API/docs/calendar-auth-migration.md

# Migrating the Calendar domain onto the admin identity module

Status: **complete.** Steps 1, 3 and 4 were deployed and verified in production on
2026-09-06; step 2 was dropped by decision and part of step 5 brought forward. Step 5 is
implemented and awaiting deploy - see its own checklist below, whose ordering is the
**opposite** of step 4's.

Verified live after step 4: the public calendar still answers anonymously, all 23 public
events kept a resolvable author, restricted calendars still refuse without a credential,
legacy query credentials answer 401, and `calendar.nachklang.art` is trusted for sign-out.

Written 2026-09-05 alongside the admin module (step 2 of `docs/plan-admin-auth.md` in the
nachklang-admin repo), which deliberately left the calendar alone. Steps 1-4 of that plan
are now live, so the calendar is the last module still on the legacy query-parameter
sessions.

## Why the calendar was left out

The admin module replaced authentication for feedback and tickets by swapping one
middleware. The calendar cannot be done that way, because its user identity is woven into
its data:

- `users`/`sessions` live in the **calendar** database and are the same tables the
  feedback and tickets admin areas used to authenticate against.
- `events.created_by_id` is an **INT** foreign key into `users.user_id`. The admin module's
  user ids are **VARCHAR(36)** strings. Migrating identity means migrating that column and
  every query that joins it.
- The Angular frontend passes `sessionId`/`sessionKey` as **query parameters**
  (`DEFERRED_SECURITY.md` item 1). Cookie sessions remove the parameters entirely, so
  every calendar route signature and the frontend's HTTP layer change together.
- `credentials.service.ts` implements a second, parallel authorisation model: the
  `MEMBER_CREDENTIAL` / `CHOIR_CREDENTIAL` / `MANAGEMENT_CREDENTIAL` shared secrets that
  let non-users read specific calendars. That has no equivalent in the admin module and is
  not a per-user permission at all.

What already exists today: `calendar` is a value in the `user_app_permissions.app` enum, so
permissions can be granted before anything else moves.

## What is in place to build on

- Cookie sessions across `*.nachklang.art`, and `requireAppAccess('calendar')` in
  `src/models/admin/admin.middleware.ts` - usable the moment a calendar route wants it.
- `res.locals.admin` is `{id, email, displayName, apps}`; `id` is the string user id.
- Invitations, disable/enable and session revocation already cover calendar users, because
  they are properties of the account rather than of an app.

## Suggested sequence

Each step is meant to leave production working on its own.

1. **Add a bridging column.** ~~`ALTER TABLE events ADD COLUMN created_by_user_id
   VARCHAR(36) NULL`, indexed. Nothing reads it yet.~~ **Done 2026-09-06**, as
   `sql/calendar/001_add_admin_user_bridge.sql` - the first migration this repo owns for the
   calendar schema, mirrored into `docker/init/01-calendar-schema-dev.sql`. It covers both
   `events.created_by_user_id` and `event_versions.version_created_by_user_id`, and carries
   no foreign key (see "What the code actually looks like" below). The dev seed leaves two
   events on the legacy path and gives one an admin id, so step 3's dual-read has both cases
   to exercise. Verified by applying the pre-migration schema and then the migration to a
   throwaway MariaDB 11 container, and diffing `SHOW CREATE TABLE` against a fresh dev
   schema: identical. Applied to the running dev database on the same day; a dev container
   created before then needs it applied, or recreating.
2. ~~**Map the accounts.**~~ **Dropped 2026-09-06.** There is no backfill: since the
   creator is only ever a display name (see below), old events keep resolving through the
   legacy join until step 5 and then simply lose the name. Re-inviting the people who
   actually still need calendar access remains an operational task, but it is no longer a
   migration step and nothing is blocked on it.
3. **Dual-read.** ~~Change `events.service.ts` to prefer `created_by_user_id` and fall back
   to `created_by_id`. Writes fill both.~~ **Done 2026-09-06.** `events.service.ts` now reads
   both columns and prefers the admin one, resolving the name through a single
   `findDisplayNames` lookup against the admin database per result set (added to
   `users.admin.service.ts` for this). Four copies of the same SELECT and four copies of the
   row mapper were collapsed into one of each first - the dual read would otherwise have had
   to be written four times.

