Harden the admin module after a fresh-context review

Six defects found by an independent review of 7aac07a.

Environment handling now fails safe. NODE_ENV=production was gating the
signing key, the cookie domain, the CORS origin list and invitation-token
logging all at once, and it was documented nowhere - an unset value, which is
what a fresh Plesk vhost gives you, silently degraded all four. Only
'development' and 'test' relax anything now; everything else, unset included,
is strict. The hardcoded fallback secret is gone (dev gets a random
per-process one, so no committed value can ever sign a production cookie),
and invitation-link logging is an explicit ADMIN_LOG_INVITE_LINKS opt-in that
is refused in strict mode.

Rate limiting no longer collapses into a single global bucket. Without
trustedProxies, better-auth rejects a multi-value x-forwarded-for, resolves no
client IP, and keys every request to "no-trusted-ip" - where /sign-in/*
allows 3 requests per 10 seconds, so one noisy client could lock the whole
organisation out. CLIENT_IP_HEADERS and TRUSTED_PROXY_IPS make this explicit,
the unspecified x-forwarded-for fallback is gone, and strict mode warns at
boot when no trusted proxy is configured.

Invite acceptance is transactional. The user and its credential account go in
one runWithTransaction, as better-auth's own sign-up route does. A transaction
cannot span the permission and invitation writes - those use this module's own
pool - so a failure there is compensated: the user row is deleted and the
invitation un-marked, so the link works again instead of leaving the invitee
with a burnt token and an account no route can repair.

The last-admin guards were check-then-act. Two admins each removing the
other's admin permission could both pass the check and both commit, leaving
nobody able to administer anything. The count now runs inside the write
transaction under SELECT ... FOR UPDATE.

Also: lastSignInAt filtered expired sessions in the detail endpoint but not
the list, so the two disagreed; and the integration suite never reset
rateLimit, leaving it one added sign-in away from 429s that look like auth
bugs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -52,12 +52,6 @@ ADMIN_BOOTSTRAP_EMAIL=
 # request shares ONE rate-limit bucket (/sign-in/* allows 3 per 10 seconds, so
 # one noisy client locks everyone out). Check with:
 #   SELECT `key` FROM rateLimit;  -- a "no-trusted-ip" row means it is happening.
-# The header the reverse proxy puts the real client IP in. Must be one the proxy
-# actually overwrites - trusting a header it does not set lets any client send its
-# own value and bypass the sign-in rate limit entirely.
-# Set to "none" to trust no header at all: every request then shares one rate-limit
-# bucket, which is the safe fallback if the check below fails. Verify after deploy
-# with: SELECT ipAddress FROM session ORDER BY createdAt DESC LIMIT 3;
 CLIENT_IP_HEADERS=x-real-ip
 TRUSTED_PROXY_IPS=
 

CLAUDE.md

@@ -33,50 +33,29 @@ Express.js REST API in TypeScript with a service-oriented layering. Domains: `Ca
 
 | Layer | Location |
 |---|---|
-| Router | `src/models/calendar/Calendar.router.ts`, `…/events/events.router.ts` |
-| Services | `…/events/events.service.ts`, `…/events/credentials.service.ts`, `…/events/icalgenerator.service.ts` |
+| Router | `src/models/calendar/Calendar.router.ts`, `…/events/events.router.ts`, `…/users/users.router.ts` |
+| Services | `…/events/events.service.ts`, `…/users/users.service.ts`, `…/events/credentials.service.ts`, `…/events/icalgenerator.service.ts` |
 | DB pool | `src/models/calendar/Calendar.db.ts` (MariaDB, pool size 5) |
 | Shared | `src/common/` (base route class, nodemailer wrapper), `src/middleware/logger.ts` (Winston) |
 
-**Auth model:** One, since the calendar migration completed.
+**Auth model:** Two of them, on purpose.
 
-*Admin module (`src/models/admin/`)* — used by every app: calendar, feedback, tickets and the
-admin app itself. better-auth 1.7 on its own `nachklang_admin` database (Kysely + mysql2; every
+*Admin module (`src/models/admin/`)* — the current one, used by feedback, tickets and the
+admin app. better-auth 1.7 on its own `nachklang_admin` database (Kysely + mysql2; every
 other domain keeps the `mariadb` driver), mounted at `/admin/auth/*` for the auth handler
 and `/admin` for the JSON routes. Sessions are httpOnly cookies scoped to
 `.nachklang.art`, so one sign-in covers every app. Accounts are **invite-only** — public
 sign-up is disabled, and `invitations.plugin.ts` is the only code that creates users.
-A permission is **(app, role)** in `user_app_permissions`, keyed on
-`(user_id, app, role)` so one user can hold several roles per app. `access` is the only role
-today and means "may use this app at all"; `APP_ROLES` in `admin.schema.ts` is the contract,
-and a role not listed there is rejected rather than written. `requireAppAccess(app)` in
-`admin.middleware.ts` is the single authenticator - it takes an optional second argument to
-narrow to one role, and queries the database on every request (no cookie cache) so disabling
-a user takes effect at once. Two things to know before touching this: any count of admins
-must count **distinct users**, not permission rows, or a single admin with two roles reads as
-two and the last-admin guard stops guarding; and both write endpoints accept
-`{permissions: [{app, role}]}` as well as the older `{apps: ['tickets']}`, which means the
-same at the `access` role. `ADMIN_BOOTSTRAP_EMAIL`
+Permissions are per app in `user_app_permissions`; `requireAppAccess(app)` in
+`admin.middleware.ts` is the single authenticator, and it queries the database on every
+request (no cookie cache) so disabling a user takes effect at once. `ADMIN_BOOTSTRAP_EMAIL`
 makes sure someone can always get in on a fresh database.
 
-*The calendar* used to be the exception - its own `users`/`sessions` tables, and a session
-token passed in **query parameters**. That is gone: `docs/calendar-auth-migration.md` records
-the migration, finished 2026-09-06. Writes sit behind `requireAppAccess('calendar')`; reads
-resolve the same cookie optionally, because one URL serves an anonymous visitor, an iCal
-subscription and a signed-in editor.
-
-Two calendar-specific things survive that migration and are easy to break:
-
-- **The `public` calendar answers with no credential of any kind.** nachklang.art reads it to
-  show the next upcoming event. Pinned by `test/calendar/credentials.service.test.ts` and
-  `test/calendar/events.router.test.ts`.
-- **The shared passwords (`MEMBER_CREDENTIAL`, `CHOIR_CREDENTIAL`, `MANAGEMENT_CREDENTIAL`,
-  from `.env`) still open the restricted calendars for reading**, because an iCal client
-  cannot send a cookie. They can never write.
-
-An event's creator is a display name and nothing else - nothing authorises on it. It resolves
-from the admin module's `user.name` when the row carries an admin id, and otherwise from
-`created_by_name`, a snapshot taken before the legacy `users` table was renamed aside.
+*Legacy calendar* — unchanged: users need a `@nachklang.art` email, and after activation
+get a session token (30-day window, hash + IP stored in the DB), passed as query
+parameters. Migration is planned but not started: `docs/calendar-auth-migration.md`.
+Credentials for non-user calendar access (`MEMBER_CREDENTIAL`, `CHOIR_CREDENTIAL`,
+`MANAGEMENT_CREDENTIAL`) come from `.env`.
 
 **Admin database driver:** the admin pool is the **callback-style** `mysql2`, never
 `mysql2/promise`. Kysely's `MysqlDialect` calls `pool.getConnection((err, conn) => ...)`;
@@ -89,19 +68,6 @@ error. Only the integration tests catch this.
 `better-auth/db`, called with `auth.options`), diff, and add a numbered migration. Do not
 use the published `@better-auth/cli`; it lags the library.
 
-**`docker-compose.dev.yml` builds a fresh local dev database from `docker/init/`, not
-from `sql/<domain>/` directly** - the two domains use different mechanisms and both need
-to be kept in sync by hand whenever a migration is added: `docker/init/03-tickets-schema.sql`
-and `02-feedback-schema.sql` are thin files that `SOURCE` every `sql/<domain>/NNN_*.sql`
-in order (add the new migration's `SOURCE` line there too); `01-calendar-schema-dev.sql`
-and `04-admin-schema.sql` instead fold each migration's effect directly into one
-reconstructed CREATE-TABLE schema (own header comment: "keep the two in step") - no
-`SOURCE` list to extend, edit the reconstructed schema itself. Found
-`03-tickets-schema.sql` missing the `SOURCE` line for `003_add_confirmation_email_status.sql`
-while adding `004` - every tickets dev DB spun up since that migration was added has been
-silently missing the column (mail sends still succeed, `recordConfirmationEmailResult`'s
-`UPDATE` just fails and logs). Fixed.
-
 **Event versioning:** Events have a companion `event_versions` table. `events.service.ts` manages writes to both.
 
 **Calendar types and IDs:** `public` (1), `members` (2), `management` (3), `choir` (4), `birthdays` (5). `credentials.service.ts` enforces which session/credential can read each calendar.

DEFERRED_SECURITY.md

@@ -5,28 +5,15 @@ These items were identified during a security review on 2026-05-02 and conscious
 
 ---
 
-## 1. Session credentials in URL query parameters (logged-in users) — CLOSED 2026-09-06
+## 1. Session credentials in URL query parameters (logged-in users)
 
 **Files:** `src/models/calendar/events/events.router.ts` — all GET/PUT/DELETE handlers
 
-`sessionId` and `sessionKey` were read from query parameters, which meant they appeared in
-server access logs, browser history, proxy logs, and `Referer` headers.
+`sessionId` and `sessionKey` are currently read from query parameters, which means they appear in server access logs, browser history, proxy logs, and `Referer` headers.
 
-**Fixed** by step 4 of `docs/calendar-auth-migration.md`: the calendar's write routes now sit
-behind `requireAppAccess('calendar')` against the better-auth session cookie, and the read
-routes resolve the same cookie optionally. No route reads `sessionId`/`sessionKey` any more,
-and the Angular frontend sends `withCredentials` instead of appending them to every URL. That
-closed the item outright rather than moving the credential somewhere safer.
+**Fix:** Move to request headers (`X-Session-Id` / `X-Session-Key`) or the request body. Requires a corresponding frontend update.
 
-Two things this did *not* change, both deliberate:
-
-- The shared calendar `password` parameter stays. An iCal client cannot send a cookie, so
-  this is the one caller that genuinely needs a credential in the URL. It grants read access
-  to one calendar and nothing else - `test/calendar/events.router.test.ts` pins that it can
-  never be used to write.
-- ~~The legacy `/calendar/users/*` routes still exist.~~ Removed by step 5 on 2026-09-06,
-  along with the `users` and `sessions` tables they used - renamed aside rather than dropped,
-  so nothing was destroyed.
+> Note: the shared calendar `password` parameter in query params is intentional (iCal clients don't support headers) and is acceptable for the current setup.
 
 ---
 
@@ -37,29 +24,43 @@ Two things this did *not* change, both deliberate:
 - `PUT /move/:eventId` (move)
 - `DELETE /:eventId` (delete)
 
-Currently any account holding the `calendar` permission can edit, move, or delete any event regardless of who created it. This is acceptable while everyone holding it is a trusted admin.
+Currently any active user can edit, move, or delete any event regardless of who created it. This is acceptable while all users are trusted admins.
 
-**Fix (updated 2026-09-06):** fetch the event first and verify `event.createdByUserId === res.locals.admin.id` before allowing the mutation — `createdById`, the legacy INT, is no longer written and is gone at step 5. Rather than an `isAdmin` flag, the bypass belongs in the permission model that already exists: `requireAppAccess('calendar', 'manage')` alongside the current `access` role, which needs a row in `APP_ROLES` on both sides and nothing else.
+**Fix:** When non-admin users are introduced, fetch the event first and verify `event.createdById === user.userId` before allowing the mutation. Add an `isAdmin` flag to the user model to let admins bypass the check.
 
 ---
 
-## 3. Activation token has no expiry — CLOSED 2026-09-06
+## 3. Activation token has no expiry
 
-**File:** ~~`src/models/calendar/users/users.service.ts`~~ — deleted.
+> **Superseded for new accounts (2026-09-05).** The admin module
+> (`src/models/admin/`) replaced account creation for the feedback, tickets and admin
+> apps: accounts now come from `invitations`, whose tokens expire after 7 days and are
+> stored only as a SHA-256 hash. The item below still stands for the legacy calendar
+> `users` table, which the admin module deliberately left alone - see
+> `docs/calendar-auth-migration.md`.
 
-The e-mail activation link was valid indefinitely. Closed not by adding an expiry but by
-removing the thing that issued it: step 5 of `docs/calendar-auth-migration.md` deleted the
-calendar's own account system. Accounts now come only from the admin module's `invitations`,
-whose tokens expire after 7 days and are stored as a SHA-256 hash.
+**File:** `src/models/calendar/users/users.service.ts` — `createUser` / `activateUser`
 
-Any activation link still sitting in an inbox now 404s. It only ever activated a legacy
-account, which no longer opens anything.
+The email activation link is valid indefinitely. Acceptable for a small, trusted userbase.
+
+**Fix:**
+1. Add an `activation_expires` column to the `users` table (e.g. `DATETIME`).
+2. Set it to `NOW() + INTERVAL 24 HOUR` in `createUser`.
+3. Check `activation_expires > NOW()` in `activateUser` before accepting the token.
 
 ---
 
-## 4. Password reset token has no expiry — CLOSED 2026-09-06
+## 4. Password reset token has no expiry
 
-**File:** ~~`src/models/calendar/users/users.service.ts`~~ — deleted.
+> **Superseded for new accounts (2026-09-05).** Password resets for admin-module accounts
+> go through better-auth, whose reset tokens expire after one hour. As with item 3, the
+> text below still applies to the legacy calendar `users` table.
 
-Same as item 3: `pw_reset_token_hash` never expired, and the code that set it no longer
-exists. Password resets go through better-auth, whose reset tokens expire after one hour.
+**File:** `src/models/calendar/users/users.service.ts` — `initiatePasswordReset` / `finalizePasswordReset`
+
+The reset token stored in `pw_reset_token_hash` never expires. Acceptable for a small, trusted userbase.
+
+**Fix:**
+1. Add a `pw_reset_expires` column to the `users` table (e.g. `DATETIME`).
+2. Set it to `NOW() + INTERVAL 15 MINUTE` in `initiatePasswordReset`.
+3. Check `pw_reset_expires > NOW()` in `finalizePasswordReset` before accepting the token.

docker/init/01-calendar-schema-dev.sql

@@ -1,13 +1,5 @@
--- Local dev only. Derived from the real schema, which was provided directly by
--- the repo owner (calendars, events, event_versions, and the sessions/users
--- tables that step 5 of docs/calendar-auth-migration.md renamed aside).
---
--- There is no users or sessions table here: a fresh dev database has no legacy
--- accounts to archive, so it starts where production ends up.
---
--- Changes made by this repo's own migrations under sql/calendar/ are folded in
--- here rather than appended, so a fresh dev container matches production once
--- every migration has been applied. Keep the two in step.
+-- Local dev only. Real schema, provided directly by the repo owner
+-- (calendars, events, event_versions, sessions, users) - not a guess.
 USE nachklang_calendar;
 
 CREATE TABLE `calendars` (
@@ -17,20 +9,41 @@ CREATE TABLE `calendars` (
   PRIMARY KEY (`calendar_id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
+CREATE TABLE `users` (
+  `user_id` int(11) NOT NULL AUTO_INCREMENT,
+  `full_name` text NOT NULL,
+  `password_hash` text DEFAULT NULL,
+  `email` text NOT NULL,
+  `is_active` tinyint(1) DEFAULT 0,
+  `pw_reset_token_hash` text DEFAULT NULL,
+  `activation_token` text DEFAULT NULL,
+  PRIMARY KEY (`user_id`),
+  UNIQUE KEY `email` (`email`) USING HASH
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
+
+CREATE TABLE `sessions` (
+  `session_id` int(11) NOT NULL AUTO_INCREMENT,
+  `user_id` int(11) NOT NULL,
+  `session_key_hash` text DEFAULT NULL,
+  `created_date` datetime DEFAULT current_timestamp(),
+  `valid_until` datetime DEFAULT (current_timestamp() + interval 30 day),
+  `last_ip` text DEFAULT NULL,
+  PRIMARY KEY (`session_id`),
+  KEY `sessions_users_user_id_fk` (`user_id`),
+  CONSTRAINT `sessions_users_user_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users` (`user_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
+
 CREATE TABLE `events` (
   `event_id` int(11) NOT NULL AUTO_INCREMENT,
   `calendar_id` int(11) NOT NULL,
   `uuid` text NOT NULL,
   `created_date` datetime DEFAULT current_timestamp(),
-  -- Bridge to the admin module's user ids; see sql/calendar/001_add_admin_user_bridge.sql.
-  `created_by_user_id` varchar(36) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  -- Creator name, archived before the legacy users table went away;
-  -- see sql/calendar/002_snapshot_legacy_creator_names.sql.
-  `created_by_name` varchar(255) DEFAULT NULL,
+  `created_by_id` int(11) NOT NULL,
   PRIMARY KEY (`event_id`),
   KEY `events_calendars_calendar_id_fk` (`calendar_id`),
-  KEY `events_created_by_user_idx` (`created_by_user_id`),
-  CONSTRAINT `events_calendars_calendar_id_fk` FOREIGN KEY (`calendar_id`) REFERENCES `calendars` (`calendar_id`)
+  KEY `events_users_user_id_fk` (`created_by_id`),
+  CONSTRAINT `events_calendars_calendar_id_fk` FOREIGN KEY (`calendar_id`) REFERENCES `calendars` (`calendar_id`),
+  CONSTRAINT `events_users_user_id_fk` FOREIGN KEY (`created_by_id`) REFERENCES `users` (`user_id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 CREATE TABLE `event_versions` (
@@ -44,16 +57,14 @@ CREATE TABLE `event_versions` (
   `repeat_frequency` text DEFAULT NULL,
   `location` text DEFAULT NULL,
   `url` text DEFAULT NULL,
-  -- Bridge to the admin module's user ids; see sql/calendar/001_add_admin_user_bridge.sql.
-  `version_created_by_user_id` varchar(36) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  -- Archived editor name; see sql/calendar/002_snapshot_legacy_creator_names.sql.
-  `version_created_by_name` varchar(255) DEFAULT NULL,
+  `version_created_by_id` int(11) DEFAULT NULL,
   `status` text DEFAULT NULL,
   `version_created_at` datetime DEFAULT current_timestamp(),
   PRIMARY KEY (`event_version_id`),
   KEY `event_versions_events_event_id_fk` (`event_id`),
-  KEY `event_versions_created_by_user_idx` (`version_created_by_user_id`),
-  CONSTRAINT `event_versions_events_event_id_fk` FOREIGN KEY (`event_id`) REFERENCES `events` (`event_id`) ON DELETE CASCADE ON UPDATE CASCADE
+  KEY `event_versions_users_user_id_fk` (`version_created_by_id`),
+  CONSTRAINT `event_versions_events_event_id_fk` FOREIGN KEY (`event_id`) REFERENCES `events` (`event_id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `event_versions_users_user_id_fk` FOREIGN KEY (`version_created_by_id`) REFERENCES `users` (`user_id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 INSERT INTO calendars (calendar_id, name, includes_calendars) VALUES
@@ -63,17 +74,16 @@ INSERT INTO calendars (calendar_id, name, includes_calendars) VALUES
     (4, 'choir', '[]'),
     (5, 'birthdays', '[]');
 
--- Two events carry only an archived creator name, as every pre-cutover event
--- does, and one carries an admin user id whose name is resolved live. Dev
--- therefore exercises both name sources rather than only one. The one with an
--- id is deliberately a PUBLIC event, so the anonymous listing the website uses
--- covers both. The id is the dev admin from 04-admin-schema.sql.
-INSERT INTO events (calendar_id, uuid, created_by_user_id, created_by_name) VALUES
-    (1, UUID(), NULL, 'Dev Admin'),
-    (1, UUID(), 'dev-user-0000-0000-0000-000000000001', NULL),
-    (1, UUID(), NULL, 'Dev Admin');
+-- Dev admin, password: devpassword
+INSERT INTO users (email, password_hash, full_name, is_active) VALUES
+    ('dev@nachklang.art', '$2b$10$vmj7POS/68SGE.eI7pGjMegrw0vNNZ2HVSUTra5NRsl8iOLwiMgZK', 'Dev Admin', 1);
 
-INSERT INTO event_versions (event_id, name, description, start_datetime, end_datetime, whole_day, location, url, status, version_created_by_user_id, version_created_by_name) VALUES
-    (1, 'Frühlingskonzert 2026', 'Erstes Konzert der Reihe', '2026-04-18 19:00:00', '2026-04-18 21:00:00', 0, 'Musikhochschule, Karlsruhe', 'https://www.nachklang.art/events/fruehlingskonzert-2026', 'PUBLIC', NULL, 'Dev Admin'),
-    (2, 'Sommerkonzert 2026', 'Zweites Konzert der Reihe', '2026-07-11 19:00:00', '2026-07-11 21:00:00', 0, 'Christuskirche, Karlsruhe', 'https://www.nachklang.art/events/sommerkonzert-2026', 'PUBLIC', 'dev-user-0000-0000-0000-000000000001', NULL),
-    (3, 'Adventskonzert 2026', 'Drittes Konzert der Reihe', '2026-12-05 19:00:00', '2026-12-05 21:00:00', 0, 'Stadtkirche, Karlsruhe', 'https://www.nachklang.art/events/adventskonzert-2026', 'DRAFT', NULL, 'Dev Admin');
+INSERT INTO events (calendar_id, uuid, created_by_id) VALUES
+    (1, UUID(), 1),
+    (1, UUID(), 1),
+    (1, UUID(), 1);
+
+INSERT INTO event_versions (event_id, name, description, start_datetime, end_datetime, whole_day, location, url, status, version_created_by_id) VALUES
+    (1, 'Frühlingskonzert 2026', 'Erstes Konzert der Reihe', '2026-04-18 19:00:00', '2026-04-18 21:00:00', 0, 'Musikhochschule, Karlsruhe', 'https://www.nachklang.art/events/fruehlingskonzert-2026', 'PUBLIC', 1),
+    (2, 'Sommerkonzert 2026', 'Zweites Konzert der Reihe', '2026-07-11 19:00:00', '2026-07-11 21:00:00', 0, 'Christuskirche, Karlsruhe', 'https://www.nachklang.art/events/sommerkonzert-2026', 'PUBLIC', 1),
+    (3, 'Adventskonzert 2026', 'Drittes Konzert der Reihe', '2026-12-05 19:00:00', '2026-12-05 21:00:00', 0, 'Stadtkirche, Karlsruhe', 'https://www.nachklang.art/events/adventskonzert-2026', 'DRAFT', 1);

docker/init/03-tickets-schema.sql

@@ -1,5 +1,3 @@
 USE nachklang_tickets;
 SOURCE /migrations/tickets/001_init.sql;
 SOURCE /migrations/tickets/002_add_require_address.sql;
-SOURCE /migrations/tickets/003_add_confirmation_email_status.sql;
-SOURCE /migrations/tickets/004_add_tickets_mailed.sql;

docker/init/04-admin-schema.sql

@@ -103,21 +103,15 @@ CREATE TABLE IF NOT EXISTS `rateLimit` (
 -- ---------------------------------------------------------------------------
 
 -- Which apps a user may administer. `admin` is just another app: holding it is
--- what lets someone manage users and invitations. A permission is (app, role);
--- `access` is the only role today, and the key admits several per app so finer
--- ones can be added by inserting rows rather than by migrating this table.
+-- what lets someone manage users and invitations. `role` is reserved for
+-- per-app roles later and is 'admin' for every row today.
 CREATE TABLE IF NOT EXISTS `user_app_permissions` (
 	`user_id`    VARCHAR(36) NOT NULL,
 	`app`        ENUM('calendar','feedback','tickets','admin') NOT NULL,
-	-- One row per (user, app, role). `access` means "may use this app at all"
-	-- and is the only role today; the key allows several per app so a finer
-	-- permission can be added later by inserting rows, not by migrating.
-	`role`       VARCHAR(32) NOT NULL DEFAULT 'access',
+	`role`       VARCHAR(32) NOT NULL DEFAULT 'admin',
 	`granted_by` VARCHAR(36) DEFAULT NULL,
 	`granted_at` DATETIME    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-	-- (user_id, app) is the leftmost prefix of this key, so the per-request
-	-- permission lookup needs no separate index.
-	PRIMARY KEY (`user_id`, `app`, `role`),
+	PRIMARY KEY (`user_id`, `app`),
 	CONSTRAINT `uap_user_fk` FOREIGN KEY (`user_id`) REFERENCES `user` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
@@ -128,7 +122,7 @@ CREATE TABLE IF NOT EXISTS `invitations` (
 	`email`       VARCHAR(255) NOT NULL,
 	`name`        VARCHAR(255) NOT NULL,
 	`token_hash`  CHAR(64)     NOT NULL,
-	`permissions` JSON         NOT NULL,
+	`apps`        JSON         NOT NULL,
 	`invited_by`  VARCHAR(36)  DEFAULT NULL,
 	`created_at`  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
 	`expires_at`  DATETIME     NOT NULL,
@@ -164,7 +158,7 @@ VALUES (
 );
 
 INSERT INTO `user_app_permissions` (`user_id`, `app`, `role`) VALUES
-	('dev-user-0000-0000-0000-000000000001', 'calendar', 'access'),
-	('dev-user-0000-0000-0000-000000000001', 'feedback', 'access'),
-	('dev-user-0000-0000-0000-000000000001', 'tickets',  'access'),
-	('dev-user-0000-0000-0000-000000000001', 'admin',    'access');
+	('dev-user-0000-0000-0000-000000000001', 'calendar', 'admin'),
+	('dev-user-0000-0000-0000-000000000001', 'feedback', 'admin'),
+	('dev-user-0000-0000-0000-000000000001', 'tickets',  'admin'),
+	('dev-user-0000-0000-0000-000000000001', 'admin',    'admin');

docs/calendar-auth-migration.md

@@ -1,27 +1,8 @@
 # Migrating the Calendar domain onto the admin identity module
 
-Status: **complete and deployed, 2026-09-06.** Every step is live. Step 2 was dropped by
-decision and part of step 5 brought forward; the rest went out as written.
-
-The calendar now shares one identity with the tickets, feedback and admin apps: writes sit
-behind `requireAppAccess('calendar')` against the shared session cookie, reads resolve that
-cookie optionally, and the calendar's own `users`/`sessions` tables are renamed aside and
-referenced by nothing. `DEFERRED_SECURITY.md` items 1, 3 and 4 closed with it.
-
-Verified in production after the final deploy: the public calendar answers anonymously on all
-three endpoints (23 events, 23 VEVENTs in the iCal feed, the next-event teaser intact),
-restricted calendars still refuse without a credential, unauthenticated writes answer 401,
-all six `/calendar/users/*` routes answer 404, CORS grants only `Content-Type`, sign-out from
-`calendar.nachklang.art` succeeds, and **every event kept its author** - rendered from the
-`created_by_name` snapshot, since the table it was copied from no longer exists under that
-name. That last one is the whole reason part of step 5 was brought forward.
-
-Remaining, at your leisure: `DROP TABLE sessions_legacy_archive, users_legacy_archive;`
-
-Written 2026-09-05 alongside the admin module (step 2 of `docs/plan-admin-auth.md` in the
-nachklang-admin repo), which deliberately left the calendar alone. Steps 1-4 of that plan
-are now live, so the calendar is the last module still on the legacy query-parameter
-sessions.
+Status: **not started.** Written 2026-09-05 alongside the admin module (step 2 of
+`docs/plan-admin-auth.md` in the nachklang-admin repo), which deliberately left the
+calendar alone.
 
 ## Why the calendar was left out
 
@@ -57,222 +38,37 @@ permissions can be granted before anything else moves.
 
 Each step is meant to leave production working on its own.
 
