Update the deferred-security advice for the cutover

DEFERRED_SECURITY.md item 1 still told the calendar to move its session
credentials from query parameters into X-Session-Id/X-Session-Key. That
was the right advice when two other modules read those headers; both
stopped in the cutover, so following it now would build a second
mechanism just as the first is being retired. The fix is the shared
admin identity, which closes the item outright rather than moving the
credential somewhere safer.

Also annotates the one assertion in auth-binding.ts that cannot
currently fail. It is kept deliberately - it is a tripwire against
someone reintroducing a header-session fallback for calendar users who
have not been invited yet, which is the shortcut this whole step exists
to close - but that was worth saying out loud rather than leaving it to
look like an oversight.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -52,6 +52,12 @@ ADMIN_BOOTSTRAP_EMAIL=
 # request shares ONE rate-limit bucket (/sign-in/* allows 3 per 10 seconds, so
 # one noisy client locks everyone out). Check with:
 #   SELECT `key` FROM rateLimit;  -- a "no-trusted-ip" row means it is happening.
+# The header the reverse proxy puts the real client IP in. Must be one the proxy
+# actually overwrites - trusting a header it does not set lets any client send its
+# own value and bypass the sign-in rate limit entirely.
+# Set to "none" to trust no header at all: every request then shares one rate-limit
+# bucket, which is the safe fallback if the check below fails. Verify after deploy
+# with: SELECT ipAddress FROM session ORDER BY createdAt DESC LIMIT 3;
 CLIENT_IP_HEADERS=x-real-ip
 TRUSTED_PROXY_IPS=
 

CLAUDE.md

@@ -46,9 +46,17 @@ other domain keeps the `mariadb` driver), mounted at `/admin/auth/*` for the aut
 and `/admin` for the JSON routes. Sessions are httpOnly cookies scoped to
 `.nachklang.art`, so one sign-in covers every app. Accounts are **invite-only** — public
 sign-up is disabled, and `invitations.plugin.ts` is the only code that creates users.
-Permissions are per app in `user_app_permissions`; `requireAppAccess(app)` in
-`admin.middleware.ts` is the single authenticator, and it queries the database on every
-request (no cookie cache) so disabling a user takes effect at once. `ADMIN_BOOTSTRAP_EMAIL`
+A permission is **(app, role)** in `user_app_permissions`, keyed on
+`(user_id, app, role)` so one user can hold several roles per app. `access` is the only role
+today and means "may use this app at all"; `APP_ROLES` in `admin.schema.ts` is the contract,
+and a role not listed there is rejected rather than written. `requireAppAccess(app)` in
+`admin.middleware.ts` is the single authenticator - it takes an optional second argument to
+narrow to one role, and queries the database on every request (no cookie cache) so disabling
+a user takes effect at once. Two things to know before touching this: any count of admins
+must count **distinct users**, not permission rows, or a single admin with two roles reads as
+two and the last-admin guard stops guarding; and both write endpoints accept
+`{permissions: [{app, role}]}` as well as the older `{apps: ['tickets']}`, which means the
+same at the `access` role. `ADMIN_BOOTSTRAP_EMAIL`
 makes sure someone can always get in on a fresh database.
 
 *Legacy calendar* — unchanged: users need a `@nachklang.art` email, and after activation

DEFERRED_SECURITY.md

@@ -11,7 +11,19 @@ These items were identified during a security review on 2026-05-02 and conscious
 
 `sessionId` and `sessionKey` are currently read from query parameters, which means they appear in server access logs, browser history, proxy logs, and `Referer` headers.
 
-**Fix:** Move to request headers (`X-Session-Id` / `X-Session-Key`) or the request body. Requires a corresponding frontend update.
+**Fix (updated 2026-09-06):** Move the calendar onto the shared admin identity -
+`requireAppAccess('calendar')` against the better-auth session cookie, per
+`docs/calendar-auth-migration.md`. That closes this item outright rather than moving the
+credential to a safer place, and it is now the cheaper of the two: the feedback and tickets
+modules made the same move on 2026-09-06 for one line each.
+
+~~Move to request headers (`X-Session-Id` / `X-Session-Key`) or the request body.~~ No longer
+the recommendation. Nothing on the server reads those two headers any more - the calendar's
+query parameters are the last legacy credential path in the API - so this would build a second
+mechanism just as the first is being retired. They survive only in the CORS `allowedHeaders`
+list, and only until both frontends are redeployed.
+
+Either fix requires a corresponding frontend update.
 
 > Note: the shared calendar `password` parameter in query params is intentional (iCal clients don't support headers) and is acceptable for the current setup.
 

docker/init/04-admin-schema.sql

@@ -103,15 +103,21 @@ CREATE TABLE IF NOT EXISTS `rateLimit` (
 -- ---------------------------------------------------------------------------
 
 -- Which apps a user may administer. `admin` is just another app: holding it is
--- what lets someone manage users and invitations. `role` is reserved for
--- per-app roles later and is 'admin' for every row today.
+-- what lets someone manage users and invitations. A permission is (app, role);
+-- `access` is the only role today, and the key admits several per app so finer
+-- ones can be added by inserting rows rather than by migrating this table.
 CREATE TABLE IF NOT EXISTS `user_app_permissions` (
 	`user_id`    VARCHAR(36) NOT NULL,
 	`app`        ENUM('calendar','feedback','tickets','admin') NOT NULL,
-	`role`       VARCHAR(32) NOT NULL DEFAULT 'admin',
+	-- One row per (user, app, role). `access` means "may use this app at all"
+	-- and is the only role today; the key allows several per app so a finer
+	-- permission can be added later by inserting rows, not by migrating.
+	`role`       VARCHAR(32) NOT NULL DEFAULT 'access',
 	`granted_by` VARCHAR(36) DEFAULT NULL,
 	`granted_at` DATETIME    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-	PRIMARY KEY (`user_id`, `app`),
+	-- (user_id, app) is the leftmost prefix of this key, so the per-request
+	-- permission lookup needs no separate index.
+	PRIMARY KEY (`user_id`, `app`, `role`),
 	CONSTRAINT `uap_user_fk` FOREIGN KEY (`user_id`) REFERENCES `user` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
@@ -122,7 +128,7 @@ CREATE TABLE IF NOT EXISTS `invitations` (
 	`email`       VARCHAR(255) NOT NULL,
 	`name`        VARCHAR(255) NOT NULL,
 	`token_hash`  CHAR(64)     NOT NULL,
-	`apps`        JSON         NOT NULL,
+	`permissions` JSON         NOT NULL,
 	`invited_by`  VARCHAR(36)  DEFAULT NULL,
 	`created_at`  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
 	`expires_at`  DATETIME     NOT NULL,
@@ -158,7 +164,7 @@ VALUES (
 );
 
 INSERT INTO `user_app_permissions` (`user_id`, `app`, `role`) VALUES
-	('dev-user-0000-0000-0000-000000000001', 'calendar', 'admin'),
-	('dev-user-0000-0000-0000-000000000001', 'feedback', 'admin'),
-	('dev-user-0000-0000-0000-000000000001', 'tickets',  'admin'),
-	('dev-user-0000-0000-0000-000000000001', 'admin',    'admin');
+	('dev-user-0000-0000-0000-000000000001', 'calendar', 'access'),
+	('dev-user-0000-0000-0000-000000000001', 'feedback', 'access'),
+	('dev-user-0000-0000-0000-000000000001', 'tickets',  'access'),
+	('dev-user-0000-0000-0000-000000000001', 'admin',    'access');

sql/admin/001_init.sql

@@ -114,15 +114,21 @@ CREATE TABLE IF NOT EXISTS `rateLimit` (
 -- ---------------------------------------------------------------------------
 
 -- Which apps a user may administer. `admin` is just another app: holding it is
--- what lets someone manage users and invitations. `role` is reserved for
--- per-app roles later and is 'admin' for every row today.
+-- what lets someone manage users and invitations. A permission is (app, role);
+-- `access` is the only role today, and the key admits several per app so finer
+-- ones can be added by inserting rows rather than by migrating this table.
 CREATE TABLE IF NOT EXISTS `user_app_permissions` (
 	`user_id`    VARCHAR(36) NOT NULL,
 	`app`        ENUM('calendar','feedback','tickets','admin') NOT NULL,
-	`role`       VARCHAR(32) NOT NULL DEFAULT 'admin',
+	-- One row per (user, app, role). `access` means "may use this app at all"
+	-- and is the only role today; the key allows several per app so a finer
+	-- permission can be added later by inserting rows, not by migrating.
+	`role`       VARCHAR(32) NOT NULL DEFAULT 'access',
 	`granted_by` VARCHAR(36) DEFAULT NULL,
 	`granted_at` DATETIME    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-	PRIMARY KEY (`user_id`, `app`),
+	-- (user_id, app) is the leftmost prefix of this key, so the per-request
+	-- permission lookup needs no separate index.
+	PRIMARY KEY (`user_id`, `app`, `role`),
 	CONSTRAINT `uap_user_fk` FOREIGN KEY (`user_id`) REFERENCES `user` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
@@ -133,7 +139,7 @@ CREATE TABLE IF NOT EXISTS `invitations` (
 	`email`       VARCHAR(255) NOT NULL,
 	`name`        VARCHAR(255) NOT NULL,
 	`token_hash`  CHAR(64)     NOT NULL,
-	`apps`        JSON         NOT NULL,
+	`permissions` JSON         NOT NULL,
 	`invited_by`  VARCHAR(36)  DEFAULT NULL,
 	`created_at`  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
 	`expires_at`  DATETIME     NOT NULL,

src/app.factory.ts

@@ -4,6 +4,7 @@ import swaggerUi from 'swagger-ui-express';
 import swaggerJSDoc from 'swagger-jsdoc';
 import cors from 'cors';
 import {toNodeHandler} from 'better-auth/node';
+import logger from './middleware/logger.js';
 
 // Router imports
 import {calendarRouter} from './models/calendar/Calendar.router.js';
@@ -11,7 +12,7 @@ import {feedbackRouter} from './models/feedback/Feedback.router.js';
 import {ticketsRouter} from './models/tickets/Tickets.router.js';
 import {adminRouter} from './models/admin/Admin.router.js';
 import {auth} from './models/admin/admin.auth.js';
-import {ADMIN_ALLOWED_ORIGINS} from './models/admin/admin.config.js';
+import {ADMIN_ALLOWED_ORIGINS, isProd} from './models/admin/admin.config.js';
 
 
 dotenv.config();
@@ -47,15 +48,28 @@ export const createApp = (): express.Application => {
 		// staging host does not need a code change here.
 		...ADMIN_ALLOWED_ORIGINS
 	];
-	const isDev = process.env.NODE_ENV !== 'production';
+	// `isProd` from admin.config, NOT `NODE_ENV !== 'production'`. The two are not
+	// the same when NODE_ENV is unset, which is exactly what a fresh Plesk vhost
+	// gives you: the old test called that "dev" and opened the loopback and
+	// private-LAN exceptions below. With `credentials: true` on this CORS config
+	// and a session cookie scoped to .nachklang.art, that let any page served
+	// from localhost read a signed-in admin's data cross-origin. admin.config
+	// treats anything but an explicit 'development'/'test' as production, so an
+	// unset value now fails closed.
+	const isDev = !isProd;
 	const localhostRegex = /^http:\/\/localhost:\d+$/;
 	// Matches http://<private-LAN-IPv4>:<port> - needed so the feedback form can
 	// be reached from a real phone over WiFi during dev (the phone's Origin is
 	// the dev machine's LAN IP, never "localhost"). Dev-only, same as above.
 	const lanIpRegex = /^http:\/\/(192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}):\d+$/;
 	app.use(cors({
-		// X-Session-* stay allowed until the calendar module is migrated off the
-		// legacy header sessions (see docs/calendar-auth-migration.md).
+		// X-Session-* are no longer read by anything on this side: the step 4
+		// cutover took the last two readers (feedback.auth.ts, tickets.auth.ts)
+		// off them, and the calendar module passes its session in query
+		// parameters (DEFERRED_SECURITY.md item 1). They stay allowed only so a
+		// browser still running the pre-cutover tickets or feedback bundle gets
+		// a clean 401 rather than a CORS preflight failure. Drop them once both
+		// frontends are deployed - see docs/calendar-auth-migration.md step 5.
 		allowedHeaders: ['Content-Type', 'X-Session-Id', 'X-Session-Key'],
 		// The admin session lives in a cookie, so browsers must be allowed to send
 		// it cross-origin - this is what makes credentials: 'include' work.
@@ -83,7 +97,26 @@ export const createApp = (): express.Application => {
 
 	// better-auth's own handler, mounted before express.json(): it reads the raw
 	// request body stream itself and a parsed body would leave it hanging.
-	app.all('/admin/auth/*', toNodeHandler(auth));
+	//
+	// Wrapped, because Express 4 does not await an async handler: a rejected
+	// promise escapes as an unhandled rejection instead of becoming a response.
+	// Nearly every better-auth route touches the admin database, so a database
+	// blip would leave the request hanging with no answer at all while the
+	// process logged an uncaughtException - observed by pointing ADMIN_DB at a
+	// database the user cannot open. Answer 503 instead: the caller learns, and
+	// the other domains keep serving.
+	const authHandler = toNodeHandler(auth);
+	app.all('/admin/auth/*', (req, res) => {
+		Promise.resolve(authHandler(req, res)).catch((e: any) => {
+			logger.error('Admin auth handler failed', {path: req.path, detail: e?.message});
+			if (!res.headersSent) {
+				res.status(503).send({
+					status: 'SERVICE_UNAVAILABLE',
+					message: 'Die Anmeldung ist derzeit nicht verfügbar. Bitte versuche es später erneut.'
+				});
+			}
+		});
+	});
 
