smal fix

Web/modules/database/ausleihung.py

@@ -1235,5 +1235,5 @@ def reset_item_completely(item_id):
     except Exception as e:
         return {
             'success': False,
-            'message': f'Fehler beim Zurücksetzen: {str(e)}'
+            'message': f'Fehler beim Zurücksetzen.'
         }

Web/modules/database/items.py

@@ -24,7 +24,7 @@ import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
 
 
-LIBRARY_ITEM_TYPES = ('book', 'cd', 'dvd', 'media')
+LIBRARY_ITEM_TYPES = ('book', 'cd', 'dvd', 'media', 'schulbuch')
 
 
 def _non_library_query(extra_query=None):
@@ -49,7 +49,7 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
              ansch_jahr=None, ansch_kost=None, code_4=None, reservierbar=True,
              series_group_id=None, series_count=1, series_position=1,
              is_grouped_sub_item=False, parent_item_id=None,
-             isbn=None, item_type='general'):
+             isbn=None, item_type='general', library_category=None):
     """
     Add a new item to the inventory.
     
@@ -70,6 +70,9 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
         series_position (int, optional): Position inside the batch (1-based)
         is_grouped_sub_item (bool, optional): Whether this item is hidden as sub-item
         parent_item_id (str, optional): Parent item id if this is a sub-item
+        isbn (str, optional): ISBN for books or media items
+        item_type (str, optional): Type of the item (e.g., 'general', 'book', 'cd')
+        library_category (str, optional): Library category for the item
         
     Returns:
         ObjectId: ID of the new item or None if failed
@@ -97,6 +100,7 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
             'Anschaffungskosten': ansch_kost,
             'Code_4': code_4,
             'ISBN': isbn,
+            'library_category': library_category,
             'ItemType': item_type,
             'SeriesGroupId': series_group_id,
             'SeriesCount': series_count,
@@ -196,7 +200,7 @@ def get_group_item_ids(id):
 
 def update_item(id, name, ort, beschreibung, images=None, verfuegbar=True, 
                 filter=None, filter2=None, filter3=None, ansch_jahr=None, ansch_kost=None, code_4=None, reservierbar=True,
-                isbn=None, item_type='general'):
+                isbn=None, item_type='general', library_category=None):
     """
     Update an existing inventory item.
     
@@ -214,7 +218,7 @@ def update_item(id, name, ort, beschreibung, images=None, verfuegbar=True,
         ansch_kost (float, optional): Cost of acquisition
         code_4 (str, optional): 4-digit identification code
         reservierbar (bool, optional): Whether the item can be reserved in advance
-        
+        library_category (str, optional): Library category for the item
     Returns:
         bool: True if successful, False otherwise
     """
@@ -241,6 +245,7 @@ def update_item(id, name, ort, beschreibung, images=None, verfuegbar=True,
             'Anschaffungskosten': ansch_kost,
             'Code_4': code_4,
             'ISBN': isbn,
+            'library_category': library_category,
             'ItemType': item_type,
             'LastUpdated': datetime.datetime.now()
         }

Web/modules/log/audit_log.py

@@ -10,6 +10,7 @@ import hashlib
 import json
 import random
 import time
+from Web.modules.inventarsystem.data_protection import encrypt_document_fields, decrypt_document_fields
 
 from pymongo.errors import DuplicateKeyError
 
@@ -24,21 +25,34 @@ def _entry_hash(prev_hash, payload):
     base = f"{prev_hash}|{_stable_json(payload)}"
     return hashlib.sha256(base.encode("utf-8")).hexdigest()
 
-
-def append_audit_event(db, event_type, actor, payload, request_ip=None, source="web", max_retries=5):
+def get_decrypted_audit_logs(db, query=None, decrypt_fields=None):
     """
-    Append an audit event to a tamper-evident chain.
-
+    Retrieve and decrypt audit logs for analysis.
+    
     Args:
-        db: MongoDB database handle.
-        event_type (str): Event category.
-        actor (str): User/system who performed the action.
-        payload (dict): Event details.
-        request_ip (str, optional): Request origin.
-        source (str): Source subsystem.
+        query (dict): MongoDB query filter.
+        decrypt_fields (list): Fields within the 'payload' that should be decrypted.
+    """
+    logs = db["audit_log"]
+    cursor = logs.find(query or {}).sort("chain_index", 1)
+    
+    results = []
+    for entry in cursor:
+        # Decrypt specific fields if provided
+        if decrypt_fields:
+            decrypt_document_fields(entry.get("payload", {}), decrypt_fields)
+        results.append(entry)
+        
+    return results
 
