Prepare Kalendartool for MPM and disable invites

lib/auth/mpm-provisioning.ts

@@ -0,0 +1,45 @@
+import { randomBytes } from 'node:crypto';
+import { prisma } from '@/lib/db/client';
+import type { AuthenticatedUser } from '@/lib/permissions/permissions';
+import type { Role } from '@prisma/client';
+
+interface MpmIdentity {
+  userId: string;
+  username: string;
+  displayName: string | null;
+  role: 'ADMIN' | 'USER';
+}
+
+/**
+ * MPM is the identity and role authority in module mode. The module's local
+ * user row supplies stable foreign keys for calendars and reservations.
+ */
+export async function provisionMpmUser(identity: MpmIdentity): Promise<AuthenticatedUser> {
+  const hubId = `mpm:${identity.userId}`;
+  const email = `mpm-${Buffer.from(identity.userId).toString('base64url')}@users.invalid`;
+  const user = await prisma.user.upsert({
+    where: { hubId },
+    create: {
+      hubId,
+      email,
+      username: identity.username,
+      passwordHash: randomBytes(48).toString('hex'),
+      role: identity.role as Role,
+    },
+    update: {
+      email,
+      username: identity.username,
+      role: identity.role as Role,
+    },
+    select: { id: true, email: true, username: true, role: true },
+  });
+
+  // Keep the external display name available as the profile label when MPM
+  // has no separate username. Username is the stable, unique MPM account name.
+  return {
+    id: user.id,
+    email: user.email,
+    username: identity.displayName || user.username,
+    role: user.role,
+  };
+}

lib/auth/session.ts

@@ -5,8 +5,9 @@
  * Kryptografie, keine Klartext-Sessions in der Datenbank.
  */
 import { SignJWT, jwtVerify } from 'jose';
-import { cookies } from 'next/headers';
+import { cookies, headers } from 'next/headers';
 import { getConfig } from '@/lib/config';
+import { provisionMpmUser } from '@/lib/auth/mpm-provisioning';
 import type { AuthenticatedUser } from '@/lib/permissions/permissions';
 
 const SESSION_COOKIE_NAME = 'calendar_session';
@@ -62,6 +63,18 @@ export async function clearSessionCookie(): Promise<void> {
  * Wirft UnauthorizedError, wenn keine gueltige Session existiert.
  */
 export async function getAuthenticatedUser(): Promise<AuthenticatedUser> {
+  if (process.env.MPM_AUTH_MODE === 'true') {
+    const requestHeaders = await headers();
+    const userId = requestHeaders.get('x-kalendartool-mpm-user-id');
+    const username = requestHeaders.get('x-kalendartool-mpm-username');
+    const displayName = requestHeaders.get('x-kalendartool-mpm-display-name');
+    const role = requestHeaders.get('x-kalendartool-mpm-role');
+    if (!userId || !username || !role || !['ADMIN', 'USER'].includes(role)) {
+      throw new UnauthorizedError();
+    }
+    return provisionMpmUser({ userId, username, displayName, role: role as 'ADMIN' | 'USER' });
+  }
+
   const cookieStore = await cookies();
   const token = cookieStore.get(SESSION_COOKIE_NAME)?.value;
   if (!token) {
@@ -98,4 +111,4 @@ export async function tryGetAuthenticatedUser(): Promise<AuthenticatedUser | nul
   } catch {
     return null;
   }
-}
+}