.env.example

@@ -25,6 +25,20 @@ TICKETS_DB=
 TICKETS_RATE_LIMIT_MAX=10
 TICKETS_RATE_LIMIT_WINDOW_MIN=10
 
+ADMIN_DB=
+# 32+ random bytes, e.g. `openssl rand -base64 48`. Rotating it signs everyone
+# out and invalidates outstanding password-reset links.
+BETTER_AUTH_SECRET=
+API_BASE_URL=http://localhost:3000
+ADMIN_APP_URL=http://localhost:3002
+# Comma-separated origins of the apps that may call /admin/* with credentials.
+APP_ORIGINS=http://localhost:3001
+# nachklang.art in production; passkeys are bound to this value.
+PASSKEY_RP_ID=localhost
+# On start-up, makes sure this address can get in (invite, or grant admin if the
+# user already exists). Idempotent, safe to leave set.
+ADMIN_BOOTSTRAP_EMAIL=
+
 MEMBER_CREDENTIAL=123
 CHOIR_CREDENTIAL=123
 MANAGEMENT_CREDENTIAL=123

CLAUDE.md

@@ -10,6 +10,7 @@ npm run start    # Build and start (tsc && node ./dist/app.js)
 npm run debug    # Start with DEBUG=* environment variable
 npm run test     # Run the vitest suite once with coverage (lcov + testResults/sonar-report.xml)
 npm run test:watch  # vitest in watch mode
+npm run test:integration  # Admin-module tests against a throwaway MariaDB (needs docker or podman)
 ```
 
 Run a single test file:
@@ -19,10 +20,12 @@ npx vitest run test/some.test.ts
 
 ## Architecture
 
-Express.js REST API in TypeScript with a service-oriented layering. Domains: `Calendar` (events, users) and `Feedback` (concert feedback forms, mounted at `/feedback`, backed by its own `FEEDBACK_DB` — see `src/models/feedback/`: public submission flow, admin CRUD, reporting, and a Salesforce newsletter-sync integration).
+Express.js REST API in TypeScript with a service-oriented layering. Domains: `Calendar` (events, users), `Feedback` (concert feedback forms, mounted at `/feedback`, backed by its own `FEEDBACK_DB` — see `src/models/feedback/`: public submission flow, admin CRUD, reporting, and a Salesforce newsletter-sync integration), `Tickets` (mounted at `/tickets`), and `Admin` (identity and permissions, mounted at `/admin`, backed by `ADMIN_DB` — see below).
+
+`src/app.factory.ts` builds the Express app; `app.ts` only starts it. The split exists so the integration tests drive the real wiring.
 
 **Request path:**
-1. `app.ts` mounts `Calendar.router.ts` at `/calendar`
+1. `src/app.factory.ts` mounts `Calendar.router.ts` at `/calendar`
 2. `Calendar.router.ts` delegates to `events.router.ts` and `users.router.ts`
 3. Routers call services; services call the MariaDB pool in `Calendar.db.ts`
 
@@ -35,7 +38,35 @@ Express.js REST API in TypeScript with a service-oriented layering. Domains: `Ca
 | DB pool | `src/models/calendar/Calendar.db.ts` (MariaDB, pool size 5) |
 | Shared | `src/common/` (base route class, nodemailer wrapper), `src/middleware/logger.ts` (Winston) |
 
-**Auth model:** Users must have a `@nachklang.art` email. After activation they receive a session token (30-day window); the token hash + IP are stored in the DB. Credentials for non-user calendar access (`MEMBER_CREDENTIAL`, `CHOIR_CREDENTIAL`, `MANAGEMENT_CREDENTIAL`) come from `.env`.
+**Auth model:** Two of them, on purpose.
+
+*Admin module (`src/models/admin/`)* — the current one, used by feedback, tickets and the
+admin app. better-auth 1.7 on its own `nachklang_admin` database (Kysely + mysql2; every
+other domain keeps the `mariadb` driver), mounted at `/admin/auth/*` for the auth handler
+and `/admin` for the JSON routes. Sessions are httpOnly cookies scoped to
+`.nachklang.art`, so one sign-in covers every app. Accounts are **invite-only** — public
+sign-up is disabled, and `invitations.plugin.ts` is the only code that creates users.
+Permissions are per app in `user_app_permissions`; `requireAppAccess(app)` in
+`admin.middleware.ts` is the single authenticator, and it queries the database on every
+request (no cookie cache) so disabling a user takes effect at once. `ADMIN_BOOTSTRAP_EMAIL`
+makes sure someone can always get in on a fresh database.
+
+*Legacy calendar* — unchanged: users need a `@nachklang.art` email, and after activation
+get a session token (30-day window, hash + IP stored in the DB), passed as query
+parameters. Migration is planned but not started: `docs/calendar-auth-migration.md`.
+Credentials for non-user calendar access (`MEMBER_CREDENTIAL`, `CHOIR_CREDENTIAL`,
+`MANAGEMENT_CREDENTIAL`) come from `.env`.
+
+**Admin database driver:** the admin pool is the **callback-style** `mysql2`, never
+`mysql2/promise`. Kysely's `MysqlDialect` calls `pool.getConnection((err, conn) => ...)`;
+the promise wrapper ignores that callback, so every Kysely query hangs forever with no
+error. Only the integration tests catch this.
+
+**Admin schema changes:** `sql/admin/NNN_*.sql`, hand-maintained and mirrored in
+`docker/init/`. The better-auth tables must match what the configured version derives from
+`admin.auth.ts` — on every better-auth upgrade, re-derive them (`getAuthTables` from
+`better-auth/db`, called with `auth.options`), diff, and add a numbered migration. Do not
+use the published `@better-auth/cli`; it lags the library.
 
 **Event versioning:** Events have a companion `event_versions` table. `events.service.ts` manages writes to both.
 
@@ -59,6 +90,13 @@ DB_HOST=
 DB_USER=
 DB_PASSWORD=
 CALENDAR_DB=
+ADMIN_DB=
+BETTER_AUTH_SECRET=
+API_BASE_URL=
+ADMIN_APP_URL=
+APP_ORIGINS=
+PASSKEY_RP_ID=
+ADMIN_BOOTSTRAP_EMAIL=
 FEEDBACK_DB=
 FEEDBACK_IP_SALT=
 FEEDBACK_RATE_LIMIT_MAX=

DEFERRED_SECURITY.md

@@ -32,6 +32,13 @@ Currently any active user can edit, move, or delete any event regardless of who
 
 ## 3. Activation token has no expiry
 
+> **Superseded for new accounts (2026-09-05).** The admin module
+> (`src/models/admin/`) replaced account creation for the feedback, tickets and admin
+> apps: accounts now come from `invitations`, whose tokens expire after 7 days and are
+> stored only as a SHA-256 hash. The item below still stands for the legacy calendar
+> `users` table, which the admin module deliberately left alone - see
+> `docs/calendar-auth-migration.md`.
+
 **File:** `src/models/calendar/users/users.service.ts` — `createUser` / `activateUser`
 
 The email activation link is valid indefinitely. Acceptable for a small, trusted userbase.
@@ -45,6 +52,10 @@ The email activation link is valid indefinitely. Acceptable for a small, trusted
 
 ## 4. Password reset token has no expiry
 
+> **Superseded for new accounts (2026-09-05).** Password resets for admin-module accounts
+> go through better-auth, whose reset tokens expire after one hour. As with item 3, the
+> text below still applies to the legacy calendar `users` table.
+
 **File:** `src/models/calendar/users/users.service.ts` — `initiatePasswordReset` / `finalizePasswordReset`
 
 The reset token stored in `pw_reset_token_hash` never expires. Acceptable for a small, trusted userbase.

app.ts

@@ -1,16 +1,8 @@
-import express from 'express';
 import * as http from 'http';
 import * as dotenv from 'dotenv';
-import swaggerUi from 'swagger-ui-express';
-import swaggerJSDoc from 'swagger-jsdoc';
-import cors from 'cors';
 import logger from './src/middleware/logger.js';
-
+import {createApp} from './src/app.factory.js';
-// Router imports
+import {bootstrapAdmin} from './src/models/admin/admin.bootstrap.js';
-import {calendarRouter} from './src/models/calendar/Calendar.router.js';
-import {feedbackRouter} from './src/models/feedback/Feedback.router.js';
-import {ticketsRouter} from './src/models/tickets/Tickets.router.js';
-
 
 dotenv.config();
 
@@ -21,97 +13,11 @@ if (!process.env.PORT) {
 
 const port: number = parseInt(process.env.PORT, 10);
 
-const app: express.Application = express();
+const app = createApp();
 const server: http.Server = http.createServer(app);
 
-// Behind Plesk's nginx, req.ip is the proxy unless we trust the forwarded header.
-// Verify the resolved client IP is correct in staging before relying on it
-// (used by the feedback rate limiter).
-app.set('trust proxy', 1);
-
-// here we are adding middleware to parse all incoming requests as JSON
-app.use(express.json());
-
-// Configure CORS
-let allowedHosts = [
-	'https://www.nachklang.art',
-	'https://calendar.nachklang.art',
-	'https://feedback.nachklang.art',
-	'https://tickets.nachklang.art'
-];
-const isDev = process.env.NODE_ENV !== 'production';
-const localhostRegex = /^http:\/\/localhost:\d+$/;
-// Matches http://<private-LAN-IPv4>:<port> - needed so the feedback form can
-// be reached from a real phone over WiFi during dev (the phone's Origin is
-// the dev machine's LAN IP, never "localhost"). Dev-only, same as above.
-const lanIpRegex = /^http:\/\/(192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}):\d+$/;
-app.use(cors({
-	allowedHeaders: ['Content-Type', 'X-Session-Id', 'X-Session-Key'],
-	origin: function (origin: any, callback: any) {
-		// Allow requests with no origin
-		if (!origin) return callback(null, true);
-
-		// Any localhost port, or a private-LAN IP, is fine outside production -
-		// dev servers pick whatever port is free (Next.js falls back from 3000
-		// if it's taken), and real-device testing hits the dev machine by IP.
-		if (isDev && (localhostRegex.test(origin) || lanIpRegex.test(origin))) {
-			return callback(null, true);
-		}
-
-		// Block requests with wrong origin
-		if (allowedHosts.indexOf(origin) === -1) {
-			return callback(new Error('The CORS policy doesn\'t allow access for your origin.'), false);
-		}
-
-		// Allow all other requests
-		return callback(null, true);
-	}
-}));
-
-// Swagger documentation
-const swaggerDefinition = {
-	openapi: '3.0.0',
-	info: {
-		title: 'Nachklang e.V. REST API',
-		version: '0.1.0',
-		license: {
-			name: 'Licensed Under MIT',
-			url: 'https://spdx.org/licenses/MIT.html'
-		},
-		contact: {
-			name: 'Nachklang e.V.',
-			url: 'https://www.nachklang.art'
-		}
-	}
-};
-
-const options = {
-	swaggerDefinition,
-	// Paths to files containing OpenAPI definitions
-	apis: [
-		'./src/models/**/*.interface.ts',
-		'./src/models/**/*.router.ts'
-	]
-};
-
-const swaggerSpec = swaggerJSDoc(options);
-
-app.use(
-	'/docs',
-	swaggerUi.serve,
-	swaggerUi.setup(swaggerSpec)
-);
-
-// Add routers
-app.use('/calendar', calendarRouter);
-app.use('/feedback', feedbackRouter);
-app.use('/tickets', ticketsRouter);
-
-// this is a simple route to make sure everything is working properly
-app.get('/', (req: express.Request, res: express.Response) => {
-	res.status(200).send('Welcome to the Nachklang e.V. REST API!');
-});
-
 server.listen(port, () => {
 	logger.info('Server listening on Port ' + port);
+	// Makes sure ADMIN_BOOTSTRAP_EMAIL can always get in. Never throws.
+	void bootstrapAdmin();
 });

docker-compose.test.yml

@@ -0,0 +1,31 @@
+# Manual alternative for bringing up the admin tests' database by hand.
+#
+# `npm run test:integration` does NOT use this file: test/integration/setup.ts
+# starts the container directly, because `podman compose` needs a separate
+# compose provider that neither podman nor docker ships, and one container needs
+# no orchestration. Keep the two in step, or delete this file if nobody uses it.
+#
+# Port 3307 and a throwaway data directory on purpose: it must never collide
+# with, or outlive, the dev database from docker-compose.dev.yml.
+services:
+  mariadb-test:
+    image: mariadb:11
+    environment:
+      MARIADB_ROOT_PASSWORD: roottestpassword
+      MARIADB_DATABASE: nachklang_admin
+      MARIADB_USER: nachklang
+      MARIADB_PASSWORD: testpassword
+    ports:
+      - "3307:3306"
+    tmpfs:
+      - /var/lib/mysql
+    volumes:
+      # Applied by the entrypoint on first boot, against MARIADB_DATABASE.
+      # This is the very migration production runs, so a mistake in it fails
+      # the test run rather than the deploy.
+      - ./sql/admin/001_init.sql:/docker-entrypoint-initdb.d/001_init.sql:ro
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 2s
+      timeout: 5s
+      retries: 30

docker/init/00-databases.sql

@@ -1,10 +1,12 @@
--- Local dev only. Creates the three databases + a dev user with full access.
+-- Local dev only. Creates the four databases + a dev user with full access.
 CREATE DATABASE IF NOT EXISTS nachklang_calendar CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
 CREATE DATABASE IF NOT EXISTS nachklang_feedback CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
 CREATE DATABASE IF NOT EXISTS nachklang_tickets CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+CREATE DATABASE IF NOT EXISTS nachklang_admin CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
 
 CREATE USER IF NOT EXISTS 'nachklang'@'%' IDENTIFIED BY 'devpassword';
 GRANT ALL PRIVILEGES ON nachklang_calendar.* TO 'nachklang'@'%';
 GRANT ALL PRIVILEGES ON nachklang_feedback.* TO 'nachklang'@'%';
 GRANT ALL PRIVILEGES ON nachklang_tickets.* TO 'nachklang'@'%';
+GRANT ALL PRIVILEGES ON nachklang_admin.* TO 'nachklang'@'%';
 FLUSH PRIVILEGES;

docker/init/04-admin-schema.sql

@@ -0,0 +1,164 @@
+-- Local dev only. Mirrors the table definitions in sql/admin/001_init.sql -
+-- keep the two in step - and seeds a ready-to-use dev account on top.
+USE nachklang_admin;
+
+CREATE TABLE IF NOT EXISTS `user` (
+	`id`            VARCHAR(36)  NOT NULL,
+	`name`          VARCHAR(255) NOT NULL,
+	`email`         VARCHAR(255) NOT NULL,
+	`emailVerified` TINYINT(1)   NOT NULL DEFAULT 0,
+	`image`         TEXT         DEFAULT NULL,
+	`createdAt`     DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	`updatedAt`     DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	-- Nachklang addition, declared through better-auth's additionalFields so
+	-- the adapter knows about it. Disabling also revokes the user's sessions.
+	`disabled`      TINYINT(1)   NOT NULL DEFAULT 0,
+	PRIMARY KEY (`id`),
+	UNIQUE KEY `user_email` (`email`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `session` (
+	`id`        VARCHAR(36)  NOT NULL,
+	`expiresAt` DATETIME     NOT NULL,
+	`token`     VARCHAR(255) NOT NULL,
+	`createdAt` DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	`updatedAt` DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	`ipAddress` VARCHAR(255) DEFAULT NULL,
+	`userAgent` TEXT         DEFAULT NULL,
+	`userId`    VARCHAR(36)  NOT NULL,
+	PRIMARY KEY (`id`),
+	UNIQUE KEY `session_token` (`token`),
+	KEY `session_user` (`userId`),
+	CONSTRAINT `session_user_fk` FOREIGN KEY (`userId`) REFERENCES `user` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `account` (
+	`id`                    VARCHAR(36)  NOT NULL,
+	-- 1.7 addition: distinguishes a local credential account
+	-- ("local:credential") from an OAuth issuer. Written by better-auth.
+	`issuer`                VARCHAR(255) NOT NULL,
+	`accountId`             VARCHAR(255) NOT NULL,
+	`providerId`            VARCHAR(255) NOT NULL,
+	`userId`                VARCHAR(36)  NOT NULL,
+	`accessToken`           TEXT         DEFAULT NULL,
+	`refreshToken`          TEXT         DEFAULT NULL,
+	`idToken`               TEXT         DEFAULT NULL,
+	`accessTokenExpiresAt`  DATETIME     DEFAULT NULL,
+	`refreshTokenExpiresAt` DATETIME     DEFAULT NULL,
+	`scope`                 TEXT         DEFAULT NULL,
+	`password`              TEXT         DEFAULT NULL,
+	`createdAt`             DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	`updatedAt`             DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	PRIMARY KEY (`id`),
+	KEY `account_user` (`userId`),
+	KEY `account_provider` (`providerId`, `accountId`),
+	CONSTRAINT `account_user_fk` FOREIGN KEY (`userId`) REFERENCES `user` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- Password-reset and e-mail-verification tokens.
+CREATE TABLE IF NOT EXISTS `verification` (
+	`id`         VARCHAR(36)  NOT NULL,
+	`identifier` VARCHAR(255) NOT NULL,
+	`value`      TEXT         NOT NULL,
+	`expiresAt`  DATETIME     NOT NULL,
+	`createdAt`  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	`updatedAt`  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	PRIMARY KEY (`id`),
+	KEY `verification_identifier` (`identifier`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `passkey` (
+	`id`           VARCHAR(36)  NOT NULL,
+	`name`         VARCHAR(255) DEFAULT NULL,
+	`publicKey`    TEXT         NOT NULL,
+	`userId`       VARCHAR(36)  NOT NULL,
+	`credentialID` VARCHAR(255) NOT NULL,
+	`counter`      INT          NOT NULL DEFAULT 0,
+	`deviceType`   VARCHAR(255) NOT NULL,
+	`backedUp`     TINYINT(1)   NOT NULL DEFAULT 0,
+	`transports`   VARCHAR(255) DEFAULT NULL,
+	`createdAt`    DATETIME     DEFAULT CURRENT_TIMESTAMP,
+	`aaguid`       VARCHAR(255) DEFAULT NULL,
+	PRIMARY KEY (`id`),
+	KEY `passkey_user` (`userId`),
+	KEY `passkey_credential` (`credentialID`),
+	CONSTRAINT `passkey_user_fk` FOREIGN KEY (`userId`) REFERENCES `user` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- Required by rateLimit.storage = 'database' in admin.auth.ts. Passenger may
+-- run several API instances, and an in-memory limiter would give each of them
+-- its own budget.
+CREATE TABLE IF NOT EXISTS `rateLimit` (
+	`id`          VARCHAR(36)  NOT NULL,
+	`key`         VARCHAR(255) NOT NULL,
+	`count`       INT          NOT NULL DEFAULT 0,
+	-- Epoch milliseconds, not a DATETIME: better-auth stores a number here.
+	`lastRequest` BIGINT       NOT NULL DEFAULT 0,
+	PRIMARY KEY (`id`),
+	UNIQUE KEY `rate_limit_key` (`key`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- ---------------------------------------------------------------------------
+-- Nachklang-owned tables
+-- ---------------------------------------------------------------------------
+
+-- Which apps a user may administer. `admin` is just another app: holding it is
+-- what lets someone manage users and invitations. `role` is reserved for
+-- per-app roles later and is 'admin' for every row today.
