Umgesetzt:

Ausleihungen verwenden jetzt user_id statt Benutzername als Funktionsargument.
Das Feld User speichert nun die Benutzer-ID statt des Benutzernamens.
Login speichert zusätzlich session['user_id'].
Normale Ausleihen, Schülerausweis-Ausleihen und Reservierungen verwenden die Benutzer-ID.
Berechtigungsprüfungen für eigene Ausleihen/Buchungen vergleichen IDs.
Kalenderbuchungen erkennen den aktuellen Benutzer jetzt ebenfalls über die ID.
update_ausleihung() und get_ausleihung_by_user() wurden angepasst.

Web/app.py

@@ -468,6 +468,10 @@ def _enforce_active_session_user():
         return None
 
     username = session.get('username')
+    current_user_id = session.get('user_id')
+    if not current_user_id:
+        current_user = us.get_user(username)
+        current_user_id = str(current_user['_id']) if current_user and current_user.get('_id') else None
     if not username:
         return None
 
@@ -4228,9 +4232,12 @@ def api_library_scan_action():
             due_date = now + datetime.timedelta(days=borrow_duration_days)
 
             it.update_item_status(item_id, False, borrower_name)
+            borrower_user = us.get_user_by_student_card(student_card_id)
+            if not borrower_user or not borrower_user.get('_id'):
+                return jsonify({'ok': False, 'message': 'Kein Benutzer für diesen Schülerausweis gefunden.'}), 404
             au.add_ausleihung(
                 item_id,
-                borrower_name,
+                str(borrower_user['_id']),
                 now,
                 end_date=due_date,
                 due_date=due_date,
@@ -5467,6 +5474,7 @@ def login():
         if user:
             app.logger.info(f"Login success: username={encrypt_text(username)!r} tenant={current_tenant_id or 'default'} db={current_tenant_db} host={request.host} ip={encrypt_text(request.remote_addr)}")
             session['username'] = username
+            session['user_id'] = str(user.get('_id'))
             is_admin_user = bool(user.get('Admin', False))
             session['admin'] = is_admin_user
             session['is_admin'] = is_admin_user
@@ -5867,10 +5875,7 @@ def get_bookings():
         result = []
         for booking in bookings:
             raw_booking_user = booking.get('User') or ''
-            try:
-                booking_user = decrypt_text(raw_booking_user) if raw_booking_user else ''
-            except Exception:
-                booking_user = str(raw_booking_user)
+            booking_user = str(raw_booking_user)
             start_dt = booking.get('Start')
             if not start_dt:
                 continue
@@ -5916,7 +5921,7 @@ def get_bookings():
                 'userName': str(booking_user),
                 'notes': str(booking.get('Notes') or ''),
                 'period': period,
-                'isCurrentUser': str(booking_user) == username,
+                'isCurrentUser': str(booking_user) == str(current_user_id),
                 'itemBorrower': item_borrower,
             })
 
@@ -6036,7 +6041,10 @@ def api_booking_conflicts():
         current_permissions = us.get_effective_permissions(session['username'])
             
         if not current_permissions['actions'].get('can_view_logs', False):
-            query['User'] = session['username']
+            current_user = us.get_user(session['username'])
+            if not current_user or not current_user.get('_id'):
+                return jsonify({'error': 'User account could not be resolved'}), 401
+            query['User'] = str(current_user['_id'])
 
         conflicts = list(ausleihungen.find(query))
         result = []
@@ -7377,6 +7385,11 @@ def ausleihen(id):
         return redirect(url_for('login'))
     
     username = session['username']
+    current_user = us.get_user(username)
+    if not current_user or not current_user.get('_id'):
+        flash('Benutzerkonto konnte nicht eindeutig ermittelt werden.', 'error')
+        return redirect(url_for('login'))
+    effective_borrower_id = str(current_user['_id'])
     requested_return_to = (request.form.get('return_to') or '').strip().lower()
     if requested_return_to == 'library' and cfg.MODULES.is_enabled('library'):
         redirect_target = 'library_view'
@@ -7450,6 +7463,7 @@ def ausleihen(id):
                     flash('Keine Schülerin/kein Schüler mit dieser Ausweis-ID gefunden.', 'error')
                     return redirect(url_for('library_view'))
                 effective_borrower = student_user.get('Username') or student_user.get('username') or username
+                effective_borrower_id = str(student_user['_id'])
                 if borrow_duration_days is None:
                     try:
                         card_default = int(student_user.get('MaxBorrowDays', cfg.STUDENT_DEFAULT_BORROW_DAYS))
@@ -7524,7 +7538,7 @@ def ausleihen(id):
             it.update_item_status(unit_id, False, effective_borrower)
             au.add_ausleihung(
                 unit_id,
-                effective_borrower,
+                effective_borrower_id,
                 start_date,
                 end_date=end_date,
                 due_date=end_date if is_library_item else None,
@@ -7621,7 +7635,7 @@ def ausleihen(id):
         start_date = datetime.datetime.now(ZoneInfo("Europe/Berlin"))
         au.add_ausleihung(
             id,
-            effective_borrower,
+            effective_borrower_id,
             start_date,
             end_date=end_date,
             due_date=end_date if is_library_item else None,
@@ -7672,7 +7686,7 @@ def ausleihen(id):
             exemplar_id = f"{id}_{exemplar['number']}"
             au.add_ausleihung(
                 exemplar_id,
-                effective_borrower,
+                effective_borrower_id,
                 start_date,
                 end_date=end_date,
                 due_date=end_date if is_library_item else None,
@@ -7833,7 +7847,12 @@ def get_ausleihung_by_item_route(id):
 
     current_permissions = us.get_effective_permissions(session['username'])
             
