# Migrating the Calendar domain onto the admin identity module Status: **complete.** Steps 1, 3 and 4 were deployed and verified in production on 2026-09-06; step 2 was dropped by decision and part of step 5 brought forward. Step 5 is implemented and awaiting deploy - see its own checklist below, whose ordering is the **opposite** of step 4's. Verified live after step 4: the public calendar still answers anonymously, all 23 public events kept a resolvable author, restricted calendars still refuse without a credential, legacy query credentials answer 401, and `calendar.nachklang.art` is trusted for sign-out. Written 2026-09-05 alongside the admin module (step 2 of `docs/plan-admin-auth.md` in the nachklang-admin repo), which deliberately left the calendar alone. Steps 1-4 of that plan are now live, so the calendar is the last module still on the legacy query-parameter sessions. ## Why the calendar was left out The admin module replaced authentication for feedback and tickets by swapping one middleware. The calendar cannot be done that way, because its user identity is woven into its data: - `users`/`sessions` live in the **calendar** database and are the same tables the feedback and tickets admin areas used to authenticate against. - `events.created_by_id` is an **INT** foreign key into `users.user_id`. The admin module's user ids are **VARCHAR(36)** strings. Migrating identity means migrating that column and every query that joins it. - The Angular frontend passes `sessionId`/`sessionKey` as **query parameters** (`DEFERRED_SECURITY.md` item 1). Cookie sessions remove the parameters entirely, so every calendar route signature and the frontend's HTTP layer change together. - `credentials.service.ts` implements a second, parallel authorisation model: the `MEMBER_CREDENTIAL` / `CHOIR_CREDENTIAL` / `MANAGEMENT_CREDENTIAL` shared secrets that let non-users read specific calendars. That has no equivalent in the admin module and is not a per-user permission at all. What already exists today: `calendar` is a value in the `user_app_permissions.app` enum, so permissions can be granted before anything else moves. ## What is in place to build on - Cookie sessions across `*.nachklang.art`, and `requireAppAccess('calendar')` in `src/models/admin/admin.middleware.ts` - usable the moment a calendar route wants it. - `res.locals.admin` is `{id, email, displayName, apps}`; `id` is the string user id. - Invitations, disable/enable and session revocation already cover calendar users, because they are properties of the account rather than of an app. ## Suggested sequence Each step is meant to leave production working on its own. 1. **Add a bridging column.** ~~`ALTER TABLE events ADD COLUMN created_by_user_id VARCHAR(36) NULL`, indexed. Nothing reads it yet.~~ **Done 2026-09-06**, as `sql/calendar/001_add_admin_user_bridge.sql` - the first migration this repo owns for the calendar schema, mirrored into `docker/init/01-calendar-schema-dev.sql`. It covers both `events.created_by_user_id` and `event_versions.version_created_by_user_id`, and carries no foreign key (see "What the code actually looks like" below). The dev seed leaves two events on the legacy path and gives one an admin id, so step 3's dual-read has both cases to exercise. Verified by applying the pre-migration schema and then the migration to a throwaway MariaDB 11 container, and diffing `SHOW CREATE TABLE` against a fresh dev schema: identical. Applied to the running dev database on the same day; a dev container created before then needs it applied, or recreating. 2. ~~**Map the accounts.**~~ **Dropped 2026-09-06.** There is no backfill: since the creator is only ever a display name (see below), old events keep resolving through the legacy join until step 5 and then simply lose the name. Re-inviting the people who actually still need calendar access remains an operational task, but it is no longer a migration step and nothing is blocked on it. 3. **Dual-read.** ~~Change `events.service.ts` to prefer `created_by_user_id` and fall back to `created_by_id`. Writes fill both.~~ **Done 2026-09-06.** `events.service.ts` now reads both columns and prefers the admin one, resolving the name through a single `findDisplayNames` lookup against the admin database per result set (added to `users.admin.service.ts` for this). Four copies of the same SELECT and four copies of the row mapper were collapsed into one of each first - the dual read would otherwise have had to be written four times. A name now has three possible sources, tried weakest first: the legacy join, then the `created_by_name` snapshot from migration 002, then the live admin lookup - which wins because it is the only one that follows an account being renamed. An admin id that no longer resolves falls back rather than blanking, and a failure to reach the admin database is caught and logged rather than propagated, so an anonymous read of the public calendar never depends on the admin database being up. Covered by `test/calendar/events.service.test.ts`. **Writes are not dual-written**, contrary to the original plan: before the cutover the request only ever carries a legacy session, so there is no admin id available to write. Writes start filling `created_by_user_id` (and stop filling `created_by_id`) in step 4. 4. **Switch the routes.** ~~Replace the query-parameter session checks in `events.router.ts` and `users.router.ts` with `requireAppAccess('calendar')`, and change the Angular frontend to `withCredentials: true`.~~ **Done 2026-09-06.