feat(backend): local accounts + invites for Gemeinde Teamer

Per the updated plan, Gemeinde Teamer are no longer Authentik-backed; they
are local accounts a Gemeinde Verantwortliche/r provisions per KC.

Schema:
- User.authentikSub now nullable; add passwordHash + kcId (cascade from Kc)
  so one User model covers Authentik members and local Teamer.
- new TeamerInvite model: shareable group link (email null, maxUses null)
  or personal invite (email pinned, single use), with expiry + revoke.
- sync log now also replicates User / Membership / TeamerInvite.

Auth:
- TeamAuthService: bcrypt password login (POST /auth/team-login) and invite
  redemption (POST /auth/teamer/register) issuing a JWT signed with
  TEAM_JWT_SECRET, payload typ:"team".
- TeamJwtStrategy (AuthGuard('team')) resolves it to the same
  AuthenticatedUser shape as AuthentikStrategy.
- TokenVerificationService.verifyEither() also accepts team tokens (WS).
- files + chat read endpoints accept 'team' tokens; Teamer see non-Konfi
  files and can use chat / start DMs.

Teamer admin (teamer/ module, under /gemeinde/:gemeindeId):
- POST/GET teamer, DELETE teamer/:userId
- POST/GET teamer-invites, DELETE teamer-invites/:inviteId
- LT may manage any Gemeinde; a Verantwortliche/r only their own
  (checked in TeamerService, since RolesGuard only scopes by kcId).

Tests: TeamAuthService + TeamerService specs added (Prisma/Sync mocked),
npm test green at 32. Docs (plan + backend README) updated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app.module.ts

@@ -6,6 +6,7 @@ import { PrismaModule } from './prisma/prisma.module';
 import { AuthModule } from './auth/auth.module';
 import { KcModule } from './kc/kc.module';
 import { GemeindeModule } from './gemeinde/gemeinde.module';
+import { TeamerModule } from './teamer/teamer.module';
 import { WahlModule } from './wahl/wahl.module';
 import { FilesModule } from './files/files.module';
 import { ChatModule } from './chat/chat.module';
@@ -25,6 +26,7 @@ import { SyncModule } from './sync/sync.module';
     AuthModule,
     KcModule,
     GemeindeModule,
+    TeamerModule,
     WahlModule,
     FilesModule,
     ChatModule,

src/auth/auth.controller.ts

@@ -1,14 +1,32 @@
 import { Body, Controller, Post } from '@nestjs/common';
 import { GuestAuthService } from './guest-auth.service';
+import { TeamAuthService } from './team-auth.service';
 import { CreateGuestDto } from './dto/create-guest.dto';
+import { TeamLoginDto } from './dto/team-login.dto';
+import { RegisterTeamerDto } from './dto/register-teamer.dto';
 
 @Controller('auth')
 export class AuthController {
-  constructor(private readonly guestAuth: GuestAuthService) {}
+  constructor(
+    private readonly guestAuth: GuestAuthService,
+    private readonly teamAuth: TeamAuthService,
+  ) {}
 
   /// Redeems a KC invite code and registers a new temporary guest/Konfi account.
   @Post('guest')
   createGuest(@Body() dto: CreateGuestDto) {
     return this.guestAuth.createGuest(dto.inviteCode, dto.firstName, dto.lastName);
   }
+
+  /// Password login for local Gemeinde Teamer accounts.
+  @Post('team-login')
+  teamLogin(@Body() dto: TeamLoginDto) {
+    return this.teamAuth.login(dto.email, dto.password);
+  }
+
+  /// Self-registration for a Gemeinde Teamer via an invite token/link.
+  @Post('teamer/register')
+  registerTeamer(@Body() dto: RegisterTeamerDto) {
+    return this.teamAuth.registerFromInvite(dto);
+  }
 }

src/auth/auth.module.ts

@@ -4,8 +4,10 @@ import { JwtModule } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
 import { AuthController } from './auth.controller';
 import { GuestAuthService } from './guest-auth.service';
+import { TeamAuthService } from './team-auth.service';
 import { AuthentikStrategy } from './authentik.strategy';
 import { GuestJwtStrategy } from './guest-jwt.strategy';
+import { TeamJwtStrategy } from './team-jwt.strategy';
 import { TokenVerificationService } from './token-verification.service';
 
 @Module({
@@ -20,7 +22,14 @@ import { TokenVerificationService } from './token-verification.service';
     }),
   ],
   controllers: [AuthController],
-  providers: [GuestAuthService, AuthentikStrategy, GuestJwtStrategy, TokenVerificationService],
-  exports: [TokenVerificationService],
+  providers: [
+    GuestAuthService,
+    TeamAuthService,
+    AuthentikStrategy,
+    GuestJwtStrategy,
+    TeamJwtStrategy,
+    TokenVerificationService,
+  ],
+  exports: [TokenVerificationService, TeamAuthService],
 })
 export class AuthModule {}

src/auth/authenticated-request.ts

@@ -8,10 +8,12 @@ export interface AuthenticatedMembership {
   role: Role;
 }
 
-/// Shape attached to req.user by JwtStrategy after validating an access token.
+/// Shape attached to req.user after validating an access token — by
+/// AuthentikStrategy for Authentik-backed members, or by TeamJwtStrategy for
+/// local Gemeinde Teamer (then `authentikSub` is null).
 export interface AuthenticatedUser {
   userId: string;
-  authentikSub: string;
+  authentikSub: string | null;
   email: string;
   memberships: AuthenticatedMembership[];
 }

