Un-stale Tasks 3-7 of the Martyrology OIDC plan

auth/handoffs/liturgicalcalendar.md

@@ -30,13 +30,31 @@ Generated by `setup-zitadel.sh --provision-litcal` + `setup-openfga.sh --create-
   - `calendar_editor` — Calendar Editor
   - `test_editor` — Test Definition Author
 
+Everything in this Zitadel section was re-verified against production on 2026-08-04 — Org/Project IDs, both app IDs and client IDs, both auth methods, all four role keys, and the frontend's registered redirect and post-logout URIs all match exactly as recorded.
+
 ## OpenFGA
 
 - **API URL**: `https://authz.catholicdigitalcommons.org`
 - **Store name**: `LiturgicalCalendar`
 - **Store ID**: `01KRSCF4GVX0X4ZNXXJQEC4XXJ`
-- **Authorization model ID**: `01KRSCF4K9W2EWZ1X2PP1QVH3B`
-- **Model source**: `cdcf-infra/auth/models/LiturgicalCalendar.json` — lifted verbatim from `LiturgicalCalendarAPI/scripts/openfga-model.json` (schema 1.1; types: `user`, `wider_region`, `national_calendar`, `diocesan_calendar`, `test_definition`; each with `admin`/`viewer`/`editor`/`deleter` relations).
+- **Authorization model ID**: `01KW4FW2ZCT1E693PY8D9TJEFM` — the latest model in the store, uploaded 2026-06-27T12:11Z. Supersedes `01KW40P7AM87W4Y864D2RZDR0B` (same day, 07:46Z) and `01KRSCF4K9W2EWZ1X2PP1QVH3B` (the original 2026-05-16 upload this handoff used to record).
+- **Model source**: **`LiturgicalCalendarAPI/scripts/openfga-model.json` — that repo, not this one.** Schema 1.1. Deployed types: `user`, `wider_region`, `national_calendar`, `diocesan_calendar`, `general_roman_calendar`, `national_calendar_test`, `diocesan_calendar_test`, `general_roman_calendar_test`; relations are `admin`/`editor`/`viewer` throughout, plus `member_nation` on `wider_region`. Verified against the live store on 2026-08-04.
+
+  Both `test_definition` and the `deleter` relation are **gone** — dropped by the LitCal team in `ea6fdd6c` ("drop test_definition type") and `76033bfb` ("admin-superset model … drop deleter"), with the calendar-scoped test types added in `2060b19a`. Any consumer still checking `deleter` or `test_definition` is checking against a relation that no longer exists **in the current/latest model** — consumers pinned to an earlier model ID (e.g. `01KRSCF4K9W2EWZ1X2PP1QVH3B`) still see it, since a pin names a specific model ID.
+
+### ⚠ The copy in this repo is stale — do not re-run `--create-litcal-store`
+
+`cdcf-infra/auth/models/LiturgicalCalendar.json` has not been touched since 2026-05-16 (`dd343e5`), so it still describes the original model. The LitCal team has since evolved the model twice in their own repo and uploaded it directly to the shared store.
+
+`upload_model_if_changed` in `setup-openfga.sh` compares the store's **latest** model against that file and uploads a new version when they differ. They differ. So running:
+
+```bash
+./setup-openfga.sh --target production --create-litcal-store   # ⚠ NOT safe right now
+```
+
+would push the May model back on top as the new latest — silently reverting `general_roman_calendar`, the three `*_test` types and `member_nation`, and resurrecting `test_definition`/`deleter`. Existing pinned consumers would be unaffected (a pin names a specific model ID), but anything resolving "latest" would regress.
+
+Until `auth/models/LiturgicalCalendar.json` is re-synced from `LiturgicalCalendarAPI/scripts/openfga-model.json`, treat the LitCal store's model as **owned by the LitCal repo** and leave it alone from here. Store creation and tuple seeding are unaffected; it is only the model upload that is unsafe.
 
 ## Out-of-band (delivered separately, not in this repo)
 
@@ -55,7 +73,7 @@ ZITADEL_CLIENT_ID=373246751403933699        # ← the API Backend client_id (aud
 