** `DEFERRED_SECURITY.md` item 1 is closed: no route reads `sessionId`/`sessionKey` any more. How it came out, route by route: - The four write routes sit behind `requireAppAccess('calendar')` as middleware. They answer 401 when signed out and 403 without the permission, where they used to answer 403 for both. - The three read routes cannot use middleware - the same URL serves an anonymous visitor, an iCal subscription holding a shared password, and a signed-in editor who should see drafts. They call `resolveAccess` optionally instead (`signedInEditor` in the router), and a signed-in user *without* the calendar permission is treated as anonymous rather than refused, so they keep their access to the public calendar. - `credentials.service.ts` lost its session half entirely and is now just the password table. `hasAccess(calendar, password)`. - `/calendar/users/*` was left alone. Nothing calls it and a session it mints opens nothing, but they are live password-accepting endpoints - step 5 removes them. Also: `calendar.nachklang.art` joined `DEFAULT_APP_ORIGINS` (better-auth `trustedOrigins`, without which sign-out from the calendar fails while everything else works), and `localhost:4200` joined the dev origins for the same reason. Two things this step had to carry that the original sequence put in step 5: - **`sql/calendar/003_allow_null_legacy_creator.sql` makes `events.created_by_id` nullable** (`MODIFY created_by_id INT NULL`). It is `NOT NULL` today, so the first event created after the cutover would otherwise fail to insert - there is no legacy int id to write any more. `event_versions.version_created_by_id` is already nullable. The foreign key can stay until step 5; it permits NULL. It also re-runs 002's idempotent name backfill, to catch anything created between the two migrations. Applying it early is safe - widening a column to accept NULL cannot break the running pre-cutover build. - **The public calendar stays anonymous.** `hasAccess('public')` returns true before any credential check, and nachklang.art reads `/calendar/events/public/json` and `/public/json/next` with no session at all. Pinned at both levels - the password table in `test/calendar/credentials.service.test.ts`, the routes themselves in `test/calendar/events.router.test.ts` - so this cannot regress quietly. ### Deploy checklist Production has **none** of the three migrations: 001 and 002 were only ever applied to the dev database. The API build below selects `created_by_user_id` and `created_by_name` on every read, so deploying it against a database missing them fails every calendar request including the anonymous public feed the website uses. In order: 1. **Apply `sql/calendar/001`, `002`, `003`, in that order**, against `CALENDAR_DB`. All three are re-runnable, so applying one that is already applied is a no-op. Verify before continuing: `SHOW COLUMNS FROM events LIKE '%by_user%'; SHOW COLUMNS FROM events LIKE '%by_name%';` - four rows across the two tables, and `created_by_id` nullable. 2. **Check `APP_ORIGINS` on the API vhost.** `calendar.nachklang.art` is in the code's default list, but the environment variable *replaces* that list rather than adding to it - so if it is set at all (the tickets/feedback cutover may have set it), append `https://calendar.nachklang.art` or the calendar's sign-out will 403 while everything else works. That is the failure mode the comment in `admin.config.ts` warns about. 3. **Deploy the API.** 4. **Deploy the calendar frontend immediately after.** Do not leave a gap - see below. 5. **Re-run 002's two `UPDATE` statements.** Between step 1 and step 3 the old API was still writing `created_by_id` with no snapshot; those few rows would otherwise lose their author at step 5. 6. **Rebuild the admin app** if `NEXT_PUBLIC_ALLOWED_REDIRECT_ORIGINS` does not already contain `https://calendar.nachklang.art`. It is a **build-time** value, so a restart does nothing. **The window between steps 3 and 4 does not look broken, which is the danger.** The old Angular bundle starts by calling `POST /calendar/users/checkSessionValid`, and those legacy routes are untouched - so it still succeeds and the page renders as signed in. What the user then sees is an empty event table and saves that silently do nothing. It looks like the calendar lost its data, not like a deploy in progress. Keep the gap to minutes, or take the frontend offline for it. **One-way door:** any iCal subscription whose URL carries `?sessionId=&sessionKey=` rather than `?password=` stops working permanently. The shared-password URLs are unaffected. 5. **Drop the legacy path.** **Implemented 2026-09-06** on `feature/calendar-drop-legacy-path`; not yet deployed. Gated on step 4 being live, which it now is. What went: - `src/models/calendar/users/` in its entirety - registration, login, activation, both password-reset routes, and the session checking the feedback and tickets admin areas used to authenticate against - plus its mount in `Calendar.router.ts`. That was the API's last unauthenticated account-creation and mail-sending endpoint. - The two `LEFT OUTER JOIN users` clauses in `events.service.ts` and the `legacy_*` aliases they fed, along with `created_by_id` / `version_created_by_id` in the SELECT, the row mapper and the `Event` interface. One name source remains besides the live admin lookup: the snapshot, which is what made this safe. - `X-Session-Id` / `X-Session-Key` from the CORS `allowedHeaders`. Nothing had read them since the tickets and feedback cutover, or sent them since this one. - The tripwire in `test/admin/auth-binding.ts` asserting neither module fell back to a calendar header session. There is nothing left to fall back to. `DEFERRED_SECURITY.md` items **3** and **4** (activation and reset tokens never expiring) close with it - not by adding expiries but by deleting the code that issued them. ### Deploy checklist — note the order is REVERSED from step 4 Step 4's migration only added columns, so it went first. `004` *removes* columns and a table that the currently running build still selects and joins, so running it first fails every calendar read including the public feed. The step 5 build references none of them and runs happily against the old schema. Therefore: 1. **Confirm the snapshot is complete.