Put the feedback and tickets admin areas behind the shared identity (#13)

Reviewed-on: #13
Co-authored-by: Patrick Müller <mail@pmueller.me>
Co-committed-by: Patrick Müller <mail@pmueller.me>

src/app.factory.ts

@@ -63,8 +63,13 @@ export const createApp = (): express.Application => {
 	// the dev machine's LAN IP, never "localhost"). Dev-only, same as above.
 	const lanIpRegex = /^http:\/\/(192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}):\d+$/;
 	app.use(cors({
-		// X-Session-* stay allowed until the calendar module is migrated off the
-		// legacy header sessions (see docs/calendar-auth-migration.md).
+		// X-Session-* are no longer read by anything on this side: the step 4
+		// cutover took the last two readers (feedback.auth.ts, tickets.auth.ts)
+		// off them, and the calendar module passes its session in query
+		// parameters (DEFERRED_SECURITY.md item 1). They stay allowed only so a
+		// browser still running the pre-cutover tickets or feedback bundle gets
+		// a clean 401 rather than a CORS preflight failure. Drop them once both
+		// frontends are deployed - see docs/calendar-auth-migration.md step 5.
 		allowedHeaders: ['Content-Type', 'X-Session-Id', 'X-Session-Key'],
 		// The admin session lives in a cookie, so browsers must be allowed to send
 		// it cross-origin - this is what makes credentials: 'include' work.