changes to the right page permission check

.docker-build.env

@@ -1,11 +0,0 @@
-NUITKA_BUILD=0
-INVENTAR_HTTP_PORT=10000
-INVENTAR_HTTP_PORTS=10000
-INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:v0.7.42
-INVENTAR_APP_CPUS=1.0
-INVENTAR_APP_MEM_LIMIT=384m
-INVENTAR_APP_MEM_SWAP_LIMIT=768m
-INVENTAR_WORKERS=4
-INVENTAR_THREADS=2
-INVENTAR_WORKER_TIMEOUT=30
-INVENTAR_WORKER_CONNECTIONS=100

.github/workflows/release-docker.yml

@@ -1,4 +1,4 @@
-name: https://github.com/AIIrondev/legendary-octo-garbanzo
+name: Release Inventarsystem
 
 on:
   push:
@@ -25,6 +25,7 @@ env:
 
 jobs:
   release-docker:
+    # Hinweis: Falls dein lokaler Gitea-Runner ein anderes Label hat (z.B. 'linux' oder 'self-hosted'), passe dies hier an.
     runs-on: ubuntu-latest
 
     steps:
@@ -34,18 +35,20 @@ jobs:
       - name: Set metadata
         id: meta
         env:
+          # Gitea stellt das GITHUB_TOKEN für Kompatibilität mit GitHub Actions automatisch zur Verfügung
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          EVENT_NAME: ${{ github.event_name }}
-          REF_NAME: ${{ github.ref_name }}
-          BUMP_TYPE: ${{ github.event.inputs.bump || 'patch' }}
+          REPO: ${{ gitea.repository }}
+          EVENT_NAME: ${{ gitea.event_name }}
+          REF_NAME: ${{ gitea.ref_name }}
+          BUMP_TYPE: ${{ gitea.event.inputs.bump || 'patch' }}
+          DOCKER_API_VERSION: '1.44'
         run: |
           if [ "$EVENT_NAME" = "push" ] && [ -n "$REF_NAME" ]; then
             TAG="$REF_NAME"
           else
-            # Fetch latest release tag via GitHub API (fall back to v0.8.31)
+            # Gitea API Endpunkt nutzen, um das aktuellste Release abzufragen
             latest_tag="v0.8.31"
-            if meta_json=$(curl -fsSL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "https://api.github.com/repos/$REPO/releases/latest" 2>/dev/null); then
+            if meta_json=$(curl -fsSL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/json" "https://git.invario-software.eu/api/v1/repos/$REPO/releases/latest" 2>/dev/null); then
               tag_name=$(printf "%s" "$meta_json" | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
               if [ -n "$tag_name" ]; then
                 latest_tag="$tag_name"
@@ -108,19 +111,70 @@ jobs:
             TAG="${base}.${i}"
           fi
 
-          IMAGE="ghcr.io/aiirondev/legendary-octo-garbanzo:${TAG}"
+          # Docker Images verlangen Kleinbuchstaben. Repository-Namen daher umwandeln.
+          LOWER_REPO=$(echo "$REPO" | tr '[:upper:]' '[:lower:]')
+          IMAGE="git.invario-software.eu/${LOWER_REPO}:${TAG}"
+          
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "image=$IMAGE" >> "$GITHUB_OUTPUT"
+          echo "lower_repo=$LOWER_REPO" >> "$GITHUB_OUTPUT"
+        
+      - name: Ensure Docker CLI is available and up to date
+        run: |
+          install_docker=true
+          
+          # Prüfen, ob Docker existiert und ob die Version ausreicht
+          if command -v docker >/dev/null 2>&1; then
+            # Extrahiere die Major-Version
+            DOCKER_MAJOR=$(docker --version | grep -oE '[0-9]+' | head -n1)
+            
+            # API 1.44 erfordert mindestens Docker v25
+            if [ -n "$DOCKER_MAJOR" ] && [ "$DOCKER_MAJOR" -ge 25 ]; then
+              install_docker=false
+            fi
+          fi
+
+          if [ "$install_docker" = true ]; then
+            echo "Veraltete oder fehlende Docker-Installation erkannt. Lade statische Docker CLI herunter..."
+            
+            DOCKER_VERSION="26.1.4"
+            
+            # Download der statischen Binaries via curl oder wget (umgeht apt-get komplett)
+            if command -v curl >/dev/null 2>&1; then
+              curl -fsSLO "https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}.tgz"
+            else
+              wget -q "https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}.tgz"
+            fi
+            
+            tar -xzf docker-${DOCKER_VERSION}.tgz
+            
+            # Installation in lokalen Benutzer-Pfad, um sudo/root-Rechte-Probleme zu vermeiden
+            mkdir -p "$HOME/.local/bin"
+            cp docker/docker "$HOME/.local/bin/"
+            
+            # Pfad für nachfolgende GitHub Actions Schritte verfügbar machen
+            echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+            
+            # Pfad für diesen spezifischen Shell-Run exportieren
+            export PATH="$HOME/.local/bin:$PATH"
+            
+            rm -rf docker docker-${DOCKER_VERSION}.tgz
+            echo "Docker CLI wurde erfolgreich aktualisiert."
+          else
+            echo "Docker CLI ist bereits auf einem aktuellen Stand."
+          fi
+
+          docker --version
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Login to GHCR
+      - name: Login to Gitea Container Registry
         uses: docker/login-action@v3
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: git.invario-software.eu
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push release image
         uses: docker/build-push-action@v6
@@ -128,10 +182,9 @@ jobs:
           context: .
           file: ./Dockerfile
           push: true
-          load: true # Lädt das Image in den lokalen Docker-Daemon für den 'docker save' Schritt
           tags: |
             ${{ steps.meta.outputs.image }}
-            ghcr.io/aiirondev/legendary-octo-garbanzo:latest
+            git.invario-software.eu/${{ steps.meta.outputs.lower_repo }}:latest
 
       - name: Build local image tar for offline deploy
         run: |
@@ -139,20 +192,10 @@ jobs:
           IMG="${{ steps.meta.outputs.image }}"
           TAG="${{ steps.meta.outputs.tag }}"
 
-          if docker image inspect "$IMG" >/dev/null 2>&1; then
-            echo "Using local image $IMG"
-            docker save "$IMG" | gzip > "inventarsystem-image-${TAG}.tar.gz"
-            exit 0
-          fi
+          echo "Pulling freshly pushed image from registry: $IMG"
+          docker pull "$IMG"
 
-          echo "Local image $IMG not found, trying to pull"
-          if docker pull "$IMG" >/dev/null 2>&1; then
-            docker save "$IMG" | gzip > "inventarsystem-image-${TAG}.tar.gz"
-            exit 0
-          fi
-
-          echo "Pull failed, attempting local docker build as fallback"
-          docker build -t "$IMG" .
+          echo "Saving image to offline tar archive..."
           docker save "$IMG" | gzip > "inventarsystem-image-${TAG}.tar.gz"
 
       - name: Create release-only docker bundle
@@ -161,7 +204,7 @@ jobs:
           cat > release-bundle/docker-compose.yml <<EOF
           services:
             app:
-              image: \${INVENTAR_APP_IMAGE:-ghcr.io/aiirondev/legendary-octo-garbanzo:${{ steps.meta.outputs.tag }}}
+              image: \${INVENTAR_APP_IMAGE:-${{ steps.meta.outputs.image }}}
               container_name: inventarsystem-app
               restart: unless-stopped
               ports:
@@ -225,7 +268,7 @@ jobs:
           EOF
 
           # Copy runtime scripts and config if present
-          for f in start.sh stop.sh restart.sh backup.sh config.json update.sh; do
+          for f in start.sh stop.sh restart.sh backup.sh restore.sh config.json update.sh; do
             if [ -f "$f" ]; then
               cp "$f" "release-bundle/$(basename "$f")"
             fi
@@ -242,12 +285,10 @@ jobs:
           find release-bundle -maxdepth 1 -type f -name '*.sh' -exec chmod +x {} \; || true
           tar -czf inventarsystem-docker-bundle.tar.gz -C release-bundle .
 
-      - name: Create or update GitHub Release
-        uses: softprops/action-gh-release@v2
+      - name: Create or update Gitea Release
+        uses: https://gitea.com/actions/gitea-release-action@v1
         with:
           tag_name: ${{ steps.meta.outputs.tag }}
           files: |
             inventarsystem-docker-bundle.tar.gz
-            inventarsystem-image-${{ steps.meta.outputs.tag }}.tar.gz
-          fail_on_unmatched_files: false
-          generate_release_notes: true
+            inventarsystem-image-${{ steps.meta.outputs.tag }}.tar.gz

README.md

@@ -120,19 +120,19 @@ Das Inventarsystem stellt folgende Wartungsskripte bereit:
 **Option 1**
 
 ```bash
-wget -O - https://raw.githubusercontent.com/AIIrondev/legendary-octo-garbanzo/main/install.sh | sudo bash
+wget -O - https://git.invario-software.eu/Invario/Inventarsystem/raw/branch/main/install.sh | sudo bash
 ```
 
 **Option 2**
 
 ```bash
-curl -s https://raw.githubusercontent.com/AIIrondev/legendary-octo-garbanzo/main/install.sh | sudo bash
+curl -s https://git.invario-software.eu/Invario/Inventarsystem/raw/branch/main/install.sh | sudo bash
 ```
 
 Legacy-MongoDB uebernehmen und altes Host-System aufraeumen:
 
 ```bash
-curl -s https://raw.githubusercontent.com/AIIrondev/legendary-octo-garbanzo/main/install.sh | \
+curl -s https://git.invario-software.eu/Invario/Inventarsystem/raw/branch/main/install.sh | \
   sudo bash -s -- --migrate-legacy-db --remove-legacy-system
 ```
 

