diff --git a/Web/app.py b/Web/app.py index 779abe1..5958b57 100755 --- a/Web/app.py +++ b/Web/app.py @@ -556,7 +556,7 @@ def _enforce_module_access(): flash(msg, 'info') if name != 'inventory' and cfg.MODULES.is_enabled('inventory'): - return redirect(url_for('home')) + return redirect(url_for('home_admin')) elif name != 'library' and cfg.MODULES.is_enabled('library'): return redirect('/library') @@ -630,7 +630,7 @@ def handle_build_error(e): return redirect('/library') if 'username' in session: - return redirect(url_for('home')) + return redirect(url_for('home_admin')) return redirect(url_for('login')) @@ -708,10 +708,10 @@ def _permission_denied_fallback_endpoint(permissions, current_endpoint=None): is_admin_user = bool(username and us.check_admin(username)) admin_home_allowed = _page_access_allowed(permissions, 'home_admin') and _action_access_allowed(permissions, 'can_manage_settings') - for candidate in ('my_borrowed_items', 'tutorial_page', 'notifications_view', 'impressum', 'home'): + for candidate in ('my_borrowed_items', 'tutorial_page', 'notifications_view', 'impressum', 'home_admin'): if current_endpoint and candidate == current_endpoint: continue - if candidate == 'home' and is_admin_user and not admin_home_allowed: + if candidate == 'home_admin' and is_admin_user and not admin_home_allowed: continue if _page_access_allowed(permissions, candidate): return candidate @@ -2178,7 +2178,7 @@ def _upload_excel_items(scope='inventory'): if is_library_scope: if not cfg.MODULES.is_enabled('library'): flash('Bibliotheks-Modul ist deaktiviert.', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) excel_file = request.files.get(file_field) if not excel_file or not excel_file.filename: @@ -2194,7 +2194,7 @@ def _upload_excel_items(scope='inventory'): # Allow CSV imports for authenticated non-admin users only for inventory (non-library) if not (is_csv and not is_library_scope and 'username' in session): flash('Einfüge-Rechte erforderlich.', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) filename_lower = excel_file.filename.lower() if not filename_lower.endswith(('.xlsx', '.csv')): @@ -2882,15 +2882,16 @@ def user_status(): ##################################################### changes to be made to account for the new account permison managment system ############################## +"""" @app.route('/') def home(): - """ + """""" Main route for the application homepage. Redirects to the appropriate view based on user role. Returns: flask.Response: Rendered template or redirect - """ + """""" if 'username' not in session: flash('Bitte mit registriertem Konto anmelden!', 'error') return redirect(url_for('login')) @@ -2921,7 +2922,7 @@ def home(): if fallback_endpoint == 'logout': flash('Für diesen Benutzer sind aktuell keine Seiten freigegeben.', 'error') return redirect(url_for(fallback_endpoint)) - +""" @app.route('/home_admin') def home_admin(): @@ -2942,9 +2943,12 @@ def home_admin(): else: return "Weder Inventar- noch Bibliotheks-Modul sind aktiviert.", 403 - if not us.check_admin(session['username']): + current_permissions = us.get_effective_permissions(session['username']) + + if not current_permissions['pages'].get('home', False): flash('Ihnen ist es nicht gestattet auf dieser Internetanwendung, die eben besuchte Adrrese zu nutzen, versuchen sie es erneut nach dem sie sich mit einem berechtigten Nutzer angemeldet haben!', 'error') - return redirect(url_for('login')) + return redirect(url_for('library_view')) + return render_template( 'main_admin.html', username=session['username'], @@ -3052,7 +3056,7 @@ def library_view(): return redirect(url_for('login')) if not cfg.MODULES.is_enabled('library'): flash('Bibliotheks-Modul ist deaktiviert.', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) return render_template( 'library_table.html', @@ -3080,7 +3084,7 @@ def library_loans_admin(): if not cfg.MODULES.is_enabled('library'): flash('Bibliotheks-Modul ist deaktiviert.', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) _ensure_audit_indexes_once() @@ -4478,7 +4482,7 @@ def login(): flask.Response: Rendered template or redirect """ if 'username' in session: - return redirect(url_for('home')) + return redirect(url_for('home_admin')) if request.method == 'POST': username = request.form['username'] password = request.form['password'] @@ -4514,7 +4518,7 @@ def login(): fallback_endpoint = _permission_denied_fallback_endpoint(permissions, current_endpoint='login') return redirect(url_for(fallback_endpoint)) else: - return redirect(url_for('home')) + return redirect(url_for('home_admin')) else: app.logger.warning(f"Login failed: username={encrypt_text(username)!r} tenant={current_tenant_id or 'default'} db={current_tenant_db} host={request.host} ip={encrypt_text(request.remote_addr)}") flash('Ungültige Anmeldedaten', 'error') @@ -4584,7 +4588,7 @@ def change_password(): # Update the password if us.update_password(session['username'], new_password): flash('Ihr Passwort wurde erfolgreich geändert.', 'success') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) else: