Prepare Kalendartool for MPM and disable invites

lib/auth/session.ts

@@ -5,8 +5,9 @@
  * Kryptografie, keine Klartext-Sessions in der Datenbank.
  */
 import { SignJWT, jwtVerify } from 'jose';
-import { cookies } from 'next/headers';
+import { cookies, headers } from 'next/headers';
 import { getConfig } from '@/lib/config';
+import { provisionMpmUser } from '@/lib/auth/mpm-provisioning';
 import type { AuthenticatedUser } from '@/lib/permissions/permissions';
 
 const SESSION_COOKIE_NAME = 'calendar_session';
@@ -62,6 +63,18 @@ export async function clearSessionCookie(): Promise<void> {
  * Wirft UnauthorizedError, wenn keine gueltige Session existiert.
  */
 export async function getAuthenticatedUser(): Promise<AuthenticatedUser> {
+  if (process.env.MPM_AUTH_MODE === 'true') {
+    const requestHeaders = await headers();
+    const userId = requestHeaders.get('x-kalendartool-mpm-user-id');
+    const username = requestHeaders.get('x-kalendartool-mpm-username');
+    const displayName = requestHeaders.get('x-kalendartool-mpm-display-name');
+    const role = requestHeaders.get('x-kalendartool-mpm-role');
+    if (!userId || !username || !role || !['ADMIN', 'USER'].includes(role)) {
+      throw new UnauthorizedError();
+    }
+    return provisionMpmUser({ userId, username, displayName, role: role as 'ADMIN' | 'USER' });
+  }
+
   const cookieStore = await cookies();
   const token = cookieStore.get(SESSION_COOKIE_NAME)?.value;
   if (!token) {
@@ -98,4 +111,4 @@ export async function tryGetAuthenticatedUser(): Promise<AuthenticatedUser | nul
   } catch {
     return null;
   }
-}
+}