Add a read-only role per app for calendar, feedback and tickets

A grant can now be `read` instead of `access`: requireAppAccess lets it
through for GET/HEAD/OPTIONS and answers 403 to every other method, so
new write routes are covered without being marked. `read` and `access`
on the same app are rejected together; user management has no read role.
/tickets/admin/me and /feedback/admin/me report `readOnly`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/integration/admin.readonly.test.ts

@@ -0,0 +1,121 @@
+import {describe, it, expect, beforeAll, beforeEach, afterAll} from 'vitest';
+import type {Application} from 'express';
+import {createApp} from '../../src/app.factory.js';
+import {READ_ROLE} from '../../src/models/admin/admin.schema.js';
+import {closeDatabase, createAndAcceptInvitation, resetDatabase} from './helpers.js';
+
+/**
+ * The read-only role end to end: a real session cookie through the real
+ * middleware into each app's routers. The writes are rejected before any
+ * handler runs, which is why this suite needs no tickets/feedback/calendar
+ * database - a 403 here proves the gate held, not that a query failed.
+ */
+
+let app: Application;
+
+beforeAll(() => {
+	app = createApp();
+});
+
+beforeEach(async () => {
+	await resetDatabase();
+});
+
+afterAll(async () => {
+	await closeDatabase();
+});
+
+const readOnlyEverywhere = async () => {
+	return createAndAcceptInvitation(app, 'reader@nachklang.art', 'Reader', [
+		{app: 'tickets', role: READ_ROLE},
+		{app: 'feedback', role: READ_ROLE},
+		{app: 'calendar', role: READ_ROLE}
+	]);
+};
+
+describe('read-only access', () => {
+	it('reports readOnly on each app\'s /me', async () => {
+		const {agent} = await readOnlyEverywhere();
+
+		const tickets = await agent.get('/tickets/admin/me');
+		const feedback = await agent.get('/feedback/admin/me');
+
+		expect(tickets.status).toBe(200);
+		expect(tickets.body.readOnly).toBe(true);
+		expect(feedback.status).toBe(200);
+		expect(feedback.body.readOnly).toBe(true);
+	});
+
+	it('reports readOnly false for full access', async () => {
+		const {agent} = await createAndAcceptInvitation(app, 'full@nachklang.art', 'Full', ['tickets']);
+
+		const res = await agent.get('/tickets/admin/me');
+
+		expect(res.status).toBe(200);
+		expect(res.body.readOnly).toBe(false);
+	});
+
+	it.each([
+		['post', '/tickets/admin/vouchers/wildcard'],
+		['post', '/tickets/admin/redemptions/1/resend-confirmation'],
+		['patch', '/tickets/admin/redemptions/1'],
+		['put', '/tickets/admin/events/1/settings'],
+		['delete', '/feedback/admin/submissions/1'],
+		['post', '/feedback/admin/events'],
+		['post', '/calendar/events'],
+		['delete', '/calendar/events/1']
+	] as const)('refuses %s %s', async (method, path) => {
+		const {agent} = await readOnlyEverywhere();
+
+		const res = await agent[method](path).send({});
+
+		expect(res.status).toBe(403);
+		expect(res.body.message).toBe('Du hast für diesen Bereich nur Lesezugriff.');
+	});
+
+	it('does not open user management', async () => {
+		const {agent} = await readOnlyEverywhere();
+
+		expect((await agent.get('/admin/users')).status).toBe(403);
+	});
+});
+
+describe('granting read-only access', () => {
+	const signedInAdmin = () => createAndAcceptInvitation(app, 'admin@nachklang.art', 'Admin', ['admin']);
+
+	it('stores the read role per app', async () => {
+		const {agent} = await signedInAdmin();
+		const other = await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);
+
+		const res = await agent
+			.put(`/admin/users/${other.userId}/permissions`)
+			.send({permissions: [{app: 'tickets', role: READ_ROLE}, {app: 'feedback', role: 'access'}]});
+
+		expect(res.status).toBe(200);
+		expect(res.body.permissions).toEqual(expect.arrayContaining([
+			{app: 'tickets', role: READ_ROLE},
+			{app: 'feedback', role: 'access'}
+		]));
+	});
+
+	it('rejects full and read-only access to the same app', async () => {
+		const {agent} = await signedInAdmin();
+		const other = await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);
+
+		const res = await agent
+			.put(`/admin/users/${other.userId}/permissions`)
+			.send({permissions: [{app: 'tickets', role: READ_ROLE}, {app: 'tickets', role: 'access'}]});
+
+		expect(res.status).toBe(400);
+	});
+
+	it('rejects inviting someone with read-only user management', async () => {
+		const {agent} = await signedInAdmin();
+
+		const res = await agent
+			.post('/admin/invitations')
+			.send({email: 'new@nachklang.art', name: 'New', permissions: [{app: 'admin', role: READ_ROLE}]});
+
+		expect(res.status).toBe(400);
+	});
+});