src/auth/dto/register-teamer.dto.ts

@@ -0,0 +1,30 @@
+import {
+  IsEmail,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  MinLength,
+} from 'class-validator';
+
+export class RegisterTeamerDto {
+  @IsString()
+  @IsNotEmpty()
+  token!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  firstName!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  lastName!: string;
+
+  @IsString()
+  @MinLength(8)
+  password!: string;
+
+  /// Required for group-link invites; ignored/validated against a personal invite.
+  @IsOptional()
+  @IsEmail()
+  email?: string;
+}

src/auth/dto/team-login.dto.ts

@@ -0,0 +1,10 @@
+import { IsEmail, IsNotEmpty, IsString } from 'class-validator';
+
+export class TeamLoginDto {
+  @IsEmail()
+  email!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  password!: string;
+}

src/auth/team-auth.service.spec.ts

@@ -0,0 +1,232 @@
+import {
+  ConflictException,
+  ForbiddenException,
+  NotFoundException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Role } from '@prisma/client';
+import * as bcrypt from 'bcryptjs';
+import { TeamAuthService } from './team-auth.service';
+
+/// Covers the branching in invite redemption and password login. Prisma and
+/// SyncService are faked in memory; bcrypt/jsonwebtoken run for real.
+
+const SECRET = 'test-team-secret';
+
+interface InviteRow {
+  id: string;
+  kcId: string;
+  gemeindeId: string;
+  token: string;
+  email: string | null;
+  maxUses: number | null;
+  usedCount: number;
+  expiresAt: Date | null;
+  revokedAt: Date | null;
+}
+
+function makeService(seed: {
+  invites?: InviteRow[];
+  users?: { id: string; email: string; passwordHash: string | null }[];
+}) {
+  const invites = [...(seed.invites ?? [])];
+  const users = [...(seed.users ?? [])].map((u) => ({
+    firstName: 'X',
+    lastName: 'Y',
+    authentikSub: null,
+    kcId: null,
+    createdAt: new Date(),
+    memberships: [] as unknown[],
+    ...u,
+  }));
+
+  const prisma = {
+    user: {
+      findUnique: jest.fn(({ where }: { where: { email?: string; id?: string } }) =>
+        Promise.resolve(
+          users.find(
+            (u) =>
+              (where.email !== undefined && u.email === where.email) ||
+              (where.id !== undefined && u.id === where.id),
+          ) ?? null,
+        ),
+      ),
+      findFirst: jest.fn(({ where }: { where: { id: string } }) =>
+        Promise.resolve(users.find((u) => u.id === where.id && u.passwordHash) ?? null),
+      ),
+      create: jest.fn(({ data }: { data: Record<string, unknown> }) => {
+        const row = { id: `u-${users.length + 1}`, memberships: [], ...data } as never;
+        users.push(row);
+        return Promise.resolve(row);
+      }),
+    },
+    membership: {
+      create: jest.fn(({ data }: { data: Record<string, unknown> }) =>
+        Promise.resolve({ id: `m-1`, ...data }),
+      ),
+    },
+    teamerInvite: {
+      findUnique: jest.fn(({ where }: { where: { token: string } }) =>
+        Promise.resolve(invites.find((i) => i.token === where.token) ?? null),
+      ),
+      update: jest.fn(({ where, data }: { where: { id: string }; data: { usedCount: { increment: number } } }) => {
+        const inv = invites.find((i) => i.id === where.id)!;
+        inv.usedCount += data.usedCount.increment;
+        return Promise.resolve(inv);
+      }),
+    },
+  };
+  const sync = { capture: jest.fn().mockResolvedValue(undefined) };
+  const config = { getOrThrow: jest.fn().mockReturnValue(SECRET) };
+
+  const service = new TeamAuthService(prisma as never, config as never, sync as never);
+  return { service, prisma, sync, users, invites };
+}
+
+function invite(overrides: Partial<InviteRow> = {}): InviteRow {
+  return {
+    id: 'inv-1',
+    kcId: 'kc-1',
+    gemeindeId: 'gem-1',
+    token: 'tok-1',
+    email: null,
+    maxUses: null,
+    usedCount: 0,
+    expiresAt: null,
+    revokedAt: null,
+    ...overrides,
+  };
+}
+
+const base = {
+  token: 'tok-1',
+  firstName: 'Mara',
+  lastName: 'Klein',
+  password: 'supersecret',
+};
+
+describe('TeamAuthService.registerFromInvite', () => {
+  it('rejects an unknown token', async () => {
+    const { service } = makeService({ invites: [] });
+    await expect(
+      service.registerFromInvite({ ...base, email: 'm@example.org' }),
+    ).rejects.toBeInstanceOf(NotFoundException);
+  });
+
+  it('rejects a revoked invite', async () => {