-1. **Add a bridging column.** ~~`ALTER TABLE events ADD COLUMN created_by_user_id
-   VARCHAR(36) NULL`, indexed. Nothing reads it yet.~~ **Done 2026-09-06**, as
-   `sql/calendar/001_add_admin_user_bridge.sql` - the first migration this repo owns for the
-   calendar schema, mirrored into `docker/init/01-calendar-schema-dev.sql`. It covers both
-   `events.created_by_user_id` and `event_versions.version_created_by_user_id`, and carries
-   no foreign key (see "What the code actually looks like" below). The dev seed leaves two
-   events on the legacy path and gives one an admin id, so step 3's dual-read has both cases
-   to exercise. Verified by applying the pre-migration schema and then the migration to a
-   throwaway MariaDB 11 container, and diffing `SHOW CREATE TABLE` against a fresh dev
-   schema: identical. Applied to the running dev database on the same day; a dev container
-   created before then needs it applied, or recreating.
-2. ~~**Map the accounts.**~~ **Dropped 2026-09-06.** There is no backfill: since the
-   creator is only ever a display name (see below), old events keep resolving through the
-   legacy join until step 5 and then simply lose the name. Re-inviting the people who
-   actually still need calendar access remains an operational task, but it is no longer a
-   migration step and nothing is blocked on it.
-3. **Dual-read.** ~~Change `events.service.ts` to prefer `created_by_user_id` and fall back
-   to `created_by_id`. Writes fill both.~~ **Done 2026-09-06.** `events.service.ts` now reads
-   both columns and prefers the admin one, resolving the name through a single
-   `findDisplayNames` lookup against the admin database per result set (added to
-   `users.admin.service.ts` for this). Four copies of the same SELECT and four copies of the
-   row mapper were collapsed into one of each first - the dual read would otherwise have had
-   to be written four times.
-
-   A name now has three possible sources, tried weakest first: the legacy join, then the
-   `created_by_name` snapshot from migration 002, then the live admin lookup - which wins
-   because it is the only one that follows an account being renamed. An admin id that no
-   longer resolves falls back rather than blanking, and a failure to reach the admin database
-   is caught and logged rather than propagated, so an anonymous read of the public calendar
-   never depends on the admin database being up. Covered by
-   `test/calendar/events.service.test.ts`.
-
-   **Writes are not dual-written**, contrary to the original plan: before the cutover the
-   request only ever carries a legacy session, so there is no admin id available to write.
-   Writes start filling `created_by_user_id` (and stop filling `created_by_id`) in step 4.
-4. **Switch the routes.** ~~Replace the query-parameter session checks in `events.router.ts`
-   and `users.router.ts` with `requireAppAccess('calendar')`, and change the Angular frontend
-   to `withCredentials: true`.~~ **Done 2026-09-06.** `DEFERRED_SECURITY.md` item 1 is closed:
-   no route reads `sessionId`/`sessionKey` any more.
-
-   How it came out, route by route:
-
-   - The four write routes sit behind `requireAppAccess('calendar')` as middleware. They
-     answer 401 when signed out and 403 without the permission, where they used to answer 403
-     for both.
-   - The three read routes cannot use middleware - the same URL serves an anonymous visitor,
-     an iCal subscription holding a shared password, and a signed-in editor who should see
-     drafts. They call `resolveAccess` optionally instead (`signedInEditor` in the router),
-     and a signed-in user *without* the calendar permission is treated as anonymous rather
-     than refused, so they keep their access to the public calendar.
-   - `credentials.service.ts` lost its session half entirely and is now just the password
-     table. `hasAccess(calendar, password)`.
-   - `/calendar/users/*` was left alone. Nothing calls it and a session it mints opens
-     nothing, but they are live password-accepting endpoints - step 5 removes them.
-
-   Also: `calendar.nachklang.art` joined `DEFAULT_APP_ORIGINS` (better-auth `trustedOrigins`,
-   without which sign-out from the calendar fails while everything else works), and
-   `localhost:4200` joined the dev origins for the same reason.
-
-   Two things this step had to carry that the original sequence put in step 5:
-
-   - **`sql/calendar/003_allow_null_legacy_creator.sql` makes `events.created_by_id` nullable**
-     (`MODIFY created_by_id INT NULL`). It is `NOT NULL` today, so the first event created after the
-     cutover would otherwise fail to insert - there is no legacy int id to write any more.
-     `event_versions.version_created_by_id` is already nullable. The foreign key can stay
-     until step 5; it permits NULL. It also re-runs 002's idempotent name backfill, to catch
-     anything created between the two migrations. Applying it early is safe - widening a
-     column to accept NULL cannot break the running pre-cutover build.
-   - **The public calendar stays anonymous.** `hasAccess('public')` returns true before any
-     credential check, and nachklang.art reads `/calendar/events/public/json` and
-     `/public/json/next` with no session at all. Pinned at both levels - the password table in
-     `test/calendar/credentials.service.test.ts`, the routes themselves in
-     `test/calendar/events.router.test.ts` - so this cannot regress quietly.
-
-   ### Deploy checklist
-
-   Production has **none** of the three migrations: 001 and 002 were only ever applied to the
-   dev database. The API build below selects `created_by_user_id` and `created_by_name` on
-   every read, so deploying it against a database missing them fails every calendar request
-   including the anonymous public feed the website uses. In order:
-
-   1. **Apply `sql/calendar/001`, `002`, `003`, in that order**, against `CALENDAR_DB`. All
-      three are re-runnable, so applying one that is already applied is a no-op. Verify
-      before continuing:
-      `SHOW COLUMNS FROM events LIKE '%by_user%'; SHOW COLUMNS FROM events LIKE '%by_name%';`
-      - four rows across the two tables, and `created_by_id` nullable.
-   2. **Check `APP_ORIGINS` on the API vhost.** `calendar.nachklang.art` is in the code's
-      default list, but the environment variable *replaces* that list rather than adding to
-      it - so if it is set at all (the tickets/feedback cutover may have set it), append
-      `https://calendar.nachklang.art` or the calendar's sign-out will 403 while everything
-      else works. That is the failure mode the comment in `admin.config.ts` warns about.
-   3. **Deploy the API.**
-   4. **Deploy the calendar frontend immediately after.** Do not leave a gap - see below.
-   5. **Re-run 002's two `UPDATE` statements.** Between step 1 and step 3 the old API was
-      still writing `created_by_id` with no snapshot; those few rows would otherwise lose
-      their author at step 5.
-   6. **Rebuild the admin app** if `NEXT_PUBLIC_ALLOWED_REDIRECT_ORIGINS` does not already
-      contain `https://calendar.nachklang.art`. It is a **build-time** value, so a restart
-      does nothing.
-
-   **The window between steps 3 and 4 does not look broken, which is the danger.** The old
-   Angular bundle starts by calling `POST /calendar/users/checkSessionValid`, and those
-   legacy routes are untouched - so it still succeeds and the page renders as signed in. What
-   the user then sees is an empty event table and saves that silently do nothing. It looks
-   like the calendar lost its data, not like a deploy in progress. Keep the gap to minutes,
-   or take the frontend offline for it.
-
-   **One-way door:** any iCal subscription whose URL carries `?sessionId=&sessionKey=` rather
-   than `?password=` stops working permanently. The shared-password URLs are unaffected.
-5. **Drop the legacy path.** **Deployed 2026-09-06.** Gated on step 4 being live, which it
-   was.
-
-   What went:
-
-   - `src/models/calendar/users/` in its entirety - registration, login, activation, both
-     password-reset routes, and the session checking the feedback and tickets admin areas
-     used to authenticate against - plus its mount in `Calendar.router.ts`. That was the
-     API's last unauthenticated account-creation and mail-sending endpoint.
-   - The two `LEFT OUTER JOIN users` clauses in `events.service.ts` and the `legacy_*`
-     aliases they fed, along with `created_by_id` / `version_created_by_id` in the SELECT, the
-     row mapper and the `Event` interface. One name source remains besides the live admin
-     lookup: the snapshot, which is what made this safe.
-   - `X-Session-Id` / `X-Session-Key` from the CORS `allowedHeaders`. Nothing had read them
-     since the tickets and feedback cutover, or sent them since this one.
-   - The tripwire in `test/admin/auth-binding.ts` asserting neither module fell back to a
-     calendar header session. There is nothing left to fall back to.
-
-   `DEFERRED_SECURITY.md` items **3** and **4** (activation and reset tokens never expiring)
-   close with it - not by adding expiries but by deleting the code that issued them.
-
-   ### Deploy checklist — kept for the record; the order was REVERSED from step 4
-
-   Step 4's migration only added columns, so it went first. `004` *removes* columns and a
-   table that the currently running build still selects and joins, so running it first fails
-   every calendar read including the public feed. The step 5 build references none of them and
-   runs happily against the old schema. Therefore:
-
-   1. **Confirm the snapshot is complete.** Both must return 0:
-      ```sql
-      SELECT SUM(created_by_id IS NOT NULL AND created_by_name IS NULL) FROM events;
-      SELECT SUM(version_created_by_id IS NOT NULL AND version_created_by_name IS NULL) FROM event_versions;
-      ```
-      A non-zero count is an event whose author `004` would erase. Re-run 002's backfill first.
-   2. **Deploy the API.** No frontend deploy is needed: the calendar frontend never read
-      `createdById` (its `Event` model has only the name), and nothing else is known to.
-   3. **Confirm the calendar still works** - the public feed, a signed-in read, and one save.
-      At this point the old columns and tables still exist, unused, so this step is fully
-      reversible by redeploying the previous build.
-
-      Note that `tsc` does not remove output for deleted sources, so a build over an existing
-      `dist/` leaves `dist/src/models/calendar/users/*.js` behind. Nothing imports it and the
-      routes 404, but the deployed artifact still contains the code - clear `dist/` in the
-      pipeline if you want the artifact to match the source.
-   4. **Apply `sql/calendar/004_drop_legacy_auth.sql`.** This is the point of no return for
-      the columns; the accounts themselves are only renamed aside.
-   5. Optionally, later and at a quiet moment:
-      `DROP TABLE sessions_legacy_archive, users_legacy_archive;`
-
-   **One-way door:** `Event.createdById` and `lastModifiedById` leave the API response. Check
-   anything reading `/calendar/events/*/json` that is not the calendar frontend.
-
-   **Observed during the deploy, worth keeping.** A browser holding a *cached pre-cutover*
-   Angular bundle looked signed in and showed every event's status as "Error". The old bundle
-   called `/calendar/users/checkSessionValid`, which still existed between step 4 and step 5,
-   so it rendered as authenticated - then fetched events with no cookie, got the anonymous
-   listing, which omits `status`, and the UI's status switch fell through to its error label.
-   Signing out and back in fixed it. After this step that route 404s, so a stale bundle now
-   fails honestly instead of faking a session. This is the same "does not look broken" window
-   the step 4 checklist warns about, seen from the other side.
-
-## What the code actually looks like (surveyed 2026-09-06)
-
-Four things found while doing step 1 that change how the later steps should be built:
-
-- **`created_by_id` is display-only.** Nothing authorises on it. `events.router.ts` gates
-  PUT, POST, DELETE and `/move` on `user?.isActive` alone - there is no "only the creator may
-  edit" rule anywhere - and the column is read back solely to render `created_by_name` and
-  `last_modified_by_name`. That de-risks steps 2, 3 and 5 considerably: an event whose
-  creator never gets re-invited loses a name in the UI, it does not become uneditable or
-  invisible. It also means the step 2 backfill is best-effort, not a precondition.
-- **The two schemas are separate databases.** `nachklang_calendar` and `nachklang_admin`
-  have their own connection pools (`Calendar.db.ts` vs the admin module's Kysely instance).
-  So the bridging columns get no foreign key, and - the part the original sequence missed -
-  **the `LEFT OUTER JOIN users` that produces the creator's name cannot simply be repointed**.
-  It would have to become a cross-schema join, which hardcodes the admin database name into
-  calendar SQL and ties the two schemas together exactly as an FK would. Recommendation for
-  step 3: drop the join for the new path and resolve names in the service layer instead -
-  collect the distinct ids from the result set and do one lookup against the admin users
-  service. One extra query per listing, no coupling, and it keeps working if the admin
-  database ever moves.
-- **`events.created_by_id` is `NOT NULL`.** Step 5 cannot simply stop writing it; that step
-  has to drop the column (and its FK to `users`) in the same migration that stops the writes,
-  or make it nullable first.
-- **Every calendar read already hits the session table.** `/:calendar/json` calls
-  `UserService.checkSession` before falling back to `credentials.service.ts`, so the shared
-  credentials are the *fallback*, not the primary path. Step 4 replaces the first half of
-  that with `requireAppAccess('calendar')` and has to decide what happens to the second half
-  - which is the first open question below.
+1. **Add a bridging column.** `ALTER TABLE events ADD COLUMN created_by_user_id
+   VARCHAR(36) NULL`, indexed. Nothing reads it yet.
+2. **Map the accounts.** For every legacy `users` row that should survive, invite the
+   person through the admin UI. On acceptance, backfill `events.created_by_user_id` from
+   `events.created_by_id` via an email-to-new-id mapping. Everyone not re-invited keeps
+   working on the legacy path until step 4.
+3. **Dual-read.** Change `events.service.ts` to prefer `created_by_user_id` and fall back
+   to `created_by_id`. Writes fill both. This is the only step that is temporary code, and
+   it should carry a removal note pointing at step 5.
+4. **Switch the routes.** Replace the query-parameter session checks in
+   `events.router.ts` and `users.router.ts` with `requireAppAccess('calendar')`, and change
+   the Angular frontend to `withCredentials: true` against the same origin list. Deploy the
+   API first; the calendar frontend is broken between the two deploys, so pick a quiet
+   time. This closes `DEFERRED_SECURITY.md` item 1.
+5. **Drop the legacy path.** Remove `users.service.ts`'s session handling, the `sessions`
+   table, `created_by_id`, and the dual-read from step 3. Legacy `/calendar/users/*` stays
+   only if something still calls it - otherwise delete it too. `X-Session-Id` /
+   `X-Session-Key` can then come out of the CORS `allowedHeaders` list in
+   `src/app.factory.ts`.
 
 ## Open questions to settle before starting
 
-**Settled 2026-09-06:**
-
-- **The shared calendar credentials keep working, but only for iCal.** The web app goes
-  cookie-only at step 4; `MEMBER_CREDENTIAL` and friends survive on
-  `GET /calendar/events/{calendar}/ical`, which is the one case where the client genuinely
-  cannot send a cookie. Everything else in `credentials.service.ts` goes with step 5.
-  `public` stays anonymous everywhere - see the note under step 4.
-- **The iCal export keeps its own scheme.** Same reasoning; it is the reason the shared
-  credentials survive at all rather than an exception to their removal.
-- **No account backfill.** See step 2 above.
-- **Pre-cutover authorship is archived, not discarded.** `events.created_by_name` and
-  `event_versions.version_created_by_name`, backfilled once by migration 002 and never
-  written again. This was originally listed as a step 5 question; it was brought forward so
-  the data is safe well before the table that holds it is dropped.
-
-**Nothing is open.** The last one - ~~`event_versions.version_created_by_id`~~, the same INT
-reference on the version rows - was handled in passing: step 1 gave it a sibling bridging
-column, step 2 a sibling snapshot, and step 3 reads it exactly like `events`.
+- **The shared calendar credentials.** Do `MEMBER_CREDENTIAL` and friends stay as a
+  separate mechanism (they serve people with no account at all, and iCal clients that
+  cannot send headers), or do read-only accounts replace them? This is a product decision,
+  not a technical one, and it decides how much of `credentials.service.ts` survives.
+- **The iCal export.** `GET /calendar/events/{calendar}/ical` takes a password in the query
+  string on purpose, because iCal clients cannot send headers. Cookie sessions do not help
+  here; this endpoint likely keeps its own scheme.
+- **Which legacy accounts to keep.** Step 2 is the moment to not re-invite people who no
+  longer need access.
+- **`event_versions.version_created_by_id`.** The same INT reference again, joined in
+  `events.service.ts` for the "last modified by" name. It has to move with `events`, and it
+  is the reason step 1's bridging column needs a sibling on `event_versions`.

sql/admin/001_init.sql

@@ -114,21 +114,15 @@ CREATE TABLE IF NOT EXISTS `rateLimit` (
 -- ---------------------------------------------------------------------------
 
 -- Which apps a user may administer. `admin` is just another app: holding it is
--- what lets someone manage users and invitations. A permission is (app, role);
--- `access` is the only role today, and the key admits several per app so finer
--- ones can be added by inserting rows rather than by migrating this table.
+-- what lets someone manage users and invitations. `role` is reserved for
+-- per-app roles later and is 'admin' for every row today.
 CREATE TABLE IF NOT EXISTS `user_app_permissions` (
 	`user_id`    VARCHAR(36) NOT NULL,
 	`app`        ENUM('calendar','feedback','tickets','admin') NOT NULL,
-	-- One row per (user, app, role). `access` means "may use this app at all"
-	-- and is the only role today; the key allows several per app so a finer
-	-- permission can be added later by inserting rows, not by migrating.
-	`role`       VARCHAR(32) NOT NULL DEFAULT 'access',
+	`role`       VARCHAR(32) NOT NULL DEFAULT 'admin',
 	`granted_by` VARCHAR(36) DEFAULT NULL,
 	`granted_at` DATETIME    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-	-- (user_id, app) is the leftmost prefix of this key, so the per-request
-	-- permission lookup needs no separate index.
-	PRIMARY KEY (`user_id`, `app`, `role`),
+	PRIMARY KEY (`user_id`, `app`),
 	CONSTRAINT `uap_user_fk` FOREIGN KEY (`user_id`) REFERENCES `user` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
@@ -139,7 +133,7 @@ CREATE TABLE IF NOT EXISTS `invitations` (
 	`email`       VARCHAR(255) NOT NULL,
 	`name`        VARCHAR(255) NOT NULL,
 	`token_hash`  CHAR(64)     NOT NULL,
-	`permissions` JSON         NOT NULL,
+	`apps`        JSON         NOT NULL,
 	`invited_by`  VARCHAR(36)  DEFAULT NULL,
 	`created_at`  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
 	`expires_at`  DATETIME     NOT NULL,

sql/calendar/001_add_admin_user_bridge.sql

@@ -1,38 +0,0 @@
--- Nachklang e.V. Calendar module — step 1 of docs/calendar-auth-migration.md.
--- Adds the bridging columns that let an event record who created it as an
--- *admin* user id (VARCHAR(36)) alongside the legacy calendar users.user_id
--- (INT). Apply manually against the CALENDAR_DB database:
---   mysql -h <DB_HOST> -u <DB_USER> -p <CALENDAR_DB> < 001_add_admin_user_bridge.sql
---
--- Numbered 001 because this is the first migration this repo owns for the
--- calendar schema: the tables themselves predate it and were provided by the
--- repo owner (mirrored for dev in docker/init/01-calendar-schema-dev.sql).
---
--- Nothing reads these columns yet — step 3 introduces the dual-read. Adding
--- them first means the backfill in step 2 has somewhere to write, and this
--- migration can be applied to production on its own without any code change.
---
--- No foreign key, on purpose. The admin `user` table lives in a *different*
--- database (nachklang_admin) behind a different connection pool, and a
--- cross-schema FK would tie the two schemas' lifecycles together: you could no
--- longer dump, restore or move one without the other. The reference is
--- enforced in application code, which is also where the legacy/new fallback
--- lives.
---
--- The collation is pinned to the admin database's (utf8mb4_unicode_ci) rather
--- than inherited from the calendar tables' utf8mb4_general_ci. These columns
--- hold ids that only ever compare against nachklang_admin.user.id, and a
--- mismatched collation makes any such comparison fail at runtime with
--- "Illegal mix of collations" instead of at review time.
-
-ALTER TABLE `events`
-    ADD COLUMN IF NOT EXISTS `created_by_user_id` VARCHAR(36)
-        CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci
-        NULL DEFAULT NULL AFTER `created_by_id`,
-    ADD KEY IF NOT EXISTS `events_created_by_user_idx` (`created_by_user_id`);
-
-ALTER TABLE `event_versions`
-    ADD COLUMN IF NOT EXISTS `version_created_by_user_id` VARCHAR(36)
-        CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci
-        NULL DEFAULT NULL AFTER `version_created_by_id`,
-    ADD KEY IF NOT EXISTS `event_versions_created_by_user_idx` (`version_created_by_user_id`);

sql/calendar/002_snapshot_legacy_creator_names.sql

@@ -1,42 +0,0 @@
--- Nachklang e.V. Calendar module — step 5 preparation, brought forward.
--- Apply manually against the CALENDAR_DB database, after 001:
---   mysql -h <DB_HOST> -u <DB_USER> -p <CALENDAR_DB> < 002_snapshot_legacy_creator_names.sql
---
--- Snapshots the creator's and last editor's *name* onto the event itself.
---
--- Why: the creator is only ever rendered as a name (nothing authorises on it),
--- and today that name comes from joining the calendar's own `users` table.
--- Step 5 drops that table, which would silently erase the authorship of every
--- event created before the cutover. There is no account backfill to save them
--- either - that was dropped deliberately, see docs/calendar-auth-migration.md.
--- One text column per reference keeps the history at no ongoing cost.
---
--- These columns are an archive, not a source of truth. Nothing writes them
--- after this backfill: events created from the cutover onwards carry an admin
--- user id, whose name is resolved live so that renaming an account updates
--- everywhere. The read path prefers the live admin name, falls back to this
--- snapshot, and falls back again to the join until step 5 removes it.
---
--- The whole file is re-runnable: IF NOT EXISTS on the columns, and the backfill
--- only touches rows with no snapshot yet. Step 4's migration re-runs the
--- backfill, to catch anything created between this migration and the cutover.
---
--- No charset clause: unlike 001's id columns these hold display text that is
--- only ever compared against other calendar data, so they inherit the tables'
--- utf8mb4_general_ci like the columns they are copied from.
-
-ALTER TABLE `events`
-    ADD COLUMN IF NOT EXISTS `created_by_name` VARCHAR(255) NULL DEFAULT NULL AFTER `created_by_user_id`;
-
-ALTER TABLE `event_versions`
-    ADD COLUMN IF NOT EXISTS `version_created_by_name` VARCHAR(255) NULL DEFAULT NULL AFTER `version_created_by_user_id`;
-
-UPDATE `events` e
-    JOIN `users` u ON u.user_id = e.created_by_id
-    SET e.created_by_name = u.full_name
-    WHERE e.created_by_name IS NULL;
-
-UPDATE `event_versions` v
-    JOIN `users` u ON u.user_id = v.version_created_by_id
-    SET v.version_created_by_name = u.full_name
-    WHERE v.version_created_by_name IS NULL;

sql/calendar/003_allow_null_legacy_creator.sql

@@ -1,32 +0,0 @@
--- Nachklang e.V. Calendar module — step 4 of docs/calendar-auth-migration.md,
--- the cutover. Apply manually against the CALENDAR_DB database, after 002,
--- and BEFORE deploying the API build that goes with it:
---   mysql -h <DB_HOST> -u <DB_USER> -p <CALENDAR_DB> < 003_allow_null_legacy_creator.sql
---
--- From the cutover on, an event's creator is an admin-module user id. There is
--- no legacy calendar user id to write any more, and `events.created_by_id` is
--- NOT NULL - so without this the very first event created after the deploy
--- fails to insert. `event_versions.version_created_by_id` is already nullable.
---
--- The foreign key to `users` is kept: it permits NULL, so it costs nothing
--- until step 5 drops the column and the table together.
---
--- Applying this early is harmless. Widening a column to accept NULL cannot
--- break the running pre-cutover build, which always supplies a value, so this
--- can go out ahead of the deploy rather than during it.
-
-ALTER TABLE `events`
-    MODIFY COLUMN `created_by_id` INT(11) NULL DEFAULT NULL;
-
--- Re-run of 002's backfill, to catch anything created between the two
--- migrations while the legacy path was still writing events. Idempotent by
--- construction: it only touches rows that have no snapshot yet.
-UPDATE `events` e
-    JOIN `users` u ON u.user_id = e.created_by_id
-    SET e.created_by_name = u.full_name
-    WHERE e.created_by_name IS NULL;
-
-UPDATE `event_versions` v
-    JOIN `users` u ON u.user_id = v.version_created_by_id
-    SET v.version_created_by_name = u.full_name
-    WHERE v.version_created_by_name IS NULL;

sql/calendar/004_drop_legacy_auth.sql

@@ -1,60 +0,0 @@
--- Nachklang e.V. Calendar module — step 5 of docs/calendar-auth-migration.md.
--- Apply manually against the CALENDAR_DB database, after 003:
---   mysql -h <DB_HOST> -u <DB_USER> -p <CALENDAR_DB> < 004_drop_legacy_auth.sql
---
--- *** APPLY THIS AFTER DEPLOYING THE API, NOT BEFORE. ***
---
--- This is the opposite order from the step 4 cutover, and getting it wrong by
--- analogy is the obvious mistake. Step 4's migration only *added* things, so it
--- was safe ahead of the deploy. This one removes columns and a table that the
--- currently running build still selects and joins - applying it first fails
--- every calendar read, including the anonymous public feed the website uses.
--- The step 5 build touches none of them, so it runs happily against the old
--- schema; deploy it, confirm the calendar works, then run this.
---
--- Nothing here loses information that is still reachable: the creators' display
--- names were snapshotted into events.created_by_name and
--- event_versions.version_created_by_name by migration 002, and the step 4
--- runbook re-ran that backfill after the deploy. Verify before running:
---
---   SELECT SUM(created_by_id IS NOT NULL AND created_by_name IS NULL) FROM events;
---   SELECT SUM(version_created_by_id IS NOT NULL AND version_created_by_name IS NULL) FROM event_versions;
---
--- Both must be 0. A non-zero count is an event whose author this migration
--- would erase; re-run 002's backfill first.
-
--- The foreign keys have to go before the columns they are declared on.
--- IF EXISTS so that a re-run after a partial failure gets past them.
-ALTER TABLE `events`
-    DROP FOREIGN KEY IF EXISTS `events_users_user_id_fk`;
-
-ALTER TABLE `event_versions`
-    DROP FOREIGN KEY IF EXISTS `event_versions_users_user_id_fk`;
-
-ALTER TABLE `events`
-    DROP INDEX IF EXISTS `events_users_user_id_fk`,
-    DROP COLUMN IF EXISTS `created_by_id`;
-
-ALTER TABLE `event_versions`
-    DROP INDEX IF EXISTS `event_versions_users_user_id_fk`,
-    DROP COLUMN IF EXISTS `version_created_by_id`;
-
--- The accounts themselves are renamed aside rather than dropped.
---
--- Nothing visible depends on them any more - the names are snapshotted, and no
--- code has referenced these tables since the step 4 cutover. But they still
--- hold e-mail addresses and password hashes, and a rename makes them
--- unreachable without destroying anything.
---
--- `sessions` has a foreign key into `users`; InnoDB rewires it to the new name
--- on rename, so after this it reads REFERENCES `users_legacy_archive` and the
--- pair stays internally consistent whichever order they are renamed in.
--- Verified on MariaDB 11.
---
--- Unlike the statements above this is not re-runnable, and that is the safe
--- behaviour: a second run fails on a missing `sessions` rather than doing
--- anything. Drop them for real whenever you like, at a moment when nobody is
--- mid-deploy:
---   DROP TABLE `sessions_legacy_archive`, `users_legacy_archive`;
-RENAME TABLE `sessions` TO `sessions_legacy_archive`;
-RENAME TABLE `users`    TO `users_legacy_archive`;

sql/tickets/004_add_tickets_mailed.sql

@@ -1,8 +0,0 @@
--- Nachklang e.V. Tickets module — adds a per-event "tickets are mailed" flag.
--- Defaults to 0 (not mailed) because no event mails physical tickets today -
--- the redemption confirmation email uses this to decide whether to tell the
--- guest their tickets await pickup at the Abendkasse instead. Apply manually
--- against TICKETS_DB, after 003_add_confirmation_email_status.sql:
---   mysql -h <DB_HOST> -u <DB_USER> -p <TICKETS_DB> < 004_add_tickets_mailed.sql
-ALTER TABLE event_ticket_settings
-    ADD COLUMN tickets_mailed TINYINT(1) NOT NULL DEFAULT 0 AFTER require_address;

src/app.factory.ts

@@ -4,7 +4,6 @@ import swaggerUi from 'swagger-ui-express';
 import swaggerJSDoc from 'swagger-jsdoc';
 import cors from 'cors';
 import {toNodeHandler} from 'better-auth/node';
-import logger from './middleware/logger.js';
 
 // Router imports
 import {calendarRouter} from './models/calendar/Calendar.router.js';
@@ -12,7 +11,7 @@ import {feedbackRouter} from './models/feedback/Feedback.router.js';
 import {ticketsRouter} from './models/tickets/Tickets.router.js';
 import {adminRouter} from './models/admin/Admin.router.js';
 import {auth} from './models/admin/admin.auth.js';
-import {ADMIN_ALLOWED_ORIGINS, isProd} from './models/admin/admin.config.js';
+import {ADMIN_ALLOWED_ORIGINS} from './models/admin/admin.config.js';
 
 
 dotenv.config();
@@ -48,27 +47,16 @@ export const createApp = (): express.Application => {
 		// staging host does not need a code change here.
 		...ADMIN_ALLOWED_ORIGINS
 	];
-	// `isProd` from admin.config, NOT `NODE_ENV !== 'production'`. The two are not
-	// the same when NODE_ENV is unset, which is exactly what a fresh Plesk vhost
-	// gives you: the old test called that "dev" and opened the loopback and
-	// private-LAN exceptions below. With `credentials: true` on this CORS config
-	// and a session cookie scoped to .nachklang.art, that let any page served
-	// from localhost read a signed-in admin's data cross-origin. admin.config
-	// treats anything but an explicit 'development'/'test' as production, so an
-	// unset value now fails closed.
-	const isDev = !isProd;
+	const isDev = process.env.NODE_ENV !== 'production';
 	const localhostRegex = /^http:\/\/localhost:\d+$/;
 	// Matches http://<private-LAN-IPv4>:<port> - needed so the feedback form can
 	// be reached from a real phone over WiFi during dev (the phone's Origin is
 	// the dev machine's LAN IP, never "localhost"). Dev-only, same as above.
 	const lanIpRegex = /^http:\/\/(192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}):\d+$/;
 	app.use(cors({
-		// Content-Type alone. X-Session-Id / X-Session-Key were allowed here
-		// through the two cutovers so that a browser still holding a pre-cutover
-		// bundle got a clean 401 rather than a confusing CORS preflight failure.
-		// Nothing has read them since the first cutover and nothing has sent them
-		// since the second, so they came out with the rest of the legacy path.
-		allowedHeaders: ['Content-Type'],
+		// X-Session-* stay allowed until the calendar module is migrated off the
+		// legacy header sessions (see docs/calendar-auth-migration.md).
+		allowedHeaders: ['Content-Type', 'X-Session-Id', 'X-Session-Key'],
 		// The admin session lives in a cookie, so browsers must be allowed to send
 		// it cross-origin - this is what makes credentials: 'include' work.
 		credentials: true,
@@ -95,26 +83,7 @@ export const createApp = (): express.Application => {
 
 	// better-auth's own handler, mounted before express.json(): it reads the raw
 	// request body stream itself and a parsed body would leave it hanging.
-	//
-	// Wrapped, because Express 4 does not await an async handler: a rejected
-	// promise escapes as an unhandled rejection instead of becoming a response.
-	// Nearly every better-auth route touches the admin database, so a database
-	// blip would leave the request hanging with no answer at all while the
-	// process logged an uncaughtException - observed by pointing ADMIN_DB at a
-	// database the user cannot open. Answer 503 instead: the caller learns, and
-	// the other domains keep serving.
-	const authHandler = toNodeHandler(auth);
-	app.all('/admin/auth/*', (req, res) => {
-		Promise.resolve(authHandler(req, res)).catch((e: any) => {
-			logger.error('Admin auth handler failed', {path: req.path, detail: e?.message});
-			if (!res.headersSent) {
-				res.status(503).send({
-					status: 'SERVICE_UNAVAILABLE',
-					message: 'Die Anmeldung ist derzeit nicht verfügbar. Bitte versuche es später erneut.'
-				});
-			}
-		});
-	});
+	app.all('/admin/auth/*', toNodeHandler(auth));
 
 	// here we are adding middleware to parse all incoming requests as JSON
 	app.use(express.json());

src/models/admin/Admin.router.ts

@@ -35,11 +35,6 @@ adminRouter.get('/me', requireSignedIn, (req: Request, res: Response) => {
 		id: res.locals.admin.id,
 		email: res.locals.admin.email,
 		fullName: res.locals.admin.displayName,
-		// `permissions` is the full (app, role) truth; `apps` is the distinct
-		// apps within it. Both are sent because the three frontends only ever ask
-		// "may I show this app?", and keeping `apps` means a finer permission can
-		// land here without a coordinated deploy of all of them.
-		permissions: res.locals.admin.permissions,
 		apps: res.locals.admin.apps
 	});
 });

src/models/admin/admin.auth.ts

@@ -1,6 +1,6 @@
 import {betterAuth} from 'better-auth';
 import {APIError} from 'better-auth/api';
-import {passkey, getAuthenticatorName} from '@better-auth/passkey';
+import {passkey} from '@better-auth/passkey';
 import {NachklangAdminDB} from './Admin.db.js';
 import {invitationsPlugin} from './invitations/invitations.plugin.js';
 import {sendPasswordResetMail} from './admin.mail.js';
@@ -33,11 +33,7 @@ const localhostOrigins = [
 	'http://localhost:3000',
 	'http://localhost:3001',
 	'http://localhost:3002',
-	'http://localhost:3003',
-	// The Angular calendar frontend; `ng serve` defaults to 4200. Missing from
-	// this list, sign-out from the calendar answers 403 in dev only, which is a
-	// confusing thing to debug against a production config that is fine.
-	'http://localhost:4200'
+	'http://localhost:3003'
 ];
 
 const trustedOrigins = isProd
@@ -120,24 +116,7 @@ export const auth = betterAuth({
 		passkey({
 			rpID: PASSKEY_RP_ID,
 			rpName: 'Nachklang',
-			origin: ADMIN_ALLOWED_ORIGINS,
-
-			registration: {
-				// Without this, every passkey is stored with name = NULL and the
-				// account page can only label them all "Passkey" - useless at the
-				// one moment that list matters, when someone has to remove the
-				// passkey on the device they just lost.
-				//
-				// The AAGUID identifies the authenticator *model* (not a device
-				// and not a person), and better-auth ships the lookup table, so
-				// this yields "1Password", "iCloud Keychain", "Windows Hello".
-				// It only fills a blank: a name the client sent always wins, and
-				// an unknown AAGUID leaves the column NULL as before.
-				afterVerification: async ({verification}) => {
-					const name = getAuthenticatorName(verification.registrationInfo?.aaguid);
-					return name ? {name} : undefined;
-				}
-			}
+			origin: ADMIN_ALLOWED_ORIGINS
 		}),
 		invitationsPlugin()
 	],

src/models/admin/admin.bootstrap.ts

@@ -1,7 +1,6 @@
 import * as UsersService from './users/users.admin.service.js';
 import * as InvitationsService from './invitations/invitations.service.js';
 import {sendInvitationMail} from './admin.mail.js';
-import {ACCESS_ROLE} from './admin.schema.js';
 import {ADMIN_APP_URL, ADMIN_BOOTSTRAP_EMAIL, LOG_INVITE_LINKS} from './admin.config.js';
 import logger from '../../middleware/logger.js';
 
@@ -49,7 +48,7 @@ export const bootstrapAdmin = async (): Promise<void> => {
 		const invitation = await InvitationsService.createInvitation(
 			email,
 			'Nachklang Admin',
-			[{app: 'admin', role: ACCESS_ROLE}],
+			['admin'],
 			null
 		);
 

src/models/admin/admin.config.ts

@@ -73,29 +73,8 @@ const parseList = (value: string | undefined, fallback: string[]): string[] => {
 	return parsed.length > 0 ? parsed : fallback;
 };
 
-/**
- * The apps whose frontends may talk to /admin/* with credentials.
- *
- * They feed better-auth's `trustedOrigins`, which is what lets the tickets and
- * feedback admin areas call /admin/auth/sign-out from their own origin. That
- * became load-bearing with the step 4 cutover: before it, the only browser
- * origin that ever reached /admin/auth was the admin app itself. The calendar
- * joined them with its own cutover (docs/calendar-auth-migration.md step 4).
- *
- * Hence the production default rather than an empty list. An origin missing
- * here fails in a way that is easy to misread - sign-in works, the app works,
- * and only sign-out returns an origin error - so the two frontends we know
- * about are named here and APP_ORIGINS overrides them for a staging host.
- * Dev adds the localhost ports separately (see admin.auth.ts).
- */
-const DEFAULT_APP_ORIGINS = [
-	'https://tickets.nachklang.art',
-	'https://feedback.nachklang.art',
-	'https://calendar.nachklang.art'
-];
-
-export const APP_ORIGINS = parseList(process.env.APP_ORIGINS, DEFAULT_APP_ORIGINS)
-	.map(origin => origin.replace(/\/$/, ''));
+// The apps whose frontends may talk to /admin/* with credentials.
+export const APP_ORIGINS = parseList(process.env.APP_ORIGINS, []).map(origin => origin.replace(/\/$/, ''));
 
 // Kept in sync by construction rather than by three separate lists: the admin
 // app itself always counts, and dev adds the local ports.
@@ -122,53 +101,16 @@ export const ADMIN_ALLOWED_ORIGINS = Array.from(new Set([
  * brute-force budget - so the default is the single header nginx sets, not a
  * permissive list.
  */
-
-/**
- * `CLIENT_IP_HEADERS=none` trusts no header at all.
- *
- * This is the escape hatch for the one case where the wrong setting is worse
- * than no setting: if the proxy turns out NOT to overwrite the header we are
- * trusting, any client can send it and mint itself an unlimited brute-force
- * budget against /sign-in. Falling back to the shared bucket is bad (one noisy
- * client can lock the organisation out for ten seconds at a time) but it is
- * bad in a way that fails closed, and it can be reverted from the environment
- * without a deploy.
- *
- * Reach for it only after a check has actually failed - `SELECT ipAddress FROM
- * session ORDER BY createdAt DESC` showing 127.0.0.1 or NULL for a real remote
- * sign-in - and take it back out once the header is configured.
- *
- * An empty or unset value still means "use the default", not "trust nothing":
- * a stray blank line in a .env must not silently change how requests are
- * bucketed. Only the explicit word does that.
- */
-const TRUST_NO_HEADER = 'none';
-
-export const TRUST_NO_CLIENT_IP_HEADER =
-	(process.env.CLIENT_IP_HEADERS || '').trim().toLowerCase() === TRUST_NO_HEADER;
-
-// An empty array is what better-auth reads as "no headers": it only falls back
-// to its own default when the option is absent, and `[]` is truthy.
-export const CLIENT_IP_HEADERS = TRUST_NO_CLIENT_IP_HEADER
-	? []
-	: parseList(process.env.CLIENT_IP_HEADERS, ['x-real-ip']);
+export const CLIENT_IP_HEADERS = parseList(process.env.CLIENT_IP_HEADERS, ['x-real-ip']);
 
 export const TRUSTED_PROXY_IPS = parseList(process.env.TRUSTED_PROXY_IPS, []);
 
-if (isProd && TRUST_NO_CLIENT_IP_HEADER) {
-	logger.warn(
-		'Admin module: CLIENT_IP_HEADERS=none - no client-IP header is trusted, so every ' +
-		'request shares one rate-limit bucket and /sign-in allows 3 attempts per 10 seconds ' +
-		'for everyone combined. This is the safe fallback, not a destination: configure the ' +
-		'header the proxy actually sets and remove it.'
-	);
-} else if (isProd && TRUSTED_PROXY_IPS.length === 0) {
+if (isProd && TRUSTED_PROXY_IPS.length === 0) {
 	logger.warn(
 		'Admin module: TRUSTED_PROXY_IPS is not set. If the proxy sends a multi-value ' +
 		`${CLIENT_IP_HEADERS.join('/')}, better-auth cannot resolve a client IP and every ` +
 		'request shares one rate-limit bucket. Verify with: SELECT `key` FROM rateLimit - ' +
-		'a "no-trusted-ip" row means this is happening. A single-value header needs no ' +
-		'trusted proxies, so this warning is expected on a plain single-proxy setup.'
+		'a "no-trusted-ip" row means this is happening.'
 	);
 }
 

src/models/admin/admin.middleware.ts

@@ -2,7 +2,7 @@ import express from 'express';
 import {fromNodeHeaders} from 'better-auth/node';
 import {auth} from './admin.auth.js';
 import * as UsersService from './users/users.admin.service.js';
-import {AppName, AppPermission, AppRole} from './admin.schema.js';
+import {AppName} from './admin.schema.js';
 import {sendServerError} from './admin.errors.js';
 
