[People · Phase 2] Soci and association fees on Entra ID #144

Status: not started. Design needed.

Placeholder so the whole roadmap (#146) is traceable. Don't start before the design is agreed.

Goal

Manage the association's Soci: membership fee payments and renewal status.

What we already know

• Entra ID is the source of truth for who is a socio, and Auth already reads it (socio state, Microsoft 365 sign-in). No linking is needed.
• Nothing is shared with People records (Group Admins / Team members). The first version did that badly and is removed in [People · Cleanup] Remove what doesn't belong in People #142.
• Admitting a socio stays in the Azure section (azure:members:create). Phase 2 doesn't create accounts.
• Fees attach to the Entra user: object ID, with the member number as employeeId.
• Permissions get their own namespace (e.g. soci:*). The old people:members:*, people:fees:* and people:receipts:* are deleted in [People · Cleanup] Delete the Soci, fee and receipt permissions from the production IdP auth#77.

Useful references (git history, for ideas only, not to restore)

Fee renewal, transfer receipt upload and review, receipt numbering, receipts signed with the CIE through eSign, IBAN validation and the mail outbox: #100 and PoliNetworkOrg/backend#83.