+    const { service } = makeService({ invites: [invite({ revokedAt: new Date() })] });
+    await expect(
+      service.registerFromInvite({ ...base, email: 'm@example.org' }),
+    ).rejects.toBeInstanceOf(NotFoundException);
+  });
+
+  it('rejects an expired invite', async () => {
+    const { service } = makeService({
+      invites: [invite({ expiresAt: new Date(Date.now() - 1000) })],
+    });
+    await expect(
+      service.registerFromInvite({ ...base, email: 'm@example.org' }),
+    ).rejects.toBeInstanceOf(ForbiddenException);
+  });
+
+  it('rejects an invite that is used up', async () => {
+    const { service } = makeService({
+      invites: [invite({ maxUses: 2, usedCount: 2 })],
+    });
+    await expect(
+      service.registerFromInvite({ ...base, email: 'm@example.org' }),
+    ).rejects.toBeInstanceOf(ForbiddenException);
+  });
+
+  it('requires an email for a group-link invite', async () => {
+    const { service } = makeService({ invites: [invite({ email: null })] });
+    await expect(service.registerFromInvite({ ...base })).rejects.toBeInstanceOf(
+      ConflictException,
+    );
+  });
+
+  it('rejects an email that does not match a personal invite', async () => {
+    const { service } = makeService({
+      invites: [invite({ email: 'pinned@example.org' })],
+    });
+    await expect(
+      service.registerFromInvite({ ...base, email: 'other@example.org' }),
+    ).rejects.toBeInstanceOf(ForbiddenException);
+  });
+
+  it('rejects when an account with that email already exists', async () => {
+    const { service } = makeService({
+      invites: [invite()],
+      users: [{ id: 'u-x', email: 'm@example.org', passwordHash: 'h' }],
+    });
+    await expect(
+      service.registerFromInvite({ ...base, email: 'm@example.org' }),
+    ).rejects.toBeInstanceOf(ConflictException);
+  });
+
+  it('creates a local Teamer + GEMEINDE_TEAMER membership and burns one use', async () => {
+    const { service, prisma, sync, invites } = makeService({ invites: [invite()] });
+    const res = await service.registerFromInvite({ ...base, email: 'M@Example.org' });
+
+    expect(res.accessToken).toEqual(expect.any(String));
+    expect(prisma.user.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        email: 'm@example.org',
+        kcId: 'kc-1',
+        passwordHash: expect.any(String),
+      }),
+    });
+    const createdHash = prisma.user.create.mock.calls[0][0].data.passwordHash as string;
+    expect(await bcrypt.compare('supersecret', createdHash)).toBe(true);
+    expect(prisma.membership.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        kcId: 'kc-1',
+        gemeindeId: 'gem-1',
+        role: Role.GEMEINDE_TEAMER,
+      }),
+    });
+    expect(invites[0].usedCount).toBe(1);
+    expect(sync.capture).toHaveBeenCalledWith('User', 'CREATE', expect.any(String), expect.anything());
+    expect(sync.capture).toHaveBeenCalledWith('Membership', 'CREATE', expect.any(String), expect.anything());
+    expect(sync.capture).toHaveBeenCalledWith('TeamerInvite', 'UPDATE', expect.any(String), expect.anything());
+  });
+});
+
+describe('TeamAuthService.login', () => {
+  it('rejects an unknown email', async () => {
+    const { service } = makeService({ users: [] });
+    await expect(service.login('nobody@example.org', 'x')).rejects.toBeInstanceOf(
+      UnauthorizedException,
+    );
+  });
+
+  it('rejects a user without a password hash (Authentik-only account)', async () => {
+    const { service } = makeService({
+      users: [{ id: 'u-1', email: 'lt@example.org', passwordHash: null }],
+    });
+    await expect(service.login('lt@example.org', 'x')).rejects.toBeInstanceOf(
+      UnauthorizedException,
+    );
+  });
+
+  it('rejects a wrong password', async () => {
+    const { service } = makeService({
+      users: [
+        { id: 'u-1', email: 't@example.org', passwordHash: bcrypt.hashSync('right', 10) },
+      ],
+    });
+    await expect(service.login('t@example.org', 'wrong')).rejects.toBeInstanceOf(
+      UnauthorizedException,
+    );
+  });
+
+  it('issues a token for correct credentials', async () => {
+    const { service } = makeService({
+      users: [
+        { id: 'u-1', email: 't@example.org', passwordHash: bcrypt.hashSync('right', 10) },
+      ],
+    });
+    const res = await service.login('T@example.org', 'right');
+    expect(res.accessToken).toEqual(expect.any(String));
+  });
+});