 /**
@@ -28,9 +28,6 @@ export interface AdminIdentity {
 
 export interface AdminAccess extends AdminIdentity {
 	disabled: boolean;
-	/** Every (app, role) grant. */
-	permissions: AppPermission[];
-	/** The distinct apps those grants cover. */
 	apps: AppName[];
 }
 
@@ -62,7 +59,6 @@ export const resolveAccess = async (req: express.Request): Promise<AdminAccess |
 		email: access.email,
 		displayName: access.displayName,
 		disabled: access.disabled,
-		permissions: access.permissions,
 		apps: access.apps
 	};
 };
@@ -101,12 +97,8 @@ export const requireSignedIn: express.RequestHandler = async (req, res, next) =>
  * what feedback.auth.ts's requireAdminAuth used to be, except that it now
  * answers 403 for a signed-in user without that app's permission instead of
  * letting any activated @nachklang.art account in.
- *
- * The optional second argument narrows it to one role within the app. Nothing
- * passes it today - every app has exactly the `access` role - but it is the
- * seam a finer permission arrives through.
  */
-export const requireAppAccess = (app: AppName, role?: AppRole): express.RequestHandler => {
+export const requireAppAccess = (app: AppName): express.RequestHandler => {
 	return async (req, res, next) => {
 		try {
 			const access = await resolveAccess(req);
@@ -118,15 +110,7 @@ export const requireAppAccess = (app: AppName, role?: AppRole): express.RequestH
 				forbidden(res, 'Dieses Konto ist deaktiviert.');
 				return;
 			}
-
-			// Without a role this asks "may they open this app at all?", which is
-			// any grant on it. With one it asks for that specific grant - the hook
-			// a finer permission plugs into, without touching existing call sites.
-			const allowed = role === undefined
-				? access.apps.includes(app)
-				: access.permissions.some(permission => permission.app === app && permission.role === role);
-
-			if (!allowed) {
+			if (!access.apps.includes(app)) {
 				forbidden(res, 'Für diesen Bereich fehlt dir die Berechtigung.');
 				return;
 			}

src/models/admin/admin.schema.ts

@@ -19,87 +19,6 @@ export const isAppName = (value: unknown): value is AppName => {
 	return typeof value === 'string' && (APP_NAMES as string[]).includes(value);
 };
 
-/**
- * A permission is (app, role), not just an app. Today every app has exactly one
- * role - `access`, "may use this app at all" - so the model looks like a plain
- * list of apps and the UI renders one checkbox each. It is written this way
- * anyway because the alternative gets expensive fast: `user_app_permissions`
- * has primary key (user_id, app, role), so a user can hold several roles for
- * the same app, and adding one later is a string in APP_ROLES plus rows - never
- * a schema migration and never a change to the shape on the wire.
- *
- * Note the role is deliberately NOT called `admin`, which is what the column
- * defaulted to before: on a `tickets` row that reads as "tickets administrator"
- * when it only ever meant "has access", and once real roles exist there would
- * be no way to tell the two apart.
- */
-export const ACCESS_ROLE = 'access';
-
-export type AppRole = string;
-
-/** Every role that exists, per app, in display order. Extend to add one. */
-export const APP_ROLES: Record<AppName, readonly AppRole[]> = {
-	calendar: [ACCESS_ROLE],
-	feedback: [ACCESS_ROLE],
-	tickets: [ACCESS_ROLE],
-	admin: [ACCESS_ROLE]
-};
-
-export interface AppPermission {
-	app: AppName;
-	role: AppRole;
-}
-
-export const isAppRole = (app: AppName, role: unknown): role is AppRole => {
-	return typeof role === 'string' && APP_ROLES[app].includes(role);
-};
-
-export const isAppPermission = (value: unknown): value is AppPermission => {
-	if (typeof value !== 'object' || value === null) {
-		return false;
-	}
-	const candidate = value as {app?: unknown; role?: unknown};
-	return isAppName(candidate.app) && isAppRole(candidate.app, candidate.role);
-};
-
-/**
- * Normalises whatever a caller sent into a valid, duplicate-free permission
- * list. Accepts the richer `{app, role}` form and the plain `AppName` form,
- * because `{apps: ['tickets']}` is still what the older callers send and it
- * means exactly "tickets at the access role".
- */
-export const toPermissions = (value: unknown): AppPermission[] | null => {
-	if (!Array.isArray(value)) {
-		return null;
-	}
-
-	const permissions: AppPermission[] = [];
-	for (const entry of value) {
-		if (isAppName(entry)) {
-			permissions.push({app: entry, role: ACCESS_ROLE});
-		} else if (isAppPermission(entry)) {
-			permissions.push({app: entry.app, role: entry.role});
-		} else {
-			return null;
-		}
-	}
-
-	const seen = new Set<string>();
-	return permissions.filter(permission => {
-		const key = `${permission.app}:${permission.role}`;
-		if (seen.has(key)) {
-			return false;
-		}
-		seen.add(key);
-		return true;
-	});
-};
-
-/** The distinct apps a permission list grants any access to. */
-export const appsOf = (permissions: AppPermission[]): AppName[] => {
-	return APP_NAMES.filter(app => permissions.some(permission => permission.app === app));
-};
-
 export interface UserTable {
 	id: string;
 	name: string;
@@ -133,7 +52,7 @@ export interface PasskeyTable {
 export interface UserAppPermissionTable {
 	user_id: string;
 	app: AppName;
-	role: AppRole;
+	role: string;
 	granted_by: string | null;
 	granted_at: Generated<Date>;
 }
@@ -144,9 +63,8 @@ export interface InvitationTable {
 	email: string;
 	name: string;
 	token_hash: string;
-	// JSON column holding an AppPermission[]. Older rows may hold a plain
-	// AppName[]; `parsePermissions` reads both.
-	permissions: string;
+	// JSON column holding an AppName[].
+	apps: string;
 	invited_by: string | null;
 	created_at: Generated<Date>;
 	expires_at: Date;

src/models/admin/invitations/invitations.plugin.ts

@@ -147,7 +147,7 @@ export const invitationsPlugin = () => {
 							return created;
 						});
 
-						await UsersService.setPermissions(user.id, invitation.permissions, null);
+						await UsersService.setPermissions(user.id, invitation.apps, null);
 
 						const session = await ctx.context.internalAdapter.createSession(user.id);
 						await setSessionCookie(ctx, {session, user});

src/models/admin/invitations/invitations.router.ts

@@ -1,7 +1,7 @@
 import express, {Request, Response} from 'express';
 import * as InvitationsService from './invitations.service.js';
 import * as UsersService from '../users/users.admin.service.js';
-import {toPermissions} from '../admin.schema.js';
+import {isAppName, AppName} from '../admin.schema.js';
 import {sendInvitationMail} from '../admin.mail.js';
 import {ADMIN_APP_URL, LOG_INVITE_LINKS} from '../admin.config.js';
 import {sendServerError} from '../admin.errors.js';
@@ -64,24 +64,16 @@ invitationsRouter.get('/', async (req: Request, res: Response) => {
  *                  application/json:
  *                      schema:
  *                          type: object
- *                          required: [email, name, permissions]
+ *                          required: [email, name, apps]
  *                          properties:
  *                              email:
  *                                  type: string
  *                              name:
  *                                  type: string
- *                              permissions:
+ *                              apps:
  *                                  type: array
- *                                  description: >
- *                                      One entry per (app, role). A plain array of app names is
- *                                      accepted too and means the same at the `access` role.
  *                                  items:
- *                                      type: object
- *                                      properties:
- *                                          app:
- *                                              type: string
- *                                          role:
- *                                              type: string
+ *                                      type: string
  *          responses:
  *              201:
  *                  description: Invitation created and mailed
@@ -94,15 +86,10 @@ invitationsRouter.post('/', async (req: Request, res: Response) => {
 	try {
 		const email = String(req.body?.email || '').trim().toLowerCase();
 		const name = String(req.body?.name || '').trim();
+		const apps: unknown = req.body?.apps;
 
-		// Same two accepted shapes as PUT /admin/users/:id/permissions.
-		const permissions = toPermissions(req.body?.permissions ?? req.body?.apps);
-
-		if (!EMAIL_PATTERN.test(email) || name.length === 0 || !permissions) {
-			res.status(400).send({
-				status: 'BAD_REQUEST',
-				message: 'E-Mail, Name und Berechtigungen sind erforderlich.'
-			});
+		if (!EMAIL_PATTERN.test(email) || name.length === 0 || !Array.isArray(apps) || !apps.every(isAppName)) {
+			res.status(400).send({status: 'BAD_REQUEST', message: 'E-Mail, Name und App-Liste sind erforderlich.'});
 			return;
 		}
 
@@ -120,7 +107,7 @@ invitationsRouter.post('/', async (req: Request, res: Response) => {
 		const invitation = await InvitationsService.createInvitation(
 			email,
 			name,
-			permissions,
+			apps as AppName[],
 			res.locals.admin.id
 		);
 

src/models/admin/invitations/invitations.service.ts

@@ -1,6 +1,6 @@
 import * as crypto from 'crypto';
 import {NachklangAdminDB} from '../Admin.db.js';
-import {AppPermission, isAppName, isAppPermission, ACCESS_ROLE} from '../admin.schema.js';
+import {AppName, APP_NAMES, isAppName} from '../admin.schema.js';
 
 const db = NachklangAdminDB.db;
 
@@ -19,7 +19,7 @@ export interface OpenInvitation {
 	id: number;
 	email: string;
 	name: string;
-	permissions: AppPermission[];
+	apps: AppName[];
 	invitedBy: string | null;
 	createdAt: Date;
 	expiresAt: Date;
@@ -29,7 +29,7 @@ export interface AcceptableInvitation {
 	id: number;
 	email: string;
 	name: string;
-	permissions: AppPermission[];
+	apps: AppName[];
 }
 
 const hashToken = (token: string): string => {
@@ -41,28 +41,11 @@ const generateToken = (): string => {
 	return crypto.randomBytes(32).toString('base64url');
 };
 
-/**
- * Reads the stored permission list. Two shapes are accepted: the current
- * `[{app, role}]`, and a bare `['tickets', ...]` from before roles existed,
- * which means the same thing at the `access` role. Invitations live for seven
- * days, so a deploy that changes the shape has in-flight rows in the old one -
- * tolerating both is what stops those invitees from being stranded.
- *
- * mysql2 hands back a JSON column already parsed; a driver or column-type
- * change that turns it into a string must not break the read path either.
- */
-const parsePermissions = (value: unknown): AppPermission[] => {
+const parseApps = (value: unknown): AppName[] => {
+	// mysql2 hands back a JSON column already parsed; a driver or column-type
+	// change that turns it into a string must not break the read path.
 	const raw = typeof value === 'string' ? JSON.parse(value) : value;
-	if (!Array.isArray(raw)) {
-		return [];
-	}
-
-	return raw.flatMap((entry): AppPermission[] => {
-		if (isAppName(entry)) {
-			return [{app: entry, role: ACCESS_ROLE}];
-		}
-		return isAppPermission(entry) ? [{app: entry.app, role: entry.role}] : [];
-	});
+	return Array.isArray(raw) ? raw.filter(isAppName) : [];
 };
 
 const expiryFromNow = (): Date => {
@@ -78,12 +61,12 @@ const expiryFromNow = (): Date => {
 export const createInvitation = async (
 	email: string,
 	name: string,
-	permissions: AppPermission[],
+	apps: AppName[],
 	invitedBy: string | null
 ): Promise<{id: number; token: string; expiresAt: Date}> => {
 	const token = generateToken();
 	const expiresAt = expiryFromNow();
-	const valid = permissions.filter(isAppPermission);
+	const validApps = Array.from(new Set(apps)).filter(app => APP_NAMES.includes(app));
 
 	const id = await db.transaction().execute(async trx => {
 		await trx
@@ -100,7 +83,7 @@ export const createInvitation = async (
 				email,
 				name,
 				token_hash: hashToken(token),
-				permissions: JSON.stringify(valid),
+				apps: JSON.stringify(validApps),
 				invited_by: invitedBy,
 				created_at: new Date(),
 				expires_at: expiresAt
@@ -122,7 +105,7 @@ export const createInvitation = async (
 export const findByToken = async (token: string): Promise<AcceptableInvitation | null> => {
 	const row = await db
 		.selectFrom('invitations')
-		.select(['id', 'email', 'name', 'permissions'])
+		.select(['id', 'email', 'name', 'apps'])
 		.where('token_hash', '=', hashToken(token))
 		.where('accepted_at', 'is', null)
 		.where('revoked_at', 'is', null)
@@ -133,7 +116,7 @@ export const findByToken = async (token: string): Promise<AcceptableInvitation |
 		return null;
 	}
 
-	return {id: row.id, email: row.email, name: row.name, permissions: parsePermissions(row.permissions)};
+	return {id: row.id, email: row.email, name: row.name, apps: parseApps(row.apps)};
 };
 
 /** Marks the invitation accepted. Conditional on it still being open so two
@@ -166,7 +149,7 @@ export const unmarkAccepted = async (invitationId: number): Promise<void> => {
 export const listOpenInvitations = async (): Promise<OpenInvitation[]> => {
 	const rows = await db
 		.selectFrom('invitations')
-		.select(['id', 'email', 'name', 'permissions', 'invited_by', 'created_at', 'expires_at'])
+		.select(['id', 'email', 'name', 'apps', 'invited_by', 'created_at', 'expires_at'])
 		.where('accepted_at', 'is', null)
 		.where('revoked_at', 'is', null)
 		.where('expires_at', '>', new Date())
@@ -177,7 +160,7 @@ export const listOpenInvitations = async (): Promise<OpenInvitation[]> => {
 		id: row.id,
 		email: row.email,
 		name: row.name,
-		permissions: parsePermissions(row.permissions),
+		apps: parseApps(row.apps),
 		invitedBy: row.invited_by,
 		createdAt: row.created_at,
 		expiresAt: row.expires_at

src/models/admin/users/users.admin.router.ts

@@ -1,6 +1,6 @@
 import express, {Request, Response} from 'express';
 import * as UsersService from './users.admin.service.js';
-import {toPermissions} from '../admin.schema.js';
+import {AppName, isAppName} from '../admin.schema.js';
 import {sendServerError} from '../admin.errors.js';
 
 export const usersAdminRouter = express.Router();
@@ -90,40 +90,26 @@ usersAdminRouter.get('/:userId', async (req: Request, res: Response) => {
  *                      schema:
  *                          type: object
  *                          properties:
- *                              permissions:
+ *                              apps:
  *                                  type: array
- *                                  description: >
- *                                      One entry per (app, role). `access` is the only role today.
- *                                      A plain array of app names is also accepted and means the
- *                                      same at the `access` role.
  *                                  items:
- *                                      type: object
- *                                      properties:
- *                                          app:
- *                                              type: string
- *                                              enum: [calendar, feedback, tickets, admin]
- *                                          role:
- *                                              type: string
- *                                              enum: [access]
+ *                                      type: string
+ *                                      enum: [calendar, feedback, tickets, admin]
  *          responses:
  *              200:
  *                  description: Success
  *              400:
- *                  description: Invalid app or role
+ *                  description: Invalid app name
  *              409:
  *                  description: Would lock the last admin out
  */
 usersAdminRouter.put('/:userId/permissions', async (req: Request, res: Response) => {
 	try {
 		const userId = req.params.userId;
+		const apps: unknown = req.body?.apps;
 
-		// `permissions: [{app, role}]` is the real shape; `apps: ['tickets']` is
-		// accepted as shorthand for the same thing at the `access` role, so a
-		// caller that predates roles keeps working.
-		const permissions = toPermissions(req.body?.permissions ?? req.body?.apps);
-
-		if (!permissions) {
-			res.status(400).send({status: 'BAD_REQUEST', message: 'Ungültige Berechtigungsliste.'});
+		if (!Array.isArray(apps) || !apps.every(isAppName)) {
+			res.status(400).send({status: 'BAD_REQUEST', message: 'Ungültige App-Liste.'});
 			return;
 		}
 
@@ -133,8 +119,7 @@ usersAdminRouter.put('/:userId/permissions', async (req: Request, res: Response)
 		}
 
 		const target = await UsersService.loadAccess(userId);
-		const keepsAdmin = permissions.some(permission => permission.app === 'admin');
-		const losesAdmin = Boolean(target?.apps.includes('admin')) && !keepsAdmin;
+		const losesAdmin = Boolean(target?.apps.includes('admin')) && !(apps as AppName[]).includes('admin');
 
 		// Self-lockout is checked here because it needs the caller's identity,
 		// which the service has no business knowing. The last-admin check is
@@ -145,7 +130,7 @@ usersAdminRouter.put('/:userId/permissions', async (req: Request, res: Response)
 			return;
 		}
 
-		const result = await UsersService.setPermissionsGuarded(userId, permissions, res.locals.admin.id);
+		const result = await UsersService.setPermissionsGuarded(userId, apps as AppName[], res.locals.admin.id);
 		if (result === 'last-admin') {
 			conflict(res, 'Die letzte Admin-Berechtigung kann nicht entzogen werden.');
 			return;

src/models/admin/users/users.admin.service.ts

@@ -1,15 +1,6 @@
 import {Transaction} from 'kysely';
 import {NachklangAdminDB} from '../Admin.db.js';
-import {
-	AdminDatabase,
-	AppName,
-	AppPermission,
-	AppRole,
-	ACCESS_ROLE,
-	appsOf,
-	isAppName,
-	isAppRole
-} from '../admin.schema.js';
+import {AdminDatabase, AppName, APP_NAMES} from '../admin.schema.js';
 
 const db = NachklangAdminDB.db;
 
@@ -27,10 +18,6 @@ export interface UserAccess {
 	email: string;
 	displayName: string;
 	disabled: boolean;
-	/** Every (app, role) grant this user holds. */
-	permissions: AppPermission[];
-	/** The distinct apps the above grants any access to. Derived, kept because
-	 *  most callers only ever ask "may they open this app at all?". */
 	apps: AppName[];
 }
 
@@ -40,7 +27,6 @@ export interface UserListEntry {
 	id: string;
 	email: string;
 	name: string;
-	permissions: AppPermission[];
 	apps: AppName[];
 	status: UserStatus;
 	createdAt: Date;
@@ -75,8 +61,7 @@ export const loadAccess = async (userId: string): Promise<UserAccess | null> =>
 			'user.email as email',
 			'user.name as name',
 			'user.disabled as disabled',
-			'user_app_permissions.app as app',
-			'user_app_permissions.role as role'
+			'user_app_permissions.app as app'
 		])
 		.execute();
 
@@ -84,32 +69,16 @@ export const loadAccess = async (userId: string): Promise<UserAccess | null> =>
 		return null;
 	}
 
-	const permissions = toPermissionRows(rows);
-
 	return {
 		id: rows[0].id,
 		email: rows[0].email,
 		displayName: rows[0].name,
 		// MySQL TINYINT(1) comes back as 0/1 through mysql2.
 		disabled: Boolean(rows[0].disabled),
-		permissions,
-		apps: appsOf(permissions)
+		apps: rows.map(row => row.app).filter((app): app is AppName => app !== null)
 	};
 };
 
-/**
- * Turns joined permission rows into AppPermission[]. The left join produces one
- * row with a null app for a user who holds nothing, and a role written directly
- * into the database that no longer appears in APP_ROLES is dropped rather than
- * trusted - the table is the store, APP_ROLES is the contract.
- */
-const toPermissionRows = (rows: {app: AppName | null; role: string | null}[]): AppPermission[] => {
-	return rows
-		.filter((row): row is {app: AppName; role: string} =>
-			isAppName(row.app) && isAppRole(row.app, row.role))
-		.map(row => ({app: row.app, role: row.role}));
-};
-
 export const listUsers = async (): Promise<UserListEntry[]> => {
 	const users = await db
 		.selectFrom('user')
@@ -119,7 +88,7 @@ export const listUsers = async (): Promise<UserListEntry[]> => {
 
 	const permissions = await db
 		.selectFrom('user_app_permissions')
-		.select(['user_id', 'app', 'role'])
+		.select(['user_id', 'app'])
 		.execute();
 
 	// Last sign-in is derived from the newest session rather than stored: a
@@ -138,33 +107,26 @@ export const listUsers = async (): Promise<UserListEntry[]> => {
 		.groupBy('userId')
 		.execute();
 
-	const permissionsByUser = new Map<string, AppPermission[]>();
+	const appsByUser = new Map<string, AppName[]>();
 	for (const row of permissions) {
-		if (!isAppRole(row.app, row.role)) {
-			continue;
-		}
-		const held = permissionsByUser.get(row.user_id) || [];
-		held.push({app: row.app, role: row.role});
-		permissionsByUser.set(row.user_id, held);
+		const apps = appsByUser.get(row.user_id) || [];
+		apps.push(row.app);
+		appsByUser.set(row.user_id, apps);
 	}
 
 	const lastSignInByUser = new Map<string, Date | null>(
 		lastSessions.map(row => [row.userId, row.lastSignInAt as Date | null])
 	);
 
-	return users.map(user => {
-		const held = permissionsByUser.get(user.id) || [];
-		return {
-			id: user.id,
-			email: user.email,
-			name: user.name,
-			permissions: held,
-			apps: appsOf(held),
-			status: user.disabled ? ('deaktiviert' as const) : ('aktiv' as const),
-			createdAt: user.createdAt,
-			lastSignInAt: lastSignInByUser.get(user.id) ?? null
-		};
-	});
+	return users.map(user => ({
+		id: user.id,
+		email: user.email,
+		name: user.name,
+		apps: appsByUser.get(user.id) || [],
+		status: user.disabled ? 'deaktiviert' : 'aktiv',
+		createdAt: user.createdAt,
+		lastSignInAt: lastSignInByUser.get(user.id) ?? null
+	}));
 };
 
 export const getUserDetail = async (userId: string): Promise<UserDetail | null> => {
@@ -179,11 +141,7 @@ export const getUserDetail = async (userId: string): Promise<UserDetail | null>
 	}
 
 	const [permissions, sessions, passkeys] = await Promise.all([
-		db
-			.selectFrom('user_app_permissions')
-			.select(['app', 'role'])
-			.where('user_id', '=', userId)
-			.execute(),
+		db.selectFrom('user_app_permissions').select('app').where('user_id', '=', userId).execute(),
 		db
 			.selectFrom('session')
 			.select(['id', 'createdAt', 'expiresAt', 'ipAddress', 'userAgent'])
@@ -198,14 +156,11 @@ export const getUserDetail = async (userId: string): Promise<UserDetail | null>
 			.executeTakeFirst()
 	]);
 
-	const held = toPermissionRows(permissions);
-
 	return {
 		id: user.id,
 		email: user.email,
 		name: user.name,
-		permissions: held,
-		apps: appsOf(held),
+		apps: permissions.map(row => row.app),
 		status: user.disabled ? 'deaktiviert' : 'aktiv',
 		createdAt: user.createdAt,
 		lastSignInAt: sessions.length > 0 ? sessions[0].createdAt : null,
@@ -219,51 +174,25 @@ export const getUserDetail = async (userId: string): Promise<UserDetail | null>
  * transaction rather than a diff: the set is at most four rows, and a diff
  * would only add branches for no measurable gain.
  */
-
-/** The rows a permission list becomes. One row per (app, role). */
-const permissionRows = (
-	userId: string,
-	permissions: AppPermission[],
-	grantedBy: string | null
-) => {
-	return permissions.map(permission => ({
-		user_id: userId,
-		app: permission.app,
-		role: permission.role,
-		granted_by: grantedBy,
-		granted_at: new Date()
-	}));
-};
-
-/** Drops anything not in APP_ROLES and de-duplicates on (app, role). */
-const validPermissions = (permissions: AppPermission[]): AppPermission[] => {
-	const seen = new Set<string>();
-	return permissions.filter(permission => {
-		if (!isAppName(permission.app) || !isAppRole(permission.app, permission.role)) {
-			return false;
-		}
-		const key = `${permission.app}:${permission.role}`;
-		if (seen.has(key)) {
-			return false;
-		}
-		seen.add(key);
-		return true;
-	});
-};
-
 export const setPermissions = async (
 	userId: string,
-	permissions: AppPermission[],
+	apps: AppName[],
 	grantedBy: string | null
 ): Promise<void> => {
-	const valid = validPermissions(permissions);
+	const unique = Array.from(new Set(apps)).filter(app => APP_NAMES.includes(app));
 
 	await db.transaction().execute(async trx => {
 		await trx.deleteFrom('user_app_permissions').where('user_id', '=', userId).execute();
-		if (valid.length > 0) {
+		if (unique.length > 0) {
 			await trx
 				.insertInto('user_app_permissions')
-				.values(permissionRows(userId, valid, grantedBy))
+				.values(unique.map(app => ({
+					user_id: userId,
+					app,
+					role: 'admin',
+					granted_by: grantedBy,
+					granted_at: new Date()
+				})))
 				.execute();
 		}
 	});
@@ -288,11 +217,7 @@ const countActiveAdminsForUpdate = async (trx: Transaction<AdminDatabase>): Prom
 		.innerJoin('user', 'user.id', 'user_app_permissions.user_id')
 		.where('user_app_permissions.app', '=', 'admin')
 		.where('user.disabled', '=', false)
-		// countDistinct, not countAll: with (user_id, app, role) as the key one
-		// user can hold several roles on `admin`, and counting rows would make a
-		// single admin with two roles look like two admins - defeating the guard
-		// at exactly the moment it matters.
-		.select(({fn}) => fn.count<number>('user_app_permissions.user_id').distinct().as('count'))
+		.select(({fn}) => fn.countAll<number>().as('count'))
 		.forUpdate()
 		.executeTakeFirst();
 
@@ -305,11 +230,10 @@ const countActiveAdminsForUpdate = async (trx: Transaction<AdminDatabase>): Prom
  */
 export const setPermissionsGuarded = async (
 	userId: string,
-	permissions: AppPermission[],
+	apps: AppName[],
 	grantedBy: string | null
 ): Promise<LastAdminGuardResult> => {
-	const valid = validPermissions(permissions);
-	const keepsAdmin = valid.some(permission => permission.app === 'admin');
+	const unique = Array.from(new Set(apps)).filter(app => APP_NAMES.includes(app));
 
 	return db.transaction().execute(async trx => {
 		const target = await trx
@@ -318,20 +242,25 @@ export const setPermissionsGuarded = async (
 			.where('user_app_permissions.user_id', '=', userId)
 			.where('user_app_permissions.app', '=', 'admin')
 			.select(['user.disabled as disabled'])
-			.limit(1)
 			.forUpdate()
 			.executeTakeFirst();
 
-		const losesAdmin = Boolean(target) && !keepsAdmin;
+		const losesAdmin = Boolean(target) && !unique.includes('admin');
 		if (losesAdmin && !target?.disabled && (await countActiveAdminsForUpdate(trx)) <= 1) {
 			return 'last-admin';
 		}
 
 		await trx.deleteFrom('user_app_permissions').where('user_id', '=', userId).execute();
-		if (valid.length > 0) {
+		if (unique.length > 0) {
 			await trx
 				.insertInto('user_app_permissions')
-				.values(permissionRows(userId, valid, grantedBy))
+				.values(unique.map(app => ({
+					user_id: userId,
+					app,
+					role: 'admin',
+					granted_by: grantedBy,
+					granted_at: new Date()
+				})))
 				.execute();
 		}
 
@@ -352,7 +281,6 @@ export const disableUserGuarded = async (userId: string): Promise<LastAdminGuard
 			.where('user_app_permissions.app', '=', 'admin')
 			.where('user.disabled', '=', false)
 			.select('user_app_permissions.user_id')
-			.limit(1)
 			.forUpdate()
 			.executeTakeFirst();
 
@@ -370,16 +298,12 @@ export const disableUserGuarded = async (userId: string): Promise<LastAdminGuard
 export const grantPermission = async (
 	userId: string,
 	app: AppName,
-	grantedBy: string | null,
-	role: AppRole = ACCESS_ROLE
+	grantedBy: string | null
 ): Promise<void> => {
 	await db
 		.insertInto('user_app_permissions')
-		.values({user_id: userId, app, role, granted_by: grantedBy, granted_at: new Date()})
-		// The row already existing is the success case - this is "make sure they
-		// hold it", not "re-grant it" - so nothing is overwritten and granted_by
-		// keeps naming whoever granted it first.
-		.onDuplicateKeyUpdate({role})
+		.values({user_id: userId, app, role: 'admin', granted_by: grantedBy, granted_at: new Date()})
+		.onDuplicateKeyUpdate({role: 'admin'})
 		.execute();
 };
 
@@ -437,30 +361,3 @@ export const findUserByEmail = async (email: string): Promise<{id: string; email
 
 	return row ?? null;
 };
-
-/**
- * Display names for a set of user ids, as an id -> name map. Ids that no
- * longer exist are simply absent from the map rather than mapping to a
- * placeholder, so callers can distinguish "deleted account" from "never had
- * one" and choose their own fallback.
- *
- * This exists for the calendar migration (docs/calendar-auth-migration.md
- * step 3): the calendar lives in a different database, so it cannot join
- * against `user` to render "created by". One lookup per result set keeps that
- * cheap without coupling the two schemas.
- */
-export const findDisplayNames = async (ids: readonly string[]): Promise<Map<string, string>> => {
-	const distinct = Array.from(new Set(ids.filter(id => id)));
-	if (distinct.length === 0) {
-		// Kysely renders `in ()` for an empty list, which MariaDB rejects.
-		return new Map();
-	}
-
-	const rows = await db
-		.selectFrom('user')
-		.select(['id', 'name'])
-		.where('id', 'in', distinct)
-		.execute();
-
-	return new Map(rows.map(row => [row.id, row.name]));
-};

src/models/calendar/Calendar.router.ts

@@ -5,6 +5,7 @@ import express, {Request, Response} from 'express';
 import {Guid} from 'guid-typescript';
 import logger from '../../middleware/logger.js';
 import {eventsRouter} from './events/events.router.js';
+import {usersRouter} from './users/users.router.js';
 
 /**
  * Router Definition
@@ -12,13 +13,7 @@ import {eventsRouter} from './events/events.router.js';
 export const calendarRouter = express.Router();
 
 calendarRouter.use('/events', eventsRouter);
-
-/*
- * There is no /calendar/users any more. It held this module's own accounts -
- * registration, login, activation, password reset, and the session table the
- * feedback and tickets admin areas used to authenticate against - and every one
- * of those moved to the admin module. See docs/calendar-auth-migration.md.
- */
+calendarRouter.use('/users', usersRouter);
 
 
 /**

src/models/calendar/events/credentials.service.ts

@@ -1,55 +1,73 @@
 import * as dotenv from 'dotenv';
+import * as UserService from '../users/users.service.js';
+
 
 dotenv.config();
 
 /**
- * The shared calendar passwords, and nothing else.
- *
- * Before the step 4 cutover each function here also took a sessionId/sessionKey
- * pair and checked it against the calendar's own sessions table, so "is this a
- * signed-in user?" and "did they send the right shared password?" were tangled
- * together in five places. Signed-in access is now decided by
- * requireAppAccess('calendar') before the handler runs; what is left is the
- * fallback for people who have no account at all.
- *
- * That fallback survives on purpose, for one reason: an iCal client subscribing
- * to a calendar URL cannot send a cookie. Everything the Angular app does goes
- * through the session cookie instead. See docs/calendar-auth-migration.md.
- *
- * `public` is deliberately open to everyone with no credential of any kind -
- * nachklang.art reads it anonymously to show the next upcoming event. Pinned by
- * test/calendar/credentials.service.test.ts.
+ * Checks if the password gives admin privileges (view / create / edit / delete)
+ * @param password
  */
-
-const credentialFor = (calendarName: string): string | undefined => {
-	switch (calendarName) {
-		case 'members':
-			return process.env.MEMBER_CREDENTIAL;
-		case 'choir':
-		case 'birthdays':
-			return process.env.CHOIR_CREDENTIAL;
-		case 'management':
-			return process.env.MANAGEMENT_CREDENTIAL;
-		default:
-			return undefined;
+export const checkAdminPrivileges = async (sessionId: string, sessionKey: string, ip: string) => {
+	if(sessionId) {
+		let user = await UserService.checkSession(sessionId, sessionKey, ip);
+		return user?.isActive ?? false;
 	}
-};
+	return false;
+}
 
 /**
- * Whether the given shared password opens the given calendar. Answers false
- * for an unknown calendar, and - importantly - for a calendar whose credential
- * is not configured at all: an unset MEMBER_CREDENTIAL must not turn into
- * "everyone with an empty password gets in".
+ * Checks if the password gives member view privileges
+ * @param password
  */
-export const hasAccess = async (calendarName: string, password: string): Promise<boolean> => {
-	if (calendarName === 'public') {
-		return true;
+export const checkMemberPrivileges = async (sessionId: string, sessionKey: string, password: string, ip: string) => {
+	if(sessionId) {
+		let user = await UserService.checkSession(sessionId, sessionKey, ip);
+		return user?.isActive ?? false;
 	}
 
-	const expected = credentialFor(calendarName);
-	if (!expected) {
-		return false;
+	return password == process.env.MEMBER_CREDENTIAL;
+}
+
+/**
+ * Checks if the password gives choir view privileges
+ * @param password
+ */
+export const checkChoirPrivileges = async (sessionId: string, sessionKey: string, password: string, ip: string) => {
+	if(sessionId) {
+		let user = await UserService.checkSession(sessionId, sessionKey, ip);
+		return user?.isActive ?? false;
 	}
 