   A name now has three possible sources, tried weakest first: the legacy join, then the
   `created_by_name` snapshot from migration 002, then the live admin lookup - which wins
   because it is the only one that follows an account being renamed. An admin id that no
   longer resolves falls back rather than blanking, and a failure to reach the admin database
   is caught and logged rather than propagated, so an anonymous read of the public calendar
   never depends on the admin database being up. Covered by
   `test/calendar/events.service.test.ts`.

   **Writes are not dual-written**, contrary to the original plan: before the cutover the
   request only ever carries a legacy session, so there is no admin id available to write.
   Writes start filling `created_by_user_id` (and stop filling `created_by_id`) in step 4.
4. **Switch the routes.** ~~Replace the query-parameter session checks in `events.router.ts`
   and `users.router.ts` with `requireAppAccess('calendar')`, and change the Angular frontend
   to `withCredentials: true`.~~ **Done 2026-09-06.** `DEFERRED_SECURITY.md` item 1 is closed:
   no route reads `sessionId`/`sessionKey` any more.

   How it came out, route by route:

   - The four write routes sit behind `requireAppAccess('calendar')` as middleware. They
     answer 401 when signed out and 403 without the permission, where they used to answer 403
     for both.
   - The three read routes cannot use middleware - the same URL serves an anonymous visitor,
     an iCal subscription holding a shared password, and a signed-in editor who should see
     drafts. They call `resolveAccess` optionally instead (`signedInEditor` in the router),
     and a signed-in user *without* the calendar permission is treated as anonymous rather
     than refused, so they keep their access to the public calendar.
   - `credentials.service.ts` lost its session half entirely and is now just the password
     table. `hasAccess(calendar, password)`.
   - `/calendar/users/*` was left alone. Nothing calls it and a session it mints opens
     nothing, but they are live password-accepting endpoints - step 5 removes them.

   Also: `calendar.nachklang.art` joined `DEFAULT_APP_ORIGINS` (better-auth `trustedOrigins`,
   without which sign-out from the calendar fails while everything else works), and
   `localhost:4200` joined the dev origins for the same reason.

   Two things this step had to carry that the original sequence put in step 5:

   - **`sql/calendar/003_allow_null_legacy_creator.sql` makes `events.created_by_id` nullable**
     (`MODIFY created_by_id INT NULL`). It is `NOT NULL` today, so the first event created after the
     cutover would otherwise fail to insert - there is no legacy int id to write any more.
     `event_versions.version_created_by_id` is already nullable. The foreign key can stay
     until step 5; it permits NULL. It also re-runs 002's idempotent name backfill, to catch
     anything created between the two migrations. Applying it early is safe - widening a
     column to accept NULL cannot break the running pre-cutover build.
   - **The public calendar stays anonymous.** `hasAccess('public')` returns true before any
     credential check, and nachklang.art reads `/calendar/events/public/json` and
     `/public/json/next` with no session at all. Pinned at both levels - the password table in
     `test/calendar/credentials.service.test.ts`, the routes themselves in
     `test/calendar/events.router.test.ts` - so this cannot regress quietly.