 OPENFGA_API_URL=https://authz.catholicdigitalcommons.org
 OPENFGA_STORE_ID=01KRSCF4GVX0X4ZNXXJQEC4XXJ
-OPENFGA_MODEL_ID=01KRSCF4K9W2EWZ1X2PP1QVH3B
+OPENFGA_MODEL_ID=01KW4FW2ZCT1E693PY8D9TJEFM   # ← latest as of 2026-08-04; was 01KRSCF4K9W2EWZ1X2PP1QVH3B
 # OPENFGA_PRESHARED_KEY=<out-of-band>
 ```
 

docs/SYSADMIN.md

@@ -56,7 +56,7 @@ Discussion: <https://github.com/CatholicOS/cdcf-website/discussions/98>. Summary
 | Internal nginx proxy | `nginx:alpine` (config in `auth/nginx/zitadel.conf`) | same |
 | OpenFGA | `openfga/openfga:v1.15.1` | same |
 | OpenFGA migrate (one-shot) | `openfga/openfga:v1.15.1` | same |
-| Authz model (LitCal) | `auth/models/LiturgicalCalendar.json` | lifted verbatim from `LiturgicalCalendarAPI/scripts/openfga-model.json` |
+| Authz model (LitCal) | `auth/models/LiturgicalCalendar.json` | originally lifted verbatim from `LiturgicalCalendarAPI/scripts/openfga-model.json`, but **frozen at the 2026-05-16 version and two revisions behind the deployed model** — that repo now owns it, see the §4.8 warning |
 | Authz model (Martyrology) | `auth/models/Martyrology.json` + `auth/models/Martyrology.tuples.json` | this repo — the `.tuples.json` carries the structural `edition → governed_by → governance_body` wiring seeded at store creation |
 | Setup script — Zitadel | `auth/setup-zitadel.sh` | this repo |
 | Setup script — OpenFGA | `auth/setup-openfga.sh` | this repo |
@@ -240,10 +240,12 @@ After successful run, you can sign in to the admin console at `https://auth.cath
 ### 4.8 OpenFGA stores + models [📜 CLI script]
 
 ```bash
-./setup-openfga.sh --target production --create-litcal-store
+./setup-openfga.sh --target production --create-litcal-store       # ⚠ see warning below
 ./setup-openfga.sh --target production --create-martyrology-store
 ```
 
+⚠ **`--create-litcal-store` is not safe to re-run as of 2026-08-04.** The LitCal model is now evolved in `LiturgicalCalendarAPI/scripts/openfga-model.json` and uploaded to the shared store from there; `auth/models/LiturgicalCalendar.json` here has been frozen since 2026-05-16 and is two revisions behind. Because `upload_model_if_changed` uploads whenever the file differs from the store's latest, re-running it would push the stale May model on top as the new latest. See [`handoffs/liturgicalcalendar.md`](../auth/handoffs/liturgicalcalendar.md) → "The copy in this repo is stale". The command is safe again once the file is re-synced from the LitCal repo.
+
 Each action creates the store (idempotent) and uploads `auth/models/<StoreName>.json` as the authorization model (idempotent — re-uploads only if the file diverges from what's already in the store). Prints the store ID + model ID.
 
 Where an `auth/models/<StoreName>.tuples.json` file exists it is also seeded — currently only Martyrology has one, carrying the structural `edition → governed_by → governance_body` tuples the model is useless without. Only tuples missing from the store are written; tuples present in the store but absent from the file are reported as drift and left alone (the script never deletes). Human role grants (`user:<sub>` → reader/editor/admin) are **not** seeded — they are per-person operator actions, see [`auth/handoffs/martyrology.md`](../auth/handoffs/martyrology.md).
@@ -311,7 +313,7 @@ A snapshot, not a source of truth: the per-property handoffs in [`auth/handoffs/
 | Org | Zitadel Project | Project roles | OpenFGA store |
 |---|---|---|---|
 | `CDCF` | `CDCF Website` (`376050623310725125`) | `subscriber`, `contributor`, `author`, `editor`, `administrator` | none — by design, see [`handoffs/cdcf-website.md`](../auth/handoffs/cdcf-website.md) |
-| `LiturgicalCalendar` | `LiturgicalCalendarAPI` (`373246750732845059`) | `admin`, `developer`, `calendar_editor`, `test_editor` | `LiturgicalCalendar` (`01KRSCF4GVX0X4ZNXXJQEC4XXJ`) |
+| `LiturgicalCalendar` | `LiturgicalCalendarAPI` (`373246750732845059`) | `admin`, `developer`, `calendar_editor`, `test_editor` | `LiturgicalCalendar` (`01KRSCF4GVX0X4ZNXXJQEC4XXJ`) — model owned by the LitCal repo, see §4.8 warning |
 | `Martyrology` | `MartyrologyAPI` (`384518610174869507`) | `admin`, `martyrology_editor`, `developer` | `Martyrology` (`01KZ1M9NJR1JHTMTV091X5DMYZ`) |
 | `BibleGet` | none — pre-provisioned Org stub | — | none |
 | `OntoKit` | none — pre-provisioned Org stub | — | none |