+CREATE TABLE IF NOT EXISTS `user_app_permissions` (
+	`user_id`    VARCHAR(36) NOT NULL,
+	`app`        ENUM('calendar','feedback','tickets','admin') NOT NULL,
+	`role`       VARCHAR(32) NOT NULL DEFAULT 'admin',
+	`granted_by` VARCHAR(36) DEFAULT NULL,
+	`granted_at` DATETIME    NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	PRIMARY KEY (`user_id`, `app`),
+	CONSTRAINT `uap_user_fk` FOREIGN KEY (`user_id`) REFERENCES `user` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- The only route to a new account: there is no public sign-up. Only the
+-- SHA-256 of the token is stored, so a dump of this table hands out no access.
+CREATE TABLE IF NOT EXISTS `invitations` (
+	`id`          INT AUTO_INCREMENT PRIMARY KEY,
+	`email`       VARCHAR(255) NOT NULL,
+	`name`        VARCHAR(255) NOT NULL,
+	`token_hash`  CHAR(64)     NOT NULL,
+	`apps`        JSON         NOT NULL,
+	`invited_by`  VARCHAR(36)  DEFAULT NULL,
+	`created_at`  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	`expires_at`  DATETIME     NOT NULL,
+	`accepted_at` DATETIME     DEFAULT NULL,
+	`revoked_at`  DATETIME     DEFAULT NULL,
+	UNIQUE KEY `inv_token_hash` (`token_hash`),
+	KEY `inv_email` (`email`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- ---------------------------------------------------------------------------
+-- Dev seed: dev@nachklang.art / devpassword, with every app permission.
+-- Local only - this account exists nowhere but in this container.
+--
+-- The password hash is better-auth's own scrypt format (salt:hash), produced
+-- with better-auth 1.7.2's hashPassword(). Regenerate it if better-auth ever
+-- changes that format; a hash it cannot parse shows up as "invalid password"
+-- on an otherwise correct sign-in.
+--
+-- `issuer` must be exactly 'local:credential' - it is how better-auth 1.7
+-- recognises a local password account when signing in.
+-- ---------------------------------------------------------------------------
+INSERT INTO `user` (`id`, `name`, `email`, `emailVerified`, `disabled`)
+VALUES ('dev-user-0000-0000-0000-000000000001', 'Dev Admin', 'dev@nachklang.art', 1, 0);
+
+INSERT INTO `account` (`id`, `issuer`, `accountId`, `providerId`, `userId`, `password`)
+VALUES (
+	'dev-acct-0000-0000-0000-000000000001',
+	'local:credential',
+	'dev-user-0000-0000-0000-000000000001',
+	'credential',
+	'dev-user-0000-0000-0000-000000000001',
+	'e6a0485feb04b8fa64453db87badd8e1:85aaffd845e1e44fabc5be97d684c0f533845ed11088bd3f4d533ef277ead71da8372b5c6a72c7eae2d48e3270c50e2d13cffa4fcfb0b5cec456100b8f007ed2'
+);
+
+INSERT INTO `user_app_permissions` (`user_id`, `app`, `role`) VALUES
+	('dev-user-0000-0000-0000-000000000001', 'calendar', 'admin'),
+	('dev-user-0000-0000-0000-000000000001', 'feedback', 'admin'),
+	('dev-user-0000-0000-0000-000000000001', 'tickets',  'admin'),
+	('dev-user-0000-0000-0000-000000000001', 'admin',    'admin');

docs/calendar-auth-migration.md

@@ -0,0 +1,74 @@
+# Migrating the Calendar domain onto the admin identity module
+
+Status: **not started.** Written 2026-09-05 alongside the admin module (step 2 of
+`docs/plan-admin-auth.md` in the nachklang-admin repo), which deliberately left the
+calendar alone.
+
+## Why the calendar was left out
+
+The admin module replaced authentication for feedback and tickets by swapping one
+middleware. The calendar cannot be done that way, because its user identity is woven into
+its data:
+
+- `users`/`sessions` live in the **calendar** database and are the same tables the
+  feedback and tickets admin areas used to authenticate against.
+- `events.created_by_id` is an **INT** foreign key into `users.user_id`. The admin module's
+  user ids are **VARCHAR(36)** strings. Migrating identity means migrating that column and
+  every query that joins it.
+- The Angular frontend passes `sessionId`/`sessionKey` as **query parameters**
+  (`DEFERRED_SECURITY.md` item 1). Cookie sessions remove the parameters entirely, so
+  every calendar route signature and the frontend's HTTP layer change together.
+- `credentials.service.ts` implements a second, parallel authorisation model: the
+  `MEMBER_CREDENTIAL` / `CHOIR_CREDENTIAL` / `MANAGEMENT_CREDENTIAL` shared secrets that
+  let non-users read specific calendars. That has no equivalent in the admin module and is
+  not a per-user permission at all.
+
+What already exists today: `calendar` is a value in the `user_app_permissions.app` enum, so
+permissions can be granted before anything else moves.
+
+## What is in place to build on
+
+- Cookie sessions across `*.nachklang.art`, and `requireAppAccess('calendar')` in
+  `src/models/admin/admin.middleware.ts` - usable the moment a calendar route wants it.
+- `res.locals.admin` is `{id, email, displayName, apps}`; `id` is the string user id.
+- Invitations, disable/enable and session revocation already cover calendar users, because
+  they are properties of the account rather than of an app.
+
+## Suggested sequence
+
+Each step is meant to leave production working on its own.
+
+1. **Add a bridging column.** `ALTER TABLE events ADD COLUMN created_by_user_id
+   VARCHAR(36) NULL`, indexed. Nothing reads it yet.
+2. **Map the accounts.** For every legacy `users` row that should survive, invite the
+   person through the admin UI. On acceptance, backfill `events.created_by_user_id` from
+   `events.created_by_id` via an email-to-new-id mapping. Everyone not re-invited keeps
+   working on the legacy path until step 4.
+3. **Dual-read.** Change `events.service.ts` to prefer `created_by_user_id` and fall back
+   to `created_by_id`. Writes fill both. This is the only step that is temporary code, and
+   it should carry a removal note pointing at step 5.
+4. **Switch the routes.** Replace the query-parameter session checks in
+   `events.router.ts` and `users.router.ts` with `requireAppAccess('calendar')`, and change
+   the Angular frontend to `withCredentials: true` against the same origin list. Deploy the
+   API first; the calendar frontend is broken between the two deploys, so pick a quiet
+   time. This closes `DEFERRED_SECURITY.md` item 1.
+5. **Drop the legacy path.** Remove `users.service.ts`'s session handling, the `sessions`
+   table, `created_by_id`, and the dual-read from step 3. Legacy `/calendar/users/*` stays
+   only if something still calls it - otherwise delete it too. `X-Session-Id` /
+   `X-Session-Key` can then come out of the CORS `allowedHeaders` list in
+   `src/app.factory.ts`.
+
+## Open questions to settle before starting
+
+- **The shared calendar credentials.** Do `MEMBER_CREDENTIAL` and friends stay as a
+  separate mechanism (they serve people with no account at all, and iCal clients that
+  cannot send headers), or do read-only accounts replace them? This is a product decision,
+  not a technical one, and it decides how much of `credentials.service.ts` survives.
+- **The iCal export.** `GET /calendar/events/{calendar}/ical` takes a password in the query
+  string on purpose, because iCal clients cannot send headers. Cookie sessions do not help
+  here; this endpoint likely keeps its own scheme.
+- **Which legacy accounts to keep.** Step 2 is the moment to not re-invite people who no
+  longer need access.
+- **`event_versions.version_created_by_id`.** The same INT reference again, joined in
+  `events.service.ts` for the "last modified by" name. It has to move with `events`, and it
+  is the reason step 1's bridging column needs a sibling on `event_versions`.

package.json

@@ -12,25 +12,31 @@
 		"build": "tsc",
 		"debug": "export DEBUG=* && npm run start",
 		"test": "vitest run --coverage",
-		"test:watch": "vitest"
+		"test:watch": "vitest",
+		"test:integration": "vitest run --config vitest.integration.config.ts"
 	},
 	"keywords": [],
 	"author": "",
 	"license": "ISC",
 	"dependencies": {
+		"@better-auth/passkey": "^1.7.2",
 		"app-root-path": "^3.0.0",
 		"axios": "^1.20.0",
 		"bcrypt": "^5.0.1",
+		"better-auth": "^1.7.2",
 		"cors": "^2.8.5",
 		"debug": "^4.3.1",
 		"dotenv": "^16.6.1",
 		"express": "^4.18.2",
 		"guid-typescript": "^1.0.9",
+		"kysely": "^0.29.5",
 		"mariadb": "^3.0.2",
+		"mysql2": "^3.24.3",
 		"random-words": "^1.1.1",
 		"swagger-jsdoc": "^6.1.0",
 		"swagger-ui-express": "^4.3.0",
-		"winston": "^3.3.3"
+		"winston": "^3.3.3",
+		"zod": "^4.5.4"
 	},
 	"devDependencies": {
 		"@types/app-root-path": "^1.2.4",
@@ -40,14 +46,21 @@
 		"@types/express": "^4.17.15",
 		"@types/node": "^26.4.1",
 		"@types/random-words": "^1.1.2",
+		"@types/supertest": "^7.2.1",
 		"@types/swagger-jsdoc": "^6.0.1",
 		"@types/swagger-ui-express": "^4.1.3",
 		"@types/winston": "^2.4.4",
 		"@vitest/coverage-v8": "^5.0.0",
 		"is-number": "^7.0.0",
 		"source-map-support": "^0.5.19",
+		"supertest": "^7.2.2",
 		"typescript": "^5.9.3",
 		"vitest": "^5.0.0",
 		"vitest-sonar-reporter": "^3.0.0"
+	},
+	"overrides": {
+		"better-auth": {
+			"vitest": "$vitest"
+		}
 	}
 }

sql/admin/001_init.sql

@@ -0,0 +1,144 @@
+-- nachklang_admin: identity, sessions and per-app permissions for every
+-- *.nachklang.art app.
+--
+-- The better-auth tables below (user, session, account, verification, passkey,
+-- rateLimit) mirror what better-auth 1.7.2 derives from the configuration in
+-- src/models/admin/admin.auth.ts, including the `disabled` additionalField on
+-- `user` and the `rateLimit` table that rateLimit.storage='database' requires.
+-- On every better-auth upgrade: re-derive the table list, diff it against this
+-- file, and add a numbered migration - never edit this one in place.
+--
+-- Table and column names are better-auth's own ("camel" casing, so `rateLimit`
+-- and `userId`). MariaDB on Linux compares table names case-sensitively, so the
+-- casing here is load-bearing. The two Nachklang-owned tables at the bottom use
+-- the snake_case convention of the rest of this repo's SQL.
+
+CREATE TABLE IF NOT EXISTS `user` (
+	`id`            VARCHAR(36)  NOT NULL,
+	`name`          VARCHAR(255) NOT NULL,
+	`email`         VARCHAR(255) NOT NULL,
+	`emailVerified` TINYINT(1)   NOT NULL DEFAULT 0,
+	`image`         TEXT         DEFAULT NULL,
+	`createdAt`     DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	`updatedAt`     DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	-- Nachklang addition, declared through better-auth's additionalFields so
+	-- the adapter knows about it. Disabling also revokes the user's sessions.
+	`disabled`      TINYINT(1)   NOT NULL DEFAULT 0,
+	PRIMARY KEY (`id`),
+	UNIQUE KEY `user_email` (`email`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `session` (
+	`id`        VARCHAR(36)  NOT NULL,
+	`expiresAt` DATETIME     NOT NULL,
+	`token`     VARCHAR(255) NOT NULL,
+	`createdAt` DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	`updatedAt` DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	`ipAddress` VARCHAR(255) DEFAULT NULL,
+	`userAgent` TEXT         DEFAULT NULL,
+	`userId`    VARCHAR(36)  NOT NULL,
+	PRIMARY KEY (`id`),
+	UNIQUE KEY `session_token` (`token`),
+	KEY `session_user` (`userId`),
+	CONSTRAINT `session_user_fk` FOREIGN KEY (`userId`) REFERENCES `user` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `account` (
+	`id`                    VARCHAR(36)  NOT NULL,
+	-- 1.7 addition: distinguishes a local credential account
+	-- ("local:credential") from an OAuth issuer. Written by better-auth.
+	`issuer`                VARCHAR(255) NOT NULL,
+	`accountId`             VARCHAR(255) NOT NULL,
+	`providerId`            VARCHAR(255) NOT NULL,
+	`userId`                VARCHAR(36)  NOT NULL,
+	`accessToken`           TEXT         DEFAULT NULL,
+	`refreshToken`          TEXT         DEFAULT NULL,
+	`idToken`               TEXT         DEFAULT NULL,
+	`accessTokenExpiresAt`  DATETIME     DEFAULT NULL,
+	`refreshTokenExpiresAt` DATETIME     DEFAULT NULL,
+	`scope`                 TEXT         DEFAULT NULL,
+	`password`              TEXT         DEFAULT NULL,
+	`createdAt`             DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	`updatedAt`             DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	PRIMARY KEY (`id`),
+	KEY `account_user` (`userId`),
+	KEY `account_provider` (`providerId`, `accountId`),
+	CONSTRAINT `account_user_fk` FOREIGN KEY (`userId`) REFERENCES `user` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- Password-reset and e-mail-verification tokens.
+CREATE TABLE IF NOT EXISTS `verification` (
+	`id`         VARCHAR(36)  NOT NULL,
+	`identifier` VARCHAR(255) NOT NULL,
+	`value`      TEXT         NOT NULL,
+	`expiresAt`  DATETIME     NOT NULL,
+	`createdAt`  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	`updatedAt`  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	PRIMARY KEY (`id`),
+	KEY `verification_identifier` (`identifier`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `passkey` (
+	`id`           VARCHAR(36)  NOT NULL,
+	`name`         VARCHAR(255) DEFAULT NULL,
+	`publicKey`    TEXT         NOT NULL,
+	`userId`       VARCHAR(36)  NOT NULL,
+	`credentialID` VARCHAR(255) NOT NULL,
+	`counter`      INT          NOT NULL DEFAULT 0,
+	`deviceType`   VARCHAR(255) NOT NULL,
+	`backedUp`     TINYINT(1)   NOT NULL DEFAULT 0,
+	`transports`   VARCHAR(255) DEFAULT NULL,
+	`createdAt`    DATETIME     DEFAULT CURRENT_TIMESTAMP,
+	`aaguid`       VARCHAR(255) DEFAULT NULL,
+	PRIMARY KEY (`id`),
+	KEY `passkey_user` (`userId`),
+	KEY `passkey_credential` (`credentialID`),
+	CONSTRAINT `passkey_user_fk` FOREIGN KEY (`userId`) REFERENCES `user` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- Required by rateLimit.storage = 'database' in admin.auth.ts. Passenger may
+-- run several API instances, and an in-memory limiter would give each of them
+-- its own budget.
+CREATE TABLE IF NOT EXISTS `rateLimit` (
+	`id`          VARCHAR(36)  NOT NULL,
+	`key`         VARCHAR(255) NOT NULL,
+	`count`       INT          NOT NULL DEFAULT 0,
+	-- Epoch milliseconds, not a DATETIME: better-auth stores a number here.
+	`lastRequest` BIGINT       NOT NULL DEFAULT 0,
+	PRIMARY KEY (`id`),
+	UNIQUE KEY `rate_limit_key` (`key`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- ---------------------------------------------------------------------------
+-- Nachklang-owned tables
+-- ---------------------------------------------------------------------------
+
+-- Which apps a user may administer. `admin` is just another app: holding it is
+-- what lets someone manage users and invitations. `role` is reserved for
+-- per-app roles later and is 'admin' for every row today.
+CREATE TABLE IF NOT EXISTS `user_app_permissions` (
+	`user_id`    VARCHAR(36) NOT NULL,
+	`app`        ENUM('calendar','feedback','tickets','admin') NOT NULL,
+	`role`       VARCHAR(32) NOT NULL DEFAULT 'admin',
+	`granted_by` VARCHAR(36) DEFAULT NULL,
+	`granted_at` DATETIME    NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	PRIMARY KEY (`user_id`, `app`),
+	CONSTRAINT `uap_user_fk` FOREIGN KEY (`user_id`) REFERENCES `user` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- The only route to a new account: there is no public sign-up. Only the
+-- SHA-256 of the token is stored, so a dump of this table hands out no access.
+CREATE TABLE IF NOT EXISTS `invitations` (
+	`id`          INT AUTO_INCREMENT PRIMARY KEY,
+	`email`       VARCHAR(255) NOT NULL,
+	`name`        VARCHAR(255) NOT NULL,
+	`token_hash`  CHAR(64)     NOT NULL,
+	`apps`        JSON         NOT NULL,
+	`invited_by`  VARCHAR(36)  DEFAULT NULL,
+	`created_at`  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	`expires_at`  DATETIME     NOT NULL,
+	`accepted_at` DATETIME     DEFAULT NULL,
+	`revoked_at`  DATETIME     DEFAULT NULL,
+	UNIQUE KEY `inv_token_hash` (`token_hash`),
+	KEY `inv_email` (`email`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

src/app.factory.ts

@@ -0,0 +1,138 @@
+import express from 'express';
+import * as dotenv from 'dotenv';
+import swaggerUi from 'swagger-ui-express';
+import swaggerJSDoc from 'swagger-jsdoc';
+import cors from 'cors';
+import {toNodeHandler} from 'better-auth/node';
+
+// Router imports
+import {calendarRouter} from './models/calendar/Calendar.router.js';
+import {feedbackRouter} from './models/feedback/Feedback.router.js';
+import {ticketsRouter} from './models/tickets/Tickets.router.js';
+import {adminRouter} from './models/admin/Admin.router.js';
+import {auth} from './models/admin/admin.auth.js';
+import {ADMIN_ALLOWED_ORIGINS} from './models/admin/admin.config.js';
+
+
+dotenv.config();
+
+
+/**
+ * Builds the Express app with every router and middleware in place.
+ *
+ * Separate from app.ts so the integration tests can drive the *real* wiring
+ * with supertest instead of a hand-rolled copy of it. The order below is not
+ * cosmetic - CORS has to precede the better-auth handler so preflights get
+ * their headers, and the better-auth handler has to precede express.json()
+ * because it reads the raw body stream itself.
+ */
+export const createApp = (): express.Application => {
+	const app: express.Application = express();
+
+	// Behind Plesk's nginx, req.ip is the proxy unless we trust the forwarded header.
+	// Verify the resolved client IP is correct in staging before relying on it
+	// (used by the feedback rate limiter).
+	app.set('trust proxy', 1);
+
+	// Configure CORS. This has to run before the better-auth handler below, so
+	// that preflights for /admin/auth/* get their headers, which is why it now
+	// sits above express.json() instead of after it.
+	let allowedHosts = [
+		'https://www.nachklang.art',
+		'https://calendar.nachklang.art',
+		'https://feedback.nachklang.art',
+		'https://tickets.nachklang.art',
+		'https://admin.nachklang.art',
+		// The admin app's origin comes from ADMIN_APP_URL, so a rename or a
+		// staging host does not need a code change here.
