Put the feedback and tickets admin areas behind the shared identity (#13)

Reviewed-on: #13 Co-authored-by: Patrick Müller <mail@pmueller.me> Co-committed-by: Patrick Müller <mail@pmueller.me>
2026-09-06 19:06:30 +00:00
parent bf7be65b03
commit 3c892d02ed
20 changed files with 457 additions and 309 deletions
@@ -19,9 +19,9 @@ export const reportsAdminRouter = express.Router();
 *          summary: Aggregated feedback report for one event
 *          description: Song-pick vote counts, song-rating averages, capped free-text list, guest book count, and newsletter sync counts.
 *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
 *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
 *              - in: path
 *                name: eventId
 *                required: true
@@ -34,6 +34,8 @@ export const reportsAdminRouter = express.Router();
 *                  description: Unknown event
 *              401:
 *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
 */
 reportsAdminRouter.get('/:eventId/report', async (req: Request, res: Response) => {
 	try {
@@ -55,9 +57,9 @@ reportsAdminRouter.get('/:eventId/report', async (req: Request, res: Response) =
 *          summary: Guest Book entries for one event
 *          description: Newest first, paginated.
 *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
 *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
 *              - in: path
 *                name: eventId
 *                required: true
@@ -81,6 +83,8 @@ reportsAdminRouter.get('/:eventId/report', async (req: Request, res: Response) =
 *                  description: Success
 *              401:
 *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
 */
 reportsAdminRouter.get('/:eventId/guestbook', async (req: Request, res: Response) => {
 	try {
@@ -101,9 +105,9 @@ reportsAdminRouter.get('/:eventId/guestbook', async (req: Request, res: Response
 *          summary: Newsletter signups for one event
 *          description: Includes sync_status, so failures can be handled manually. Newest first, paginated.
 *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
 *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
 *              - in: path
 *                name: eventId
 *                required: true
@@ -127,6 +131,8 @@ reportsAdminRouter.get('/:eventId/guestbook', async (req: Request, res: Response
 *                  description: Success
 *              401:
 *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
 */
 reportsAdminRouter.get('/:eventId/newsletter', async (req: Request, res: Response) => {
 	try {
@@ -147,9 +153,9 @@ reportsAdminRouter.get('/:eventId/newsletter', async (req: Request, res: Respons
 *          summary: CSV export of all answers for one event
 *          description: Long format, one row per answer. UTF-8 BOM, `;` separator, RFC 4180 escaping, formula-injection guard.
 *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
 *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
 *              - in: path
 *                name: eventId
 *                required: true
@@ -162,6 +168,8 @@ reportsAdminRouter.get('/:eventId/newsletter', async (req: Request, res: Respons
 *                      text/csv: {}
 *              401:
 *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
 */
 reportsAdminRouter.get('/:eventId/export/responses.csv', async (req: Request, res: Response) => {
 	try {
@@ -187,9 +195,9 @@ reportsAdminRouter.get('/:eventId/export/responses.csv', async (req: Request, re
 *      get:
 *          summary: CSV export of Guest Book entries for one event
 *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
 *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
 *              - in: path
 *                name: eventId
 *                required: true
@@ -202,6 +210,8 @@ reportsAdminRouter.get('/:eventId/export/responses.csv', async (req: Request, re
 *                      text/csv: {}
 *              401:
 *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
 */
 reportsAdminRouter.get('/:eventId/export/guestbook.csv', async (req: Request, res: Response) => {
 	try {