   ### Deploy checklist

   Production has **none** of the three migrations: 001 and 002 were only ever applied to the
   dev database. The API build below selects `created_by_user_id` and `created_by_name` on
   every read, so deploying it against a database missing them fails every calendar request
   including the anonymous public feed the website uses. In order:

   1. **Apply `sql/calendar/001`, `002`, `003`, in that order**, against `CALENDAR_DB`. All
      three are re-runnable, so applying one that is already applied is a no-op. Verify
      before continuing:
      `SHOW COLUMNS FROM events LIKE '%by_user%'; SHOW COLUMNS FROM events LIKE '%by_name%';`
      - four rows across the two tables, and `created_by_id` nullable.
   2. **Check `APP_ORIGINS` on the API vhost.** `calendar.nachklang.art` is in the code's
      default list, but the environment variable *replaces* that list rather than adding to
      it - so if it is set at all (the tickets/feedback cutover may have set it), append
      `https://calendar.nachklang.art` or the calendar's sign-out will 403 while everything
      else works. That is the failure mode the comment in `admin.config.ts` warns about.
   3. **Deploy the API.**
   4. **Deploy the calendar frontend immediately after.** Do not leave a gap - see below.
   5. **Re-run 002's two `UPDATE` statements.** Between step 1 and step 3 the old API was
      still writing `created_by_id` with no snapshot; those few rows would otherwise lose
      their author at step 5.
   6. **Rebuild the admin app** if `NEXT_PUBLIC_ALLOWED_REDIRECT_ORIGINS` does not already
      contain `https://calendar.nachklang.art`. It is a **build-time** value, so a restart
      does nothing.

   **The window between steps 3 and 4 does not look broken, which is the danger.** The old
   Angular bundle starts by calling `POST /calendar/users/checkSessionValid`, and those
   legacy routes are untouched - so it still succeeds and the page renders as signed in. What
   the user then sees is an empty event table and saves that silently do nothing. It looks
   like the calendar lost its data, not like a deploy in progress. Keep the gap to minutes,
   or take the frontend offline for it.

   **One-way door:** any iCal subscription whose URL carries `?sessionId=&sessionKey=` rather
   than `?password=` stops working permanently. The shared-password URLs are unaffected.
5. **Drop the legacy path.** **Implemented 2026-09-06** on `feature/calendar-drop-legacy-path`;
   not yet deployed. Gated on step 4 being live, which it now is.

   What went:

   - `src/models/calendar/users/` in its entirety - registration, login, activation, both
     password-reset routes, and the session checking the feedback and tickets admin areas
     used to authenticate against - plus its mount in `Calendar.router.ts`. That was the
     API's last unauthenticated account-creation and mail-sending endpoint.
   - The two `LEFT OUTER JOIN users` clauses in `events.service.ts` and the `legacy_*`
     aliases they fed, along with `created_by_id` / `version_created_by_id` in the SELECT, the
     row mapper and the `Event` interface. One name source remains besides the live admin
     lookup: the snapshot, which is what made this safe.
   - `X-Session-Id` / `X-Session-Key` from the CORS `allowedHeaders`. Nothing had read them
     since the tickets and feedback cutover, or sent them since this one.
   - The tripwire in `test/admin/auth-binding.ts` asserting neither module fell back to a
     calendar header session. There is nothing left to fall back to.

   `DEFERRED_SECURITY.md` items **3** and **4** (activation and reset tokens never expiring)
   close with it - not by adding expiries but by deleting the code that issued them.

   ### Deploy checklist — note the order is REVERSED from step 4

   Step 4's migration only added columns, so it went first. `004` *removes* columns and a
   table that the currently running build still selects and joins, so running it first fails
   every calendar read including the public feed. The step 5 build references none of them and
   runs happily against the old schema. Therefore:

   1. **Confirm the snapshot is complete.** Both must return 0:
      ```sql
      SELECT SUM(created_by_id IS NOT NULL AND created_by_name IS NULL) FROM events;
      SELECT SUM(version_created_by_id IS NOT NULL AND version_created_by_name IS NULL) FROM event_versions;
      ```
      A non-zero count is an event whose author `004` would erase. Re-run 002's backfill first.
   2. **Deploy the API.** No frontend deploy is needed: the calendar frontend never read
      `createdById` (its `Event` model has only the name), and nothing else is known to.
   3. **Confirm the calendar still works** - the public feed, a signed-in read, and one save.
      At this point the old columns and tables still exist, unused, so this step is fully
      reversible by redeploying the previous build.