+		...ADMIN_ALLOWED_ORIGINS
+	];
+	const isDev = process.env.NODE_ENV !== 'production';
+	const localhostRegex = /^http:\/\/localhost:\d+$/;
+	// Matches http://<private-LAN-IPv4>:<port> - needed so the feedback form can
+	// be reached from a real phone over WiFi during dev (the phone's Origin is
+	// the dev machine's LAN IP, never "localhost"). Dev-only, same as above.
+	const lanIpRegex = /^http:\/\/(192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}):\d+$/;
+	app.use(cors({
+		// X-Session-* stay allowed until the calendar module is migrated off the
+		// legacy header sessions (see docs/calendar-auth-migration.md).
+		allowedHeaders: ['Content-Type', 'X-Session-Id', 'X-Session-Key'],
+		// The admin session lives in a cookie, so browsers must be allowed to send
+		// it cross-origin - this is what makes credentials: 'include' work.
+		credentials: true,
+		origin: function (origin: any, callback: any) {
+			// Allow requests with no origin
+			if (!origin) return callback(null, true);
+
+			// Any localhost port, or a private-LAN IP, is fine outside production -
+			// dev servers pick whatever port is free (Next.js falls back from 3000
+			// if it's taken), and real-device testing hits the dev machine by IP.
+			if (isDev && (localhostRegex.test(origin) || lanIpRegex.test(origin))) {
+				return callback(null, true);
+			}
+
+			// Block requests with wrong origin
+			if (allowedHosts.indexOf(origin) === -1) {
+				return callback(new Error('The CORS policy doesn\'t allow access for your origin.'), false);
+			}
+
+			// Allow all other requests
+			return callback(null, true);
+		}
+	}));
+
+	// better-auth's own handler, mounted before express.json(): it reads the raw
+	// request body stream itself and a parsed body would leave it hanging.
+	app.all('/admin/auth/*', toNodeHandler(auth));
+
+	// here we are adding middleware to parse all incoming requests as JSON
+	app.use(express.json());
+
+	// Swagger documentation
+	const swaggerDefinition = {
+		openapi: '3.0.0',
+		info: {
+			title: 'Nachklang e.V. REST API',
+			version: '1.0.0',
+			license: {
+				name: 'Licensed Under MIT',
+				url: 'https://spdx.org/licenses/MIT.html'
+			},
+			contact: {
+				name: 'Nachklang e.V.',
+				url: 'https://www.nachklang.art'
+			}
+		}
+	};
+
+	const options = {
+		swaggerDefinition,
+		// Paths to files containing OpenAPI definitions
+		apis: [
+			'./src/models/**/*.interface.ts',
+			'./src/models/**/*.router.ts'
+		]
+	};
+
+	const swaggerSpec = swaggerJSDoc(options);
+
+	app.use(
+		'/docs',
+		swaggerUi.serve,
+		swaggerUi.setup(swaggerSpec)
+	);
+
+	// Add routers
+	app.use('/calendar', calendarRouter);
+	app.use('/feedback', feedbackRouter);
+	app.use('/tickets', ticketsRouter);
+	// JSON routes only; the auth handler above is mounted separately.
+	app.use('/admin', adminRouter);
+
+	// this is a simple route to make sure everything is working properly
+	app.get('/', (req: express.Request, res: express.Response) => {
+		res.status(200).send('Welcome to the Nachklang e.V. REST API!');
+	});
+
+	return app;
+};

src/models/admin/Admin.db.ts

@@ -0,0 +1,55 @@
+import * as dotenv from 'dotenv';
+import mysql from 'mysql2';
+import {Kysely, MysqlDialect} from 'kysely';
+import {AdminDatabase} from './admin.schema.js';
+import logger from '../../middleware/logger.js';
+
+dotenv.config();
+
+/**
+ * The admin module is the one place in this API that does not use the
+ * `mariadb` driver: better-auth talks to the database through Kysely, whose
+ * MySQL dialect expects a mysql2 pool. The other domains keep their own
+ * `mariadb` pools (see Feedback.db.ts) - this is an addition, not a migration.
+ *
+ * The pool is the callback-style `mysql2` one, NOT `mysql2/promise`: Kysely's
+ * MysqlDialect calls `pool.getConnection((err, conn) => ...)`. The promise
+ * wrapper ignores that callback and returns a Promise instead, so every query
+ * through Kysely would hang forever with no error - which is exactly what it
+ * did until the integration tests caught it.
+ *
+ * timezone 'Z' matters: better-auth computes session and token expiry in UTC.
+ * Without it mysql2 would write and read those DATETIMEs in the process's local
+ * zone, so sessions would expire an hour early or late depending on DST.
+ */
+
+export namespace NachklangAdminDB {
+	export const pool = mysql.createPool({
+		host: process.env.DB_HOST,
+		user: process.env.DB_USER,
+		password: process.env.DB_PASSWORD,
+		database: process.env.ADMIN_DB,
+		// The other modules' pools default to 3306. This one is configurable so
+		// the integration tests can point at a throwaway container on another
+		// port without touching a developer's real .env.
+		port: parseInt(process.env.DB_PORT || '3306', 10),
+		connectionLimit: 5,
+		timezone: 'Z'
+	});
+
+	// mysql2 emits connection trouble as an event on the pool, not only as a
+	// rejected query. Without a listener Node turns that into an
+	// uncaughtException, so a database restart would take the whole API - and
+	// with it the calendar, feedback and tickets domains - down with it.
+	// Individual queries still reject, and their callers still answer 500.
+	pool.on('error', (err: unknown) => {
+		logger.error('Admin database pool error', {detail: (err as any)?.message});
+	});
+
+	// Handed to better-auth as `database: {dialect, type: 'mysql'}`.
+	export const dialect = new MysqlDialect({pool});
+
+	// Used by this module's own services for the two custom tables and for
+	// permission lookups that join better-auth's `user`.
+	export const db = new Kysely<AdminDatabase>({dialect});
+}

src/models/admin/Admin.router.ts

@@ -0,0 +1,43 @@
+import express, {Request, Response} from 'express';
+import {requireAppAccess, requireSignedIn} from './admin.middleware.js';
+import {usersAdminRouter} from './users/users.admin.router.js';
+import {invitationsRouter} from './invitations/invitations.router.js';
+
+/**
+ * The admin module's JSON routes. Deliberately *not* the better-auth handler:
+ * that one is mounted separately in app.ts, ahead of express.json(), because it
+ * needs the raw request body stream.
+ *
+ * Mounted at /admin, so the tree is:
+ *   /admin/me            any signed-in account
+ *   /admin/users/*       admin permission
+ *   /admin/invitations/* admin permission
+ */
+export const adminRouter = express.Router();
+
+/**
+ * @swagger
+ * /admin/me:
+ *      get:
+ *          summary: The current user's identity and app permissions
+ *          description: Used by every frontend to decide what to show. The API remains the real gate.
+ *          tags: [admin]
+ *          responses:
+ *              200:
+ *                  description: Success
+ *              401:
+ *                  description: Not signed in
+ *              403:
+ *                  description: Account disabled
+ */
+adminRouter.get('/me', requireSignedIn, (req: Request, res: Response) => {
+	res.status(200).send({
+		id: res.locals.admin.id,
+		email: res.locals.admin.email,
+		fullName: res.locals.admin.displayName,
+		apps: res.locals.admin.apps
+	});
+});
+
+adminRouter.use('/users', requireAppAccess('admin'), usersAdminRouter);
+adminRouter.use('/invitations', requireAppAccess('admin'), invitationsRouter);

src/models/admin/admin.auth.ts

@@ -0,0 +1,141 @@
+import {betterAuth} from 'better-auth';
+import {APIError} from 'better-auth/api';
+import {passkey} from '@better-auth/passkey';
+import {NachklangAdminDB} from './Admin.db.js';
+import {invitationsPlugin} from './invitations/invitations.plugin.js';
+import {sendPasswordResetMail} from './admin.mail.js';
+import * as UsersService from './users/users.admin.service.js';
+import logger from '../../middleware/logger.js';
+import {
+	ADMIN_ALLOWED_ORIGINS,
+	API_BASE_URL,
+	BETTER_AUTH_SECRET,
+	PASSKEY_RP_ID,
+	isProd
+} from './admin.config.js';
+
+/**
+ * The single better-auth instance for all *.nachklang.art apps. Mounted in
+ * app.ts at /admin/auth/* with better-auth's own node handler, ahead of
+ * express.json() (it needs the raw body stream).
+ *
+ * The session cookie is what every app trusts. Everything else in this module -
+ * permissions, invitations, the admin UI - hangs off it.
+ */
+
+const DAY = 60 * 60 * 24;
+
+// Dev runs the apps on plain localhost ports; cookies ignore the port, so
+// single-sign-on across them works without fake subdomains or mkcert.
+const localhostOrigins = [
+	'http://localhost:3000',
+	'http://localhost:3001',
+	'http://localhost:3002',
+	'http://localhost:3003'
+];
+
+const trustedOrigins = isProd
+	? ADMIN_ALLOWED_ORIGINS
+	: Array.from(new Set([...ADMIN_ALLOWED_ORIGINS, ...localhostOrigins]));
+
+export const auth = betterAuth({
+	appName: 'Nachklang',
+	database: {
+		dialect: NachklangAdminDB.dialect,
+		type: 'mysql'
+	},
+	basePath: '/admin/auth',
+	// Mandatory once crossSubDomainCookies is on: better-auth derives the
+	// cookie domain and its own absolute URLs from this.
+	baseURL: API_BASE_URL,
+	secret: BETTER_AUTH_SECRET,
+	trustedOrigins,
+
+	emailAndPassword: {
+		enabled: true,
+		// There is no public sign-up: accounts exist only through an
+		// invitation (see invitations.plugin.ts). This also makes
+		// auth.api.signUpEmail throw, which is intended.
+		disableSignUp: true,
+		sendResetPassword: async ({user, url}) => {
+			await sendPasswordResetMail(user.email, user.name, url);
+		}
+	},
+
+	user: {
+		additionalFields: {
+			// Not `returned`, and not settable through the API: disabling is an
+			// admin action on /admin/users/:id/disable, never something a
+			// session owner can flip on themselves.
+			disabled: {
+				type: 'boolean',
+				defaultValue: false,
+				input: false,
+				returned: false
+			}
+		}
+	},
+
+	session: {
+		expiresIn: 30 * DAY,
+		updateAge: DAY
+		// Deliberately no cookieCache: requireAppAccess hits the database on
+		// every request anyway, and a cached session would keep a disabled
+		// user or a revoked session alive for the cache's lifetime.
+	},
+
+	advanced: {
+		// Fixes the cookie name across releases so the frontends' middleware can
+		// check for it: "nachklang.session_token", or
+		// "__Secure-nachklang.session_token" over https.
+		cookiePrefix: 'nachklang',
+		crossSubDomainCookies: isProd
+			? {enabled: true, domain: '.nachklang.art'}
+			: {enabled: false},
+		ipAddress: {
+			// better-auth reads the request itself and does not know about
+			// Express's `trust proxy`, so the header has to be named here.
+			// Verify against what Plesk's nginx actually sets before relying on
+			// the rate limiter (see the plan's pre-deploy checklist).
+			ipAddressHeaders: ['x-real-ip', 'x-forwarded-for']
+		}
+	},
+
+	rateLimit: {
+		enabled: true,
+		// Passenger may run more than one instance; an in-memory limiter would
+		// then give each of them its own budget.
+		storage: 'database'
+	},
+
+	plugins: [
+		passkey({
+			rpID: PASSKEY_RP_ID,
+			rpName: 'Nachklang',
+			origin: ADMIN_ALLOWED_ORIGINS
+		}),
+		invitationsPlugin()
+	],
+
+	databaseHooks: {
+		session: {
+			create: {
+				before: async session => {
+					const access = await UsersService.loadAccess(session.userId);
+					if (access?.disabled) {
+						logger.warn('Admin: sign-in attempt by a disabled account', {userId: session.userId});
+						// Throwing rather than returning false: `false` aborts
+						// the session write silently and the caller sees a
+						// confusing success-shaped response with no cookie.
+						throw new APIError('FORBIDDEN', {
+							code: 'ACCOUNT_DISABLED',
+							message: 'Dieses Konto ist deaktiviert.'
+						});
+					}
+				}
+			}
+		}
+	}
+});
+
+export type AdminAuth = typeof auth;

src/models/admin/admin.bootstrap.ts

@@ -0,0 +1,67 @@
+import * as UsersService from './users/users.admin.service.js';
+import * as InvitationsService from './invitations/invitations.service.js';
+import {sendInvitationMail} from './admin.mail.js';
+import {ADMIN_APP_URL, ADMIN_BOOTSTRAP_EMAIL, isProd} from './admin.config.js';
+import logger from '../../middleware/logger.js';
+
+/**
+ * Solves the empty-database problem: with invite-only accounts and no public
+ * sign-up, a fresh nachklang_admin has nobody who can invite anybody. Rather
+ * than a CLI script somebody has to remember to run against production, the API
+ * makes sure on every start that ADMIN_BOOTSTRAP_EMAIL can get in.
+ *
+ * Idempotent by design - it is safe on every restart:
+ *   - an active admin already exists  -> do nothing
+ *   - the address exists as a user    -> grant it `admin`
+ *   - an open invitation exists       -> do nothing (do not re-mail on restart)
+ *   - otherwise                       -> invite, and mail the link
+ *
+ * Never throws: a database blip at boot must not stop the API from serving the
+ * calendar, feedback and tickets domains.
+ */
+export const bootstrapAdmin = async (): Promise<void> => {
+	try {
+		if (!ADMIN_BOOTSTRAP_EMAIL) {
+			return;
+		}
+
+		const email = ADMIN_BOOTSTRAP_EMAIL.trim().toLowerCase();
+
+		if ((await UsersService.countActiveAdmins()) > 0) {
+			return;
+		}
+
+		const existing = await UsersService.findUserByEmail(email);
+		if (existing) {
+			await UsersService.grantPermission(existing.id, 'admin', null);
+			logger.info('Admin bootstrap: granted the admin permission to the existing bootstrap user', {email});
+			return;
+		}
+
+		// An expired invitation is not "open", so the next restart re-issues
+		// one - which is the recovery path if the first mail never arrived.
+		if (await InvitationsService.hasOpenInvitationFor(email)) {
+			logger.info('Admin bootstrap: an open invitation already exists', {email});
+			return;
+		}
+
+		const invitation = await InvitationsService.createInvitation(
+			email,
+			'Nachklang Admin',
+			['admin'],
+			null
+		);
+
+		const mailed = await sendInvitationMail(email, 'Nachklang Admin', invitation.token, invitation.expiresAt);
+		logger.info('Admin bootstrap: invitation created', {email, mailed});
+
+		// Outside production the Salesforce mail relay is usually off, so the
+		// link is logged instead - that is how a local setup gets its first
+		// admin. Never in production: the log would then hold a live credential.
+		if (!isProd) {
+			logger.info(`Admin bootstrap: ${ADMIN_APP_URL}/accept-invite?token=${invitation.token}`);
+		}
+	} catch (e: any) {
+		logger.error('Admin bootstrap failed', {detail: e?.message});
+	}
+};

src/models/admin/admin.config.ts

@@ -0,0 +1,63 @@
+import * as dotenv from 'dotenv';
+import logger from '../../middleware/logger.js';
+
+dotenv.config();
+
+/**
+ * One place that reads the admin module's environment. Both admin.auth.ts
+ * (better-auth trustedOrigins, passkey origins) and app.ts (CORS) need the
+ * same origin list, and a second parser would drift from this one.
+ *
+ * In production every value is mandatory: a missing BETTER_AUTH_SECRET or a
+ * wrong ADMIN_APP_URL is the kind of misconfiguration that fails as "login
+ * silently does nothing" hours later, so it fails at boot instead. In dev the
+ * localhost defaults below let a fresh checkout run without an .env.
+ */
+
+export const isProd = process.env.NODE_ENV === 'production';
+
+const required = (name: string, devDefault: string): string => {
+	const value = process.env[name];
+	if (value) {
+		return value;
+	}
+	if (isProd) {
+		logger.error(`Admin module: ${name} is not set`);
+		throw new Error(`${name} must be set in production`);
+	}
+	return devDefault;
+};
+
+export const API_BASE_URL = required('API_BASE_URL', 'http://localhost:3000');
+export const ADMIN_APP_URL = required('ADMIN_APP_URL', 'http://localhost:3002');
+
+// 32+ random bytes; better-auth signs cookies and reset tokens with it.
+// Rotating it invalidates every session, which is why it is not derived.
+export const BETTER_AUTH_SECRET = required(
+	'BETTER_AUTH_SECRET',
+	'dev-only-insecure-secret-do-not-use-in-production'
+);
+
+// Passkeys are bound to this: a credential registered for "nachklang.art"
+// works on every *.nachklang.art host, one registered for "localhost" only
+// works in dev. Changing it invalidates every registered passkey.
+export const PASSKEY_RP_ID = process.env.PASSKEY_RP_ID || (isProd ? 'nachklang.art' : 'localhost');
+
+// The apps whose frontends may talk to /admin/* with credentials.
+const parseOrigins = (value: string | undefined): string[] => {
+	return (value || '')
+		.split(',')
+		.map(origin => origin.trim().replace(/\/$/, ''))
+		.filter(origin => origin.length > 0);
+};
+
+export const APP_ORIGINS = parseOrigins(process.env.APP_ORIGINS);
+
+// Kept in sync by construction rather than by three separate lists: the admin
+// app itself always counts, and dev adds the local ports.
+export const ADMIN_ALLOWED_ORIGINS = Array.from(new Set([
+	ADMIN_APP_URL.replace(/\/$/, ''),
+	...APP_ORIGINS
+]));
+
+export const ADMIN_BOOTSTRAP_EMAIL = process.env.ADMIN_BOOTSTRAP_EMAIL || '';

src/models/admin/admin.errors.ts

@@ -0,0 +1,17 @@
+import {Response} from 'express';
+import {Guid} from 'guid-typescript';
+import logger from '../../middleware/logger.js';
+
+/**
+ * Same catch-block convention as the feedback and tickets modules: log with a
+ * reference guid, never hand the real error message to the client.
+ */
+export const sendServerError = (res: Response, e: any): void => {
+	const errorGuid = Guid.create().toString();
+	logger.error('Error handling a request: ' + e.message, {reference: errorGuid});
+	res.status(500).send({
+		status: 'PROCESSING_ERROR',
+		message: 'Internal Server Error. Try again later.',
+		reference: errorGuid
+	});
+};

src/models/admin/admin.interface.ts

@@ -0,0 +1,120 @@
+/**
+ * Swagger component definitions for the admin module. Picked up by
+ * swagger-jsdoc through the `src/models/**\/*.interface.ts` glob in
+ * app.factory.ts.
+ *
+ * Note what is *not* documented here: the better-auth routes under
+ * /admin/auth/* (sign-in, sign-out, reset-password, passkey ceremonies, and
+ * the invitation preview/accept endpoints). better-auth owns those paths and
+ * their shapes; duplicating them by hand would only drift on the next upgrade.
