Merge pull request 'Record the calendar migration as complete and deployed' (#16) from docs/calendar-migration-complete into master

Reviewed-on: #16

docs/calendar-auth-migration.md

@@ -1,13 +1,22 @@
 # Migrating the Calendar domain onto the admin identity module
 
-Status: **complete.** Steps 1, 3 and 4 were deployed and verified in production on
-2026-09-06; step 2 was dropped by decision and part of step 5 brought forward. Step 5 is
-implemented and awaiting deploy - see its own checklist below, whose ordering is the
-**opposite** of step 4's.
+Status: **complete and deployed, 2026-09-06.** Every step is live. Step 2 was dropped by
+decision and part of step 5 brought forward; the rest went out as written.
 
-Verified live after step 4: the public calendar still answers anonymously, all 23 public
-events kept a resolvable author, restricted calendars still refuse without a credential,
-legacy query credentials answer 401, and `calendar.nachklang.art` is trusted for sign-out.
+The calendar now shares one identity with the tickets, feedback and admin apps: writes sit
+behind `requireAppAccess('calendar')` against the shared session cookie, reads resolve that
+cookie optionally, and the calendar's own `users`/`sessions` tables are renamed aside and
+referenced by nothing. `DEFERRED_SECURITY.md` items 1, 3 and 4 closed with it.
+
+Verified in production after the final deploy: the public calendar answers anonymously on all
+three endpoints (23 events, 23 VEVENTs in the iCal feed, the next-event teaser intact),
+restricted calendars still refuse without a credential, unauthenticated writes answer 401,
+all six `/calendar/users/*` routes answer 404, CORS grants only `Content-Type`, sign-out from
+`calendar.nachklang.art` succeeds, and **every event kept its author** - rendered from the
+`created_by_name` snapshot, since the table it was copied from no longer exists under that
+name. That last one is the whole reason part of step 5 was brought forward.
+
+Remaining, at your leisure: `DROP TABLE sessions_legacy_archive, users_legacy_archive;`
 
 Written 2026-09-05 alongside the admin module (step 2 of `docs/plan-admin-auth.md` in the
 nachklang-admin repo), which deliberately left the calendar alone. Steps 1-4 of that plan
@@ -157,8 +166,8 @@ Each step is meant to leave production working on its own.
 
    **One-way door:** any iCal subscription whose URL carries `?sessionId=&sessionKey=` rather
    than `?password=` stops working permanently. The shared-password URLs are unaffected.
-5. **Drop the legacy path.** **Implemented 2026-09-06** on `feature/calendar-drop-legacy-path`;
-   not yet deployed. Gated on step 4 being live, which it now is.
+5. **Drop the legacy path.** **Deployed 2026-09-06.** Gated on step 4 being live, which it
+   was.
 
    What went:
 
@@ -178,7 +187,7 @@ Each step is meant to leave production working on its own.
    `DEFERRED_SECURITY.md` items **3** and **4** (activation and reset tokens never expiring)
    close with it - not by adding expiries but by deleting the code that issued them.
 
-   ### Deploy checklist — note the order is REVERSED from step 4
+   ### Deploy checklist — kept for the record; the order was REVERSED from step 4
 
    Step 4's migration only added columns, so it went first. `004` *removes* columns and a
    table that the currently running build still selects and joins, so running it first fails
@@ -209,6 +218,15 @@ Each step is meant to leave production working on its own.
    **One-way door:** `Event.createdById` and `lastModifiedById` leave the API response. Check
    anything reading `/calendar/events/*/json` that is not the calendar frontend.
 
+   **Observed during the deploy, worth keeping.** A browser holding a *cached pre-cutover*
+   Angular bundle looked signed in and showed every event's status as "Error". The old bundle
+   called `/calendar/users/checkSessionValid`, which still existed between step 4 and step 5,
+   so it rendered as authenticated - then fetched events with no cookie, got the anonymous
+   listing, which omits `status`, and the UI's status switch fell through to its error label.
+   Signing out and back in fixed it. After this step that route 404s, so a stale bundle now
+   fails honestly instead of faking a session. This is the same "does not look broken" window
+   the step 4 checklist warns about, seen from the other side.
+
 ## What the code actually looks like (surveyed 2026-09-06)
 
 Four things found while doing step 1 that change how the later steps should be built:

src/models/tickets/admin/events.admin.service.ts

@@ -14,7 +14,6 @@ export interface EventPickerEntry {
 	startDateTime: Date;
 	location: string;
 	status: string | undefined;
-	redemptionDeadline: Date | null;
 }
 