      Note that `tsc` does not remove output for deleted sources, so a build over an existing
      `dist/` leaves `dist/src/models/calendar/users/*.js` behind. Nothing imports it and the
      routes 404, but the deployed artifact still contains the code - clear `dist/` in the
      pipeline if you want the artifact to match the source.
   4. **Apply `sql/calendar/004_drop_legacy_auth.sql`.** This is the point of no return for
      the columns; the accounts themselves are only renamed aside.
   5. Optionally, later and at a quiet moment:
      `DROP TABLE sessions_legacy_archive, users_legacy_archive;`

   **One-way door:** `Event.createdById` and `lastModifiedById` leave the API response. Check
   anything reading `/calendar/events/*/json` that is not the calendar frontend.

## What the code actually looks like (surveyed 2026-09-06)

Four things found while doing step 1 that change how the later steps should be built:

- **`created_by_id` is display-only.** Nothing authorises on it. `events.router.ts` gates
  PUT, POST, DELETE and `/move` on `user?.isActive` alone - there is no "only the creator may
  edit" rule anywhere - and the column is read back solely to render `created_by_name` and
  `last_modified_by_name`. That de-risks steps 2, 3 and 5 considerably: an event whose
  creator never gets re-invited loses a name in the UI, it does not become uneditable or
  invisible. It also means the step 2 backfill is best-effort, not a precondition.
- **The two schemas are separate databases.** `nachklang_calendar` and `nachklang_admin`
  have their own connection pools (`Calendar.db.ts` vs the admin module's Kysely instance).
  So the bridging columns get no foreign key, and - the part the original sequence missed -
  **the `LEFT OUTER JOIN users` that produces the creator's name cannot simply be repointed**.
  It would have to become a cross-schema join, which hardcodes the admin database name into
  calendar SQL and ties the two schemas together exactly as an FK would. Recommendation for
  step 3: drop the join for the new path and resolve names in the service layer instead -
  collect the distinct ids from the result set and do one lookup against the admin users
  service. One extra query per listing, no coupling, and it keeps working if the admin
  database ever moves.
- **`events.created_by_id` is `NOT NULL`.** Step 5 cannot simply stop writing it; that step
  has to drop the column (and its FK to `users`) in the same migration that stops the writes,
  or make it nullable first.
- **Every calendar read already hits the session table.** `/:calendar/json` calls
  `UserService.checkSession` before falling back to `credentials.service.ts`, so the shared
  credentials are the *fallback*, not the primary path. Step 4 replaces the first half of
  that with `requireAppAccess('calendar')` and has to decide what happens to the second half
  - which is the first open question below.

## Open questions to settle before starting

**Settled 2026-09-06:**

- **The shared calendar credentials keep working, but only for iCal.** The web app goes
  cookie-only at step 4; `MEMBER_CREDENTIAL` and friends survive on
  `GET /calendar/events/{calendar}/ical`, which is the one case where the client genuinely
  cannot send a cookie. Everything else in `credentials.service.ts` goes with step 5.
  `public` stays anonymous everywhere - see the note under step 4.
- **The iCal export keeps its own scheme.** Same reasoning; it is the reason the shared
  credentials survive at all rather than an exception to their removal.
- **No account backfill.** See step 2 above.
- **Pre-cutover authorship is archived, not discarded.** `events.created_by_name` and
  `event_versions.version_created_by_name`, backfilled once by migration 002 and never
  written again. This was originally listed as a step 5 question; it was brought forward so
  the data is safe well before the table that holds it is dropped.

**Nothing is open.** The last one - ~~`event_versions.version_created_by_id`~~, the same INT
reference on the version rows - was handled in passing: step 1 gave it a sibling bridging
column, step 2 a sibling snapshot, and step 3 reads it exactly like `events`.