 	// here we are adding middleware to parse all incoming requests as JSON
 	app.use(express.json());

src/models/admin/Admin.router.ts

@@ -35,6 +35,11 @@ adminRouter.get('/me', requireSignedIn, (req: Request, res: Response) => {
 		id: res.locals.admin.id,
 		email: res.locals.admin.email,
 		fullName: res.locals.admin.displayName,
+		// `permissions` is the full (app, role) truth; `apps` is the distinct
+		// apps within it. Both are sent because the three frontends only ever ask
+		// "may I show this app?", and keeping `apps` means a finer permission can
+		// land here without a coordinated deploy of all of them.
+		permissions: res.locals.admin.permissions,
 		apps: res.locals.admin.apps
 	});
 });

src/models/admin/admin.auth.ts

@@ -1,6 +1,6 @@
 import {betterAuth} from 'better-auth';
 import {APIError} from 'better-auth/api';
-import {passkey} from '@better-auth/passkey';
+import {passkey, getAuthenticatorName} from '@better-auth/passkey';
 import {NachklangAdminDB} from './Admin.db.js';
 import {invitationsPlugin} from './invitations/invitations.plugin.js';
 import {sendPasswordResetMail} from './admin.mail.js';
@@ -116,7 +116,24 @@ export const auth = betterAuth({
 		passkey({
 			rpID: PASSKEY_RP_ID,
 			rpName: 'Nachklang',
-			origin: ADMIN_ALLOWED_ORIGINS
+			origin: ADMIN_ALLOWED_ORIGINS,
+
+			registration: {
+				// Without this, every passkey is stored with name = NULL and the
+				// account page can only label them all "Passkey" - useless at the
+				// one moment that list matters, when someone has to remove the
+				// passkey on the device they just lost.
+				//
+				// The AAGUID identifies the authenticator *model* (not a device
+				// and not a person), and better-auth ships the lookup table, so
+				// this yields "1Password", "iCloud Keychain", "Windows Hello".
+				// It only fills a blank: a name the client sent always wins, and
+				// an unknown AAGUID leaves the column NULL as before.
+				afterVerification: async ({verification}) => {
+					const name = getAuthenticatorName(verification.registrationInfo?.aaguid);
+					return name ? {name} : undefined;
+				}
+			}
 		}),
 		invitationsPlugin()
 	],

src/models/admin/admin.bootstrap.ts

@@ -1,6 +1,7 @@
 import * as UsersService from './users/users.admin.service.js';
 import * as InvitationsService from './invitations/invitations.service.js';
 import {sendInvitationMail} from './admin.mail.js';
+import {ACCESS_ROLE} from './admin.schema.js';
 import {ADMIN_APP_URL, ADMIN_BOOTSTRAP_EMAIL, LOG_INVITE_LINKS} from './admin.config.js';
 import logger from '../../middleware/logger.js';
 
@@ -48,7 +49,7 @@ export const bootstrapAdmin = async (): Promise<void> => {
 		const invitation = await InvitationsService.createInvitation(
 			email,
 			'Nachklang Admin',
-			['admin'],
+			[{app: 'admin', role: ACCESS_ROLE}],
 			null
 		);
 

src/models/admin/admin.config.ts

@@ -73,8 +73,27 @@ const parseList = (value: string | undefined, fallback: string[]): string[] => {
 	return parsed.length > 0 ? parsed : fallback;
 };
 
-// The apps whose frontends may talk to /admin/* with credentials.
-export const APP_ORIGINS = parseList(process.env.APP_ORIGINS, []).map(origin => origin.replace(/\/$/, ''));
+/**
+ * The apps whose frontends may talk to /admin/* with credentials.
+ *
+ * They feed better-auth's `trustedOrigins`, which is what lets the tickets and
+ * feedback admin areas call /admin/auth/sign-out from their own origin. That
+ * became load-bearing with the step 4 cutover: before it, the only browser
+ * origin that ever reached /admin/auth was the admin app itself.
+ *
+ * Hence the production default rather than an empty list. An origin missing
+ * here fails in a way that is easy to misread - sign-in works, the app works,
+ * and only sign-out returns an origin error - so the two frontends we know
+ * about are named here and APP_ORIGINS overrides them for a staging host.
+ * Dev adds the localhost ports separately (see admin.auth.ts).
+ */
+const DEFAULT_APP_ORIGINS = [
+	'https://tickets.nachklang.art',
+	'https://feedback.nachklang.art'
+];
+
+export const APP_ORIGINS = parseList(process.env.APP_ORIGINS, DEFAULT_APP_ORIGINS)
+	.map(origin => origin.replace(/\/$/, ''));
 
 // Kept in sync by construction rather than by three separate lists: the admin
 // app itself always counts, and dev adds the local ports.
@@ -101,16 +120,53 @@ export const ADMIN_ALLOWED_ORIGINS = Array.from(new Set([
  * brute-force budget - so the default is the single header nginx sets, not a
  * permissive list.
  */
-export const CLIENT_IP_HEADERS = parseList(process.env.CLIENT_IP_HEADERS, ['x-real-ip']);
+
+/**
+ * `CLIENT_IP_HEADERS=none` trusts no header at all.
+ *
+ * This is the escape hatch for the one case where the wrong setting is worse
+ * than no setting: if the proxy turns out NOT to overwrite the header we are
+ * trusting, any client can send it and mint itself an unlimited brute-force
+ * budget against /sign-in. Falling back to the shared bucket is bad (one noisy
+ * client can lock the organisation out for ten seconds at a time) but it is
+ * bad in a way that fails closed, and it can be reverted from the environment
+ * without a deploy.
+ *
+ * Reach for it only after a check has actually failed - `SELECT ipAddress FROM
+ * session ORDER BY createdAt DESC` showing 127.0.0.1 or NULL for a real remote
+ * sign-in - and take it back out once the header is configured.
+ *
+ * An empty or unset value still means "use the default", not "trust nothing":
+ * a stray blank line in a .env must not silently change how requests are
+ * bucketed. Only the explicit word does that.
+ */
+const TRUST_NO_HEADER = 'none';
+
+export const TRUST_NO_CLIENT_IP_HEADER =
+	(process.env.CLIENT_IP_HEADERS || '').trim().toLowerCase() === TRUST_NO_HEADER;
+
+// An empty array is what better-auth reads as "no headers": it only falls back
+// to its own default when the option is absent, and `[]` is truthy.
+export const CLIENT_IP_HEADERS = TRUST_NO_CLIENT_IP_HEADER
+	? []
+	: parseList(process.env.CLIENT_IP_HEADERS, ['x-real-ip']);
 
 export const TRUSTED_PROXY_IPS = parseList(process.env.TRUSTED_PROXY_IPS, []);
 
-if (isProd && TRUSTED_PROXY_IPS.length === 0) {
+if (isProd && TRUST_NO_CLIENT_IP_HEADER) {
+	logger.warn(
+		'Admin module: CLIENT_IP_HEADERS=none - no client-IP header is trusted, so every ' +
+		'request shares one rate-limit bucket and /sign-in allows 3 attempts per 10 seconds ' +
+		'for everyone combined. This is the safe fallback, not a destination: configure the ' +
+		'header the proxy actually sets and remove it.'
+	);
+} else if (isProd && TRUSTED_PROXY_IPS.length === 0) {
 	logger.warn(
 		'Admin module: TRUSTED_PROXY_IPS is not set. If the proxy sends a multi-value ' +
 		`${CLIENT_IP_HEADERS.join('/')}, better-auth cannot resolve a client IP and every ` +
 		'request shares one rate-limit bucket. Verify with: SELECT `key` FROM rateLimit - ' +
-		'a "no-trusted-ip" row means this is happening.'
+		'a "no-trusted-ip" row means this is happening. A single-value header needs no ' +
+		'trusted proxies, so this warning is expected on a plain single-proxy setup.'
 	);
 }
 

src/models/admin/admin.middleware.ts

@@ -2,7 +2,7 @@ import express from 'express';
 import {fromNodeHeaders} from 'better-auth/node';
 import {auth} from './admin.auth.js';
 import * as UsersService from './users/users.admin.service.js';
-import {AppName} from './admin.schema.js';
+import {AppName, AppPermission, AppRole} from './admin.schema.js';
 import {sendServerError} from './admin.errors.js';
 
 /**
@@ -28,6 +28,9 @@ export interface AdminIdentity {
 
 export interface AdminAccess extends AdminIdentity {
 	disabled: boolean;
+	/** Every (app, role) grant. */
+	permissions: AppPermission[];
+	/** The distinct apps those grants cover. */
 	apps: AppName[];
 }
 
@@ -59,6 +62,7 @@ export const resolveAccess = async (req: express.Request): Promise<AdminAccess |
 		email: access.email,
 		displayName: access.displayName,
 		disabled: access.disabled,
+		permissions: access.permissions,
 		apps: access.apps
 	};
 };
@@ -97,8 +101,12 @@ export const requireSignedIn: express.RequestHandler = async (req, res, next) =>
  * what feedback.auth.ts's requireAdminAuth used to be, except that it now
  * answers 403 for a signed-in user without that app's permission instead of
  * letting any activated @nachklang.art account in.
+ *
+ * The optional second argument narrows it to one role within the app. Nothing
+ * passes it today - every app has exactly the `access` role - but it is the
+ * seam a finer permission arrives through.
  */
-export const requireAppAccess = (app: AppName): express.RequestHandler => {
+export const requireAppAccess = (app: AppName, role?: AppRole): express.RequestHandler => {
 	return async (req, res, next) => {
 		try {
 			const access = await resolveAccess(req);
@@ -110,7 +118,15 @@ export const requireAppAccess = (app: AppName): express.RequestHandler => {
 				forbidden(res, 'Dieses Konto ist deaktiviert.');
 				return;
 			}
-			if (!access.apps.includes(app)) {
+
+			// Without a role this asks "may they open this app at all?", which is
+			// any grant on it. With one it asks for that specific grant - the hook
+			// a finer permission plugs into, without touching existing call sites.
+			const allowed = role === undefined
+				? access.apps.includes(app)
+				: access.permissions.some(permission => permission.app === app && permission.role === role);
+
+			if (!allowed) {
 				forbidden(res, 'Für diesen Bereich fehlt dir die Berechtigung.');
 				return;
 			}

src/models/admin/admin.schema.ts

@@ -19,6 +19,87 @@ export const isAppName = (value: unknown): value is AppName => {
 	return typeof value === 'string' && (APP_NAMES as string[]).includes(value);
 };
 
+/**
+ * A permission is (app, role), not just an app. Today every app has exactly one
+ * role - `access`, "may use this app at all" - so the model looks like a plain
+ * list of apps and the UI renders one checkbox each. It is written this way
+ * anyway because the alternative gets expensive fast: `user_app_permissions`
+ * has primary key (user_id, app, role), so a user can hold several roles for
+ * the same app, and adding one later is a string in APP_ROLES plus rows - never
+ * a schema migration and never a change to the shape on the wire.
+ *
+ * Note the role is deliberately NOT called `admin`, which is what the column
+ * defaulted to before: on a `tickets` row that reads as "tickets administrator"
+ * when it only ever meant "has access", and once real roles exist there would
+ * be no way to tell the two apart.
+ */
+export const ACCESS_ROLE = 'access';
+
+export type AppRole = string;
+
+/** Every role that exists, per app, in display order. Extend to add one. */
+export const APP_ROLES: Record<AppName, readonly AppRole[]> = {
+	calendar: [ACCESS_ROLE],
+	feedback: [ACCESS_ROLE],
+	tickets: [ACCESS_ROLE],
+	admin: [ACCESS_ROLE]
+};
+
+export interface AppPermission {
+	app: AppName;
+	role: AppRole;
+}
+
+export const isAppRole = (app: AppName, role: unknown): role is AppRole => {
+	return typeof role === 'string' && APP_ROLES[app].includes(role);
+};
+
+export const isAppPermission = (value: unknown): value is AppPermission => {
+	if (typeof value !== 'object' || value === null) {
+		return false;
+	}
+	const candidate = value as {app?: unknown; role?: unknown};
+	return isAppName(candidate.app) && isAppRole(candidate.app, candidate.role);
+};
+
+/**
+ * Normalises whatever a caller sent into a valid, duplicate-free permission
+ * list. Accepts the richer `{app, role}` form and the plain `AppName` form,
+ * because `{apps: ['tickets']}` is still what the older callers send and it
+ * means exactly "tickets at the access role".
+ */
+export const toPermissions = (value: unknown): AppPermission[] | null => {
+	if (!Array.isArray(value)) {
+		return null;
+	}
+
+	const permissions: AppPermission[] = [];
+	for (const entry of value) {
+		if (isAppName(entry)) {
+			permissions.push({app: entry, role: ACCESS_ROLE});
+		} else if (isAppPermission(entry)) {
+			permissions.push({app: entry.app, role: entry.role});
+		} else {
+			return null;
+		}
+	}
+
+	const seen = new Set<string>();
+	return permissions.filter(permission => {
+		const key = `${permission.app}:${permission.role}`;
+		if (seen.has(key)) {
+			return false;
+		}
+		seen.add(key);
+		return true;
+	});
+};
+
+/** The distinct apps a permission list grants any access to. */
+export const appsOf = (permissions: AppPermission[]): AppName[] => {
+	return APP_NAMES.filter(app => permissions.some(permission => permission.app === app));
+};
+
 export interface UserTable {
 	id: string;
 	name: string;
@@ -52,7 +133,7 @@ export interface PasskeyTable {
 export interface UserAppPermissionTable {
 	user_id: string;
 	app: AppName;
-	role: string;
+	role: AppRole;
 	granted_by: string | null;
 	granted_at: Generated<Date>;
 }
@@ -63,8 +144,9 @@ export interface InvitationTable {
 	email: string;
 	name: string;
 	token_hash: string;
-	// JSON column holding an AppName[].
-	apps: string;
+	// JSON column holding an AppPermission[]. Older rows may hold a plain
+	// AppName[]; `parsePermissions` reads both.
+	permissions: string;
 	invited_by: string | null;
 	created_at: Generated<Date>;
 	expires_at: Date;

src/models/admin/invitations/invitations.plugin.ts

@@ -147,7 +147,7 @@ export const invitationsPlugin = () => {
 							return created;
 						});
 