flash('Fehler beim Ändern des Passworts. Bitte versuchen Sie es später erneut.', 'error') @@ -5178,7 +5182,7 @@ def upload_item(): elif cfg.MODULES.is_enabled('library') and _page_access_allowed(permissions, 'home_library'): success_redirect_endpoint = 'home_library' else: - success_redirect_endpoint = 'home' + success_redirect_endpoint = 'home_admin' # Detect if request is from mobile device is_mobile = 'Mobile' in request.headers.get('User-Agent', '') @@ -6384,7 +6388,7 @@ def delete_item(id): if not current_permissions['actions'].get('can_delete', False): flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion (Löschen) auszuführen.', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) if not cfg.MODULES.is_enabled('inventory'): flash('Bibliotheks-Modul ist deaktiviert.', 'error') @@ -6448,11 +6452,11 @@ def delete_library_item(id): if not current_permissions['actions'].get('can_delete', False): flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion (Löschen) auszuführen.', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) if not cfg.MODULES.is_enabled('library'): flash('Bibliotheks-Modul ist deaktiviert.', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) # Verify item exists and is a library item try: @@ -6522,7 +6526,7 @@ def bulk_delete_items(): if not current_permissions['actions'].get('can_delete', False): flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion (Löschen) auszuführen.', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) if not cfg.MODULES.is_enabled('inventory'): flash('Bibliotheks-Modul ist deaktiviert.', 'error') @@ -6587,7 +6591,7 @@ def edit_item(id): if not current_permissions['actions'].get('can_edit', False): flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion (Löschen) auszuführen.', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) if not cfg.MODULES.is_enabled('inventory'): flash('Bibliotheks-Modul ist deaktiviert.', 'error') @@ -7005,7 +7009,7 @@ def ausleihen(id): if requested_return_to == 'library' and cfg.MODULES.is_enabled('library'): redirect_target = 'library_view' else: - redirect_target = 'home_admin' if us.check_admin(username) else 'home' # check for plausability + redirect_target = 'home_admin' item = it.get_item(id) if not item: @@ -7071,7 +7075,7 @@ def ausleihen(id): student_user = us.get_user_by_student_card(student_card_id) if not student_user: flash('Keine Schülerin/kein Schüler mit dieser Ausweis-ID gefunden.', 'error') - return redirect(url_for('home_admin')) + return redirect(url_for('library')) effective_borrower = student_user.get('Username') or student_user.get('username') or username if borrow_duration_days is None: try: @@ -7321,7 +7325,7 @@ def zurueckgeben(id): item = it.get_item(id) if not item: flash('Element nicht gefunden', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) username = session['username'] @@ -7903,20 +7907,20 @@ def terminplan(): if not cfg.MODULES.is_enabled('terminplan'): flash('Der Terminplaner ist deaktiviert.', 'info') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) # Make sure the template exists template_path = os.path.join(BASE_DIR, 'templates', 'terminplan.html') if not os.path.exists(template_path): print(f"Template file not found: {template_path}") flash('Vorlage nicht gefunden. Bitte kontaktieren Sie den Administrator.', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) return render_template('terminplan.html', school_periods=SCHOOL_PERIODS) except Exception as e: app.logger.error(f"Error rendering terminplan: {e}") flash('Ein Fehler ist beim Anzeigen des Kalenders aufgetreten.', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) '''-------------------------------------------------------------------------------------------------------------ADMIN ROUTES------------------------------------------------------------------------------------------------------------------''' @@ -7973,7 +7977,7 @@ def register(): action_permissions=action_permissions, page_permissions=page_permissions, ) - return redirect(url_for('home')) + return redirect(url_for('home_admin')) return render_template( 'register.html', library_module_enabled=cfg.MODULES.is_enabled('library'), @@ -8658,7 +8662,7 @@ def admin_create_invoice(borrow_id): 'damage_reason': damage_reason, 'created_at': now, 'created_by': session.get('username', ''), - 'borrower': borrower, + 'borrower': decrypt_text(borrower), 'item_id': str(item_doc['_id']), 'item_name': item_name, 'item_code': item_code, @@ -10438,7 +10442,7 @@ def notifications_view(): except Exception as exc: app.logger.error(f"Error loading notifications: {exc}") flash('Fehler beim Laden der Benachrichtigungen.', 'error') - return redirect(url_for('home')) + return redirect(url_for('home_admin')) finally: if client: client.close() diff --git a/Web/templates/main_admin.html b/Web/templates/main_admin.html index 1d5cec4..f32121d 100755 --- a/Web/templates/main_admin.html +++ b/Web/templates/main_admin.html @@ -2309,6 +2309,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
+ {% if current_permissions.actions.get('can_edit', False) %}