-	return password === expected;
-};
+	return password == process.env.CHOIR_CREDENTIAL;
+}
+
+/**
+ * Checks if the password gives management view privileges
+ * @param password
+ */
+export const checkManagementPrivileges = async (sessionId: string, sessionKey: string, password: string, ip: string) => {
+	if(sessionId) {
+		let user = await UserService.checkSession(sessionId, sessionKey, ip);
+		return user?.isActive ?? false;
+	}
+
+	return password == process.env.MANAGEMENT_CREDENTIAL;
+}
+
+export const hasAccess = async (calendarName: string, sessionId: string, sessionKey: string, password: string, ip: string) => {
+	switch (calendarName) {
+		case 'public':
+			return true;
+		case 'members':
+			return await checkMemberPrivileges(sessionId, sessionKey, password, ip);
+		case 'choir':
+			return await checkChoirPrivileges(sessionId, sessionKey, password, ip);
+		case 'management':
+			return await checkManagementPrivileges(sessionId, sessionKey, password, ip);
+        case 'birthdays':
+            return await checkChoirPrivileges(sessionId, sessionKey, password, ip);
+		default:
+			return false;
+	}
+}

src/models/calendar/events/event.interface.ts

@@ -14,6 +14,7 @@
  *         - endDateTime
  *         - createdDate
  *         - location
+ *         - createdById
  *         - url
  *         - wholeDay
  *       properties:
@@ -64,20 +65,18 @@
  *           type: string
  *           description: The name of the user who created the event
  *           example: "John Doe"
- *         createdByUserId:
- *           type: string
- *           nullable: true
- *           description: The admin-module user id of the creator, once it has one
- *           example: "8f1c0f2e-0f1a-4b9e-9a7c-2d5f1b3c4d5e"
+ *         createdById:
+ *           type: integer
+ *           description: The ID of the user who created the event
+ *           example: 456
  *         lastModifiedBy:
  *           type: string
  *           description: The name of the user who last modified the event
  *           example: "John Doe"
- *         lastModifiedByUserId:
- *           type: string
- *           nullable: true
- *           description: The admin-module user id of the last editor, once it has one
- *           example: "8f1c0f2e-0f1a-4b9e-9a7c-2d5f1b3c4d5e"
+ *         lastModifiedById:
+ *           type: integer
+ *           description: The ID of the user who last modified the event
+ *           example: 456
  *         url:
  *           type: string
  *           description: A URL with more information about the event
@@ -103,13 +102,10 @@ export interface Event {
 	createdDate: Date;
 	lastModifiedDate?: Date;
 	location: string;
-	/** Display name of the creator: the live admin name when the id below
-	 *  resolves, otherwise the name archived before the legacy users table was
-	 *  removed. See docs/calendar-auth-migration.md. */
 	createdBy?: string;
-	createdByUserId?: string | null;
+	createdById: number;
 	lastModifiedBy?: string;
-	lastModifiedByUserId?: string | null;
+	lastModifiedById?: number;
 	url: string;
 	wholeDay: boolean;
     repeatFrequency: string;

src/models/calendar/events/events.router.ts

@@ -7,7 +7,7 @@ import {Event} from './event.interface.js';
 import * as EventService from './events.service.js';
 import * as iCalService from './icalgenerator.service.js';
 import * as CredentialService from './credentials.service.js';
-import {requireAppAccess, resolveAccess, AdminAccess} from '../../admin/admin.middleware.js';
+import * as UserService from '../users/users.service.js';
 import {Guid} from 'guid-typescript';
 import logger from '../../../middleware/logger.js';
 
@@ -29,44 +29,6 @@ export const calendarNames = new Map<string, any>([
     ['birthdays', {id: 5, name: 'Nachklang_birthday_calendar'}]
 ]);
 
-/**
- * The gate on everything that writes. Step 4 of
- * docs/calendar-auth-migration.md replaced a sessionId/sessionKey pair in the
- * query string (DEFERRED_SECURITY.md item 1) with the same session cookie the
- * other three apps use, and "any activated @nachklang.art account" with an
- * explicit per-user calendar permission.
- */
-const requireCalendarAccess = requireAppAccess('calendar');
-
-/** Set by requireCalendarAccess; the writer's admin identity. */
-const adminOf = (res: Response): AdminAccess => res.locals.admin as AdminAccess;
-
-/**
- * Resolves a signed-in calendar user for the *read* routes, or null.
- *
- * Reads cannot use the middleware: the same URL serves an anonymous visitor
- * (the public calendar the website polls), someone holding a shared password
- * (an iCal subscription), and a signed-in editor who should see drafts. So it
- * answers "who is this, if anyone?" instead of refusing the request, and each
- * handler decides what that means.
- *
- * A failure to reach the admin database is swallowed for the same reason the
- * name lookup in events.service.ts swallows one: it must not be able to take
- * the anonymous public calendar down.
- */
-const signedInEditor = async (req: Request): Promise<AdminAccess | null> => {
-	try {
-		const access = await resolveAccess(req);
-		if (!access || access.disabled || !access.apps.includes('calendar')) {
-			return null;
-		}
-		return access;
-	} catch (e: any) {
-		logger.warn('Calendar: could not resolve the session, continuing as anonymous: ' + e.message);
-		return null;
-	}
-};
-
 
 /**
  * Controller Definitions
@@ -77,10 +39,7 @@ const signedInEditor = async (req: Request): Promise<AdminAccess | null> => {
  * /calendar/events/{calendar}/json:
  *      get:
  *          summary: Get all events from a specific calendar in JSON format
- *          description: >
- *              Returns the calendar's events. The public calendar is open to everyone; the
- *              others need either a signed-in account with the calendar permission - which
- *              also unlocks drafts - or the calendar's shared password.
+ *          description: Returns all events from the specified calendar in JSON format. Authentication required.
  *          tags:
  *              - calendar
  *          parameters:
@@ -89,13 +48,23 @@ const signedInEditor = async (req: Request): Promise<AdminAccess | null> => {
  *                required: true
  *                schema:
  *                    type: string
- *                    enum: [public, members, choir, management, birthdays]
+ *                    enum: [public, members, choir, management]
  *                description: The name of the calendar to get events from
  *              - in: query
+ *                name: sessionId
+ *                schema:
+ *                    type: string
+ *                description: Session ID for authentication
+ *              - in: query
+ *                name: sessionKey
+ *                schema:
+ *                    type: string
+ *                description: Session key for authentication
+ *              - in: query
  *                name: password
  *                schema:
  *                    type: string
- *                description: The calendar's shared password, for callers with no account
+ *                description: Password for calendar access (if not using session authentication)
  *          responses:
  *              200:
  *                  description: Success
@@ -140,7 +109,10 @@ eventsRouter.get('/:calendar/json', async (req: Request, res: Response) => {
 	try {
 		// Get request params
 		let calendarName: string = req.params.calendar as string ?? '';
+		let sessionId: string = req.query.sessionId as string ?? '';
+		let sessionKey: string = req.query.sessionKey as string ?? '';
 		let password: string = req.query.password as string ?? '';
+		let ip: string = req.socket.remoteAddress ?? '';
 
 		if (calendarName.length < 1) {
 			res.status(400).send({'message': 'Please state the name of the calendar you want events from.'});
@@ -154,19 +126,23 @@ eventsRouter.get('/:calendar/json', async (req: Request, res: Response) => {
 
 		let calendarId: number = calendarNames.get(calendarName)!.id;
 
-		const editor = await signedInEditor(req);
+		let user = await UserService.checkSession(sessionId, sessionKey, ip);
 
-		// Not signed in: fall back to the shared password for this calendar.
-		if (!editor && ! await CredentialService.hasAccess(calendarName, password)) {
-			res.status(403).send({'message': 'You do not have access to the specified calendar.'});
-			return;
+		// If no user was found, check if the password gives access to the calendar
+		if(user === null || !user.isActive) {
+			if (! await CredentialService.hasAccess(calendarName, sessionId, sessionKey, password, ip)) {
+				res.status(403).send({'message': 'You do not have access to the specified calendar.'});
+				return;
+			}
 		}
 
-		// Editors get the admin view (drafts included, calendar includes ignored);
-		// everyone else gets published events only.
-		let events: Event[] = editor
-			? await EventService.getAllEventsAdmin(calendarId)
-			: await EventService.getAllEvents(calendarId);
+		let events: Event[];
+
+		if(user?.isActive) {
+			events = await EventService.getAllEventsAdmin(calendarId);
+		} else {
+			events = await EventService.getAllEvents(calendarId);
+		}
 
 		// Send the events back
 		res.status(200).send(events);
@@ -182,10 +158,7 @@ eventsRouter.get('/:calendar/json', async (req: Request, res: Response) => {
  * /calendar/events/{calendar}/json/next:
  *      get:
  *          summary: Get the next upcoming event from a calendar
- *          description: >
- *              The next upcoming event. The public calendar is open to everyone; the
- *              others need either a signed-in account with the calendar permission or the
- *              calendar's shared password.
+ *          description: Returns the next upcoming event from the specified calendar. Authentication required.
  *          tags:
  *              - calendar
  *          parameters:
@@ -194,13 +167,23 @@ eventsRouter.get('/:calendar/json', async (req: Request, res: Response) => {
  *                required: true
  *                schema:
  *                    type: string
- *                    enum: [public, members, choir, management, birthdays]
+ *                    enum: [public, members, choir, management]
  *                description: The name of the calendar to get the next event from
  *              - in: query
+ *                name: sessionId
+ *                schema:
+ *                    type: string
+ *                description: Session ID for authentication
+ *              - in: query
+ *                name: sessionKey
+ *                schema:
+ *                    type: string
+ *                description: Session key for authentication
+ *              - in: query
  *                name: password
  *                schema:
  *                    type: string
- *                description: The calendar's shared password, for callers with no account
+ *                description: Password for calendar access (if not using session authentication)
  *          responses:
  *              200:
  *                  description: Success
@@ -259,7 +242,10 @@ eventsRouter.get('/:calendar/json/next', async (req: Request, res: Response) =>
 	try {
 		// Get request params
 		let calendarName: string = req.params.calendar as string ?? '';
+		let sessionId: string = req.query.sessionId as string ?? '';
+		let sessionKey: string = req.query.sessionKey as string ?? '';
 		let password: string = req.query.password as string ?? '';
+		let ip: string = req.socket.remoteAddress ?? '';
 
 		if (calendarName.length < 1) {
 			res.status(400).send({'message': 'Please state the name of the calendar you want events from.'});
@@ -273,19 +259,7 @@ eventsRouter.get('/:calendar/json/next', async (req: Request, res: Response) =>
 
 		let calendarId: number = calendarNames.get(calendarName)!.id;
 
-		// Holding the calendar's shared password, or signed in. The password path
-		// is what keeps iCal subscriptions working - a calendar client cannot
-		// send a cookie.
-		//
-		// The password is checked FIRST so that `public`, which needs no
-		// credential at all, short-circuits before signedInEditor runs. Otherwise
-		// every request from a browser that happens to hold a .nachklang.art
-		// cookie - which is any signed-in user on any of the four apps - would put
-		// an admin-database query in front of the anonymous public feed, with no
-		// timeout. Both operands are side-effect free, so the order is free to
-		// choose; this order is the one that keeps the public calendar
-		// independent of the admin database.
-		if (! await CredentialService.hasAccess(calendarName, password) && !await signedInEditor(req)) {
+		if (! await CredentialService.hasAccess(calendarName, sessionId, sessionKey, password, ip)) {
 			res.status(403).send({'message': 'You do not have access to the specified calendar.'});
 			return;
 		}
@@ -316,10 +290,7 @@ eventsRouter.get('/:calendar/json/next', async (req: Request, res: Response) =>
  * /calendar/events/{calendar}/ical:
  *      get:
  *          summary: Get all events from a specific calendar in iCal format
- *          description: >
- *              The calendar in iCal format. The public calendar is open to everyone; the
- *              others take the calendar's shared password in the query string, which is
- *              why that mechanism survives - an iCal client cannot send a cookie.
+ *          description: Returns all events from the specified calendar in iCal format for calendar applications. Authentication required.
  *          tags:
  *              - calendar
  *          parameters:
@@ -328,13 +299,23 @@ eventsRouter.get('/:calendar/json/next', async (req: Request, res: Response) =>
  *                required: true
  *                schema:
  *                    type: string
- *                    enum: [public, members, choir, management, birthdays]
+ *                    enum: [public, members, choir, management]
  *                description: The name of the calendar to get events from
  *              - in: query
+ *                name: sessionId
+ *                schema:
+ *                    type: string
+ *                description: Session ID for authentication
+ *              - in: query
+ *                name: sessionKey
+ *                schema:
+ *                    type: string
+ *                description: Session key for authentication
+ *              - in: query
  *                name: password
  *                schema:
  *                    type: string
- *                description: The calendar's shared password, for callers with no account
+ *                description: Password for calendar access (if not using session authentication)
  *          responses:
  *              200:
  *                  description: Success - returns iCal file
@@ -384,7 +365,10 @@ eventsRouter.get('/:calendar/ical', async (req: Request, res: Response) => {
 	try {
 		// Get request params
 		let calendarName: string = req.params.calendar as string ?? '';
+		let sessionId: string = req.query.sessionId as string ?? '';
+		let sessionKey: string = req.query.sessionKey as string ?? '';
 		let password: string = req.query.password as string ?? '';
+		let ip: string = req.socket.remoteAddress ?? '';
 
 		if (calendarName.length < 1) {
 			res.status(400).send({'message': 'Please state the name of the calendar you want events from.'});
@@ -398,19 +382,7 @@ eventsRouter.get('/:calendar/ical', async (req: Request, res: Response) => {
 
 		let calendarId: number = calendarNames.get(calendarName)!.id;
 
-		// Holding the calendar's shared password, or signed in. The password path
-		// is what keeps iCal subscriptions working - a calendar client cannot
-		// send a cookie.
-		//
-		// The password is checked FIRST so that `public`, which needs no
-		// credential at all, short-circuits before signedInEditor runs. Otherwise
-		// every request from a browser that happens to hold a .nachklang.art
-		// cookie - which is any signed-in user on any of the four apps - would put
-		// an admin-database query in front of the anonymous public feed, with no
-		// timeout. Both operands are side-effect free, so the order is free to
-		// choose; this order is the one that keeps the public calendar
-		// independent of the admin database.
-		if (! await CredentialService.hasAccess(calendarName, password) && !await signedInEditor(req)) {
+		if (! await CredentialService.hasAccess(calendarName, sessionId, sessionKey, password, ip)) {
 			res.status(403).send({'message': 'You do not have access to the specified calendar.'});
 			return;
 		}
@@ -441,11 +413,22 @@ eventsRouter.get('/:calendar/ical', async (req: Request, res: Response) => {
  * /calendar/events:
  *      post:
  *          summary: Create a new event
- *          description: Creates a new event. Requires a signed-in account with the calendar permission.
+ *          description: Creates a new event in the specified calendar. Authentication required.
  *          tags:
  *              - calendar
- *          security:
- *              - AdminSessionCookie: []
+ *          parameters:
+ *              - in: query
+ *                name: sessionId
+ *                required: true
+ *                schema:
+ *                    type: string
+ *                description: Session ID for authentication
+ *              - in: query
+ *                name: sessionKey
+ *                required: true
+ *                schema:
+ *                    type: string
+ *                description: Session key for authentication
  *          requestBody:
  *              required: true
  *              content:
@@ -512,32 +495,16 @@ eventsRouter.get('/:calendar/ical', async (req: Request, res: Response) => {
  *                                  message:
  *                                      type: string
  *                                      example: Required parameters missing
- *              401:
- *                  description: Unauthorized - not signed in
- *                  content:
- *                      application/json:
- *                          schema:
- *                              type: object
- *                              properties:
- *                                  status:
- *                                      type: string
- *                                      example: UNAUTHORIZED
- *                                  message:
- *                                      type: string
- *                                      example: Anmeldung erforderlich.
  *              403:
- *                  description: Forbidden - the account lacks the calendar permission
+ *                  description: Forbidden - no access to create events
  *                  content:
  *                      application/json:
  *                          schema:
  *                              type: object
  *                              properties:
- *                                  status:
- *                                      type: string
- *                                      example: FORBIDDEN
  *                                  message:
  *                                      type: string
- *                                      example: "Für diesen Bereich fehlt dir die Berechtigung."
+ *                                      example: You do not have access to the specified calendar.
  *              500:
  *                  description: Server error
  *                  content:
@@ -555,9 +522,19 @@ eventsRouter.get('/:calendar/ical', async (req: Request, res: Response) => {
  *                                      type: string
  *                                      example: 6ec1361c-4175-4e81-b2ef-a0792a9a1dc3
  */
-eventsRouter.post('/', requireCalendarAccess, async (req: Request, res: Response) => {
+eventsRouter.post('/', async (req: Request, res: Response) => {
 	try {
-		const admin = adminOf(res);
+		// Get params
+		let sessionId: string = req.query.sessionId as string ?? '';
+		let sessionKey: string = req.query.sessionKey as string ?? '';
+		let ip: string = req.socket.remoteAddress ?? '';
+
+		let user = await UserService.checkSession(sessionId, sessionKey, ip);
+
+		if (!user?.isActive) {
+			res.status(403).send({'message': 'You do not have access to the specified calendar.'});
+			return;
+		}
 
 		if (
 			req.body.calendarId === undefined ||
@@ -579,9 +556,7 @@ eventsRouter.post('/', requireCalendarAccess, async (req: Request, res: Response
 			endDateTime: new Date(req.body.endDateTime),
 			createdDate: new Date(),
 			location: req.body.location ?? '',
-			// LEGACY createdById is deliberately not set: there is no calendar
-			// user id any more, and migration 003 made the column nullable.
-			createdByUserId: admin.id,
+			createdById: user.userId ?? -1,
 			url: req.body.url ?? '',
 			wholeDay: req.body.wholeDay ?? false,
             repeatFrequency: req.body.repeatFrequency ?? '',
@@ -610,11 +585,9 @@ eventsRouter.post('/', requireCalendarAccess, async (req: Request, res: Response
  * /calendar/events/{eventId}:
  *      put:
  *          summary: Update an existing event
- *          description: Updates an existing event. Requires a signed-in account with the calendar permission.
+ *          description: Updates an existing event with the provided data. Authentication required.
  *          tags:
  *              - calendar
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
  *              - in: path
  *                name: eventId
@@ -622,6 +595,18 @@ eventsRouter.post('/', requireCalendarAccess, async (req: Request, res: Response
  *                schema:
  *                    type: integer
  *                description: The ID of the event to update
+ *              - in: query
+ *                name: sessionId
+ *                required: true
+ *                schema:
+ *                    type: string
+ *                description: Session ID for authentication
+ *              - in: query
+ *                name: sessionKey
+ *                required: true
+ *                schema:
+ *                    type: string
+ *                description: Session key for authentication
  *          requestBody:
  *              required: true
  *              content:
@@ -654,6 +639,9 @@ eventsRouter.post('/', requireCalendarAccess, async (req: Request, res: Response
  *                              location:
  *                                  type: string
  *                                  example: "Musikhochschule, Karlsruhe"
+ *                              createdBy:
+ *                                  type: string
+ *                                  example: "John Doe"
  *                              url:
  *                                  type: string
  *                                  example: "https://www.nachklang.art/events/concert"
@@ -685,32 +673,16 @@ eventsRouter.post('/', requireCalendarAccess, async (req: Request, res: Response
  *                                  message:
  *                                      type: string
  *                                      example: Required parameters missing
- *              401:
- *                  description: Unauthorized - not signed in
- *                  content:
- *                      application/json:
- *                          schema:
- *                              type: object
- *                              properties:
- *                                  status:
- *                                      type: string
- *                                      example: UNAUTHORIZED
- *                                  message:
- *                                      type: string
- *                                      example: Anmeldung erforderlich.
  *              403:
- *                  description: Forbidden - the account lacks the calendar permission
+ *                  description: Forbidden - no access to update events
  *                  content:
  *                      application/json:
  *                          schema:
  *                              type: object
  *                              properties:
- *                                  status:
- *                                      type: string
- *                                      example: FORBIDDEN
  *                                  message:
  *                                      type: string
- *                                      example: "Für diesen Bereich fehlt dir die Berechtigung."
+ *                                      example: You do not have access to the specified calendar.
  *              500:
  *                  description: Server error
  *                  content:
@@ -728,9 +700,19 @@ eventsRouter.post('/', requireCalendarAccess, async (req: Request, res: Response
  *                                      type: string
  *                                      example: 6ec1361c-4175-4e81-b2ef-a0792a9a1dc3
  */
-eventsRouter.put('/:eventId', requireCalendarAccess, async (req: Request, res: Response) => {
+eventsRouter.put('/:eventId', async (req: Request, res: Response) => {
 	try {
-		const admin = adminOf(res);
+		// Get params
+		let sessionId: string = req.query.sessionId as string ?? '';
+		let sessionKey: string = req.query.sessionKey as string ?? '';
+		let ip: string = req.socket.remoteAddress ?? '';
+
+		let user = await UserService.checkSession(sessionId, sessionKey, ip);
+
+		if (!user?.isActive) {
+			res.status(403).send({'message': 'You do not have access to the specified calendar.'});
+			return;
+		}
 
 		if (
 			req.params.eventId === undefined ||
@@ -753,9 +735,8 @@ eventsRouter.put('/:eventId', requireCalendarAccess, async (req: Request, res: R
 			endDateTime: new Date(req.body.endDateTime),
 			createdDate: new Date(),
 			location: req.body.location ?? '',
-			// LEGACY createdById is deliberately not set: there is no calendar
-			// user id any more, and migration 003 made the column nullable.
-			createdByUserId: admin.id,
+			createdBy: req.body.createdBy ?? '',
+			createdById: user.userId ?? -1,
 			url: req.body.url ?? '',
 			wholeDay: req.body.wholeDay ?? false,
             repeatFrequency: req.body.repeatFrequency ?? '',
@@ -787,11 +768,9 @@ eventsRouter.put('/:eventId', requireCalendarAccess, async (req: Request, res: R
  * /calendar/events/move/{eventId}:
  *      put:
  *          summary: Move an event to a different calendar
- *          description: Moves an event to a different calendar. Requires a signed-in account with the calendar permission.
+ *          description: Moves an existing event to a different calendar. Authentication required.
  *          tags:
  *              - calendar
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
  *              - in: path
  *                name: eventId
@@ -799,6 +778,18 @@ eventsRouter.put('/:eventId', requireCalendarAccess, async (req: Request, res: R
  *                schema:
  *                    type: integer
  *                description: The ID of the event to move
+ *              - in: query
+ *                name: sessionId
+ *                required: true
+ *                schema:
+ *                    type: string
+ *                description: Session ID for authentication
+ *              - in: query
+ *                name: sessionKey
+ *                required: true
+ *                schema:
+ *                    type: string
+ *                description: Session key for authentication
  *          requestBody:
  *              required: true
  *              content:
@@ -829,6 +820,9 @@ eventsRouter.put('/:eventId', requireCalendarAccess, async (req: Request, res: R
  *                              location:
  *                                  type: string
  *                                  example: "Musikhochschule, Karlsruhe"
+ *                              createdBy:
+ *                                  type: string
+ *                                  example: "John Doe"
  *                              url:
  *                                  type: string
  *                                  example: "https://www.nachklang.art/events/concert"
@@ -860,32 +854,16 @@ eventsRouter.put('/:eventId', requireCalendarAccess, async (req: Request, res: R
  *                                  message:
  *                                      type: string
  *                                      example: Required parameters missing
- *              401:
- *                  description: Unauthorized - not signed in
- *                  content:
- *                      application/json:
- *                          schema:
- *                              type: object
- *                              properties:
- *                                  status:
- *                                      type: string
- *                                      example: UNAUTHORIZED
- *                                  message:
- *                                      type: string
- *                                      example: Anmeldung erforderlich.
  *              403:
- *                  description: Forbidden - the account lacks the calendar permission
+ *                  description: Forbidden - no access to move events
  *                  content:
  *                      application/json:
  *                          schema:
  *                              type: object
  *                              properties:
- *                                  status:
- *                                      type: string
- *                                      example: FORBIDDEN
  *                                  message:
  *                                      type: string
- *                                      example: "Für diesen Bereich fehlt dir die Berechtigung."
+ *                                      example: You do not have access to the specified calendar.
  *              500:
  *                  description: Server error
  *                  content:
@@ -903,9 +881,19 @@ eventsRouter.put('/:eventId', requireCalendarAccess, async (req: Request, res: R
  *                                      type: string
  *                                      example: 6ec1361c-4175-4e81-b2ef-a0792a9a1dc3
  */
-eventsRouter.put('/move/:eventId', requireCalendarAccess, async (req: Request, res: Response) => {
+eventsRouter.put('/move/:eventId', async (req: Request, res: Response) => {
 	try {
-		const admin = adminOf(res);
+		// Get params
+		let sessionId: string = req.query.sessionId as string ?? '';
+		let sessionKey: string = req.query.sessionKey as string ?? '';
+		let ip: string = req.socket.remoteAddress ?? '';
+
+		let user = await UserService.checkSession(sessionId, sessionKey, ip);
+
+		if (!user?.isActive) {
+			res.status(403).send({'message': 'You do not have access to the specified calendar.'});
+			return;
+		}
 
 		if (
 			req.params.eventId === undefined ||
@@ -925,9 +913,8 @@ eventsRouter.put('/move/:eventId', requireCalendarAccess, async (req: Request, r
 			endDateTime: new Date(req.body.endDateTime),
 			createdDate: new Date(),
 			location: req.body.location ?? '',
-			// LEGACY createdById is deliberately not set: there is no calendar
-			// user id any more, and migration 003 made the column nullable.
-			createdByUserId: admin.id,
+			createdBy: req.body.createdBy ?? '',
+			createdById: user.userId ?? -1,
 			url: req.body.url ?? '',
 			wholeDay: req.body.wholeDay ?? false,
             repeatFrequency: req.body.repeatFrequency ?? '',
@@ -957,11 +944,9 @@ eventsRouter.put('/move/:eventId', requireCalendarAccess, async (req: Request, r
  * /calendar/events/{eventId}:
  *      delete:
  *          summary: Delete an event
- *          description: Deletes an event. Requires a signed-in account with the calendar permission.
+ *          description: Deletes an existing event. Authentication required.
  *          tags:
  *              - calendar
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
  *              - in: path
  *                name: eventId
@@ -969,6 +954,18 @@ eventsRouter.put('/move/:eventId', requireCalendarAccess, async (req: Request, r
  *                schema:
  *                    type: integer
  *                description: The ID of the event to delete
+ *              - in: query
+ *                name: sessionId
+ *                required: true
+ *                schema:
+ *                    type: string
+ *                description: Session ID for authentication
+ *              - in: query
+ *                name: sessionKey
+ *                required: true
+ *                schema:
+ *                    type: string
+ *                description: Session key for authentication
  *          responses:
  *              200:
  *                  description: Event deleted successfully
@@ -990,32 +987,16 @@ eventsRouter.put('/move/:eventId', requireCalendarAccess, async (req: Request, r
  *                                  message:
  *                                      type: string
  *                                      example: Required parameters missing
- *              401:
- *                  description: Unauthorized - not signed in
- *                  content:
- *                      application/json:
- *                          schema:
- *                              type: object
- *                              properties:
- *                                  status:
- *                                      type: string
- *                                      example: UNAUTHORIZED
- *                                  message:
- *                                      type: string
- *                                      example: Anmeldung erforderlich.
  *              403:
- *                  description: Forbidden - the account lacks the calendar permission
+ *                  description: Forbidden - no access to delete events
  *                  content:
  *                      application/json:
  *                          schema:
  *                              type: object
  *                              properties:
- *                                  status:
- *                                      type: string
- *                                      example: FORBIDDEN
  *                                  message:
  *                                      type: string
- *                                      example: "Für diesen Bereich fehlt dir die Berechtigung."
+ *                                      example: You do not have access to the specified calendar.
  *              500:
  *                  description: Server error
  *                  content:
@@ -1033,9 +1014,19 @@ eventsRouter.put('/move/:eventId', requireCalendarAccess, async (req: Request, r
  *                                      type: string
  *                                      example: 6ec1361c-4175-4e81-b2ef-a0792a9a1dc3
  */
-eventsRouter.delete('/:eventId', requireCalendarAccess, async (req: Request, res: Response) => {
+eventsRouter.delete('/:eventId', async (req: Request, res: Response) => {
 	try {
-		const admin = adminOf(res);
+		// Get params
+		let sessionId: string = req.query.sessionId as string ?? '';
+		let sessionKey: string = req.query.sessionKey as string ?? '';
+		let ip: string = req.socket.remoteAddress ?? '';
+
+		let user = await UserService.checkSession(sessionId, sessionKey, ip);
+
+		if (!user?.isActive) {
+			res.status(403).send({'message': 'You do not have access to the specified calendar.'});
+			return;
+		}
 
 		if (
 			req.params.eventId === undefined
@@ -1055,9 +1046,7 @@ eventsRouter.delete('/:eventId', requireCalendarAccess, async (req: Request, res
 			createdDate: new Date(),
 			location: '',
 			createdBy: '',
-			// LEGACY createdById is deliberately not set: there is no calendar
-			// user id any more, and migration 003 made the column nullable.
-			createdByUserId: admin.id,
+			createdById: user.userId ?? -1,
 			url: '',
 			wholeDay: false,
             repeatFrequency: '',

src/models/calendar/events/events.service.ts

@@ -2,163 +2,65 @@ import * as dotenv from 'dotenv';
 import {Guid} from 'guid-typescript';
 import {Event} from './event.interface.js';
 import {NachklangCalendarDB} from '../Calendar.db.js';
-import * as AdminUsersService from '../../admin/users/users.admin.service.js';
-import logger from '../../../middleware/logger.js';
 
 
 dotenv.config();
 
-/**
- * How an event's creator is resolved, after step 5 of
- * docs/calendar-auth-migration.md removed the legacy path.
- *
- * The creator is only ever rendered as a name - nothing authorises on it, there
- * is no "only the creator may edit" rule anywhere - which is why an unresolvable
- * one degrades to blank rather than to an error.
- *
- * Two sources remain, weaker first:
- *
- *   1. `created_by_name`, a snapshot of the name as it stood when the calendar
- *      had its own `users` table. Migration 002 took it, migration 004 dropped
- *      the table it was taken from, and nothing has written it since. It exists
- *      so the authorship of pre-cutover events survived that removal.
- *   2. The admin module's `user.name`, looked up live for rows carrying an admin
- *      id. It wins, because it is the only one that follows a rename.
- *
- * The third source - joining the calendar's own `users` table on
- * `created_by_id` - is gone with the table and the column.
- */
-
-/**
- * The one SELECT the four read paths share; callers append their own WHERE and
- * ORDER BY. `v.*` carries the version row's own creator columns, so only the
- * `events` columns need naming.
- *
- * There are no joins to a users table any more. There is no users table.
- */
-const EVENT_SELECT = `
-		SELECT e.calendar_id, e.uuid, e.created_date, e.created_by_user_id, e.created_by_name, v.* FROM events e
-			INNER JOIN (
-  				SELECT event_id, MAX(event_version_id) AS latest_version
-			  	FROM event_versions
-			  	GROUP BY event_id
-			) latest_versions
-			ON e.event_id = latest_versions.event_id
-			INNER JOIN event_versions v
-			ON v.event_id = latest_versions.event_id AND v.event_version_id = latest_versions.latest_version`;
-
-/**
- * Maps a result row to an Event. `status` is included only where it always
- * was: the admin views and the by-id lookup return it, the two public listings
- * do not.
- */
-const toEvent = (row: any, includeStatus: boolean): Event => {
-	const event: Event = {
-		eventId: row.event_id,
-		calendarId: row.calendar_id,
-		uuid: row.uuid,
-		name: row.name,
-		description: row.description,
-		startDateTime: row.start_datetime,
-		endDateTime: row.end_datetime,
-		createdDate: row.created_date,
-		lastModifiedDate: row.version_created_at,
-		location: row.location,
-		// The archived name. resolveAdminNames below overwrites it for rows that
-		// carry an admin id, which is the only source that follows a rename.
-		createdBy: row.created_by_name,
-		createdByUserId: row.created_by_user_id ?? null,
-		lastModifiedBy: row.version_created_by_name,
-		lastModifiedByUserId: row.version_created_by_user_id ?? null,
-		url: row.url,
-		wholeDay: row.whole_day,
-		repeatFrequency: row.repeat_frequency
-	};
-
-	if (includeStatus) {
-		event.status = row.status;
-	}
-
-	return event;
-};
-
-/**
- * Fills in creator/editor names for rows that carry an admin user id, by way
- * of a single lookup against the admin database. The calendar cannot join
- * against `user` - it is a different schema behind a different pool - and
- * making it one would tie the two schemas together as tightly as a foreign key
- * would.
- *
- * A failure here is swallowed on purpose. These endpoints include the public
- * calendar the website reads anonymously, and a name is decoration: if the
- * admin database is unreachable, an event should still render with whatever
- * the snapshot holds rather than 500 the whole listing. The alternative
- * would widen the public calendar's blast radius to include the admin
- * database, which it has never depended on before.
- */
-const resolveAdminNames = async (events: Event[]): Promise<void> => {
-	const ids = events
-		.flatMap(event => [event.createdByUserId, event.lastModifiedByUserId])
-		.filter((id): id is string => Boolean(id));
-
-	if (ids.length === 0) {
-		return;
-	}
-
-	let names: Map<string, string>;
-	try {
-		names = await AdminUsersService.findDisplayNames(ids);
-	} catch (e: any) {
-		logger.warn('Calendar: could not resolve creator names from the admin database: ' + e.message);
-		return;
-	}
-
-	for (const event of events) {
-		const createdBy = event.createdByUserId ? names.get(event.createdByUserId) : undefined;
-		if (createdBy) {
-			event.createdBy = createdBy;
-		}
-
-		const lastModifiedBy = event.lastModifiedByUserId ? names.get(event.lastModifiedByUserId) : undefined;
-		if (lastModifiedBy) {
-			event.lastModifiedBy = lastModifiedBy;
-		}
-	}
-};
-
-/**
- * The calendars a listing has to cover: the requested one plus whatever it
- * declares in `includes_calendars`.
- */
-const calendarsToFetch = async (conn: any, calendarId: number): Promise<number[]> => {
-	const calendarQuery = 'SELECT calendar_id, includes_calendars FROM calendars WHERE calendar_id = ?';
-	const calendarRes = await conn.query(calendarQuery, calendarId);
-	let calendars: number[] = [calendarId];
-	for (let row of calendarRes) {
-		let includes: number[] = JSON.parse(row.includes_calendars);
-		calendars = [...calendars, ...includes];
-	}
-	return calendars;
-};
-
 /**
  * Returns all events for the given calendar
  * @param calendarId The calendar Id
  */
 export const getAllEvents = async (calendarId: number): Promise<Event[]> => {
 	let conn = await NachklangCalendarDB.getConnection();
+	let eventRows: Event[] = [];
 	try {
-		const calendars = await calendarsToFetch(conn, calendarId);
+		const calendarQuery = 'SELECT calendar_id, includes_calendars FROM calendars WHERE calendar_id = ?';
+		const calendarRes = await conn.query(calendarQuery, calendarId);
+		let calendarsToFetch: number[] = [calendarId];
+		for(let row of calendarRes) {
+			let includes: number[] = JSON.parse(row.includes_calendars);
+			calendarsToFetch = [...calendarsToFetch, ...includes];
+		}
 
