update: octane calendar link that each user can add

src/routes/calendarFeed.js

@@ -0,0 +1,26 @@
+// Public (unauthenticated) route: calendar apps subscribing to a webcal://
+// link don't send our session cookie, so this can't sit behind requireAuth.
+// The per-user token in the URL is the only access control — see
+// usersRepo.ensureIcsToken / findByIcsToken.
+const express = require('express');
+const usersRepo = require('../repositories/usersRepo');
+const rehearsalsRepo = require('../repositories/rehearsalsRepo');
+const { buildRehearsalsFeed } = require('../lib/icsFeed');
+const asyncHandler = require('../lib/asyncHandler');
+
+const router = express.Router();
+
+router.get(
+  '/rehearsals/:token.ics',
+  asyncHandler(async (req, res) => {
+    const user = await usersRepo.findByIcsToken(req.params.token);
+    if (!user) return res.status(404).send('Not found');
+
+    const rehearsals = await rehearsalsRepo.findUpcoming();
+    res
+      .type('text/calendar; charset=utf-8')
+      .send(buildRehearsalsFeed(rehearsals));
+  })
+);
+
+module.exports = router;

src/routes/users.js

@@ -48,6 +48,14 @@ router.get(
   })
 );
 
+router.get(
+  '/me/ics-feed-url',
+  asyncHandler(async (req, res) => {
+    const token = await usersRepo.ensureIcsToken(req.user.id);
+    res.json({ path: `/calendar/feed/rehearsals/${token}.ics` });
+  })
+);
+
 router.patch(
   '/me/display-name',
   asyncHandler(async (req, res) => {