Sprint 4 PR 4.5c — close /calendar/org/export auth gap

[tomqwu]

Why

PR #226 (4.5b) closed three of the four calendar auth gaps but explicitly left this one open as a follow-up:

GET /api/v1/calendar/org/export still uses the spoofable person_id-as-auth proxy: it accepts person_id as a query parameter and looks up the admin record by that id instead of by the JWT.

Person ids are deterministic (often email-derived slugs), so anyone who can enumerate or guess an admin's id can download the entire organization's events — a PII / org-data leak. This PR closes that gap.

What changed

• api/routers/calendar.py — export_organization_events now takes current_admin: Person = Depends(get_current_admin_user) and delegates the same-org check to verify_org_member(current_admin, org_id). The person_id query parameter (which was the spoof vector) has been removed from the signature. FastAPI silently ignores extra query params, so legacy clients still sending ?person_id=... won't 422.
• tests/api/test_calendar_auth.py — new TestOrgExportAuth class with 5 cases:
  1. No auth header → 401/403
  2. Volunteer in same org → 403
  3. Admin in org A asking for org B → 403
  4. Admin in same org, no events seeded → 404 (auth passes; the empty-events 404 is the next gate)
  5. Explicit regression test: a volunteer trying to escalate by passing an admin's id in ?person_id=... → 403 (the legacy spoof vector no longer works)
• tests/conftest.py — extend the unit-tier verify_org_member monkey-patch list to include api.routers.calendar, since that router now imports the symbol directly.
• tests/unit/test_calendar.py — drop the now-dead ?person_id= query param from the URLs; remove test_org_export_as_volunteer_denied (mocked auth always returns admin so the case isn't representable in this tier — the equivalent assertion lives in TestOrgExportAuth).
• tests/contract/openapi.snapshot.json — refreshed via make update-openapi-snapshot: person_id parameter removed, HTTPBearer security added, description updated.

Validation

• poetry run pytest tests/api/test_calendar_auth.py tests/unit/test_calendar.py → 32 passed
• make test-unit-fast → 338 passed, 21 skipped
• poetry run pytest tests/api tests/contract → 316 passed
• poetry run pytest tests/cli tests/integration → 59 passed
• poetry run black api tests clean; poetry run ruff check api tests clean

Follow-ups

• The E2E lane will only go green once fix(e2e): bump stale 2026-06-07 seed dates so /v/open tests stop timing out #227 (fix-e2e-stale-dates) lands and this branch is rebased onto the updated main. The stale-date flake is pre-existing and unrelated to this change.

---

Generated by Claude Code.

---

Generated by Claude Code