-		const eventsQuery = `${EVENT_SELECT}
+		const eventsQuery = `
+		SELECT e.calendar_id, e.uuid, e.created_date, e.created_by_id, u.full_name as created_by_name, u2.full_name as last_modified_by_name, v.* FROM events e
+			INNER JOIN (
+  				SELECT event_id, MAX(event_version_id) AS latest_version
+			  	FROM event_versions
+			  	GROUP BY event_id
+			) latest_versions
+			ON e.event_id = latest_versions.event_id
+			INNER JOIN event_versions v
+			ON v.event_id = latest_versions.event_id AND v.event_version_id = latest_versions.latest_version
+			LEFT OUTER JOIN users u ON u.user_id = e.created_by_id
+		    LEFT OUTER JOIN users u2 ON u2.user_id = v.version_created_by_id
 			WHERE e.calendar_id IN (?) AND v.status = 'PUBLIC'
 			ORDER BY e.event_id`;
-		const eventsRes = await conn.query(eventsQuery, [calendars]);
+		const eventsRes = await conn.query(eventsQuery, [calendarsToFetch]);
 
-		const events = eventsRes.map((row: any) => toEvent(row, false));
-		await resolveAdminNames(events);
+		for (let row of eventsRes) {
+			eventRows.push({
+				eventId: row.event_id,
+				calendarId: row.calendar_id,
+				uuid: row.uuid,
+				name: row.name,
+				description: row.description,
+				startDateTime: row.start_datetime,
+				endDateTime: row.end_datetime,
+				createdDate: row.created_date,
+				lastModifiedDate: row.version_created_at,
+				location: row.location,
+				createdBy: row.created_by_name,
+				createdById: row.created_by_id,
+				lastModifiedBy: row.last_modified_by_name,
+				lastModifiedById: row.version_created_by_id,
+				url: row.url,
+				wholeDay: row.whole_day,
+                repeatFrequency: row.repeat_frequency
+			});
+		}
 
-		return events;
+		return eventRows;
 	} catch (err) {
 		throw err;
 	} finally {
@@ -174,16 +76,48 @@ export const getAllEvents = async (calendarId: number): Promise<Event[]> => {
  */
 export const getAllEventsAdmin = async (calendarId: number): Promise<Event[]> => {
 	let conn = await NachklangCalendarDB.getConnection();
+	let eventRows: Event[] = [];
 	try {
-		const eventsQuery = `${EVENT_SELECT}
+		const eventsQuery = `
+        SELECT e.calendar_id, e.uuid, e.created_date, e.created_by_id, u.full_name as created_by_name, u2.full_name as last_modified_by_name, v.* FROM events e
+			INNER JOIN (
+  				SELECT event_id, MAX(event_version_id) AS latest_version
+			  	FROM event_versions
+			  	GROUP BY event_id
+			) latest_versions
+			ON e.event_id = latest_versions.event_id
+			INNER JOIN event_versions v
+			ON v.event_id = latest_versions.event_id AND v.event_version_id = latest_versions.latest_version
+			LEFT OUTER JOIN users u ON u.user_id = e.created_by_id
+			LEFT OUTER JOIN users u2 ON u2.user_id = v.version_created_by_id
 			WHERE e.calendar_id = ?
 			ORDER BY e.event_id`;
 		const eventsRes = await conn.query(eventsQuery, calendarId);
 
-		const events = eventsRes.map((row: any) => toEvent(row, true));
-		await resolveAdminNames(events);
+		for (let row of eventsRes) {
+			eventRows.push({
+				eventId: row.event_id,
+				calendarId: row.calendar_id,
+				uuid: row.uuid,
+				name: row.name,
+				description: row.description,
+				startDateTime: row.start_datetime,
+				endDateTime: row.end_datetime,
+				createdDate: row.created_date,
+				lastModifiedDate: row.version_created_at,
+				location: row.location,
+				createdBy: row.created_by_name,
+				createdById: row.created_by_id,
+				lastModifiedBy: row.last_modified_by_name,
+				lastModifiedById: row.version_created_by_id,
+				url: row.url,
+				wholeDay: row.whole_day,
+                repeatFrequency: row.repeat_frequency,
+				status: row.status
+			});
+		}
 
-		return events;
+		return eventRows;
 	} catch (err) {
 		throw err;
 	} finally {
@@ -202,7 +136,18 @@ export const getAllEventsAdmin = async (calendarId: number): Promise<Event[]> =>
 export const getEventById = async (eventId: number): Promise<Event | null> => {
 	let conn = await NachklangCalendarDB.getConnection();
 	try {
-		const eventsQuery = `${EVENT_SELECT}
+		const eventsQuery = `
+		SELECT e.calendar_id, e.uuid, e.created_date, e.created_by_id, u.full_name as created_by_name, u2.full_name as last_modified_by_name, v.* FROM events e
+			INNER JOIN (
+  				SELECT event_id, MAX(event_version_id) AS latest_version
+			  	FROM event_versions
+			  	GROUP BY event_id
+			) latest_versions
+			ON e.event_id = latest_versions.event_id
+			INNER JOIN event_versions v
+			ON v.event_id = latest_versions.event_id AND v.event_version_id = latest_versions.latest_version
+			LEFT OUTER JOIN users u ON u.user_id = e.created_by_id
+		    LEFT OUTER JOIN users u2 ON u2.user_id = v.version_created_by_id
 			WHERE e.event_id = ?`;
 		const eventsRes = await conn.query(eventsQuery, eventId);
 
@@ -210,10 +155,27 @@ export const getEventById = async (eventId: number): Promise<Event | null> => {
 			return null;
 		}
 
-		const event = toEvent(eventsRes[0], true);
-		await resolveAdminNames([event]);
-
-		return event;
+		const row = eventsRes[0];
+		return {
+			eventId: row.event_id,
+			calendarId: row.calendar_id,
+			uuid: row.uuid,
+			name: row.name,
+			description: row.description,
+			startDateTime: row.start_datetime,
+			endDateTime: row.end_datetime,
+			createdDate: row.created_date,
+			lastModifiedDate: row.version_created_at,
+			location: row.location,
+			createdBy: row.created_by_name,
+			createdById: row.created_by_id,
+			lastModifiedBy: row.last_modified_by_name,
+			lastModifiedById: row.version_created_by_id,
+			url: row.url,
+			wholeDay: row.whole_day,
+            repeatFrequency: row.repeat_frequency,
+			status: row.status
+		} as Event;
 	} catch (err) {
 		throw err;
 	} finally {
@@ -231,11 +193,11 @@ export const createEvent = async (event: Event): Promise<number> => {
 	try {
 		await conn.beginTransaction();
 		let eventUUID = Guid.create().toString();
-		const eventsQuery = 'INSERT INTO events (calendar_id, uuid, created_by_user_id) VALUES (?,?,?) RETURNING event_id';
-		const eventsRes = await conn.execute(eventsQuery, [event.calendarId, eventUUID, event.createdByUserId ?? null]);
+		const eventsQuery = 'INSERT INTO events (calendar_id, uuid, created_by_id) VALUES (?,?,?) RETURNING event_id';
+		const eventsRes = await conn.execute(eventsQuery, [event.calendarId, eventUUID, event.createdById]);
 
-		const versionQuery = 'INSERT INTO event_versions (event_id, name, description, start_datetime, end_datetime, whole_day, repeat_frequency, location, url, status, version_created_by_user_id) VALUES (?,?,?,?,?,?,?,?,?,?,?);'
-		await conn.execute(versionQuery, [eventsRes[0].event_id, event.name, event.description, event.startDateTime, event.endDateTime, event.wholeDay, event.repeatFrequency, event.location, event.url, event.status, event.createdByUserId ?? null]);
+		const versionQuery = 'INSERT INTO event_versions (event_id, name, description, start_datetime, end_datetime, whole_day, repeat_frequency, location, url, status, version_created_by_id) VALUES (?,?,?,?,?,?,?,?,?,?,?);'
+		await conn.execute(versionQuery, [eventsRes[0].event_id, event.name, event.description, event.startDateTime, event.endDateTime, event.wholeDay, event.repeatFrequency, event.location, event.url, event.status, event.createdById]);
 
 		await conn.commit();
 
@@ -256,8 +218,8 @@ export const updateEvent = async (event: Event): Promise<number> => {
 	let conn = await NachklangCalendarDB.getConnection();
 	try {
 		await conn.beginTransaction();
-		const versionQuery = 'INSERT INTO event_versions (event_id, name, description, start_datetime, end_datetime, whole_day, repeat_frequency, location, url, status, version_created_by_user_id) VALUES (?,?,?,?,?,?,?,?,?,?,?);'
-		const versionRes = await conn.execute(versionQuery, [event.eventId, event.name, event.description, event.startDateTime, event.endDateTime, event.wholeDay, event.repeatFrequency, event.location, event.url, event.status, event.createdByUserId ?? null]);
+		const versionQuery = 'INSERT INTO event_versions (event_id, name, description, start_datetime, end_datetime, whole_day, repeat_frequency, location, url, status, version_created_by_id) VALUES (?,?,?,?,?,?,?,?,?,?,?);'
+		const versionRes = await conn.execute(versionQuery, [event.eventId, event.name, event.description, event.startDateTime, event.endDateTime, event.wholeDay, event.repeatFrequency, event.location, event.url, event.status, event.createdById]);
 
 		await conn.commit();
 
@@ -278,8 +240,8 @@ export const deleteEvent = async (event: Event): Promise<boolean> => {
 	let conn = await NachklangCalendarDB.getConnection();
 	try {
 		await conn.beginTransaction();
-		const versionQuery = 'INSERT INTO event_versions (event_id, status, version_created_by_user_id) VALUES (?,?,?);'
-		const versionRes = await conn.execute(versionQuery, [event.eventId, 'DELETED', event.createdByUserId ?? null]);
+		const versionQuery = 'INSERT INTO event_versions (event_id, status, version_created_by_id) VALUES (?,?,?);'
+		const versionRes = await conn.execute(versionQuery, [event.eventId, 'DELETED', event.createdById]);
 
 		await conn.commit();
 
@@ -321,23 +283,56 @@ export const moveEvent = async (event: Event): Promise<boolean> => {
 export const getNextUpcomingEvent = async (calendarId: number): Promise<Event | null> => {
 	let conn = await NachklangCalendarDB.getConnection();
 	try {
-		const calendars = await calendarsToFetch(conn, calendarId);
+		const calendarQuery = 'SELECT calendar_id, includes_calendars FROM calendars WHERE calendar_id = ?';
+		const calendarRes = await conn.query(calendarQuery, calendarId);
+		let calendarsToFetch: number[] = [calendarId];
+		for(let row of calendarRes) {
+			let includes: number[] = JSON.parse(row.includes_calendars);
+			calendarsToFetch = [...calendarsToFetch, ...includes];
+		}
 
 		const now = new Date();
-		const eventsQuery = `${EVENT_SELECT}
+		const eventsQuery = `
+		SELECT e.calendar_id, e.uuid, e.created_date, e.created_by_id, u.full_name as created_by_name, u2.full_name as last_modified_by_name, v.* FROM events e
+			INNER JOIN (
+  				SELECT event_id, MAX(event_version_id) AS latest_version
+			  	FROM event_versions
+			  	GROUP BY event_id
+			) latest_versions
+			ON e.event_id = latest_versions.event_id
+			INNER JOIN event_versions v
+			ON v.event_id = latest_versions.event_id AND v.event_version_id = latest_versions.latest_version
+			LEFT OUTER JOIN users u ON u.user_id = e.created_by_id
+			LEFT OUTER JOIN users u2 ON u2.user_id = v.version_created_by_id
 			WHERE e.calendar_id IN (?) AND v.status = 'PUBLIC' AND v.start_datetime > ?
 			ORDER BY v.start_datetime ASC
 			LIMIT 1`;
-		const eventsRes = await conn.query(eventsQuery, [calendars, now]);
+		const eventsRes = await conn.query(eventsQuery, [calendarsToFetch, now]);
 
 		if (eventsRes.length === 0) {
 			return null;
 		}
 
-		const event = toEvent(eventsRes[0], false);
-		await resolveAdminNames([event]);
-
-		return event;
+		const row = eventsRes[0];
+		return {
+			eventId: row.event_id,
+			calendarId: row.calendar_id,
+			uuid: row.uuid,
+			name: row.name,
+			description: row.description,
+			startDateTime: row.start_datetime,
+			endDateTime: row.end_datetime,
+			createdDate: row.created_date,
+			lastModifiedDate: row.version_created_at,
+			location: row.location,
+			createdBy: row.created_by_name,
+			createdById: row.created_by_id,
+			lastModifiedBy: row.last_modified_by_name,
+			lastModifiedById: row.version_created_by_id,
+			url: row.url,
+			wholeDay: row.whole_day,
+            repeatFrequency: row.repeat_frequency
+		} as Event;
 	} catch (err) {
 		throw err;
 	} finally {

src/models/calendar/users/session.interface.ts

@@ -0,0 +1,53 @@
+/**
+ * @swagger
+ * components:
+ *   schemas:
+ *     Session:
+ *       type: object
+ *       required:
+ *         - sessionId
+ *         - userId
+ *         - sessionKey
+ *         - sessionKeyHash
+ *         - lastIP
+ *       properties:
+ *         sessionId:
+ *           type: integer
+ *           description: The unique identifier for the session
+ *           example: 789
+ *         userId:
+ *           type: integer
+ *           description: The ID of the user this session belongs to
+ *           example: 456
+ *         sessionKey:
+ *           type: string
+ *           description: The session key used for authentication
+ *           example: "abc123def456"
+ *         sessionKeyHash:
+ *           type: string
+ *           description: The hashed session key (not returned in API responses)
+ *           example: "$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG"
+ *         createdDate:
+ *           type: string
+ *           format: date-time
+ *           description: The date and time when the session was created
+ *           example: "2023-05-01T10:00:00.000Z"
+ *         validUntil:
+ *           type: string
+ *           format: date-time
+ *           description: The date and time until when the session is valid
+ *           example: "2023-05-08T10:00:00.000Z"
+ *         lastIP:
+ *           type: string
+ *           description: The last IP address used with this session
+ *           example: "192.168.1.1"
+ */
+export interface Session {
+	sessionId: number;
+	userId: number;
+	sessionKey: string;
+	sessionKeyHash: string;
+	createdDate?: Date;
+	validUntil?: Date;
+	lastIP: string;
+}

src/models/calendar/users/user.interface.ts

@@ -0,0 +1,42 @@
+/**
+ * @swagger
+ * components:
+ *   schemas:
+ *     User:
+ *       type: object
+ *       required:
+ *         - userId
+ *         - fullName
+ *         - passwordHash
+ *         - email
+ *         - isActive
+ *       properties:
+ *         userId:
+ *           type: integer
+ *           description: The unique identifier for the user
+ *           example: 456
+ *         fullName:
+ *           type: string
+ *           description: The full name of the user
+ *           example: "John Doe"
+ *         passwordHash:
+ *           type: string
+ *           description: The hashed password of the user (not returned in API responses)
+ *           example: "$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG"
+ *         email:
+ *           type: string
+ *           format: email
+ *           description: The email address of the user
+ *           example: "john.doe@nachklang.art"
+ *         isActive:
+ *           type: boolean
+ *           description: Whether the user account is active
+ *           example: true
+ */
+export interface User {
+	userId: number;
+	fullName: string;
+	passwordHash: string;
+	email: string;
+	isActive: boolean;
+}

src/models/calendar/users/users.router.ts

@@ -0,0 +1,671 @@
+/**
+ * Required External Modules and Interfaces
+ */
+
+import express, {Request, Response} from 'express';
+import * as UserService from './users.service.js';
+import {Session} from './session.interface.js';
+import {User} from './user.interface.js';
+import {Guid} from 'guid-typescript';
+import logger from '../../../middleware/logger.js';
+
+/**
+ * Router Definition
+ */
+
+export const usersRouter = express.Router();
+
+
+/**
+ * Controller Definitions
+ */
+
+/**
+ * @swagger
+ * /calendar/users/register:
+ *      post:
+ *          summary: Register a new user
+ *          description: Creates a new user account with the provided email, password, and full name. Only accepts official Nachklang email addresses.
+ *          tags:
+ *              - calendar
+ *          requestBody:
+ *              required: true
+ *              content:
+ *                  application/json:
+ *                      schema:
+ *                          type: object
+ *                          required:
+ *                              - email
+ *                              - password
+ *                              - fullName
+ *                          properties:
+ *                              email:
+ *                                  type: string
+ *                                  format: email
+ *                                  example: john.doe@nachklang.art
+ *                                  description: Must be an official Nachklang email address
+ *                              password:
+ *                                  type: string
+ *                                  format: password
+ *                                  example: securePassword123
+ *                              fullName:
+ *                                  type: string
+ *                                  example: John Doe
+ *          responses:
+ *              201:
+ *                  description: User registered successfully
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  sessionId:
+ *                                      type: integer
+ *                                      example: 123
+ *                                  sessionKey:
+ *                                      type: string
+ *                                      example: abc123def456
+ *              400:
+ *                  description: Bad request - missing or invalid parameters
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  message:
+ *                                      type: string
+ *                                      example: Missing parameters
+ *              500:
+ *                  description: Server error
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  status:
+ *                                      type: string
+ *                                      example: PROCESSING_ERROR
+ *                                  message:
+ *                                      type: string
+ *                                      example: Internal Server Error. Try again later.
+ *                                  reference:
+ *                                      type: string
+ *                                      example: 6ec1361c-4175-4e81-b2ef-a0792a9a1dc3
+ */
+// POST users/register
+usersRouter.post('/register', async (req: Request, res: Response) => {
+	try {
+		const password: string = req.body.password;
+		const email: string = req.body.email;
+		const fullName: string = req.body.fullName;
+		const ip: string = req.socket.remoteAddress ?? '';
+
+		if (!password || !email || !fullName) {
+			// Missing
+			res.status(400).send(JSON.stringify({message: 'Missing parameters'}));
+			return;
+		}
+
+		const emailRegex = /^[a-zA-Z0-9\_\-\.]+@nachklang\.art$/;
+
+		if(!emailRegex.test(email)) {
+			res.status(400).send(JSON.stringify({message: 'Must use an official Nachklang email address'}));
+			return;
+		}
+
+		// Create the user and a session
+		const session: Session = await UserService.createUser(email, password, fullName, ip);
+
+		// Send the session details back to the user
+		res.status(201).send({
+			sessionId: session.sessionId,
+			sessionKey: session.sessionKey
+		});
+	} catch (e: any) {
+		let errorGuid = Guid.create().toString();
+		logger.error('Error handling a request: ' + e.message, {reference: errorGuid});
+		res.status(500).send({
+			'status': 'PROCESSING_ERROR',
+			'message': 'Internal Server Error. Try again later.',
+			'reference': errorGuid
+		});
+	}
+});
+
+/**
+ * @swagger
+ * /calendar/users/activate:
+ *      get:
+ *          summary: Activate a user account
+ *          description: Activates a user account using the provided user ID and activation token.
+ *          tags:
+ *              - calendar
+ *          parameters:
+ *              - in: query
+ *                name: id
+ *                required: true
+ *                schema:
+ *                    type: integer
+ *                description: The ID of the user to activate
+ *              - in: query
+ *                name: token
+ *                required: true
+ *                schema:
+ *                    type: string
+ *                description: The activation token sent to the user's email
+ *          responses:
+ *              200:
+ *                  description: User activated successfully
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  status:
+ *                                      type: string
+ *                                      example: OK
+ *                                  message:
+ *                                      type: string
+ *                                      example: User activated
+ *              400:
+ *                  description: Bad request - missing parameters or activation failed
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  status:
+ *                                      type: string
+ *                                      example: PROCESSING_ERROR
+ *                                  message:
+ *                                      type: string
+ *                                      example: Error activating user. Please contact your administrator.
+ *              500:
+ *                  description: Server error
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  status:
+ *                                      type: string
+ *                                      example: PROCESSING_ERROR
+ *                                  message:
+ *                                      type: string
+ *                                      example: Internal Server Error. Try again later.
+ *                                  reference:
+ *                                      type: string
+ *                                      example: 6ec1361c-4175-4e81-b2ef-a0792a9a1dc3
+ */
+// GET /users/activate
+usersRouter.get('/activate', async (req: Request, res: Response) => {
+	try {
+		const userId: number = parseInt(req.query.id as string ?? '-1', 10);
+		const token: string = req.query.token as string ?? '';
+
+		if (!userId || !token) {
+			// Missing
+			res.status(400).send(JSON.stringify({message: 'Missing parameters'}));
+			return;
+		}
+
+		// Create the user and a session
+		const success: boolean = await UserService.activateUser(userId, token);
+
+		// Send the session details back to the user
+		if(success) {
+			res.status(200).send({
+				'status': 'OK',
+				'message': 'User activated'
+			});
+			return;
+		}
+		res.status(400).send({'status': 'PROCESSING_ERROR','message': 'Error activating user. Please contact your administrator.'});
+	} catch (e: any) {
+		let errorGuid = Guid.create().toString();
+		logger.error('Error handling a request: ' + e.message, {reference: errorGuid});
+		res.status(500).send({
+			'status': 'PROCESSING_ERROR',
+			'message': 'Internal Server Error. Try again later.',
+			'reference': errorGuid
+		});
+	}
+});
+
+/**
+ * @swagger
+ * /calendar/users/login:
+ *      post:
+ *          summary: Login a user
+ *          description: Authenticates a user with the provided email and password and returns a session.
+ *          tags:
+ *              - calendar
+ *          requestBody:
+ *              required: true
+ *              content:
+ *                  application/json:
+ *                      schema:
+ *                          type: object
+ *                          required:
+ *                              - email
+ *                              - password
+ *                          properties:
+ *                              email:
+ *                                  type: string
+ *                                  format: email
+ *                                  example: john.doe@nachklang.art
+ *                              password:
+ *                                  type: string
+ *                                  format: password
+ *                                  example: securePassword123
+ *          responses:
+ *              200:
+ *                  description: Login successful
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  sessionId:
+ *                                      type: integer
+ *                                      example: 123
+ *                                  sessionKey:
+ *                                      type: string
+ *                                      example: abc123def456
+ *              400:
+ *                  description: Bad request - missing parameters
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  message:
+ *                                      type: string
+ *                                      example: Missing parameters
+ *              401:
+ *                  description: Unauthorized - invalid credentials
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  message:
+ *                                      type: string
+ *                                      example: Wrong username and / or password
+ *                                  sessionId:
+ *                                      type: integer
+ *                                      example: -1
+ *                                  sessionKey:
+ *                                      type: string
+ *                                      example: ""
+ *              500:
+ *                  description: Server error
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  status:
+ *                                      type: string
+ *                                      example: PROCESSING_ERROR
+ *                                  message:
+ *                                      type: string
+ *                                      example: Internal Server Error. Try again later.
+ *                                  reference:
+ *                                      type: string
+ *                                      example: 6ec1361c-4175-4e81-b2ef-a0792a9a1dc3
+ */
+// POST users/login
+usersRouter.post('/login', async (req: Request, res: Response) => {
+	try {
+		const password: string = req.body.password;
+		const email: string = req.body.email;
+		const ip: string = req.socket.remoteAddress ?? '';
+
+		if (!password || !email) {
+			// Missing
+			res.status(400).send(JSON.stringify({message: 'Missing parameters'}));
+			return;
+		}
+
+		// Create a session
+		const session: Session | null = await UserService.login(email, password, ip);
+
+		if (!session || !session.sessionId) {
+			// Error logging in, probably wrong username / password
+			res.status(401).send(JSON.stringify({message: 'Wrong username and / or password', sessionId: -1, sessionKey: ''}));
+			return;
+		}
+
+		// Send the session details back to the user
+		res.status(200).send({
+			sessionId: session.sessionId,
+			sessionKey: session.sessionKey
+		});
+	} catch (e: any) {
+		let errorGuid = Guid.create().toString();
+		logger.error('Error handling a request: ' + e.message, {reference: errorGuid});
+		res.status(500).send({
+			'status': 'PROCESSING_ERROR',
+			'message': 'Internal Server Error. Try again later.',
+			'reference': errorGuid
+		});
+	}
+});
+
+/**
+ * @swagger
+ * /calendar/users/checkSessionValid:
+ *      post:
+ *          summary: Check if a session is valid
+ *          description: Checks if the provided session is valid and returns the user information if it is.
+ *          tags:
+ *              - calendar
+ *          requestBody:
+ *              required: true
+ *              content:
+ *                  application/json:
+ *                      schema:
+ *                          type: object
+ *                          required:
+ *                              - sessionId
+ *                              - sessionKey
+ *                          properties:
+ *                              sessionId:
+ *                                  type: integer
+ *                                  example: 123
+ *                              sessionKey:
+ *                                  type: string
+ *                                  example: abc123def456
+ *          responses:
+ *              200:
+ *                  description: Session is valid
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              $ref: '#/components/schemas/User'
+ *              401:
+ *                  description: Unauthorized - invalid session
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  messages:
+ *                                      type: array
+ *                                      items:
+ *                                          type: string
+ *                                      example: ["Invalid session"]
+ *              500:
+ *                  description: Server error
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  status:
+ *                                      type: string
+ *                                      example: PROCESSING_ERROR
+ *                                  message:
+ *                                      type: string
+ *                                      example: Internal Server Error. Try again later.
+ *                                  reference:
+ *                                      type: string
+ *                                      example: 6ec1361c-4175-4e81-b2ef-a0792a9a1dc3
+ */
+// POST users/checkSessionValid
+usersRouter.post('/checkSessionValid', async (req: Request, res: Response) => {
+	try {
+		const ip: string = req.socket.remoteAddress ?? '';
+		const session_id = req.body.sessionId;
+		const session_key = req.body.sessionKey;
+
+		if (!session_id || !session_key) {
+			// Error logging in, probably wrong username / password
+			res.status(401).send(JSON.stringify({messages: ['No session detected']}));
+			return;
+		}
+
+		const user: User | null = await UserService.checkSession(session_id, session_key, ip);
+
+		if (!user || !user.userId) {
+			// Error logging in, probably wrong username / password
+			res.status(401).send(JSON.stringify({messages: ['Invalid session']}));
+			return;
+		}
+
+		res.status(200).send(user);
+	} catch (e: any) {
+		let errorGuid = Guid.create().toString();
+		logger.error('Error handling a request: ' + e.message, {reference: errorGuid});
+		res.status(500).send({
+			'status': 'PROCESSING_ERROR',
+			'message': 'Internal Server Error. Try again later.',
+			'reference': errorGuid
+		});
+	}
+});
+
+/**
+ * @swagger
+ * /calendar/users/initiatePasswordReset:
+ *      post:
+ *          summary: Initiates a password reset
+ *          description: Checks if the user exists and if so, initiates a password reset by sending an email to the user.
+ *          tags:
+ *              - calendar
+ *          responses:
+ *              200:
+ *                  description: Success
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  messages:
+ *                                      type: array
+ *                                      items:
+ *                                          type: string
+ *                                          example: Success
+ *                                      description: A list of status messages
+ *              400:
+ *                  description: Problem with the request. Please consider the returned detailed error.
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  messages:
+ *                                      type: array
+ *                                      items:
+ *                                          type: string
+ *                                          example: Missing parameters
+ *                                      description: A list of error messages
+ *              401:
+ *                  description: Problem with authorizing the user. Please check the provided credentials.
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  messages:
+ *                                      type: array
+ *                                      items:
+ *                                          type: string
+ *                                          example: Invalid session
+ *                                      description: A list of error messages
+ *              500:
+ *                  description: A server error occurred. Please try again. If this issue persists, contact the admin.
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  status:
+ *                                      type: string
+ *                                      description: The response status
+ *                                      example: PROCESSING_ERROR
+ *                                  message:
+ *                                      type: string
+ *                                      description: The detailed error message
+ *                                      example: Internal Server Error. Try again later.
+ *                                  reference:
+ *                                      type: string
+ *                                      description: An error reference for getting support concerning this error.
+ *                                      example: 6ec1361c-4175-4e81-b2ef-a0792a9a1dc3
+ *          requestBody:
+ *              required: true
+ *              content:
+ *                  application/json:
+ *                      schema:
+ *                          type: object
+ *                          properties:
+ *                              email:
+ *                                  type: string
+ *                                  example: patrick@nachklang.art
+ */
+usersRouter.post('/initiatePasswordReset', async(req: Request, res: Response) => {
+	try {
+		const username = req.body.username;
+
+		if (!username) {
+			// Error logging in, probably wrong username / password
+			res.status(400).send(JSON.stringify({messages: ['No username given']}));
+			return;
+		}
+
+		const success: boolean = await UserService.initiatePasswordReset(username);
+
+		if (!success) {
+			// Error logging in, probably wrong username / password
+			res.status(401).send(JSON.stringify({messages: ['Error']}));
+			return;
+		}
+
+		res.status(200).send(JSON.stringify({messages: ['Success']}));
+	} catch (e: any) {
+		let errorGuid = Guid.create().toString();
+		logger.error('Error handling a request: ' + e.message, {reference: errorGuid});
+		res.status(500).send({
+			'status': 'PROCESSING_ERROR',
+			'message': 'Internal Server Error. Try again later.',
+			'reference': errorGuid
+		});
+	}
+});
+
+/**
+ * @swagger
+ * /calendar/users/finalizePasswordReset:
+ *      post:
+ *          summary: Finalizes the password reset
+ *          description: Checks if the given token is valid and if so, finalizes the password reset by setting the new password.
+ *          tags:
+ *              - calendar
+ *          responses:
+ *              200:
+ *                  description: Success
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  messages:
+ *                                      type: array
+ *                                      items:
+ *                                          type: string
+ *                                          example: Success
+ *                                      description: A list of status messages
+ *              400:
+ *                  description: Problem with the request. Please consider the returned detailed error.
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  messages:
+ *                                      type: array
+ *                                      items:
+ *                                          type: string
+ *                                          example: Missing parameters
+ *                                      description: A list of error messages
+ *              401:
+ *                  description: Problem with authorizing the user. Please check the provided credentials.
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  messages:
+ *                                      type: array
+ *                                      items:
+ *                                          type: string
+ *                                          example: Invalid session
+ *                                      description: A list of error messages
+ *              500:
+ *                  description: A server error occurred. Please try again. If this issue persists, contact the admin.
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  status:
+ *                                      type: string
+ *                                      description: The response status
+ *                                      example: PROCESSING_ERROR
+ *                                  message:
+ *                                      type: string
+ *                                      description: The detailed error message
+ *                                      example: Internal Server Error. Try again later.
+ *                                  reference:
+ *                                      type: string
+ *                                      description: An error reference for getting support concerning this error.
+ *                                      example: 6ec1361c-4175-4e81-b2ef-a0792a9a1dc3
+ *          requestBody:
+ *              required: true
+ *              content:
+ *                  application/json:
+ *                      schema:
+ *                          type: object
+ *                          properties:
+ *                              email:
+ *                                  type: string
+ *                                  example: patrick@nachklang.art
+ *                              token:
+ *                                  type: string
+ *                                  example: 3ccd147f-720b-4e29-a8b7-46b63de31555
+ *                              password:
+ *                                  type: string
+ *                                  example: ExtremelyBadPassword
+ */
+usersRouter.post('/finalizePasswordReset', async(req: Request, res: Response) => {
+	try {
+		const username = req.body.username;
+		const token = req.body.token;
+		const newPassword = req.body.password;
+
+		if (!username) {
+			// Error logging in, probably wrong username / password
+			res.status(400).send(JSON.stringify({messages: ['No username, token or password given']}));
+			return;
+		}
+
+		const success: boolean = await UserService.finalizePasswordReset(username, token, newPassword);
+
+		if (!success) {
+			// Error logging in, probably wrong username / password
+			res.status(401).send(JSON.stringify({messages: ['Error']}));
+			return;
+		}
+
+		res.status(200).send(JSON.stringify({messages: ['Success']}));
+	} catch (e: any) {
+		let errorGuid = Guid.create().toString();
+		logger.error('Error handling a request: ' + e.message, {reference: errorGuid});
+		res.status(500).send({
+			'status': 'PROCESSING_ERROR',
+			'message': 'Internal Server Error. Try again later.',
+			'reference': errorGuid
+		});
+	}
+});