Web/app.py

@@ -289,7 +289,7 @@ SCHEDULER_INTERVAL = cfg.SCHEDULER_INTERVAL_MIN
 SSL_CERT = cfg.SSL_CERT
 SSL_KEY = cfg.SSL_KEY
 
-LIBRARY_ITEM_TYPES = ('book', 'cd', 'dvd', 'other', 'schoolbook', 'Buch', 'Schulbuch', 'schulbuch')
+LIBRARY_ITEM_TYPES = ('book', 'cd', 'dvd', 'schoolbook', 'Buch', 'Schulbuch', 'schulbuch')
 INVOICE_CURRENCY = 'EUR'
 
 NOTIFICATION_STATUS_CACHE_TTL = max(3, int(os.getenv('INVENTAR_NOTIFICATION_STATUS_CACHE_TTL', '8')))
@@ -1258,7 +1258,9 @@ def inject_version():
         try:
             client = MongoClient(MONGODB_HOST, MONGODB_PORT)
             db = client[MONGODB_DB]
-            unread_notification_count = _get_unread_notification_count(db, session['username'], is_admin=is_admin)
+            # Pass the computed permission instead of the strict is_admin boolean
+            can_manage = current_permissions.get('actions', {}).get('can_manage_settings', False)
+            unread_notification_count = _get_unread_notification_count(db, session['username'], is_admin=(is_admin or can_manage))
         except Exception:
             unread_notification_count = 0
         finally:
@@ -3066,15 +3068,22 @@ def library_loans_admin():
     if 'username' not in session:
         flash('Ihnen ist es nicht gestattet auf dieser Internetanwendung, die eben besuchte Adrrese zu nutzen, versuchen sie es erneut nach dem sie sich mit einem berechtigten Nutzer angemeldet haben!', 'error')
         return redirect(url_for('login'))
-    if not us.check_admin(session['username']):
+    
+    current_permissions = us.get_effective_permissions(session['username'])
+
+    if not current_permissions['pages'].get('library_loans_admin', False):
         flash('Ihnen ist es nicht gestattet auf dieser Internetanwendung, die eben besuchte Adrrese zu nutzen, versuchen sie es erneut nach dem sie sich mit einem berechtigten Nutzer angemeldet haben!', 'error')
-        return redirect(url_for('login'))
+        return redirect(url_for('library_view'))
+
     if not cfg.MODULES.is_enabled('library'):
         flash('Bibliotheks-Modul ist deaktiviert.', 'error')
-        return redirect(url_for('home_admin'))
+        return redirect(url_for('home'))
 
     _ensure_audit_indexes_once()
 
+    # IMPORT HINZUGEFÜGT: Entschlüsselungs-Tool importieren
+    from modules.inventarsystem.data_protection import decrypt_text
+
     def fmt_dt(dt):
         try:
             return dt.strftime('%d.%m.%Y %H:%M') if dt else ''
@@ -3121,6 +3130,9 @@ def library_loans_admin():
             item_has_damage = bool(item_doc.get('HasDamage')) or condition_value == 'destroyed' or bool(item_doc.get('DamageReports'))
             damage_reports = item_doc.get('DamageReports', []) or []
 
+            raw_user = record.get('User', '')
+            decrypted_user = decrypt_text(raw_user) if raw_user else ''
+
             loan_entries.append({
                 'id': str(record.get('_id')),
                 'item_id': item_id,
@@ -3128,7 +3140,7 @@ def library_loans_admin():
                 'item_code': item_doc.get('Code_4', ''),
                 'item_author': item_doc.get('Author', ''),
                 'item_isbn': item_doc.get('ISBN', ''),
-                'user': record.get('User', ''),
+                'user': decrypted_user, 
                 'status': record.get('Status', ''),
                 'start': fmt_dt(record.get('Start')),
                 'end': fmt_dt(record.get('End')),
@@ -3181,7 +3193,6 @@ def library_loans_admin():
         if client:
             client.close()
 
-
 @app.route('/api/library_items')
 def api_library_items():
     """
@@ -3212,7 +3223,7 @@ def api_library_items():
         ausleihungen_db = db['ausleihungen']
 
         query = {
-            'ItemType': {'$in': ['book', 'cd', 'dvd', 'other', 'schoolbook', 'schulbuch', 'Buch', 'Schulbuch']},
+            'ItemType': {'$in': ['book', 'cd', 'dvd', 'schoolbook', 'schulbuch', 'Buch', 'Schulbuch']},
             'IsGroupedSubItem': {'$ne': True},
             'Deleted': {'$ne': True}
         }
@@ -3338,7 +3349,7 @@ def api_library_items():
                 client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
                 db = client[cfg.MONGODB_DB]
                 student_cards = db['student_cards']
-                card = student_cards.find_one({'_id': ObjectId(borrow_id)})
+                card = student_cards.find_one({'_id': ObjectId(borrower)}) if borrower else None
                 card = _decrypt_student_card_doc(card)
                 client.close()
                 borrower = card['SchülerName']
@@ -5180,7 +5191,7 @@ def upload_item():
         item_type_input = sanitize_form_value(request.form.get('item_type_input', ''))
         library_category = sanitize_form_value(request.form.get('library_category', ''))
         
-        if library_caregory != '':
+        if library_category != '':
             item_is_library = True
 
         try:
@@ -7883,7 +7894,7 @@ def register():
                 page_permissions = {}
                 for endpoint_name, _ in PERMISSION_PAGE_OPTIONS:
                     page_permissions[endpoint_name] = request.form.get(f'page_{endpoint_name}') == 'on'
-
+                
             us.add_user(
                 username,
                 password,
@@ -8048,6 +8059,8 @@ def admin_borrowings():
 
     _ensure_audit_indexes_once()
 
+    from modules.inventarsystem.data_protection import decrypt_text
+
     client = MongoClient(MONGODB_HOST, MONGODB_PORT)
     db = client[MONGODB_DB]
     ausleihungen = db['ausleihungen']
@@ -8081,6 +8094,10 @@ def admin_borrowings():
             item_name = None
             item_cost = None
             has_damage = False
+
+        raw_user = r.get('User', '')
+        decrypted_user = decrypt_text(raw_user) if raw_user else ''
+
         entries.append({
             'id': str(r.get('_id')),
             'item_id': str(item_doc.get('_id')) if item_doc and item_doc.get('_id') else str(it_id or ''),
@@ -8088,7 +8105,7 @@ def admin_borrowings():
             'item_name': str(item_name or ''),
             'item_cost': fmt_money(item_cost),
             'item_cost_raw': item_cost if item_cost is not None else '',
-            'user': r.get('User', ''),
+            'user': decrypted_user,
             'status': r.get('Status', ''),
             'start': fmt_dt(r.get('Start')),
             'end': fmt_dt(r.get('End')),
@@ -8154,10 +8171,26 @@ def admin_audit_dashboard():
 
         # DEC_START: Decrypt the sensitive fields for display
         for row in audit_rows:
-            if "payload" in row:
-                # decrypt_document_fields acts in-place
-                decrypt_document_fields(row["payload"], SENSITIVE_AUDIT_FIELDS)
-        # DEC_END
+            payload_raw = row.get("payload")
+            
+            if payload_raw and isinstance(payload_raw, str):
+                try:
+                    # Safely evaluate the python-like dict string, providing context for ObjectId
+                    safe_context = {"ObjectId": ObjectId, "None": None, "True": True, "False": False}
+                    payload_dict = eval(payload_raw, {"__builtins__": {}}, safe_context)
+                    
+                    if isinstance(payload_dict, dict):
+                        # Decrypt the sensitive keys inside the extracted dictionary
+                        decrypt_document_fields(payload_dict, SENSITIVE_AUDIT_FIELDS)
+                        
+                        # Replace the raw string with the clean dictionary for the Jinja template
+                        row["payload"] = payload_dict
+                except Exception as parse_err:
+                    app.logger.error(f"Failed to parse audit payload string for index {row.get('chain_index')}: {parse_err}")
+            
+            elif payload_raw and isinstance(payload_raw, dict):
+                # Fallback in case some newer log rows are already stored as proper dictionaries
+                decrypt_document_fields(payload_raw, SENSITIVE_AUDIT_FIELDS)
 
         return render_template(
             'admin_audit.html',
@@ -8204,11 +8237,26 @@ def admin_audit_export_pdf_official():
 
         audit_rows = list(db['audit_log'].find({}).sort('chain_index', -1).limit(limit))
 
-        # DEC_START: Decrypt sensitive fields for the PDF report
         for row in audit_rows:
-            if "payload" in row:
-                decrypt_document_fields(row["payload"], SENSITIVE_AUDIT_FIELDS)
-        # DEC_END
+            payload_raw = row.get("payload")
+            
+            if payload_raw and isinstance(payload_raw, str):
+                try:
+                    # Safely evaluate the python-like dict string with custom token support
+                    safe_context = {"ObjectId": ObjectId, "None": None, "True": True, "False": False}
+                    payload_dict = eval(payload_raw, {"__builtins__": {}}, safe_context)
+                    
+                    if isinstance(payload_dict, dict):
+                        # Decrypt the dictionary fields in-place
+                        decrypt_document_fields(payload_dict, SENSITIVE_AUDIT_FIELDS)
+                        # Replace string with the clean dictionary so the PDF generator can read it
+                        row["payload"] = payload_dict
+                except Exception as parse_err:
+                    app.logger.error(f"Failed to parse audit payload string for PDF export at index {row.get('chain_index')}: {parse_err}")
+            
+            elif payload_raw and isinstance(payload_raw, dict):
+                # Fallback for standard dict payloads
+                decrypt_document_fields(payload_raw, SENSITIVE_AUDIT_FIELDS)
 
         # Get school information from settings or use defaults
         school_info = _get_school_info_for_export()
@@ -9239,6 +9287,10 @@ def logs():
         logs_collection = db['system_logs']
         extra_logs = list(logs_collection.find({'type': {'$in': ['damage_report', 'damage_repair']}}))
 