src/auth/team-auth.service.ts

@@ -0,0 +1,160 @@
+import {
+  ConflictException,
+  ForbiddenException,
+  Injectable,
+  NotFoundException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Role, SyncOperation } from '@prisma/client';
+import * as bcrypt from 'bcryptjs';
+import * as jwt from 'jsonwebtoken';
+import { PrismaClient } from '../prisma/prisma.module';
+import { SyncService } from '../sync/sync.service';
+import { AuthenticatedUser } from './authenticated-request';
+
+export interface TeamJwtPayload {
+  sub: string;
+  typ: 'team';
+}
+
+const TOKEN_TTL = '12h';
+const BCRYPT_ROUNDS = 10;
+
+/// Local (non-Authentik) auth for Gemeinde Teamer: password login plus
+/// redemption of a TeamerInvite issued by a Gemeinde Verantwortliche/r. Team
+/// tokens are signed with TEAM_JWT_SECRET and carry `typ: 'team'` so they are
+/// never mistaken for a guest token.
+@Injectable()
+export class TeamAuthService {
+  private readonly secret: string;
+
+  constructor(
+    private readonly prisma: PrismaClient,
+    private readonly config: ConfigService,
+    private readonly sync: SyncService,
+  ) {
+    this.secret = config.getOrThrow<string>('TEAM_JWT_SECRET');
+  }
+
+  async login(email: string, password: string): Promise<{ accessToken: string }> {
+    const user = await this.prisma.user.findUnique({
+      where: { email: email.toLowerCase() },
+      include: { memberships: true },
+    });
+    if (!user || !user.passwordHash) {
+      throw new UnauthorizedException('Invalid credentials');
+    }
+    const ok = await bcrypt.compare(password, user.passwordHash);
+    if (!ok) {
+      throw new UnauthorizedException('Invalid credentials');
+    }
+    return { accessToken: this.sign(user.id) };
+  }
+
+  /// Redeems an invite token and creates the local Teamer account + its
+  /// GEMEINDE_TEAMER membership for the invite's Gemeinde.
+  async registerFromInvite(input: {
+    token: string;
+    firstName: string;
+    lastName: string;
+    password: string;
+    email?: string;
+  }): Promise<{ accessToken: string }> {
+    const invite = await this.prisma.teamerInvite.findUnique({
+      where: { token: input.token },
+    });
+    if (!invite || invite.revokedAt) {
+      throw new NotFoundException('Unknown or revoked invite');
+    }
+    if (invite.expiresAt && invite.expiresAt.getTime() < Date.now()) {
+      throw new ForbiddenException('Invite has expired');
+    }
+    if (invite.maxUses !== null && invite.usedCount >= invite.maxUses) {
+      throw new ForbiddenException('Invite has already been used up');
+    }
+
+    if (
+      invite.email &&
+      input.email &&
+      input.email.toLowerCase() !== invite.email.toLowerCase()
+    ) {
+      throw new ForbiddenException('Email does not match this invite');
+    }
+    const email = (invite.email ?? input.email ?? '').toLowerCase();
+    if (!email) {
+      throw new ConflictException('This invite requires an email address');
+    }
+    if (await this.prisma.user.findUnique({ where: { email } })) {
+      throw new ConflictException('An account with this email already exists');
+    }
+
+    const passwordHash = await bcrypt.hash(input.password, BCRYPT_ROUNDS);
+    const user = await this.prisma.user.create({
+      data: {
+        email,
+        firstName: input.firstName,
+        lastName: input.lastName,
+        passwordHash,
+        kcId: invite.kcId,
+      },
+    });
+    const membership = await this.prisma.membership.create({
+      data: {
+        userId: user.id,
+        kcId: invite.kcId,
+        gemeindeId: invite.gemeindeId,
+        role: Role.GEMEINDE_TEAMER,
+      },
+    });
+    const updatedInvite = await this.prisma.teamerInvite.update({
+      where: { id: invite.id },
+      data: { usedCount: { increment: 1 } },
+    });
+
+    await this.sync.capture('User', SyncOperation.CREATE, user.id, user);
+    await this.sync.capture('Membership', SyncOperation.CREATE, membership.id, membership);
+    await this.sync.capture('TeamerInvite', SyncOperation.UPDATE, updatedInvite.id, updatedInvite);
+
+    return { accessToken: this.sign(user.id) };
+  }
+
+  private sign(userId: string): string {
+    const payload: TeamJwtPayload = { sub: userId, typ: 'team' };
+    return jwt.sign(payload, this.secret, { expiresIn: TOKEN_TTL });
+  }
+
+  /// Verifies a raw team token (used by the WS handshake path, outside passport).
+  async verify(token: string): Promise<AuthenticatedUser> {
+    let payload: TeamJwtPayload;
+    try {
+      payload = jwt.verify(token, this.secret) as TeamJwtPayload;
+    } catch {
+      throw new UnauthorizedException('Invalid team token');
+    }
+    if (payload.typ !== 'team' || !payload.sub) {
+      throw new UnauthorizedException('Not a team token');
+    }
+    return this.resolve(payload.sub);
+  }
+
+  async resolve(userId: string): Promise<AuthenticatedUser> {
+    const user = await this.prisma.user.findFirst({
+      where: { id: userId, passwordHash: { not: null } },
+      include: { memberships: true },
+    });
+    if (!user) {
+      throw new UnauthorizedException('Team account no longer exists');
+    }
+    return {
+      userId: user.id,
+      authentikSub: user.authentikSub,
+      email: user.email,
+      memberships: user.memberships.map((m) => ({
+        kcId: m.kcId,
+        gemeindeId: m.gemeindeId,
+        role: m.role,
+      })),
+    };
+  }
+}

src/auth/team-jwt.strategy.ts

@@ -0,0 +1,26 @@
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ConfigService } from '@nestjs/config';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { AuthenticatedUser } from './authenticated-request';
+import { TeamAuthService, TeamJwtPayload } from './team-auth.service';
+
+/// Verifies the local JWT issued to Gemeinde Teamer by TeamAuthService and
+/// resolves it to the same AuthenticatedUser shape as AuthentikStrategy, so
+/// downstream RolesGuard / controllers treat both member kinds identically.
+@Injectable()
+export class TeamJwtStrategy extends PassportStrategy(Strategy, 'team') {
+  constructor(
+    config: ConfigService,
+    private readonly teamAuth: TeamAuthService,
+  ) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      secretOrKey: config.getOrThrow<string>('TEAM_JWT_SECRET'),
+    });
+  }
+
+  validate(payload: TeamJwtPayload): Promise<AuthenticatedUser> {
+    return this.teamAuth.resolve(payload.sub);
+  }
+}

src/auth/token-verification.service.ts

@@ -6,6 +6,7 @@ import * as jwksRsa from 'jwks-rsa';
 import { PrismaClient } from '../prisma/prisma.module';
 import { AuthenticatedUser } from './authenticated-request';
 import { GuestJwtPayload } from './guest-auth.service';
+import { TeamAuthService } from './team-auth.service';
 
 /// Verifies raw bearer tokens outside the HTTP/passport pipeline, needed for
 /// the WebSocket handshake where AuthGuard('authentik'|'guest') don't apply.
@@ -18,6 +19,7 @@ export class TokenVerificationService {
     private readonly config: ConfigService,
     private readonly prisma: PrismaClient,
     private readonly guestJwt: JwtService,
+    private readonly teamAuth: TeamAuthService,
   ) {
     this.issuerUrl = config.getOrThrow<string>('AUTHENTIK_ISSUER_URL');
     this.jwks = jwksRsa({ jwksUri: `${this.issuerUrl}/jwks/`, cache: true, rateLimit: true });
@@ -61,12 +63,17 @@ export class TokenVerificationService {
     return this.guestJwt.verifyAsync<GuestJwtPayload>(token);
   }
 