-						await UsersService.setPermissions(user.id, invitation.apps, null);
+						await UsersService.setPermissions(user.id, invitation.permissions, null);
 
 						const session = await ctx.context.internalAdapter.createSession(user.id);
 						await setSessionCookie(ctx, {session, user});

src/models/admin/invitations/invitations.router.ts

@@ -1,7 +1,7 @@
 import express, {Request, Response} from 'express';
 import * as InvitationsService from './invitations.service.js';
 import * as UsersService from '../users/users.admin.service.js';
-import {isAppName, AppName} from '../admin.schema.js';
+import {toPermissions} from '../admin.schema.js';
 import {sendInvitationMail} from '../admin.mail.js';
 import {ADMIN_APP_URL, LOG_INVITE_LINKS} from '../admin.config.js';
 import {sendServerError} from '../admin.errors.js';
@@ -64,16 +64,24 @@ invitationsRouter.get('/', async (req: Request, res: Response) => {
  *                  application/json:
  *                      schema:
  *                          type: object
- *                          required: [email, name, apps]
+ *                          required: [email, name, permissions]
  *                          properties:
  *                              email:
  *                                  type: string
  *                              name:
  *                                  type: string
- *                              apps:
+ *                              permissions:
  *                                  type: array
+ *                                  description: >
+ *                                      One entry per (app, role). A plain array of app names is
+ *                                      accepted too and means the same at the `access` role.
  *                                  items:
- *                                      type: string
+ *                                      type: object
+ *                                      properties:
+ *                                          app:
+ *                                              type: string
+ *                                          role:
+ *                                              type: string
  *          responses:
  *              201:
  *                  description: Invitation created and mailed
@@ -86,10 +94,15 @@ invitationsRouter.post('/', async (req: Request, res: Response) => {
 	try {
 		const email = String(req.body?.email || '').trim().toLowerCase();
 		const name = String(req.body?.name || '').trim();
-		const apps: unknown = req.body?.apps;
 
-		if (!EMAIL_PATTERN.test(email) || name.length === 0 || !Array.isArray(apps) || !apps.every(isAppName)) {
-			res.status(400).send({status: 'BAD_REQUEST', message: 'E-Mail, Name und App-Liste sind erforderlich.'});
+		// Same two accepted shapes as PUT /admin/users/:id/permissions.
+		const permissions = toPermissions(req.body?.permissions ?? req.body?.apps);
+
+		if (!EMAIL_PATTERN.test(email) || name.length === 0 || !permissions) {
+			res.status(400).send({
+				status: 'BAD_REQUEST',
+				message: 'E-Mail, Name und Berechtigungen sind erforderlich.'
+			});
 			return;
 		}
 
@@ -107,7 +120,7 @@ invitationsRouter.post('/', async (req: Request, res: Response) => {
 		const invitation = await InvitationsService.createInvitation(
 			email,
 			name,
-			apps as AppName[],
+			permissions,
 			res.locals.admin.id
 		);
 

src/models/admin/invitations/invitations.service.ts

@@ -1,6 +1,6 @@
 import * as crypto from 'crypto';
 import {NachklangAdminDB} from '../Admin.db.js';
-import {AppName, APP_NAMES, isAppName} from '../admin.schema.js';
+import {AppPermission, isAppName, isAppPermission, ACCESS_ROLE} from '../admin.schema.js';
 
 const db = NachklangAdminDB.db;
 
@@ -19,7 +19,7 @@ export interface OpenInvitation {
 	id: number;
 	email: string;
 	name: string;
-	apps: AppName[];
+	permissions: AppPermission[];
 	invitedBy: string | null;
 	createdAt: Date;
 	expiresAt: Date;
@@ -29,7 +29,7 @@ export interface AcceptableInvitation {
 	id: number;
 	email: string;
 	name: string;
-	apps: AppName[];
+	permissions: AppPermission[];
 }
 
 const hashToken = (token: string): string => {
@@ -41,11 +41,28 @@ const generateToken = (): string => {
 	return crypto.randomBytes(32).toString('base64url');
 };
 
-const parseApps = (value: unknown): AppName[] => {
-	// mysql2 hands back a JSON column already parsed; a driver or column-type
-	// change that turns it into a string must not break the read path.
+/**
+ * Reads the stored permission list. Two shapes are accepted: the current
+ * `[{app, role}]`, and a bare `['tickets', ...]` from before roles existed,
+ * which means the same thing at the `access` role. Invitations live for seven
+ * days, so a deploy that changes the shape has in-flight rows in the old one -
+ * tolerating both is what stops those invitees from being stranded.
+ *
+ * mysql2 hands back a JSON column already parsed; a driver or column-type
+ * change that turns it into a string must not break the read path either.
+ */
+const parsePermissions = (value: unknown): AppPermission[] => {
 	const raw = typeof value === 'string' ? JSON.parse(value) : value;
-	return Array.isArray(raw) ? raw.filter(isAppName) : [];
+	if (!Array.isArray(raw)) {
+		return [];
+	}
+
+	return raw.flatMap((entry): AppPermission[] => {
+		if (isAppName(entry)) {
+			return [{app: entry, role: ACCESS_ROLE}];
+		}
+		return isAppPermission(entry) ? [{app: entry.app, role: entry.role}] : [];
+	});
 };
 
 const expiryFromNow = (): Date => {
@@ -61,12 +78,12 @@ const expiryFromNow = (): Date => {
 export const createInvitation = async (
 	email: string,
 	name: string,
-	apps: AppName[],
+	permissions: AppPermission[],
 	invitedBy: string | null
 ): Promise<{id: number; token: string; expiresAt: Date}> => {
 	const token = generateToken();
 	const expiresAt = expiryFromNow();
-	const validApps = Array.from(new Set(apps)).filter(app => APP_NAMES.includes(app));
+	const valid = permissions.filter(isAppPermission);
 
 	const id = await db.transaction().execute(async trx => {
 		await trx
@@ -83,7 +100,7 @@ export const createInvitation = async (
 				email,
 				name,
 				token_hash: hashToken(token),
-				apps: JSON.stringify(validApps),
+				permissions: JSON.stringify(valid),
 				invited_by: invitedBy,
 				created_at: new Date(),
 				expires_at: expiresAt
@@ -105,7 +122,7 @@ export const createInvitation = async (
 export const findByToken = async (token: string): Promise<AcceptableInvitation | null> => {
 	const row = await db
 		.selectFrom('invitations')
-		.select(['id', 'email', 'name', 'apps'])
+		.select(['id', 'email', 'name', 'permissions'])
 		.where('token_hash', '=', hashToken(token))
 		.where('accepted_at', 'is', null)
 		.where('revoked_at', 'is', null)
@@ -116,7 +133,7 @@ export const findByToken = async (token: string): Promise<AcceptableInvitation |
 		return null;
 	}
 
-	return {id: row.id, email: row.email, name: row.name, apps: parseApps(row.apps)};
+	return {id: row.id, email: row.email, name: row.name, permissions: parsePermissions(row.permissions)};
 };
 
 /** Marks the invitation accepted. Conditional on it still being open so two
@@ -149,7 +166,7 @@ export const unmarkAccepted = async (invitationId: number): Promise<void> => {
 export const listOpenInvitations = async (): Promise<OpenInvitation[]> => {
 	const rows = await db
 		.selectFrom('invitations')
-		.select(['id', 'email', 'name', 'apps', 'invited_by', 'created_at', 'expires_at'])
+		.select(['id', 'email', 'name', 'permissions', 'invited_by', 'created_at', 'expires_at'])
 		.where('accepted_at', 'is', null)
 		.where('revoked_at', 'is', null)
 		.where('expires_at', '>', new Date())
@@ -160,7 +177,7 @@ export const listOpenInvitations = async (): Promise<OpenInvitation[]> => {
 		id: row.id,
 		email: row.email,
 		name: row.name,
-		apps: parseApps(row.apps),
+		permissions: parsePermissions(row.permissions),
 		invitedBy: row.invited_by,
 		createdAt: row.created_at,
 		expiresAt: row.expires_at

src/models/admin/users/users.admin.router.ts

@@ -1,6 +1,6 @@
 import express, {Request, Response} from 'express';
 import * as UsersService from './users.admin.service.js';
-import {AppName, isAppName} from '../admin.schema.js';
+import {toPermissions} from '../admin.schema.js';
 import {sendServerError} from '../admin.errors.js';
 
 export const usersAdminRouter = express.Router();
@@ -90,26 +90,40 @@ usersAdminRouter.get('/:userId', async (req: Request, res: Response) => {
  *                      schema:
  *                          type: object
  *                          properties:
- *                              apps:
+ *                              permissions:
  *                                  type: array
+ *                                  description: >
+ *                                      One entry per (app, role). `access` is the only role today.
+ *                                      A plain array of app names is also accepted and means the
+ *                                      same at the `access` role.
  *                                  items:
- *                                      type: string
- *                                      enum: [calendar, feedback, tickets, admin]
+ *                                      type: object
+ *                                      properties:
+ *                                          app:
+ *                                              type: string
+ *                                              enum: [calendar, feedback, tickets, admin]
+ *                                          role:
+ *                                              type: string
+ *                                              enum: [access]
  *          responses:
  *              200:
  *                  description: Success
  *              400:
- *                  description: Invalid app name
+ *                  description: Invalid app or role
  *              409:
  *                  description: Would lock the last admin out
  */
 usersAdminRouter.put('/:userId/permissions', async (req: Request, res: Response) => {
 	try {
 		const userId = req.params.userId;
-		const apps: unknown = req.body?.apps;
 
-		if (!Array.isArray(apps) || !apps.every(isAppName)) {
-			res.status(400).send({status: 'BAD_REQUEST', message: 'Ungültige App-Liste.'});
+		// `permissions: [{app, role}]` is the real shape; `apps: ['tickets']` is
+		// accepted as shorthand for the same thing at the `access` role, so a
+		// caller that predates roles keeps working.
+		const permissions = toPermissions(req.body?.permissions ?? req.body?.apps);
+
+		if (!permissions) {
+			res.status(400).send({status: 'BAD_REQUEST', message: 'Ungültige Berechtigungsliste.'});
 			return;
 		}
 
@@ -119,7 +133,8 @@ usersAdminRouter.put('/:userId/permissions', async (req: Request, res: Response)
 		}
 
 		const target = await UsersService.loadAccess(userId);
-		const losesAdmin = Boolean(target?.apps.includes('admin')) && !(apps as AppName[]).includes('admin');
+		const keepsAdmin = permissions.some(permission => permission.app === 'admin');
+		const losesAdmin = Boolean(target?.apps.includes('admin')) && !keepsAdmin;
 
 		// Self-lockout is checked here because it needs the caller's identity,
 		// which the service has no business knowing. The last-admin check is
@@ -130,7 +145,7 @@ usersAdminRouter.put('/:userId/permissions', async (req: Request, res: Response)
 			return;
 		}
 
-		const result = await UsersService.setPermissionsGuarded(userId, apps as AppName[], res.locals.admin.id);
+		const result = await UsersService.setPermissionsGuarded(userId, permissions, res.locals.admin.id);
 		if (result === 'last-admin') {
 			conflict(res, 'Die letzte Admin-Berechtigung kann nicht entzogen werden.');
 			return;

src/models/admin/users/users.admin.service.ts

@@ -1,6 +1,15 @@
 import {Transaction} from 'kysely';
 import {NachklangAdminDB} from '../Admin.db.js';
-import {AdminDatabase, AppName, APP_NAMES} from '../admin.schema.js';
+import {
+	AdminDatabase,
+	AppName,
+	AppPermission,
+	AppRole,
+	ACCESS_ROLE,
+	appsOf,
+	isAppName,
+	isAppRole
+} from '../admin.schema.js';
 
 const db = NachklangAdminDB.db;
 
@@ -18,6 +27,10 @@ export interface UserAccess {
 	email: string;
 	displayName: string;
 	disabled: boolean;
+	/** Every (app, role) grant this user holds. */
+	permissions: AppPermission[];
+	/** The distinct apps the above grants any access to. Derived, kept because
+	 *  most callers only ever ask "may they open this app at all?". */
 	apps: AppName[];
 }
 
@@ -27,6 +40,7 @@ export interface UserListEntry {
 	id: string;
 	email: string;
 	name: string;
+	permissions: AppPermission[];
 	apps: AppName[];
 	status: UserStatus;
 	createdAt: Date;
@@ -61,7 +75,8 @@ export const loadAccess = async (userId: string): Promise<UserAccess | null> =>
 			'user.email as email',
 			'user.name as name',
 			'user.disabled as disabled',
-			'user_app_permissions.app as app'
+			'user_app_permissions.app as app',
+			'user_app_permissions.role as role'
 		])
 		.execute();
 
@@ -69,16 +84,32 @@ export const loadAccess = async (userId: string): Promise<UserAccess | null> =>
 		return null;
 	}
 
+	const permissions = toPermissionRows(rows);
+
 	return {
 		id: rows[0].id,
 		email: rows[0].email,
 		displayName: rows[0].name,
 		// MySQL TINYINT(1) comes back as 0/1 through mysql2.
 		disabled: Boolean(rows[0].disabled),
-		apps: rows.map(row => row.app).filter((app): app is AppName => app !== null)
+		permissions,
+		apps: appsOf(permissions)
 	};
 };
 
+/**
+ * Turns joined permission rows into AppPermission[]. The left join produces one
+ * row with a null app for a user who holds nothing, and a role written directly
+ * into the database that no longer appears in APP_ROLES is dropped rather than
+ * trusted - the table is the store, APP_ROLES is the contract.
+ */
+const toPermissionRows = (rows: {app: AppName | null; role: string | null}[]): AppPermission[] => {
+	return rows
+		.filter((row): row is {app: AppName; role: string} =>
+			isAppName(row.app) && isAppRole(row.app, row.role))
+		.map(row => ({app: row.app, role: row.role}));
+};
+
 export const listUsers = async (): Promise<UserListEntry[]> => {
 	const users = await db
 		.selectFrom('user')
@@ -88,7 +119,7 @@ export const listUsers = async (): Promise<UserListEntry[]> => {
 
 	const permissions = await db
 		.selectFrom('user_app_permissions')
-		.select(['user_id', 'app'])
+		.select(['user_id', 'app', 'role'])
 		.execute();
 
 	// Last sign-in is derived from the newest session rather than stored: a
@@ -107,26 +138,33 @@ export const listUsers = async (): Promise<UserListEntry[]> => {
 		.groupBy('userId')
 		.execute();
 
