From 3b637de18835c079220a21a4defb5a36c1c054f1 Mon Sep 17 00:00:00 2001
From: AIIrondev <iron.ai.dev@gmail.com>
Date: Fri, 17 Apr 2026 23:07:37 +0200
Subject: [PATCH] feat: Implement custom permission settings in user
 registration and update user addition logic

---
 Web/app.py                  |  24 +++++--
 Web/templates/register.html | 140 ++++++++++++++++++++++++++++++++----
 Web/user.py                 |  24 ++++++-
 3 files changed, 166 insertions(+), 22 deletions(-)

diff --git a/Web/app.py b/Web/app.py
index c61ab62..22a400a 100755
--- a/Web/app.py
+++ b/Web/app.py
@@ -6688,8 +6688,8 @@ def register():
         if request.method == 'POST':
             username = request.form['username']
             password = request.form['password']
-            name = request.form['name']
-            last_name = request.form['last-name']
+            permission_preset = (request.form.get('permission_preset') or 'standard_user').strip()
+            use_custom_permissions = request.form.get('use_custom_permissions') == 'on'
             is_student = bool(request.form.get('is_student')) if cfg.STUDENT_CARDS_MODULE_ENABLED else False
             student_card_id = us.normalize_student_card_id(request.form.get('student_card_id')) if cfg.STUDENT_CARDS_MODULE_ENABLED else ''
             max_borrow_days_raw = request.form.get('max_borrow_days') if cfg.STUDENT_CARDS_MODULE_ENABLED else None
@@ -6703,6 +6703,17 @@ def register():
                 flash('Passwort ist zu schwach', 'error')
                 return redirect(url_for('register'))
 
+            action_permissions = None
+            page_permissions = None
+            if use_custom_permissions:
+                action_permissions = {}
+                for action_key, _ in PERMISSION_ACTION_OPTIONS:
+                    action_permissions[action_key] = request.form.get(f'action_{action_key}') == 'on'
+
+                page_permissions = {}
+                for endpoint_name, _ in PERMISSION_PAGE_OPTIONS:
+                    page_permissions[endpoint_name] = request.form.get(f'page_{endpoint_name}') == 'on'
+
             max_borrow_days = None
             if is_student:
                 if not student_card_id:
@@ -6720,11 +6731,14 @@ def register():
             us.add_user(
                 username,
                 password,
-                name,
-                last_name,
+                username,
+                '',
                 is_student=is_student,
                 student_card_id=student_card_id if is_student else None,
-                max_borrow_days=max_borrow_days
+                max_borrow_days=max_borrow_days,
+                permission_preset=permission_preset,
+                action_permissions=action_permissions,
+                page_permissions=page_permissions,
             )
             return redirect(url_for('home'))
         return render_template(
diff --git a/Web/templates/register.html b/Web/templates/register.html
index 175f229..2834314 100755
--- a/Web/templates/register.html
+++ b/Web/templates/register.html
@@ -39,16 +39,7 @@
                         <span class="input-icon">👤</span>
                         <input type="text" id="username" name="username" placeholder="Geben Sie einen Benutzernamen ein" required>
                     </div>
-                    <label for="name">Name</label>
-                    <div class="input-container">
-                        <span class="input-icon">👤</span>
-                        <input type="text" id="name" name="name" placeholder="Geben Sie den Namen ein" required>
-                    </div>
-                    <label for="last-name">Nachname</label>
-                    <div class="input-container">
-                        <span class="input-icon">👤</span>
-                        <input type="text" id="last-name" name="last-name" placeholder="Geben Sie den Nachnamen ein" required>
-                    </div>
+                    <p class="anonymize-hint">Klarnamen werden nicht gespeichert. Ein anonymes Kürzel wird automatisch aus dem Benutzernamen erzeugt.</p>
                 </div>
                 
                 <div class="form-group">
@@ -81,6 +72,43 @@
                 </div>
                 {% endif %}
 
+                <div class="form-group">
+                    <label for="permission-preset">Berechtigungs-Preset</label>
+                    <select id="permission-preset" name="permission_preset" class="form-select">
+                        {% for preset_key, preset in permission_presets.items() %}
+                        <option value="{{ preset_key }}">{{ preset.label }}</option>
+                        {% endfor %}
+                    </select>
+
+                    <label style="display:flex; align-items:center; gap:8px; margin-top:12px; color:#1f2937;">
+                        <input type="checkbox" id="use-custom-permissions" name="use_custom_permissions" style="width:auto;">
+                        Individuelle Berechtigungen statt Preset setzen
+                    </label>
+
+                    <div id="custom-permissions" style="display:none; margin-top:12px;">
+                        <div class="permission-panels">
+                            <div class="permission-panel">
+                                <h4>Aktionsrechte</h4>
+                                {% for action_key, action_label in permission_action_options %}
+                                <label class="permission-check">
+                                    <input type="checkbox" class="permission-action-checkbox" name="action_{{ action_key }}">
+                                    <span>{{ action_label }}</span>
+                                </label>
+                                {% endfor %}
+                            </div>
+                            <div class="permission-panel">
+                                <h4>Seitenrechte</h4>
+                                {% for endpoint_name, endpoint_label in permission_page_options %}
+                                <label class="permission-check">
+                                    <input type="checkbox" class="permission-page-checkbox" name="page_{{ endpoint_name }}">
+                                    <span>{{ endpoint_label }}</span>
+                                </label>
+                                {% endfor %}
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
                 <div class="form-group form-actions">
                     <button type="submit" class="action-button register-button">Benutzer registrieren</button>
                 </div>
@@ -174,7 +202,8 @@ body {
 }
 
 input[type="text"],
-input[type="password"] {
+input[type="password"],
+.form-select {
     width: 100%;
     padding: 0.8rem 1rem 0.8rem 3rem;
     border: 1px solid #ddd;
@@ -185,12 +214,17 @@ input[type="password"] {
 }
 
 input[type="text"]:focus,
-input[type="password"]:focus {
+input[type="password"]:focus,
+.form-select:focus {
     border-color: var(--primary-color);
     box-shadow: 0 0 0 3px rgba(52, 152, 219, 0.2);
     outline: none;
 }
 