src/models/calendar/users/users.service.ts

@@ -0,0 +1,296 @@
+import * as dotenv from 'dotenv';
+import bcrypt from 'bcrypt';
+import {Guid} from 'guid-typescript';
+import {User} from './user.interface.js';
+import {Session} from './session.interface.js';
+import {NachklangCalendarDB} from '../Calendar.db.js';
+import {MailService} from '../../../common/common.mail.js';
+
+dotenv.config();
+
+/**
+ * Data Model Interfaces
+ */
+
+
+/**
+ * Service Methods
+ */
+
+/**
+ * Creates a user record in the database, also creates a session. Returns the session if successful.
+ */
+export const createUser = async (email: string, password: string, fullName: string, ip: string): Promise<Session> => {
+	let conn = await NachklangCalendarDB.getConnection();
+	try {
+		await conn.beginTransaction();
+
+		// Hash password and generate + hash session key
+		const pwHash = bcrypt.hashSync(password, 10);
+		const sessionKey = Guid.create().toString();
+		const sessionKeyHash = bcrypt.hashSync(sessionKey, 10);
+
+		const activationToken = Guid.create().toString();
+		const activationTokenHash = bcrypt.hashSync(activationToken, 10);
+
+		// Create user entry in SQL
+		const userQuery = 'INSERT INTO users (email, password_hash, full_name, activation_token) VALUES (?, ?, ?, ?) RETURNING user_id';
+		const userIdRes = await conn.query(userQuery, [email, pwHash, fullName, activationTokenHash]);
+
+		// Get user id of the created user
+		let userId: number = -1;
+		for (const row of userIdRes) {
+			userId = row.user_id;
+		}
+
+		// Create session
+		const sessionQuery = 'INSERT INTO sessions (user_id, session_key_hash, created_date, valid_until, last_ip) VALUES (?,?,NOW(),DATE_ADD(NOW(), INTERVAL 30 DAY),?) RETURNING session_id';
+		const sessionIdRes = await conn.query(sessionQuery, [userId, sessionKeyHash, ip]);
+		await conn.commit();
+
+		// Get session id of the created session
+		let sessionId: number = -1;
+		for (const row of sessionIdRes) {
+			sessionId = row.session_id;
+		}
+
+		// Send email with activation link (after commit so we don't block on email
+		// delivery). sendMail never throws on a delivery failure - it logs and
+		// returns false - so a mail-server problem here can't roll back the
+		// already-committed user and leave registration reporting a false error.
+		await MailService.sendMail(email, 'Activate your Nachklang account', `Hi ${fullName},\n\nPlease click on the following link to activate your account:\n\nhttps://api.nachklang.art/calendar/users/activate?id=${userId}&token=${activationToken}`);
+
+		return {
+			sessionId: sessionId,
+			userId: userId,
+			sessionKey: sessionKey,
+			sessionKeyHash: 'HIDDEN',
+			lastIP: ip
+		};
+	} catch (err) {
+		await conn.rollback();
+		throw err;
+	} finally {
+		await conn.end();
+	}
+};
+
+export const activateUser = async (userId: number, token: string): Promise<boolean> => {
+	let conn = await NachklangCalendarDB.getConnection();
+	try {
+		await conn.beginTransaction();
+
+		const checkTokenQuery = 'SELECT user_id, activation_token FROM users WHERE user_id = ? AND is_active = 0';
+		const userNameRes = await conn.query(checkTokenQuery, [userId]);
+		let storedTokenHash = '';
+		for (const row of userNameRes) {
+            storedTokenHash = row.activation_token;
+        }
+		if (!storedTokenHash || !bcrypt.compareSync(token, storedTokenHash)) {
+            return false;
+        }
+		const activateQuery = 'UPDATE users SET is_active = 1, activation_token = null WHERE user_id = ?';
+		const activateRes = await conn.execute(activateQuery, [userId]);
+		await conn.commit();
+		return activateRes.affectedRows !== 0;
+	} catch (err) {
+		await conn.rollback();
+		throw err;
+	} finally {
+		await conn.end();
+	}
+}
+
+/**
+ * Checks if the given credentials are valid and creates a new session if they are.
+ * Returns the session information in case of a successful login
+ */
+export const login = async (email: string, password: string, ip: string): Promise<Session | null> => {
+	let conn = await NachklangCalendarDB.getConnection();
+	try {
+		await conn.beginTransaction();
+
+		// Get saved password hash
+		const query = 'SELECT user_id, password_hash FROM users WHERE email = ?';
+		const userRows = await conn.query(query, email);
+		let savedHash = '';
+		let userId = -1;
+		for (const row of userRows) {
+			savedHash = row.password_hash;
+			userId = row.user_id;
+		}
+
+		// Check for correct password
+		if (!bcrypt.compareSync(password, savedHash)) {
+			return null;
+		}
+
+		// Generate + hash session key
+		const sessionKey = Guid.create().toString();
+		const sessionKeyHash = bcrypt.hashSync(sessionKey, 10);
+
+		// Create session
+		const sessionQuery = 'INSERT INTO sessions (user_id, session_key_hash, created_date, valid_until, last_ip) VALUES (?,?,NOW(),DATE_ADD(NOW(), INTERVAL 30 DAY),?) RETURNING session_id';
+		const sessionIdRes = await conn.query(sessionQuery, [userId, sessionKeyHash, ip]);
+		await conn.commit();
+
+		// Get session id of the created session
+		let sessionId: number = -1;
+		for (const row of sessionIdRes) {
+			sessionId = row.session_id;
+		}
+
+		return {
+			sessionId: sessionId,
+			userId: userId,
+			sessionKey: sessionKey,
+			sessionKeyHash: 'HIDDEN',
+			lastIP: ip
+		};
+	} catch (err) {
+		await conn.rollback();
+		throw err;
+	} finally {
+		await conn.end();
+	}
+};
+
+/**
+ * Checks if the given session information are valid and returns the user information if they are
+ */
+export const checkSession = async (sessionId: string, sessionKey: string, ip: string): Promise<User | null> => {
+	let conn = await NachklangCalendarDB.getConnection();
+	try {
+		await conn.beginTransaction();
+
+		// Get saved session key hash
+		const query = 'SELECT user_id, session_key_hash, valid_until FROM sessions WHERE session_id = ?';
+		const sessionRows = await conn.query(query, sessionId);
+		let savedHash = '';
+		let userId = -1;
+		let validUntil = new Date();
+		for (const row of sessionRows) {
+			savedHash = row.session_key_hash;
+			userId = row.user_id;
+			validUntil = row.valid_until;
+		}
+
+		// Check for correct key
+		if (!bcrypt.compareSync(sessionKey, savedHash)) {
+			return null;
+		}
+
+		// Check if the session is still valid
+		if (validUntil <= new Date()) {
+			return null;
+		}
+
+		// Update session entry in SQL
+		const updateSessionsQuery = 'UPDATE sessions SET last_IP = ? WHERE session_id = ?';
+		await conn.query(updateSessionsQuery, [ip, sessionId]);
+		await conn.commit();
+
+		// Get the other required user information
+		const userQuery = 'SELECT user_id, email, full_name, is_active FROM users WHERE user_id = ?';
+		const userRows = await conn.query(userQuery, userId);
+		let email = '';
+		let fullName = '';
+		let is_active = false;
+		for (const row of userRows) {
+			email = row.email;
+			fullName = row.full_name;
+			is_active = row.is_active;
+		}
+
+		// Everything is fine, return user information
+		return {
+			userId: userId,
+			email: email,
+			passwordHash: 'HIDDEN',
+			fullName: fullName,
+			isActive: is_active
+		};
+	} catch (err) {
+		await conn.rollback();
+		throw err;
+	} finally {
+		await conn.end();
+	}
+};
+
+export const initiatePasswordReset = async (email: string): Promise<boolean> => {
+	let conn = await NachklangCalendarDB.getConnection();
+	try {
+		await conn.beginTransaction();
+
+		const checkUsernameQuery = 'SELECT user_id, full_Name FROM users WHERE email = ?';
+		const userNameRes = await conn.query(checkUsernameQuery, [email]);
+		if (userNameRes.length === 0) {
+			return false;
+		}
+		let userId: number = -1;
+		let fullName: string = '';
+		for(let row of userNameRes) {
+			userId = row.user_id;
+			fullName = row.full_Name;
+		}
+
+		let resetToken = Guid.create().toString();
+		let resetTokenHash = bcrypt.hashSync(resetToken, 10);
+
+		const updateQuery = 'UPDATE users SET pw_reset_token_hash = ? WHERE user_id = ?';
+		const updateRes = await conn.execute(updateQuery, [resetTokenHash, userId]);
+
+		if(updateRes.affectedRows === 0) {
+			return false;
+		}
+		await conn.commit();
+
+		await MailService.sendMail(email, 'Password Reset', `Hello ${fullName},\n\nYou requested a password reset for your BonkApp account. If you did not request this, please ignore this email.\n\nTo reset your password, please use the following reset token:\n\n${resetToken}`);
+		return true;
+	} catch (err) {
+		await conn.rollback();
+		throw err;
+	} finally {
+		await conn.end();
+	}
+}
+
+export const finalizePasswordReset = async (email: string, token: string, newPassword: string): Promise<boolean> => {
+	let conn = await NachklangCalendarDB.getConnection();
+	try {
+		await conn.beginTransaction();
+
+		const checkTokenQuery = 'SELECT user_id, pw_reset_token_hash FROM users WHERE email = ?';
+		const userNameRes = await conn.query(checkTokenQuery, [email]);
+		if (userNameRes.length === 0) {
+			return false;
+		}
+		let userId: string = '';
+		let tokenHash: string = '';
+		for(let row of userNameRes) {
+			userId = row.user_id;
+			tokenHash = row.pw_reset_token_hash;
+		}
+
+		if(!bcrypt.compareSync(token, tokenHash)) {
+			return false;
+		}
+
+		const pwHash = bcrypt.hashSync(newPassword, 10);
+		const updatePasswordQuery = 'UPDATE users SET password_hash = ?, pw_reset_token_hash = NULL WHERE user_id = ?';
+		const updateRes = await conn.execute(updatePasswordQuery, [pwHash, userId]);
+
+		if(updateRes.affectedRows > 0) {
+			await conn.commit();
+			return true;
+		}
+
+		return false;
+	} catch (err) {
+		await conn.rollback();
+		throw err;
+	} finally {
+		await conn.end();
+	}
+}

src/models/feedback/admin/admin.interface.ts

@@ -1,6 +1,19 @@
 /**
  * @swagger
  * components:
+ *   parameters:
+ *     SessionIdHeader:
+ *       in: header
+ *       name: X-Session-Id
+ *       required: true
+ *       schema:
+ *         type: string
+ *     SessionKeyHeader:
+ *       in: header
+ *       name: X-Session-Key
+ *       required: true
+ *       schema:
+ *         type: string
  *   schemas:
  *     EventAdminSummary:
  *       type: object

src/models/feedback/admin/admin.router.ts

@@ -26,8 +26,9 @@ adminRouter.use(requireAdminAuth);
  *          summary: Validate the current admin session
  *          description: Used by the Next.js middleware/proxy to gate /admin. Returns the authenticated admin's identity.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
+ *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *          responses:
  *              200:
  *                  description: Success
@@ -42,8 +43,6 @@ adminRouter.use(requireAdminAuth);
  *                                      type: string
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 adminRouter.get('/me', (req: Request, res: Response) => {
 	res.status(200).send({email: res.locals.admin.email, fullName: res.locals.admin.displayName});
@@ -56,9 +55,9 @@ adminRouter.get('/me', (req: Request, res: Response) => {
  *          summary: Delete a single submission
  *          description: Removes the submission and everything under it (its answers, guest book entry, newsletter signup) - for removing an individual abusive or inappropriate entry. Not a bulk moderation tool.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: submissionId
  *                required: true
@@ -71,8 +70,6 @@ adminRouter.get('/me', (req: Request, res: Response) => {
  *                  description: Unknown submission
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 adminRouter.delete('/submissions/:submissionId', async (req: Request, res: Response) => {
 	try {

src/models/feedback/admin/events.admin.router.ts

@@ -18,8 +18,9 @@ export const eventsAdminRouter = express.Router();
  *          summary: List all events (admin)
  *          description: All events, published or not, past or future, with submission counts.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
+ *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *          responses:
  *              200:
  *                  description: Success
@@ -31,14 +32,13 @@ export const eventsAdminRouter = express.Router();
  *                                  $ref: '#/components/schemas/EventAdminSummary'
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  *      post:
  *          summary: Create an event
  *          description: Auto-generates the slug from the name and event year; defaults feedback_deadline to event_date + 14 days 23:59:59 unless supplied.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
+ *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *          requestBody:
  *              required: true
  *              content:
@@ -68,8 +68,6 @@ export const eventsAdminRouter = express.Router();
  *                  description: Missing required fields
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/', async (req: Request, res: Response) => {
 	try {
@@ -103,9 +101,9 @@ eventsAdminRouter.post('/', async (req: Request, res: Response) => {
  *          summary: Get one event (admin)
  *          description: Full event detail including setlist and assigned questions.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -122,14 +120,12 @@ eventsAdminRouter.post('/', async (req: Request, res: Response) => {
  *                  description: Unknown event
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  *      put:
  *          summary: Update an event
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -142,15 +138,13 @@ eventsAdminRouter.post('/', async (req: Request, res: Response) => {
  *                  description: Unknown event
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  *      delete:
  *          summary: Delete an event
  *          description: Refuses with 409 if submissions exist unless ?force=true is passed.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -169,8 +163,6 @@ eventsAdminRouter.post('/', async (req: Request, res: Response) => {
  *                  description: Submissions exist and force was not set
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/:eventId', async (req: Request, res: Response) => {
 	try {
@@ -222,9 +214,9 @@ eventsAdminRouter.delete('/:eventId', async (req: Request, res: Response) => {
  *      get:
  *          summary: Get an event's setlist
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -235,14 +227,12 @@ eventsAdminRouter.delete('/:eventId', async (req: Request, res: Response) => {
  *                  description: Success
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  *      post:
  *          summary: Add a song to an event's setlist
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -267,8 +257,6 @@ eventsAdminRouter.delete('/:eventId', async (req: Request, res: Response) => {
  *                  description: Missing title
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/:eventId/songs', async (req: Request, res: Response) => {
 	try {
@@ -304,9 +292,9 @@ eventsAdminRouter.post('/:eventId/songs', async (req: Request, res: Response) =>
  *          summary: Bulk reorder an event's setlist
  *          description: Rewrites song positions as a dense 0..n-1 sequence in one transaction.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -329,8 +317,6 @@ eventsAdminRouter.post('/:eventId/songs', async (req: Request, res: Response) =>
  *                  description: Reordered
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.put('/:eventId/songs/order', async (req: Request, res: Response) => {
 	try {
@@ -348,9 +334,9 @@ eventsAdminRouter.put('/:eventId/songs/order', async (req: Request, res: Respons
  *      get:
  *          summary: Get an event's assigned questions
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -361,15 +347,13 @@ eventsAdminRouter.put('/:eventId/songs/order', async (req: Request, res: Respons
  *                  description: Success
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  *      put:
  *          summary: Bulk-set an event's assigned questions
  *          description: One transaction - inserts new, updates existing, deletes removed. Keeps the admin UI a simple save-the-whole-list form.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -399,8 +383,6 @@ eventsAdminRouter.put('/:eventId/songs/order', async (req: Request, res: Respons
  *                  description: Saved
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/:eventId/questions', async (req: Request, res: Response) => {
 	try {

src/models/feedback/admin/questions.admin.router.ts

@@ -16,9 +16,9 @@ export const questionsAdminRouter = express.Router();
  *      get:
  *          summary: List the question library
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: query
  *                name: includeArchived
  *                schema:
@@ -34,13 +34,12 @@ export const questionsAdminRouter = express.Router();
  *                                  $ref: '#/components/schemas/AdminQuestion'
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  *      post:
  *          summary: Create a question
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
+ *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *          requestBody:
  *              required: true
  *              content:
@@ -62,8 +61,6 @@ export const questionsAdminRouter = express.Router();
  *                  description: Missing or invalid fields
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 questionsAdminRouter.get('/', async (req: Request, res: Response) => {
 	try {
@@ -97,9 +94,9 @@ questionsAdminRouter.post('/', async (req: Request, res: Response) => {
  *          summary: Edit a question's label/help text
  *          description: question_type is immutable after creation - the admin UI offers "archive and create new" instead.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: questionId
  *                required: true
@@ -126,15 +123,13 @@ questionsAdminRouter.post('/', async (req: Request, res: Response) => {
  *                  description: Unknown question
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  *      delete:
  *          summary: Archive (or hard-delete) a question
  *          description: Archives the question if it has ever been used; hard-deletes it if it has never been assigned to any event.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: questionId
  *                required: true
@@ -147,8 +142,6 @@ questionsAdminRouter.post('/', async (req: Request, res: Response) => {
  *                  description: Unknown question
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 questionsAdminRouter.put('/:questionId', async (req: Request, res: Response) => {
 	try {

src/models/feedback/admin/reports.admin.router.ts

@@ -19,9 +19,9 @@ export const reportsAdminRouter = express.Router();
  *          summary: Aggregated feedback report for one event
  *          description: Song-pick vote counts, song-rating averages, capped free-text list, guest book count, and newsletter sync counts.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -34,8 +34,6 @@ export const reportsAdminRouter = express.Router();
  *                  description: Unknown event
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 reportsAdminRouter.get('/:eventId/report', async (req: Request, res: Response) => {
 	try {
@@ -57,9 +55,9 @@ reportsAdminRouter.get('/:eventId/report', async (req: Request, res: Response) =
  *          summary: Guest Book entries for one event
  *          description: Newest first, paginated.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -83,8 +81,6 @@ reportsAdminRouter.get('/:eventId/report', async (req: Request, res: Response) =
  *                  description: Success
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 reportsAdminRouter.get('/:eventId/guestbook', async (req: Request, res: Response) => {
 	try {
@@ -105,9 +101,9 @@ reportsAdminRouter.get('/:eventId/guestbook', async (req: Request, res: Response
  *          summary: Newsletter signups for one event
  *          description: Includes sync_status, so failures can be handled manually. Newest first, paginated.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -131,8 +127,6 @@ reportsAdminRouter.get('/:eventId/guestbook', async (req: Request, res: Response
  *                  description: Success
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 reportsAdminRouter.get('/:eventId/newsletter', async (req: Request, res: Response) => {
 	try {
@@ -153,9 +147,9 @@ reportsAdminRouter.get('/:eventId/newsletter', async (req: Request, res: Respons
  *          summary: CSV export of all answers for one event
  *          description: Long format, one row per answer. UTF-8 BOM, `;` separator, RFC 4180 escaping, formula-injection guard.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -168,8 +162,6 @@ reportsAdminRouter.get('/:eventId/newsletter', async (req: Request, res: Respons
  *                      text/csv: {}
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 reportsAdminRouter.get('/:eventId/export/responses.csv', async (req: Request, res: Response) => {
 	try {
@@ -195,9 +187,9 @@ reportsAdminRouter.get('/:eventId/export/responses.csv', async (req: Request, re
  *      get:
  *          summary: CSV export of Guest Book entries for one event
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -210,8 +202,6 @@ reportsAdminRouter.get('/:eventId/export/responses.csv', async (req: Request, re
  *                      text/csv: {}
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 reportsAdminRouter.get('/:eventId/export/guestbook.csv', async (req: Request, res: Response) => {
 	try {

src/models/feedback/admin/songs.admin.router.ts

@@ -16,9 +16,9 @@ export const songsAdminRouter = express.Router();
  *      put:
  *          summary: Edit a song's title/composer
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: songId
  *                required: true
@@ -45,15 +45,13 @@ export const songsAdminRouter = express.Router();
  *                  description: Unknown song
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  *      delete:
  *          summary: Remove a song
  *          description: Past answers keep their song_title_snapshot even after the song is removed.
  *          tags: [feedback-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: songId
  *                required: true
@@ -66,8 +64,6 @@ export const songsAdminRouter = express.Router();
  *                  description: Unknown song
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 songsAdminRouter.put('/:songId', async (req: Request, res: Response) => {
 	try {

src/models/feedback/feedback.auth.ts

@@ -1,38 +1,78 @@
-import {requireAppAccess} from '../admin/admin.middleware.js';
+import express from 'express';
+import * as UserService from '../calendar/users/users.service.js';
+import {sendServerError} from './feedback.errors.js';
 
 /**
  * This file is the ONLY place in the feedback module that knows how admin
- * authentication works. No route handler and no service outside this file may
- * read session headers or resolve a user itself.
+ * authentication works today. No route handler and no service outside this
+ * file may import users.service, read session headers, or touch bcrypt.
  *
- * Today: the shared admin identity in `src/models/admin/`. A session cookie
- * set by /admin/auth on admin.nachklang.art, plus a `feedback` permission on
- * the account. Both are re-checked on every request, so disabling a user or
- * taking their feedback permission away takes effect immediately.
+ * Today: reuses the existing Calendar users/sessions mechanism. Any
+ * activated @nachklang.art account may administer feedback — no roles.
+ * Migrating to Keycloak later means writing a keycloakJwtAuthenticator
+ * below and changing the one `activeAuthenticator` binding (plus the
+ * frontend's login route handler) — nothing else in the feedback module
+ * needs to change.
  *
- * Before 2026-09-06 this was a header session against the calendar users
- * table, and any activated @nachklang.art account could administer feedback.
- * That is why the swap is a one-line binding: everything downstream only ever
- * saw `requireAdminAuth` and `res.locals.admin`, and both still mean what
- * they meant. What changed is that access is now granted per user rather than
- * implied by having an account.
- *
- * Explicitly forbidden: accepting session credentials from query parameters,
- * even "temporarily". That is the exact mistake documented in
- * DEFERRED_SECURITY.md item 1 for the Calendar domain, where credentials end
- * up in access logs, browser history, proxy logs, and Referer headers.
+ * Explicitly forbidden: accepting sessionId/sessionKey from query
+ * parameters, even "temporarily". That is the exact mistake documented in
+ * DEFERRED_SECURITY.md item 1 for the Calendar domain, where credentials
+ * end up in access logs, browser history, proxy logs, and Referer headers.
+ * Headers only.
  */
 
-// The only thing the rest of the feedback module knows about an admin. The
-// shared middleware puts a superset of this on res.locals.admin.
+// The only thing the rest of the feedback module knows about an admin.
 export interface AdminIdentity {
 	id: string;
 	email: string;
 	displayName: string;
 }
 
+// Pluggable strategy: extract + verify credentials from a request.
+// Returns the identity, or null if unauthenticated. Throws only on
+// infrastructure errors (e.g. the DB being unreachable).
+export type AdminAuthenticator = (req: express.Request) => Promise<AdminIdentity | null>;
+
+// Current implementation: reads X-Session-Id / X-Session-Key headers,
+// delegates to the existing calendar UserService.checkSession(...).
+export const sessionHeaderAuthenticator: AdminAuthenticator = async (req) => {
+	const sessionId = req.header('X-Session-Id');
+	const sessionKey = req.header('X-Session-Key');
+	if (!sessionId || !sessionKey) {
+		return null;
+	}
+
+	const ip = req.ip || '';
+	const user = await UserService.checkSession(sessionId, sessionKey, ip);
+
+	// Mirrors the Calendar domain's own convention: a valid session on an
+	// inactive (not yet activated) account is not sufficient.
+	if (!user || !user.isActive) {
+		return null;
+	}
+
+	return {
+		id: String(user.userId),
+		email: user.email,
+		displayName: user.fullName
+	};
+};
+
+// Swap point: change this one binding to migrate to Keycloak.
+export const activeAuthenticator: AdminAuthenticator = sessionHeaderAuthenticator;
+
 // Express middleware used by every admin route. On success:
-// res.locals.admin = AdminAccess (an AdminIdentity plus permissions), calls
-// next(). On failure: 401 when not signed in, 403 when signed in without the
-// feedback permission.
-export const requireAdminAuth = requireAppAccess('feedback');
+// res.locals.admin = AdminIdentity, calls next(). On failure: 401.
+export const requireAdminAuth: express.RequestHandler = async (req, res, next) => {
+	try {
+		const identity = await activeAuthenticator(req);
+		if (!identity) {
+			res.status(401).send({status: 'UNAUTHORIZED', message: 'Anmeldung erforderlich.'});
+			return;
+		}
+		res.locals.admin = identity;
+		next();
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+};

src/models/tickets/admin/admin.router.ts

@@ -16,15 +16,14 @@ adminRouter.use(requireAdminAuth);
  *      get:
  *          summary: Validate the current admin session
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
+ *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *          responses:
  *              200:
  *                  description: Success
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 adminRouter.get('/me', (req: Request, res: Response) => {
 	res.status(200).send({email: res.locals.admin.email, fullName: res.locals.admin.displayName});

src/models/tickets/admin/events.admin.router.ts

@@ -11,15 +11,14 @@ export const eventsAdminRouter = express.Router();
  *          summary: List concerts for the admin event picker
  *          description: Wraps the Calendar module's public-calendar admin listing (includes DRAFT events).
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
+ *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *          responses:
  *              200:
  *                  description: Success
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/', async (req: Request, res: Response) => {
 	try {
@@ -36,15 +35,14 @@ eventsAdminRouter.get('/', async (req: Request, res: Response) => {
  *          summary: List public-calendar events not yet added to the ticket shop
  *          description: Source list for the "add a concert" picker - the public calendar holds more than concerts, so events only appear in the ticket shop once explicitly added.
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
+ *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *          responses:
  *              200:
  *                  description: Success
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/available', async (req: Request, res: Response) => {
 	try {
@@ -60,9 +58,9 @@ eventsAdminRouter.get('/available', async (req: Request, res: Response) => {
  *      get:
  *          summary: Get a concert's voucher/capacity stats
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -77,8 +75,6 @@ eventsAdminRouter.get('/available', async (req: Request, res: Response) => {
  *                              $ref: '#/components/schemas/EventStats'
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.get('/:eventId/stats', async (req: Request, res: Response) => {
 	try {
@@ -93,11 +89,11 @@ eventsAdminRouter.get('/:eventId/stats', async (req: Request, res: Response) =>
  * /tickets/admin/events/{eventId}/settings:
  *      put:
  *          summary: Set a concert's voucher settings
- *          description: Upserts capacity (null = uncapped), redemption deadline (null = none), whether to collect a mailing address, and whether tickets are mailed to guests.
+ *          description: Upserts capacity (null = uncapped), redemption deadline (null = none), and whether to collect a mailing address.
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -122,20 +118,15 @@ eventsAdminRouter.get('/:eventId/stats', async (req: Request, res: Response) =>
  *                              requireAddress:
  *                                  type: boolean
  *                                  description: Only meaningful when collectAddress is true.
- *                              ticketsMailed:
- *                                  type: boolean
- *                                  description: When false, the redemption confirmation email tells the guest their tickets await pickup at the Abendkasse instead.
  *          responses:
  *              200:
  *                  description: Saved
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.put('/:eventId/settings', async (req: Request, res: Response) => {
 	try {
-		const {capacity, redemptionDeadline, collectAddress, requireAddress, ticketsMailed} = req.body || {};
+		const {capacity, redemptionDeadline, collectAddress, requireAddress} = req.body || {};
 		await EventsAdminService.setEventSettings(Number(req.params.eventId), {
 			capacity: capacity ?? null,
 			// The mariadb driver needs an actual Date to serialize a DATETIME
@@ -143,8 +134,7 @@ eventsAdminRouter.put('/:eventId/settings', async (req: Request, res: Response)
 			// rejected with "Incorrect datetime value".
 			redemptionDeadline: redemptionDeadline ? new Date(redemptionDeadline) : null,
 			collectAddress: !!collectAddress,
-			requireAddress: !!collectAddress && !!requireAddress,
-			ticketsMailed: !!ticketsMailed
+			requireAddress: !!collectAddress && !!requireAddress
 		});
 		res.status(200).send({status: 'OK'});
 	} catch (e: any) {
@@ -159,9 +149,9 @@ eventsAdminRouter.put('/:eventId/settings', async (req: Request, res: Response)
  *          summary: Remove an event from the ticket shop
  *          description: Deletes its settings row, so it drops out of the picker and reappears in the "add" list. Refused with 409 if vouchers already reference the event - existing vouchers/redemptions stay valid either way.
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: eventId
  *                required: true
@@ -174,8 +164,6 @@ eventsAdminRouter.put('/:eventId/settings', async (req: Request, res: Response)
  *                  description: Vouchers already reference this event
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 eventsAdminRouter.delete('/:eventId/settings', async (req: Request, res: Response) => {
 	try {

src/models/tickets/admin/events.admin.service.ts

@@ -14,7 +14,6 @@ export interface EventPickerEntry {
 	startDateTime: Date;
 	location: string;
 	status: string | undefined;
-	redemptionDeadline: Date | null;
 }
 
 /**
@@ -27,26 +26,19 @@ export interface EventPickerEntry {
  */
 export const listEventsForPicker = async (): Promise<EventPickerEntry[]> => {
 	let conn = await NachklangTicketsDB.getConnection();
-	let deadlineByEventId: Map<number, Date | null>;
+	let enabledEventIds: number[];
 	try {
-		const rows = await conn.query('SELECT event_id, redemption_deadline FROM event_ticket_settings');
-		deadlineByEventId = new Map(rows.map((r: any) => [r.event_id, r.redemption_deadline]));
+		const rows = await conn.query('SELECT event_id FROM event_ticket_settings');
+		enabledEventIds = rows.map((r: any) => r.event_id);
 	} finally {
 		await conn.end();
 	}
-	if (deadlineByEventId.size === 0) return [];
+	if (enabledEventIds.length === 0) return [];
 
-	const events = await Promise.all([...deadlineByEventId.keys()].map(id => CalendarEventsService.getEventById(id)));
+	const events = await Promise.all(enabledEventIds.map(id => CalendarEventsService.getEventById(id)));
 	return events
 		.filter((e): e is NonNullable<typeof e> => e !== null && e.status !== 'DELETED')
-		.map(e => ({
-			eventId: e.eventId,
-			name: e.name,
-			startDateTime: e.startDateTime,
-			location: e.location,
-			status: e.status,
-			redemptionDeadline: deadlineByEventId.get(e.eventId) ?? null
-		}))
+		.map(e => ({eventId: e.eventId, name: e.name, startDateTime: e.startDateTime, location: e.location, status: e.status}))
 		.sort((a, b) => a.startDateTime.getTime() - b.startDateTime.getTime());
 };
 
@@ -67,9 +59,7 @@ export const listAvailableEventsToAdd = async (): Promise<EventPickerEntry[]> =>
 	const events = await CalendarEventsService.getAllEventsAdmin(PUBLIC_CALENDAR_ID);
 	return events
 		.filter(e => e.status !== 'DELETED' && !enabledEventIds.has(e.eventId))
-		// Not yet added to the ticket shop, so there's no event_ticket_settings
-		// row and therefore no deadline to report.
-		.map(e => ({eventId: e.eventId, name: e.name, startDateTime: e.startDateTime, location: e.location, status: e.status, redemptionDeadline: null}))
+		.map(e => ({eventId: e.eventId, name: e.name, startDateTime: e.startDateTime, location: e.location, status: e.status}))
 		.sort((a, b) => a.startDateTime.getTime() - b.startDateTime.getTime());
 };
 