+        from modules.inventarsystem.data_protection import decrypt_text
+        from bson.objectid import ObjectId
+        
+
         for log_item in extra_logs:
             log_type = log_item.get('type', '')
             item_id = log_item.get('item_id')
@@ -9258,7 +9310,7 @@ def logs():
                 note = log_item.get('note', '')
                 formatted_items.append({
                     'Item': item_name,
-                    'User': log_item.get('user', 'Unknown User'),
+                    'User': decrypt_text(log_item.get('user', 'Unknown User')),
                     'Start': ts_display,
                     'End': '-',
                     'Duration': '-',
@@ -9272,7 +9324,7 @@ def logs():
                 resolved_count = log_item.get('resolved_count', 0)
                 formatted_items.append({
                     'Item': item_name,
-                    'User': log_item.get('user', 'Unknown User'),
+                    'User': decrypt_text(log_item.get('user', 'Unknown User')),
                     'Start': ts_display,
                     'End': '-',
                     'Duration': '-',
@@ -10366,91 +10418,53 @@ def notifications_unread_status():
             client.close()
 
 
-@app.route('/admin/damaged_items')
+@app.route('/admin/damaged_items') 
 def admin_damaged_items():
-    """Dedicated admin management window for damaged items."""
+    """Admin-Übersicht aller aktiven und vergangenen Ausleihen."""
     if 'username' not in session:
         flash('Administratorrechte erforderlich.', 'error')
         return redirect(url_for('login'))
 
-    '''
-    permissions = _get_current_user_permissions()
-    if not _action_access_allowed(permissions, 'can_manage_settings'):
-        flash('Sie haben keine Berechtigung, die Schulstammdaten zu ändern.', 'error')
-        if cfg.MODULES.is_enabled('library'):
-            return redirect(url_for('library_admin'))
-    '''
-            
+    from modules.inventarsystem.data_protection import decrypt_text
+    from bson.objectid import ObjectId
+
     client = None
     try:
         client = MongoClient(MONGODB_HOST, MONGODB_PORT)
         db = client[MONGODB_DB]
-        items_col = db['items']
         ausleihungen_col = db['ausleihungen']
+        items_col = db['items']
 
-        items = list(items_col.find(
-            {
-                'Deleted': {'$ne': True},
-                '$or': [
-                    {'HasDamage': True},
-                    {'Condition': 'destroyed'},
-                    {'DamageReports.0': {'$exists': True}},
-                ]
-            },
-            {
-                'Name': 1,
-                'Code_4': 1,
-                'ItemType': 1,
-                'Author': 1,
-                'ISBN': 1,
-                'Condition': 1,
-                'DamageReports': 1,
-                'DamageRepairs': 1,
-                'Verfuegbar': 1,
-                'User': 1,
-                'LastUpdated': 1,
-            }
-        ).sort('LastUpdated', -1))
+        ausleihungen = list(ausleihungen_col.find().sort('Start', -1))
 
-        damaged_rows = []
-        for item_doc in items:
-            item_id = str(item_doc.get('_id'))
-            active_borrow = ausleihungen_col.find_one(
-                {'Item': item_id, 'Status': {'$in': ['active', 'planned']}},
-                {'_id': 1, 'User': 1, 'Status': 1, 'End': 1}
-            )
-            reports = item_doc.get('DamageReports', []) or []
-            latest_report = reports[0] if reports else {}
+        for record in ausleihungen:
+            raw_user = record.get('User', '')
+            if raw_user:
+                record['User'] = decrypt_text(raw_user)
 
-            damaged_rows.append({
-                'id': item_id,
-                'name': item_doc.get('Name', ''),
-                'code': item_doc.get('Code_4', ''),
-                'item_type': item_doc.get('ItemType', ''),
-                'author': item_doc.get('Author', ''),
-                'isbn': item_doc.get('ISBN', ''),
-                'condition': item_doc.get('Condition', ''),
-                'available': bool(item_doc.get('Verfuegbar', False)),
-                'borrow_user': item_doc.get('User', ''),
-                'damage_count': len(reports),
-                'damage_reports': reports,
-                'latest_damage_description': latest_report.get('description', ''),
-                'latest_damage_by': latest_report.get('reported_by', ''),
-                'latest_damage_at': latest_report.get('reported_at'),
-                'active_borrow': active_borrow,
-                'last_updated': item_doc.get('LastUpdated'),
-            })
+            item_id = record.get('Item')
+            if item_id:
+                try:
+                    item_doc = items_col.find_one({'_id': ObjectId(item_id)})
+                    if item_doc:
+                        if item_doc.get('User'):
+                            item_doc['User'] = decrypt_text(item_doc['User'])
+                        
+                        record['ItemDetails'] = item_doc
+                except Exception as e:
+                    app.logger.warning(f"Konnte Item {item_id} für Ausleihe {record.get('_id')} nicht laden: {e}")
 
         return render_template(
-            'admin_damaged_items.html',
-            damaged_items=damaged_rows,
+            'admin_damaged_items.html',  
+            ausleihungen=ausleihungen,
             library_module_enabled=cfg.MODULES.is_enabled('library'),
             student_cards_module_enabled=cfg.MODULES.is_enabled('student_cards'),
             mail_module_enabled=cfg.MODULES.is_enabled('mail')
         )
+
     except Exception as exc:
-        app.logger.error(f"Error loading damaged-items admin view: {exc}")
-        flash('Fehler beim Laden der Defekte-Items-Verwaltung.', 'error')
+        app.logger.error(f"Fehler beim Laden der Ausleihen-Verwaltung: {exc}")
+        flash('Fehler beim Laden der Ausleihen-Übersicht.', 'error')
         return redirect(url_for('home_admin'))
     finally:
         if client:

Web/modules/database/user.py

@@ -323,7 +323,8 @@ def get_effective_permissions(username):
     if bool(user.get('Admin', False)):
         return build_default_permission_payload('full_access')
 
-    preset_key = user.get('PermissionPreset') or 'standard_user'
+    preset_key = user.get('PermissionPreset')
+    print(preset_key)
     payload = build_default_permission_payload(preset_key)
     payload['actions'] = _normalize_bool_map(user.get('ActionPermissions', {}), payload['actions'])
     payload['pages'] = _normalize_bool_map(user.get('PagePermissions', {}), payload['pages'])
@@ -552,10 +553,15 @@ def add_user(
             for key, value in page_permissions.items():
                 permission_defaults['pages'][str(key)] = bool(value)
 
+        if permission_preset == "full_access":
+            can_admin_preset_based = True 
+        else:
+            can_admin_preset_based = False
+        
         user_doc = {
             'Username': username,
             'Password': hashing(password),
-            'Admin': False,
+            'Admin': can_admin_preset_based,
             'active_ausleihung': None,
             'name': name.strip() if name else '',
             'last_name': last_name.strip() if last_name else '',

Web/templates/base.html

@@ -1130,7 +1130,7 @@
                         <li class="nav-item" data-nav-fixed="true">
                             <a class="nav-link {% if current_path == url_for('terminplan') %}nav-active{% endif %}" href="{{ url_for('terminplan') }}" data-tutorial-tip="Hier sehen Sie den Kalender mit den bestehenden Terminen.">Kalender</a>
                         </li>
-                        {% if current_permissions.pages.get('terminplan', True) and current_permissions.actions.get('can_insert', True) %}
+                        {% if current_permissions.pages.get('terminplan', False) and current_permissions.actions.get('can_insert', False) %}
                         <li class="nav-item">
                             <a class="nav-link quick-link-pill {% if current_path == url_for('terminplaner.configure') %}nav-active{% endif %}" href="{{ url_for('terminplaner.configure') }}" data-tutorial-tip="Neuen Terminplan erstellen und an Ihr Team versenden.">Neue Planung</a>
                         </li>
@@ -1145,20 +1145,22 @@
                             <a class="nav-link dropdown-toggle" href="#" id="termMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false" title="Weitere Optionen">Mehr Optionen</a>
                             <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="termMoreDropdown">
                                 {% if 'username' in session %}
-                                {% if current_permissions.pages.get('tutorial_page', True) %}
+                                {% if current_permissions.pages.get('tutorial_page', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('tutorial_page') }}">Tutorial</a></li>
                                 {% endif %}
+                                {% if current_permissions.pages.get('admin_school_settings', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_school_settings') }}">Schulstammdaten</a></li>
-                                {% if current_permissions.actions.get('can_view_logs', True) and current_permissions.pages.get('admin_audit_dashboard', True) %}
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_view_logs', False) or current_permissions.pages.get('admin_audit_dashboard', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_audit_dashboard') }}">Audit Dashboard</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
                                 {% endif %}
                                 