+ */
+
+/**
+ * @swagger
+ * components:
+ *   securitySchemes:
+ *     AdminSessionCookie:
+ *       type: apiKey
+ *       in: cookie
+ *       name: nachklang.session_token
+ *       description: >
+ *         Set by /admin/auth/sign-in/email. Over https the name is
+ *         __Secure-nachklang.session_token and the cookie is scoped to
+ *         .nachklang.art, so one sign-in covers every *.nachklang.art app.
+ *   schemas:
+ *     AdminApp:
+ *       type: string
+ *       enum: [calendar, feedback, tickets, admin]
+ *       description: Holding "admin" is what allows managing users and invitations.
+ *     AdminMe:
+ *       type: object
+ *       properties:
+ *         id:
+ *           type: string
+ *         email:
+ *           type: string
+ *         fullName:
+ *           type: string
+ *         apps:
+ *           type: array
+ *           items:
+ *             $ref: '#/components/schemas/AdminApp'
+ *     AdminUserSession:
+ *       type: object
+ *       properties:
+ *         id:
+ *           type: string
+ *         createdAt:
+ *           type: string
+ *           format: date-time
+ *         expiresAt:
+ *           type: string
+ *           format: date-time
+ *         ipAddress:
+ *           type: string
+ *           nullable: true
+ *         userAgent:
+ *           type: string
+ *           nullable: true
+ *     AdminUser:
+ *       type: object
+ *       properties:
+ *         id:
+ *           type: string
+ *         email:
+ *           type: string
+ *         name:
+ *           type: string
+ *         apps:
+ *           type: array
+ *           items:
+ *             $ref: '#/components/schemas/AdminApp'
+ *         status:
+ *           type: string
+ *           enum: [aktiv, deaktiviert]
+ *           description: Derived - there is no status column.
+ *         createdAt:
+ *           type: string
+ *           format: date-time
+ *         lastSignInAt:
+ *           type: string
+ *           format: date-time
+ *           nullable: true
+ *           description: Newest session's creation time; null once every session has expired.
+ *     AdminUserDetail:
+ *       allOf:
+ *         - $ref: '#/components/schemas/AdminUser'
+ *         - type: object
+ *           properties:
+ *             sessions:
+ *               type: array
+ *               items:
+ *                 $ref: '#/components/schemas/AdminUserSession'
+ *             passkeyCount:
+ *               type: integer
+ *     AdminInvitation:
+ *       type: object
+ *       description: An open invitation. The token itself is never returned by any endpoint.
+ *       properties:
+ *         id:
+ *           type: integer
+ *         email:
+ *           type: string
+ *         name:
+ *           type: string
+ *         apps:
+ *           type: array
+ *           items:
+ *             $ref: '#/components/schemas/AdminApp'
+ *         invitedBy:
+ *           type: string
+ *           nullable: true
+ *           description: Null for the invitation created by the ADMIN_BOOTSTRAP_EMAIL bootstrap.
+ *         createdAt:
+ *           type: string
+ *           format: date-time
+ *         expiresAt:
+ *           type: string
+ *           format: date-time
+ */
+export {};

src/models/admin/admin.mail.ts

@@ -0,0 +1,124 @@
+import {MailService} from '../../common/common.mail.js';
+import {ADMIN_APP_URL} from './admin.config.js';
+
+/**
+ * The two transactional mails the admin module sends. Both go out through the
+ * shared MailService (Salesforce relay, see common.mail.ts), which never throws
+ * on a delivery failure - the invitation row and the reset token are already
+ * committed by the time we get here.
+ *
+ * HTML plus a plain-text body: the text part is not a fallback afterthought,
+ * it is what allowlist-based receivers and text-only clients actually show.
+ */
+
+const escapeHtml = (value: string): string => {
+	return value
+		.replace(/&/g, '&')
+		.replace(/</g, '&lt;')
+		.replace(/>/g, '&gt;')
+		.replace(/"/g, '&quot;');
+};
+
+// `heading` is escaped here; `paragraphs` are not, because callers pass markup
+// (a <strong> around the expiry date) and escape their own interpolations.
+const layout = (heading: string, paragraphs: string[], buttonLabel: string, buttonUrl: string): string => {
+	const body = paragraphs.map(p => `<p style="margin:0 0 16px;">${p}</p>`).join('');
+	return `<!doctype html>
+<html lang="de">
+<body style="margin:0;padding:24px;background:#f5f5f4;font-family:Helvetica,Arial,sans-serif;color:#1c1917;">
+<div style="max-width:520px;margin:0 auto;background:#ffffff;border-radius:8px;padding:32px;">
+<h1 style="margin:0 0 24px;font-size:20px;">${escapeHtml(heading)}</h1>
+${body}
+<p style="margin:24px 0;">
+<a href="${escapeHtml(buttonUrl)}" style="display:inline-block;background:#1c1917;color:#ffffff;text-decoration:none;padding:12px 20px;border-radius:6px;">${escapeHtml(buttonLabel)}</a>
+</p>
+<p style="margin:0;font-size:13px;color:#57534e;">Falls der Button nicht funktioniert, kopiere diesen Link in deinen Browser:<br>
+<span style="word-break:break-all;">${escapeHtml(buttonUrl)}</span></p>
+</div>
+</body>
+</html>`;
+};
+
+/**
+ * Invitation mail. The link carries the raw token in the query string; the
+ * admin app strips it from the URL as soon as it has read it (see the plan's
+ * §3b - the token must never reach an API access log or a Referer header).
+ */
+export const sendInvitationMail = async (
+	recipientAddress: string,
+	name: string,
+	token: string,
+	expiresAt: Date
+): Promise<boolean> => {
+	const url = `${ADMIN_APP_URL}/accept-invite?token=${encodeURIComponent(token)}`;
+	const expiry = expiresAt.toLocaleDateString('de-DE', {day: '2-digit', month: '2-digit', year: 'numeric'});
+	const subject = 'Dein Zugang zu Nachklang';
+
+	const text = [
+		`Hallo ${name},`,
+		'',
+		'du wurdest eingeladen, ein Nachklang-Konto anzulegen. Über diesen Link vergibst du dein Passwort:',
+		'',
+		url,
+		'',
+		`Der Link ist bis zum ${expiry} gültig.`,
+		'',
+		'Wenn du damit nichts anfangen kannst, ignoriere diese E-Mail einfach.',
+		'',
+		'Viele Grüße',
+		'Nachklang e.V.'
+	].join('\n');
+
+	const html = layout(
+		`Hallo ${name},`,
+		[
+			'du wurdest eingeladen, ein Nachklang-Konto anzulegen. Über den Button vergibst du dein Passwort.',
+			`Der Link ist bis zum <strong>${escapeHtml(expiry)}</strong> gültig.`,
+			'Wenn du damit nichts anfangen kannst, ignoriere diese E-Mail einfach.'
+		],
+		'Konto einrichten',
+		url
+	);
+
+	return MailService.sendMail(recipientAddress, subject, text, {html});
+};
+
+/**
+ * Password reset. better-auth builds the URL (it embeds its own token and the
+ * redirectTo the admin app passed), so this only wraps it in our templates.
+ */
+export const sendPasswordResetMail = async (
+	recipientAddress: string,
+	name: string,
+	url: string
+): Promise<boolean> => {
+	const subject = 'Passwort zurücksetzen';
+
+	const text = [
+		`Hallo ${name},`,
+		'',
+		'über diesen Link kannst du ein neues Passwort vergeben:',
+		'',
+		url,
+		'',
+		'Der Link ist eine Stunde gültig.',
+		'',
+		'Wenn du kein neues Passwort angefordert hast, ist nichts passiert - ignoriere diese E-Mail.',
+		'',
+		'Viele Grüße',
+		'Nachklang e.V.'
+	].join('\n');
+
+	const html = layout(
+		`Hallo ${name},`,
+		[
+			'über den Button kannst du ein neues Passwort vergeben.',
+			'Der Link ist eine Stunde gültig.',
+			'Wenn du kein neues Passwort angefordert hast, ist nichts passiert - ignoriere diese E-Mail.'
+		],
+		'Neues Passwort vergeben',
+		url
+	);
+
+	return MailService.sendMail(recipientAddress, subject, text, {html});
+};

src/models/admin/admin.middleware.ts

@@ -0,0 +1,124 @@
+import express from 'express';
+import {fromNodeHeaders} from 'better-auth/node';
+import {auth} from './admin.auth.js';
+import * as UsersService from './users/users.admin.service.js';
+import {AppName} from './admin.schema.js';
+import {sendServerError} from './admin.errors.js';
+
+/**
+ * The one authenticator for every admin area in this API. It replaces
+ * feedback.auth.ts and tickets.auth.ts, which each re-implemented the same
+ * header-session check against the calendar users table.
+ *
+ * Two things are checked on every request, deliberately without any caching:
+ * that the session cookie is valid (better-auth), and that the user is still
+ * enabled and still holds the permission for this app (one database query).
+ * That is what makes "disable a user" and "revoke a session" take effect
+ * immediately rather than whenever a cached session happens to expire.
+ */
+
+// The shape the feedback and tickets services already expect - unchanged, so
+// nothing downstream of the authenticator needs to know this file replaced
+// their own.
+export interface AdminIdentity {
+	id: string;
+	email: string;
+	displayName: string;
+}
+
+export interface AdminAccess extends AdminIdentity {
+	disabled: boolean;
+	apps: AppName[];
+}
+
+const unauthorized = (res: express.Response): void => {
+	res.status(401).send({status: 'UNAUTHORIZED', message: 'Anmeldung erforderlich.'});
+};
+
+const forbidden = (res: express.Response, message: string): void => {
+	res.status(403).send({status: 'FORBIDDEN', message});
+};
+
+/**
+ * Resolves the session cookie to a user with their permissions, or null.
+ * One database query, no cache. Throws only on infrastructure errors.
+ */
+export const resolveAccess = async (req: express.Request): Promise<AdminAccess | null> => {
+	const session = await auth.api.getSession({headers: fromNodeHeaders(req.headers)});
+	if (!session?.user) {
+		return null;
+	}
+
+	const access = await UsersService.loadAccess(session.user.id);
+	if (!access) {
+		return null;
+	}
+
+	return {
+		id: access.id,
+		email: access.email,
+		displayName: access.displayName,
+		disabled: access.disabled,
+		apps: access.apps
+	};
+};
+
+/**
+ * Any signed-in account, no permission required. Used by /admin/me and the
+ * account-management routes: a user with no app permissions at all still has
+ * to be able to see that, and to manage their own password and passkeys.
+ *
+ * The disabled check is not redundant with the session-create hook: that hook
+ * stops a disabled user from signing in, this stops one who was disabled while
+ * holding a live cookie. Disabling revokes sessions, so the window is small -
+ * but "small" is not "closed".
+ */
+export const requireSignedIn: express.RequestHandler = async (req, res, next) => {
+	try {
+		const access = await resolveAccess(req);
+		if (!access) {
+			unauthorized(res);
+			return;
+		}
+		if (access.disabled) {
+			forbidden(res, 'Dieses Konto ist deaktiviert.');
+			return;
+		}
+
+		res.locals.admin = access;
+		next();
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+};
+
+/**
+ * The gate every admin area sits behind. `requireAppAccess('feedback')` is
+ * what feedback.auth.ts's requireAdminAuth used to be, except that it now
+ * answers 403 for a signed-in user without that app's permission instead of
+ * letting any activated @nachklang.art account in.
+ */
+export const requireAppAccess = (app: AppName): express.RequestHandler => {
+	return async (req, res, next) => {
+		try {
+			const access = await resolveAccess(req);
+			if (!access) {
+				unauthorized(res);
+				return;
+			}
+			if (access.disabled) {
+				forbidden(res, 'Dieses Konto ist deaktiviert.');
+				return;
+			}
+			if (!access.apps.includes(app)) {
+				forbidden(res, 'Für diesen Bereich fehlt dir die Berechtigung.');
+				return;
+			}
+
+			res.locals.admin = access;
+			next();
+		} catch (e: any) {
+			sendServerError(res, e);
+		}
+	};
+};

src/models/admin/admin.schema.ts

@@ -0,0 +1,81 @@
+import {Generated} from 'kysely';
+
+/**
+ * Kysely table types for `nachklang_admin`. Only the columns this module
+ * actually reads or writes are declared - better-auth owns the full shape of
+ * its own tables and does not use this interface, it is here so the users and
+ * invitations services get compile-time checking instead of `any`.
+ *
+ * Column names follow better-auth's default "camel" casing for its tables
+ * (`emailVerified`, `userId`, `createdAt`); our own two tables use the
+ * snake_case convention of the rest of the repo's SQL.
+ */
+
+export type AppName = 'calendar' | 'feedback' | 'tickets' | 'admin';
+
+export const APP_NAMES: AppName[] = ['calendar', 'feedback', 'tickets', 'admin'];
+
+export const isAppName = (value: unknown): value is AppName => {
+	return typeof value === 'string' && (APP_NAMES as string[]).includes(value);
+};
+
+export interface UserTable {
+	id: string;
+	name: string;
+	email: string;
+	emailVerified: boolean;
+	image: string | null;
+	createdAt: Date;
+	updatedAt: Date;
+	// Added via better-auth `additionalFields` (see admin.auth.ts).
+	disabled: boolean;
+}
+
+export interface SessionTable {
+	id: string;
+	token: string;
+	userId: string;
+	expiresAt: Date;
+	createdAt: Date;
+	updatedAt: Date;
+	ipAddress: string | null;
+	userAgent: string | null;
+}
+
+export interface PasskeyTable {
+	id: string;
+	name: string | null;
+	userId: string;
+	createdAt: Date;
+}
+
+export interface UserAppPermissionTable {
+	user_id: string;
+	app: AppName;
+	role: string;
+	granted_by: string | null;
+	granted_at: Generated<Date>;
+}
+
+export interface InvitationTable {
+	// AUTO_INCREMENT: present on select, never supplied on insert.
+	id: Generated<number>;
+	email: string;
+	name: string;
+	token_hash: string;
+	// JSON column holding an AppName[].
+	apps: string;
+	invited_by: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	accepted_at: Date | null;
+	revoked_at: Date | null;
+}
+
+export interface AdminDatabase {
+	user: UserTable;
+	session: SessionTable;
+	passkey: PasskeyTable;
+	user_app_permissions: UserAppPermissionTable;
+	invitations: InvitationTable;
+}

src/models/admin/invitations/invitations.plugin.ts

@@ -0,0 +1,157 @@
+import * as z from 'zod';
+import {APIError, createAuthEndpoint} from 'better-auth/api';
+import {setSessionCookie} from 'better-auth/cookies';
+import {createLocalAccountIssuer} from 'better-auth/db';
+import type {BetterAuthPlugin} from 'better-auth';
+import * as InvitationsService from './invitations.service.js';
+import * as UsersService from '../users/users.admin.service.js';
+import logger from '../../../middleware/logger.js';
+
+/**
+ * The two public endpoints of the invitation flow, implemented as a better-auth
+ * plugin rather than as plain Express routes on the admin router.
+ *
+ * Why a plugin: `emailAndPassword.disableSignUp` is on, which makes
+ * `auth.api.signUpEmail` refuse - deliberately, there is no public sign-up.
+ * Accepting an invitation still has to create a user, hash a password, write a
+ * credential account and sign the person in. All four are better-auth
+ * internals reachable only from inside an endpoint's context, so this is where
+ * account creation lives. Nothing outside this file may create users.
+ *
+ * Because they are plugin endpoints they sit under better-auth's basePath:
+ *   POST /admin/auth/invitations/preview
+ *   POST /admin/auth/invitations/accept
+ *
+ * The token travels in the request *body*, never in the path or query, so it
+ * cannot end up in an access log or a Referer header.
+ */
+
+// Unknown, expired, revoked and already-accepted tokens must be
+// indistinguishable to the caller: one shared error, one shared message.
+const invalidToken = (): APIError => {
+	return new APIError('BAD_REQUEST', {
+		code: 'INVALID_INVITATION',
+		message: 'Diese Einladung ist nicht mehr gültig.'
+	});
+};
+
+export const invitationsPlugin = () => {
+	return {
+		id: 'nachklang-invitations',
+		endpoints: {
+			/**
+			 * Lets the accept-invite page show who the invitation is for before
+			 * asking for a password. Returns only name and email - never the
+			 * granted apps, which is information the invitee has no need for
+			 * and an attacker with a stolen link should not get either.
+			 */
+			previewInvitation: createAuthEndpoint(
+				'/invitations/preview',
+				{
+					method: 'POST',
+					body: z.object({
+						token: z.string().min(1)
+					})
+				},
+				async ctx => {
+					const invitation = await InvitationsService.findByToken(ctx.body.token);
+					if (!invitation) {
+						throw invalidToken();
+					}
+
+					return ctx.json({email: invitation.email, name: invitation.name});
+				}
+			),
+
+			/**
+			 * Redeems the invitation: creates the user, its credential account
+			 * and its permissions, then signs the person straight in so they
+			 * land in the app instead of on a login form.
+			 */
+			acceptInvitation: createAuthEndpoint(
+				'/invitations/accept',
+				{
+					method: 'POST',
+					body: z.object({
+						token: z.string().min(1),
+						password: z.string().min(8).max(128)
+					})
+				},
+				async ctx => {
+					const invitation = await InvitationsService.findByToken(ctx.body.token);
+					if (!invitation) {
+						throw invalidToken();
+					}
+
+					// An account for this address already exists: the right fix
+					// is for an admin to grant permissions on the existing user,
+					// not to create a second one. Reported distinctly because
+					// the person holds a valid token - this leaks nothing they
+					// do not already know about their own mailbox.
+					const existing = await UsersService.findUserByEmail(invitation.email);
+					if (existing) {
+						throw new APIError('CONFLICT', {
+							code: 'USER_ALREADY_EXISTS',
+							message: 'Für diese E-Mail-Adresse gibt es bereits ein Konto. Melde dich stattdessen an.'
+						});
+					}
+
+					// Claim the invitation before creating anything. The update
+					// is conditional on it still being open, so two concurrent
+					// submissions of the same link cannot both end up creating a
+					// user.
+					const claimed = await InvitationsService.markAccepted(invitation.id);
+					if (!claimed) {
+						throw invalidToken();
+					}
+
+					try {
+						const user = await ctx.context.internalAdapter.createUser(
+							{
+								email: invitation.email,
+								name: invitation.name,
+								// Accepting a link sent to that mailbox *is* the
+								// proof of address ownership, so there is no
+								// separate verification mail (plan decision 15).
+								emailVerified: true,
+								disabled: false
+							},
+							{method: 'email-password'}
+						);
+
+						// Same call better-auth's own sign-up route makes, down to
+						// the synthetic issuer - a credential account written any
+						// other way would not be found on sign-in.
+						await ctx.context.internalAdapter.linkAccount({
+							userId: user.id,
+							providerId: 'credential',
+							issuer: createLocalAccountIssuer('credential'),
+							accountId: user.id,
+							password: await ctx.context.password.hash(ctx.body.password)
+						});
+
+						await UsersService.setPermissions(user.id, invitation.apps, null);
+
+						const session = await ctx.context.internalAdapter.createSession(user.id);
+						await setSessionCookie(ctx, {session, user});
+
+						return ctx.json({
+							user: {id: user.id, email: user.email, name: user.name}
+						});
+					} catch (e: any) {
+						// The invitation is already marked accepted at this
+						// point. Leaving it that way is deliberate: a token that
+						// has been through a half-completed account creation
+						// should not stay usable. The admin can send a new
+						// invitation, and this log says why one is needed.
