Read calendar event creators from the admin module, and archive the old ones (#14)

Reviewed-on: #14
Co-authored-by: Patrick Müller <mail@pmueller.me>
Co-committed-by: Patrick Müller <mail@pmueller.me>

src/app.factory.ts

@@ -63,13 +63,14 @@ export const createApp = (): express.Application => {
 	// the dev machine's LAN IP, never "localhost"). Dev-only, same as above.
 	const lanIpRegex = /^http:\/\/(192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}):\d+$/;
 	app.use(cors({
-		// X-Session-* are no longer read by anything on this side: the step 4
-		// cutover took the last two readers (feedback.auth.ts, tickets.auth.ts)
-		// off them, and the calendar module passes its session in query
-		// parameters (DEFERRED_SECURITY.md item 1). They stay allowed only so a
-		// browser still running the pre-cutover tickets or feedback bundle gets
-		// a clean 401 rather than a CORS preflight failure. Drop them once both
-		// frontends are deployed - see docs/calendar-auth-migration.md step 5.
+		// X-Session-* are no longer read by anything on this side, and no longer
+		// sent by anything either: the tickets and feedback cutover took the last
+		// two readers off them, and the calendar cutover removed the last legacy
+		// credential path in the API (its session used to travel in query
+		// parameters - DEFERRED_SECURITY.md item 1, now closed). They stay allowed
+		// only so a browser still running a pre-cutover tickets or feedback bundle
+		// gets a clean 401 rather than a CORS preflight failure. Drop them once
+		// those have aged out - see docs/calendar-auth-migration.md step 5.
 		allowedHeaders: ['Content-Type', 'X-Session-Id', 'X-Session-Key'],
 		// The admin session lives in a cookie, so browsers must be allowed to send
 		// it cross-origin - this is what makes credentials: 'include' work.