Add a read-only role per app for calendar, feedback and tickets

A grant can now be `read` instead of `access`: requireAppAccess lets it
through for GET/HEAD/OPTIONS and answers 403 to every other method, so
new write routes are covered without being marked. `read` and `access`
on the same app are rejected together; user management has no read role.
/tickets/admin/me and /feedback/admin/me report `readOnly`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/admin/admin.middleware.test.ts

@@ -15,7 +15,7 @@ import {requireAppAccess, requireSignedIn, resolveAccess} from '../../src/models
 const mockGetSession = auth.api.getSession as unknown as Mock;
 const mockLoadAccess = UsersService.loadAccess as Mock;
 
-const makeReq = (): Request => ({headers: {cookie: 'nachklang.session_token=abc'}} as unknown as Request);
+const makeReq = (method = 'GET'): Request => ({method, headers: {cookie: 'nachklang.session_token=abc'}} as unknown as Request);
 
 const makeRes = (): Response => {
 	const res: any = {};
@@ -219,4 +219,62 @@ describe('requireAppAccess', () => {
 
 		expect(next).toHaveBeenCalled();
 	});
+
+	describe('read-only grant', () => {
+		const readOnlyUser = {
+			...activeUser,
+			permissions: [{app: 'tickets', role: 'read'}],
+			apps: ['tickets']
+		};
+
+		it.each(['GET', 'HEAD', 'OPTIONS'])('lets %s through', async method => {
+			mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+			mockLoadAccess.mockResolvedValue(readOnlyUser);
+			const res = makeRes();
+			const next = vi.fn();
+
+			await requireAppAccess('tickets')(makeReq(method), res, next);
+
+			expect(next).toHaveBeenCalled();
+		});
+
+		it.each(['POST', 'PUT', 'PATCH', 'DELETE'])('403s %s', async method => {
+			mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+			mockLoadAccess.mockResolvedValue(readOnlyUser);
+			const res = makeRes();
+			const next = vi.fn();
+
+			await requireAppAccess('tickets')(makeReq(method), res, next);
+
+			expect(res.status).toHaveBeenCalledWith(403);
+			expect(res.send).toHaveBeenCalledWith(expect.objectContaining({message: 'Du hast für diesen Bereich nur Lesezugriff.'}));
+			expect(next).not.toHaveBeenCalled();
+		});
+
+		it('does not let full access to another app write here', async () => {
+			mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+			mockLoadAccess.mockResolvedValue({
+				...activeUser,
+				permissions: [{app: 'tickets', role: 'read'}, {app: 'feedback', role: 'access'}],
+				apps: ['feedback', 'tickets']
+			});
+			const res = makeRes();
+			const next = vi.fn();
+
+			await requireAppAccess('tickets')(makeReq('POST'), res, next);
+
+			expect(res.status).toHaveBeenCalledWith(403);
+		});
+
+		it('lets full access write', async () => {
+			mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+			mockLoadAccess.mockResolvedValue(activeUser);
+			const res = makeRes();
+			const next = vi.fn();
+
+			await requireAppAccess('feedback')(makeReq('DELETE'), res, next);
+
+			expect(next).toHaveBeenCalled();
+		});
+	});
 });

test/admin/admin.schema.test.ts

@@ -1,9 +1,12 @@
 import {describe, expect, it} from 'vitest';
 import {
 	ACCESS_ROLE,
+	READ_ROLE,
 	appsOf,
+	canWrite,
 	isAppPermission,
 	isAppRole,
+	isReadOnly,
 	toPermissions
 } from '../../src/models/admin/admin.schema.js';
 
@@ -59,6 +62,44 @@ describe('toPermissions', () => {
 	it('reads an empty list as "no permissions", not as invalid', () => {
 		expect(toPermissions([])).toEqual([]);
 	});
+	it('reads the read-only role', () => {
+		expect(toPermissions([{app: 'tickets', role: READ_ROLE}])).toEqual([
+			{app: 'tickets', role: READ_ROLE}
+		]);
+	});
+
+	it('rejects full and read-only access to the same app together', () => {
+		expect(toPermissions(['tickets', {app: 'tickets', role: READ_ROLE}])).toBeNull();
+	});
+
+	it('allows full access to one app next to read-only access to another', () => {
+		expect(toPermissions(['tickets', {app: 'feedback', role: READ_ROLE}])).toEqual([
+			{app: 'tickets', role: ACCESS_ROLE},
+			{app: 'feedback', role: READ_ROLE}
+		]);
+	});
+
+	it('rejects read-only access to user management', () => {
+		expect(toPermissions([{app: 'admin', role: READ_ROLE}])).toBeNull();
+	});
+});
+
+describe('canWrite / isReadOnly', () => {
+	it('lets only the access role write', () => {
+		const permissions = [
+			{app: 'tickets' as const, role: ACCESS_ROLE},
+			{app: 'feedback' as const, role: READ_ROLE}
+		];
+		expect(canWrite(permissions, 'tickets')).toBe(true);
+		expect(canWrite(permissions, 'feedback')).toBe(false);
+		expect(isReadOnly(permissions, 'tickets')).toBe(false);
+		expect(isReadOnly(permissions, 'feedback')).toBe(true);
+	});
+
+	it('is neither for an app without any grant', () => {
+		expect(canWrite([], 'calendar')).toBe(false);
+		expect(isReadOnly([], 'calendar')).toBe(false);
+	});
 });
 