+						logger.error('Admin: invitation accepted but account creation failed', {
+							invitationId: invitation.id,
+							detail: e?.message
+						});
+						throw e;
+					}
+				}
+			)
+		}
+	} satisfies BetterAuthPlugin;
+};

src/models/admin/invitations/invitations.router.ts

@@ -0,0 +1,194 @@
+import express, {Request, Response} from 'express';
+import * as InvitationsService from './invitations.service.js';
+import * as UsersService from '../users/users.admin.service.js';
+import {isAppName, AppName} from '../admin.schema.js';
+import {sendInvitationMail} from '../admin.mail.js';
+import {ADMIN_APP_URL} from '../admin.config.js';
+import {sendServerError} from '../admin.errors.js';
+import logger from '../../../middleware/logger.js';
+import {isProd} from '../admin.config.js';
+
+export const invitationsRouter = express.Router();
+
+/**
+ * The admin-facing half of invitations (create, resend, revoke). The public
+ * half - preview and accept - lives in invitations.plugin.ts, because
+ * redeeming an invitation has to create a user through better-auth internals.
+ *
+ * Mounted behind requireAppAccess('admin').
+ */
+
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+/**
+ * Outside production the Salesforce relay is normally off, so the invitation
+ * mail never arrives and only the token's hash is stored - there would be no
+ * way to walk through the accept flow locally. Logging the link closes that,
+ * and mirrors what the bootstrap already does. Never in production: the log
+ * would then hold a live credential.
+ */
+const logInviteLinkInDev = (token: string): void => {
+	if (!isProd) {
+		logger.info(`Admin: invitation link ${ADMIN_APP_URL}/accept-invite?token=${encodeURIComponent(token)}`);
+	}
+};
+
+/**
+ * @swagger
+ * /admin/invitations:
+ *      get:
+ *          summary: List open (unaccepted, unrevoked, unexpired) invitations
+ *          tags: [admin]
+ *          responses:
+ *              200:
+ *                  description: Success
+ */
+invitationsRouter.get('/', async (req: Request, res: Response) => {
+	try {
+		res.status(200).send(await InvitationsService.listOpenInvitations());
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+});
+
+/**
+ * @swagger
+ * /admin/invitations:
+ *      post:
+ *          summary: Invite someone and mail them an acceptance link
+ *          tags: [admin]
+ *          requestBody:
+ *              required: true
+ *              content:
+ *                  application/json:
+ *                      schema:
+ *                          type: object
+ *                          required: [email, name, apps]
+ *                          properties:
+ *                              email:
+ *                                  type: string
+ *                              name:
+ *                                  type: string
+ *                              apps:
+ *                                  type: array
+ *                                  items:
+ *                                      type: string
+ *          responses:
+ *              201:
+ *                  description: Invitation created and mailed
+ *              400:
+ *                  description: Invalid input
+ *              409:
+ *                  description: A user with this address already exists
+ */
+invitationsRouter.post('/', async (req: Request, res: Response) => {
+	try {
+		const email = String(req.body?.email || '').trim().toLowerCase();
+		const name = String(req.body?.name || '').trim();
+		const apps: unknown = req.body?.apps;
+
+		if (!EMAIL_PATTERN.test(email) || name.length === 0 || !Array.isArray(apps) || !apps.every(isAppName)) {
+			res.status(400).send({status: 'BAD_REQUEST', message: 'E-Mail, Name und App-Liste sind erforderlich.'});
+			return;
+		}
+
+		// Inviting someone who already has an account would strand them on an
+		// accept page that can only fail. Granting permissions on the existing
+		// user is the operation they actually want.
+		if (await UsersService.findUserByEmail(email)) {
+			res.status(409).send({
+				status: 'CONFLICT',
+				message: 'Für diese E-Mail-Adresse gibt es bereits ein Konto. Vergib dort die Berechtigungen.'
+			});
+			return;
+		}
+
+		const invitation = await InvitationsService.createInvitation(
+			email,
+			name,
+			apps as AppName[],
+			res.locals.admin.id
+		);
+
+		const mailed = await sendInvitationMail(email, name, invitation.token, invitation.expiresAt);
+		if (!mailed) {
+			logger.warn('Admin: invitation created but the mail was not accepted', {email});
+		}
+		logInviteLinkInDev(invitation.token);
+
+		res.status(201).send({id: invitation.id, email, name, expiresAt: invitation.expiresAt, mailed});
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+});
+
+/**
+ * @swagger
+ * /admin/invitations/{invitationId}/resend:
+ *      post:
+ *          summary: Issue a new token for an open invitation and mail it again
+ *          description: The previous link stops working.
+ *          tags: [admin]
+ *          responses:
+ *              200:
+ *                  description: Resent
+ *              404:
+ *                  description: No open invitation with this id
+ */
+invitationsRouter.post('/:invitationId/resend', async (req: Request, res: Response) => {
+	try {
+		const invitationId = parseInt(req.params.invitationId, 10);
+		if (Number.isNaN(invitationId)) {
+			res.status(400).send({status: 'BAD_REQUEST', message: 'Ungültige Einladungs-ID.'});
+			return;
+		}
+
+		const resent = await InvitationsService.resendInvitation(invitationId);
+		if (!resent) {
+			res.status(404).send({status: 'NOT_FOUND', message: 'Einladung nicht gefunden.'});
+			return;
+		}
+
+		const mailed = await sendInvitationMail(resent.email, resent.name, resent.token, resent.expiresAt);
+		if (!mailed) {
+			logger.warn('Admin: invitation resent but the mail was not accepted', {email: resent.email});
+		}
+		logInviteLinkInDev(resent.token);
+
+		res.status(200).send({id: invitationId, expiresAt: resent.expiresAt, mailed});
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+});
+
+/**
+ * @swagger
+ * /admin/invitations/{invitationId}:
+ *      delete:
+ *          summary: Revoke an open invitation
+ *          tags: [admin]
+ *          responses:
+ *              204:
+ *                  description: Revoked
+ *              404:
+ *                  description: No open invitation with this id
+ */
+invitationsRouter.delete('/:invitationId', async (req: Request, res: Response) => {
+	try {
+		const invitationId = parseInt(req.params.invitationId, 10);
+		if (Number.isNaN(invitationId)) {
+			res.status(400).send({status: 'BAD_REQUEST', message: 'Ungültige Einladungs-ID.'});
+			return;
+		}
+
+		const revoked = await InvitationsService.revokeInvitation(invitationId);
+		if (!revoked) {
+			res.status(404).send({status: 'NOT_FOUND', message: 'Einladung nicht gefunden.'});
+			return;
+		}
+
+		res.status(204).send();
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+});

src/models/admin/invitations/invitations.service.ts

@@ -0,0 +1,209 @@
+import * as crypto from 'crypto';
+import {NachklangAdminDB} from '../Admin.db.js';
+import {AppName, APP_NAMES, isAppName} from '../admin.schema.js';
+
+const db = NachklangAdminDB.db;
+
+/**
+ * Invitations are this API's only path to a new account (there is no public
+ * sign-up). The raw token exists exactly twice: in the mail we send and in the
+ * request body when it comes back. What we store is its SHA-256 hash, so a
+ * database dump does not hand out account access - the same reasoning as the
+ * calendar module's session key hashing, and the reason lookups go through
+ * `findByToken` rather than any query on a plaintext column.
+ */
+
+export const INVITATION_TTL_DAYS = 7;
+
+export interface OpenInvitation {
+	id: number;
+	email: string;
+	name: string;
+	apps: AppName[];
+	invitedBy: string | null;
+	createdAt: Date;
+	expiresAt: Date;
+}
+
+export interface AcceptableInvitation {
+	id: number;
+	email: string;
+	name: string;
+	apps: AppName[];
+}
+
+const hashToken = (token: string): string => {
+	return crypto.createHash('sha256').update(token).digest('hex');
+};
+
+const generateToken = (): string => {
+	// 32 bytes, url-safe: it travels in a mail link's query string.
+	return crypto.randomBytes(32).toString('base64url');
+};
+
+const parseApps = (value: unknown): AppName[] => {
+	// mysql2 hands back a JSON column already parsed; a driver or column-type
+	// change that turns it into a string must not break the read path.
+	const raw = typeof value === 'string' ? JSON.parse(value) : value;
+	return Array.isArray(raw) ? raw.filter(isAppName) : [];
+};
+
+const expiryFromNow = (): Date => {
+	return new Date(Date.now() + INVITATION_TTL_DAYS * 24 * 60 * 60 * 1000);
+};
+
+/**
+ * Creates an invitation and returns the raw token for the mail. Any earlier
+ * open invitation for the same address is revoked first: two valid links for
+ * one mailbox is a needless second live credential, and "resend" would
+ * otherwise quietly accumulate them.
+ */
+export const createInvitation = async (
+	email: string,
+	name: string,
+	apps: AppName[],
+	invitedBy: string | null
+): Promise<{id: number; token: string; expiresAt: Date}> => {
+	const token = generateToken();
+	const expiresAt = expiryFromNow();
+	const validApps = Array.from(new Set(apps)).filter(app => APP_NAMES.includes(app));
+
+	const id = await db.transaction().execute(async trx => {
+		await trx
+			.updateTable('invitations')
+			.set({revoked_at: new Date()})
+			.where('email', '=', email)
+			.where('accepted_at', 'is', null)
+			.where('revoked_at', 'is', null)
+			.execute();
+
+		const result = await trx
+			.insertInto('invitations')
+			.values({
+				email,
+				name,
+				token_hash: hashToken(token),
+				apps: JSON.stringify(validApps),
+				invited_by: invitedBy,
+				created_at: new Date(),
+				expires_at: expiresAt
+			})
+			.executeTakeFirst();
+
+		return Number(result.insertId);
+	});
+
+	return {id, token, expiresAt};
+};
+
+/**
+ * Looks up a still-usable invitation by raw token. Callers must not
+ * distinguish "unknown", "expired", "revoked" and "already accepted" to the
+ * client: all four answer with the same shape, so a stranger cannot probe which
+ * tokens ever existed.
+ */
+export const findByToken = async (token: string): Promise<AcceptableInvitation | null> => {
+	const row = await db
+		.selectFrom('invitations')
+		.select(['id', 'email', 'name', 'apps'])
+		.where('token_hash', '=', hashToken(token))
+		.where('accepted_at', 'is', null)
+		.where('revoked_at', 'is', null)
+		.where('expires_at', '>', new Date())
+		.executeTakeFirst();
+
+	if (!row) {
+		return null;
+	}
+
+	return {id: row.id, email: row.email, name: row.name, apps: parseApps(row.apps)};
+};
+
+/** Marks the invitation accepted. Conditional on it still being open so two
+ *  concurrent accepts of the same link cannot both create an account. */
+export const markAccepted = async (invitationId: number): Promise<boolean> => {
+	const result = await db
+		.updateTable('invitations')
+		.set({accepted_at: new Date()})
+		.where('id', '=', invitationId)
+		.where('accepted_at', 'is', null)
+		.where('revoked_at', 'is', null)
+		.executeTakeFirst();
+
+	return Number(result.numUpdatedRows) > 0;
+};
+
+export const listOpenInvitations = async (): Promise<OpenInvitation[]> => {
+	const rows = await db
+		.selectFrom('invitations')
+		.select(['id', 'email', 'name', 'apps', 'invited_by', 'created_at', 'expires_at'])
+		.where('accepted_at', 'is', null)
+		.where('revoked_at', 'is', null)
+		.where('expires_at', '>', new Date())
+		.orderBy('created_at', 'desc')
+		.execute();
+
+	return rows.map(row => ({
+		id: row.id,
+		email: row.email,
+		name: row.name,
+		apps: parseApps(row.apps),
+		invitedBy: row.invited_by,
+		createdAt: row.created_at,
+		expiresAt: row.expires_at
+	}));
+};
+
+export const getOpenInvitation = async (invitationId: number): Promise<OpenInvitation | null> => {
+	const all = await listOpenInvitations();
+	return all.find(invitation => invitation.id === invitationId) ?? null;
+};
+
+/** Resend issues a *new* token and expiry and invalidates the old one, rather
+ *  than re-mailing the existing link: if the first mail leaked, resending it
+ *  would extend the leak's lifetime. */
+export const resendInvitation = async (
+	invitationId: number
+): Promise<{token: string; email: string; name: string; expiresAt: Date} | null> => {
+	const invitation = await getOpenInvitation(invitationId);
+	if (!invitation) {
+		return null;
+	}
+
+	const token = generateToken();
+	const expiresAt = expiryFromNow();
+
+	await db
+		.updateTable('invitations')
+		.set({token_hash: hashToken(token), expires_at: expiresAt, created_at: new Date()})
+		.where('id', '=', invitationId)
+		.execute();
+
+	return {token, email: invitation.email, name: invitation.name, expiresAt};
+};
+
+export const revokeInvitation = async (invitationId: number): Promise<boolean> => {
+	const result = await db
+		.updateTable('invitations')
+		.set({revoked_at: new Date()})
+		.where('id', '=', invitationId)
+		.where('accepted_at', 'is', null)
+		.where('revoked_at', 'is', null)
+		.executeTakeFirst();
+
+	return Number(result.numUpdatedRows) > 0;
+};
+
+/** Used by the bootstrap to stay idempotent across restarts. */
+export const hasOpenInvitationFor = async (email: string): Promise<boolean> => {
+	const row = await db
+		.selectFrom('invitations')
+		.select('id')
+		.where('email', '=', email)
+		.where('accepted_at', 'is', null)
+		.where('revoked_at', 'is', null)
+		.where('expires_at', '>', new Date())
+		.executeTakeFirst();
+
+	return Boolean(row);
+};

src/models/admin/users/users.admin.router.ts

@@ -0,0 +1,229 @@
+import express, {Request, Response} from 'express';
+import * as UsersService from './users.admin.service.js';
+import {AppName, isAppName} from '../admin.schema.js';
+import {sendServerError} from '../admin.errors.js';
+
+export const usersAdminRouter = express.Router();
+
+/**
+ * User administration. Mounted behind requireAppAccess('admin'), so every
+ * handler here can assume res.locals.admin is an admin.
+ *
+ * The guards below exist because this API can lock its own operators out: the
+ * only way to grant a permission is through these routes, so an admin who
+ * removes the last `admin` permission leaves nobody who can put it back short
+ * of a manual SQL statement in production.
+ */
+
+const conflict = (res: Response, message: string): void => {
+	res.status(409).send({status: 'CONFLICT', message});
+};
+
+const notFound = (res: Response): void => {
+	res.status(404).send({status: 'NOT_FOUND', message: 'Benutzer nicht gefunden.'});
+};
+
+/**
+ * @swagger
+ * /admin/users:
+ *      get:
+ *          summary: List all users with their app permissions and status
+ *          tags: [admin]
+ *          responses:
+ *              200:
+ *                  description: Success
+ *              401:
+ *                  description: Not signed in
+ *              403:
+ *                  description: Missing the admin permission
+ */
+usersAdminRouter.get('/', async (req: Request, res: Response) => {
+	try {
+		res.status(200).send(await UsersService.listUsers());
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+});
+
+/**
+ * @swagger
+ * /admin/users/{userId}:
+ *      get:
+ *          summary: One user with their active sessions and passkey count
+ *          tags: [admin]
+ *          parameters:
+ *              - in: path
+ *                name: userId
+ *                required: true
+ *                schema:
+ *                    type: string
+ *          responses:
+ *              200:
+ *                  description: Success
+ *              404:
+ *                  description: Unknown user
+ */
+usersAdminRouter.get('/:userId', async (req: Request, res: Response) => {
+	try {
+		const detail = await UsersService.getUserDetail(req.params.userId);
+		if (!detail) {
+			notFound(res);
+			return;
+		}
+		res.status(200).send(detail);
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+});
+
+/**
+ * @swagger
+ * /admin/users/{userId}/permissions:
+ *      put:
+ *          summary: Replace a user's app permissions
+ *          description: Refuses to remove the caller's own admin permission or the last remaining active admin.
+ *          tags: [admin]
+ *          requestBody:
+ *              required: true
+ *              content:
+ *                  application/json:
+ *                      schema:
+ *                          type: object
+ *                          properties:
+ *                              apps:
+ *                                  type: array
+ *                                  items:
+ *                                      type: string
+ *                                      enum: [calendar, feedback, tickets, admin]
+ *          responses:
+ *              200:
+ *                  description: Success
+ *              400:
+ *                  description: Invalid app name
+ *              409:
+ *                  description: Would lock the last admin out
+ */
+usersAdminRouter.put('/:userId/permissions', async (req: Request, res: Response) => {
+	try {
+		const userId = req.params.userId;
+		const apps: unknown = req.body?.apps;
+
+		if (!Array.isArray(apps) || !apps.every(isAppName)) {
+			res.status(400).send({status: 'BAD_REQUEST', message: 'Ungültige App-Liste.'});
+			return;
+		}
+
+		if (!(await UsersService.userExists(userId))) {
+			notFound(res);
+			return;
+		}
+
+		const target = await UsersService.loadAccess(userId);
+		const losesAdmin = Boolean(target?.apps.includes('admin')) && !(apps as AppName[]).includes('admin');
+
+		if (losesAdmin && userId === res.locals.admin.id) {
+			conflict(res, 'Du kannst dir die Admin-Berechtigung nicht selbst entziehen.');
+			return;
+		}
+
+		// Only an enabled admin counts; see countActiveAdmins.
+		if (losesAdmin && !target?.disabled && (await UsersService.countActiveAdmins()) <= 1) {
+			conflict(res, 'Die letzte Admin-Berechtigung kann nicht entzogen werden.');
+			return;
+		}
+
+		await UsersService.setPermissions(userId, apps as AppName[], res.locals.admin.id);
+		res.status(200).send(await UsersService.getUserDetail(userId));
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+});
+
+/**
+ * @swagger
+ * /admin/users/{userId}/disable:
+ *      post:
+ *          summary: Disable a user and revoke all of their sessions
+ *          tags: [admin]
+ *          responses:
+ *              200:
+ *                  description: Success
+ *              409:
+ *                  description: Would disable the caller or the last admin
+ */
+usersAdminRouter.post('/:userId/disable', async (req: Request, res: Response) => {
+	try {
+		const userId = req.params.userId;
+
+		if (userId === res.locals.admin.id) {
+			conflict(res, 'Du kannst dich nicht selbst deaktivieren.');
+			return;
+		}
+
+		const target = await UsersService.loadAccess(userId);
+		if (!target) {
+			notFound(res);
+			return;
+		}
+
+		if (target.apps.includes('admin') && !target.disabled && (await UsersService.countActiveAdmins()) <= 1) {
+			conflict(res, 'Der letzte aktive Admin kann nicht deaktiviert werden.');
+			return;
+		}
+
+		await UsersService.disableUser(userId);
+		res.status(200).send(await UsersService.getUserDetail(userId));
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+});
+
+/**
+ * @swagger
+ * /admin/users/{userId}/enable:
+ *      post:
+ *          summary: Re-enable a disabled user
+ *          description: Does not restore sessions - the user signs in again.
