Add Tickets domain for the voucher-based ticket shop (#8)

Reviewed-on: #8
Co-authored-by: Patrick Mueller <patrick@mueller-patrick.tech>
Co-committed-by: Patrick Mueller <patrick@mueller-patrick.tech>

src/models/tickets/tickets.auth.ts

@@ -0,0 +1,63 @@
+import express from 'express';
+import * as UserService from '../calendar/users/users.service';
+import {sendServerError} from './tickets.errors';
+
+/**
+ * Mirrors the Feedback module's feedback.auth.ts: this is the ONLY place in
+ * the tickets module that knows how admin authentication works. No route
+ * handler and no service outside this file may import users.service, read
+ * session headers, or touch bcrypt.
+ *
+ * Today: reuses the existing Calendar users/sessions mechanism. Any
+ * activated @nachklang.art account may administer vouchers - no roles, same
+ * policy as Feedback (see docs/plan-ticket-shop.md). A dedicated
+ * roles/permissions model is explicitly out of scope for v1.
+ *
+ * Explicitly forbidden: accepting sessionId/sessionKey from query
+ * parameters - headers only (see DEFERRED_SECURITY.md item 1).
+ */
+
+export interface AdminIdentity {
+	id: string;
+	email: string;
+	displayName: string;
+}
+
+export type AdminAuthenticator = (req: express.Request) => Promise<AdminIdentity | null>;
+
+export const sessionHeaderAuthenticator: AdminAuthenticator = async (req) => {
+	const sessionId = req.header('X-Session-Id');
+	const sessionKey = req.header('X-Session-Key');
+	if (!sessionId || !sessionKey) {
+		return null;
+	}
+
+	const ip = req.ip || '';
+	const user = await UserService.checkSession(sessionId, sessionKey, ip);
+
+	if (!user || !user.isActive) {
+		return null;
+	}
+
+	return {
+		id: String(user.userId),
+		email: user.email,
+		displayName: user.fullName
+	};
+};
+
+export const activeAuthenticator: AdminAuthenticator = sessionHeaderAuthenticator;
+
+export const requireAdminAuth: express.RequestHandler = async (req, res, next) => {
+	try {
+		const identity = await activeAuthenticator(req);
+		if (!identity) {
+			res.status(401).send({status: 'UNAUTHORIZED', message: 'Anmeldung erforderlich.'});
+			return;
+		}
+		res.locals.admin = identity;
+		next();
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+};