-  /// Tries Authentik first (team member), then falls back to a guest token.
+  /// Tries Authentik, then a local team (Teamer) token, then a guest token.
   async verifyEither(token: string): Promise<
     { kind: 'user'; user: AuthenticatedUser } | { kind: 'guest'; guest: GuestJwtPayload }
   > {
     try {
       return { kind: 'user', user: await this.verifyAuthentik(token) };
+    } catch {
+      // not an Authentik token
+    }
+    try {
+      return { kind: 'user', user: await this.teamAuth.verify(token) };
     } catch {
       return { kind: 'guest', guest: await this.verifyGuest(token) };
     }

src/chat/chat.controller.ts

@@ -24,21 +24,22 @@ export class ChatController {
     return this.chat.createChannel(kcId, dto.type, dto.gemeindeId);
   }
 
-  /// Any two team members of the same KC can start a direct conversation.
+  /// Any two team members of the same KC can start a direct conversation
+  /// (Authentik-backed members and local Gemeinde Teamer alike).
   @Post('direct')
-  @UseGuards(AuthGuard('authentik'))
+  @UseGuards(AuthGuard(['authentik', 'team']))
   createDirectChannel(@Body() dto: CreateDirectChannelDto, @Req() req: AuthenticatedRequest) {
     return this.chat.getOrCreateDirectChannel(dto.kcId, req.user!.userId, dto.otherUserId);
   }
 
   @Get(':kcId/channels')
-  @UseGuards(AuthGuard(['authentik', 'guest']))
+  @UseGuards(AuthGuard(['authentik', 'team', 'guest']))
   listChannels(@Param('kcId') kcId: string, @Req() req: ChatRequest) {
     return this.chat.listChannelsForCaller(kcId, resolveChatCaller(req.user!));
   }
 
   @Get('channels/:channelId/messages')
-  @UseGuards(AuthGuard(['authentik', 'guest']))
+  @UseGuards(AuthGuard(['authentik', 'team', 'guest']))
   listMessages(@Param('channelId') channelId: string, @Req() req: ChatRequest) {
     return this.chat.listMessages(channelId, resolveChatCaller(req.user!));
   }

src/files/files.controller.ts

@@ -47,7 +47,7 @@ export class FilesController {
   }
 
   @Get(':kcId')
-  @UseGuards(AuthGuard(['authentik', 'guest']))
+  @UseGuards(AuthGuard(['authentik', 'team', 'guest']))
   list(@Param('kcId') kcId: string, @Req() req: FileCallerRequest) {
     const allowed = isGuest(req.user)
       ? GUEST_ALLOWED_VISIBILITIES
@@ -56,7 +56,7 @@ export class FilesController {
   }
 
   @Get('download/:fileId')
-  @UseGuards(AuthGuard(['authentik', 'guest']))
+  @UseGuards(AuthGuard(['authentik', 'team', 'guest']))
   async download(
     @Param('fileId') fileId: string,
     @Req() req: FileCallerRequest,

src/sync/sync.service.ts

@@ -6,6 +6,9 @@ import { PrismaClient } from '../prisma/prisma.module';
 const SYNCED_MODELS = [
   'Kc',
   'Gemeinde',
+  'User',
+  'Membership',
+  'TeamerInvite',
   'GuestAccount',
   'Wahl',
   'Workshop',

src/teamer/dto/create-teamer-invite.dto.ts

@@ -0,0 +1,21 @@
+import { IsEmail, IsInt, IsOptional, Min } from 'class-validator';
+
+export class CreateTeamerInviteDto {
+  /// Set for a personal invite pinned to one address; omit for a shareable
+  /// group link.
+  @IsOptional()
+  @IsEmail()
+  email?: string;
+
+  /// Max redemptions. Defaults to 1 for a personal invite, unlimited for a
+  /// group link.
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  maxUses?: number;
+
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  expiresInHours?: number;
+}

src/teamer/dto/create-teamer.dto.ts

@@ -0,0 +1,18 @@
+import { IsEmail, IsNotEmpty, IsString, MinLength } from 'class-validator';
+
+export class CreateTeamerDto {
+  @IsString()
+  @IsNotEmpty()
+  firstName!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  lastName!: string;
+
+  @IsEmail()
+  email!: string;
+
+  @IsString()
+  @MinLength(8)
+  password!: string;
+}