 describe('isAppRole', () => {

test/integration/admin.readonly.test.ts

@@ -0,0 +1,121 @@
+import {describe, it, expect, beforeAll, beforeEach, afterAll} from 'vitest';
+import type {Application} from 'express';
+import {createApp} from '../../src/app.factory.js';
+import {READ_ROLE} from '../../src/models/admin/admin.schema.js';
+import {closeDatabase, createAndAcceptInvitation, resetDatabase} from './helpers.js';
+
+/**
+ * The read-only role end to end: a real session cookie through the real
+ * middleware into each app's routers. The writes are rejected before any
+ * handler runs, which is why this suite needs no tickets/feedback/calendar
+ * database - a 403 here proves the gate held, not that a query failed.
+ */
+
+let app: Application;
+
+beforeAll(() => {
+	app = createApp();
+});
+
+beforeEach(async () => {
+	await resetDatabase();
+});
+
+afterAll(async () => {
+	await closeDatabase();
+});
+
+const readOnlyEverywhere = async () => {
+	return createAndAcceptInvitation(app, 'reader@nachklang.art', 'Reader', [
+		{app: 'tickets', role: READ_ROLE},
+		{app: 'feedback', role: READ_ROLE},
+		{app: 'calendar', role: READ_ROLE}
+	]);
+};
+
+describe('read-only access', () => {
+	it('reports readOnly on each app\'s /me', async () => {
+		const {agent} = await readOnlyEverywhere();
+
+		const tickets = await agent.get('/tickets/admin/me');
+		const feedback = await agent.get('/feedback/admin/me');
+
+		expect(tickets.status).toBe(200);
+		expect(tickets.body.readOnly).toBe(true);
+		expect(feedback.status).toBe(200);
+		expect(feedback.body.readOnly).toBe(true);
+	});
+
+	it('reports readOnly false for full access', async () => {
+		const {agent} = await createAndAcceptInvitation(app, 'full@nachklang.art', 'Full', ['tickets']);
+
+		const res = await agent.get('/tickets/admin/me');
+
+		expect(res.status).toBe(200);
+		expect(res.body.readOnly).toBe(false);
+	});
+
+	it.each([
+		['post', '/tickets/admin/vouchers/wildcard'],
+		['post', '/tickets/admin/redemptions/1/resend-confirmation'],
+		['patch', '/tickets/admin/redemptions/1'],
+		['put', '/tickets/admin/events/1/settings'],
+		['delete', '/feedback/admin/submissions/1'],
+		['post', '/feedback/admin/events'],
+		['post', '/calendar/events'],
+		['delete', '/calendar/events/1']
+	] as const)('refuses %s %s', async (method, path) => {
+		const {agent} = await readOnlyEverywhere();
+
+		const res = await agent[method](path).send({});
+
+		expect(res.status).toBe(403);
+		expect(res.body.message).toBe('Du hast für diesen Bereich nur Lesezugriff.');
+	});
+
+	it('does not open user management', async () => {
+		const {agent} = await readOnlyEverywhere();
+
+		expect((await agent.get('/admin/users')).status).toBe(403);
+	});
+});
+
+describe('granting read-only access', () => {
+	const signedInAdmin = () => createAndAcceptInvitation(app, 'admin@nachklang.art', 'Admin', ['admin']);
+
+	it('stores the read role per app', async () => {
+		const {agent} = await signedInAdmin();
+		const other = await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);
+
+		const res = await agent
+			.put(`/admin/users/${other.userId}/permissions`)
+			.send({permissions: [{app: 'tickets', role: READ_ROLE}, {app: 'feedback', role: 'access'}]});
+
+		expect(res.status).toBe(200);
+		expect(res.body.permissions).toEqual(expect.arrayContaining([
+			{app: 'tickets', role: READ_ROLE},
+			{app: 'feedback', role: 'access'}
+		]));
+	});
+
+	it('rejects full and read-only access to the same app', async () => {
+		const {agent} = await signedInAdmin();
+		const other = await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);
+
+		const res = await agent
+			.put(`/admin/users/${other.userId}/permissions`)
+			.send({permissions: [{app: 'tickets', role: READ_ROLE}, {app: 'tickets', role: 'access'}]});
+
+		expect(res.status).toBe(400);
+	});
+
+	it('rejects inviting someone with read-only user management', async () => {
+		const {agent} = await signedInAdmin();
+
+		const res = await agent
+			.post('/admin/invitations')
+			.send({email: 'new@nachklang.art', name: 'New', permissions: [{app: 'admin', role: READ_ROLE}]});
+
+		expect(res.status).toBe(400);
+	});
+});