+ *          tags: [admin]
+ *          responses:
+ *              200:
+ *                  description: Success
+ */
+usersAdminRouter.post('/:userId/enable', async (req: Request, res: Response) => {
+	try {
+		if (!(await UsersService.userExists(req.params.userId))) {
+			notFound(res);
+			return;
+		}
+
+		await UsersService.enableUser(req.params.userId);
+		res.status(200).send(await UsersService.getUserDetail(req.params.userId));
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+});
+
+/**
+ * @swagger
+ * /admin/users/{userId}/sessions/{sessionId}:
+ *      delete:
+ *          summary: Revoke one session of a user
+ *          tags: [admin]
+ *          responses:
+ *              204:
+ *                  description: Revoked
+ *              404:
+ *                  description: Unknown session for this user
+ */
+usersAdminRouter.delete('/:userId/sessions/:sessionId', async (req: Request, res: Response) => {
+	try {
+		const revoked = await UsersService.revokeSession(req.params.userId, req.params.sessionId);
+		if (!revoked) {
+			res.status(404).send({status: 'NOT_FOUND', message: 'Sitzung nicht gefunden.'});
+			return;
+		}
+		res.status(204).send();
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+});

src/models/admin/users/users.admin.service.ts

@@ -0,0 +1,260 @@
+import {NachklangAdminDB} from '../Admin.db.js';
+import {AppName, APP_NAMES} from '../admin.schema.js';
+
+const db = NachklangAdminDB.db;
+
+/**
+ * Everything that reads or writes permissions. Two callers with very different
+ * hot-path requirements share this file: admin.middleware.ts runs
+ * `loadAccess` on *every* admin-authenticated request (which is why it is one
+ * query joining `user.disabled` and the permission rows - see the plan's
+ * decision to run without better-auth's cookieCache), and the /admin/users
+ * routes run the rest.
+ */
+
+export interface UserAccess {
+	id: string;
+	email: string;
+	displayName: string;
+	disabled: boolean;
+	apps: AppName[];
+}
+
+export type UserStatus = 'aktiv' | 'deaktiviert';
+
+export interface UserListEntry {
+	id: string;
+	email: string;
+	name: string;
+	apps: AppName[];
+	status: UserStatus;
+	createdAt: Date;
+	lastSignInAt: Date | null;
+}
+
+export interface UserSessionEntry {
+	id: string;
+	createdAt: Date;
+	expiresAt: Date;
+	ipAddress: string | null;
+	userAgent: string | null;
+}
+
+export interface UserDetail extends UserListEntry {
+	sessions: UserSessionEntry[];
+	passkeyCount: number;
+}
+
+/**
+ * The single per-request lookup behind requireAppAccess. Returns null when the
+ * user row is gone; `disabled` is returned rather than filtered so the
+ * middleware can answer 403 (account deactivated) instead of a misleading 401.
+ */
+export const loadAccess = async (userId: string): Promise<UserAccess | null> => {
+	const rows = await db
+		.selectFrom('user')
+		.leftJoin('user_app_permissions', 'user_app_permissions.user_id', 'user.id')
+		.where('user.id', '=', userId)
+		.select([
+			'user.id as id',
+			'user.email as email',
+			'user.name as name',
+			'user.disabled as disabled',
+			'user_app_permissions.app as app'
+		])
+		.execute();
+
+	if (rows.length === 0) {
+		return null;
+	}
+
+	return {
+		id: rows[0].id,
+		email: rows[0].email,
+		displayName: rows[0].name,
+		// MySQL TINYINT(1) comes back as 0/1 through mysql2.
+		disabled: Boolean(rows[0].disabled),
+		apps: rows.map(row => row.app).filter((app): app is AppName => app !== null)
+	};
+};
+
+export const listUsers = async (): Promise<UserListEntry[]> => {
+	const users = await db
+		.selectFrom('user')
+		.select(['id', 'email', 'name', 'disabled', 'createdAt'])
+		.orderBy('name', 'asc')
+		.execute();
+
+	const permissions = await db
+		.selectFrom('user_app_permissions')
+		.select(['user_id', 'app'])
+		.execute();
+
+	// Last sign-in is derived from the newest session rather than stored: a
+	// session row is created on every sign-in and we never update its
+	// createdAt, so max(createdAt) is exactly that, with no extra column to
+	// keep in sync. Sessions are pruned on expiry, so this goes back to null
+	// for someone who has not signed in for over 30 days.
+	const lastSessions = await db
+		.selectFrom('session')
+		.select(({fn}) => ['userId', fn.max('createdAt').as('lastSignInAt')])
+		.groupBy('userId')
+		.execute();
+
+	const appsByUser = new Map<string, AppName[]>();
+	for (const row of permissions) {
+		const apps = appsByUser.get(row.user_id) || [];
+		apps.push(row.app);
+		appsByUser.set(row.user_id, apps);
+	}
+
+	const lastSignInByUser = new Map<string, Date | null>(
+		lastSessions.map(row => [row.userId, row.lastSignInAt as Date | null])
+	);
+
+	return users.map(user => ({
+		id: user.id,
+		email: user.email,
+		name: user.name,
+		apps: appsByUser.get(user.id) || [],
+		status: user.disabled ? 'deaktiviert' : 'aktiv',
+		createdAt: user.createdAt,
+		lastSignInAt: lastSignInByUser.get(user.id) ?? null
+	}));
+};
+
+export const getUserDetail = async (userId: string): Promise<UserDetail | null> => {
+	const user = await db
+		.selectFrom('user')
+		.select(['id', 'email', 'name', 'disabled', 'createdAt'])
+		.where('id', '=', userId)
+		.executeTakeFirst();
+
+	if (!user) {
+		return null;
+	}
+
+	const [permissions, sessions, passkeys] = await Promise.all([
+		db.selectFrom('user_app_permissions').select('app').where('user_id', '=', userId).execute(),
+		db
+			.selectFrom('session')
+			.select(['id', 'createdAt', 'expiresAt', 'ipAddress', 'userAgent'])
+			.where('userId', '=', userId)
+			.where('expiresAt', '>', new Date())
+			.orderBy('createdAt', 'desc')
+			.execute(),
+		db
+			.selectFrom('passkey')
+			.select(({fn}) => fn.countAll<number>().as('count'))
+			.where('userId', '=', userId)
+			.executeTakeFirst()
+	]);
+
+	return {
+		id: user.id,
+		email: user.email,
+		name: user.name,
+		apps: permissions.map(row => row.app),
+		status: user.disabled ? 'deaktiviert' : 'aktiv',
+		createdAt: user.createdAt,
+		lastSignInAt: sessions.length > 0 ? sessions[0].createdAt : null,
+		sessions,
+		passkeyCount: Number(passkeys?.count ?? 0)
+	};
+};
+
+/**
+ * Replaces a user's permission set. Written as delete-then-insert inside one
+ * transaction rather than a diff: the set is at most four rows, and a diff
+ * would only add branches for no measurable gain.
+ */
+export const setPermissions = async (
+	userId: string,
+	apps: AppName[],
+	grantedBy: string | null
+): Promise<void> => {
+	const unique = Array.from(new Set(apps)).filter(app => APP_NAMES.includes(app));
+
+	await db.transaction().execute(async trx => {
+		await trx.deleteFrom('user_app_permissions').where('user_id', '=', userId).execute();
+		if (unique.length > 0) {
+			await trx
+				.insertInto('user_app_permissions')
+				.values(unique.map(app => ({
+					user_id: userId,
+					app,
+					role: 'admin',
+					granted_by: grantedBy,
+					granted_at: new Date()
+				})))
+				.execute();
+		}
+	});
+};
+
+export const grantPermission = async (
+	userId: string,
+	app: AppName,
+	grantedBy: string | null
+): Promise<void> => {
+	await db
+		.insertInto('user_app_permissions')
+		.values({user_id: userId, app, role: 'admin', granted_by: grantedBy, granted_at: new Date()})
+		.onDuplicateKeyUpdate({role: 'admin'})
+		.execute();
+};
+
+/** Disabling revokes every session: a disabled user must lose access now, not
+ *  when their 30-day cookie happens to expire. */
+export const disableUser = async (userId: string): Promise<void> => {
+	await db.transaction().execute(async trx => {
+		await trx.updateTable('user').set({disabled: true}).where('id', '=', userId).execute();
+		await trx.deleteFrom('session').where('userId', '=', userId).execute();
+	});
+};
+
+export const enableUser = async (userId: string): Promise<void> => {
+	await db.updateTable('user').set({disabled: false}).where('id', '=', userId).execute();
+};
+
+export const revokeSession = async (userId: string, sessionId: string): Promise<boolean> => {
+	const result = await db
+		.deleteFrom('session')
+		.where('id', '=', sessionId)
+		.where('userId', '=', userId)
+		.executeTakeFirst();
+
+	return Number(result.numDeletedRows) > 0;
+};
+
+/**
+ * Guard input for the self-lockout rules: how many enabled users still hold the
+ * `admin` permission. Disabled admins do not count - they cannot sign in, so
+ * leaving only disabled admins is the same lockout as leaving none.
+ */
+export const countActiveAdmins = async (): Promise<number> => {
+	const row = await db
+		.selectFrom('user_app_permissions')
+		.innerJoin('user', 'user.id', 'user_app_permissions.user_id')
+		.where('user_app_permissions.app', '=', 'admin')
+		.where('user.disabled', '=', false)
+		.select(({fn}) => fn.countAll<number>().as('count'))
+		.executeTakeFirst();
+
+	return Number(row?.count ?? 0);
+};
+
+export const userExists = async (userId: string): Promise<boolean> => {
+	const row = await db.selectFrom('user').select('id').where('id', '=', userId).executeTakeFirst();
+	return Boolean(row);
+};
+
+export const findUserByEmail = async (email: string): Promise<{id: string; email: string} | null> => {
+	const row = await db
+		.selectFrom('user')
+		.select(['id', 'email'])
+		.where('email', '=', email)
+		.executeTakeFirst();
+
+	return row ?? null;
+};

test/admin/admin.bootstrap.test.ts

@@ -0,0 +1,91 @@
+import {vi, describe, it, expect, beforeEach, type Mock} from 'vitest';
+
+vi.mock('../../src/models/admin/users/users.admin.service.js', () => ({
+	countActiveAdmins: vi.fn(),
+	findUserByEmail: vi.fn(),
+	grantPermission: vi.fn()
+}));
+vi.mock('../../src/models/admin/invitations/invitations.service.js', () => ({
+	hasOpenInvitationFor: vi.fn(),
+	createInvitation: vi.fn()
+}));
+vi.mock('../../src/models/admin/admin.mail.js', () => ({
+	sendInvitationMail: vi.fn()
+}));
+vi.mock('../../src/models/admin/admin.config.js', () => ({
+	ADMIN_BOOTSTRAP_EMAIL: 'boss@nachklang.art',
+	ADMIN_APP_URL: 'http://localhost:3002',
+	isProd: false
+}));
+
+import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
+import * as InvitationsService from '../../src/models/admin/invitations/invitations.service.js';
+import {sendInvitationMail} from '../../src/models/admin/admin.mail.js';
+import {bootstrapAdmin} from '../../src/models/admin/admin.bootstrap.js';
+
+const countActiveAdmins = UsersService.countActiveAdmins as Mock;
+const findUserByEmail = UsersService.findUserByEmail as Mock;
+const grantPermission = UsersService.grantPermission as Mock;
+const hasOpenInvitationFor = InvitationsService.hasOpenInvitationFor as Mock;
+const createInvitation = InvitationsService.createInvitation as Mock;
+const mockMail = sendInvitationMail as Mock;
+
+beforeEach(() => {
+	countActiveAdmins.mockReset();
+	findUserByEmail.mockReset();
+	grantPermission.mockReset();
+	hasOpenInvitationFor.mockReset();
+	createInvitation.mockReset();
+	mockMail.mockReset();
+	mockMail.mockResolvedValue(true);
+	createInvitation.mockResolvedValue({id: 1, token: 'raw-token', expiresAt: new Date()});
+});
+
+describe('bootstrapAdmin', () => {
+	it('does nothing when an active admin already exists', async () => {
+		countActiveAdmins.mockResolvedValue(1);
+
+		await bootstrapAdmin();
+
+		expect(createInvitation).not.toHaveBeenCalled();
+		expect(grantPermission).not.toHaveBeenCalled();
+	});
+
+	it('grants admin directly when the bootstrap address is already a user', async () => {
+		countActiveAdmins.mockResolvedValue(0);
+		findUserByEmail.mockResolvedValue({id: 'u9', email: 'boss@nachklang.art'});
+
+		await bootstrapAdmin();
+
+		expect(grantPermission).toHaveBeenCalledWith('u9', 'admin', null);
+		expect(createInvitation).not.toHaveBeenCalled();
+	});
+
+	it('does not re-invite (or re-mail) while an open invitation exists', async () => {
+		countActiveAdmins.mockResolvedValue(0);
+		findUserByEmail.mockResolvedValue(null);
+		hasOpenInvitationFor.mockResolvedValue(true);
+
+		await bootstrapAdmin();
+
+		expect(createInvitation).not.toHaveBeenCalled();
+		expect(mockMail).not.toHaveBeenCalled();
+	});
+
+	it('invites with the admin permission when there is nothing to work with', async () => {
+		countActiveAdmins.mockResolvedValue(0);
+		findUserByEmail.mockResolvedValue(null);
+		hasOpenInvitationFor.mockResolvedValue(false);
+
+		await bootstrapAdmin();
+
+		expect(createInvitation).toHaveBeenCalledWith('boss@nachklang.art', 'Nachklang Admin', ['admin'], null);
+		expect(mockMail).toHaveBeenCalled();
+	});
+
+	it('never throws when the database is unreachable at boot', async () => {
+		countActiveAdmins.mockRejectedValue(new Error('connect ECONNREFUSED'));
+
+		await expect(bootstrapAdmin()).resolves.toBeUndefined();
+	});
+});

test/admin/admin.mail.test.ts

@@ -0,0 +1,71 @@
+import {vi, describe, it, expect, beforeEach, type Mock} from 'vitest';
+
+vi.mock('../../src/common/common.mail.js', () => ({
+	MailService: {sendMail: vi.fn()}
+}));
+vi.mock('../../src/models/admin/admin.config.js', () => ({
+	ADMIN_APP_URL: 'https://admin.nachklang.art'
+}));
+
+import {MailService} from '../../src/common/common.mail.js';
+import {sendInvitationMail, sendPasswordResetMail} from '../../src/models/admin/admin.mail.js';
+
+const sendMail = MailService.sendMail as Mock;
+
+beforeEach(() => {
+	sendMail.mockReset();
+	sendMail.mockResolvedValue(true);
+});
+
+describe('sendInvitationMail', () => {
+	it('points at the admin app and carries the token in the query string', async () => {
+		await sendInvitationMail('a@nachklang.art', 'Anna', 'tok-en_123', new Date('2026-09-12T10:00:00Z'));
+
+		const [to, subject, text, options] = sendMail.mock.calls[0];
+		expect(to).toBe('a@nachklang.art');
+		expect(subject).toBeTruthy();
+		expect(text).toContain('https://admin.nachklang.art/accept-invite?token=tok-en_123');
+		expect(options.html).toContain('https://admin.nachklang.art/accept-invite?token=tok-en_123');
+	});
+
+	it('url-encodes a token containing url-significant characters', async () => {
+		await sendInvitationMail('a@nachklang.art', 'Anna', 'a+b/c=d', new Date());
+
+		const [, , text] = sendMail.mock.calls[0];
+		expect(text).toContain('token=a%2Bb%2Fc%3Dd');
+	});
+
+	it('sends both a text and an html part', async () => {
+		await sendInvitationMail('a@nachklang.art', 'Anna', 'tok', new Date());
+
+		const [, , text, options] = sendMail.mock.calls[0];
+		expect(text.length).toBeGreaterThan(0);
+		expect(options.html).toContain('<html');
+	});
+
+	it('escapes a name that contains html', async () => {
+		await sendInvitationMail('a@nachklang.art', '<script>alert(1)</script>', 'tok', new Date());
+
+		const [, , , options] = sendMail.mock.calls[0];
+		expect(options.html).not.toContain('<script>');
+		expect(options.html).toContain('&lt;script&gt;');
+	});
+
+	it('reports a delivery failure to the caller rather than throwing', async () => {
+		sendMail.mockResolvedValue(false);
+
+		await expect(sendInvitationMail('a@nachklang.art', 'Anna', 'tok', new Date())).resolves.toBe(false);
+	});
+});
+
+describe('sendPasswordResetMail', () => {
+	it('uses the url better-auth generated, unchanged', async () => {
+		const url = 'https://api.nachklang.art/admin/auth/reset-password/abc?callbackURL=x';
+
+		await sendPasswordResetMail('a@nachklang.art', 'Anna', url);
+
+		const [, , text, options] = sendMail.mock.calls[0];
+		expect(text).toContain(url);
+		expect(options.html).toContain('https://api.nachklang.art/admin/auth/reset-password/abc');
+	});
+});

test/admin/admin.middleware.test.ts

@@ -0,0 +1,174 @@
+import {vi, describe, it, expect, beforeEach, type Mock} from 'vitest';
+import {Request, Response} from 'express';
+
+vi.mock('../../src/models/admin/admin.auth.js', () => ({
+	auth: {api: {getSession: vi.fn()}}
+}));
+vi.mock('../../src/models/admin/users/users.admin.service.js', () => ({
+	loadAccess: vi.fn()
+}));
+
+import {auth} from '../../src/models/admin/admin.auth.js';
+import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
+import {requireAppAccess, requireSignedIn, resolveAccess} from '../../src/models/admin/admin.middleware.js';
+
+const mockGetSession = auth.api.getSession as unknown as Mock;
+const mockLoadAccess = UsersService.loadAccess as Mock;
+
+const makeReq = (): Request => ({headers: {cookie: 'nachklang.session_token=abc'}} as unknown as Request);
+
+const makeRes = (): Response => {
+	const res: any = {};
+	res.status = vi.fn().mockReturnValue(res);
+	res.send = vi.fn().mockReturnValue(res);
+	res.locals = {};
+	return res as Response;
+};
+
+const activeUser = {
+	id: 'u1',
+	email: 'a@nachklang.art',
+	displayName: 'A',
+	disabled: false,
+	apps: ['feedback', 'admin']
+};
+
+describe('resolveAccess', () => {
+	beforeEach(() => {
+		mockGetSession.mockReset();
+		mockLoadAccess.mockReset();
+	});
+
+	it('returns null without a valid session', async () => {
+		mockGetSession.mockResolvedValue(null);
+		expect(await resolveAccess(makeReq())).toBeNull();
+		expect(mockLoadAccess).not.toHaveBeenCalled();
+	});
+
+	it('returns null when the session points at a user row that is gone', async () => {
+		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+		mockLoadAccess.mockResolvedValue(null);
+		expect(await resolveAccess(makeReq())).toBeNull();
+	});
+
+	it('resolves identity and permissions in a single permission query', async () => {
+		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+		mockLoadAccess.mockResolvedValue(activeUser);
+
+		expect(await resolveAccess(makeReq())).toEqual({
+			id: 'u1',
+			email: 'a@nachklang.art',
+			displayName: 'A',
+			disabled: false,
+			apps: ['feedback', 'admin']
+		});
+		// No cookieCache: exactly one lookup per request, never zero.