src/teamer/teamer.controller.ts

@@ -0,0 +1,74 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Param,
+  Post,
+  Req,
+  UseGuards,
+} from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+import { TeamerService } from './teamer.service';
+import { CreateTeamerDto } from './dto/create-teamer.dto';
+import { CreateTeamerInviteDto } from './dto/create-teamer-invite.dto';
+import { Roles } from '../common/roles.decorator';
+import { RolesGuard } from '../common/roles.guard';
+import { Role } from '../common/role.enum';
+import { AuthenticatedRequest } from '../auth/authenticated-request';
+
+/// Gemeinde Teamer administration. The coarse guard admits Leitungsteam and
+/// Gemeinde Verantwortliche (both Authentik-backed); TeamerService then
+/// checks the caller is actually responsible for `:gemeindeId`.
+@Controller('gemeinde/:gemeindeId')
+@UseGuards(AuthGuard('authentik'), RolesGuard)
+@Roles(Role.LEITUNGSTEAM, Role.GEMEINDE_VERANTWORTLICHER)
+export class TeamerController {
+  constructor(private readonly teamer: TeamerService) {}
+
+  @Post('teamer')
+  create(
+    @Param('gemeindeId') gemeindeId: string,
+    @Body() dto: CreateTeamerDto,
+    @Req() req: AuthenticatedRequest,
+  ) {
+    return this.teamer.createTeamer(req.user!, gemeindeId, dto);
+  }
+
+  @Get('teamer')
+  list(@Param('gemeindeId') gemeindeId: string, @Req() req: AuthenticatedRequest) {
+    return this.teamer.listTeamer(req.user!, gemeindeId);
+  }
+
+  @Delete('teamer/:userId')
+  remove(
+    @Param('gemeindeId') gemeindeId: string,
+    @Param('userId') userId: string,
+    @Req() req: AuthenticatedRequest,
+  ) {
+    return this.teamer.removeTeamer(req.user!, gemeindeId, userId);
+  }
+
+  @Post('teamer-invites')
+  createInvite(
+    @Param('gemeindeId') gemeindeId: string,
+    @Body() dto: CreateTeamerInviteDto,
+    @Req() req: AuthenticatedRequest,
+  ) {
+    return this.teamer.createInvite(req.user!, gemeindeId, dto);
+  }
+
+  @Get('teamer-invites')
+  listInvites(@Param('gemeindeId') gemeindeId: string, @Req() req: AuthenticatedRequest) {
+    return this.teamer.listInvites(req.user!, gemeindeId);
+  }
+
+  @Delete('teamer-invites/:inviteId')
+  revokeInvite(
+    @Param('gemeindeId') gemeindeId: string,
+    @Param('inviteId') inviteId: string,
+    @Req() req: AuthenticatedRequest,
+  ) {
+    return this.teamer.revokeInvite(req.user!, gemeindeId, inviteId);
+  }
+}

src/teamer/teamer.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { TeamerService } from './teamer.service';
+import { TeamerController } from './teamer.controller';
+
+@Module({
+  providers: [TeamerService],
+  controllers: [TeamerController],
+})
+export class TeamerModule {}