-	const appsByUser = new Map<string, AppName[]>();
+	const permissionsByUser = new Map<string, AppPermission[]>();
 	for (const row of permissions) {
-		const apps = appsByUser.get(row.user_id) || [];
-		apps.push(row.app);
-		appsByUser.set(row.user_id, apps);
+		if (!isAppRole(row.app, row.role)) {
+			continue;
+		}
+		const held = permissionsByUser.get(row.user_id) || [];
+		held.push({app: row.app, role: row.role});
+		permissionsByUser.set(row.user_id, held);
 	}
 
 	const lastSignInByUser = new Map<string, Date | null>(
 		lastSessions.map(row => [row.userId, row.lastSignInAt as Date | null])
 	);
 
-	return users.map(user => ({
-		id: user.id,
-		email: user.email,
-		name: user.name,
-		apps: appsByUser.get(user.id) || [],
-		status: user.disabled ? 'deaktiviert' : 'aktiv',
-		createdAt: user.createdAt,
-		lastSignInAt: lastSignInByUser.get(user.id) ?? null
-	}));
+	return users.map(user => {
+		const held = permissionsByUser.get(user.id) || [];
+		return {
+			id: user.id,
+			email: user.email,
+			name: user.name,
+			permissions: held,
+			apps: appsOf(held),
+			status: user.disabled ? ('deaktiviert' as const) : ('aktiv' as const),
+			createdAt: user.createdAt,
+			lastSignInAt: lastSignInByUser.get(user.id) ?? null
+		};
+	});
 };
 
 export const getUserDetail = async (userId: string): Promise<UserDetail | null> => {
@@ -141,7 +179,11 @@ export const getUserDetail = async (userId: string): Promise<UserDetail | null>
 	}
 
 	const [permissions, sessions, passkeys] = await Promise.all([
-		db.selectFrom('user_app_permissions').select('app').where('user_id', '=', userId).execute(),
+		db
+			.selectFrom('user_app_permissions')
+			.select(['app', 'role'])
+			.where('user_id', '=', userId)
+			.execute(),
 		db
 			.selectFrom('session')
 			.select(['id', 'createdAt', 'expiresAt', 'ipAddress', 'userAgent'])
@@ -156,11 +198,14 @@ export const getUserDetail = async (userId: string): Promise<UserDetail | null>
 			.executeTakeFirst()
 	]);
 
+	const held = toPermissionRows(permissions);
+
 	return {
 		id: user.id,
 		email: user.email,
 		name: user.name,
-		apps: permissions.map(row => row.app),
+		permissions: held,
+		apps: appsOf(held),
 		status: user.disabled ? 'deaktiviert' : 'aktiv',
 		createdAt: user.createdAt,
 		lastSignInAt: sessions.length > 0 ? sessions[0].createdAt : null,
@@ -174,25 +219,51 @@ export const getUserDetail = async (userId: string): Promise<UserDetail | null>
  * transaction rather than a diff: the set is at most four rows, and a diff
  * would only add branches for no measurable gain.
  */
+
+/** The rows a permission list becomes. One row per (app, role). */
+const permissionRows = (
+	userId: string,
+	permissions: AppPermission[],
+	grantedBy: string | null
+) => {
+	return permissions.map(permission => ({
+		user_id: userId,
+		app: permission.app,
+		role: permission.role,
+		granted_by: grantedBy,
+		granted_at: new Date()
+	}));
+};
+
+/** Drops anything not in APP_ROLES and de-duplicates on (app, role). */
+const validPermissions = (permissions: AppPermission[]): AppPermission[] => {
+	const seen = new Set<string>();
+	return permissions.filter(permission => {
+		if (!isAppName(permission.app) || !isAppRole(permission.app, permission.role)) {
+			return false;
+		}
+		const key = `${permission.app}:${permission.role}`;
+		if (seen.has(key)) {
+			return false;
+		}
+		seen.add(key);
+		return true;
+	});
+};
+
 export const setPermissions = async (
 	userId: string,
-	apps: AppName[],
+	permissions: AppPermission[],
 	grantedBy: string | null
 ): Promise<void> => {
-	const unique = Array.from(new Set(apps)).filter(app => APP_NAMES.includes(app));
+	const valid = validPermissions(permissions);
 
 	await db.transaction().execute(async trx => {
 		await trx.deleteFrom('user_app_permissions').where('user_id', '=', userId).execute();
-		if (unique.length > 0) {
+		if (valid.length > 0) {
 			await trx
 				.insertInto('user_app_permissions')
-				.values(unique.map(app => ({
-					user_id: userId,
-					app,
-					role: 'admin',
-					granted_by: grantedBy,
-					granted_at: new Date()
-				})))
+				.values(permissionRows(userId, valid, grantedBy))
 				.execute();
 		}
 	});
@@ -217,7 +288,11 @@ const countActiveAdminsForUpdate = async (trx: Transaction<AdminDatabase>): Prom
 		.innerJoin('user', 'user.id', 'user_app_permissions.user_id')
 		.where('user_app_permissions.app', '=', 'admin')
 		.where('user.disabled', '=', false)
-		.select(({fn}) => fn.countAll<number>().as('count'))
+		// countDistinct, not countAll: with (user_id, app, role) as the key one
+		// user can hold several roles on `admin`, and counting rows would make a
+		// single admin with two roles look like two admins - defeating the guard
+		// at exactly the moment it matters.
+		.select(({fn}) => fn.count<number>('user_app_permissions.user_id').distinct().as('count'))
 		.forUpdate()
 		.executeTakeFirst();
 
@@ -230,10 +305,11 @@ const countActiveAdminsForUpdate = async (trx: Transaction<AdminDatabase>): Prom
  */
 export const setPermissionsGuarded = async (
 	userId: string,
-	apps: AppName[],
+	permissions: AppPermission[],
 	grantedBy: string | null
 ): Promise<LastAdminGuardResult> => {
-	const unique = Array.from(new Set(apps)).filter(app => APP_NAMES.includes(app));
+	const valid = validPermissions(permissions);
+	const keepsAdmin = valid.some(permission => permission.app === 'admin');
 
 	return db.transaction().execute(async trx => {
 		const target = await trx
@@ -242,25 +318,20 @@ export const setPermissionsGuarded = async (
 			.where('user_app_permissions.user_id', '=', userId)
 			.where('user_app_permissions.app', '=', 'admin')
 			.select(['user.disabled as disabled'])
+			.limit(1)
 			.forUpdate()
 			.executeTakeFirst();
 
-		const losesAdmin = Boolean(target) && !unique.includes('admin');
+		const losesAdmin = Boolean(target) && !keepsAdmin;
 		if (losesAdmin && !target?.disabled && (await countActiveAdminsForUpdate(trx)) <= 1) {
 			return 'last-admin';
 		}
 
 		await trx.deleteFrom('user_app_permissions').where('user_id', '=', userId).execute();
-		if (unique.length > 0) {
+		if (valid.length > 0) {
 			await trx
 				.insertInto('user_app_permissions')
-				.values(unique.map(app => ({
-					user_id: userId,
-					app,
-					role: 'admin',
-					granted_by: grantedBy,
-					granted_at: new Date()
-				})))
+				.values(permissionRows(userId, valid, grantedBy))
 				.execute();
 		}
 
@@ -281,6 +352,7 @@ export const disableUserGuarded = async (userId: string): Promise<LastAdminGuard
 			.where('user_app_permissions.app', '=', 'admin')
 			.where('user.disabled', '=', false)
 			.select('user_app_permissions.user_id')
+			.limit(1)
 			.forUpdate()
 			.executeTakeFirst();
 
@@ -298,12 +370,16 @@ export const disableUserGuarded = async (userId: string): Promise<LastAdminGuard
 export const grantPermission = async (
 	userId: string,
 	app: AppName,
-	grantedBy: string | null
+	grantedBy: string | null,
+	role: AppRole = ACCESS_ROLE
 ): Promise<void> => {
 	await db
 		.insertInto('user_app_permissions')
-		.values({user_id: userId, app, role: 'admin', granted_by: grantedBy, granted_at: new Date()})
-		.onDuplicateKeyUpdate({role: 'admin'})
+		.values({user_id: userId, app, role, granted_by: grantedBy, granted_at: new Date()})
+		// The row already existing is the success case - this is "make sure they
+		// hold it", not "re-grant it" - so nothing is overwritten and granted_by
+		// keeps naming whoever granted it first.
+		.onDuplicateKeyUpdate({role})
 		.execute();
 };
 

src/models/feedback/admin/admin.interface.ts

@@ -1,19 +1,6 @@
 /**
  * @swagger
  * components:
- *   parameters:
- *     SessionIdHeader:
- *       in: header
- *       name: X-Session-Id
- *       required: true
- *       schema:
- *         type: string
- *     SessionKeyHeader:
- *       in: header
- *       name: X-Session-Key
- *       required: true
- *       schema:
- *         type: string
  *   schemas:
  *     EventAdminSummary:
  *       type: object

src/models/feedback/admin/admin.router.ts

@@ -26,9 +26,8 @@ adminRouter.use(requireAdminAuth);
  *          summary: Validate the current admin session
  *          description: Used by the Next.js middleware/proxy to gate /admin. Returns the authenticated admin's identity.
  *          tags: [feedback-admin]
- *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
+ *          security:
+ *              - AdminSessionCookie: []
  *          responses:
  *              200:
  *                  description: Success
@@ -43,6 +42,8 @@ adminRouter.use(requireAdminAuth);
  *                                      type: string
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 adminRouter.get('/me', (req: Request, res: Response) => {
 	res.status(200).send({email: res.locals.admin.email, fullName: res.locals.admin.displayName});
@@ -55,9 +56,9 @@ adminRouter.get('/me', (req: Request, res: Response) => {
  *          summary: Delete a single submission
  *          description: Removes the submission and everything under it (its answers, guest book entry, newsletter signup) - for removing an individual abusive or inappropriate entry. Not a bulk moderation tool.
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: submissionId
  *                required: true
@@ -70,6 +71,8 @@ adminRouter.get('/me', (req: Request, res: Response) => {
  *                  description: Unknown submission
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 adminRouter.delete('/submissions/:submissionId', async (req: Request, res: Response) => {
 	try {

src/models/feedback/admin/events.admin.router.ts

@@ -18,9 +18,8 @@ export const eventsAdminRouter = express.Router();
  *          summary: List all events (admin)
  *          description: All events, published or not, past or future, with submission counts.
  *          tags: [feedback-admin]
- *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
+ *          security:
+ *              - AdminSessionCookie: []
  *          responses:
  *              200:
  *                  description: Success
@@ -32,13 +31,14 @@ export const eventsAdminRouter = express.Router();
  *                                  $ref: '#/components/schemas/EventAdminSummary'
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  *      post:
  *          summary: Create an event
  *          description: Auto-generates the slug from the name and event year; defaults feedback_deadline to event_date + 14 days 23:59:59 unless supplied.
  *          tags: [feedback-admin]
- *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
+ *          security:
+ *              - AdminSessionCookie: []
  *          requestBody:
  *              required: true
  *              content:
@@ -68,6 +68,8 @@ export const eventsAdminRouter = express.Router();
  *                  description: Missing required fields
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/', async (req: Request, res: Response) => {
 	try {
@@ -101,9 +103,9 @@ eventsAdminRouter.post('/', async (req: Request, res: Response) => {
  *          summary: Get one event (admin)
  *          description: Full event detail including setlist and assigned questions.
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -120,12 +122,14 @@ eventsAdminRouter.post('/', async (req: Request, res: Response) => {
  *                  description: Unknown event
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  *      put:
  *          summary: Update an event
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -138,13 +142,15 @@ eventsAdminRouter.post('/', async (req: Request, res: Response) => {
  *                  description: Unknown event
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  *      delete:
  *          summary: Delete an event
  *          description: Refuses with 409 if submissions exist unless ?force=true is passed.
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -163,6 +169,8 @@ eventsAdminRouter.post('/', async (req: Request, res: Response) => {
  *                  description: Submissions exist and force was not set
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/:eventId', async (req: Request, res: Response) => {
 	try {
@@ -214,9 +222,9 @@ eventsAdminRouter.delete('/:eventId', async (req: Request, res: Response) => {
  *      get:
  *          summary: Get an event's setlist
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -227,12 +235,14 @@ eventsAdminRouter.delete('/:eventId', async (req: Request, res: Response) => {
  *                  description: Success
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  *      post:
  *          summary: Add a song to an event's setlist
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -257,6 +267,8 @@ eventsAdminRouter.delete('/:eventId', async (req: Request, res: Response) => {
  *                  description: Missing title
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/:eventId/songs', async (req: Request, res: Response) => {
 	try {
@@ -292,9 +304,9 @@ eventsAdminRouter.post('/:eventId/songs', async (req: Request, res: Response) =>
  *          summary: Bulk reorder an event's setlist
  *          description: Rewrites song positions as a dense 0..n-1 sequence in one transaction.
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -317,6 +329,8 @@ eventsAdminRouter.post('/:eventId/songs', async (req: Request, res: Response) =>
  *                  description: Reordered
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.put('/:eventId/songs/order', async (req: Request, res: Response) => {
 	try {
@@ -334,9 +348,9 @@ eventsAdminRouter.put('/:eventId/songs/order', async (req: Request, res: Respons
  *      get:
  *          summary: Get an event's assigned questions
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -347,13 +361,15 @@ eventsAdminRouter.put('/:eventId/songs/order', async (req: Request, res: Respons
  *                  description: Success
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  *      put:
  *          summary: Bulk-set an event's assigned questions
  *          description: One transaction - inserts new, updates existing, deletes removed. Keeps the admin UI a simple save-the-whole-list form.
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -383,6 +399,8 @@ eventsAdminRouter.put('/:eventId/songs/order', async (req: Request, res: Respons
  *                  description: Saved
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/:eventId/questions', async (req: Request, res: Response) => {
 	try {