+		expect(mockLoadAccess).toHaveBeenCalledTimes(1);
+	});
+});
+
+describe('requireSignedIn', () => {
+	beforeEach(() => {
+		mockGetSession.mockReset();
+		mockLoadAccess.mockReset();
+	});
+
+	it('401s without a session', async () => {
+		mockGetSession.mockResolvedValue(null);
+		const res = makeRes();
+		const next = vi.fn();
+
+		await requireSignedIn(makeReq(), res, next);
+
+		expect(res.status).toHaveBeenCalledWith(401);
+		expect(next).not.toHaveBeenCalled();
+	});
+
+	it('403s a disabled user that still holds a valid cookie', async () => {
+		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+		mockLoadAccess.mockResolvedValue({...activeUser, disabled: true});
+		const res = makeRes();
+		const next = vi.fn();
+
+		await requireSignedIn(makeReq(), res, next);
+
+		expect(res.status).toHaveBeenCalledWith(403);
+		expect(next).not.toHaveBeenCalled();
+	});
+
+	it('admits a signed-in user with no app permissions at all', async () => {
+		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+		mockLoadAccess.mockResolvedValue({...activeUser, apps: []});
+		const res = makeRes();
+		const next = vi.fn();
+
+		await requireSignedIn(makeReq(), res, next);
+
+		expect(next).toHaveBeenCalled();
+		expect(res.locals.admin.apps).toEqual([]);
+	});
+});
+
+describe('requireAppAccess', () => {
+	beforeEach(() => {
+		mockGetSession.mockReset();
+		mockLoadAccess.mockReset();
+	});
+
+	it('401s without a session', async () => {
+		mockGetSession.mockResolvedValue(null);
+		const res = makeRes();
+		const next = vi.fn();
+
+		await requireAppAccess('feedback')(makeReq(), res, next);
+
+		expect(res.status).toHaveBeenCalledWith(401);
+	});
+
+	it('403s a signed-in user without that app permission', async () => {
+		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+		mockLoadAccess.mockResolvedValue({...activeUser, apps: ['feedback']});
+		const res = makeRes();
+		const next = vi.fn();
+
+		await requireAppAccess('tickets')(makeReq(), res, next);
+
+		expect(res.status).toHaveBeenCalledWith(403);
+		expect(next).not.toHaveBeenCalled();
+	});
+
+	it('403s a disabled user even when they hold the permission', async () => {
+		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+		mockLoadAccess.mockResolvedValue({...activeUser, disabled: true});
+		const res = makeRes();
+		const next = vi.fn();
+
+		await requireAppAccess('feedback')(makeReq(), res, next);
+
+		expect(res.status).toHaveBeenCalledWith(403);
+	});
+
+	it('passes through and exposes the identity the feedback/tickets services expect', async () => {
+		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+		mockLoadAccess.mockResolvedValue(activeUser);
+		const res = makeRes();
+		const next = vi.fn();
+
+		await requireAppAccess('feedback')(makeReq(), res, next);
+
+		expect(next).toHaveBeenCalled();
+		expect(res.locals.admin).toMatchObject({id: 'u1', email: 'a@nachklang.art', displayName: 'A'});
+	});
+
+	it('500s (never allows through) when the permission query throws', async () => {
+		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+		mockLoadAccess.mockRejectedValue(new Error('db down'));
+		const res = makeRes();
+		const next = vi.fn();
+
+		await requireAppAccess('feedback')(makeReq(), res, next);
+
+		expect(res.status).toHaveBeenCalledWith(500);
+		expect(next).not.toHaveBeenCalled();
+	});
+});

test/admin/users.admin.router.test.ts

@@ -0,0 +1,165 @@
+import {vi, describe, it, expect, beforeEach, type Mock} from 'vitest';
+import express from 'express';
+import request from 'supertest';
+
+vi.mock('../../src/models/admin/users/users.admin.service.js', () => ({
+	listUsers: vi.fn(),
+	getUserDetail: vi.fn(),
+	loadAccess: vi.fn(),
+	setPermissions: vi.fn(),
+	disableUser: vi.fn(),
+	enableUser: vi.fn(),
+	revokeSession: vi.fn(),
+	countActiveAdmins: vi.fn(),
+	userExists: vi.fn()
+}));
+
+import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
+import {usersAdminRouter} from '../../src/models/admin/users/users.admin.router.js';
+
+const service = UsersService as unknown as Record<string, Mock>;
+
+// The router always runs behind requireAppAccess('admin'), which is what puts
+// res.locals.admin there; this stands in for it.
+const makeApp = (callerId = 'me') => {
+	const app = express();
+	app.use(express.json());
+	app.use((req, res, next) => {
+		res.locals.admin = {id: callerId, email: 'me@nachklang.art', displayName: 'Me', apps: ['admin']};
+		next();
+	});
+	app.use('/admin/users', usersAdminRouter);
+	return app;
+};
+
+beforeEach(() => {
+	for (const fn of Object.values(service)) {
+		if (typeof fn?.mockReset === 'function') {
+			fn.mockReset();
+		}
+	}
+	service.getUserDetail.mockResolvedValue({id: 'other', apps: []});
+	service.userExists.mockResolvedValue(true);
+});
+
+describe('PUT /admin/users/:id/permissions', () => {
+	it('rejects an unknown app name', async () => {
+		const res = await request(makeApp()).put('/admin/users/other/permissions').send({apps: ['calendar', 'nope']});
+
+		expect(res.status).toBe(400);
+		expect(service.setPermissions).not.toHaveBeenCalled();
+	});
+
+	it('rejects a non-array body', async () => {
+		const res = await request(makeApp()).put('/admin/users/other/permissions').send({apps: 'admin'});
+
+		expect(res.status).toBe(400);
+	});
+
+	it('404s for an unknown user', async () => {
+		service.userExists.mockResolvedValue(false);
+
+		const res = await request(makeApp()).put('/admin/users/ghost/permissions').send({apps: []});
+
+		expect(res.status).toBe(404);
+		expect(service.setPermissions).not.toHaveBeenCalled();
+	});
+
+	it('refuses to remove the caller\'s own admin permission', async () => {
+		service.loadAccess.mockResolvedValue({id: 'me', disabled: false, apps: ['admin']});
+		service.countActiveAdmins.mockResolvedValue(5);
+
+		const res = await request(makeApp('me')).put('/admin/users/me/permissions').send({apps: ['feedback']});
+
+		expect(res.status).toBe(409);
+		expect(service.setPermissions).not.toHaveBeenCalled();
+	});
+
+	// Defence in depth: with the caller themselves being an active admin this
+	// count cannot actually reach 1 in production, but the guard is what makes
+	// that safe to rely on rather than to reason about.
+	it('refuses to remove the last remaining active admin', async () => {
+		service.loadAccess.mockResolvedValue({id: 'other', disabled: false, apps: ['admin']});
+		service.countActiveAdmins.mockResolvedValue(1);
+
+		const res = await request(makeApp('me')).put('/admin/users/other/permissions').send({apps: []});
+
+		expect(res.status).toBe(409);
+		expect(service.setPermissions).not.toHaveBeenCalled();
+	});
+
+	it('allows removing an admin while another active admin remains', async () => {
+		service.loadAccess.mockResolvedValue({id: 'other', disabled: false, apps: ['admin']});
+		service.countActiveAdmins.mockResolvedValue(2);
+
+		const res = await request(makeApp('me')).put('/admin/users/other/permissions').send({apps: ['tickets']});
+
+		expect(res.status).toBe(200);
+		expect(service.setPermissions).toHaveBeenCalledWith('other', ['tickets'], 'me');
+	});
+
+	it('allows granting permissions to someone who has none', async () => {
+		service.loadAccess.mockResolvedValue({id: 'other', disabled: false, apps: []});
+
+		const res = await request(makeApp('me')).put('/admin/users/other/permissions').send({apps: ['feedback', 'tickets']});
+
+		expect(res.status).toBe(200);
+		// Nothing is being taken away, so the last-admin count is not consulted.
+		expect(service.countActiveAdmins).not.toHaveBeenCalled();
+	});
+});
+
+describe('POST /admin/users/:id/disable', () => {
+	it('refuses to disable the caller', async () => {
+		const res = await request(makeApp('me')).post('/admin/users/me/disable');
+
+		expect(res.status).toBe(409);
+		expect(service.disableUser).not.toHaveBeenCalled();
+	});
+
+	it('refuses to disable the last active admin', async () => {
+		service.loadAccess.mockResolvedValue({id: 'other', disabled: false, apps: ['admin']});
+		service.countActiveAdmins.mockResolvedValue(1);
+
+		const res = await request(makeApp('me')).post('/admin/users/other/disable');
+
+		expect(res.status).toBe(409);
+		expect(service.disableUser).not.toHaveBeenCalled();
+	});
+
+	it('disables a non-admin user', async () => {
+		service.loadAccess.mockResolvedValue({id: 'other', disabled: false, apps: ['feedback']});
+
+		const res = await request(makeApp('me')).post('/admin/users/other/disable');
+
+		expect(res.status).toBe(200);
+		expect(service.disableUser).toHaveBeenCalledWith('other');
+	});
+
+	it('404s for an unknown user', async () => {
+		service.loadAccess.mockResolvedValue(null);
+
+		const res = await request(makeApp('me')).post('/admin/users/ghost/disable');
+
+		expect(res.status).toBe(404);
+	});
+});
+
+describe('DELETE /admin/users/:id/sessions/:sid', () => {
+	it('404s when the session does not belong to that user', async () => {
+		service.revokeSession.mockResolvedValue(false);
+
+		const res = await request(makeApp()).delete('/admin/users/other/sessions/s1');
+
+		expect(res.status).toBe(404);
+	});
+
+	it('204s on a successful revoke', async () => {
+		service.revokeSession.mockResolvedValue(true);
+
+		const res = await request(makeApp()).delete('/admin/users/other/sessions/s1');
+
+		expect(res.status).toBe(204);
+		expect(service.revokeSession).toHaveBeenCalledWith('other', 's1');
+	});
+});

test/integration/admin.auth.test.ts

@@ -0,0 +1,272 @@
+import {describe, it, expect, beforeAll, beforeEach, afterAll} from 'vitest';
+import request from 'supertest';
+import type {Application} from 'express';
+import {createApp} from '../../src/app.factory.js';
+import * as InvitationsService from '../../src/models/admin/invitations/invitations.service.js';
+import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
+import {
+	closeDatabase,
+	createAndAcceptInvitation,
+	resetDatabase,
+	sessionCookieFrom,
+	SESSION_COOKIE
+} from './helpers.js';
+
+/**
+ * End-to-end against a real MariaDB (docker-compose.test.yml) and the real
+ * Express wiring from app.factory.ts. Mocks would not catch what this module
+ * can actually get wrong: the Kysely MySQL dialect, cookie attributes, and the
+ * middleware order that lets better-auth read the raw request body.
+ */
+
+let app: Application;
+
+beforeAll(() => {
+	app = createApp();
+});
+
+beforeEach(async () => {
+	await resetDatabase();
+});
+
+afterAll(async () => {
+	await closeDatabase();
+});
+
+describe('sign-up is closed', () => {
+	it('refuses the public sign-up endpoint', async () => {
+		const res = await request(app)
+			.post('/admin/auth/sign-up/email')
+			.send({email: 'stranger@example.com', password: 'password123', name: 'Stranger'});
+
+		expect(res.status).toBeGreaterThanOrEqual(400);
+		expect(await UsersService.findUserByEmail('stranger@example.com')).toBeNull();
+	});
+});
+
+describe('invitation acceptance', () => {
+	it('creates the user, its permissions and a session cookie', async () => {
+		const {agent, userId} = await createAndAcceptInvitation(
+			app,
+			'anna@nachklang.art',
+			'Anna',
+			['feedback', 'tickets']
+		);
+
+		const access = await UsersService.loadAccess(userId);
+		expect(access?.email).toBe('anna@nachklang.art');
+		expect(access?.apps.sort()).toEqual(['feedback', 'tickets']);
+		expect(access?.disabled).toBe(false);
+
+		// The cookie works on a subsequent request.
+		const me = await agent.get('/admin/me');
+		expect(me.status).toBe(200);
+		expect(me.body.email).toBe('anna@nachklang.art');
+		expect(me.body.apps.sort()).toEqual(['feedback', 'tickets']);
+	});
+
+	it('sets the session cookie under the configured prefix', async () => {
+		const invitation = await InvitationsService.createInvitation('b@nachklang.art', 'B', ['feedback'], null);
+
+		const res = await request(app)
+			.post('/admin/auth/invitations/accept')
+			.send({token: invitation.token, password: 'devpassword123'});
+
+		const cookie = sessionCookieFrom(res);
+		expect(cookie).toBeDefined();
+		expect(cookie).toContain('HttpOnly');
+	});
+
+	it('lets the new account sign in with the password it just set', async () => {
+		await createAndAcceptInvitation(app, 'c@nachklang.art', 'C', ['feedback'], 'my-password-1');
+
+		const res = await request(app)
+			.post('/admin/auth/sign-in/email')
+			.send({email: 'c@nachklang.art', password: 'my-password-1'});
+
+		expect(res.status).toBe(200);
+		expect(sessionCookieFrom(res)).toBeDefined();
+	});
+
+	it('previews an invitation without revealing the granted apps', async () => {
+		const invitation = await InvitationsService.createInvitation('d@nachklang.art', 'D', ['admin'], null);
+
+		const res = await request(app)
+			.post('/admin/auth/invitations/preview')
+			.send({token: invitation.token});
+
+		expect(res.status).toBe(200);
+		expect(res.body).toEqual({email: 'd@nachklang.art', name: 'D'});
+	});
+
+	it('answers an unknown token exactly like an expired one', async () => {
+		const invitation = await InvitationsService.createInvitation('e@nachklang.art', 'E', ['feedback'], null);
+		await InvitationsService.revokeInvitation(invitation.id);
+
+		const unknown = await request(app).post('/admin/auth/invitations/preview').send({token: 'no-such-token'});
+		const revoked = await request(app).post('/admin/auth/invitations/preview').send({token: invitation.token});
+
+		expect(unknown.status).toBe(revoked.status);
+		expect(unknown.body).toEqual(revoked.body);
+	});
+
+	it('cannot be redeemed twice', async () => {
+		const invitation = await InvitationsService.createInvitation('f@nachklang.art', 'F', ['feedback'], null);
+
+		const first = await request(app)
+			.post('/admin/auth/invitations/accept')
+			.send({token: invitation.token, password: 'devpassword123'});
+		const second = await request(app)
+			.post('/admin/auth/invitations/accept')
+			.send({token: invitation.token, password: 'devpassword123'});
+
+		expect(first.status).toBe(200);
+		expect(second.status).toBeGreaterThanOrEqual(400);
+	});
+
+	it('rejects an expired invitation', async () => {
+		const invitation = await InvitationsService.createInvitation('g@nachklang.art', 'G', ['feedback'], null);
+		// Reach past the service to age it: there is deliberately no API for this.
+		const {NachklangAdminDB} = await import('../../src/models/admin/Admin.db.js');
+		await NachklangAdminDB.db
+			.updateTable('invitations')
+			.set({expires_at: new Date(Date.now() - 1000)})
+			.where('id', '=', invitation.id)
+			.execute();
+
+		const res = await request(app)
+			.post('/admin/auth/invitations/accept')
+			.send({token: invitation.token, password: 'devpassword123'});
+
+		expect(res.status).toBeGreaterThanOrEqual(400);
+	});
+
+	it('rejects a password below the minimum length', async () => {
+		const invitation = await InvitationsService.createInvitation('h@nachklang.art', 'H', ['feedback'], null);
+
+		const res = await request(app)
+			.post('/admin/auth/invitations/accept')
+			.send({token: invitation.token, password: 'short'});
+
+		expect(res.status).toBeGreaterThanOrEqual(400);
+		expect(await UsersService.findUserByEmail('h@nachklang.art')).toBeNull();
+	});
+});
+
+describe('sessions', () => {
+	it('signs out and stops accepting the cookie', async () => {
+		const {agent} = await createAndAcceptInvitation(app, 'i@nachklang.art', 'I', ['feedback']);
+
+		expect((await agent.get('/admin/me')).status).toBe(200);
+
+		const signOut = await agent.post('/admin/auth/sign-out').send({});
+		expect(signOut.status).toBe(200);
+
+		expect((await agent.get('/admin/me')).status).toBe(401);
+	});
+
+	it('rejects a disabled user who still holds a valid cookie', async () => {
+		const {agent, userId} = await createAndAcceptInvitation(app, 'j@nachklang.art', 'J', ['feedback']);
+
+		// Strip the permission check out of the picture: disable without going
+		// through disableUser's session revocation, so the cookie stays live.
+		const {NachklangAdminDB} = await import('../../src/models/admin/Admin.db.js');
+		await NachklangAdminDB.db.updateTable('user').set({disabled: true}).where('id', '=', userId).execute();
+
+		const res = await agent.get('/admin/me');
+		expect(res.status).toBe(403);
+	});
+
+	it('disabling a user revokes their sessions immediately', async () => {
+		const {agent, userId} = await createAndAcceptInvitation(app, 'k@nachklang.art', 'K', ['feedback']);
+
+		await UsersService.disableUser(userId);
+
+		const res = await agent.get('/admin/me');
+		expect(res.status).toBe(401);
+	});
+
+	it('refuses to sign a disabled user back in', async () => {
+		const {userId} = await createAndAcceptInvitation(app, 'l@nachklang.art', 'L', ['feedback'], 'my-password-1');
+		await UsersService.disableUser(userId);
+
+		const res = await request(app)
+			.post('/admin/auth/sign-in/email')
+			.send({email: 'l@nachklang.art', password: 'my-password-1'});
+
+		expect(res.status).toBeGreaterThanOrEqual(400);
+		expect(sessionCookieFrom(res)).toBeUndefined();
+	});
+});
+
+describe('requireAppAccess', () => {
+	it('401s an anonymous request', async () => {
+		expect((await request(app).get('/admin/me')).status).toBe(401);
+		expect((await request(app).get('/admin/users')).status).toBe(401);
+	});
+
+	it('403s a signed-in user without the admin permission', async () => {
+		const {agent} = await createAndAcceptInvitation(app, 'm@nachklang.art', 'M', ['feedback']);
+
+		const res = await agent.get('/admin/users');
+		expect(res.status).toBe(403);
+	});
+
+	it('lets an admin through', async () => {
+		const {agent} = await createAndAcceptInvitation(app, 'n@nachklang.art', 'N', ['admin']);
+
+		const res = await agent.get('/admin/users');
+		expect(res.status).toBe(200);
+		expect(Array.isArray(res.body)).toBe(true);
+	});
+
+	// Step 2 deliberately does NOT swap the feedback and tickets authenticators:
+	// they still authenticate against the legacy calendar sessions, so an admin
+	// cookie means nothing to them yet. This asserts that boundary rather than
+	// the end state - when step 4 lands, these two expectations become 200/403
+	// and this comment goes away.
