Put the feedback and tickets admin areas behind the shared identity (#13)

Reviewed-on: #13 Co-authored-by: Patrick Müller <mail@pmueller.me> Co-committed-by: Patrick Müller <mail@pmueller.me>
2026-09-06 19:06:30 +00:00
parent bf7be65b03
commit 3c892d02ed
20 changed files with 457 additions and 309 deletions
@@ -16,9 +16,9 @@ export const questionsAdminRouter = express.Router();
 *      get:
 *          summary: List the question library
 *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
 *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
 *              - in: query
 *                name: includeArchived
 *                schema:
@@ -34,12 +34,13 @@ export const questionsAdminRouter = express.Router();
 *                                  $ref: '#/components/schemas/AdminQuestion'
 *              401:
 *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
 *      post:
 *          summary: Create a question
 *          tags: [feedback-admin]
- *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
+ *          security:
+ *              - AdminSessionCookie: []
 *          requestBody:
 *              required: true
 *              content:
@@ -61,6 +62,8 @@ export const questionsAdminRouter = express.Router();
 *                  description: Missing or invalid fields
 *              401:
 *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
 */
 questionsAdminRouter.get('/', async (req: Request, res: Response) => {
 	try {
@@ -94,9 +97,9 @@ questionsAdminRouter.post('/', async (req: Request, res: Response) => {
 *          summary: Edit a question's label/help text
 *          description: question_type is immutable after creation - the admin UI offers "archive and create new" instead.
 *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
 *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
 *              - in: path
 *                name: questionId
 *                required: true
@@ -123,13 +126,15 @@ questionsAdminRouter.post('/', async (req: Request, res: Response) => {
 *                  description: Unknown question
 *              401:
 *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
 *      delete:
 *          summary: Archive (or hard-delete) a question
 *          description: Archives the question if it has ever been used; hard-deletes it if it has never been assigned to any event.
 *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
 *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
 *              - in: path
 *                name: questionId
 *                required: true
@@ -142,6 +147,8 @@ questionsAdminRouter.post('/', async (req: Request, res: Response) => {
 *                  description: Unknown question
 *              401:
 *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
 */
 questionsAdminRouter.put('/:questionId', async (req: Request, res: Response) => {
 	try {