src/models/feedback/admin/questions.admin.router.ts

@@ -16,9 +16,9 @@ export const questionsAdminRouter = express.Router();
  *      get:
  *          summary: List the question library
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: query
  *                name: includeArchived
  *                schema:
@@ -34,12 +34,13 @@ export const questionsAdminRouter = express.Router();
  *                                  $ref: '#/components/schemas/AdminQuestion'
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  *      post:
  *          summary: Create a question
  *          tags: [feedback-admin]
- *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
+ *          security:
+ *              - AdminSessionCookie: []
  *          requestBody:
  *              required: true
  *              content:
@@ -61,6 +62,8 @@ export const questionsAdminRouter = express.Router();
  *                  description: Missing or invalid fields
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 questionsAdminRouter.get('/', async (req: Request, res: Response) => {
 	try {
@@ -94,9 +97,9 @@ questionsAdminRouter.post('/', async (req: Request, res: Response) => {
  *          summary: Edit a question's label/help text
  *          description: question_type is immutable after creation - the admin UI offers "archive and create new" instead.
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: questionId
  *                required: true
@@ -123,13 +126,15 @@ questionsAdminRouter.post('/', async (req: Request, res: Response) => {
  *                  description: Unknown question
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  *      delete:
  *          summary: Archive (or hard-delete) a question
  *          description: Archives the question if it has ever been used; hard-deletes it if it has never been assigned to any event.
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: questionId
  *                required: true
@@ -142,6 +147,8 @@ questionsAdminRouter.post('/', async (req: Request, res: Response) => {
  *                  description: Unknown question
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 questionsAdminRouter.put('/:questionId', async (req: Request, res: Response) => {
 	try {

src/models/feedback/admin/reports.admin.router.ts

@@ -19,9 +19,9 @@ export const reportsAdminRouter = express.Router();
  *          summary: Aggregated feedback report for one event
  *          description: Song-pick vote counts, song-rating averages, capped free-text list, guest book count, and newsletter sync counts.
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -34,6 +34,8 @@ export const reportsAdminRouter = express.Router();
  *                  description: Unknown event
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 reportsAdminRouter.get('/:eventId/report', async (req: Request, res: Response) => {
 	try {
@@ -55,9 +57,9 @@ reportsAdminRouter.get('/:eventId/report', async (req: Request, res: Response) =
  *          summary: Guest Book entries for one event
  *          description: Newest first, paginated.
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -81,6 +83,8 @@ reportsAdminRouter.get('/:eventId/report', async (req: Request, res: Response) =
  *                  description: Success
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 reportsAdminRouter.get('/:eventId/guestbook', async (req: Request, res: Response) => {
 	try {
@@ -101,9 +105,9 @@ reportsAdminRouter.get('/:eventId/guestbook', async (req: Request, res: Response
  *          summary: Newsletter signups for one event
  *          description: Includes sync_status, so failures can be handled manually. Newest first, paginated.
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -127,6 +131,8 @@ reportsAdminRouter.get('/:eventId/guestbook', async (req: Request, res: Response
  *                  description: Success
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 reportsAdminRouter.get('/:eventId/newsletter', async (req: Request, res: Response) => {
 	try {
@@ -147,9 +153,9 @@ reportsAdminRouter.get('/:eventId/newsletter', async (req: Request, res: Respons
  *          summary: CSV export of all answers for one event
  *          description: Long format, one row per answer. UTF-8 BOM, `;` separator, RFC 4180 escaping, formula-injection guard.
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -162,6 +168,8 @@ reportsAdminRouter.get('/:eventId/newsletter', async (req: Request, res: Respons
  *                      text/csv: {}
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 reportsAdminRouter.get('/:eventId/export/responses.csv', async (req: Request, res: Response) => {
 	try {
@@ -187,9 +195,9 @@ reportsAdminRouter.get('/:eventId/export/responses.csv', async (req: Request, re
  *      get:
  *          summary: CSV export of Guest Book entries for one event
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -202,6 +210,8 @@ reportsAdminRouter.get('/:eventId/export/responses.csv', async (req: Request, re
  *                      text/csv: {}
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 reportsAdminRouter.get('/:eventId/export/guestbook.csv', async (req: Request, res: Response) => {
 	try {

src/models/feedback/admin/songs.admin.router.ts

@@ -16,9 +16,9 @@ export const songsAdminRouter = express.Router();
  *      put:
  *          summary: Edit a song's title/composer
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: songId
  *                required: true
@@ -45,13 +45,15 @@ export const songsAdminRouter = express.Router();
  *                  description: Unknown song
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  *      delete:
  *          summary: Remove a song
  *          description: Past answers keep their song_title_snapshot even after the song is removed.
  *          tags: [feedback-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: songId
  *                required: true
@@ -64,6 +66,8 @@ export const songsAdminRouter = express.Router();
  *                  description: Unknown song
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 songsAdminRouter.put('/:songId', async (req: Request, res: Response) => {
 	try {

src/models/feedback/feedback.auth.ts

@@ -1,78 +1,38 @@
-import express from 'express';
-import * as UserService from '../calendar/users/users.service.js';
-import {sendServerError} from './feedback.errors.js';
+import {requireAppAccess} from '../admin/admin.middleware.js';
 
 /**
  * This file is the ONLY place in the feedback module that knows how admin
- * authentication works today. No route handler and no service outside this
- * file may import users.service, read session headers, or touch bcrypt.
+ * authentication works. No route handler and no service outside this file may
+ * read session headers or resolve a user itself.
  *
- * Today: reuses the existing Calendar users/sessions mechanism. Any
- * activated @nachklang.art account may administer feedback — no roles.
- * Migrating to Keycloak later means writing a keycloakJwtAuthenticator
- * below and changing the one `activeAuthenticator` binding (plus the
- * frontend's login route handler) — nothing else in the feedback module
- * needs to change.
+ * Today: the shared admin identity in `src/models/admin/`. A session cookie
+ * set by /admin/auth on admin.nachklang.art, plus a `feedback` permission on
+ * the account. Both are re-checked on every request, so disabling a user or
+ * taking their feedback permission away takes effect immediately.
  *
- * Explicitly forbidden: accepting sessionId/sessionKey from query
- * parameters, even "temporarily". That is the exact mistake documented in
- * DEFERRED_SECURITY.md item 1 for the Calendar domain, where credentials
- * end up in access logs, browser history, proxy logs, and Referer headers.
- * Headers only.
+ * Before 2026-09-06 this was a header session against the calendar users
+ * table, and any activated @nachklang.art account could administer feedback.
+ * That is why the swap is a one-line binding: everything downstream only ever
+ * saw `requireAdminAuth` and `res.locals.admin`, and both still mean what
+ * they meant. What changed is that access is now granted per user rather than
+ * implied by having an account.
+ *
+ * Explicitly forbidden: accepting session credentials from query parameters,
+ * even "temporarily". That is the exact mistake documented in
+ * DEFERRED_SECURITY.md item 1 for the Calendar domain, where credentials end
+ * up in access logs, browser history, proxy logs, and Referer headers.
  */
 
-// The only thing the rest of the feedback module knows about an admin.
+// The only thing the rest of the feedback module knows about an admin. The
+// shared middleware puts a superset of this on res.locals.admin.
 export interface AdminIdentity {
 	id: string;
 	email: string;
 	displayName: string;
 }
 
-// Pluggable strategy: extract + verify credentials from a request.
-// Returns the identity, or null if unauthenticated. Throws only on
-// infrastructure errors (e.g. the DB being unreachable).
-export type AdminAuthenticator = (req: express.Request) => Promise<AdminIdentity | null>;
-
-// Current implementation: reads X-Session-Id / X-Session-Key headers,
-// delegates to the existing calendar UserService.checkSession(...).
-export const sessionHeaderAuthenticator: AdminAuthenticator = async (req) => {
-	const sessionId = req.header('X-Session-Id');
-	const sessionKey = req.header('X-Session-Key');
-	if (!sessionId || !sessionKey) {
-		return null;
-	}
-
-	const ip = req.ip || '';
-	const user = await UserService.checkSession(sessionId, sessionKey, ip);
-
-	// Mirrors the Calendar domain's own convention: a valid session on an
-	// inactive (not yet activated) account is not sufficient.
-	if (!user || !user.isActive) {
-		return null;
-	}
-
-	return {
-		id: String(user.userId),
-		email: user.email,
-		displayName: user.fullName
-	};
-};
-
-// Swap point: change this one binding to migrate to Keycloak.
-export const activeAuthenticator: AdminAuthenticator = sessionHeaderAuthenticator;
-
 // Express middleware used by every admin route. On success:
-// res.locals.admin = AdminIdentity, calls next(). On failure: 401.
-export const requireAdminAuth: express.RequestHandler = async (req, res, next) => {
-	try {
-		const identity = await activeAuthenticator(req);
-		if (!identity) {
-			res.status(401).send({status: 'UNAUTHORIZED', message: 'Anmeldung erforderlich.'});
-			return;
-		}
-		res.locals.admin = identity;
-		next();
-	} catch (e: any) {
-		sendServerError(res, e);
-	}
-};
+// res.locals.admin = AdminAccess (an AdminIdentity plus permissions), calls
+// next(). On failure: 401 when not signed in, 403 when signed in without the
+// feedback permission.
+export const requireAdminAuth = requireAppAccess('feedback');

src/models/tickets/admin/admin.router.ts

@@ -16,14 +16,15 @@ adminRouter.use(requireAdminAuth);
  *      get:
  *          summary: Validate the current admin session
  *          tags: [tickets-admin]
- *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
+ *          security:
+ *              - AdminSessionCookie: []
  *          responses:
  *              200:
  *                  description: Success
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 adminRouter.get('/me', (req: Request, res: Response) => {
 	res.status(200).send({email: res.locals.admin.email, fullName: res.locals.admin.displayName});

src/models/tickets/admin/events.admin.router.ts

@@ -11,14 +11,15 @@ export const eventsAdminRouter = express.Router();
  *          summary: List concerts for the admin event picker
  *          description: Wraps the Calendar module's public-calendar admin listing (includes DRAFT events).
  *          tags: [tickets-admin]
- *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
+ *          security:
+ *              - AdminSessionCookie: []
  *          responses:
  *              200:
  *                  description: Success
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/', async (req: Request, res: Response) => {
 	try {
@@ -35,14 +36,15 @@ eventsAdminRouter.get('/', async (req: Request, res: Response) => {
  *          summary: List public-calendar events not yet added to the ticket shop
  *          description: Source list for the "add a concert" picker - the public calendar holds more than concerts, so events only appear in the ticket shop once explicitly added.
  *          tags: [tickets-admin]
- *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
+ *          security:
+ *              - AdminSessionCookie: []
  *          responses:
  *              200:
  *                  description: Success
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/available', async (req: Request, res: Response) => {
 	try {
@@ -58,9 +60,9 @@ eventsAdminRouter.get('/available', async (req: Request, res: Response) => {
  *      get:
  *          summary: Get a concert's voucher/capacity stats
  *          tags: [tickets-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -75,6 +77,8 @@ eventsAdminRouter.get('/available', async (req: Request, res: Response) => {
  *                              $ref: '#/components/schemas/EventStats'
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/:eventId/stats', async (req: Request, res: Response) => {
 	try {
@@ -91,9 +95,9 @@ eventsAdminRouter.get('/:eventId/stats', async (req: Request, res: Response) =>
  *          summary: Set a concert's voucher settings
  *          description: Upserts capacity (null = uncapped), redemption deadline (null = none), and whether to collect a mailing address.
  *          tags: [tickets-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -123,6 +127,8 @@ eventsAdminRouter.get('/:eventId/stats', async (req: Request, res: Response) =>
  *                  description: Saved
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.put('/:eventId/settings', async (req: Request, res: Response) => {
 	try {
@@ -149,9 +155,9 @@ eventsAdminRouter.put('/:eventId/settings', async (req: Request, res: Response)
  *          summary: Remove an event from the ticket shop
  *          description: Deletes its settings row, so it drops out of the picker and reappears in the "add" list. Refused with 409 if vouchers already reference the event - existing vouchers/redemptions stay valid either way.
  *          tags: [tickets-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -164,6 +170,8 @@ eventsAdminRouter.put('/:eventId/settings', async (req: Request, res: Response)
  *                  description: Vouchers already reference this event
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.delete('/:eventId/settings', async (req: Request, res: Response) => {
 	try {

src/models/tickets/admin/redemptions.admin.router.ts

@@ -11,9 +11,9 @@ export const redemptionsAdminRouter = express.Router();
  *          summary: List redemptions (admin)
  *          description: Filterable by event and status (ACTIVE/UNDONE).
  *          tags: [tickets-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: query
  *                name: eventId
  *                schema:
@@ -33,6 +33,8 @@ export const redemptionsAdminRouter = express.Router();
  *                                  $ref: '#/components/schemas/RedemptionSummary'
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 redemptionsAdminRouter.get('/', async (req: Request, res: Response) => {
 	try {
@@ -50,9 +52,9 @@ redemptionsAdminRouter.get('/', async (req: Request, res: Response) => {
  *      get:
  *          summary: Get a single redemption (admin)
  *          tags: [tickets-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: redemptionId
  *                required: true
@@ -65,13 +67,15 @@ redemptionsAdminRouter.get('/', async (req: Request, res: Response) => {
  *                  description: Unknown redemption
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  *      patch:
  *          summary: Edit a redemption's contact info and/or guest list
  *          description: Only fields present in the body are changed. Growing the guest count is re-checked against the voucher's max guests and the event's remaining capacity. Logs to the audit trail with an optional admin-supplied reason.
  *          tags: [tickets-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: redemptionId
  *                required: true
@@ -105,6 +109,8 @@ redemptionsAdminRouter.get('/', async (req: Request, res: Response) => {
  *                  description: Not active, exceeds max guests, or exceeds remaining capacity
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 redemptionsAdminRouter.get('/:redemptionId', async (req: Request, res: Response) => {
 	try {
@@ -161,9 +167,9 @@ redemptionsAdminRouter.patch('/:redemptionId', async (req: Request, res: Respons
  *          summary: Undo a redemption
  *          description: Reopens the code (back to UNUSED) and marks the redemption UNDONE. Guest data is kept for the audit trail; a later re-redemption creates a new redemption record.
  *          tags: [tickets-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: redemptionId
  *                required: true
@@ -186,6 +192,8 @@ redemptionsAdminRouter.patch('/:redemptionId', async (req: Request, res: Respons
  *                  description: Redemption is not active
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 redemptionsAdminRouter.post('/:redemptionId/undo', async (req: Request, res: Response) => {
 	try {
@@ -211,9 +219,9 @@ redemptionsAdminRouter.post('/:redemptionId/undo', async (req: Request, res: Res
  *          summary: Resend the redemption confirmation email
  *          description: Rebuilds the confirmation email from the stored redemption data and sends it again, then records the outcome on the redemption. Intended for redemptions whose original confirmation email failed.
  *          tags: [tickets-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: redemptionId
  *                required: true
@@ -230,6 +238,8 @@ redemptionsAdminRouter.post('/:redemptionId/undo', async (req: Request, res: Res
  *                  description: The email relay rejected the send
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 redemptionsAdminRouter.post('/:redemptionId/resend-confirmation', async (req: Request, res: Response) => {
 	try {
@@ -259,9 +269,9 @@ redemptionsAdminRouter.post('/:redemptionId/resend-confirmation', async (req: Re
  *      get:
  *          summary: Get a voucher's admin-action audit trail
  *          tags: [tickets-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: code
  *                required: true
@@ -278,6 +288,8 @@ redemptionsAdminRouter.post('/:redemptionId/resend-confirmation', async (req: Re
  *                                  $ref: '#/components/schemas/AuditLogEntry'
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 export const voucherHistoryRouter = express.Router();
 voucherHistoryRouter.get('/:code/history', async (req: Request, res: Response) => {