@@ -99,7 +89,6 @@ export const getEventStats = async (eventId: number): Promise<EventStats> => {
 			redemptionDeadline: ticketState.redemptionDeadline,
 			collectAddress: ticketState.collectAddress,
 			requireAddress: ticketState.requireAddress,
-			ticketsMailed: ticketState.ticketsMailed,
 			guestsUsed: ticketState.guestsUsed,
 			spotsRemaining: ticketState.spotsRemaining,
 			unusedCodes,
@@ -120,10 +109,10 @@ export const setEventSettings = async (eventId: number, settings: Omit<EventTick
 	try {
 		await conn.beginTransaction();
 		await conn.query(
-			`INSERT INTO event_ticket_settings (event_id, capacity, redemption_deadline, collect_address, require_address, tickets_mailed)
-			 VALUES (?,?,?,?,?,?)
-			 ON DUPLICATE KEY UPDATE capacity = VALUES(capacity), redemption_deadline = VALUES(redemption_deadline), collect_address = VALUES(collect_address), require_address = VALUES(require_address), tickets_mailed = VALUES(tickets_mailed)`,
-			[eventId, settings.capacity, settings.redemptionDeadline, settings.collectAddress ? 1 : 0, settings.requireAddress ? 1 : 0, settings.ticketsMailed ? 1 : 0]
+			`INSERT INTO event_ticket_settings (event_id, capacity, redemption_deadline, collect_address, require_address)
+			 VALUES (?,?,?,?,?)
+			 ON DUPLICATE KEY UPDATE capacity = VALUES(capacity), redemption_deadline = VALUES(redemption_deadline), collect_address = VALUES(collect_address), require_address = VALUES(require_address)`,
+			[eventId, settings.capacity, settings.redemptionDeadline, settings.collectAddress ? 1 : 0, settings.requireAddress ? 1 : 0]
 		);
 		await conn.commit();
 	} catch (err) {

src/models/tickets/admin/redemptions.admin.router.ts

@@ -11,9 +11,9 @@ export const redemptionsAdminRouter = express.Router();
  *          summary: List redemptions (admin)
  *          description: Filterable by event and status (ACTIVE/UNDONE).
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: query
  *                name: eventId
  *                schema:
@@ -33,8 +33,6 @@ export const redemptionsAdminRouter = express.Router();
  *                                  $ref: '#/components/schemas/RedemptionSummary'
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 redemptionsAdminRouter.get('/', async (req: Request, res: Response) => {
 	try {
@@ -52,9 +50,9 @@ redemptionsAdminRouter.get('/', async (req: Request, res: Response) => {
  *      get:
  *          summary: Get a single redemption (admin)
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: redemptionId
  *                required: true
@@ -67,15 +65,13 @@ redemptionsAdminRouter.get('/', async (req: Request, res: Response) => {
  *                  description: Unknown redemption
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  *      patch:
  *          summary: Edit a redemption's contact info and/or guest list
  *          description: Only fields present in the body are changed. Growing the guest count is re-checked against the voucher's max guests and the event's remaining capacity. Logs to the audit trail with an optional admin-supplied reason.
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: redemptionId
  *                required: true
@@ -109,8 +105,6 @@ redemptionsAdminRouter.get('/', async (req: Request, res: Response) => {
  *                  description: Not active, exceeds max guests, or exceeds remaining capacity
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 redemptionsAdminRouter.get('/:redemptionId', async (req: Request, res: Response) => {
 	try {
@@ -167,9 +161,9 @@ redemptionsAdminRouter.patch('/:redemptionId', async (req: Request, res: Respons
  *          summary: Undo a redemption
  *          description: Reopens the code (back to UNUSED) and marks the redemption UNDONE. Guest data is kept for the audit trail; a later re-redemption creates a new redemption record.
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: redemptionId
  *                required: true
@@ -192,8 +186,6 @@ redemptionsAdminRouter.patch('/:redemptionId', async (req: Request, res: Respons
  *                  description: Redemption is not active
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 redemptionsAdminRouter.post('/:redemptionId/undo', async (req: Request, res: Response) => {
 	try {
@@ -219,9 +211,9 @@ redemptionsAdminRouter.post('/:redemptionId/undo', async (req: Request, res: Res
  *          summary: Resend the redemption confirmation email
  *          description: Rebuilds the confirmation email from the stored redemption data and sends it again, then records the outcome on the redemption. Intended for redemptions whose original confirmation email failed.
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: redemptionId
  *                required: true
@@ -238,8 +230,6 @@ redemptionsAdminRouter.post('/:redemptionId/undo', async (req: Request, res: Res
  *                  description: The email relay rejected the send
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 redemptionsAdminRouter.post('/:redemptionId/resend-confirmation', async (req: Request, res: Response) => {
 	try {
@@ -269,9 +259,9 @@ redemptionsAdminRouter.post('/:redemptionId/resend-confirmation', async (req: Re
  *      get:
  *          summary: Get a voucher's admin-action audit trail
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: code
  *                required: true
@@ -288,8 +278,6 @@ redemptionsAdminRouter.post('/:redemptionId/resend-confirmation', async (req: Re
  *                                  $ref: '#/components/schemas/AuditLogEntry'
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 export const voucherHistoryRouter = express.Router();
 voucherHistoryRouter.get('/:code/history', async (req: Request, res: Response) => {

src/models/tickets/admin/vouchers.admin.router.ts

@@ -11,9 +11,9 @@ export const vouchersAdminRouter = express.Router();
  *          summary: List vouchers (admin)
  *          description: Filterable by event and status.
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: query
  *                name: eventId
  *                schema:
@@ -33,8 +33,6 @@ export const vouchersAdminRouter = express.Router();
  *                                  $ref: '#/components/schemas/VoucherCode'
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 vouchersAdminRouter.get('/', async (req: Request, res: Response) => {
 	try {
@@ -53,8 +51,9 @@ vouchersAdminRouter.get('/', async (req: Request, res: Response) => {
  *          summary: Batch-generate wildcard codes
  *          description: Generates `quantity` codes sharing the same eligible events and max-guest count, grouped under one batchId.
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
+ *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *          requestBody:
  *              required: true
  *              content:
@@ -88,8 +87,6 @@ vouchersAdminRouter.get('/', async (req: Request, res: Response) => {
  *                  description: Invalid input
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 vouchersAdminRouter.post('/wildcard', async (req: Request, res: Response) => {
 	try {
@@ -115,8 +112,9 @@ vouchersAdminRouter.post('/wildcard', async (req: Request, res: Response) => {
  *          summary: Bulk-create personalized codes
  *          description: One code per row (name, email, eligible events, max guests), grouped under one batchId.
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
+ *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *          requestBody:
  *              required: true
  *              content:
@@ -149,8 +147,6 @@ vouchersAdminRouter.post('/wildcard', async (req: Request, res: Response) => {
  *                  description: Invalid input
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 vouchersAdminRouter.post('/personalized', async (req: Request, res: Response) => {
 	try {
@@ -173,9 +169,9 @@ vouchersAdminRouter.post('/personalized', async (req: Request, res: Response) =>
  *      get:
  *          summary: Get a single voucher (admin)
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: code
  *                required: true
@@ -188,8 +184,6 @@ vouchersAdminRouter.post('/personalized', async (req: Request, res: Response) =>
  *                  description: Unknown code
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 vouchersAdminRouter.get('/:code', async (req: Request, res: Response) => {
 	try {
@@ -211,9 +205,9 @@ vouchersAdminRouter.get('/:code', async (req: Request, res: Response) => {
  *          summary: Void an unredeemed code
  *          description: Only allowed while the code is UNUSED. Logs to the voucher's audit trail.
  *          tags: [tickets-admin]
- *          security:
- *              - AdminSessionCookie: []
  *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
  *              - in: path
  *                name: code
  *                required: true
@@ -236,8 +230,6 @@ vouchersAdminRouter.get('/:code', async (req: Request, res: Response) => {
  *                  description: Code is not in UNUSED status
  *              401:
  *                  description: Unauthorized
- *              403:
- *                  description: Signed in without the permission for this app, or account disabled
  */
 vouchersAdminRouter.post('/:code/void', async (req: Request, res: Response) => {
 	try {

src/models/tickets/public/voucher.public.service.ts

@@ -39,7 +39,6 @@ export const validateVoucher = async (code: string): Promise<VoucherValidation |
 				name: event.name,
 				startDateTime: event.startDateTime,
 				location: event.location,
-				redemptionDeadline: ticketState.redemptionDeadline,
 				deadlinePassed: ticketState.redemptionDeadline !== null && now > new Date(ticketState.redemptionDeadline),
 				isFull: ticketState.spotsRemaining !== null && ticketState.spotsRemaining <= 0,
 				spotsRemaining: ticketState.spotsRemaining,

src/models/tickets/tickets.auth.ts

@@ -1,23 +1,20 @@
-import {requireAppAccess} from '../admin/admin.middleware.js';
+import express from 'express';
+import * as UserService from '../calendar/users/users.service.js';
+import {sendServerError} from './tickets.errors.js';
 
 /**
  * Mirrors the Feedback module's feedback.auth.ts: this is the ONLY place in
  * the tickets module that knows how admin authentication works. No route
- * handler and no service outside this file may read session headers or
- * resolve a user itself.
+ * handler and no service outside this file may import users.service, read
+ * session headers, or touch bcrypt.
  *
- * Today: the shared admin identity in `src/models/admin/`. A session cookie
- * set by /admin/auth on admin.nachklang.art, plus a `tickets` permission on
- * the account. Both are re-checked on every request, so disabling a user or
- * taking their tickets permission away takes effect immediately.
+ * Today: reuses the existing Calendar users/sessions mechanism. Any
+ * activated @nachklang.art account may administer vouchers - no roles, same
+ * policy as Feedback (see docs/plan-ticket-shop.md). A dedicated
+ * roles/permissions model is explicitly out of scope for v1.
  *
- * Before 2026-09-06 this was a header session against the calendar users
- * table, and any activated @nachklang.art account could administer vouchers
- * (see docs/plan-ticket-shop.md, which called a roles model out of scope for
- * v1). It is in scope now, and lives in the admin module rather than here.
- *
- * Explicitly forbidden: accepting session credentials from query parameters -
- * see DEFERRED_SECURITY.md item 1.
+ * Explicitly forbidden: accepting sessionId/sessionKey from query
+ * parameters - headers only (see DEFERRED_SECURITY.md item 1).
  */
 
 export interface AdminIdentity {
@@ -26,6 +23,41 @@ export interface AdminIdentity {
 	displayName: string;
 }
 
-// On failure: 401 when not signed in, 403 when signed in without the tickets
-// permission.
-export const requireAdminAuth = requireAppAccess('tickets');
+export type AdminAuthenticator = (req: express.Request) => Promise<AdminIdentity | null>;
+
+export const sessionHeaderAuthenticator: AdminAuthenticator = async (req) => {
+	const sessionId = req.header('X-Session-Id');
+	const sessionKey = req.header('X-Session-Key');
+	if (!sessionId || !sessionKey) {
+		return null;
+	}
+
+	const ip = req.ip || '';
+	const user = await UserService.checkSession(sessionId, sessionKey, ip);
+
+	if (!user || !user.isActive) {
+		return null;
+	}
+
+	return {
+		id: String(user.userId),
+		email: user.email,
+		displayName: user.fullName
+	};
+};
+
+export const activeAuthenticator: AdminAuthenticator = sessionHeaderAuthenticator;
+
+export const requireAdminAuth: express.RequestHandler = async (req, res, next) => {
+	try {
+		const identity = await activeAuthenticator(req);
+		if (!identity) {
+			res.status(401).send({status: 'UNAUTHORIZED', message: 'Anmeldung erforderlich.'});
+			return;
+		}
+		res.locals.admin = identity;
+		next();
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+};

src/models/tickets/tickets.capacity.ts

@@ -4,7 +4,6 @@ export interface EventTicketState {
 	redemptionDeadline: Date | null;
 	collectAddress: boolean;
 	requireAddress: boolean;
-	ticketsMailed: boolean;
 	guestsUsed: number;
 	spotsRemaining: number | null;
 }
@@ -22,7 +21,7 @@ export interface EventTicketState {
  * (uncapped) don't need this - there's no cap to race against.
  */
 export const getEventTicketState = async (conn: any, eventId: number, forUpdate = false): Promise<EventTicketState> => {
-	const settingsQuery = `SELECT capacity, redemption_deadline, collect_address, require_address, tickets_mailed FROM event_ticket_settings WHERE event_id = ?${forUpdate ? ' FOR UPDATE' : ''}`;
+	const settingsQuery = `SELECT capacity, redemption_deadline, collect_address, require_address FROM event_ticket_settings WHERE event_id = ?${forUpdate ? ' FOR UPDATE' : ''}`;
 	const settingsRows = await conn.query(settingsQuery, [eventId]);
 	const capacity = settingsRows.length > 0 ? settingsRows[0].capacity : null;
 	const redemptionDeadline = settingsRows.length > 0 ? settingsRows[0].redemption_deadline : null;
@@ -30,7 +29,6 @@ export const getEventTicketState = async (conn: any, eventId: number, forUpdate
 	// Only meaningful when collectAddress is also true - the field isn't
 	// shown/collected at all otherwise, so "required" is moot.
 	const requireAddress = collectAddress && settingsRows.length > 0 ? !!settingsRows[0].require_address : false;
-	const ticketsMailed = settingsRows.length > 0 ? !!settingsRows[0].tickets_mailed : false;
 
 	const usedRows = await conn.query(
 		"SELECT COALESCE(SUM(guest_count), 0) as used FROM redemptions WHERE event_id = ? AND status = 'ACTIVE'",
@@ -39,5 +37,5 @@ export const getEventTicketState = async (conn: any, eventId: number, forUpdate
 	const guestsUsed = Number(usedRows[0].used);
 	const spotsRemaining = capacity === null ? null : Math.max(0, capacity - guestsUsed);
 
-	return {eventId, capacity, redemptionDeadline, collectAddress, requireAddress, ticketsMailed, guestsUsed, spotsRemaining};
+	return {eventId, capacity, redemptionDeadline, collectAddress, requireAddress, guestsUsed, spotsRemaining};
 };

src/models/tickets/tickets.confirmation-email.ts

@@ -24,23 +24,6 @@ export interface ConfirmationRecipient {
 	guestNames: string[];
 }
 
-/**
- * Whether an event's tickets are mailed to guests - read directly rather than
- * via getEventTicketState (tickets.capacity.ts) since that also computes a
- * live guest count this function doesn't need. Absent settings row (no
- * ticket-shop config yet) defaults to false, same "absence over sentinels"
- * convention as the rest of event_ticket_settings.
- */
-const ticketsAreMailed = async (eventId: number): Promise<boolean> => {
-	let conn = await NachklangTicketsDB.getConnection();
-	try {
-		const rows = await conn.query('SELECT tickets_mailed FROM event_ticket_settings WHERE event_id = ?', [eventId]);
-		return rows.length > 0 ? !!rows[0].tickets_mailed : false;
-	} finally {
-		await conn.end();
-	}
-};
-
 /**
  * Sends the redemption confirmation email for one redemption. Returns whether
  * the mail was accepted by the relay. Never throws: a missing event is treated
@@ -53,20 +36,14 @@ export const sendRedemptionConfirmation = async (recipient: ConfirmationRecipien
 		return false;
 	}
 
-	const ticketsMailed = await ticketsAreMailed(recipient.eventId);
-	const pickupNotice = ticketsMailed
-		? ''
-		: `\n\nDeine Tickets werden nicht postalisch versendet: Sie liegen am Konzertabend unter dem Namen ${recipient.contactName} für dich an der Abendkasse bereit.`;
-
 	const guestList = recipient.guestNames.map(name => `- ${name}`).join('\n');
 	const body =
 		`Hallo ${recipient.contactName},\n\n` +
 		`vielen Dank für deine Anmeldung zu "${event.name}"!\n\n` +
 		`Termin: ${formatGermanDateTime(event.startDateTime)}\n` +
 		`Ort: ${event.location}\n\n` +
-		`Angemeldete Gäste:\n${guestList}` +
-		pickupNotice +
-		`\n\nWir freuen uns auf dich!\n\nDein Nachklang-Team`;
+		`Angemeldete Gäste:\n${guestList}\n\n` +
+		`Wir freuen uns auf dich!\n\nDein Nachklang-Team`;
 
 	let icsAttachment;
 	try {

src/models/tickets/tickets.interface.ts

@@ -10,7 +10,7 @@
  *       enum: [ACTIVE, UNDONE]
  *     EligibleEvent:
  *       type: object
- *       required: [eventId, name, startDateTime, location, redemptionDeadline, deadlinePassed, isFull, collectAddress, requireAddress]
+ *       required: [eventId, name, startDateTime, location, deadlinePassed, isFull, collectAddress, requireAddress]
  *       properties:
  *         eventId:
  *           type: integer
@@ -23,11 +23,6 @@
  *           format: date-time
  *         location:
  *           type: string
- *         redemptionDeadline:
- *           type: string
- *           format: date-time
- *           nullable: true
- *           description: null when the event has no redemption deadline set
  *         deadlinePassed:
  *           type: boolean
  *         isFull:
@@ -149,7 +144,7 @@
  *             type: integer
  *     EventTicketSettings:
  *       type: object
- *       required: [eventId, collectAddress, requireAddress, ticketsMailed]
+ *       required: [eventId, collectAddress, requireAddress]
  *       properties:
  *         eventId:
  *           type: integer
@@ -165,12 +160,9 @@
  *         requireAddress:
  *           type: boolean
  *           description: Only meaningful when collectAddress is true.
- *         ticketsMailed:
- *           type: boolean
- *           description: When false, the redemption confirmation email tells the guest their tickets await pickup at the Abendkasse instead.
  *     EventStats:
  *       type: object
- *       required: [eventId, collectAddress, requireAddress, ticketsMailed, guestsUsed, unusedCodes, redeemedCodes, voidCodes]
+ *       required: [eventId, collectAddress, requireAddress, guestsUsed, unusedCodes, redeemedCodes, voidCodes]
  *       properties:
  *         eventId:
  *           type: integer
@@ -185,8 +177,6 @@
  *           type: boolean
  *         requireAddress:
  *           type: boolean
- *         ticketsMailed:
- *           type: boolean
  *         guestsUsed:
  *           type: integer
  *         spotsRemaining:
@@ -234,7 +224,6 @@ export interface EligibleEvent {
 	name: string;
 	startDateTime: Date;
 	location: string;
-	redemptionDeadline: Date | null;
 	deadlinePassed: boolean;
 	isFull: boolean;
 	spotsRemaining: number | null;
@@ -296,7 +285,6 @@ export interface EventTicketSettings {
 	redemptionDeadline: Date | null;
 	collectAddress: boolean;
 	requireAddress: boolean;
-	ticketsMailed: boolean;
 }
 
 export interface EventStats extends EventTicketSettings {

test/admin/admin.bootstrap.test.ts

@@ -79,12 +79,7 @@ describe('bootstrapAdmin', () => {
 
 		await bootstrapAdmin();
 
-		expect(createInvitation).toHaveBeenCalledWith(
-			'boss@nachklang.art',
-			'Nachklang Admin',
-			[{app: 'admin', role: 'access'}],
-			null
-		);
+		expect(createInvitation).toHaveBeenCalledWith('boss@nachklang.art', 'Nachklang Admin', ['admin'], null);
 		expect(mockMail).toHaveBeenCalled();
 	});
 

test/admin/admin.config.test.ts

@@ -1,144 +0,0 @@
-import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
-
-// admin.config calls dotenv.config(), which would read the repo's own .env and
-// quietly reintroduce NODE_ENV=development - the exact value several of these
-// cases exist to remove. Stub it so the tests see only what they set.
-vi.mock('dotenv', () => ({config: vi.fn()}));
-
-/**
- * admin.config reads the environment once at import, so every case here has to
- * reset the module registry and re-import it. The two things worth pinning are
- * the ones that are silent when wrong: which client-IP header is trusted, and
- * whether an unset NODE_ENV counts as production.
- */
-
-const ORIGINAL_ENV = {...process.env};
-
-const loadConfig = async () => {
-	vi.resetModules();
-	return import('../../src/models/admin/admin.config.js');
-};
-
-beforeEach(() => {
-	process.env = {...ORIGINAL_ENV};
-	// dotenv.config() in admin.config does not overwrite what is already set,
-	// so setting these here is enough to keep the local .env out of the test.
-	process.env.NODE_ENV = 'test';
-	delete process.env.CLIENT_IP_HEADERS;
-	delete process.env.TRUSTED_PROXY_IPS;
-});
-
-afterEach(() => {
-	process.env = {...ORIGINAL_ENV};
-});
-
-describe('CLIENT_IP_HEADERS', () => {
-	it('defaults to the single header Plesk nginx sets', async () => {
-		const config = await loadConfig();
-		expect(config.CLIENT_IP_HEADERS).toEqual(['x-real-ip']);
-		expect(config.TRUST_NO_CLIENT_IP_HEADER).toBe(false);
-	});
-
-	it('reads a comma-separated list', async () => {
-		process.env.CLIENT_IP_HEADERS = 'x-real-ip, cf-connecting-ip';
-		const config = await loadConfig();
-		expect(config.CLIENT_IP_HEADERS).toEqual(['x-real-ip', 'cf-connecting-ip']);
-	});
-
-	it('trusts nothing when set to "none"', async () => {
-		// The escape hatch. An empty list is what better-auth reads as "no
-		// headers" - it only falls back to its own default when the option is
-		// absent - so this really does stop any header being believed.
-		process.env.CLIENT_IP_HEADERS = 'none';
-		const config = await loadConfig();
-		expect(config.CLIENT_IP_HEADERS).toEqual([]);
-		expect(config.TRUST_NO_CLIENT_IP_HEADER).toBe(true);
-	});
-
-	it('accepts the hatch case-insensitively and with stray whitespace', async () => {
-		process.env.CLIENT_IP_HEADERS = '  NONE  ';
-		const config = await loadConfig();
-		expect(config.CLIENT_IP_HEADERS).toEqual([]);
-	});
-
-	it('treats an empty value as "use the default", not as the hatch', async () => {
-		// A blank line in a .env must not silently change how requests are
-		// bucketed - only the explicit word does that.
-		process.env.CLIENT_IP_HEADERS = '';
-		const config = await loadConfig();
-		expect(config.CLIENT_IP_HEADERS).toEqual(['x-real-ip']);
-		expect(config.TRUST_NO_CLIENT_IP_HEADER).toBe(false);
-	});
-
-	it('does not mistake a header actually named none-ish for the hatch', async () => {
-		process.env.CLIENT_IP_HEADERS = 'x-none';
-		const config = await loadConfig();
-		expect(config.CLIENT_IP_HEADERS).toEqual(['x-none']);
-		expect(config.TRUST_NO_CLIENT_IP_HEADER).toBe(false);
-	});
-});
-
-describe('APP_ORIGINS', () => {
-	beforeEach(() => {
-		delete process.env.APP_ORIGINS;
-	});
-
-	// These reach better-auth's trustedOrigins, and the step 4 cutover made the
-	// tickets and feedback origins load-bearing: without them their sign-out
-	// call is rejected while everything else still works.
-	it('defaults to the three production frontends', async () => {
-		const config = await loadConfig();
-		expect(config.APP_ORIGINS).toEqual([
-			'https://tickets.nachklang.art',
-			'https://feedback.nachklang.art',
-			'https://calendar.nachklang.art'
-		]);
-	});
-
-	it('is overridden wholesale by the environment, for a staging host', async () => {
-		process.env.APP_ORIGINS = 'https://tickets.staging.example, https://feedback.staging.example/';
-		const config = await loadConfig();
-		expect(config.APP_ORIGINS).toEqual([
-			'https://tickets.staging.example',
-			// Trailing slash stripped: an origin with one never matches.
-			'https://feedback.staging.example'
-		]);
-	});
-
-	it('always includes the admin app itself in ADMIN_ALLOWED_ORIGINS', async () => {
-		process.env.ADMIN_APP_URL = 'https://admin.nachklang.art';
-		const config = await loadConfig();
-		expect(config.ADMIN_ALLOWED_ORIGINS).toContain('https://admin.nachklang.art');
-		expect(config.ADMIN_ALLOWED_ORIGINS).toContain('https://tickets.nachklang.art');
-	});
-});
-
-describe('isProd', () => {
-	it('is false only for the explicit relaxed environments', async () => {
-		process.env.NODE_ENV = 'development';
-		expect((await loadConfig()).isProd).toBe(false);
-
-		process.env.NODE_ENV = 'test';
-		expect((await loadConfig()).isProd).toBe(false);
-	});
-
-	it('treats an unset NODE_ENV as production, which is what a bare vhost gives', async () => {
-		delete process.env.NODE_ENV;
-		// Strict mode refuses to boot without these; supply them so the import
-		// gets far enough to answer the question being asked.
-		process.env.BETTER_AUTH_SECRET = 'x'.repeat(48);
-		process.env.API_BASE_URL = 'https://api.nachklang.art';
-		process.env.ADMIN_APP_URL = 'https://admin.nachklang.art';
-
-		expect((await loadConfig()).isProd).toBe(true);
-	});
-
-	it('refuses to start without a signing key outside development', async () => {
-		delete process.env.NODE_ENV;
-		delete process.env.BETTER_AUTH_SECRET;
-		process.env.API_BASE_URL = 'https://api.nachklang.art';
-		process.env.ADMIN_APP_URL = 'https://admin.nachklang.art';
-
-		await expect(loadConfig()).rejects.toThrow(/BETTER_AUTH_SECRET/);
-	});
-});

test/admin/admin.middleware.test.ts

@@ -30,10 +30,6 @@ const activeUser = {
 	email: 'a@nachklang.art',
 	displayName: 'A',
 	disabled: false,
-	permissions: [
-		{app: 'feedback', role: 'access'},
-		{app: 'admin', role: 'access'}
-	],
 	apps: ['feedback', 'admin']
 };
 
@@ -64,10 +60,6 @@ describe('resolveAccess', () => {
 			email: 'a@nachklang.art',
 			displayName: 'A',
 			disabled: false,
-			permissions: [
-				{app: 'feedback', role: 'access'},
-				{app: 'admin', role: 'access'}
-			],
 			apps: ['feedback', 'admin']
 		});
 		// No cookieCache: exactly one lookup per request, never zero.
@@ -135,11 +127,7 @@ describe('requireAppAccess', () => {
 
 	it('403s a signed-in user without that app permission', async () => {
 		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
-		mockLoadAccess.mockResolvedValue({
-			...activeUser,
-			permissions: [{app: 'feedback', role: 'access'}],
-			apps: ['feedback']
-		});
+		mockLoadAccess.mockResolvedValue({...activeUser, apps: ['feedback']});
 		const res = makeRes();
 		const next = vi.fn();
 
@@ -183,40 +171,4 @@ describe('requireAppAccess', () => {
 		expect(res.status).toHaveBeenCalledWith(500);
 		expect(next).not.toHaveBeenCalled();
 	});
-
-	// The seam a finer per-app permission arrives through. Nothing passes a role
-	// today, so these two pin the behaviour before there is anything to break.
-	it('403s when a specific role is required and the user only holds another', async () => {
-		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
-		mockLoadAccess.mockResolvedValue({
-			...activeUser,
-			permissions: [{app: 'tickets', role: 'access'}],
-			apps: ['tickets']
-		});
-		const res = makeRes();
-		const next = vi.fn();
-
-		await requireAppAccess('tickets', 'refund')(makeReq(), res, next);
-
-		expect(res.status).toHaveBeenCalledWith(403);
-		expect(next).not.toHaveBeenCalled();
-	});
-
-	it('passes when the user holds exactly the required role', async () => {
-		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
-		mockLoadAccess.mockResolvedValue({
-			...activeUser,
-			permissions: [
-				{app: 'tickets', role: 'access'},
-				{app: 'tickets', role: 'refund'}
-			],
-			apps: ['tickets']
-		});
-		const res = makeRes();
-		const next = vi.fn();
-
-		await requireAppAccess('tickets', 'refund')(makeReq(), res, next);
-
-		expect(next).toHaveBeenCalled();
-	});
 });

test/admin/admin.schema.test.ts

@@ -1,99 +0,0 @@
-import {describe, expect, it} from 'vitest';
-import {
-	ACCESS_ROLE,
-	appsOf,
-	isAppPermission,
-	isAppRole,
-	toPermissions
-} from '../../src/models/admin/admin.schema.js';
-
-/**
- * The permission model is (app, role). These tests pin the two properties the
- * rest of the module leans on: that the older `['tickets']` shape still means
- * "tickets at the access role", and that nothing outside APP_ROLES gets in.
- */
-
-describe('toPermissions', () => {
-	it('reads the full (app, role) form', () => {
-		expect(toPermissions([{app: 'tickets', role: 'access'}])).toEqual([
-			{app: 'tickets', role: 'access'}
-		]);
-	});
-
-	it('reads a plain app list as that app at the access role', () => {
-		expect(toPermissions(['feedback', 'admin'])).toEqual([
-			{app: 'feedback', role: ACCESS_ROLE},
-			{app: 'admin', role: ACCESS_ROLE}
-		]);
-	});
-
-	it('accepts the two forms mixed, which is what a half-migrated caller sends', () => {
-		expect(toPermissions(['feedback', {app: 'tickets', role: 'access'}])).toEqual([
-			{app: 'feedback', role: ACCESS_ROLE},
-			{app: 'tickets', role: ACCESS_ROLE}
-		]);
-	});
-
-	it('drops duplicates of the same (app, role)', () => {
-		expect(toPermissions(['tickets', {app: 'tickets', role: 'access'}])).toEqual([
-			{app: 'tickets', role: ACCESS_ROLE}
-		]);
-	});
-
-	it('rejects rather than silently dropping an unknown app', () => {
-		// Silently ignoring it would let "grant calendar + nonsense" look like a
-		// success while granting less than the caller asked for.
-		expect(toPermissions(['calendar', 'nonsense'])).toBeNull();
-	});
-
-	it('rejects an unknown role', () => {
-		expect(toPermissions([{app: 'tickets', role: 'refund'}])).toBeNull();
-	});
-
-	it('rejects anything that is not a list', () => {
-		expect(toPermissions('admin')).toBeNull();
-		expect(toPermissions(null)).toBeNull();
-		expect(toPermissions({app: 'admin', role: 'access'})).toBeNull();
-	});
-
-	it('reads an empty list as "no permissions", not as invalid', () => {
-		expect(toPermissions([])).toEqual([]);
-	});
-});
-
-describe('isAppRole', () => {
-	it('accepts the access role for every app', () => {
-		expect(isAppRole('admin', ACCESS_ROLE)).toBe(true);
-		expect(isAppRole('calendar', ACCESS_ROLE)).toBe(true);
-	});
-
-	it('rejects a role that does not exist yet', () => {
-		expect(isAppRole('tickets', 'refund')).toBe(false);
-	});
-});
-
-describe('isAppPermission', () => {
-	it('needs both halves to be valid', () => {
-		expect(isAppPermission({app: 'tickets', role: ACCESS_ROLE})).toBe(true);
-		expect(isAppPermission({app: 'tickets'})).toBe(false);
-		expect(isAppPermission({role: ACCESS_ROLE})).toBe(false);
-		expect(isAppPermission(null)).toBe(false);
-	});
-});
-
-describe('appsOf', () => {
-	it('collapses several roles on one app to a single entry', () => {
-		// The point of the derived list: a user with two roles on tickets has
-		// access to tickets once, not twice.
-		const apps = appsOf([
-			{app: 'tickets', role: ACCESS_ROLE},
-			{app: 'tickets', role: 'future-role'},
-			{app: 'admin', role: ACCESS_ROLE}
-		]);
-		expect(apps).toEqual(['tickets', 'admin']);
-	});
-
-	it('is empty for no permissions', () => {
-		expect(appsOf([])).toEqual([]);
-	});
-});

test/admin/auth-binding.ts

@@ -1,107 +0,0 @@
-import {vi, describe, it, expect, beforeEach, type Mock} from 'vitest';
-import express, {Request, Response} from 'express';
-
-/**
- * Shared body for the two cutover tests (2026-09-06). feedback.auth.ts and
- * tickets.auth.ts used to carry their own header-session authenticator against
- * the calendar users table; both are now one binding to the shared admin gate.
- *
- * What is worth asserting is not how that gate works - admin.middleware.test.ts
- * owns that - but that each module is bound to *its own* app. The mocks live in
- * the calling file because vi.mock is per-module-graph; only the assertions are
- * shared.
- *
- * There used to be a tripwire here asserting neither module fell back to the
- * calendar's header sessions. It went with step 5: the calendar users service
- * no longer exists, so there is nothing left to fall back to and nothing to
- * assert against.
- */
-
-export interface BindingMocks {
-	/** auth.api.getSession from the mocked admin.auth.js */
-	getSession: Mock;
-	/** loadAccess from the mocked users.admin.service.js */
-	loadAccess: Mock;
-}
-
-const makeReq = (): Request => ({headers: {cookie: 'nachklang.session_token=abc'}} as unknown as Request);
-
-const makeRes = (): Response => {
-	const res: any = {};
-	res.status = vi.fn().mockReturnValue(res);
-	res.send = vi.fn().mockReturnValue(res);
-	res.locals = {};
-	return res as Response;
-};
-
-const userWith = (...apps: string[]) => ({
-	id: 'u1',
-	email: 'a@nachklang.art',
-	displayName: 'Anna Admin',
-	disabled: false,
-	permissions: apps.map(app => ({app, role: 'access'})),
-	apps
-});
-
-export const describeAdminBinding = (
-	app: string,
-	otherApp: string,
-	middleware: express.RequestHandler,
-	mocks: () => BindingMocks
-): void => {
-	describe(`${app} requireAdminAuth`, () => {
-		let m: BindingMocks;
-
-		const run = async () => {
-			const res = makeRes();
-			const next = vi.fn();
-			await middleware(makeReq(), res, next);
-			return {res, next};
-		};
-
-		beforeEach(() => {
-			m = mocks();
-			m.getSession.mockReset();
-			m.loadAccess.mockReset();
-		});
-
-		it('responds 401 and does not call next() without a session', async () => {
-			m.getSession.mockResolvedValue(null);
-
-			const {res, next} = await run();
-
-			expect(res.status).toHaveBeenCalledWith(401);
-			expect(next).not.toHaveBeenCalled();
-		});
-
-		it(`responds 403 for a signed-in user who only has ${otherApp}`, async () => {
-			m.getSession.mockResolvedValue({user: {id: 'u1'}});
-			m.loadAccess.mockResolvedValue(userWith(otherApp));
-
-			const {res, next} = await run();
-
-			expect(res.status).toHaveBeenCalledWith(403);
-			expect(next).not.toHaveBeenCalled();
-		});
-
-		it('responds 403 for a disabled user who still holds the permission', async () => {
-			m.getSession.mockResolvedValue({user: {id: 'u1'}});
-			m.loadAccess.mockResolvedValue({...userWith(app), disabled: true});
-
-			const {res, next} = await run();
-
-			expect(res.status).toHaveBeenCalledWith(403);
-			expect(next).not.toHaveBeenCalled();
-		});
-
-		it('sets res.locals.admin and calls next() with the permission', async () => {
-			m.getSession.mockResolvedValue({user: {id: 'u1'}});
-			m.loadAccess.mockResolvedValue(userWith(app));
-
-			const {res, next} = await run();
-
-			expect(next).toHaveBeenCalled();
-			expect(res.locals.admin).toMatchObject({id: 'u1', email: 'a@nachklang.art', displayName: 'Anna Admin'});
-		});
-	});
-};

test/admin/users.admin.router.test.ts

@@ -97,37 +97,7 @@ describe('PUT /admin/users/:id/permissions', () => {
 		const res = await request(makeApp('me')).put('/admin/users/other/permissions').send({apps: ['tickets']});
 
 		expect(res.status).toBe(200);
-		expect(service.setPermissionsGuarded).toHaveBeenCalledWith(
-			'other',
-			[{app: 'tickets', role: 'access'}],
-			'me'
-		);
-	});
-
-	it('accepts the richer {permissions} body', async () => {
-		service.loadAccess.mockResolvedValue({id: 'other', disabled: false, apps: []});
-
-		const res = await request(makeApp('me'))
-			.put('/admin/users/other/permissions')
-			.send({permissions: [{app: 'tickets', role: 'access'}]});
-
-		expect(res.status).toBe(200);
-		expect(service.setPermissionsGuarded).toHaveBeenCalledWith(
-			'other',
-			[{app: 'tickets', role: 'access'}],
-			'me'
-		);
-	});
-
-	it('rejects a role that does not exist', async () => {
-		service.loadAccess.mockResolvedValue({id: 'other', disabled: false, apps: []});
-
-		const res = await request(makeApp('me'))
-			.put('/admin/users/other/permissions')
-			.send({permissions: [{app: 'tickets', role: 'refund'}]});
-
-		expect(res.status).toBe(400);
-		expect(service.setPermissionsGuarded).not.toHaveBeenCalled();
+		expect(service.setPermissionsGuarded).toHaveBeenCalledWith('other', ['tickets'], 'me');
 	});
 
 	it('allows granting permissions to someone who has none', async () => {
@@ -136,11 +106,7 @@ describe('PUT /admin/users/:id/permissions', () => {
 		const res = await request(makeApp('me')).put('/admin/users/other/permissions').send({apps: ['feedback', 'tickets']});
 
 		expect(res.status).toBe(200);
-		expect(service.setPermissionsGuarded).toHaveBeenCalledWith(
-			'other',
-			[{app: 'feedback', role: 'access'}, {app: 'tickets', role: 'access'}],
-			'me'
-		);
+		expect(service.setPermissionsGuarded).toHaveBeenCalledWith('other', ['feedback', 'tickets'], 'me');
 	});
 });
 

