Prepare Kalendartool for MPM and disable invites

lib/auth/mpm-provisioning.ts

@@ -0,0 +1,45 @@
+import { randomBytes } from 'node:crypto';
+import { prisma } from '@/lib/db/client';
+import type { AuthenticatedUser } from '@/lib/permissions/permissions';
+import type { Role } from '@prisma/client';
+
+interface MpmIdentity {
+  userId: string;
+  username: string;
+  displayName: string | null;
+  role: 'ADMIN' | 'USER';
+}
+
+/**
+ * MPM is the identity and role authority in module mode. The module's local
+ * user row supplies stable foreign keys for calendars and reservations.
+ */
+export async function provisionMpmUser(identity: MpmIdentity): Promise<AuthenticatedUser> {
+  const hubId = `mpm:${identity.userId}`;
+  const email = `mpm-${Buffer.from(identity.userId).toString('base64url')}@users.invalid`;
+  const user = await prisma.user.upsert({
+    where: { hubId },
+    create: {
+      hubId,
+      email,
+      username: identity.username,
+      passwordHash: randomBytes(48).toString('hex'),
+      role: identity.role as Role,
+    },
+    update: {
+      email,
+      username: identity.username,
+      role: identity.role as Role,
+    },
+    select: { id: true, email: true, username: true, role: true },
+  });
+
+  // Keep the external display name available as the profile label when MPM
+  // has no separate username. Username is the stable, unique MPM account name.
+  return {
+    id: user.id,
+    email: user.email,
+    username: identity.displayName || user.username,
+    role: user.role,
+  };
+}