src/models/tickets/admin/vouchers.admin.router.ts

@@ -11,9 +11,9 @@ export const vouchersAdminRouter = express.Router();
  *          summary: List vouchers (admin)
  *          description: Filterable by event and status.
  *          tags: [tickets-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: query
  *                name: eventId
  *                schema:
@@ -33,6 +33,8 @@ export const vouchersAdminRouter = express.Router();
  *                                  $ref: '#/components/schemas/VoucherCode'
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 vouchersAdminRouter.get('/', async (req: Request, res: Response) => {
 	try {
@@ -51,9 +53,8 @@ vouchersAdminRouter.get('/', async (req: Request, res: Response) => {
  *          summary: Batch-generate wildcard codes
  *          description: Generates `quantity` codes sharing the same eligible events and max-guest count, grouped under one batchId.
  *          tags: [tickets-admin]
- *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
+ *          security:
+ *              - AdminSessionCookie: []
  *          requestBody:
  *              required: true
  *              content:
@@ -87,6 +88,8 @@ vouchersAdminRouter.get('/', async (req: Request, res: Response) => {
  *                  description: Invalid input
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 vouchersAdminRouter.post('/wildcard', async (req: Request, res: Response) => {
 	try {
@@ -112,9 +115,8 @@ vouchersAdminRouter.post('/wildcard', async (req: Request, res: Response) => {
  *          summary: Bulk-create personalized codes
  *          description: One code per row (name, email, eligible events, max guests), grouped under one batchId.
  *          tags: [tickets-admin]
- *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
+ *          security:
+ *              - AdminSessionCookie: []
  *          requestBody:
  *              required: true
  *              content:
@@ -147,6 +149,8 @@ vouchersAdminRouter.post('/wildcard', async (req: Request, res: Response) => {
  *                  description: Invalid input
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 vouchersAdminRouter.post('/personalized', async (req: Request, res: Response) => {
 	try {
@@ -169,9 +173,9 @@ vouchersAdminRouter.post('/personalized', async (req: Request, res: Response) =>
  *      get:
  *          summary: Get a single voucher (admin)
  *          tags: [tickets-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: code
  *                required: true
@@ -184,6 +188,8 @@ vouchersAdminRouter.post('/personalized', async (req: Request, res: Response) =>
  *                  description: Unknown code
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 vouchersAdminRouter.get('/:code', async (req: Request, res: Response) => {
 	try {
@@ -205,9 +211,9 @@ vouchersAdminRouter.get('/:code', async (req: Request, res: Response) => {
  *          summary: Void an unredeemed code
  *          description: Only allowed while the code is UNUSED. Logs to the voucher's audit trail.
  *          tags: [tickets-admin]
+ *          security:
+ *              - AdminSessionCookie: []
  *          parameters:
- *              - $ref: '#/components/parameters/SessionIdHeader'
- *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: code
  *                required: true
@@ -230,6 +236,8 @@ vouchersAdminRouter.get('/:code', async (req: Request, res: Response) => {
  *                  description: Code is not in UNUSED status
  *              401:
  *                  description: Unauthorized
+ *              403:
+ *                  description: Signed in without the permission for this app, or account disabled
  */
 vouchersAdminRouter.post('/:code/void', async (req: Request, res: Response) => {
 	try {

src/models/tickets/tickets.auth.ts

@@ -1,20 +1,23 @@
-import express from 'express';
-import * as UserService from '../calendar/users/users.service.js';
-import {sendServerError} from './tickets.errors.js';
+import {requireAppAccess} from '../admin/admin.middleware.js';
 
 /**
  * Mirrors the Feedback module's feedback.auth.ts: this is the ONLY place in
  * the tickets module that knows how admin authentication works. No route
- * handler and no service outside this file may import users.service, read
- * session headers, or touch bcrypt.
+ * handler and no service outside this file may read session headers or
+ * resolve a user itself.
  *
- * Today: reuses the existing Calendar users/sessions mechanism. Any
- * activated @nachklang.art account may administer vouchers - no roles, same
- * policy as Feedback (see docs/plan-ticket-shop.md). A dedicated
- * roles/permissions model is explicitly out of scope for v1.
+ * Today: the shared admin identity in `src/models/admin/`. A session cookie
+ * set by /admin/auth on admin.nachklang.art, plus a `tickets` permission on
+ * the account. Both are re-checked on every request, so disabling a user or
+ * taking their tickets permission away takes effect immediately.
  *
- * Explicitly forbidden: accepting sessionId/sessionKey from query
- * parameters - headers only (see DEFERRED_SECURITY.md item 1).
+ * Before 2026-09-06 this was a header session against the calendar users
+ * table, and any activated @nachklang.art account could administer vouchers
+ * (see docs/plan-ticket-shop.md, which called a roles model out of scope for
+ * v1). It is in scope now, and lives in the admin module rather than here.
+ *
+ * Explicitly forbidden: accepting session credentials from query parameters -
+ * see DEFERRED_SECURITY.md item 1.
  */
 
 export interface AdminIdentity {
@@ -23,41 +26,6 @@ export interface AdminIdentity {
 	displayName: string;
 }
 
-export type AdminAuthenticator = (req: express.Request) => Promise<AdminIdentity | null>;
-
-export const sessionHeaderAuthenticator: AdminAuthenticator = async (req) => {
-	const sessionId = req.header('X-Session-Id');
-	const sessionKey = req.header('X-Session-Key');
-	if (!sessionId || !sessionKey) {
-		return null;
-	}
-
-	const ip = req.ip || '';
-	const user = await UserService.checkSession(sessionId, sessionKey, ip);
-
-	if (!user || !user.isActive) {
-		return null;
-	}
-
-	return {
-		id: String(user.userId),
-		email: user.email,
-		displayName: user.fullName
-	};
-};
-
-export const activeAuthenticator: AdminAuthenticator = sessionHeaderAuthenticator;
-
-export const requireAdminAuth: express.RequestHandler = async (req, res, next) => {
-	try {
-		const identity = await activeAuthenticator(req);
-		if (!identity) {
-			res.status(401).send({status: 'UNAUTHORIZED', message: 'Anmeldung erforderlich.'});
-			return;
-		}
-		res.locals.admin = identity;
-		next();
-	} catch (e: any) {
-		sendServerError(res, e);
-	}
-};
+// On failure: 401 when not signed in, 403 when signed in without the tickets
+// permission.
+export const requireAdminAuth = requireAppAccess('tickets');

test/admin/admin.bootstrap.test.ts

@@ -79,7 +79,12 @@ describe('bootstrapAdmin', () => {
 
 		await bootstrapAdmin();
 
-		expect(createInvitation).toHaveBeenCalledWith('boss@nachklang.art', 'Nachklang Admin', ['admin'], null);
+		expect(createInvitation).toHaveBeenCalledWith(
+			'boss@nachklang.art',
+			'Nachklang Admin',
+			[{app: 'admin', role: 'access'}],
+			null
+		);
 		expect(mockMail).toHaveBeenCalled();
 	});
 

test/admin/admin.config.test.ts

@@ -0,0 +1,143 @@
+import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
+
+// admin.config calls dotenv.config(), which would read the repo's own .env and
+// quietly reintroduce NODE_ENV=development - the exact value several of these
+// cases exist to remove. Stub it so the tests see only what they set.
+vi.mock('dotenv', () => ({config: vi.fn()}));
+
+/**
+ * admin.config reads the environment once at import, so every case here has to
+ * reset the module registry and re-import it. The two things worth pinning are
+ * the ones that are silent when wrong: which client-IP header is trusted, and
+ * whether an unset NODE_ENV counts as production.
+ */
+
+const ORIGINAL_ENV = {...process.env};
+
+const loadConfig = async () => {
+	vi.resetModules();
+	return import('../../src/models/admin/admin.config.js');
+};
+
+beforeEach(() => {
+	process.env = {...ORIGINAL_ENV};
+	// dotenv.config() in admin.config does not overwrite what is already set,
+	// so setting these here is enough to keep the local .env out of the test.
+	process.env.NODE_ENV = 'test';
+	delete process.env.CLIENT_IP_HEADERS;
+	delete process.env.TRUSTED_PROXY_IPS;
+});
+
+afterEach(() => {
+	process.env = {...ORIGINAL_ENV};
+});
+
+describe('CLIENT_IP_HEADERS', () => {
+	it('defaults to the single header Plesk nginx sets', async () => {
+		const config = await loadConfig();
+		expect(config.CLIENT_IP_HEADERS).toEqual(['x-real-ip']);
+		expect(config.TRUST_NO_CLIENT_IP_HEADER).toBe(false);
+	});
+
+	it('reads a comma-separated list', async () => {
+		process.env.CLIENT_IP_HEADERS = 'x-real-ip, cf-connecting-ip';
+		const config = await loadConfig();
+		expect(config.CLIENT_IP_HEADERS).toEqual(['x-real-ip', 'cf-connecting-ip']);
+	});
+
+	it('trusts nothing when set to "none"', async () => {
+		// The escape hatch. An empty list is what better-auth reads as "no
+		// headers" - it only falls back to its own default when the option is
+		// absent - so this really does stop any header being believed.
+		process.env.CLIENT_IP_HEADERS = 'none';
+		const config = await loadConfig();
+		expect(config.CLIENT_IP_HEADERS).toEqual([]);
+		expect(config.TRUST_NO_CLIENT_IP_HEADER).toBe(true);
+	});
+
+	it('accepts the hatch case-insensitively and with stray whitespace', async () => {
+		process.env.CLIENT_IP_HEADERS = '  NONE  ';
+		const config = await loadConfig();
+		expect(config.CLIENT_IP_HEADERS).toEqual([]);
+	});
+
+	it('treats an empty value as "use the default", not as the hatch', async () => {
+		// A blank line in a .env must not silently change how requests are
+		// bucketed - only the explicit word does that.
+		process.env.CLIENT_IP_HEADERS = '';
+		const config = await loadConfig();
+		expect(config.CLIENT_IP_HEADERS).toEqual(['x-real-ip']);
+		expect(config.TRUST_NO_CLIENT_IP_HEADER).toBe(false);
+	});
+
+	it('does not mistake a header actually named none-ish for the hatch', async () => {
+		process.env.CLIENT_IP_HEADERS = 'x-none';
+		const config = await loadConfig();
+		expect(config.CLIENT_IP_HEADERS).toEqual(['x-none']);
+		expect(config.TRUST_NO_CLIENT_IP_HEADER).toBe(false);
+	});
+});
+
+describe('APP_ORIGINS', () => {
+	beforeEach(() => {
+		delete process.env.APP_ORIGINS;
+	});
+
+	// These reach better-auth's trustedOrigins, and the step 4 cutover made the
+	// tickets and feedback origins load-bearing: without them their sign-out
+	// call is rejected while everything else still works.
+	it('defaults to the two production frontends', async () => {
+		const config = await loadConfig();
+		expect(config.APP_ORIGINS).toEqual([
+			'https://tickets.nachklang.art',
+			'https://feedback.nachklang.art'
+		]);
+	});
+
+	it('is overridden wholesale by the environment, for a staging host', async () => {
+		process.env.APP_ORIGINS = 'https://tickets.staging.example, https://feedback.staging.example/';
+		const config = await loadConfig();
+		expect(config.APP_ORIGINS).toEqual([
+			'https://tickets.staging.example',
+			// Trailing slash stripped: an origin with one never matches.
+			'https://feedback.staging.example'
+		]);
+	});
+
+	it('always includes the admin app itself in ADMIN_ALLOWED_ORIGINS', async () => {
+		process.env.ADMIN_APP_URL = 'https://admin.nachklang.art';
+		const config = await loadConfig();
+		expect(config.ADMIN_ALLOWED_ORIGINS).toContain('https://admin.nachklang.art');
+		expect(config.ADMIN_ALLOWED_ORIGINS).toContain('https://tickets.nachklang.art');
+	});
+});
+
+describe('isProd', () => {
+	it('is false only for the explicit relaxed environments', async () => {
+		process.env.NODE_ENV = 'development';
+		expect((await loadConfig()).isProd).toBe(false);
+
+		process.env.NODE_ENV = 'test';
+		expect((await loadConfig()).isProd).toBe(false);
+	});
+
+	it('treats an unset NODE_ENV as production, which is what a bare vhost gives', async () => {
+		delete process.env.NODE_ENV;
+		// Strict mode refuses to boot without these; supply them so the import
+		// gets far enough to answer the question being asked.
+		process.env.BETTER_AUTH_SECRET = 'x'.repeat(48);
+		process.env.API_BASE_URL = 'https://api.nachklang.art';
+		process.env.ADMIN_APP_URL = 'https://admin.nachklang.art';
+
+		expect((await loadConfig()).isProd).toBe(true);
+	});
+
+	it('refuses to start without a signing key outside development', async () => {
+		delete process.env.NODE_ENV;
+		delete process.env.BETTER_AUTH_SECRET;
+		process.env.API_BASE_URL = 'https://api.nachklang.art';
+		process.env.ADMIN_APP_URL = 'https://admin.nachklang.art';
+
+		await expect(loadConfig()).rejects.toThrow(/BETTER_AUTH_SECRET/);
+	});
+});

test/admin/admin.middleware.test.ts

@@ -30,6 +30,10 @@ const activeUser = {
 	email: 'a@nachklang.art',
 	displayName: 'A',
 	disabled: false,
+	permissions: [
+		{app: 'feedback', role: 'access'},
+		{app: 'admin', role: 'access'}
+	],
 	apps: ['feedback', 'admin']
 };
 
