Per-client ICS calendar feed, replacing the shared ICS_TOKEN (#22)

Each client now gets their own clients.ics_token (lazily generated on first /owner/settings visit), which both authenticates and scopes /api/bookings.ics -- closing the gap where any shared-token holder could view another client's bookings by swapping the client_id query param. The owner settings page now surfaces a copyable subscribe URL. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-04 11:55:35 +02:00
parent 319218ce21
commit 24d9aca812
9 changed files with 196 additions and 20 deletions
@@ -26,7 +26,6 @@ services:
      CRM_API_TOKEN: ${CRM_API_TOKEN}
      BOOKING_TOKEN_SECRET: ${BOOKING_TOKEN_SECRET}
      SESSION_SECRET_KEY: ${SESSION_SECRET_KEY}
-      ICS_TOKEN: ${ICS_TOKEN}
      SMTP_HOST: ${SMTP_HOST}
      SMTP_PORT: ${SMTP_PORT}
      SMTP_USERNAME: ${SMTP_USERNAME}