-    if ausleihung and (current_permissions['actions'].get('can_manage_users')) or ausleihung.get('User') == session['username']:
+    current_user = us.get_user(session['username'])
+    current_user_id = str(current_user['_id']) if current_user and current_user.get('_id') else ''
+    if ausleihung and (
+        current_permissions['actions'].get('can_manage_users')
+        or ausleihung.get('User') == current_user_id
+    ):
         return {'ausleihung': ausleihung, 'status': 'success'}
     
     item = it.get_item(id)
@@ -8115,7 +8134,7 @@ def plan_booking():
         try:
             for _, period, period_times in requested_slots:
                 booking_id = au.add_planned_booking(
-                    item_id, session['username'], period_times['start'],
+                    item_id, session.get('user_id') or str(us.get_user(session['username'])['_id']), period_times['start'],
                     period_times['end'], notes, period=period
                 )
                 if not booking_id:
@@ -8168,7 +8187,7 @@ def process_day_bookings(item_id, booking_date, periods, notes):
         # Create the booking
         booking_id = au.add_planned_booking(
             item_id,
-            session['username'],
+            session.get('user_id') or str(us.get_user(session['username'])['_id']),
             start_time,
             end_time,
             notes,
@@ -8235,7 +8254,7 @@ def add_booking():
         # Continue with adding the booking
         booking_id = au.add_planned_booking(
             item_id=item_id,
-            user=session['username'],
+            user_id=session.get('user_id') or str(us.get_user(session['username'])['_id']),
             start_date=start_date,
             end_date=end_date,
             notes=notes,
@@ -8266,8 +8285,10 @@ def cancel_booking(id):
     current_permissions = us.get_effective_permissions(session['username'])
     
     # Check if user owns this booking
-    booking_user = au.dp.decrypt_text(booking.get('User')) if booking.get('User') else ''
-    if booking_user != session['username'] and not current_permissions['actions'].get('can_manage_users', False):
+    current_user = us.get_user(session['username'])
+    current_user_id = str(current_user['_id']) if current_user and current_user.get('_id') else ''
+    booking_user_id = str(booking.get('User') or '')
+    if booking_user_id != current_user_id and not current_permissions['actions'].get('can_manage_users', False):
                return {"success": False, "error": "Not authorized to cancel this booking"}, 403
     
     # Cancel the booking
@@ -12199,7 +12220,7 @@ def schedule_appointment():
             # Use add_ausleihung directly to set the correct initial status
             appointment_id = au.add_ausleihung(
                 item_id=item_id,
-                user=session['username'],
+                user_id=session.get('user_id') or str(us.get_user(session['username'])['_id']),
                 start_date=start_datetime,
                 end_date=end_datetime,
                 notes=notes,

Web/modules/database/ausleihung.py

@@ -185,13 +185,13 @@ def create_backup_database():
 
 # === AUSLEIHUNG MANAGEMENT ===
 
-def add_ausleihung(item_id, user, start_date, end_date=None, notes="", status="active", period=None, exemplar_data=None, due_date=None):
+def add_ausleihung(item_id, user_id, start_date, end_date=None, notes="", status="active", period=None, exemplar_data=None, due_date=None):
     """
     Add a new borrowing record for an item.
     
     Args:
         item_id (str): ID of the item borrowed
-        user (str): Username of the borrower
+        user_id (str): ID of the borrower
         start_date (datetime): Start date and time of the borrowing
         end_date (datetime, optional): End date and time if already returned
         notes (str, optional): Additional notes about the borrowing
@@ -209,7 +209,7 @@ def add_ausleihung(item_id, user, start_date, end_date=None, notes="", status="a
 
         ausleihung = {
             'Item': item_id,
-            'User': dp.encrypt_text(user),
+            'User': str(user_id),
             'Start': start_date,
             'Status': status
         }
@@ -256,8 +256,7 @@ def update_ausleihung(id, item_id=None, user_id=None, start=None, end=None, note
         if item_id is not None:
             update_data['Item'] = item_id
         if user_id is not None:
-            # WICHTIG: Gleiche Verschlüsselung wie in add_ausleihung nutzen!
-            update_data['User'] = dp.encrypt_text(user_id) if hasattr(dp, 'encrypt_text') else user_id
+            update_data['User'] = str(user_id)
         if start is not None:
             update_data['Start'] = ensure_timezone_aware(start)
         if end is not None:
@@ -556,9 +555,7 @@ def get_ausleihung_by_user(user_id, status=None, use_client_side_verification=Tr
             db = client[cfg.MONGODB_DB]
             ausleihungen = db['ausleihungen']
 
-            # Ensure proper encrypted query string if user IDs are encrypted in DB
-            search_user = dp.encrypt_text(user_id) if hasattr(dp, 'encrypt_text') else user_id
-            query = {'User': search_user, 'Status': {'$ne': 'deleted'}}
+            query = {'User': str(user_id), 'Status': {'$ne': 'deleted'}}
 
             if not use_client_side_verification:
                 if status is not None:
@@ -864,8 +861,8 @@ def reset_item_completely(item_id):
 
 # === KOMPATIBILITÄTSFUNKTIONEN ===
 
-def add_planned_booking(item_id, user, start_date, end_date, notes="", period=None):
-    return add_ausleihung(item_id, user, start_date, end_date, notes, status='planned', period=period)
+def add_planned_booking(item_id, user_id, start_date, end_date, notes="", period=None):
+    return add_ausleihung(item_id, user_id, start_date, end_date, notes, status='planned', period=period)
 
 
 def check_booking_conflict(item_id, start_date, end_date, period=None):