src/teamer/teamer.service.spec.ts

@@ -0,0 +1,167 @@
+import {
+  ConflictException,
+  ForbiddenException,
+  NotFoundException,
+} from '@nestjs/common';
+import { Role } from '@prisma/client';
+import * as bcrypt from 'bcryptjs';
+import { TeamerService } from './teamer.service';
+import { AuthenticatedUser } from '../auth/authenticated-request';
+
+/// Focus: the Gemeinde-scope check (assertCanManage) and the create/invite
+/// branching. Prisma + SyncService faked in memory.
+
+const GEMEINDE = { id: 'gem-1', name: 'Nord', kcId: 'kc-1', createdAt: new Date() };
+
+function caller(memberships: AuthenticatedUser['memberships']): AuthenticatedUser {
+  return { userId: 'caller-1', authentikSub: 'sub-1', email: 'c@example.org', memberships };
+}
+const LT = caller([{ kcId: 'kc-1', gemeindeId: null, role: Role.LEITUNGSTEAM }]);
+const VERANTW_GEM1 = caller([
+  { kcId: 'kc-1', gemeindeId: 'gem-1', role: Role.GEMEINDE_VERANTWORTLICHER },
+]);
+const VERANTW_GEM2 = caller([
+  { kcId: 'kc-1', gemeindeId: 'gem-2', role: Role.GEMEINDE_VERANTWORTLICHER },
+]);
+
+function makeService(opts: { gemeinde?: typeof GEMEINDE | null; existingEmails?: string[] } = {}) {
+  const gemeinde = opts.gemeinde === undefined ? GEMEINDE : opts.gemeinde;
+  const emails = new Set(opts.existingEmails ?? []);
+  const created: Record<string, unknown> = {};
+
+  const prisma = {
+    gemeinde: { findUnique: jest.fn().mockResolvedValue(gemeinde) },
+    user: {
+      findUnique: jest.fn(({ where }: { where: { email: string } }) =>
+        Promise.resolve(emails.has(where.email) ? { id: 'dup', email: where.email } : null),
+      ),
+      create: jest.fn(({ data }: { data: Record<string, unknown> }) => {
+        created.user = { id: 'u-1', createdAt: new Date(), ...data };
+        return Promise.resolve(created.user);
+      }),
+      delete: jest.fn().mockResolvedValue({ id: 'u-1' }),
+    },
+    membership: {
+      create: jest.fn(({ data }: { data: Record<string, unknown> }) => {
+        created.membership = { id: 'm-1', ...data };
+        return Promise.resolve(created.membership);
+      }),
+      findFirst: jest.fn().mockResolvedValue(null),
+      findMany: jest.fn().mockResolvedValue([]),
+    },
+    teamerInvite: {
+      create: jest.fn(({ data }: { data: Record<string, unknown> }) =>
+        Promise.resolve({ id: 'inv-1', usedCount: 0, revokedAt: null, ...data }),
+      ),
+    },
+  };
+  const sync = { capture: jest.fn().mockResolvedValue(undefined) };
+  const service = new TeamerService(prisma as never, sync as never);
+  return { service, prisma, sync, created };
+}
+
+describe('TeamerService scope check', () => {
+  it('404s when the Gemeinde does not exist', async () => {
+    const { service } = makeService({ gemeinde: null });
+    await expect(service.listTeamer(LT, 'gem-x')).rejects.toBeInstanceOf(NotFoundException);
+  });
+
+  it('lets the Leitungsteam manage any Gemeinde', async () => {
+    const { service, prisma } = makeService();
+    await expect(service.listTeamer(LT, 'gem-1')).resolves.toEqual([]);
+  });
+
+  it('lets a Verantwortliche/r manage their own Gemeinde', async () => {
+    const { service, prisma } = makeService();
+    await expect(service.listTeamer(VERANTW_GEM1, 'gem-1')).resolves.toEqual([]);
+  });
+
+  it('forbids a Verantwortliche/r from managing a different Gemeinde', async () => {
+    const { service } = makeService();
+    await expect(service.listTeamer(VERANTW_GEM2, 'gem-1')).rejects.toBeInstanceOf(
+      ForbiddenException,
+    );
+  });
+});
+
+describe('TeamerService.createTeamer', () => {
+  it('rejects a duplicate email', async () => {
+    const { service } = makeService({ existingEmails: ['dup@example.org'] });
+    await expect(
+      service.createTeamer(VERANTW_GEM1, 'gem-1', {
+        firstName: 'A',
+        lastName: 'B',
+        email: 'dup@example.org',
+        password: 'password1',
+      }),
+    ).rejects.toBeInstanceOf(ConflictException);
+  });
+
+  it('creates a hashed local account + GEMEINDE_TEAMER membership and hides the hash', async () => {
+    const { service, created, sync } = makeService();
+    const res = await service.createTeamer(VERANTW_GEM1, 'gem-1', {
+      firstName: 'Ada',
+      lastName: 'Lo',
+      email: 'Ada@Example.org',
+      password: 'password1',
+    });
+
+    expect(res).not.toHaveProperty('passwordHash');
+    expect(res.email).toBe('ada@example.org');
+    expect((created.user as { kcId: string }).kcId).toBe('kc-1');
+    expect(
+      await bcrypt.compare('password1', (created.user as { passwordHash: string }).passwordHash),
+    ).toBe(true);
+    expect((created.membership as { role: Role }).role).toBe(Role.GEMEINDE_TEAMER);
+    expect((created.membership as { gemeindeId: string }).gemeindeId).toBe('gem-1');
+    expect(sync.capture).toHaveBeenCalledWith('User', 'CREATE', 'u-1', expect.anything());
+    expect(sync.capture).toHaveBeenCalledWith('Membership', 'CREATE', 'm-1', expect.anything());
+  });
+});
+
+describe('TeamerService.createInvite', () => {
+  it('defaults a group link to unlimited uses and no expiry', async () => {
+    const { service } = makeService();
+    const inv = await service.createInvite(LT, 'gem-1', {});
+    expect(inv.email).toBeNull();
+    expect(inv.maxUses).toBeNull();
+    expect(inv.expiresAt).toBeNull();
+    expect(inv.token).toEqual(expect.any(String));
+  });
+
+  it('defaults a personal invite to a single use and lowercases the email', async () => {
+    const { service } = makeService();
+    const inv = await service.createInvite(LT, 'gem-1', { email: 'New@Example.org' });
+    expect(inv.email).toBe('new@example.org');
+    expect(inv.maxUses).toBe(1);
+  });
+
+  it('turns expiresInHours into a concrete expiry', async () => {
+    const { service } = makeService();
+    const before = Date.now();
+    const inv = await service.createInvite(LT, 'gem-1', { expiresInHours: 48 });
+    const ms = (inv.expiresAt as Date).getTime() - before;
+    expect(ms).toBeGreaterThan(47 * 3600_000);
+    expect(ms).toBeLessThan(49 * 3600_000);
+  });
+});
+
+describe('TeamerService.removeTeamer', () => {
+  it('404s when the user is not a local Teamer of that Gemeinde', async () => {
+    const { service } = makeService();
+    await expect(service.removeTeamer(LT, 'gem-1', 'u-9')).rejects.toBeInstanceOf(
+      NotFoundException,
+    );
+  });
+
+  it('deletes the account and captures a User DELETE', async () => {
+    const { service, prisma, sync } = makeService();
+    prisma.membership.findFirst = jest
+      .fn()
+      .mockResolvedValue({ userId: 'u-1', gemeindeId: 'gem-1', user: { passwordHash: 'h' } });
+    const res = await service.removeTeamer(LT, 'gem-1', 'u-1');
+    expect(res).toEqual({ id: 'u-1' });
+    expect(prisma.user.delete).toHaveBeenCalledWith({ where: { id: 'u-1' } });
+    expect(sync.capture).toHaveBeenCalledWith('User', 'DELETE', 'u-1', { id: 'u-1' });
+  });
+});