+.form-select {
+    padding-left: 1rem;
+}
+
 input::placeholder {
     color: #aaa;
 }
@@ -311,11 +345,89 @@ input::placeholder {
 .richtlinen{
     color: #ec0920;
 }
+
+.anonymize-hint {
+    margin-top: 10px;
+    margin-bottom: 0;
+    background: #f0f9ff;
+    border: 1px solid #bae6fd;
+    border-radius: 8px;
+    padding: 10px 12px;
+    color: #0c4a6e;
+    font-size: 0.92rem;
+}
+
+.permission-panels {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+    gap: 12px;
+}
+
+.permission-panel {
+    border: 1px solid #d1d5db;
+    border-radius: 8px;
+    padding: 10px;
+    background: #f8fafc;
+}
+
+.permission-panel h4 {
+    margin: 0 0 8px;
+    font-size: 1rem;
+    color: #1f2937;
+}
+
+.permission-check {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    margin: 4px 0;
+    color: #1f2937;
+}
 </style>
 
-{% if student_cards_module_enabled %}
 <script>
 document.addEventListener('DOMContentLoaded', function () {
+    const permissionPresets = {{ permission_presets | tojson }};
+    const presetSelect = document.getElementById('permission-preset');
+    const useCustomPermissions = document.getElementById('use-custom-permissions');
+    const customPermissions = document.getElementById('custom-permissions');
+
+    function applyPresetToPermissionForm(presetKey) {
+        const preset = permissionPresets[presetKey] || {};
+        const actionDefaults = preset.actions || {};
+        const pageDefaults = preset.pages || {};
+
+        document.querySelectorAll('.permission-action-checkbox').forEach(function (checkbox) {
+            const key = checkbox.name.replace('action_', '');
+            checkbox.checked = !!actionDefaults[key];
+        });
+
+        document.querySelectorAll('.permission-page-checkbox').forEach(function (checkbox) {
+            const key = checkbox.name.replace('page_', '');
+            checkbox.checked = !!pageDefaults[key];
+        });
+    }
+
+    function toggleCustomPermissions() {
+        if (!useCustomPermissions || !customPermissions) {
+            return;
+        }
+        customPermissions.style.display = useCustomPermissions.checked ? 'block' : 'none';
+    }
+
+    if (presetSelect) {
+        presetSelect.addEventListener('change', function () {
+            applyPresetToPermissionForm(this.value);
+        });
+        applyPresetToPermissionForm(presetSelect.value);
+    }
+
+    if (useCustomPermissions) {
+        useCustomPermissions.addEventListener('change', toggleCustomPermissions);
+        toggleCustomPermissions();
+    }
+
+    {% if student_cards_module_enabled %}
     const studentCheckbox = document.getElementById('is-student');
     const studentFields = document.getElementById('student-fields');
     const studentCardInput = document.getElementById('student-card-id');
@@ -332,7 +444,7 @@ document.addEventListener('DOMContentLoaded', function () {
 
     studentCheckbox.addEventListener('change', toggleStudentFields);
     toggleStudentFields();
+    {% endif %}
 });
 </script>
-{% endif %}
 {% endblock %}
\ No newline at end of file
diff --git a/Web/user.py b/Web/user.py
index 2c1d3ae..3c38d49 100755
--- a/Web/user.py
+++ b/Web/user.py
@@ -380,7 +380,18 @@ def check_nm_pwd(username, password):
     return user
 
 
-def add_user(username, password, name, last_name, is_student=False, student_card_id=None, max_borrow_days=None):
+def add_user(
+    username,
+    password,
+    name='',
+    last_name='',
+    is_student=False,
+    student_card_id=None,
+    max_borrow_days=None,
+    permission_preset='standard_user',
+    action_permissions=None,
+    page_permissions=None,
+):
     """
     Add a new user to the database.
     
@@ -396,9 +407,16 @@ def add_user(username, password, name, last_name, is_student=False, student_card
     users = db['users']
     if not check_password_strength(password):
         return False
-    permission_defaults = build_default_permission_payload('standard_user')
+    permission_defaults = build_default_permission_payload(permission_preset)
+    if isinstance(action_permissions, dict):
+        for key, value in action_permissions.items():
+            permission_defaults['actions'][str(key)] = bool(value)
+    if isinstance(page_permissions, dict):
+        for key, value in page_permissions.items():
+            permission_defaults['pages'][str(key)] = bool(value)
 
-    name_alias = build_name_synonym(name, last_name)
+    alias_source = name if str(name or '').strip() else username
+    name_alias = build_name_synonym(alias_source, '')
 
     user_doc = {
         'Username': username,