test/calendar/credentials.service.test.ts

@@ -1,49 +0,0 @@
-import {describe, expect, it, beforeEach} from 'vitest';
-
-import * as CredentialService from '../../src/models/calendar/events/credentials.service.js';
-
-/**
- * The public calendar is read anonymously by nachklang.art to show the next
- * upcoming event. That is a load-bearing property, not an accident: the step 4
- * cutover moved every signed-in path onto session cookies and left these shared
- * passwords behind only for iCal subscriptions, and the failure mode of getting
- * it wrong is the public website silently losing its events feed.
- *
- * So this pins both halves: public needs nothing, and the restricted calendars
- * still need something.
- */
-describe('hasAccess', () => {
-	beforeEach(() => {
-		process.env.MEMBER_CREDENTIAL = 'member-secret';
-		process.env.CHOIR_CREDENTIAL = 'choir-secret';
-		process.env.MANAGEMENT_CREDENTIAL = 'management-secret';
-	});
-
-	it('lets anyone read the public calendar with no password at all', async () => {
-		await expect(CredentialService.hasAccess('public', '')).resolves.toBe(true);
-	});
-
-	it.each([
-		['members', 'member-secret'],
-		['choir', 'choir-secret'],
-		['management', 'management-secret'],
-		['birthdays', 'choir-secret']
-	])('refuses %s without the credential and allows it with one', async (calendar, secret) => {
-		await expect(CredentialService.hasAccess(calendar, '')).resolves.toBe(false);
-		await expect(CredentialService.hasAccess(calendar, 'wrong')).resolves.toBe(false);
-		await expect(CredentialService.hasAccess(calendar, secret)).resolves.toBe(true);
-	});
-
-	it('refuses an unknown calendar outright', async () => {
-		await expect(CredentialService.hasAccess('nope', 'member-secret')).resolves.toBe(false);
-	});
-
-	it('refuses a calendar whose credential is not configured', async () => {
-		// An unset MEMBER_CREDENTIAL must not become "any password works", and in
-		// particular must not become "an absent password works".
-		delete process.env.MEMBER_CREDENTIAL;
-
-		await expect(CredentialService.hasAccess('members', '')).resolves.toBe(false);
-		await expect(CredentialService.hasAccess('members', undefined as any)).resolves.toBe(false);
-	});
-});

test/calendar/events.router.test.ts

@@ -1,224 +0,0 @@
-import {describe, expect, it, vi, beforeEach} from 'vitest';
-import express from 'express';
-import request from 'supertest';
-
-vi.mock('../../src/models/calendar/events/events.service.js', () => ({
-	getAllEvents: vi.fn(),
-	getAllEventsAdmin: vi.fn(),
-	getEventById: vi.fn(),
-	createEvent: vi.fn(),
-	updateEvent: vi.fn(),
-	deleteEvent: vi.fn(),
-	moveEvent: vi.fn(),
-	getNextUpcomingEvent: vi.fn()
-}));
-
-vi.mock('../../src/models/admin/admin.auth.js', () => ({
-	auth: {api: {getSession: vi.fn()}}
-}));
-
-vi.mock('../../src/models/admin/users/users.admin.service.js', () => ({
-	loadAccess: vi.fn()
-}));
-
-import * as EventService from '../../src/models/calendar/events/events.service.js';
-import {auth} from '../../src/models/admin/admin.auth.js';
-import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
-import {eventsRouter} from '../../src/models/calendar/events/events.router.js';
-
-/**
- * Step 4 of docs/calendar-auth-migration.md at the route level. The unit test
- * on credentials.service covers the password table; this covers the thing that
- * table is wired into, which is where the interesting mistakes live:
- *
- *   - the public calendar has to stay readable with no session and no password,
- *   - the shared password has to keep working for the restricted calendars,
- *     because iCal clients cannot send a cookie,
- *   - and every write has to be behind the session cookie *and* an explicit
- *     calendar permission, not merely behind "is signed in".
- */
-
-const app = express();
-app.use(express.json());
-app.use('/calendar/events', eventsRouter);
-
-const signedInAs = (apps: string[], disabled = false) => {
-	(auth.api.getSession as any).mockResolvedValue({user: {id: 'admin-1'}});
-	(UsersService.loadAccess as any).mockResolvedValue({
-		id: 'admin-1',
-		email: 'a@nachklang.art',
-		displayName: 'A',
-		disabled,
-		permissions: apps.map(app => ({app, role: 'access'})),
-		apps
-	});
-};
-
-const signedOut = () => {
-	(auth.api.getSession as any).mockResolvedValue(null);
-};
-
-const validEvent = {
-	calendarId: 1,
-	name: 'Konzert',
-	startDateTime: '2026-04-18T19:00:00Z',
-	endDateTime: '2026-04-18T21:00:00Z'
-};
-
-beforeEach(() => {
-	vi.clearAllMocks();
-	process.env.MEMBER_CREDENTIAL = 'member-secret';
-	(EventService.getAllEvents as any).mockResolvedValue([]);
-	(EventService.getAllEventsAdmin as any).mockResolvedValue([]);
-	(EventService.getNextUpcomingEvent as any).mockResolvedValue({eventId: 1, name: 'Konzert'});
-	(EventService.createEvent as any).mockResolvedValue(1);
-	(EventService.updateEvent as any).mockResolvedValue(1);
-	(EventService.moveEvent as any).mockResolvedValue(true);
-	(EventService.deleteEvent as any).mockResolvedValue(true);
-	signedOut();
-});
-
-describe('reading', () => {
-	it('serves the public calendar anonymously', async () => {
-		// The property nachklang.art depends on. No cookie, no password.
-		await request(app).get('/calendar/events/public/json').expect(200);
-
-		// And as the non-admin view: an anonymous caller must not see drafts.
-		expect(EventService.getAllEvents).toHaveBeenCalled();
-		expect(EventService.getAllEventsAdmin).not.toHaveBeenCalled();
-	});
-
-	it('refuses a restricted calendar with neither session nor password', async () => {
-		await request(app).get('/calendar/events/members/json').expect(403);
-	});
-
-	it('serves a restricted calendar to a shared password, without drafts', async () => {
-		await request(app)
-			.get('/calendar/events/members/json')
-			.query({password: 'member-secret'})
-			.expect(200);
-
-		expect(EventService.getAllEvents).toHaveBeenCalled();
-		expect(EventService.getAllEventsAdmin).not.toHaveBeenCalled();
-	});
-
-	it('gives a signed-in editor the admin view instead', async () => {
-		signedInAs(['calendar']);
-
-		await request(app).get('/calendar/events/members/json').expect(200);
-
-		expect(EventService.getAllEventsAdmin).toHaveBeenCalled();
-		expect(EventService.getAllEvents).not.toHaveBeenCalled();
-	});
-
-	it('treats a signed-in user without the calendar permission as anonymous', async () => {
-		// Not a 403: they may still read the public calendar like anyone else.
-		signedInAs(['tickets']);
-
-		await request(app).get('/calendar/events/public/json').expect(200);
-		expect(EventService.getAllEvents).toHaveBeenCalled();
-		expect(EventService.getAllEventsAdmin).not.toHaveBeenCalled();
-
-		await request(app).get('/calendar/events/members/json').expect(403);
-	});
-
-	it('still serves the public calendar when the admin database is down', async () => {
-		(auth.api.getSession as any).mockRejectedValue(new Error('ECONNREFUSED'));
-
-		await request(app).get('/calendar/events/public/json').expect(200);
-	});
-
-	// The endpoint www.nachklang.art actually calls for its next-event teaser.
-	// Tested separately from /json because it takes a different code path - it
-	// has no admin view and no editor branch - so covering /json proves nothing
-	// about it, and its failure is invisible until someone notices the website
-	// has gone quiet.
-	it('serves the next upcoming event anonymously on the public calendar', async () => {
-		await request(app).get('/calendar/events/public/json/next').expect(200);
-
-		// And without asking the admin database who the caller is: the public
-		// feed must not acquire a dependency it has never had.
-		expect(auth.api.getSession).not.toHaveBeenCalled();
-	});
-
-	it('refuses the next upcoming event on a restricted calendar without a credential', async () => {
-		await request(app).get('/calendar/events/members/json/next').expect(403);
-	});
-
-	it('serves the next upcoming event to a shared password', async () => {
-		await request(app)
-			.get('/calendar/events/members/json/next')
-			.query({password: 'member-secret'})
-			.expect(200);
-	});
-
-	it('serves the next upcoming event to a signed-in editor', async () => {
-		signedInAs(['calendar']);
-
-		await request(app).get('/calendar/events/members/json/next').expect(200);
-	});
-
-	it('does not consult the admin database for the anonymous public iCal export', async () => {
-		await request(app).get('/calendar/events/public/ical').expect(200);
-
-		expect(auth.api.getSession).not.toHaveBeenCalled();
-	});
-
-	it('keeps the shared password working on the iCal export', async () => {
-		(EventService.getAllEvents as any).mockResolvedValue([]);
-
-		await request(app).get('/calendar/events/public/ical').expect(200);
-		await request(app).get('/calendar/events/members/ical').expect(403);
-		await request(app)
-			.get('/calendar/events/members/ical')
-			.query({password: 'member-secret'})
-			.expect(200);
-	});
-});
-
-describe('writing', () => {
-	it.each([
-		['post', '/calendar/events'],
-		['put', '/calendar/events/1'],
-		['put', '/calendar/events/move/1'],
-		['delete', '/calendar/events/1']
-	])('%s %s answers 401 when signed out', async (method, path) => {
-		await (request(app) as any)[method](path).send(validEvent).expect(401);
-	});
-
-	it.each([
-		['post', '/calendar/events'],
-		['put', '/calendar/events/1'],
-		['put', '/calendar/events/move/1'],
-		['delete', '/calendar/events/1']
-	])('%s %s answers 403 without the calendar permission', async (method, path) => {
-		signedInAs(['tickets', 'feedback', 'admin']);
-		await (request(app) as any)[method](path).send(validEvent).expect(403);
-	});
-
-	it('answers 403 for a disabled account that still holds the permission', async () => {
-		signedInAs(['calendar'], true);
-		await request(app).post('/calendar/events').send(validEvent).expect(403);
-	});
-
-	it('records the writer as an admin user id, never a legacy one', async () => {
-		signedInAs(['calendar']);
-
-		await request(app).post('/calendar/events').send(validEvent).expect(201);
-
-		const written = (EventService.createEvent as any).mock.calls[0][0];
-		expect(written.createdByUserId).toBe('admin-1');
-		// Migration 003 made the legacy column nullable precisely so this can be unset.
-		expect(written.createdById).toBeUndefined();
-	});
-
-	it('refuses the shared password as a way to write', async () => {
-		// The passwords are a read fallback for clients that cannot hold a
-		// session. They must never become an editing credential.
-		await request(app)
-			.post('/calendar/events')
-			.query({password: 'member-secret'})
-			.send(validEvent)
-			.expect(401);
-	});
-});

test/calendar/events.service.test.ts

@@ -1,169 +0,0 @@
-import {describe, expect, it, vi, beforeEach} from 'vitest';
-
-const connection = {
-	query: vi.fn(),
-	execute: vi.fn(),
-	beginTransaction: vi.fn(),
-	commit: vi.fn(),
-	rollback: vi.fn(),
-	end: vi.fn()
-};
-
-vi.mock('../../src/models/calendar/Calendar.db.js', () => ({
-	NachklangCalendarDB: {getConnection: vi.fn(async () => connection)}
-}));
-
-vi.mock('../../src/models/admin/users/users.admin.service.js', () => ({
-	findDisplayNames: vi.fn()
-}));
-
-import {NachklangCalendarDB} from '../../src/models/calendar/Calendar.db.js';
-import * as AdminUsersService from '../../src/models/admin/users/users.admin.service.js';
-import * as EventService from '../../src/models/calendar/events/events.service.js';
-
-/**
- * Step 3 of docs/calendar-auth-migration.md. The property under test is that
- * an event's creator resolves from the stronger of its two remaining sources -
- * the live admin name, else the name archived before the legacy users table was
- * removed - and that a failure to reach the admin database costs a name rather
- * than the whole response: the public calendar is read anonymously by the
- * website and has never depended on the admin database being up.
- */
-
-// One row of the shape the shared SELECT produces.
-const row = (over: Record<string, unknown> = {}) => ({
-	event_id: 1,
-	calendar_id: 1,
-	uuid: 'uuid-1',
-	name: 'Konzert',
-	description: '',
-	start_datetime: new Date('2026-04-18T19:00:00Z'),
-	end_datetime: new Date('2026-04-18T21:00:00Z'),
-	created_date: new Date('2026-01-01T00:00:00Z'),
-	version_created_at: new Date('2026-01-02T00:00:00Z'),
-	location: '',
-	created_by_user_id: null,
-	created_by_name: 'Archived Person',
-	version_created_by_user_id: null,
-	version_created_by_name: 'Archived Person',
-	url: '',
-	whole_day: 0,
-	repeat_frequency: '',
-	status: 'PUBLIC',
-	...over
-});
-
-/** getAllEvents runs the calendars lookup first, then the events query. */
-const givenEvents = (...rows: unknown[]) => {
-	connection.query.mockReset();
-	connection.query
-		.mockResolvedValueOnce([{calendar_id: 1, includes_calendars: '[]'}])
-		.mockResolvedValueOnce(rows);
-};
-
-beforeEach(() => {
-	vi.clearAllMocks();
-	connection.end.mockResolvedValue(undefined);
-	(NachklangCalendarDB.getConnection as any).mockResolvedValue(connection);
-});
-
-describe('creator names', () => {
-	it('uses the archived name when the row has no admin id', async () => {
-		givenEvents(row());
-
-		const events = await EventService.getAllEvents(1);
-
-		expect(events[0].createdBy).toBe('Archived Person');
-		expect(events[0].createdByUserId).toBeNull();
-		// Nothing to resolve, so the admin database is not touched at all.
-		expect(AdminUsersService.findDisplayNames).not.toHaveBeenCalled();
-	});
-
-	it('prefers the admin name when the row carries an admin id', async () => {
-		givenEvents(row({
-			created_by_user_id: 'admin-1',
-			version_created_by_user_id: 'admin-2'
-		}));
-		(AdminUsersService.findDisplayNames as any).mockResolvedValue(
-			new Map([['admin-1', 'Neue Person'], ['admin-2', 'Andere Person']])
-		);
-
-		const events = await EventService.getAllEvents(1);
-
-		expect(events[0].createdBy).toBe('Neue Person');
-		expect(events[0].lastModifiedBy).toBe('Andere Person');
-		expect(events[0].createdByUserId).toBe('admin-1');
-	});
-
-	it('prefers the live admin name over the snapshot', async () => {
-		// A renamed account has to win over an archive that was correct when it
-		// was taken - otherwise renaming someone would leave stale names behind.
-		givenEvents(row({created_by_user_id: 'admin-1', created_by_name: 'Archived Person'}));
-		(AdminUsersService.findDisplayNames as any).mockResolvedValue(new Map([['admin-1', 'Neue Person']]));
-
-		const events = await EventService.getAllEvents(1);
-
-		expect(events[0].createdBy).toBe('Neue Person');
-	});
-
-	it('falls back to the archived name when the admin account is gone', async () => {
-		givenEvents(row({created_by_user_id: 'deleted'}));
-		(AdminUsersService.findDisplayNames as any).mockResolvedValue(new Map());
-
-		const events = await EventService.getAllEvents(1);
-
-		expect(events[0].createdBy).toBe('Archived Person');
-	});
-
-	it('leaves the name blank when a row has neither source', async () => {
-		// A post-cutover event whose author was later deleted from the admin
-		// module: no snapshot was ever taken for it, and the id resolves to
-		// nothing. Blank is the designed outcome - the creator is decoration.
-		givenEvents(row({created_by_user_id: 'deleted', created_by_name: null}));
-		(AdminUsersService.findDisplayNames as any).mockResolvedValue(new Map());
-
-		const events = await EventService.getAllEvents(1);
-
-		expect(events[0].createdBy).toBeNull();
-		expect(events).toHaveLength(1);
-	});
-
-	it('resolves a mixed result set in a single lookup', async () => {
-		givenEvents(
-			row({event_id: 1}),
-			row({event_id: 2, created_by_user_id: 'admin-1', version_created_by_user_id: 'admin-1'}),
-			row({event_id: 3, created_by_user_id: 'admin-1', version_created_by_user_id: 'admin-1'})
-		);
-		(AdminUsersService.findDisplayNames as any).mockResolvedValue(new Map([['admin-1', 'Neue Person']]));
-
-		const events = await EventService.getAllEvents(1);
-
-		expect(events.map(e => e.createdBy)).toEqual(['Archived Person', 'Neue Person', 'Neue Person']);
-		expect(AdminUsersService.findDisplayNames).toHaveBeenCalledTimes(1);
-	});
-
-	it('still returns the events when the admin database is unreachable', async () => {
-		givenEvents(row({created_by_user_id: 'admin-1'}));
-		(AdminUsersService.findDisplayNames as any).mockRejectedValue(new Error('ECONNREFUSED'));
-
-		const events = await EventService.getAllEvents(1);
-
-		expect(events).toHaveLength(1);
-		expect(events[0].name).toBe('Konzert');
-		// Degrades to the archived name rather than failing the request.
-		expect(events[0].createdBy).toBe('Archived Person');
-	});
-});
-
-describe('status', () => {
-	it('is omitted from the public listing and present in the admin one', async () => {
-		givenEvents(row());
-		const publicEvents = await EventService.getAllEvents(1);
-		expect(publicEvents[0].status).toBeUndefined();
-
-		connection.query.mockReset();
-		connection.query.mockResolvedValueOnce([row()]);
-		const adminEvents = await EventService.getAllEventsAdmin(1);
-		expect(adminEvents[0].status).toBe('PUBLIC');
-	});
-});

test/feedback/feedback.auth.test.ts

@@ -1,18 +1,88 @@
-import {vi, type Mock} from 'vitest';
+import {vi, describe, it, expect, beforeEach, type Mock} from 'vitest';
+import {Request, Response} from 'express';
 
-vi.mock('../../src/models/admin/admin.auth.js', () => ({
-	auth: {api: {getSession: vi.fn()}}
-}));
-vi.mock('../../src/models/admin/users/users.admin.service.js', () => ({
-	loadAccess: vi.fn()
+vi.mock('../../src/models/calendar/users/users.service.js', () => ({
+	checkSession: vi.fn()
 }));
 
-import {auth} from '../../src/models/admin/admin.auth.js';
-import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
-import {requireAdminAuth} from '../../src/models/feedback/feedback.auth.js';
-import {describeAdminBinding} from '../admin/auth-binding.js';
+import * as UserService from '../../src/models/calendar/users/users.service.js';
+import {requireAdminAuth, sessionHeaderAuthenticator} from '../../src/models/feedback/feedback.auth.js';
 
-describeAdminBinding('feedback', 'tickets', requireAdminAuth, () => ({
-	getSession: auth.api.getSession as unknown as Mock,
-	loadAccess: UsersService.loadAccess as Mock
-}));
+const mockCheckSession = UserService.checkSession as Mock;
+
+const makeReq = (headers: Record<string, string>): Request => {
+	return {
+		header: (name: string) => headers[name],
+		ip: '203.0.113.42'
+	} as unknown as Request;
+};
+
+const makeRes = (): Response => {
+	const res: any = {};
+	res.status = vi.fn().mockReturnValue(res);
+	res.send = vi.fn().mockReturnValue(res);
+	res.locals = {};
+	return res as Response;
+};
+
+describe('sessionHeaderAuthenticator', () => {
+	beforeEach(() => mockCheckSession.mockReset());
+
+	it('returns null when headers are missing', async () => {
+		const identity = await sessionHeaderAuthenticator(makeReq({}));
+		expect(identity).toBeNull();
+		expect(mockCheckSession).not.toHaveBeenCalled();
+	});
+
+	it('returns null when checkSession finds no user', async () => {
+		mockCheckSession.mockResolvedValue(null);
+		const identity = await sessionHeaderAuthenticator(makeReq({'X-Session-Id': '1', 'X-Session-Key': 'k'}));
+		expect(identity).toBeNull();
+	});
+
+	it('returns null for a valid session on an inactive account', async () => {
+		mockCheckSession.mockResolvedValue({userId: 1, email: 'a@nachklang.art', fullName: 'A', isActive: false});
+		const identity = await sessionHeaderAuthenticator(makeReq({'X-Session-Id': '1', 'X-Session-Key': 'k'}));
+		expect(identity).toBeNull();
+	});
+
+	it('returns the identity for a valid session on an active account', async () => {
+		mockCheckSession.mockResolvedValue({userId: 1, email: 'a@nachklang.art', fullName: 'Anna Admin', isActive: true});
+		const identity = await sessionHeaderAuthenticator(makeReq({'X-Session-Id': '1', 'X-Session-Key': 'k'}));
+		expect(identity).toEqual({id: '1', email: 'a@nachklang.art', displayName: 'Anna Admin'});
+	});
+
+	it('passes the session id and key from headers through to checkSession, never from query params', async () => {
+		mockCheckSession.mockResolvedValue({userId: 1, email: 'a@nachklang.art', fullName: 'A', isActive: true});
+		await sessionHeaderAuthenticator(makeReq({'X-Session-Id': '42', 'X-Session-Key': 'sekret'}));
+		expect(mockCheckSession).toHaveBeenCalledWith('42', 'sekret', '203.0.113.42');
+	});
+});
+
+describe('requireAdminAuth', () => {
+	beforeEach(() => mockCheckSession.mockReset());
+
+	it('responds 401 and does not call next() when unauthenticated', async () => {
+		mockCheckSession.mockResolvedValue(null);
+		const req = makeReq({});
+		const res = makeRes();
+		const next = vi.fn();
+
+		await requireAdminAuth(req, res, next);
+
+		expect(res.status).toHaveBeenCalledWith(401);
+		expect(next).not.toHaveBeenCalled();
+	});
+
+	it('sets res.locals.admin and calls next() when authenticated', async () => {
+		mockCheckSession.mockResolvedValue({userId: 1, email: 'a@nachklang.art', fullName: 'Anna Admin', isActive: true});
+		const req = makeReq({'X-Session-Id': '1', 'X-Session-Key': 'k'});
+		const res = makeRes();
+		const next = vi.fn();
+
+		await requireAdminAuth(req, res, next);
+
+		expect(next).toHaveBeenCalled();
+		expect(res.locals.admin).toEqual({id: '1', email: 'a@nachklang.art', displayName: 'Anna Admin'});
+	});
+});

test/integration/admin.auth.test.ts

@@ -9,8 +9,7 @@ import {
 	createAndAcceptInvitation,
 	resetDatabase,
 	sessionCookieFrom,
-	SESSION_COOKIE,
-	accessTo
+	SESSION_COOKIE
 } from './helpers.js';
 
 /**
@@ -67,7 +66,7 @@ describe('invitation acceptance', () => {
 	});
 
 	it('sets the session cookie under the configured prefix', async () => {
-		const invitation = await InvitationsService.createInvitation('b@nachklang.art', 'B', accessTo('feedback'), null);
+		const invitation = await InvitationsService.createInvitation('b@nachklang.art', 'B', ['feedback'], null);
 
 		const res = await request(app)
 			.post('/admin/auth/invitations/accept')
@@ -90,7 +89,7 @@ describe('invitation acceptance', () => {
 	});
 
 	it('previews an invitation without revealing the granted apps', async () => {
-		const invitation = await InvitationsService.createInvitation('d@nachklang.art', 'D', accessTo('admin'), null);
+		const invitation = await InvitationsService.createInvitation('d@nachklang.art', 'D', ['admin'], null);
 
 		const res = await request(app)
 			.post('/admin/auth/invitations/preview')
@@ -101,7 +100,7 @@ describe('invitation acceptance', () => {
 	});
 
 	it('answers an unknown token exactly like an expired one', async () => {
-		const invitation = await InvitationsService.createInvitation('e@nachklang.art', 'E', accessTo('feedback'), null);
+		const invitation = await InvitationsService.createInvitation('e@nachklang.art', 'E', ['feedback'], null);
 		await InvitationsService.revokeInvitation(invitation.id);
 
 		const unknown = await request(app).post('/admin/auth/invitations/preview').send({token: 'no-such-token'});
@@ -112,7 +111,7 @@ describe('invitation acceptance', () => {
 	});
 
 	it('cannot be redeemed twice', async () => {
-		const invitation = await InvitationsService.createInvitation('f@nachklang.art', 'F', accessTo('feedback'), null);
+		const invitation = await InvitationsService.createInvitation('f@nachklang.art', 'F', ['feedback'], null);
 
 		const first = await request(app)
 			.post('/admin/auth/invitations/accept')
@@ -126,7 +125,7 @@ describe('invitation acceptance', () => {
 	});
 
 	it('rejects an expired invitation', async () => {
-		const invitation = await InvitationsService.createInvitation('g@nachklang.art', 'G', accessTo('feedback'), null);
+		const invitation = await InvitationsService.createInvitation('g@nachklang.art', 'G', ['feedback'], null);
 		// Reach past the service to age it: there is deliberately no API for this.
 		const {NachklangAdminDB} = await import('../../src/models/admin/Admin.db.js');
 		await NachklangAdminDB.db
@@ -143,7 +142,7 @@ describe('invitation acceptance', () => {
 	});
 
 	it('rejects a password below the minimum length', async () => {
-		const invitation = await InvitationsService.createInvitation('h@nachklang.art', 'H', accessTo('feedback'), null);
+		const invitation = await InvitationsService.createInvitation('h@nachklang.art', 'H', ['feedback'], null);
 
 		const res = await request(app)
 			.post('/admin/auth/invitations/accept')
@@ -221,32 +220,16 @@ describe('requireAppAccess', () => {
 		expect(Array.isArray(res.body)).toBe(true);
 	});
 
-	// The step 4 cutover (2026-09-06): the feedback and tickets admin areas now
-	// sit behind this same gate, so one sign-in reaches every app the user has a
-	// permission for - and reaches no further. Until step 4 these two returned
-	// 401 for an admin cookie, because each module still ran its own header
-	// session against the calendar users table.
-	it('lets an admin cookie into the feedback and tickets admin areas', async () => {
+	// Step 2 deliberately does NOT swap the feedback and tickets authenticators:
+	// they still authenticate against the legacy calendar sessions, so an admin
+	// cookie means nothing to them yet. This asserts that boundary rather than
+	// the end state - when step 4 lands, these two expectations become 200/403
+	// and this comment goes away.
+	it('leaves the feedback and tickets admin areas on their legacy authenticator', async () => {
 		const user = await createAndAcceptInvitation(app, 'o@nachklang.art', 'O', ['feedback', 'tickets']);
 
-		expect((await user.agent.get('/feedback/admin/me')).status).toBe(200);
-		expect((await user.agent.get('/tickets/admin/me')).status).toBe(200);
-	});
-
-	it('403s each app separately for a user who only holds the other one', async () => {
-		const user = await createAndAcceptInvitation(app, 'q@nachklang.art', 'Q', ['feedback']);
-
-		expect((await user.agent.get('/feedback/admin/me')).status).toBe(200);
-		expect((await user.agent.get('/tickets/admin/me')).status).toBe(403);
-	});
-
-	it('401s the feedback and tickets admin areas for a legacy header session', async () => {
-		const res = await request(app)
-			.get('/feedback/admin/me')
-			.set('X-Session-Id', '1')
-			.set('X-Session-Key', 'whatever');
-
-		expect(res.status).toBe(401);
+		expect((await user.agent.get('/feedback/admin/me')).status).toBe(401);
+		expect((await user.agent.get('/tickets/admin/me')).status).toBe(401);
 	});
 });
 
@@ -276,7 +259,7 @@ describe('origin checks', () => {
 
 describe('the session cookie is not readable by scripts', () => {
 	it('is HttpOnly and SameSite=Lax', async () => {
-		const invitation = await InvitationsService.createInvitation('r@nachklang.art', 'R', accessTo('feedback'), null);
+		const invitation = await InvitationsService.createInvitation('r@nachklang.art', 'R', ['feedback'], null);
 		const res = await request(app)
 			.post('/admin/auth/invitations/accept')
 			.send({token: invitation.token, password: 'devpassword123'});

test/integration/admin.users.test.ts

@@ -5,7 +5,7 @@ import {createApp} from '../../src/app.factory.js';
 import * as InvitationsService from '../../src/models/admin/invitations/invitations.service.js';
 import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
 import {bootstrapAdmin} from '../../src/models/admin/admin.bootstrap.js';
-import {accessTo, closeDatabase, createAndAcceptInvitation, resetDatabase} from './helpers.js';
+import {closeDatabase, createAndAcceptInvitation, resetDatabase} from './helpers.js';
 
 let app: Application;
 
@@ -185,7 +185,7 @@ describe('invitations', () => {
 
 	it('invalidates the previous link on resend', async () => {
 		const {agent} = await signedInAdmin();
-		const original = await InvitationsService.createInvitation('new@nachklang.art', 'New', accessTo('feedback'), null);
+		const original = await InvitationsService.createInvitation('new@nachklang.art', 'New', ['feedback'], null);
 
 		const resent = await agent.post(`/admin/invitations/${original.id}/resend`);
 		expect(resent.status).toBe(200);
@@ -198,7 +198,7 @@ describe('invitations', () => {
 
 	it('revokes an invitation', async () => {
 		const {agent} = await signedInAdmin();
-		const invitation = await InvitationsService.createInvitation('new@nachklang.art', 'New', accessTo('feedback'), null);
+		const invitation = await InvitationsService.createInvitation('new@nachklang.art', 'New', ['feedback'], null);
 
 		expect((await agent.delete(`/admin/invitations/${invitation.id}`)).status).toBe(204);
 		expect((await agent.delete(`/admin/invitations/${invitation.id}`)).status).toBe(404);

test/integration/helpers.ts

@@ -3,7 +3,7 @@ import type {Application} from 'express';
 import request from 'supertest';
 import {NachklangAdminDB} from '../../src/models/admin/Admin.db.js';
 import * as InvitationsService from '../../src/models/admin/invitations/invitations.service.js';
-import {ACCESS_ROLE, AppName, AppPermission, toPermissions} from '../../src/models/admin/admin.schema.js';
+import {AppName} from '../../src/models/admin/admin.schema.js';
 
 const db = NachklangAdminDB.db;
 
@@ -44,13 +44,10 @@ export const createAndAcceptInvitation = async (
 	app: Application,
 	email: string,
 	name: string,
-	// Takes the shorthand as well as the full form: most tests only care that
-	// someone can open an app, and `['tickets']` says that with less noise.
-	grants: (AppName | AppPermission)[],
+	apps: AppName[],
 	password = 'devpassword123'
 ) => {
-	const permissions = toPermissions(grants) ?? [];
-	const invitation = await InvitationsService.createInvitation(email, name, permissions, null);
+	const invitation = await InvitationsService.createInvitation(email, name, apps, null);
 
 	const agent = request.agent(app);
 	const res = await agent
@@ -69,9 +66,3 @@ export const cookieHeader = (res: request.Response): string[] => {
 export const sessionCookieFrom = (res: request.Response): string | undefined => {
 	return cookieHeader(res).find(cookie => cookie.startsWith(SESSION_COOKIE));
 };
-
-/** `accessTo('feedback')` reads better than the (app, role) literal in tests
- *  that only care that someone can open an app. */
-export const accessTo = (...apps: AppName[]): AppPermission[] => {
-	return apps.map(app => ({app, role: ACCESS_ROLE}));
-};

test/tickets/confirmation-email.test.ts

@@ -47,19 +47,11 @@ const RECIPIENT = {
 	guestNames: ['Erika Mustermann', 'Hans Mustermann']
 };
 
-// Default: no event_ticket_settings row, same "absence over sentinels" case
-// as everywhere else - ticketsAreMailed reads this as false (not mailed).
-const makeSettingsConn = (ticketsMailed?: boolean) => ({
-	query: vi.fn().mockResolvedValue(ticketsMailed === undefined ? [] : [{tickets_mailed: ticketsMailed ? 1 : 0}]),
-	end: vi.fn().mockResolvedValue(undefined)
-});
-
 beforeEach(() => {
 	vi.clearAllMocks();
 	mockGetEvent.mockResolvedValue(EVENT);
 	mockToIcal.mockResolvedValue('BEGIN:VCALENDAR\nEND:VCALENDAR');
 	mockSendMail.mockResolvedValue(true);
-	mockGetConnection.mockResolvedValue(makeSettingsConn());
 });
 
 describe('sendRedemptionConfirmation', () => {
@@ -103,32 +95,6 @@ describe('sendRedemptionConfirmation', () => {
 
 		expect(await sendRedemptionConfirmation(RECIPIENT)).toBe(false);
 	});
-
-	it('adds the Abendkasse pickup notice when the event does not mail tickets', async () => {
-		mockGetConnection.mockResolvedValue(makeSettingsConn(false));
-
-		await sendRedemptionConfirmation(RECIPIENT);
-
-		const body = mockSendMail.mock.calls[0][2];
-		expect(body).toContain('Abendkasse');
-		expect(body).toContain('Erika Mustermann');
-	});
-
-	it('adds the pickup notice when there is no ticket-shop settings row at all', async () => {
-		mockGetConnection.mockResolvedValue(makeSettingsConn());
-
-		await sendRedemptionConfirmation(RECIPIENT);
-
-		expect(mockSendMail.mock.calls[0][2]).toContain('Abendkasse');
-	});
-
-	it('omits the pickup notice when the event mails tickets', async () => {
-		mockGetConnection.mockResolvedValue(makeSettingsConn(true));
-
-		await sendRedemptionConfirmation(RECIPIENT);
-
-		expect(mockSendMail.mock.calls[0][2]).not.toContain('Abendkasse');
-	});
 });
 
 describe('recordConfirmationEmailResult', () => {

test/tickets/tickets.auth.test.ts

@@ -1,18 +0,0 @@
-import {vi, type Mock} from 'vitest';
-
-vi.mock('../../src/models/admin/admin.auth.js', () => ({
-	auth: {api: {getSession: vi.fn()}}
-}));
-vi.mock('../../src/models/admin/users/users.admin.service.js', () => ({
-	loadAccess: vi.fn()
-}));
-
-import {auth} from '../../src/models/admin/admin.auth.js';
-import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
-import {requireAdminAuth} from '../../src/models/tickets/tickets.auth.js';
-import {describeAdminBinding} from '../admin/auth-binding.js';
-
-describeAdminBinding('tickets', 'feedback', requireAdminAuth, () => ({
-	getSession: auth.api.getSession as unknown as Mock,
-	loadAccess: UsersService.loadAccess as Mock
-}));