src/teamer/teamer.service.ts

@@ -0,0 +1,182 @@
+import {
+  ConflictException,
+  ForbiddenException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { randomBytes } from 'crypto';
+import { Role, SyncOperation } from '@prisma/client';
+import * as bcrypt from 'bcryptjs';
+import { PrismaClient } from '../prisma/prisma.module';
+import { SyncService } from '../sync/sync.service';
+import { AuthenticatedUser } from '../auth/authenticated-request';
+import { CreateTeamerInviteDto } from './dto/create-teamer-invite.dto';
+
+const BCRYPT_ROUNDS = 10;
+
+type PublicUser = {
+  id: string;
+  email: string;
+  firstName: string;
+  lastName: string;
+  createdAt: Date;
+};
+
+/// Management of local Gemeinde Teamer accounts and their invites. Callable by
+/// the Leitungsteam (any Gemeinde) or by a Gemeinde Verantwortliche/r for
+/// their own Gemeinde only.
+@Injectable()
+export class TeamerService {
+  constructor(
+    private readonly prisma: PrismaClient,
+    private readonly sync: SyncService,
+  ) {}
+
+  async createTeamer(
+    caller: AuthenticatedUser,
+    gemeindeId: string,
+    input: { firstName: string; lastName: string; email: string; password: string },
+  ): Promise<PublicUser> {
+    const gemeinde = await this.assertCanManage(caller, gemeindeId);
+    const email = input.email.toLowerCase();
+    if (await this.prisma.user.findUnique({ where: { email } })) {
+      throw new ConflictException('An account with this email already exists');
+    }
+
+    const passwordHash = await bcrypt.hash(input.password, BCRYPT_ROUNDS);
+    const user = await this.prisma.user.create({
+      data: {
+        email,
+        firstName: input.firstName,
+        lastName: input.lastName,
+        passwordHash,
+        kcId: gemeinde.kcId,
+      },
+    });
+    const membership = await this.prisma.membership.create({
+      data: {
+        userId: user.id,
+        kcId: gemeinde.kcId,
+        gemeindeId,
+        role: Role.GEMEINDE_TEAMER,
+      },
+    });
+    await this.sync.capture('User', SyncOperation.CREATE, user.id, user);
+    await this.sync.capture('Membership', SyncOperation.CREATE, membership.id, membership);
+    return toPublicUser(user);
+  }
+
+  async listTeamer(caller: AuthenticatedUser, gemeindeId: string): Promise<PublicUser[]> {
+    await this.assertCanManage(caller, gemeindeId);
+    const memberships = await this.prisma.membership.findMany({
+      where: { gemeindeId, role: Role.GEMEINDE_TEAMER },
+      include: { user: true },
+      orderBy: { user: { lastName: 'asc' } },
+    });
+    return memberships.map((m) => toPublicUser(m.user));
+  }
+
+  async removeTeamer(
+    caller: AuthenticatedUser,
+    gemeindeId: string,
+    userId: string,
+  ): Promise<{ id: string }> {
+    await this.assertCanManage(caller, gemeindeId);
+    const membership = await this.prisma.membership.findFirst({
+      where: { userId, gemeindeId, role: Role.GEMEINDE_TEAMER },
+      include: { user: true },
+    });
+    if (!membership || !membership.user.passwordHash) {
+      throw new NotFoundException('No local Teamer account for this Gemeinde');
+    }
+    await this.prisma.user.delete({ where: { id: userId } });
+    await this.sync.capture('User', SyncOperation.DELETE, userId, { id: userId });
+    return { id: userId };
+  }
+
+  async createInvite(
+    caller: AuthenticatedUser,
+    gemeindeId: string,
+    dto: CreateTeamerInviteDto,
+  ) {
+    const gemeinde = await this.assertCanManage(caller, gemeindeId);
+    const email = dto.email?.toLowerCase() ?? null;
+    const maxUses = dto.maxUses ?? (email ? 1 : null);
+    const expiresAt = dto.expiresInHours
+      ? new Date(Date.now() + dto.expiresInHours * 3600_000)
+      : null;
+
+    const invite = await this.prisma.teamerInvite.create({
+      data: {
+        kcId: gemeinde.kcId,
+        gemeindeId,
+        token: randomBytes(24).toString('base64url'),
+        email,
+        maxUses,
+        expiresAt,
+        createdByUserId: caller.userId,
+      },
+    });
+    await this.sync.capture('TeamerInvite', SyncOperation.CREATE, invite.id, invite);
+    return invite;
+  }
+
+  async listInvites(caller: AuthenticatedUser, gemeindeId: string) {
+    await this.assertCanManage(caller, gemeindeId);
+    return this.prisma.teamerInvite.findMany({
+      where: { gemeindeId },
+      orderBy: { createdAt: 'desc' },
+    });
+  }
+
+  async revokeInvite(caller: AuthenticatedUser, gemeindeId: string, inviteId: string) {
+    await this.assertCanManage(caller, gemeindeId);
+    const invite = await this.prisma.teamerInvite.findFirst({
+      where: { id: inviteId, gemeindeId },
+    });
+    if (!invite) {
+      throw new NotFoundException('Invite not found');
+    }
+    const updated = await this.prisma.teamerInvite.update({
+      where: { id: inviteId },
+      data: { revokedAt: new Date() },
+    });
+    await this.sync.capture('TeamerInvite', SyncOperation.UPDATE, updated.id, updated);
+    return updated;
+  }
+
+  /// LT may manage every Gemeinde; a Verantwortliche/r only the one they hold
+  /// that role for. Returns the Gemeinde (for its kcId) on success.
+  private async assertCanManage(caller: AuthenticatedUser, gemeindeId: string) {
+    const gemeinde = await this.prisma.gemeinde.findUnique({ where: { id: gemeindeId } });
+    if (!gemeinde) {
+      throw new NotFoundException('Gemeinde not found');
+    }
+    const isLeitungsteam = caller.memberships.some(
+      (m) => m.role === Role.LEITUNGSTEAM,
+    );
+    const isVerantwortlich = caller.memberships.some(
+      (m) => m.role === Role.GEMEINDE_VERANTWORTLICHER && m.gemeindeId === gemeindeId,
+    );
+    if (!isLeitungsteam && !isVerantwortlich) {
+      throw new ForbiddenException('Not responsible for this Gemeinde');
+    }
+    return gemeinde;
+  }
+}
+
+function toPublicUser(user: {
+  id: string;
+  email: string;
+  firstName: string;
+  lastName: string;
+  createdAt: Date;
+}): PublicUser {
+  return {
+    id: user.id,
+    email: user.email,
+    firstName: user.firstName,
+    lastName: user.lastName,
+    createdAt: user.createdAt,
+  };
+}