-    Returns:
-        dict: Inserted audit entry.
+
+def append_audit_event(db, event_type, actor, payload, request_ip=None, source="web", max_retries=5, encrypt_fields=None):
+    """
+    Append an audit event, optionally encrypting specific payload fields.
+    
+    Args:
+        ...
+        encrypt_fields (list, optional): List of keys in 'payload' to encrypt.
     """
     logs = db["audit_log"]
     attempts = 0
@@ -49,15 +63,24 @@ def append_audit_event(db, event_type, actor, payload, request_ip=None, source="
         chain_index = int(previous.get("chain_index", 0)) + 1 if previous else 1
 
         timestamp = datetime.datetime.utcnow()
+        
+        # 1. Create the payload dictionary
+        event_payload = payload or {}
+        
+        # 2. Encrypt sensitive fields in-place if requested
+        if encrypt_fields:
+            encrypt_document_fields(event_payload, encrypt_fields)
+
         entry_payload = {
             "event_type": event_type,
             "actor": actor or "system",
             "source": source,
             "ip": request_ip or "",
-            "payload": payload or {},
+            "payload": event_payload,
             "timestamp": timestamp.isoformat() + "Z",
         }
 
+        # 3. Hash the payload (which now contains encrypted values)
         entry_hash = _entry_hash(prev_hash, entry_payload)
 
         entry = {

Web/modules/log/ausleihung_log.py

@@ -21,7 +21,7 @@ def log_status_change(ausleihung_id, old_status, new_status, user=None):
         ausleihung_id: Die ID der Ausleihung
         old_status: Der alte Status
         new_status: Der neue Status
-        user: Der Benutzer, der die Änderung vorgenommen hat (optional)
+
     """
     try:
         # Erstelle Log-Verzeichnis, falls es nicht existiert
@@ -34,10 +34,9 @@ def log_status_change(ausleihung_id, old_status, new_status, user=None):
         
         # Protokolliere die Änderung
         timestamp = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
-        user_info = f" by {user}" if user else ""
         
         with open(log_file, 'a', encoding='utf-8') as f:
-            f.write(f"{timestamp}: Ausleihung {ausleihung_id} - Status changed from '{old_status}' to '{new_status}'{user_info}\n")
+            f.write(f"{timestamp}: Ausleihung {ausleihung_id} - Status changed from '{old_status}' to '{new_status}'\n")
             
         return True
     except Exception as e:

Web/modules/terminplaner/blueprint.py

@@ -215,7 +215,8 @@ def client(appointment_id):
                     current_user=session.get('username', ''),
                     tenant_id=_current_tenant_id(),
                     can_view_booking_names=can_view_booking_names,
-                    custom_fields=custom_fields 
+                    custom_fields=custom_fields,
+                    appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
                 )
 
             if appointment_service.book_slot(appointment_id, start_daytime, username, custom=custom_answers):
@@ -239,7 +240,8 @@ def client(appointment_id):
         tenant_id=_current_tenant_id(),
         can_view_booking_names=can_view_booking_names,
         custom_fields=custom_fields,
-        appointment_item=appointment_item
+        appointment_item=appointment_item,
+        appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
     )
 
 
@@ -356,6 +358,7 @@ def configure():
             add_to_calendar=add_to_calendar,
             email_service_enabled=cfg.EMAIL_ENABLED,
             title=title,
+            appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
         )
 
     return render_template(
@@ -366,6 +369,7 @@ def configure():
         add_to_calendar=False,
         email_service_enabled=cfg.EMAIL_ENABLED,
         title=None,
+        appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
     )
 
 
@@ -553,4 +557,5 @@ def main():
         current_user=current_user,
         upcoming_events=upcoming_events,
         tenant_id=tenant_id,
+        appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
     )

Web/push_notifications.py

@@ -13,6 +13,7 @@ import logging
 
 import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
+from Web.modules.inventarsystem.data_protection import encrypt_text, decrypt_text
 
 logger = logging.getLogger(__name__)
 
@@ -44,16 +45,22 @@ if not VAPID_PUBLIC_KEY or not VAPID_PRIVATE_KEY:
             serialization.PublicFormat.UncompressedPoint
         )
         
-        VAPID_PUBLIC_KEY = b64urlencode(raw_pub)
+        VAPID_PUBLIC_KEY = b64urlencode(raw_pub).decode('utf-8')
         VAPID_PRIVATE_KEY = VAPID_PRIVATE_PEM
     except Exception as e:
         logger.error(f'Could not load or generate VAPID keys: {e}')
 
 # Push service endpoint (typically Firebase or Web Push Service)
-PUSH_SERVICE_URL = 'https://fcm.googleapis.com/fcm/send'  # Firebase Cloud Messaging
 FCM_API_KEY = os.getenv('FCM_API_KEY', '')  # Firebase API key
 
