✨(all) add organizations, resources, channels, and infra migration (#34)

Add multi-tenant organization model populated from OIDC claims with
org-scoped user discovery, CalDAV principal filtering, and cross-org
isolation at the SabreDAV layer.

Add bookable resource principals (rooms, equipment) with CalDAV
auto-scheduling that handles conflict detection, auto-accept/decline,
and org-scoped booking enforcement. Fixes #14.

Replace CalendarSubscriptionToken with a unified Channel model
supporting CalDAV integration tokens and iCal feed URLs, with
encrypted token storage and role-based access control. Fixes #16.

Migrate task queue from Celery to Dramatiq with async ICS import,
progress tracking, and task status polling endpoint.

Replace nginx with Caddy for both the reverse proxy and frontend
static serving. Switch frontend package manager from yarn/pnpm to
npm and upgrade Node to 24, Next.js to 16, TypeScript to 5.9.

Harden security with fail-closed entitlements, RSVP rate limiting
and token expiry, CalDAV proxy path validation blocking internal
API routes, channel path scope enforcement, and ETag-based
conflict prevention.

Add frontend pages for resource management and integration channel
CRUD, with resource booking in the event modal.

Restructure CalDAV paths to /calendars/users/ and
/calendars/resources/ with nested principal collections in SabreDAV.

.github/workflows/calendars-frontend.yml

@@ -24,16 +24,16 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "22.x"
+          node-version: "24.x"
       - name: Restore the frontend cache
         uses: actions/cache@v5
         with:
           path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+          key: front-node_modules-${{ hashFiles('src/frontend/**/package-lock.json') }}
           fail-on-cache-miss: true
 
       - name: Check linting
-        run: cd src/frontend/ && yarn lint
+        run: cd src/frontend/ && npm run lint
 
   test-unit:
     runs-on: ubuntu-latest
@@ -45,16 +45,16 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "22.x"
+          node-version: "24.x"
 
       - name: Restore the frontend cache
         uses: actions/cache@v5
         with:
           path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+          key: front-node_modules-${{ hashFiles('src/frontend/**/package-lock.json') }}
           fail-on-cache-miss: true
 
       - name: Run unit tests
         run: |
           cd src/frontend/apps/calendars
-          TZ=Europe/Paris yarn test
+          TZ=Europe/Paris npm test

.github/workflows/calendars.yml

@@ -65,6 +65,7 @@ jobs:
       CALDAV_URL: http://localhost:80
       CALDAV_OUTBOUND_API_KEY: test-outbound-key
       CALDAV_INBOUND_API_KEY: test-inbound-key
+      CALDAV_INTERNAL_API_KEY: test-internal-key
       CALDAV_CALLBACK_HOST: localhost
       TRANSLATIONS_JSON_PATH: ${{ github.workspace }}/src/frontend/apps/calendars/src/features/i18n/translations.json
 
@@ -80,7 +81,7 @@ jobs:
       - name: Build and start CalDAV server
         working-directory: .
         run: |
-          docker build -t caldav-test docker/sabredav
+          docker build -t caldav-test src/caldav
           docker run -d --name caldav-test \
             --network host \
             -e PGHOST=localhost \
@@ -88,9 +89,10 @@ jobs:
             -e PGDATABASE=calendars \
             -e PGUSER=pgroot \
             -e PGPASSWORD=pass \
-            -e CALDAV_BASE_URI=/api/v1.0/caldav/ \
+            -e CALDAV_BASE_URI=/caldav/ \
             -e CALDAV_INBOUND_API_KEY=test-inbound-key \
             -e CALDAV_OUTBOUND_API_KEY=test-outbound-key \
+            -e CALDAV_INTERNAL_API_KEY=test-internal-key \
             caldav-test \
             sh -c "/usr/local/bin/init-database.sh && apache2-foreground"
 
@@ -108,13 +110,10 @@ jobs:
       - name: Install the dependencies
         run: uv sync --locked --all-extras
 
-      - name: Install gettext (required to compile messages) and MIME support
+      - name: Install MIME support
         run: |
           sudo apt-get update
-          sudo apt-get install -y gettext pandoc shared-mime-info media-types
-
-      - name: Generate a MO file from strings extracted from the project
-        run: uv run python manage.py compilemessages
+          sudo apt-get install -y pandoc shared-mime-info media-types
 