-                                {% if current_permissions.pages.get('home', True) %}
+                                {% if current_permissions.pages.get('home', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('home') }}">Inventarsystem</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('library_view', True) and library_module_enabled %}
+                                {% if current_permissions.pages.get('library_view', False) and library_module_enabled %}
                                 <li><a class="dropdown-item" href="{{ url_for('library_view') }}">Bibliothek</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
@@ -1191,7 +1193,7 @@
                                     <span class="user-notification-dot {% if unread_notification_count and unread_notification_count > 0 %}visible{% endif %}" aria-hidden="true"></span>
                                 </button>
                                 <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invUserMenuDropdown">
-                                    {% if current_permissions.pages.get('notifications_view', True) %}
+                                    {% if current_permissions.pages.get('notifications_view', False) %}
                                     <li><a class="dropdown-item" href="{{ url_for('notifications_view') }}">Benachrichtigungen</a></li>
                                     {% endif %}
                                     <li><hr class="dropdown-divider"></li>
@@ -1214,13 +1216,13 @@
                 </button>
                 <div class="collapse navbar-collapse" id="inventoryNavContent">
                     <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="inventoryNavList">
-                        {% if current_permissions.pages.get('home', True) %}
+                        {% if current_permissions.pages.get('home', False) %}
                         <li class="nav-item" data-nav-fixed="true">
                             <a class="nav-link {% if current_path == url_for('home') %}nav-active{% endif %}" href="{{ url_for('home') }}" data-tutorial-tip="Starten Sie hier mit dem Materialbestand und suchen Sie nach Artikeln.">Artikel</a>
                         </li>
                         {% endif %}
                         {% if 'username' in session %}
-                        {% if current_permissions.pages.get('my_borrowed_items', True) %}
+                        {% if current_permissions.pages.get('my_borrowed_items', False) %}
                         <li class="nav-item">
                             <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}" data-tutorial-tip="Ihre aktuellen Ausleihen und Rückgaben finden Sie hier.">Meine Ausleihen</a>
                         </li>
@@ -1239,42 +1241,44 @@
                             </a>
                             <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invMoreDropdown">
                                 {% if 'username' in session %}
-                                {% if current_permissions.pages.get('tutorial_page', True) %}
+                                {% if current_permissions.pages.get('tutorial_page', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('tutorial_page') }}">Tutorial</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('upload_admin', True) and current_permissions.actions.get('can_insert', True) %}
+                                {% if current_permissions.pages.get('upload_admin', False) and current_permissions.actions.get('can_insert', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('upload_admin') }}">➕ Hochladen</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
                                 {% endif %}
-                                {% if 'username' in session and (session.get('admin', False) or is_admin) and current_permissions.actions.get('can_manage_settings', True) %}
+                                {% if 'username' in session and current_permissions.actions.get('can_manage_settings', False) %}
                                 <li><h6 class="dropdown-header">Verwaltung</h6></li>
-                                {% if current_permissions.pages.get('manage_filters', True) %}
+                                {% if current_permissions.pages.get('manage_filters', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('manage_filters') }}">Filter verwalten</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('manage_locations', True) %}
+                                {% if current_permissions.pages.get('manage_locations', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('manage_locations') }}">Orte verwalten</a></li>
                                 {% endif %}
+                                {% if current_permissions.pages.get('admin_school_settings', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_school_settings') }}">Schulstammdaten</a></li>
-                                {% if current_permissions.pages.get('admin_borrowings', True) %}
+                                {% endif %}
+                                {% if current_permissions.pages.get('admin_borrowings', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_borrowings') }}">Ausleihen</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('admin_damaged_items', True) %}
+                                {% if current_permissions.pages.get('admin_damaged_items', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_damaged_items') }}">Defekte Items</a></li>
                                 {% endif %}
-                                {% if current_permissions.actions.get('can_view_logs', True) and current_permissions.pages.get('admin_audit_dashboard', True) %}
+                                {% if current_permissions.actions.get('can_view_logs', False) and current_permissions.pages.get('admin_audit_dashboard', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_audit_dashboard') }}">Audit Dashboard</a></li>
                                 {% endif %}
-                                {% if current_permissions.actions.get('can_view_logs', True) and current_permissions.pages.get('logs', True) %}
+                                {% if current_permissions.actions.get('can_view_logs', False) and current_permissions.pages.get('logs', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('logs') }}">Logs</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
-                                {% if current_permissions.actions.get('can_manage_users', True) %}
+                                {% if current_permissions.actions.get('can_manage_users', False) %}
                                 <li><h6 class="dropdown-header">System</h6></li>
-                                {% if current_permissions.pages.get('user_del', True) %}
+                                {% if current_permissions.pages.get('user_del', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('user_del') }}">Benutzer verwalten</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('register', True) %}
+                                {% if current_permissions.pages.get('register', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('register') }}">Neuer Benutzer</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
@@ -1311,7 +1315,7 @@
                                     <span class="user-notification-dot {% if unread_notification_count and unread_notification_count > 0 %}visible{% endif %}" aria-hidden="true"></span>
                                 </button>
                                 <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invUserMenuDropdown">
-                                    {% if current_permissions.pages.get('notifications_view', True) %}
+                                    {% if current_permissions.pages.get('notifications_view', False) %}
                                     <li><a class="dropdown-item" href="{{ url_for('notifications_view') }}">Benachrichtigungen</a></li>
                                     {% endif %}
                                     <li><hr class="dropdown-divider"></li>
@@ -1336,19 +1340,19 @@
                 </button>
                 <div class="collapse navbar-collapse" id="libraryNavContent">
                     <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="libraryNavList">
-                        {% if current_permissions.pages.get('library_view', True) %}
+                        {% if current_permissions.pages.get('library_view', False) %}
                         <li class="nav-item" data-nav-fixed="true">
                             <a class="nav-link {% if current_path == url_for('library_view') %}nav-active{% endif %}" href="{{ url_for('library_view') }}" data-tutorial-tip="Die Bibliothek zeigt Ihnen alle Medien und verfügbaren Bücher.">Medien</a>
                         </li>
                         {% endif %}
                         {% if 'username' in session %}
-                        {% if current_permissions.pages.get('tutorial_page', True) %}
+                        {% if current_permissions.pages.get('tutorial_page', False) %}
                         <li class="nav-item">
                             <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}" data-tutorial-tip="Nutzen Sie das Tutorial, um die Bibliotheksfunktionen kennenzulernen.">Tutorial</a>
                         </li>
                         {% endif %}
                         {% endif %}
-                        {% if 'username' in session and current_permissions.actions.get('can_insert', True) and current_permissions.pages.get('library_admin', True) %}
+                        {% if 'username' in session and current_permissions.actions.get('can_insert', False) and current_permissions.pages.get('library_admin', False) %}
                         <li class="nav-item">
                             <a class="nav-link nav-priority-link {% if current_path == url_for('library_admin') %}nav-active{% endif %}" href="{{ url_for('library_admin') }}" data-tutorial-tip="Neue Bibliotheksmedien können hier aufgenommen werden.">📖 Hochladen</a>
                         </li>
@@ -1365,22 +1369,24 @@
                                 Mehr Optionen
                             </a>
                             <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="libMoreDropdown">
-                                {% if 'username' in session and (session.get('admin', False) or is_admin) and current_permissions.actions.get('can_manage_settings', True) %}
+                                {% if 'username' in session and current_permissions.actions.get('can_manage_settings', False) %}
                                 <li><h6 class="dropdown-header">Bibliotheks-Verwaltung</h6></li>
-                                {% if current_permissions.pages.get('library_loans_admin', True) %}
+                                {% if current_permissions.pages.get('library_loans_admin', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('library_loans_admin') }}">Ausleihen / Defekte Items</a></li>
                                 {% endif %}
                                 {% if student_cards_module_enabled %}
                                 <li><a class="dropdown-item" href="{{ url_for('student_cards_admin') }}">Bibliotheksausweis</a></li>
                                 {% endif %}
+                                {% if current_permissions.pages.get('admin_school_settings', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_school_settings') }}">Schulstammdaten</a></li>
+                                {% endif %}
                                 <li><hr class="dropdown-divider"></li>
-                                {% if current_permissions.actions.get('can_manage_users', True) %}
+                                {% if current_permissions.actions.get('can_manage_users', False) %}
                                 <li><h6 class="dropdown-header">System</h6></li>
-                                {% if current_permissions.pages.get('user_del', True) %}
+                                {% if current_permissions.pages.get('user_del', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('user_del') }}">Benutzer verwalten</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('register', True) %}
+                                {% if current_permissions.pages.get('register', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('register') }}">Neuer Benutzer</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
@@ -1414,7 +1420,7 @@
                                     <span class="user-notification-dot {% if unread_notification_count and unread_notification_count > 0 %}visible{% endif %}" aria-hidden="true"></span>
                                 </button>
                                 <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="libUserMenuDropdown">
-                                    {% if current_permissions.pages.get('notifications_view', True) %}
+                                    {% if current_permissions.pages.get('notifications_view', False) %}
                                     <li><a class="dropdown-item" href="{{ url_for('notifications_view') }}">Benachrichtigungen</a></li>
                                     {% endif %}
                                     <li><hr class="dropdown-divider"></li>
@@ -1642,30 +1648,79 @@
     </div>
 
     <datalist id="function-search-options">
+        {% if current_permissions.pages.get('home', False) %}
         <option value="Artikel"></option>
-        <option value="Meine Ausleihen"></option>
-        <option value="Benachrichtigungen"></option>
-        <option value="Tutorial"></option>
+        {% endif %}
+
+        {% if 'username' in session %}
+            {% if current_permissions.pages.get('my_borrowed_items', False) %}
+            <option value="Meine Ausleihen"></option>
+            {% endif %}
+            {% if current_permissions.pages.get('notifications_view', False) %}
+            <option value="Benachrichtigungen"></option>
+            {% endif %}
+            {% if current_permissions.pages.get('tutorial_page', False) %}
+            <option value="Tutorial"></option>
+            {% endif %}
+        {% endif %}
+
         <option value="Impressum"></option>
         <option value="Lizenz"></option>
+
         {% if library_module_enabled %}
-        <option value="Bibliothek"></option>
-        <option value="Meine Medien"></option>
-        {% endif %}
-        {% if 'username' in session and (session.get('admin', False) or is_admin) %}
-        <option value="Hochladen"></option>
-        <option value="Ausleihen Verwaltung"></option>
-        <option value="Defekte Items"></option>
-        <option value="Filter verwalten"></option>
-        <option value="Orte verwalten"></option>
-        <option value="Schulstammdaten"></option>
-        <option value="Audit Dashboard"></option>
-        <option value="Logs"></option>
-        <option value="Benutzer verwalten"></option>
-        <option value="Neuer Benutzer"></option>
-        {% if student_cards_module_enabled %}
-        <option value="Bibliotheksausweis"></option>
+            {% if current_permissions.pages.get('library_view', False) %}
+            <option value="Bibliothek"></option>
+            {% endif %}
+            {% if 'username' in session and current_permissions.pages.get('my_borrowed_items', False) %}
+            <option value="Meine Medien"></option>
+            {% endif %}
         {% endif %}
+
+        {% if 'username' in session %}
+            {% if current_permissions.pages.get('upload_admin', False) and current_permissions.actions.get('can_insert', False) %}
+            <option value="Hochladen"></option>
+            {% endif %}
+
+            {% if current_permissions.pages.get('admin_borrowings', False) or current_permissions.pages.get('library_loans_admin', False) %}
+            <option value="Ausleihen Verwaltung"></option>
+            {% endif %}
+
+            {% if current_permissions.pages.get('admin_damaged_items', False) or current_permissions.pages.get('library_loans_admin', False) %}
+            <option value="Defekte Items"></option>
+            {% endif %}
+
+            {% if current_permissions.pages.get('manage_filters', False) %}
+            <option value="Filter verwalten"></option>
+            {% endif %}
+
+            {% if current_permissions.pages.get('manage_locations', False) %}
+            <option value="Orte verwalten"></option>
+            {% endif %}
+
+            {% if current_permissions.pages.get('admin_school_settings', False) %}
+            <option value="Schulstammdaten"></option>
+            {% endif %}
+
+            {% if current_permissions.actions.get('can_view_logs', False) and current_permissions.pages.get('admin_audit_dashboard', False) %}
+            <option value="Audit Dashboard"></option>
+            {% endif %}
+
+            {% if current_permissions.actions.get('can_view_logs', False) and current_permissions.pages.get('logs', False) %}
+            <option value="Logs"></option>
+            {% endif %}
+
+            {% if current_permissions.actions.get('can_manage_users', False) %}
+                {% if current_permissions.pages.get('user_del', False) %}
+                <option value="Benutzer verwalten"></option>
+                {% endif %}
+                {% if current_permissions.pages.get('register', False) %}
+                <option value="Neuer Benutzer"></option>
+                {% endif %}
+            {% endif %}
+
+            {% if student_cards_module_enabled and current_permissions.pages.get('student_cards_admin', False) %}
+            <option value="Bibliotheksausweis"></option>
+            {% endif %}
         {% endif %}
     </datalist>
 