 
+def _get_username_hash(username):
+    """Generates a deterministic hash for database lookups."""
+    if not username:
+        return None
+    return hashlib.sha256(username.encode('utf-8')).hexdigest()
+
+
 def get_push_subscriptions_collection(db=None):
     """Get MongoDB push subscriptions collection"""
     if db is None:
@@ -64,71 +71,68 @@ def get_push_subscriptions_collection(db=None):
 
 def get_user_subscriptions(username):
     """
-    Get all active push subscriptions for a user
-    
-    Args:
-        username (str): Username
-        
-    Returns:
-        list: List of subscription documents
+    Get all active push subscriptions for a user, decrypting data on the fly.
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         subs_col = get_push_subscriptions_collection(db)
         
-        subscriptions = list(subs_col.find({
-            'Username': username,
+        # Query using the deterministic hash, NOT the encrypted text directly
+        user_hash = _get_username_hash(username)
+        
+        encrypted_subscriptions = list(subs_col.find({
+            'UsernameHash': user_hash,
             'IsActive': True
         }))
         
         client.close()
-        return subscriptions
+        
+        # Decrypt endpoints and keys before returning
+        decrypted_subs = []
+        for sub in encrypted_subscriptions:
+            try:
+                sub['Endpoint'] = decrypt_text(sub.get('Endpoint'))
+                
+                # Keys are stored as encrypted JSON strings
+                decrypted_keys_str = decrypt_text(sub.get('Keys'))
+                sub['Keys'] = json.loads(decrypted_keys_str) if decrypted_keys_str else {}
+                
+                decrypted_subs.append(sub)
+            except Exception as e:
+                logger.error(f"Failed to decrypt subscription payload for hash {user_hash}: {e}")
+                
+        return decrypted_subs
     except Exception as e:
-        logger.error(f'Error getting push subscriptions for {username}: {e}')
+        logger.error(f'Error getting push subscriptions for user: {e}')
         return []
 
 
 def save_push_subscription(username, subscription_obj):
     """
-    Save a new push subscription for a user
-    
-    Args:
-        username (str): Username
-        subscription_obj (dict): Subscription object from Service Worker
-        {
-            'endpoint': 'https://...',
-            'keys': {
-                'p256dh': '...',
-                'auth': '...'
-            }
-        }
-        
-    Returns:
-        bool: Success status
+    Save a new push subscription for a user with field-level encryption.
     """
     try:
-        if not subscription_obj.get('endpoint'):
-            logger.warning(f'Invalid subscription object for {username}')
+        endpoint = subscription_obj.get('endpoint')
+        if not endpoint:
+            logger.warning('Invalid subscription object: missing endpoint')
             return False
         
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         subs_col = get_push_subscriptions_collection(db)
         
-        # Create unique hash of subscription to avoid duplicates
-        sub_hash = hashlib.md5(
-            f"{username}:{subscription_obj['endpoint']}".encode()
+        # Create unique hash of subscription using plaintext data to avoid duplicates
+        sub_hash = hashlib.shake_256(
+            f"{username}:{endpoint}".encode('utf-8')
         ).hexdigest()
         
-        # Check if subscription already exists
+        # Check if subscription already exists by Hash
         existing = subs_col.find_one({
-            'Username': username,
             'SubscriptionHash': sub_hash
         })
         
         if existing:
-            # Update last used time
             subs_col.update_one(
                 {'_id': existing['_id']},
                 {'$set': {
@@ -136,15 +140,19 @@ def save_push_subscription(username, subscription_obj):
                     'IsActive': True
                 }}
             )
-            logger.info(f'Updated existing subscription for {username}')
+            logger.info('Updated existing push subscription')
             client.close()
             return True
         
-        # Save new subscription
+        # Format keys as JSON string for your encrypt_text module
+        keys_str = json.dumps(subscription_obj.get('keys', {}))
+        
+        # Save new subscription, encrypting sensitive fields
         subscription_doc = {
-            'Username': username,
-            'Endpoint': subscription_obj['endpoint'],
-            'Keys': subscription_obj.get('keys', {}),
+            'UsernameHash': _get_username_hash(username),
+            'Username': encrypt_text(username),
+            'Endpoint': encrypt_text(endpoint),
+            'Keys': encrypt_text(keys_str),
             'SubscriptionHash': sub_hash,
             'IsActive': True,
             'CreatedAt': datetime.datetime.now(),
@@ -153,36 +161,31 @@ def save_push_subscription(username, subscription_obj):
         }
         
         subs_col.insert_one(subscription_doc)
-        logger.info(f'Saved new push subscription for {username}')
+        logger.info('Saved new encrypted push subscription')
         client.close()
         return True
         
     except Exception as e:
-        logger.error(f'Error saving push subscription for {username}: {e}')
+        logger.error(f'Error saving push subscription: {e}')
         return False
 
 
 def remove_push_subscription(username, endpoint):
     """
-    Remove a push subscription
-    
-    Args:
-        username (str): Username
-        endpoint (str): Subscription endpoint URL
-        
-    Returns:
-        bool: Success status
+    Remove a push subscription by making it inactive.
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         subs_col = get_push_subscriptions_collection(db)
         