@@ -60,6 +64,10 @@ describe('resolveAccess', () => {
 			email: 'a@nachklang.art',
 			displayName: 'A',
 			disabled: false,
+			permissions: [
+				{app: 'feedback', role: 'access'},
+				{app: 'admin', role: 'access'}
+			],
 			apps: ['feedback', 'admin']
 		});
 		// No cookieCache: exactly one lookup per request, never zero.
@@ -127,7 +135,11 @@ describe('requireAppAccess', () => {
 
 	it('403s a signed-in user without that app permission', async () => {
 		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
-		mockLoadAccess.mockResolvedValue({...activeUser, apps: ['feedback']});
+		mockLoadAccess.mockResolvedValue({
+			...activeUser,
+			permissions: [{app: 'feedback', role: 'access'}],
+			apps: ['feedback']
+		});
 		const res = makeRes();
 		const next = vi.fn();
 
@@ -171,4 +183,40 @@ describe('requireAppAccess', () => {
 		expect(res.status).toHaveBeenCalledWith(500);
 		expect(next).not.toHaveBeenCalled();
 	});
+
+	// The seam a finer per-app permission arrives through. Nothing passes a role
+	// today, so these two pin the behaviour before there is anything to break.
+	it('403s when a specific role is required and the user only holds another', async () => {
+		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+		mockLoadAccess.mockResolvedValue({
+			...activeUser,
+			permissions: [{app: 'tickets', role: 'access'}],
+			apps: ['tickets']
+		});
+		const res = makeRes();
+		const next = vi.fn();
+
+		await requireAppAccess('tickets', 'refund')(makeReq(), res, next);
+
+		expect(res.status).toHaveBeenCalledWith(403);
+		expect(next).not.toHaveBeenCalled();
+	});
+
+	it('passes when the user holds exactly the required role', async () => {
+		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+		mockLoadAccess.mockResolvedValue({
+			...activeUser,
+			permissions: [
+				{app: 'tickets', role: 'access'},
+				{app: 'tickets', role: 'refund'}
+			],
+			apps: ['tickets']
+		});
+		const res = makeRes();
+		const next = vi.fn();
+
+		await requireAppAccess('tickets', 'refund')(makeReq(), res, next);
+
+		expect(next).toHaveBeenCalled();
+	});
 });

test/admin/admin.schema.test.ts

@@ -0,0 +1,99 @@
+import {describe, expect, it} from 'vitest';
+import {
+	ACCESS_ROLE,
+	appsOf,
+	isAppPermission,
+	isAppRole,
+	toPermissions
+} from '../../src/models/admin/admin.schema.js';
+
+/**
+ * The permission model is (app, role). These tests pin the two properties the
+ * rest of the module leans on: that the older `['tickets']` shape still means
+ * "tickets at the access role", and that nothing outside APP_ROLES gets in.
+ */
+
+describe('toPermissions', () => {
+	it('reads the full (app, role) form', () => {
+		expect(toPermissions([{app: 'tickets', role: 'access'}])).toEqual([
+			{app: 'tickets', role: 'access'}
+		]);
+	});
+
+	it('reads a plain app list as that app at the access role', () => {
+		expect(toPermissions(['feedback', 'admin'])).toEqual([
+			{app: 'feedback', role: ACCESS_ROLE},
+			{app: 'admin', role: ACCESS_ROLE}
+		]);
+	});
+
+	it('accepts the two forms mixed, which is what a half-migrated caller sends', () => {
+		expect(toPermissions(['feedback', {app: 'tickets', role: 'access'}])).toEqual([
+			{app: 'feedback', role: ACCESS_ROLE},
+			{app: 'tickets', role: ACCESS_ROLE}
+		]);
+	});
+
+	it('drops duplicates of the same (app, role)', () => {
+		expect(toPermissions(['tickets', {app: 'tickets', role: 'access'}])).toEqual([
+			{app: 'tickets', role: ACCESS_ROLE}
+		]);
+	});
+
+	it('rejects rather than silently dropping an unknown app', () => {
+		// Silently ignoring it would let "grant calendar + nonsense" look like a
+		// success while granting less than the caller asked for.
+		expect(toPermissions(['calendar', 'nonsense'])).toBeNull();
+	});
+
+	it('rejects an unknown role', () => {
+		expect(toPermissions([{app: 'tickets', role: 'refund'}])).toBeNull();
+	});
+
+	it('rejects anything that is not a list', () => {
+		expect(toPermissions('admin')).toBeNull();
+		expect(toPermissions(null)).toBeNull();
+		expect(toPermissions({app: 'admin', role: 'access'})).toBeNull();
+	});
+
+	it('reads an empty list as "no permissions", not as invalid', () => {
+		expect(toPermissions([])).toEqual([]);
+	});
+});
+
+describe('isAppRole', () => {
+	it('accepts the access role for every app', () => {
+		expect(isAppRole('admin', ACCESS_ROLE)).toBe(true);
+		expect(isAppRole('calendar', ACCESS_ROLE)).toBe(true);
+	});
+
+	it('rejects a role that does not exist yet', () => {
+		expect(isAppRole('tickets', 'refund')).toBe(false);
+	});
+});
+
+describe('isAppPermission', () => {
+	it('needs both halves to be valid', () => {
+		expect(isAppPermission({app: 'tickets', role: ACCESS_ROLE})).toBe(true);
+		expect(isAppPermission({app: 'tickets'})).toBe(false);
+		expect(isAppPermission({role: ACCESS_ROLE})).toBe(false);
+		expect(isAppPermission(null)).toBe(false);
+	});
+});
+
+describe('appsOf', () => {
+	it('collapses several roles on one app to a single entry', () => {
+		// The point of the derived list: a user with two roles on tickets has
+		// access to tickets once, not twice.
+		const apps = appsOf([
+			{app: 'tickets', role: ACCESS_ROLE},
+			{app: 'tickets', role: 'future-role'},
+			{app: 'admin', role: ACCESS_ROLE}
+		]);
+		expect(apps).toEqual(['tickets', 'admin']);
+	});
+
+	it('is empty for no permissions', () => {
+		expect(appsOf([])).toEqual([]);
+	});
+});

test/admin/auth-binding.ts

@@ -0,0 +1,118 @@
+import {vi, describe, it, expect, beforeEach, type Mock} from 'vitest';
+import express, {Request, Response} from 'express';
+
+/**
+ * Shared body for the two cutover tests (2026-09-06). feedback.auth.ts and
+ * tickets.auth.ts used to carry their own header-session authenticator against
+ * the calendar users table; both are now one binding to the shared admin gate.
+ *
+ * What is worth asserting is not how that gate works - admin.middleware.test.ts
+ * owns that - but that each module is bound to *its own* app, and that neither
+ * consults the calendar users service any more. The mocks live in the calling
+ * file because vi.mock is per-module-graph; only the assertions are shared.
+ */
+
+export interface BindingMocks {
+	/** auth.api.getSession from the mocked admin.auth.js */
+	getSession: Mock;
+	/** loadAccess from the mocked users.admin.service.js */
+	loadAccess: Mock;
+	/** checkSession from the mocked calendar users.service.js */
+	checkSession: Mock;
+}
+
+const makeReq = (): Request => ({headers: {cookie: 'nachklang.session_token=abc'}} as unknown as Request);
+
+const makeRes = (): Response => {
+	const res: any = {};
+	res.status = vi.fn().mockReturnValue(res);
+	res.send = vi.fn().mockReturnValue(res);
+	res.locals = {};
+	return res as Response;
+};
+
+const userWith = (...apps: string[]) => ({
+	id: 'u1',
+	email: 'a@nachklang.art',
+	displayName: 'Anna Admin',
+	disabled: false,
+	permissions: apps.map(app => ({app, role: 'access'})),
+	apps
+});
+
+export const describeAdminBinding = (
+	app: string,
+	otherApp: string,
+	middleware: express.RequestHandler,
+	mocks: () => BindingMocks
+): void => {
+	describe(`${app} requireAdminAuth`, () => {
+		let m: BindingMocks;
+
+		const run = async () => {
+			const res = makeRes();
+			const next = vi.fn();
+			await middleware(makeReq(), res, next);
+			return {res, next};
+		};
+
+		beforeEach(() => {
+			m = mocks();
+			m.getSession.mockReset();
+			m.loadAccess.mockReset();
+			m.checkSession.mockReset();
+		});
+
+		it('responds 401 and does not call next() without a session', async () => {
+			m.getSession.mockResolvedValue(null);
+
+			const {res, next} = await run();
+
+			expect(res.status).toHaveBeenCalledWith(401);
+			expect(next).not.toHaveBeenCalled();
+		});
+
+		it(`responds 403 for a signed-in user who only has ${otherApp}`, async () => {
+			m.getSession.mockResolvedValue({user: {id: 'u1'}});
+			m.loadAccess.mockResolvedValue(userWith(otherApp));
+
+			const {res, next} = await run();
+
+			expect(res.status).toHaveBeenCalledWith(403);
+			expect(next).not.toHaveBeenCalled();
+		});
+
+		it('responds 403 for a disabled user who still holds the permission', async () => {
+			m.getSession.mockResolvedValue({user: {id: 'u1'}});
+			m.loadAccess.mockResolvedValue({...userWith(app), disabled: true});
+
+			const {res, next} = await run();
+
+			expect(res.status).toHaveBeenCalledWith(403);
+			expect(next).not.toHaveBeenCalled();
+		});
+
+		it('sets res.locals.admin and calls next() with the permission', async () => {
+			m.getSession.mockResolvedValue({user: {id: 'u1'}});
+			m.loadAccess.mockResolvedValue(userWith(app));
+
+			const {res, next} = await run();
+
+			expect(next).toHaveBeenCalled();
+			expect(res.locals.admin).toMatchObject({id: 'u1', email: 'a@nachklang.art', displayName: 'Anna Admin'});
+		});
+
+		// Weaker than it looks and kept deliberately: neither module imports
+		// checkSession any more, so this cannot fail today. It is a tripwire for
+		// the change that would matter - someone reintroducing a header-session
+		// fallback "just for the calendar users who have not been invited yet",
+		// which is exactly the shortcut the cutover exists to close.
+		it('never falls back to a calendar header session', async () => {
+			m.getSession.mockResolvedValue(null);
+
+			await run();
+
+			expect(m.checkSession).not.toHaveBeenCalled();
+		});
+	});
+};

test/admin/users.admin.router.test.ts

@@ -97,7 +97,37 @@ describe('PUT /admin/users/:id/permissions', () => {
 		const res = await request(makeApp('me')).put('/admin/users/other/permissions').send({apps: ['tickets']});
 
 		expect(res.status).toBe(200);
-		expect(service.setPermissionsGuarded).toHaveBeenCalledWith('other', ['tickets'], 'me');
+		expect(service.setPermissionsGuarded).toHaveBeenCalledWith(
+			'other',
+			[{app: 'tickets', role: 'access'}],
+			'me'
+		);
+	});
+
+	it('accepts the richer {permissions} body', async () => {
+		service.loadAccess.mockResolvedValue({id: 'other', disabled: false, apps: []});
+
+		const res = await request(makeApp('me'))
+			.put('/admin/users/other/permissions')
+			.send({permissions: [{app: 'tickets', role: 'access'}]});
+
+		expect(res.status).toBe(200);
+		expect(service.setPermissionsGuarded).toHaveBeenCalledWith(
+			'other',
+			[{app: 'tickets', role: 'access'}],
+			'me'
+		);
+	});
+
+	it('rejects a role that does not exist', async () => {
+		service.loadAccess.mockResolvedValue({id: 'other', disabled: false, apps: []});
+
+		const res = await request(makeApp('me'))
+			.put('/admin/users/other/permissions')
+			.send({permissions: [{app: 'tickets', role: 'refund'}]});
+
+		expect(res.status).toBe(400);
+		expect(service.setPermissionsGuarded).not.toHaveBeenCalled();
 	});
 
 	it('allows granting permissions to someone who has none', async () => {
@@ -106,7 +136,11 @@ describe('PUT /admin/users/:id/permissions', () => {
 		const res = await request(makeApp('me')).put('/admin/users/other/permissions').send({apps: ['feedback', 'tickets']});
 
 		expect(res.status).toBe(200);
-		expect(service.setPermissionsGuarded).toHaveBeenCalledWith('other', ['feedback', 'tickets'], 'me');
+		expect(service.setPermissionsGuarded).toHaveBeenCalledWith(
+			'other',
+			[{app: 'feedback', role: 'access'}, {app: 'tickets', role: 'access'}],
+			'me'
+		);
 	});
 });
 

test/feedback/feedback.auth.test.ts

@@ -1,88 +1,23 @@
-import {vi, describe, it, expect, beforeEach, type Mock} from 'vitest';
-import {Request, Response} from 'express';
+import {vi, type Mock} from 'vitest';
 
 vi.mock('../../src/models/calendar/users/users.service.js', () => ({
 	checkSession: vi.fn()
 }));
+vi.mock('../../src/models/admin/admin.auth.js', () => ({
+	auth: {api: {getSession: vi.fn()}}
+}));
+vi.mock('../../src/models/admin/users/users.admin.service.js', () => ({
+	loadAccess: vi.fn()
+}));
 
 import * as UserService from '../../src/models/calendar/users/users.service.js';
-import {requireAdminAuth, sessionHeaderAuthenticator} from '../../src/models/feedback/feedback.auth.js';
+import {auth} from '../../src/models/admin/admin.auth.js';
+import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
+import {requireAdminAuth} from '../../src/models/feedback/feedback.auth.js';
+import {describeAdminBinding} from '../admin/auth-binding.js';
 