@@ -1713,32 +1768,80 @@
             const loginHintKey = username ? ('inventarsystem_notification_login_hint_v1_' + username) : null;
 
             const functionSearchEntries = [
+                {% if current_permissions.pages.get('home', False) %}
                 { label: 'Artikel', keywords: ['artikel', 'inventar', 'home'], url: {{ url_for('home')|tojson }} },
-                { label: 'Meine Ausleihen', keywords: ['meine ausleihen', 'ausleihen', 'borrowed'], url: {{ url_for('my_borrowed_items')|tojson }} },
-                { label: 'Benachrichtigungen', keywords: ['benachrichtigungen', 'nachrichten', 'notifications'], url: {{ url_for('notifications_view')|tojson }} },
-                { label: 'Tutorial', keywords: ['tutorial', 'hilfe', 'anleitung'], url: {{ url_for('tutorial_page')|tojson }} },
+                {% endif %}
+                    
+                {% if 'username' in session %}
+                    {% if current_permissions.pages.get('my_borrowed_items', False) %}
+                    { label: 'Meine Ausleihen', keywords: ['meine ausleihen', 'ausleihen', 'borrowed'], url: {{ url_for('my_borrowed_items')|tojson }} },
+                    {% endif %}
+                    {% if current_permissions.pages.get('notifications_view', False) %}
+                    { label: 'Benachrichtigungen', keywords: ['benachrichtigungen', 'nachrichten', 'notifications'], url: {{ url_for('notifications_view')|tojson }} },
+                    {% endif %}
+                    {% if current_permissions.pages.get('tutorial_page', False) %}
+                    { label: 'Tutorial', keywords: ['tutorial', 'hilfe', 'anleitung'], url: {{ url_for('tutorial_page')|tojson }} },
+                    {% endif %}
+                {% endif %}
+                    
                 { label: 'Impressum', keywords: ['impressum'], url: {{ url_for('impressum')|tojson }} },
                 { label: 'Lizenz', keywords: ['lizenz', 'license'], url: {{ url_for('license')|tojson }} },
+                    
                 {% if library_module_enabled %}
-                { label: 'Bibliothek', keywords: ['bibliothek', 'medien'], url: {{ url_for('library_view')|tojson }} },
-                {% endif %}
-                {% if 'username' in session and (session.get('admin', False) or is_admin) %}
-                { label: 'Hochladen', keywords: ['hochladen', 'upload'], url: {{ url_for('upload_admin')|tojson }} },
-                { label: 'Ausleihen Verwaltung', keywords: ['ausleihen verwaltung', 'admin borrowings'], url: {{ url_for('admin_borrowings')|tojson }} },
-                { label: 'Defekte Items', keywords: ['defekte items', 'defekt', 'schaden'], url: {{ url_for('admin_damaged_items')|tojson }} },
-                { label: 'Filter verwalten', keywords: ['filter verwalten', 'filter'], url: {{ url_for('manage_filters')|tojson }} },
-                { label: 'Orte verwalten', keywords: ['orte verwalten', 'orte', 'location'], url: {{ url_for('manage_locations')|tojson }} },
-                { label: 'Schulstammdaten', keywords: ['schule', 'settings', 'stammdaten', 'school settings'], url: {{ url_for('admin_school_settings')|tojson }} },
-                { label: 'Audit Dashboard', keywords: ['audit', 'audit dashboard'], url: {{ url_for('admin_audit_dashboard')|tojson }} },
-                { label: 'Logs', keywords: ['logs', 'protokoll'], url: {{ url_for('logs')|tojson }} },
-                { label: 'Benutzer verwalten', keywords: ['benutzer verwalten', 'user'], url: {{ url_for('user_del')|tojson }} },
-                { label: 'Neuer Benutzer', keywords: ['neuer benutzer', 'register'], url: {{ url_for('register')|tojson }} },
-                {% if library_module_enabled %}
-                { label: 'Bibliotheks-Ausleihen', keywords: ['bibliotheks ausleihen', 'library loans'], url: {{ url_for('library_loans_admin')|tojson }} },
-                {% endif %}
-                {% if student_cards_module_enabled %}
-                { label: 'Bibliotheksausweis', keywords: ['bibliotheksausweis', 'student card'], url: {{ url_for('student_cards_admin')|tojson }} },
+                    {% if current_permissions.pages.get('library_view', False) %}
+                    { label: 'Bibliothek', keywords: ['bibliothek', 'medien'], url: {{ url_for('library_view')|tojson }} },
+                    {% endif %}
                 {% endif %}
+                    
+                {% if 'username' in session %}
+                    {% if current_permissions.pages.get('upload_admin', False) and current_permissions.actions.get('can_insert', False) %}
+                    { label: 'Hochladen', keywords: ['hochladen', 'upload'], url: {{ url_for('upload_admin')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.pages.get('admin_borrowings', False) %}
+                    { label: 'Ausleihen Verwaltung', keywords: ['ausleihen verwaltung', 'admin borrowings'], url: {{ url_for('admin_borrowings')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.pages.get('admin_damaged_items', False) %}
+                    { label: 'Defekte Items', keywords: ['defekte items', 'defekt', 'schaden'], url: {{ url_for('admin_damaged_items')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.pages.get('manage_filters', False) %}
+                    { label: 'Filter verwalten', keywords: ['filter verwalten', 'filter'], url: {{ url_for('manage_filters')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.pages.get('manage_locations', False) %}
+                    { label: 'Orte verwalten', keywords: ['orte verwalten', 'orte', 'location'], url: {{ url_for('manage_locations')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.pages.get('admin_school_settings', False) %}
+                    { label: 'Schulstammdaten', keywords: ['schule', 'settings', 'stammdaten', 'school settings'], url: {{ url_for('admin_school_settings')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.actions.get('can_view_logs', False) and current_permissions.pages.get('admin_audit_dashboard', False) %}
+                    { label: 'Audit Dashboard', keywords: ['audit', 'audit dashboard'], url: {{ url_for('admin_audit_dashboard')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.actions.get('can_view_logs', False) and current_permissions.pages.get('logs', False) %}
+                    { label: 'Logs', keywords: ['logs', 'protokoll'], url: {{ url_for('logs')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.actions.get('can_manage_users', False) %}
+                        {% if current_permissions.pages.get('user_del', False) %}
+                        { label: 'Benutzer verwalten', keywords: ['benutzer verwalten', 'user'], url: {{ url_for('user_del')|tojson }} },
+                        {% endif %}
+                        {% if current_permissions.pages.get('register', False) %}
+                        { label: 'Neuer Benutzer', keywords: ['neuer benutzer', 'register'], url: {{ url_for('register')|tojson }} },
+                        {% endif %}
+                    {% endif %}
+                    
+                    {% if library_module_enabled and current_permissions.pages.get('library_loans_admin', False) %}
+                    { label: 'Bibliotheks-Ausleihen', keywords: ['bibliotheks ausleihen', 'library loans'], url: {{ url_for('library_loans_admin')|tojson }} },
+                    {% endif %}
+                    
+                    {% if student_cards_module_enabled and current_permissions.pages.get('student_cards_admin', False) %}
+                    { label: 'Bibliotheksausweis', keywords: ['bibliotheksausweis', 'student card'], url: {{ url_for('student_cards_admin')|tojson }} },
+                    {% endif %}
                 {% endif %}
             ];
 

Web/templates/impressum.html

@@ -22,7 +22,7 @@
                 <p><strong>Name:</strong> Invario UG</p>
                 <p><strong>Adresse:</strong> Am Sportplatz 10<br>83052 Bruckmühl<br>Deutschland</p>
             </address>
-            <p><strong>E-Mail:</strong> <a href="mailto:info@invario.eu">info@invario.eu</a></p>
+            <p><strong>E-Mail:</strong> <a href="mailto:info@invario-software.de">info@invario-software.de</a></p>
         </div>
 