+	it('leaves the feedback and tickets admin areas on their legacy authenticator', async () => {
+		const user = await createAndAcceptInvitation(app, 'o@nachklang.art', 'O', ['feedback', 'tickets']);
+
+		expect((await user.agent.get('/feedback/admin/me')).status).toBe(401);
+		expect((await user.agent.get('/tickets/admin/me')).status).toBe(401);
+	});
+});
+
+describe('origin checks', () => {
+	it('rejects a cookie-bearing request from an untrusted origin', async () => {
+		const {agent} = await createAndAcceptInvitation(app, 'p@nachklang.art', 'P', ['admin']);
+
+		const res = await agent
+			.post('/admin/auth/sign-out')
+			.set('Origin', 'https://evil.example')
+			.send({});
+
+		expect(res.status).toBeGreaterThanOrEqual(400);
+	});
+
+	it('accepts the admin app origin', async () => {
+		const {agent} = await createAndAcceptInvitation(app, 'q@nachklang.art', 'Q', ['admin']);
+
+		const res = await agent
+			.post('/admin/auth/sign-out')
+			.set('Origin', 'http://localhost:3002')
+			.send({});
+
+		expect(res.status).toBe(200);
+	});
+});
+
+describe('the session cookie is not readable by scripts', () => {
+	it('is HttpOnly and SameSite=Lax', async () => {
+		const invitation = await InvitationsService.createInvitation('r@nachklang.art', 'R', ['feedback'], null);
+		const res = await request(app)
+			.post('/admin/auth/invitations/accept')
+			.send({token: invitation.token, password: 'devpassword123'});
+
+		const cookie = sessionCookieFrom(res) || '';
+		expect(cookie).toContain(SESSION_COOKIE);
+		expect(cookie).toContain('HttpOnly');
+		expect(cookie.toLowerCase()).toContain('samesite=lax');
+	});
+});

test/integration/admin.users.test.ts

@@ -0,0 +1,255 @@
+import {describe, it, expect, beforeAll, beforeEach, afterAll} from 'vitest';
+import request from 'supertest';
+import type {Application} from 'express';
+import {createApp} from '../../src/app.factory.js';
+import * as InvitationsService from '../../src/models/admin/invitations/invitations.service.js';
+import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
+import {bootstrapAdmin} from '../../src/models/admin/admin.bootstrap.js';
+import {closeDatabase, createAndAcceptInvitation, resetDatabase} from './helpers.js';
+
+let app: Application;
+
+beforeAll(() => {
+	app = createApp();
+});
+
+beforeEach(async () => {
+	await resetDatabase();
+});
+
+afterAll(async () => {
+	await closeDatabase();
+});
+
+/** Most tests here need somebody who may administer. */
+const signedInAdmin = async (email = 'admin@nachklang.art') => {
+	return createAndAcceptInvitation(app, email, 'Admin', ['admin']);
+};
+
+describe('GET /admin/users', () => {
+	it('lists users with their permissions and derived status', async () => {
+		const {agent} = await signedInAdmin();
+		await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);
+
+		const res = await agent.get('/admin/users');
+
+		expect(res.status).toBe(200);
+		const listed = res.body.find((u: any) => u.email === 'user@nachklang.art');
+		expect(listed.apps).toEqual(['feedback']);
+		expect(listed.status).toBe('aktiv');
+		expect(listed.lastSignInAt).not.toBeNull();
+	});
+
+	it('shows a disabled user as deaktiviert', async () => {
+		const {agent} = await signedInAdmin();
+		const other = await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);
+		await UsersService.disableUser(other.userId);
+
+		const res = await agent.get('/admin/users');
+		const listed = res.body.find((u: any) => u.email === 'user@nachklang.art');
+		expect(listed.status).toBe('deaktiviert');
+	});
+});
+
+describe('GET /admin/users/:id', () => {
+	it('returns active sessions and the passkey count', async () => {
+		const {agent} = await signedInAdmin();
+		const other = await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);
+
+		const res = await agent.get(`/admin/users/${other.userId}`);
+
+		expect(res.status).toBe(200);
+		expect(res.body.sessions.length).toBe(1);
+		expect(res.body.passkeyCount).toBe(0);
+	});
+
+	it('404s for an unknown id', async () => {
+		const {agent} = await signedInAdmin();
+		expect((await agent.get('/admin/users/does-not-exist')).status).toBe(404);
+	});
+});
+
+describe('permission changes', () => {
+	it('replaces the permission set', async () => {
+		const {agent} = await signedInAdmin();
+		const other = await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);
+
+		const res = await agent
+			.put(`/admin/users/${other.userId}/permissions`)
+			.send({apps: ['tickets', 'calendar']});
+
+		expect(res.status).toBe(200);
+		const access = await UsersService.loadAccess(other.userId);
+		expect(access?.apps.sort()).toEqual(['calendar', 'tickets']);
+	});
+
+	it('takes effect on the next request the affected user makes', async () => {
+		const {agent} = await signedInAdmin();
+		const other = await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['admin']);
+
+		expect((await other.agent.get('/admin/users')).status).toBe(200);
+
+		await agent.put(`/admin/users/${other.userId}/permissions`).send({apps: ['feedback']});
+
+		// No cookie cache: the very next request is already denied, on the same
+		// still-valid session cookie.
+		expect((await other.agent.get('/admin/users')).status).toBe(403);
+	});
+
+	it('refuses to strip the last admin', async () => {
+		const {agent, userId} = await signedInAdmin();
+
+		const res = await agent.put(`/admin/users/${userId}/permissions`).send({apps: ['feedback']});
+
+		expect(res.status).toBe(409);
+		expect((await UsersService.loadAccess(userId))?.apps).toContain('admin');
+	});
+
+	it('refuses to disable the caller themselves', async () => {
+		const {agent, userId} = await signedInAdmin();
+
+		const res = await agent.post(`/admin/users/${userId}/disable`);
+
+		expect(res.status).toBe(409);
+		expect((await UsersService.loadAccess(userId))?.disabled).toBe(false);
+	});
+
+	it('allows disabling a second admin', async () => {
+		const {agent} = await signedInAdmin();
+		const second = await createAndAcceptInvitation(app, 'admin2@nachklang.art', 'Admin2', ['admin']);
+
+		expect((await agent.post(`/admin/users/${second.userId}/disable`)).status).toBe(200);
+		expect((await second.agent.get('/admin/me')).status).toBe(401);
+	});
+
+	it('re-enables a disabled user without restoring their old sessions', async () => {
+		const {agent} = await signedInAdmin();
+		const other = await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);
+		await agent.post(`/admin/users/${other.userId}/disable`);
+
+		expect((await agent.post(`/admin/users/${other.userId}/enable`)).status).toBe(200);
+		expect((await UsersService.loadAccess(other.userId))?.disabled).toBe(false);
+		// The revoked session stays revoked; they sign in again.
+		expect((await other.agent.get('/admin/me')).status).toBe(401);
+	});
+});
+
+describe('session revocation', () => {
+	it('revokes one session of another user', async () => {
+		const {agent} = await signedInAdmin();
+		const other = await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);
+
+		const detail = await agent.get(`/admin/users/${other.userId}`);
+		const sessionId = detail.body.sessions[0].id;
+
+		const res = await agent.delete(`/admin/users/${other.userId}/sessions/${sessionId}`);
+		expect(res.status).toBe(204);
+
+		expect((await other.agent.get('/admin/me')).status).toBe(401);
+	});
+});
+
+describe('invitations', () => {
+	it('creates one and lists it as open', async () => {
+		const {agent} = await signedInAdmin();
+
+		const created = await agent
+			.post('/admin/invitations')
+			.send({email: 'new@nachklang.art', name: 'New', apps: ['feedback']});
+
+		expect(created.status).toBe(201);
+		// Mail is disabled in tests, and the token must never be returned.
+		expect(created.body.token).toBeUndefined();
+
+		const list = await agent.get('/admin/invitations');
+		expect(list.body.map((i: any) => i.email)).toContain('new@nachklang.art');
+	});
+
+	it('refuses to invite an address that already has an account', async () => {
+		const {agent} = await signedInAdmin();
+		await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);
+
+		const res = await agent
+			.post('/admin/invitations')
+			.send({email: 'user@nachklang.art', name: 'User', apps: ['feedback']});
+
+		expect(res.status).toBe(409);
+	});
+
+	it('rejects an invalid email or app name', async () => {
+		const {agent} = await signedInAdmin();
+
+		expect((await agent.post('/admin/invitations').send({email: 'nope', name: 'X', apps: []})).status).toBe(400);
+		expect((await agent.post('/admin/invitations').send({email: 'a@b.de', name: 'X', apps: ['nope']})).status).toBe(400);
+	});
+
+	it('invalidates the previous link on resend', async () => {
+		const {agent} = await signedInAdmin();
+		const original = await InvitationsService.createInvitation('new@nachklang.art', 'New', ['feedback'], null);
+
+		const resent = await agent.post(`/admin/invitations/${original.id}/resend`);
+		expect(resent.status).toBe(200);
+
+		const oldLink = await request(app)
+			.post('/admin/auth/invitations/preview')
+			.send({token: original.token});
+		expect(oldLink.status).toBeGreaterThanOrEqual(400);
+	});
+
+	it('revokes an invitation', async () => {
+		const {agent} = await signedInAdmin();
+		const invitation = await InvitationsService.createInvitation('new@nachklang.art', 'New', ['feedback'], null);
+
+		expect((await agent.delete(`/admin/invitations/${invitation.id}`)).status).toBe(204);
+		expect((await agent.delete(`/admin/invitations/${invitation.id}`)).status).toBe(404);
+
+		const preview = await request(app)
+			.post('/admin/auth/invitations/preview')
+			.send({token: invitation.token});
+		expect(preview.status).toBeGreaterThanOrEqual(400);
+	});
+});
+
+describe('bootstrap', () => {
+	it('creates an admin invitation on an empty database', async () => {
+		await bootstrapAdmin();
+
+		expect(await InvitationsService.hasOpenInvitationFor('boot@nachklang.art')).toBe(true);
+	});
+
+	it('is idempotent across restarts', async () => {
+		await bootstrapAdmin();
+		await bootstrapAdmin();
+
+		const open = await InvitationsService.listOpenInvitations();
+		expect(open.filter(i => i.email === 'boot@nachklang.art').length).toBe(1);
+	});
+
+	it('grants admin to an address that already has an account', async () => {
+		const user = await createAndAcceptInvitation(app, 'boot@nachklang.art', 'Boot', ['feedback']);
+
+		await bootstrapAdmin();
+
+		expect((await UsersService.loadAccess(user.userId))?.apps).toContain('admin');
+	});
+
+	it('does nothing once an active admin exists', async () => {
+		await signedInAdmin();
+
+		await bootstrapAdmin();
+
+		expect(await InvitationsService.hasOpenInvitationFor('boot@nachklang.art')).toBe(false);
+	});
+});
+
+describe('passkey endpoints', () => {
+	it('requires a session to list passkeys', async () => {
+		const anonymous = await request(app).get('/admin/auth/passkey/list-user-passkeys');
+		expect(anonymous.status).toBeGreaterThanOrEqual(400);
+
+		const {agent} = await signedInAdmin();
+		const res = await agent.get('/admin/auth/passkey/list-user-passkeys');
+		expect(res.status).toBe(200);
+		expect(res.body).toEqual([]);
+	});
+});

test/integration/helpers.ts

@@ -0,0 +1,58 @@
+import {expect} from 'vitest';
+import type {Application} from 'express';
+import request from 'supertest';
+import {NachklangAdminDB} from '../../src/models/admin/Admin.db.js';
+import * as InvitationsService from '../../src/models/admin/invitations/invitations.service.js';
+import {AppName} from '../../src/models/admin/admin.schema.js';
+
+const db = NachklangAdminDB.db;
+
+// Dev/test cookie name: advanced.cookiePrefix is 'nachklang', and the __Secure-
+// prefix is only added over https.
+export const SESSION_COOKIE = 'nachklang.session_token';
+
+/** Wipes every table between test files. Child tables first - the FKs to
+ *  `user` are ON DELETE CASCADE, but rateLimit and invitations are not. */
+export const resetDatabase = async (): Promise<void> => {
+	await db.deleteFrom('session').execute();
+	await db.deleteFrom('user_app_permissions').execute();
+	await db.deleteFrom('passkey').execute();
+	await db.deleteFrom('invitations').execute();
+	await db.deleteFrom('user').execute();
+};
+
+export const closeDatabase = async (): Promise<void> => {
+	await db.destroy();
+};
+
+/**
+ * Creates an invitation straight through the service (so the test gets the raw
+ * token, which the API deliberately never returns) and redeems it through the
+ * public endpoint. Returns an agent that carries the resulting session cookie.
+ */
+export const createAndAcceptInvitation = async (
+	app: Application,
+	email: string,
+	name: string,
+	apps: AppName[],
+	password = 'devpassword123'
+) => {
+	const invitation = await InvitationsService.createInvitation(email, name, apps, null);
+
+	const agent = request.agent(app);
+	const res = await agent
+		.post('/admin/auth/invitations/accept')
+		.send({token: invitation.token, password});
+
+	expect(res.status).toBe(200);
+	return {agent, userId: res.body.user.id, token: invitation.token};
+};
+
+export const cookieHeader = (res: request.Response): string[] => {
+	const raw = res.headers['set-cookie'];
+	return Array.isArray(raw) ? raw : raw ? [raw] : [];
+};
+
+export const sessionCookieFrom = (res: request.Response): string | undefined => {
+	return cookieHeader(res).find(cookie => cookie.startsWith(SESSION_COOKIE));
+};

test/integration/setup.ts

@@ -0,0 +1,107 @@
+import {execFile} from 'child_process';
+import {promisify} from 'util';
+import {createRequire} from 'module';
+
+const run = promisify(execFile);
+const require = createRequire(import.meta.url);
+
+/**
+ * vitest globalSetup for the admin integration tests: starts a throwaway
+ * MariaDB before the suite and removes it afterwards, so a run leaves nothing
+ * behind and never touches a shared database.
+ *
+ * The container is started directly rather than through compose, because
+ * `podman compose` needs a separate compose provider that neither podman nor
+ * docker ships. One container needs no orchestration, and this works with
+ * whichever of the two runtimes is installed.
+ */
+
+export const CONTAINER_NAME = 'nachklang-admin-test-db';
+export const TEST_DB_PORT = 3307;
+
+const IMAGE = 'docker.io/library/mariadb:11';
+
+const runtime = async (): Promise<string> => {
+	for (const candidate of ['docker', 'podman']) {
+		try {
+			await run(candidate, ['info'], {timeout: 60_000});
+			return candidate;
+		} catch {
+			// Not installed, or its daemon/machine is not running - try the next.
+		}
+	}
+	throw new Error(
+		'The admin integration tests need a container runtime. Install docker or podman ' +
+		'(with podman: `podman machine start`), then re-run npm run test:integration.'
+	);
+};
+
+/**
+ * Ready means "the entrypoint has applied 001_init.sql", not just "the port
+ * answers": MariaDB accepts connections while it is still running its init
+ * scripts, and a test that started then would fail on a missing table.
+ */
+const waitForSchema = async (): Promise<void> => {
+	const mysql = require('mysql2/promise');
+	const deadline = Date.now() + 120_000;
+	let lastError: unknown;
+
+	while (Date.now() < deadline) {
+		try {
+			const connection = await mysql.createConnection({
+				host: '127.0.0.1',
+				port: TEST_DB_PORT,
+				user: 'nachklang',
+				password: 'testpassword',
+				database: 'nachklang_admin',
+				connectTimeout: 5_000
+			});
+			const [rows] = await connection.query(
+				"SELECT COUNT(*) AS n FROM information_schema.tables " +
+				"WHERE table_schema = 'nachklang_admin' AND table_name IN ('user', 'user_app_permissions', 'invitations')"
+			);
+			await connection.end();
+			if (Number((rows as any[])[0]?.n) === 3) {
+				return;
+			}
+			lastError = new Error('schema not applied yet');
+		} catch (e) {
+			lastError = e;
+		}
+		await new Promise(resolve => setTimeout(resolve, 1_000));
+	}
+
+	throw new Error(`Test database never became ready: ${(lastError as any)?.message}`);
+};
+
+export const setup = async () => {
+	const engine = await runtime();
+
+	// A container left behind by an interrupted run would still hold the old
+	// schema and rows, so always start from scratch.
+	await run(engine, ['rm', '-f', CONTAINER_NAME], {timeout: 60_000}).catch(() => undefined);
+
+	await run(engine, [
+		'run', '-d',
+		'--name', CONTAINER_NAME,
+		'-e', 'MARIADB_ROOT_PASSWORD=roottestpassword',
+		'-e', 'MARIADB_DATABASE=nachklang_admin',
+		'-e', 'MARIADB_USER=nachklang',
+		'-e', 'MARIADB_PASSWORD=testpassword',
+		'-p', `${TEST_DB_PORT}:3306`,
+		// The very migration production runs, applied by the entrypoint on first
+		// boot - so a mistake in it fails the test run rather than the deploy.
+		'-v', `${process.cwd()}/sql/admin/001_init.sql:/docker-entrypoint-initdb.d/001_init.sql:ro`,
+		// Data lives in the container layer and dies with it.
+		IMAGE
+	], {timeout: 300_000});
+
+	await waitForSchema();
+};
+
+export const teardown = async () => {
+	const engine = await runtime().catch(() => null);
+	if (engine) {
+		await run(engine, ['rm', '-f', CONTAINER_NAME], {timeout: 60_000}).catch(() => undefined);
+	}
+};

vitest.config.ts

@@ -3,6 +3,9 @@ import {defineConfig} from 'vitest/config';
 export default defineConfig({
 	test: {
 		include: ['test/**/*.test.ts'],
+		// The integration suite needs a Docker MariaDB and runs separately via
+		// npm run test:integration (vitest.integration.config.ts).
+		exclude: ['test/integration/**'],
 		environment: 'node',
 		// feedback.ratelimit throws at import time without a salt (see
 		// test/feedback/ratelimit.salt-guard.test.ts). Set one here so the suite

vitest.integration.config.ts

@@ -0,0 +1,38 @@
+import {defineConfig} from 'vitest/config';
+
+/**
+ * The admin module's integration tests. Separate from vitest.config.ts because
+ * these need Docker: they run against a real MariaDB (see
+ * docker-compose.test.yml) rather than mocks, which is the only way to catch
+ * the Kysely/MariaDB dialect and cookie-attribute problems this module can have.
+ *
+ * Run with: npm run test:integration
+ */
+export default defineConfig({
+	test: {
+		include: ['test/integration/**/*.test.ts'],
+		environment: 'node',
+		globalSetup: ['test/integration/setup.ts'],
+		// One database, shared state: parallel files would fight over the same
+		// user and invitation rows.
+		fileParallelism: false,
+		testTimeout: 30_000,
+		hookTimeout: 180_000,
+		env: {
+			NODE_ENV: 'test',
+			FEEDBACK_IP_SALT: 'vitest-salt',
+			DB_HOST: '127.0.0.1',
+			DB_PORT: '3307',
+			DB_USER: 'nachklang',
+			DB_PASSWORD: 'testpassword',
+			ADMIN_DB: 'nachklang_admin',
+			API_BASE_URL: 'http://localhost:3000',
+			ADMIN_APP_URL: 'http://localhost:3002',
+			APP_ORIGINS: 'http://localhost:3001',
+			BETTER_AUTH_SECRET: 'integration-test-secret-not-used-anywhere-else',
+			PASSKEY_RP_ID: 'localhost',
+			ADMIN_BOOTSTRAP_EMAIL: 'boot@nachklang.art',
+			SALESFORCE_ENABLED: 'false'
+		}
+	}
+});