-const mockCheckSession = UserService.checkSession as Mock;
-
-const makeReq = (headers: Record<string, string>): Request => {
-	return {
-		header: (name: string) => headers[name],
-		ip: '203.0.113.42'
-	} as unknown as Request;
-};
-
-const makeRes = (): Response => {
-	const res: any = {};
-	res.status = vi.fn().mockReturnValue(res);
-	res.send = vi.fn().mockReturnValue(res);
-	res.locals = {};
-	return res as Response;
-};
-
-describe('sessionHeaderAuthenticator', () => {
-	beforeEach(() => mockCheckSession.mockReset());
-
-	it('returns null when headers are missing', async () => {
-		const identity = await sessionHeaderAuthenticator(makeReq({}));
-		expect(identity).toBeNull();
-		expect(mockCheckSession).not.toHaveBeenCalled();
-	});
-
-	it('returns null when checkSession finds no user', async () => {
-		mockCheckSession.mockResolvedValue(null);
-		const identity = await sessionHeaderAuthenticator(makeReq({'X-Session-Id': '1', 'X-Session-Key': 'k'}));
-		expect(identity).toBeNull();
-	});
-
-	it('returns null for a valid session on an inactive account', async () => {
-		mockCheckSession.mockResolvedValue({userId: 1, email: 'a@nachklang.art', fullName: 'A', isActive: false});
-		const identity = await sessionHeaderAuthenticator(makeReq({'X-Session-Id': '1', 'X-Session-Key': 'k'}));
-		expect(identity).toBeNull();
-	});
-
-	it('returns the identity for a valid session on an active account', async () => {
-		mockCheckSession.mockResolvedValue({userId: 1, email: 'a@nachklang.art', fullName: 'Anna Admin', isActive: true});
-		const identity = await sessionHeaderAuthenticator(makeReq({'X-Session-Id': '1', 'X-Session-Key': 'k'}));
-		expect(identity).toEqual({id: '1', email: 'a@nachklang.art', displayName: 'Anna Admin'});
-	});
-
-	it('passes the session id and key from headers through to checkSession, never from query params', async () => {
-		mockCheckSession.mockResolvedValue({userId: 1, email: 'a@nachklang.art', fullName: 'A', isActive: true});
-		await sessionHeaderAuthenticator(makeReq({'X-Session-Id': '42', 'X-Session-Key': 'sekret'}));
-		expect(mockCheckSession).toHaveBeenCalledWith('42', 'sekret', '203.0.113.42');
-	});
-});
-
-describe('requireAdminAuth', () => {
-	beforeEach(() => mockCheckSession.mockReset());
-
-	it('responds 401 and does not call next() when unauthenticated', async () => {
-		mockCheckSession.mockResolvedValue(null);
-		const req = makeReq({});
-		const res = makeRes();
-		const next = vi.fn();
-
-		await requireAdminAuth(req, res, next);
-
-		expect(res.status).toHaveBeenCalledWith(401);
-		expect(next).not.toHaveBeenCalled();
-	});
-
-	it('sets res.locals.admin and calls next() when authenticated', async () => {
-		mockCheckSession.mockResolvedValue({userId: 1, email: 'a@nachklang.art', fullName: 'Anna Admin', isActive: true});
-		const req = makeReq({'X-Session-Id': '1', 'X-Session-Key': 'k'});
-		const res = makeRes();
-		const next = vi.fn();
-
-		await requireAdminAuth(req, res, next);
-
-		expect(next).toHaveBeenCalled();
-		expect(res.locals.admin).toEqual({id: '1', email: 'a@nachklang.art', displayName: 'Anna Admin'});
-	});
-});
+describeAdminBinding('feedback', 'tickets', requireAdminAuth, () => ({
+	getSession: auth.api.getSession as unknown as Mock,
+	loadAccess: UsersService.loadAccess as Mock,
+	checkSession: UserService.checkSession as Mock
+}));

test/integration/admin.auth.test.ts

@@ -9,7 +9,8 @@ import {
 	createAndAcceptInvitation,
 	resetDatabase,
 	sessionCookieFrom,
-	SESSION_COOKIE
+	SESSION_COOKIE,
+	accessTo
 } from './helpers.js';
 
 /**
@@ -66,7 +67,7 @@ describe('invitation acceptance', () => {
 	});
 
 	it('sets the session cookie under the configured prefix', async () => {
-		const invitation = await InvitationsService.createInvitation('b@nachklang.art', 'B', ['feedback'], null);
+		const invitation = await InvitationsService.createInvitation('b@nachklang.art', 'B', accessTo('feedback'), null);
 
 		const res = await request(app)
 			.post('/admin/auth/invitations/accept')
@@ -89,7 +90,7 @@ describe('invitation acceptance', () => {
 	});
 
 	it('previews an invitation without revealing the granted apps', async () => {
-		const invitation = await InvitationsService.createInvitation('d@nachklang.art', 'D', ['admin'], null);
+		const invitation = await InvitationsService.createInvitation('d@nachklang.art', 'D', accessTo('admin'), null);
 
 		const res = await request(app)
 			.post('/admin/auth/invitations/preview')
@@ -100,7 +101,7 @@ describe('invitation acceptance', () => {
 	});
 
 	it('answers an unknown token exactly like an expired one', async () => {
-		const invitation = await InvitationsService.createInvitation('e@nachklang.art', 'E', ['feedback'], null);
+		const invitation = await InvitationsService.createInvitation('e@nachklang.art', 'E', accessTo('feedback'), null);
 		await InvitationsService.revokeInvitation(invitation.id);
 
 		const unknown = await request(app).post('/admin/auth/invitations/preview').send({token: 'no-such-token'});
@@ -111,7 +112,7 @@ describe('invitation acceptance', () => {
 	});
 
 	it('cannot be redeemed twice', async () => {
-		const invitation = await InvitationsService.createInvitation('f@nachklang.art', 'F', ['feedback'], null);
+		const invitation = await InvitationsService.createInvitation('f@nachklang.art', 'F', accessTo('feedback'), null);
 
 		const first = await request(app)
 			.post('/admin/auth/invitations/accept')
@@ -125,7 +126,7 @@ describe('invitation acceptance', () => {
 	});
 
 	it('rejects an expired invitation', async () => {
-		const invitation = await InvitationsService.createInvitation('g@nachklang.art', 'G', ['feedback'], null);
+		const invitation = await InvitationsService.createInvitation('g@nachklang.art', 'G', accessTo('feedback'), null);
 		// Reach past the service to age it: there is deliberately no API for this.
 		const {NachklangAdminDB} = await import('../../src/models/admin/Admin.db.js');
 		await NachklangAdminDB.db
@@ -142,7 +143,7 @@ describe('invitation acceptance', () => {
 	});
 
 	it('rejects a password below the minimum length', async () => {
-		const invitation = await InvitationsService.createInvitation('h@nachklang.art', 'H', ['feedback'], null);
+		const invitation = await InvitationsService.createInvitation('h@nachklang.art', 'H', accessTo('feedback'), null);
 
 		const res = await request(app)
 			.post('/admin/auth/invitations/accept')
@@ -220,16 +221,32 @@ describe('requireAppAccess', () => {
 		expect(Array.isArray(res.body)).toBe(true);
 	});
 
-	// Step 2 deliberately does NOT swap the feedback and tickets authenticators:
-	// they still authenticate against the legacy calendar sessions, so an admin
-	// cookie means nothing to them yet. This asserts that boundary rather than
-	// the end state - when step 4 lands, these two expectations become 200/403
-	// and this comment goes away.
-	it('leaves the feedback and tickets admin areas on their legacy authenticator', async () => {
+	// The step 4 cutover (2026-09-06): the feedback and tickets admin areas now
+	// sit behind this same gate, so one sign-in reaches every app the user has a
+	// permission for - and reaches no further. Until step 4 these two returned
+	// 401 for an admin cookie, because each module still ran its own header
+	// session against the calendar users table.
+	it('lets an admin cookie into the feedback and tickets admin areas', async () => {
 		const user = await createAndAcceptInvitation(app, 'o@nachklang.art', 'O', ['feedback', 'tickets']);
 
-		expect((await user.agent.get('/feedback/admin/me')).status).toBe(401);
-		expect((await user.agent.get('/tickets/admin/me')).status).toBe(401);
+		expect((await user.agent.get('/feedback/admin/me')).status).toBe(200);
+		expect((await user.agent.get('/tickets/admin/me')).status).toBe(200);
+	});
+
+	it('403s each app separately for a user who only holds the other one', async () => {
+		const user = await createAndAcceptInvitation(app, 'q@nachklang.art', 'Q', ['feedback']);
+
+		expect((await user.agent.get('/feedback/admin/me')).status).toBe(200);
+		expect((await user.agent.get('/tickets/admin/me')).status).toBe(403);
+	});
+
+	it('401s the feedback and tickets admin areas for a legacy header session', async () => {
+		const res = await request(app)
+			.get('/feedback/admin/me')
+			.set('X-Session-Id', '1')
+			.set('X-Session-Key', 'whatever');
+
+		expect(res.status).toBe(401);
 	});
 });
 
@@ -259,7 +276,7 @@ describe('origin checks', () => {
 
 describe('the session cookie is not readable by scripts', () => {
 	it('is HttpOnly and SameSite=Lax', async () => {
-		const invitation = await InvitationsService.createInvitation('r@nachklang.art', 'R', ['feedback'], null);
+		const invitation = await InvitationsService.createInvitation('r@nachklang.art', 'R', accessTo('feedback'), null);
 		const res = await request(app)
 			.post('/admin/auth/invitations/accept')
 			.send({token: invitation.token, password: 'devpassword123'});

test/integration/admin.users.test.ts

@@ -5,7 +5,7 @@ import {createApp} from '../../src/app.factory.js';
 import * as InvitationsService from '../../src/models/admin/invitations/invitations.service.js';
 import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
 import {bootstrapAdmin} from '../../src/models/admin/admin.bootstrap.js';
-import {closeDatabase, createAndAcceptInvitation, resetDatabase} from './helpers.js';
+import {accessTo, closeDatabase, createAndAcceptInvitation, resetDatabase} from './helpers.js';
 
 let app: Application;
 
@@ -185,7 +185,7 @@ describe('invitations', () => {
 
 	it('invalidates the previous link on resend', async () => {
 		const {agent} = await signedInAdmin();
-		const original = await InvitationsService.createInvitation('new@nachklang.art', 'New', ['feedback'], null);
+		const original = await InvitationsService.createInvitation('new@nachklang.art', 'New', accessTo('feedback'), null);
 
 		const resent = await agent.post(`/admin/invitations/${original.id}/resend`);
 		expect(resent.status).toBe(200);
@@ -198,7 +198,7 @@ describe('invitations', () => {
 
 	it('revokes an invitation', async () => {
 		const {agent} = await signedInAdmin();
-		const invitation = await InvitationsService.createInvitation('new@nachklang.art', 'New', ['feedback'], null);
+		const invitation = await InvitationsService.createInvitation('new@nachklang.art', 'New', accessTo('feedback'), null);
 
 		expect((await agent.delete(`/admin/invitations/${invitation.id}`)).status).toBe(204);
 		expect((await agent.delete(`/admin/invitations/${invitation.id}`)).status).toBe(404);

test/integration/helpers.ts

@@ -3,7 +3,7 @@ import type {Application} from 'express';
 import request from 'supertest';
 import {NachklangAdminDB} from '../../src/models/admin/Admin.db.js';
 import * as InvitationsService from '../../src/models/admin/invitations/invitations.service.js';
-import {AppName} from '../../src/models/admin/admin.schema.js';
+import {ACCESS_ROLE, AppName, AppPermission, toPermissions} from '../../src/models/admin/admin.schema.js';
 
 const db = NachklangAdminDB.db;
 
@@ -44,10 +44,13 @@ export const createAndAcceptInvitation = async (
 	app: Application,
 	email: string,
 	name: string,
-	apps: AppName[],
+	// Takes the shorthand as well as the full form: most tests only care that
+	// someone can open an app, and `['tickets']` says that with less noise.
+	grants: (AppName | AppPermission)[],
 	password = 'devpassword123'
 ) => {
-	const invitation = await InvitationsService.createInvitation(email, name, apps, null);
+	const permissions = toPermissions(grants) ?? [];
+	const invitation = await InvitationsService.createInvitation(email, name, permissions, null);
 
 	const agent = request.agent(app);
 	const res = await agent
@@ -66,3 +69,9 @@ export const cookieHeader = (res: request.Response): string[] => {
 export const sessionCookieFrom = (res: request.Response): string | undefined => {
 	return cookieHeader(res).find(cookie => cookie.startsWith(SESSION_COOKIE));
 };
+
+/** `accessTo('feedback')` reads better than the (app, role) literal in tests
+ *  that only care that someone can open an app. */
+export const accessTo = (...apps: AppName[]): AppPermission[] => {
+	return apps.map(app => ({app, role: ACCESS_ROLE}));
+};

test/tickets/tickets.auth.test.ts

@@ -0,0 +1,23 @@
+import {vi, type Mock} from 'vitest';
+
+vi.mock('../../src/models/calendar/users/users.service.js', () => ({
+	checkSession: vi.fn()
+}));
+vi.mock('../../src/models/admin/admin.auth.js', () => ({
+	auth: {api: {getSession: vi.fn()}}
+}));
+vi.mock('../../src/models/admin/users/users.admin.service.js', () => ({
+	loadAccess: vi.fn()
+}));
+
+import * as UserService from '../../src/models/calendar/users/users.service.js';
+import {auth} from '../../src/models/admin/admin.auth.js';
+import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
+import {requireAdminAuth} from '../../src/models/tickets/tickets.auth.js';
+import {describeAdminBinding} from '../admin/auth-binding.js';
+
+describeAdminBinding('tickets', 'feedback', requireAdminAuth, () => ({
+	getSession: auth.api.getSession as unknown as Mock,
+	loadAccess: UsersService.loadAccess as Mock,
+	checkSession: UserService.checkSession as Mock
+}));