         <div class="impressum-section mb-4">

Web/templates/library_table.html

@@ -4,7 +4,7 @@
 
 {% block content %}
 <style>
-    /* 1. The Dark Background Overlay */
+    /* The Dark Background Overlay */
     .modal {
         position: fixed;
         top: 0;
@@ -12,13 +12,13 @@
         width: 100vw;
         height: 100vh;
         background-color: rgba(0, 0, 0, 0.6);
-        /* Ensure display is controlled by JS, but set up for centering */
+        /* Display is managed by JS (none/flex) */
         align-items: center; 
         justify-content: center;
         z-index: 1000;
     }
-    
-    /* 2. The White Modal Box */
+
+    /* The White Modal Box */
     .modal-content {
         background-color: #fff;
         padding: 20px;
@@ -26,16 +26,16 @@
         max-width: 600px;
         border-radius: 8px;
         box-shadow: 0 4px 15px rgba(0, 0, 0, 0.2);
-        
-        /* These three lines are the magic for a fixed header + scrolling body */
+
+        /* Flexbox allows the header to stay fixed while the body scrolls */
         display: flex;
         flex-direction: column;
-        max-height: 85vh; /* Prevents the box from being taller than the screen */
+        max-height: 85vh;
     }
-    
-    /* 3. The Close Button */
+
+    /* The Close Button */
     .close {
-        align-self: flex-end; /* Pushes the 'x' to the right side */
+        align-self: flex-end;
         color: #aaa;
         font-size: 28px;
         font-weight: bold;
@@ -43,19 +43,18 @@
         line-height: 1;
         margin-bottom: 10px;
     }
-    
+
     .close:hover,
     .close:focus {
         color: #000;
         text-decoration: none;
     }
-    
-    /* 4. The Scrollable Content Area */
-    #detailContent {
-        overflow-y: auto; /* Adds the scrollbar ONLY if the text is too long */
-        padding-right: 10px; /* Optional: adds a little breathing room for the scrollbar */
-    }
 
+    /* The Scrollable Content Area */
+    #detailContent {
+        overflow-y: auto; /* Adds scrollbar only if needed */
+        padding-right: 10px; /* Prevents text from rubbing against the scrollbar */
+    }
     /* Library table-only view styles */
     .library-table-container {
         max-width: 1400px;
@@ -470,7 +469,7 @@
     }
 </style>
 
-<div class="library-table-container" id="libraryTableContainer" data-can-edit="{{ 1 if is_admin else 0 }}">
+<div class="library-table-container" id="libraryTableContainer" data-can-edit="{{ 1 if current_permissions.actions.get('can_edit', False) else 0 }}">
     <!-- Header -->
     <div class="library-header">
         <h1>📚 Bibliothek</h1>
@@ -592,14 +591,14 @@
     </div>
 </div>
 
-<!-- Detail Modal -->
+<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.0.6/purify.min.js"></script>
+
 <div id="detailModal" class="modal" style="display: none;">
     <div class="modal-content">
         <span class="close" onclick="closeDetailModal()">&times;</span>
         <div id="detailContent"></div>
     </div>
 </div>
-
 <script src="https://cdn.jsdelivr.net/npm/@ericblade/quagga2/dist/quagga.js"></script>
 <script>
     // =========================================================================
@@ -1098,20 +1097,47 @@
         return div.innerHTML;
     }
 
+    // Opens the modal and fetches the data
     function showItemDetail(itemId) {
+        const detailContent = document.getElementById('detailContent');
+        const detailModal = document.getElementById('detailModal');
+
+        // 1. Show the loading state immediately
+        detailContent.innerHTML = '<p>Loading details...</p>';
+        detailModal.style.display = 'flex';
+
+        // 2. Fetch the data
         fetch(`/api/item_detail/${itemId}`)
-            .then(r => r.text())
-            .then(html => {
-                document.getElementById('detailContent').innerHTML = html;
-                document.getElementById('detailModal').style.display = 'flex';
+            .then(response => {
+                if (!response.ok) {
+                    throw new Error(`HTTP error! status: ${response.status}`);
+                }
+                return response.text();
             })
-            .catch(err => console.error('Error loading detail:', err));
+            .then(html => {
+                // 3. Clean the HTML and display it
+                detailContent.innerHTML = DOMPurify.sanitize(html);
+            })
+            .catch(err => {
+                console.error('Error loading detail:', err);
+                detailContent.innerHTML = '<p>Sorry, we could not load the item details. Please try again later.</p>';
+            });
     }
 
+    // Closes the modal via the 'x' button
     function closeDetailModal() {
         document.getElementById('detailModal').style.display = 'none';
     }
 
+    // Closes the modal if the user clicks the dark background overlay
+    window.onclick = function(event) {
+        const modal = document.getElementById('detailModal');
+        // If the click happened directly on the dark overlay (not the white box)
+        if (event.target === modal) {
+            closeDetailModal();
+        }
+    };
+
     // =========================================================================
     // 5. EVENT LISTENERS INITIALIZATION & ON-LOAD INITIALIZER
     // =========================================================================

Web/templates/license.html

@@ -122,7 +122,7 @@
             <h3>Meldung von Sicherheitslücken</h3>
             <div class="license-exception-notice">
                 <h3>⚠️ Responsible Disclosure</h3>
-                <p>Falls Sie eine Sicherheitslücke entdecken, wenden sie sich umgehend an die Email: info@invario.eu .
+                <p>Falls Sie eine Sicherheitslücke entdecken, wenden sie sich umgehend an die Email: info@invario-software.de .
             </div>
         </div>
         </div><!-- /#pane-security -->

backup.sh

@@ -3,7 +3,12 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 COMPOSE_FILE="docker-compose-multitenant.yml"
+
+# Directories
 INVOICE_ARCHIVE_DIR="${INVOICE_ARCHIVE_DIR:-/var/backups/invoice-archive}"
+FULL_BACKUP_DIR="${FULL_BACKUP_DIR:-/var/backups/inventarsystem}"
+LOG_DIR="$SCRIPT_DIR/logs"
+
 KEEP_DAYS="${INVOICE_KEEP_DAYS:-3650}"
 MODE="auto"
 BASE_NAME=""
@@ -14,9 +19,7 @@ Usage: $0 [options]
 
 Options:
   --invoice-archive-dir DIR   Directory for invoice archive files
-                              (default: $INVOICE_ARCHIVE_DIR)
-  --invoice-keep-days N       Remove archived invoice files older than N days
-                              (default: $KEEP_DAYS)
+  --invoice-keep-days N       Remove archived files older than N days
   --mode auto|docker|host     Backup mode (default: auto)
   --base-name NAME            Base filename prefix for archive files
   -h, --help                  Show this help message
@@ -26,127 +29,78 @@ EOF
 parse_args() {
     while [[ $# -gt 0 ]]; do
         case "$1" in
-            --invoice-archive-dir)
-                INVOICE_ARCHIVE_DIR="$2"
-                shift 2
-                ;;
-            --invoice-keep-days)
-                KEEP_DAYS="$2"
-                shift 2
-                ;;
-            --mode)
-                MODE="$2"
-                shift 2
-                ;;
-            --base-name)
-                BASE_NAME="$2"
-                shift 2
-                ;;
-            -h|--help)
-                usage
-                exit 0
-                ;;
-            *)
-                echo "Error: unknown option '$1'" >&2
-                usage
-                exit 2
-                ;;
+            --invoice-archive-dir) INVOICE_ARCHIVE_DIR="$2"; shift 2 ;;
+            --invoice-keep-days) KEEP_DAYS="$2"; shift 2 ;;
+            --mode) MODE="$2"; shift 2 ;;
+            --base-name) BASE_NAME="$2"; shift 2 ;;
+            -h|--help) usage; exit 0 ;;
+            *) echo "Error: unknown option '$1'" >&2; usage; exit 2 ;;
         esac
     done
 }
 
 ensure_directory() {
     mkdir -p "$INVOICE_ARCHIVE_DIR"
+    mkdir -p "$FULL_BACKUP_DIR"
 }
 
 cleanup_old_archives() {
     if [[ -n "$KEEP_DAYS" ]]; then
-        find "$INVOICE_ARCHIVE_DIR" -maxdepth 1 -type f \( -name 'invoices-*.jsonl' -o -name 'invoices-*.csv' -o -name 'invoices-*.meta.json' \) -mtime +"$KEEP_DAYS" -print -delete || true
+        find "$INVOICE_ARCHIVE_DIR" -maxdepth 1 -type f -mtime +"$KEEP_DAYS" -print -delete 2>/dev/null || true
     fi
-}
-
-host_backup() {
-    if ! command -v python3 >/dev/null 2>&1; then
-        return 1
-    fi
-    if ! python3 -c 'import pymongo' >/dev/null 2>&1; then
-        return 1
-    fi
-
-    python3 "$SCRIPT_DIR/Web/backup_invoices.py" \
-        --archive-dir "$INVOICE_ARCHIVE_DIR" \
-        --base-name "$BASE_NAME"
+    # Cleanup old bundled backups (older than 30 days)
+    find "$FULL_BACKUP_DIR" -maxdepth 1 -type f -name "full_backup_*.tar.gz" -mtime +30 -print -delete 2>/dev/null || true
 }
 
 docker_backup() {
-    if ! command -v docker >/dev/null 2>&1; then
-        return 1
-    fi
-    if ! docker compose -f "$COMPOSE_FILE" ps -q app >/dev/null 2>&1; then
-        return 1
+    if ! command -v docker >/dev/null 2>&1; then return 1; fi
+    
+    local timestamp="$(date +'%Y-%m-%d_%H-%M-%S')"
+    local staging_dir="/tmp/backup_stage_$timestamp"
+    
+    echo "[$(date +'%T')] Starting unified system backup..."
+    mkdir -p "$staging_dir"
+
+    # 1. MongoDB Dump (into staging)
+    if docker compose -f "$COMPOSE_FILE" ps -q mongodb >/dev/null 2>&1; then
+        echo "[$(date +'%T')] Dumping Database..."
+        docker compose -f "$COMPOSE_FILE" exec -T mongodb mongodump --archive --gzip > "$staging_dir/db.archive.gz"
     fi
 