       - name: Run tests
         run: uv run pytest -n 2

.github/workflows/crowdin_download.yml

@@ -1,74 +0,0 @@
-name: Download translations from Crowdin
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - 'release/**'
-
-jobs:
-  install-front:
-    uses: ./.github/workflows/front-dependencies-installation.yml
-    with:
-      node_version: '22.x'
-
-  synchronize-with-crowdin:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Create empty source files
-        run: |
-          touch src/backend/locale/django.pot
-      # crowdin workflow
-      - name: crowdin action
-        uses: crowdin/github-action@v2
-        with:
-          config: crowdin/config.yml
-          upload_sources: false
-          upload_translations: false
-          download_translations: true
-          create_pull_request: false
-          push_translations: false
-          push_sources: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # A numeric ID, found at https://crowdin.com/project/<projectName>/tools/api
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-
-          # Visit https://crowdin.com/settings#api-key to create this token
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
-
-          CROWDIN_BASE_PATH: "../src/"
-      # frontend i18n
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        with:
-          path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-          fail-on-cache-miss: true
-      - name: generate translations files
-        working-directory: src/frontend
-        run: yarn i18n:deploy
-      # Create a new PR
-      - name: Create a new Pull Request with new translated strings
-        uses: peter-evans/create-pull-request@v7
-        with:
-          commit-message: |
-            🌐(i18n) update translated strings
-
-            Update translated files with new translations
-          title: 🌐(i18n) update translated strings
-          body: |
-            ## Purpose
-
-            update translated strings
-
-            ## Proposal
-
-            - [x]  update translated strings
-          branch: i18n/update-translations
-          labels: i18n

.github/workflows/crowdin_upload.yml

@@ -1,68 +0,0 @@
-name: Update crowdin sources
-
-on:
-  workflow_dispatch:
-  push:
-    branches: 
-      - main
-
-jobs:
-  install-front:
-    uses: ./.github/workflows/front-dependencies-installation.yml
-    with:
-      node_version: '22.x'
-
-  synchronize-with-crowdin:
-    needs: install-front
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      # Backend i18n
-      - name: Install Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.13.9"
-          cache: 'pip'
-      - name: Upgrade pip and setuptools
-        run: pip install --upgrade pip setuptools
-      - name: Install development dependencies
-        run: pip install --user .
-        working-directory: src/backend
-      - name: Install gettext
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gettext pandoc
-      - name: generate pot files
-        working-directory: src/backend
-        run: |
-          DJANGO_CONFIGURATION=Build python manage.py makemessages -a --keep-pot
-      # frontend i18n
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        with:
-          path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-          fail-on-cache-miss: true
-      - name: generate source translation file
-        working-directory: src/frontend
-        run: yarn i18n:extract
-      # crowdin workflow
-      - name: crowdin action
-        uses: crowdin/github-action@v2
-        with:
-          config: crowdin/config.yml
-          upload_sources: true
-          upload_translations: false
-          download_translations: false
-          create_pull_request: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # A numeric ID, found at https://crowdin.com/project/<projectName>/tools/api
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-
-          # Visit https://crowdin.com/settings#api-key to create this token
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
-
-          CROWDIN_BASE_PATH: "../src/"

.github/workflows/docker-hub.yml

@@ -49,7 +49,7 @@ jobs:
           context: ./src/backend
           target: backend-production
           platforms: ${{ github.event_name != 'pull_request' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -81,7 +81,7 @@ jobs:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
       -
-        name: Build SSG assets (platform-independent, amd64 only)
+        name: Build Next.js static output (amd64 only, avoids QEMU for Node)
         uses: docker/build-push-action@v6
         with:
           context: ./src/frontend
@@ -90,19 +90,18 @@ jobs:
           load: true
           tags: calendars-builder:local
       -
-        name: Extract SSG build output
+        name: Extract static output
         run: |
           docker create --name extract calendars-builder:local
           docker cp extract:/home/frontend/apps/calendars/out ./src/frontend/out
           docker rm extract
       -
-        name: Build and push nginx image (multi-arch)
+        name: Build and push frontend image (multi-arch)
         uses: docker/build-push-action@v6
         with:
           context: ./src/frontend
-          file: ./src/frontend/Dockerfile.nginx
+          file: ./src/frontend/Dockerfile.caddy
           platforms: ${{ github.event_name != 'pull_request' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/front-dependencies-installation.yml

@@ -5,7 +5,7 @@ on:
     inputs:
       node_version:
         required: false
-        default: '22.x'
+        default: '24.x'
         type: string
 
 jobs:
@@ -19,7 +19,7 @@ jobs:
         id: front-node_modules
         with:
           path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+          key: front-node_modules-${{ hashFiles('src/frontend/**/package-lock.json') }}
       - name: Setup Node.js
         if: steps.front-node_modules.outputs.cache-hit != 'true'
         uses: actions/setup-node@v6
@@ -27,10 +27,10 @@ jobs:
           node-version: ${{ inputs.node_version }}
       - name: Install dependencies
         if: steps.front-node_modules.outputs.cache-hit != 'true'
-        run: cd src/frontend/ && yarn install --frozen-lockfile
+        run: cd src/frontend/ && npm ci
       - name: Cache install frontend
         if: steps.front-node_modules.outputs.cache-hit != 'true'
         uses: actions/cache@v5
         with:
           path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+          key: front-node_modules-${{ hashFiles('src/frontend/**/package-lock.json') }}