 /**
@@ -27,26 +26,19 @@ export interface EventPickerEntry {
  */
 export const listEventsForPicker = async (): Promise<EventPickerEntry[]> => {
 	let conn = await NachklangTicketsDB.getConnection();
-	let deadlineByEventId: Map<number, Date | null>;
+	let enabledEventIds: number[];
 	try {
-		const rows = await conn.query('SELECT event_id, redemption_deadline FROM event_ticket_settings');
-		deadlineByEventId = new Map(rows.map((r: any) => [r.event_id, r.redemption_deadline]));
+		const rows = await conn.query('SELECT event_id FROM event_ticket_settings');
+		enabledEventIds = rows.map((r: any) => r.event_id);
 	} finally {
 		await conn.end();
 	}
-	if (deadlineByEventId.size === 0) return [];
+	if (enabledEventIds.length === 0) return [];
 
-	const events = await Promise.all([...deadlineByEventId.keys()].map(id => CalendarEventsService.getEventById(id)));
+	const events = await Promise.all(enabledEventIds.map(id => CalendarEventsService.getEventById(id)));
 	return events
 		.filter((e): e is NonNullable<typeof e> => e !== null && e.status !== 'DELETED')
-		.map(e => ({
-			eventId: e.eventId,
-			name: e.name,
-			startDateTime: e.startDateTime,
-			location: e.location,
-			status: e.status,
-			redemptionDeadline: deadlineByEventId.get(e.eventId) ?? null
-		}))
+		.map(e => ({eventId: e.eventId, name: e.name, startDateTime: e.startDateTime, location: e.location, status: e.status}))
 		.sort((a, b) => a.startDateTime.getTime() - b.startDateTime.getTime());
 };
 
@@ -67,9 +59,7 @@ export const listAvailableEventsToAdd = async (): Promise<EventPickerEntry[]> =>
 	const events = await CalendarEventsService.getAllEventsAdmin(PUBLIC_CALENDAR_ID);
 	return events
 		.filter(e => e.status !== 'DELETED' && !enabledEventIds.has(e.eventId))
-		// Not yet added to the ticket shop, so there's no event_ticket_settings
-		// row and therefore no deadline to report.
-		.map(e => ({eventId: e.eventId, name: e.name, startDateTime: e.startDateTime, location: e.location, status: e.status, redemptionDeadline: null}))
+		.map(e => ({eventId: e.eventId, name: e.name, startDateTime: e.startDateTime, location: e.location, status: e.status}))
 		.sort((a, b) => a.startDateTime.getTime() - b.startDateTime.getTime());
 };
 

src/models/tickets/public/voucher.public.service.ts

@@ -39,7 +39,6 @@ export const validateVoucher = async (code: string): Promise<VoucherValidation |
 				name: event.name,
 				startDateTime: event.startDateTime,
 				location: event.location,
-				redemptionDeadline: ticketState.redemptionDeadline,
 				deadlinePassed: ticketState.redemptionDeadline !== null && now > new Date(ticketState.redemptionDeadline),
 				isFull: ticketState.spotsRemaining !== null && ticketState.spotsRemaining <= 0,
 				spotsRemaining: ticketState.spotsRemaining,

src/models/tickets/tickets.interface.ts

@@ -10,7 +10,7 @@
  *       enum: [ACTIVE, UNDONE]
  *     EligibleEvent:
  *       type: object
- *       required: [eventId, name, startDateTime, location, redemptionDeadline, deadlinePassed, isFull, collectAddress, requireAddress]
+ *       required: [eventId, name, startDateTime, location, deadlinePassed, isFull, collectAddress, requireAddress]
  *       properties:
  *         eventId:
  *           type: integer
@@ -23,11 +23,6 @@
  *           format: date-time
  *         location:
  *           type: string
- *         redemptionDeadline:
- *           type: string
- *           format: date-time
- *           nullable: true
- *           description: null when the event has no redemption deadline set
  *         deadlinePassed:
  *           type: boolean
  *         isFull:
@@ -229,7 +224,6 @@ export interface EligibleEvent {
 	name: string;
 	startDateTime: Date;
 	location: string;
-	redemptionDeadline: Date | null;
 	deadlinePassed: boolean;
 	isFull: boolean;
 	spotsRemaining: number | null;