-    local app_container
-    app_container="$(docker compose -f "$COMPOSE_FILE" ps -q app | tr -d '[:space:]')"
-    if [[ -z "$app_container" ]]; then
-        return 1
+    # 2. Archive Assets (into staging)
+    if [ -d "./Web/uploads" ]; then
+        echo "[$(date +'%T')] Archiving assets..."
+        tar -czf "$staging_dir/assets.tar.gz" -C . Web/uploads Web/thumbnails Web/previews 2>/dev/null || true
     fi
 
-    local timestamp
-    timestamp="$(date +'%Y-%m-%d_%H-%M-%S')"
-    local output_dir
-    local remote_base
+    # 3. Archive Logs (into staging)
+    if [ -d "$LOG_DIR" ]; then
+        echo "[$(date +'%T')] Archiving logs..."
+        tar -czf "$staging_dir/logs.tar.gz" -C "$(dirname "$LOG_DIR")" "$(basename "$LOG_DIR")"
+    fi
 
-    output_dir="/tmp/invoice_archive_${timestamp}"
-    remote_base="${output_dir}/${BASE_NAME}"
-
-    docker compose -f "$COMPOSE_FILE" exec -T app mkdir -p "$output_dir"
-    docker compose -f "$COMPOSE_FILE" exec -T app python3 /app/Web/backup_invoices.py \
-        --archive-dir "$output_dir" \
-        --base-name "$BASE_NAME"
-
-    mkdir -p "$INVOICE_ARCHIVE_DIR"
-    docker cp "$app_container":"${remote_base}.jsonl" "$INVOICE_ARCHIVE_DIR/"
-    docker cp "$app_container":"${remote_base}.csv" "$INVOICE_ARCHIVE_DIR/"
-    docker cp "$app_container":"${remote_base}.meta.json" "$INVOICE_ARCHIVE_DIR/"
-
-    docker compose -f "$COMPOSE_FILE" exec -T app rm -rf "$output_dir"
+    # 4. Bundle everything into one file
+    echo "[$(date +'%T')] Bundling archive..."
+    tar -czf "$FULL_BACKUP_DIR/full_backup_$timestamp.tar.gz" -C "$staging_dir" .
+    
+    # 5. Cleanup staging
+    rm -rf "$staging_dir"
+    
+    echo "[$(date +'%T')] Backup complete: $FULL_BACKUP_DIR/full_backup_$timestamp.tar.gz"
+    return 0
 }
 
 main() {
-    if [[ -z "$BASE_NAME" ]]; then
-        BASE_NAME="invoices-$(date +'%Y-%m-%d_%H-%M-%S')"
-    fi
-
+    parse_args "$@"
     ensure_directory
 
     case "$MODE" in
-        auto)
+        auto|docker)
             if docker_backup; then
                 cleanup_old_archives
                 return 0
             fi
-            if host_backup; then
-                cleanup_old_archives
-                return 0
-            fi
-            echo "Error: could not perform invoice backup in auto mode. Docker or host Python with pymongo is required." >&2
-            return 1
-            ;;
-        docker)
-            if docker_backup; then
-                cleanup_old_archives
-                return 0
-            fi
-            echo "Error: docker backup failed or app container is unavailable." >&2
-            return 1
-            ;;
-        host)
-            if host_backup; then
-                cleanup_old_archives
-                return 0
-            fi
-            echo "Error: host backup failed. Ensure python3 and pymongo are installed." >&2
+            echo "Error: Docker backup failed." >&2
             return 1
             ;;
         *)
@@ -157,5 +111,4 @@ main() {
     esac
 }
 
-parse_args "$@"
-main
+main "$@"

config.json

@@ -27,7 +27,7 @@
         "username": "",
         "password": "",
         "from_address": "",
-        "default_sender_name": "Invario Inventurprogramm",
+        "default_sender_name": "Invario Inventarprogramm",
         "timeout_seconds": 30
     },
     "images": {

install.sh

@@ -8,8 +8,8 @@ else
     INSTALLER_DIR="$(pwd)"
 fi
 PROJECT_DIR="/opt/Inventarsystem"
-REPO_SLUG="AIIrondev/legendary-octo-garbanzo"
-API_URL="https://api.github.com/repos/$REPO_SLUG/releases/latest"
+REPO_SLUG="Invario/Inventarsystem"
+API_URL="https://git.invario-software.eu/api/v1/repos/$REPO_SLUG/releases/latest"
 BUNDLE_ASSET="inventarsystem-docker-bundle.tar.gz"
 APP_IMAGE_ASSET_PREFIX="inventarsystem-image-"
 LEGACY_DB_NAME="Inventarsystem"
@@ -39,7 +39,7 @@ need_cmd() {
 
 refresh_start_script_from_main() {
     local start_url
-    start_url="https://raw.githubusercontent.com/$REPO_SLUG/main/start.sh"
+    start_url="https://git.invario-software.eu/$REPO_SLUG/raw/branch/main/start.sh"
 
     if curl -fsSL "$start_url" -o "$TMP_DIR/start.sh"; then
         sudo install -m 755 "$TMP_DIR/start.sh" "$PROJECT_DIR/start.sh"
@@ -62,7 +62,7 @@ import re
 import sys
 
 compose_file, tag = sys.argv[1], sys.argv[2]
-target_image = f"ghcr.io/aiirondev/legendary-octo-garbanzo:{tag}"
+target_image = f"git.invario-software.eu/invario/inventarsystem:{tag}"
 
 with open(compose_file, "r", encoding="utf-8") as f:
     lines = f.readlines()
@@ -173,9 +173,9 @@ Usage: $0 [options]
 Options:
   --migrate-legacy-db           Back up host MongoDB and import into Docker MongoDB
   --remove-legacy-system        Remove old host MongoDB/system after successful import
-    --skip-cleanup-old            Do not run cleanup-old.sh after install
-    --cleanup-old-remove-cron     Also remove matching cron entries during old-system cleanup
-    --multitenant                Use docker-compose-multitenant.yml (default)
+  --skip-cleanup-old            Do not run cleanup-old.sh after install
+  --cleanup-old-remove-cron     Also remove matching cron entries during old-system cleanup
+  --multitenant                Use docker-compose-multitenant.yml (default)
   --legacy-db-name <name>       Legacy database name (default: $LEGACY_DB_NAME)
   --legacy-mongo-uri <uri>      Legacy Mongo URI (default: $LEGACY_MONGO_URI)
   --legacy-system-dir <path>    Optional old system directory to remove after migration
@@ -432,8 +432,9 @@ main() {
 
     curl -fL "$image_url" -o "$TMP_DIR/inventarsystem-image-$tag.tar.gz"
     sudo docker load -i "$TMP_DIR/inventarsystem-image-$tag.tar.gz" >/dev/null
-    # Compatibility alias: some legacy compose bundles may still reference :latest.
-    sudo docker tag "ghcr.io/aiirondev/legendary-octo-garbanzo:$tag" "ghcr.io/aiirondev/legendary-octo-garbanzo:latest" >/dev/null 2>&1 || true
+    
+    # Tagge das geladene Gitea-Image als latest
+    sudo docker tag "git.invario-software.eu/invario/inventarsystem:$tag" "git.invario-software.eu/invario/inventarsystem:latest" >/dev/null 2>&1 || true
 
     if [ ! -f "$PROJECT_DIR/start.sh" ]; then
         echo "Error: release bundle is missing start.sh"
@@ -470,19 +471,19 @@ EOF
 NUITKA_BUILD=0
 INVENTAR_HTTP_PORT=10000
 INVENTAR_HTTPS_PORT=10001
-INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:$tag
+INVENTAR_APP_IMAGE=git.invario-software.eu/invario/inventarsystem:$tag
 EOF
         sudo install -m 644 "$TMP_DIR/.docker-build.env" "$PROJECT_DIR/.docker-build.env"
     elif sudo grep -q '^INVENTAR_APP_IMAGE=' "$PROJECT_DIR/.docker-build.env"; then
-        sudo sed -i "s|^INVENTAR_APP_IMAGE=.*|INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:$tag|" "$PROJECT_DIR/.docker-build.env"
+        sudo sed -i "s|^INVENTAR_APP_IMAGE=.*|INVENTAR_APP_IMAGE=git.invario-software.eu/invario/inventarsystem:$tag|" "$PROJECT_DIR/.docker-build.env"
     else
-        echo "INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:$tag" | sudo tee -a "$PROJECT_DIR/.docker-build.env" >/dev/null
+        echo "INVENTAR_APP_IMAGE=git.invario-software.eu/invario/inventarsystem:$tag" | sudo tee -a "$PROJECT_DIR/.docker-build.env" >/dev/null
     fi
 
     backup_legacy_database
 
     echo "Starting stack..."
-    sudo env INVENTAR_APP_IMAGE="ghcr.io/aiirondev/legendary-octo-garbanzo:$tag" bash "$PROJECT_DIR/start.sh"
+    sudo env INVENTAR_APP_IMAGE="git.invario-software.eu/invario/inventarsystem:$tag" bash "$PROJECT_DIR/start.sh"
 
     restore_legacy_backup_into_docker
     cleanup_old_services
@@ -492,4 +493,4 @@ EOF
     echo "Open: https://localhost"
 }
 
