5.1	ef4789f9b2	Invites and suggestions are cases; the responsible follow the content ... Five things the first cut of accounts-from-content left open. The first person and the responsible people are set up side by side, and both try again a minute apart: a seed that waited twenty minutes on Kanidm used to hold everyone else up, and a responsible person who failed waited for the next restart. The responsible are gone over again whenever the content changes. watch_for_reload publishes portal.content.reloaded once new content is in place, and seed.rs listens. Being responsible ends when the content stops saying so: someone no page names any more leaves RESPONSIBLE_GROUP in the same pass, if portal is who put them there (Invited.already_member). The account stays. An invite keeps itself current. portal_invites has an expired state; signing in closes a person's invites, a sweep moves the ones whose link ran out, and a desk's move from expired back to open makes a fresh link and mails it. Invites made at start are on file with the desks'. A suggested edit is a case in the built-in portal_edit_suggestions bucket, the person who made it is mailed at each move, and the card lists what they sent and where it stands. Found on the way, against Kanidm 1.11.2: a link's end comes as seconds since the epoch, which portal did not read, so invite mails said "until" and nothing; and a mail search answered with a 5xx was taken for a refusal. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt	2026-09-29 21:00:10 +02:00
Bendik Aagaard LynghaugandClaude Opus 5.5	7a50ce77b2	Docs: getting started says what is retried and what waits for the next start ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt	2026-09-29 18:03:51 +02:00
Bendik Aagaard LynghaugandClaude Opus 5.5	641c5f1bd3	Docs: getting started, bringing your people in ... From an empty Kanidm to everyone at their own desk: what in the content decides who needs an account, the four things Kanidm needs for portal, the first person, what happens at start, how everyone after comes in from the desks, what the people who ask the questions can do, and what each failure looks like. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt	2026-09-29 18:02:02 +02:00
Bendik Aagaard LynghaugandClaude Opus 5.5	0886869607	Accounts the content mandates, a seed for the first person, and edits suggested by who is responsible ... Every person a page names as responsible gets a Kanidm account at start if they have none, and a mail saying they are listed as responsible for asking that question, with the link to sign in; RESPONSIBLE_GROUP puts them in one group. SEED_ADMIN_EMAIL invites the first person into the most privileged group - the one whose desk may invite into the most - once. Signed in, a responsible person may suggest a change to their own pages; checked on the server, kept, published, and mailed to the site's inbox. Fixes an invite of someone new on a Kanidm with only the onboarding account: the person is created with their address in one call, since idm_people_on_boarding may create but not modify (it answered 403). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt	2026-09-29 15:44:20 +02:00