@smartkomm/plexus-cli 0.1.3 → 0.1.4

package/dist/skill/.managed-by-plexus-cli

@@ -1 +1 @@
-a7e47ca719b3e904a3ff2d677c27375d57d83b9323a9226eb9414d3401ee68ca
+8e33119fb56e056acb65fdd91cd4829d6c512e5a9d49ae5d1c54a2b4b7c0e435

package/dist/skill/SKILL.md

@@ -168,6 +168,7 @@ whole is the operator's (ask them; do not try).
 | [config/list-setup-exports.md](references/config/list-setup-exports.md) | Plattform | List a tenant's nightly and manual setup exports and show what changed between two of them. |
 | [config/set-tenant-branding.md](references/config/set-tenant-branding.md) | Mandant + Plattform | Give the application portal colours, radius and fonts; upload logo and WOFF2 fonts (the `branding …` commands need the operator; a school uses `config apply`). |
 | [config/set-tenant-terms.md](references/config/set-tenant-terms.md) | Plattform | Switch a school from „Bewerbung" to „Anmeldung" throughout with one setting. |
+| [config/set-external-sign-in.md](references/config/set-external-sign-in.md) | Plattform | Choose how long the sign-in link in a school's letters works — once, N days, or without end. |
 | [config/set-up-billing-catalog.md](references/config/set-up-billing-catalog.md) | Mandant + Plattform | Load articles, packages, reduction tiers and Word templates by stable keys (catalog plan/apply). |
 | [config/update-tenant-config.md](references/config/update-tenant-config.md) | Mandant | Change the live config by export → edit → dry run → confirm. |
 | [config/wipe-tenant-config.md](references/config/wipe-tenant-config.md) | Plattform | Empty one config target, optionally with dependent data, or take a tenant down. |

package/dist/skill/references/config/set-external-sign-in.md

@@ -0,0 +1,53 @@
+# Set how families sign in
+
+**When to use:** a school decides how long the sign-in link in its letters
+works — forever, for N days, or once (and then 12 hours signed in).
+
+## What it is
+
+`tenant.externalSignIn` in the tenant config, **required** in every config:
+
+| Value | The link in a sign-in letter | A session it opens |
+|---|---|---|
+| `{ "mode": "oneTimeLink" }` | works once, 15 minutes; an old one says „abgelaufen" and offers a new one | ends 12 hours after sign-in |
+| `{ "mode": "periodLink", "validDays": 7 }` | works as often as opened, for 1–90 days from the letter | 7 days, refreshed while used |
+| `{ "mode": "permanentLink" }` | works as often as opened, without an end | 7 days, refreshed while used |
+
+- „Sign-in letters" are the school's three: access sent from the cockpit
+  (`applicant.accessSent`), „Link anfordern" in the portal (`applicant.magicLink`)
+  and the parked-draft letter. „Link kopieren" in the cockpit is always a
+  one-time link; the login page's link (`/login`) too.
+- An account at several schools follows the **strictest** of them.
+- A switch acts at once: an access link is checked against the mode in force
+  when it is OPENED (a switch to `oneTimeLink` retires all of them), and every
+  open session meets the new 12-hour limit within 15 minutes (the Convex token
+  lifetime).
+- Data-protection view: a one-time link ties a sign-in to the mailbox owner at
+  that moment; a reusable link can be opened by whoever holds the mail. Choose
+  `oneTimeLink` where a submission must be attributable to one person.
+
+## Set it (dry run first)
+
+```bash
+plexus-cli --env staging config set --tenant <slug> --target tenant \
+  --key <slug> --field externalSignIn --value '{"mode":"periodLink","validDays":7}'
+plexus-cli --env staging config set --tenant <slug> --target tenant \
+  --key <slug> --field externalSignIn --value '{"mode":"periodLink","validDays":7}' --confirm
+```
+
+A wrong shape is refused (`[auth/externalSignIn]`). Platform-owned: a school's
+own administrator cannot change it.
+
+## Verify
+
+- Platform → „Mandanten" → the school → Bewerbungsmanagement → „Anmeldung für
+  Familien" shows the config spelling (`oneTimeLink`, `periodLink, validDays 7`, …).
+- Send yourself „Zugang versenden → Per Mail senden" on a test application: the
+  letter says „Der Link gilt 15 Minuten" / „7 Tage" / „unbefristet".
+
+## Gotchas
+
+- A reusable link in a forwarded mail signs in whoever opens it — the cockpit's
+  „Zugangslinks sperren" ends every access link of that family at the school.
+- Access links also end when the account gains reach (another school, staff
+  rights) or its login address is changed by someone else.