** Both must return 0: ```sql SELECT SUM(created_by_id IS NOT NULL AND created_by_name IS NULL) FROM events; SELECT SUM(version_created_by_id IS NOT NULL AND version_created_by_name IS NULL) FROM event_versions; ``` A non-zero count is an event whose author `004` would erase. Re-run 002's backfill first. 2. **Deploy the API.** No frontend deploy is needed: the calendar frontend never read `createdById` (its `Event` model has only the name), and nothing else is known to. 3. **Confirm the calendar still works** - the public feed, a signed-in read, and one save. At this point the old columns and tables still exist, unused, so this step is fully reversible by redeploying the previous build. Note that `tsc` does not remove output for deleted sources, so a build over an existing `dist/` leaves `dist/src/models/calendar/users/*.js` behind. Nothing imports it and the routes 404, but the deployed artifact still contains the code - clear `dist/` in the pipeline if you want the artifact to match the source. 4. **Apply `sql/calendar/004_drop_legacy_auth.sql`.** This is the point of no return for the columns; the accounts themselves are only renamed aside. 5. Optionally, later and at a quiet moment: `DROP TABLE sessions_legacy_archive, users_legacy_archive;` **One-way door:** `Event.createdById` and `lastModifiedById` leave the API response. Check anything reading `/calendar/events/*/json` that is not the calendar frontend. ## What the code actually looks like (surveyed 2026-09-06) Four things found while doing step 1 that change how the later steps should be built: - **`created_by_id` is display-only.** Nothing authorises on it. `events.router.ts` gates PUT, POST, DELETE and `/move` on `user?.isActive` alone - there is no "only the creator may edit" rule anywhere - and the column is read back solely to render `created_by_name` and `last_modified_by_name`. That de-risks steps 2, 3 and 5 considerably: an event whose creator never gets re-invited loses a name in the UI, it does not become uneditable or invisible. It also means the step 2 backfill is best-effort, not a precondition. - **The two schemas are separate databases.** `nachklang_calendar` and `nachklang_admin` have their own connection pools (`Calendar.db.ts` vs the admin module's Kysely instance). So the bridging columns get no foreign key, and - the part the original sequence missed - **the `LEFT OUTER JOIN users` that produces the creator's name cannot simply be repointed**. It would have to become a cross-schema join, which hardcodes the admin database name into calendar SQL and ties the two schemas together exactly as an FK would. Recommendation for step 3: drop the join for the new path and resolve names in the service layer instead - collect the distinct ids from the result set and do one lookup against the admin users service. One extra query per listing, no coupling, and it keeps working if the admin database ever moves. - **`events.created_by_id` is `NOT NULL`.** Step 5 cannot simply stop writing it; that step has to drop the column (and its FK to `users`) in the same migration that stops the writes, or make it nullable first. - **Every calendar read already hits the session table.** `/:calendar/json` calls `UserService.checkSession` before falling back to `credentials.service.ts`, so the shared credentials are the *fallback*, not the primary path. Step 4 replaces the first half of that with `requireAppAccess('calendar')` and has to decide what happens to the second half - which is the first open question below. ## Open questions to settle before starting **Settled 2026-09-06:** - **The shared calendar credentials keep working, but only for iCal.** The web app goes cookie-only at step 4; `MEMBER_CREDENTIAL` and friends survive on `GET /calendar/events/{calendar}/ical`, which is the one case where the client genuinely cannot send a cookie. Everything else in `credentials.service.ts` goes with step 5. `public` stays anonymous everywhere - see the note under step 4. - **The iCal export keeps its own scheme.** Same reasoning; it is the reason the shared credentials survive at all rather than an exception to their removal. - **No account backfill.** See step 2 above. - **Pre-cutover authorship is archived, not discarded.** `events.created_by_name` and `event_versions.version_created_by_name`, backfilled once by migration 002 and never written again. This was originally listed as a step 5 question; it was brought forward so the data is safe well before the table that holds it is dropped. **Nothing is open.** The last one - ~~`event_versions.version_created_by_id`~~, the same INT reference on the version rows - was handled in passing: step 1 gave it a sibling bridging column, step 2 a sibling snapshot, and step 3 reads it exactly like `events`.