-main "$@"
+main "$@"

restore.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BACKUP_DIR="/var/backups/inventarsystem"
+COMPOSE_FILE="docker-compose-multitenant.yml"
+
+# 1. Find the latest backup bundle
+LATEST_BACKUP=$(ls -t "$BACKUP_DIR"/full_backup_*.tar.gz | head -n1 2>/dev/null || true)
+
+if [[ -z "$LATEST_BACKUP" ]]; then
+    echo "Error: No backup bundle found in $BACKUP_DIR"
+    exit 1
+fi
+
+echo "--- RESTORE PROCEDURE ---"
+echo "Found latest bundle: $(basename "$LATEST_BACKUP")"
+read -p "WARNING: This will OVERWRITE your current database and assets! Continue? (y/N) " confirm
+[[ "$confirm" != "y" ]] && exit 1
+
+# 2. Extract the bundle to a temporary location
+RESTORE_TMP="/tmp/restore_$(date +%s)"
+mkdir -p "$RESTORE_TMP"
+echo "Extracting bundle..."
+tar -xzf "$LATEST_BACKUP" -C "$RESTORE_TMP"
+
+# 3. Stop application
+echo "Stopping application..."
+docker compose -f "$COMPOSE_FILE" stop app
+
+# 4. Restore Database
+if [ -f "$RESTORE_TMP/db.archive.gz" ]; then
+    echo "Restoring MongoDB..."
+    zcat "$RESTORE_TMP/db.archive.gz" | docker compose -f "$COMPOSE_FILE" exec -T mongodb mongorestore --archive --gzip --drop
+else
+    echo "Warning: Database archive not found in bundle."
+fi
+
+# 5. Restore Assets
+if [ -f "$RESTORE_TMP/assets.tar.gz" ]; then
+    echo "Restoring Assets (Uploads/Thumbnails/Previews)..."
+    tar -xzf "$RESTORE_TMP/assets.tar.gz" -C .
+else
+    echo "Warning: Asset archive not found in bundle."
+fi
+
+# 6. Restore Logs (Optional)
+if [ -f "$RESTORE_TMP/logs.tar.gz" ]; then
+    echo "Restoring Logs..."
+    tar -xzf "$RESTORE_TMP/logs.tar.gz" -C .
+fi
+
+# 7. Start application
+echo "Restarting application..."
+docker compose -f "$COMPOSE_FILE" start app
+
+# 8. Cleanup
+rm -rf "$RESTORE_TMP"
+echo "Restore complete!"

start.sh

@@ -5,7 +5,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$SCRIPT_DIR"
 
 ENV_FILE="$SCRIPT_DIR/.docker-build.env"
-APP_IMAGE_REPO="ghcr.io/aiirondev/legendary-octo-garbanzo"
+APP_IMAGE_REPO="git.invario-software.eu/invario/inventarsystem"
 DIST_DIR="$SCRIPT_DIR/dist"
 RUNTIME_COMPOSE_OVERRIDE_FILE="$SCRIPT_DIR/.docker-compose.runtime.override.yml"
 
@@ -676,4 +676,4 @@ fi
 verify_stack_health
 
 echo "Stack started."
-echo "Open: http://<server-ip>:$HTTP_PORT_VALUE"
+echo "Open: http://<server-ip>:$HTTP_PORT_VALUE"

update.sh

@@ -2,18 +2,18 @@
 set -euo pipefail
 
 # Release-only updater for Docker deployment.
-# Updates are pulled exclusively from GitHub Releases assets.
+# Updates are pulled exclusively from Gitea Releases assets.
 
 PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 LOG_DIR="$PROJECT_DIR/logs"
 LOG_FILE="$LOG_DIR/update.log"
 STATE_FILE="$PROJECT_DIR/.release-version"
-REPO_SLUG="AIIrondev/legendary-octo-garbanzo"
-API_URL="https://api.github.com/repos/$REPO_SLUG/releases/latest"
+REPO_SLUG="Invario/Inventarsystem"
+API_URL="https://git.invario-software.eu/api/v1/repos/$REPO_SLUG/releases/latest"
 BUNDLE_ASSET="inventarsystem-docker-bundle.tar.gz"
 APP_IMAGE_ASSET_PREFIX="inventarsystem-image-"
 ENV_FILE="$PROJECT_DIR/.docker-build.env"
-APP_IMAGE_REPO="ghcr.io/aiirondev/legendary-octo-garbanzo"
+APP_IMAGE_REPO="git.invario-software.eu/invario/inventarsystem"
 DIST_DIR="$PROJECT_DIR/dist"
 COMPOSE_FILE="docker-compose-multitenant.yml"
 MIN_ROOT_FREE_MB="${INVENTAR_MIN_ROOT_FREE_MB:-2048}"
@@ -153,7 +153,7 @@ Usage: $0 [options]
 
 Options:
   --multitenant      Use docker-compose-multitenant.yml (default)
-    development        Install development build from GHCR or local dist
+  development        Install development build from Gitea Registry or local dist
   -h, --help         Show this help message
 EOF
 }
@@ -204,14 +204,14 @@ create_backup() {
         fi
     fi
 
-    if [ -x "$PROJECT_DIR/run-backup.sh" ]; then
-        if "$PROJECT_DIR/run-backup.sh" >> "$LOG_FILE" 2>&1; then
+    if [ -x "$PROJECT_DIR/backup.sh" ]; then
+        if "$PROJECT_DIR/backup.sh" --mode auto >> "$LOG_FILE" 2>&1; then
             log_message "Backup completed"
         else
             log_message "WARNING: Backup failed; continuing with release update"
         fi
     else
-        log_message "WARNING: run-backup.sh not found; skipping backup"
+        log_message "WARNING: backup.sh not found; skipping backup"
     fi
 }
 
@@ -275,10 +275,10 @@ load_release_image() {
 
 refresh_runtime_scripts_from_main() {
     local start_url stop_url restart_url update_url
-    start_url="https://raw.githubusercontent.com/$REPO_SLUG/main/start.sh"
-    stop_url="https://raw.githubusercontent.com/$REPO_SLUG/main/stop.sh"
-    restart_url="https://raw.githubusercontent.com/$REPO_SLUG/main/restart.sh"
-    update_url="https://raw.githubusercontent.com/$REPO_SLUG/main/update.sh"
+    start_url="https://git.invario-software.eu/$REPO_SLUG/raw/branch/main/start.sh"
+    stop_url="https://git.invario-software.eu/$REPO_SLUG/raw/branch/main/stop.sh"
+    restart_url="https://git.invario-software.eu/$REPO_SLUG/raw/branch/main/restart.sh"
+    update_url="https://git.invario-software.eu/$REPO_SLUG/raw/branch/main/update.sh"
 
     curl -fsSL "$start_url" -o "$PROJECT_DIR/start.sh" || log_message "WARNING: Could not refresh start.sh from main"
     curl -fsSL "$stop_url" -o "$PROJECT_DIR/stop.sh" || log_message "WARNING: Could not refresh stop.sh from main"
@@ -357,7 +357,7 @@ download_and_extract_bundle() {
         cp -f "$tmp_dir/update.sh" "$PROJECT_DIR/update.sh"
     fi
 
-    # Neu: Multi-Tenant Ressourcen kopieren, falls vorhanden
+    # Multi-Tenant Ressourcen kopieren, falls vorhanden
     if [ -f "$tmp_dir/docker-compose-multitenant.yml" ]; then
         cp -f "$tmp_dir/docker-compose-multitenant.yml" "$PROJECT_DIR/docker-compose-multitenant.yml"
     fi
@@ -374,7 +374,7 @@ download_and_extract_bundle() {
     done
 
     # Ensure executable permissions on all copied scripts
-    chmod +x "$PROJECT_DIR/start.sh" "$PROJECT_DIR/stop.sh" "$PROJECT_DIR/restart.sh" "$PROJECT_DIR/update.sh" "$PROJECT_DIR/backup.sh" "$PROJECT_DIR/manage-tenant.sh" "$PROJECT_DIR/run-tenant-cmd.sh" 2>/dev/null || true 2>/dev/null || true
+    chmod +x "$PROJECT_DIR/start.sh" "$PROJECT_DIR/stop.sh" "$PROJECT_DIR/restart.sh" "$PROJECT_DIR/update.sh" "$PROJECT_DIR/backup.sh" "$PROJECT_DIR/manage-tenant.sh" "$PROJECT_DIR/run-tenant-cmd.sh" 2>/dev/null || true
     chmod +x "$PROJECT_DIR"/manage-tenant.sh "$PROJECT_DIR"/run-tenant-cmd.sh 2>/dev/null || true
 
     if [ ! -f "$PROJECT_DIR/config.json" ] && [ -f "$tmp_dir/config.json" ]; then
@@ -412,7 +412,7 @@ EOF
 
     if ! load_local_dist_image "$tag"; then
         if ! load_release_image "$meta_file" "$tag"; then
-            log_message "Falling back to tagged GHCR image $app_image"
+            log_message "Falling back to tagged Gitea Registry image $app_image"
             if ! docker pull "$app_image" >> "$LOG_FILE" 2>&1; then
                 log_message "Falling back to local Docker build for $app_image"
                 docker build -t "$app_image" "$PROJECT_DIR" >> "$LOG_FILE" 2>&1
@@ -511,7 +511,7 @@ EOF
             printf '\nINVENTAR_APP_IMAGE=%s\n' "$app_image" >> "$ENV_FILE"
         fi
 
-        # Try local dist first, then pull from GHCR
+        # Try local dist first, then pull from Gitea Registry
         if ! load_local_dist_image "$tag"; then
             log_message "Attempting to pull development image $app_image"
             if ! docker pull "$app_image" >> "$LOG_FILE" 2>&1; then
@@ -540,7 +540,7 @@ EOF
 
     trap 'rm -rf "${tmp_dir:-}"' EXIT
 
-    log_message "Checking latest GitHub release for $REPO_SLUG..."
+    log_message "Checking latest Gitea release for $REPO_SLUG..."
     if ! fetch_release_metadata "$meta_file"; then
         log_message "WARNING: Could not fetch release metadata. Falling back to self-healing start path."
         if INVENTAR_SETUP_CRON=0 bash "$PROJECT_DIR/start.sh" >> "$LOG_FILE" 2>&1; then
@@ -623,7 +623,7 @@ EOF
     log_message "Update completed successfully to release $latest_tag"
 
     sudo ./opt/Inventarsystem/restart.sh
-    echo "Restart of the Server Completet"
+    echo "Restart of the Server Completed"
 }
 
-main "$@"
+main "$@"