+        # Recreate the deterministic hash to find the specific subscription
+        sub_hash = hashlib.shake_256(
+            f"{username}:{endpoint}".encode('utf-8')
+        ).hexdigest()
+        
         result = subs_col.update_one(
-            {
-                'Username': username,
-                'Endpoint': endpoint
-            },
+            {'SubscriptionHash': sub_hash},
             {'$set': {'IsActive': False}}
         )
         
@@ -190,31 +193,19 @@ def remove_push_subscription(username, endpoint):
         return result.modified_count > 0
         
     except Exception as e:
-        logger.error(f'Error removing push subscription for {username}: {e}')
+        logger.error(f'Error removing push subscription: {e}')
         return False
 
 
 def send_push_notification(username, title, body, icon=None, url='/', reference=None, tag='notification'):
     """
-    Send a push notification to all user's subscriptions
-    
-    Args:
-        username (str): Target username
-        title (str): Notification title
-        body (str): Notification body
-        icon (str, optional): Icon URL
-        url (str, optional): URL to open on click
-        reference (dict, optional): Reference data (item_id, etc)
-        tag (str, optional): Notification tag for grouping
-        
-    Returns:
-        int: Number of successfully sent notifications
+    Send a push notification to all user's subscriptions.
     """
     try:
         subscriptions = get_user_subscriptions(username)
         
         if not subscriptions:
-            logger.debug(f'No active push subscriptions for {username}')
+            logger.debug('No active push subscriptions for user')
             return 0
         
         sent_count = 0
@@ -232,19 +223,18 @@ def send_push_notification(username, title, body, icon=None, url='/', reference=
             if success:
                 sent_count += 1
             else:
-                # Mark subscription as inactive if send fails
                 _mark_subscription_inactive(subscription['_id'])
         
-        logger.info(f'Sent push notification to {username}: {sent_count}/{len(subscriptions)} subscriptions')
+        logger.info(f'Sent push notification: {sent_count}/{len(subscriptions)} subscriptions')
         return sent_count
         
     except Exception as e:
-        logger.error(f'Error sending push notification to {username}: {e}')
+        logger.error(f'Error sending push notification: {e}')
         return 0
 
 
 def _send_to_subscription(subscription, title, body, icon, url, reference, tag):
-    """Send push notification to a specific subscription"""
+    """Send push notification to a specific decrypted subscription"""
     try:
         payload = {
             'title': title,
@@ -256,20 +246,17 @@ def _send_to_subscription(subscription, title, body, icon, url, reference, tag):
             'reference': reference or {},
         }
         
-        # If using Firebase Cloud Messaging
         if FCM_API_KEY and subscription.get('Endpoint', '').startswith('https://fcm.'):
             return _send_fcm_notification(subscription, payload)
         
-        # Otherwise use standard Web Push Protocol
         return _send_web_push_notification(subscription, payload)
         
     except Exception as e:
-        logger.error(f'Error sending to subscription {subscription.get("_id")}: {e}')
+        logger.error(f'Error sending to subscription: {e}')
         return False
 
 
 def _send_fcm_notification(subscription, payload):
-    """Send notification via Firebase Cloud Messaging"""
     try:
         if not FCM_API_KEY:
             logger.warning('FCM_API_KEY not configured')
@@ -311,9 +298,7 @@ def _send_fcm_notification(subscription, payload):
 
 
 def _send_web_push_notification(subscription, payload):
-    """Send notification using standard Web Push Protocol"""
     try:
-        # This requires pywebpush library
         from pywebpush import webpush
         
         webpush(
@@ -325,13 +310,13 @@ def _send_web_push_notification(subscription, payload):
             vapid_private_key=VAPID_PRIVATE_KEY,
             vapid_claims={'sub': VAPID_SUBJECT},
             timeout=10,
-            ttl=3600  # Notification expires after 1 hour if device is offline
+            ttl=3600 
         )
         
         return True
         
     except ImportError:
-        logger.warning('pywebpush not installed, install with: pip install pywebpush')
+        logger.warning('pywebpush not installed. pip install pywebpush')
         return False
     except Exception as e:
         logger.error(f'Web push error: {e}')
@@ -339,7 +324,6 @@ def _send_web_push_notification(subscription, payload):
 
 
 def _mark_subscription_inactive(subscription_id):
-    """Mark a subscription as inactive (e.g., after failed send)"""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
@@ -349,37 +333,21 @@ def _mark_subscription_inactive(subscription_id):
             {'_id': ObjectId(subscription_id)},
             {'$set': {'IsActive': False}}
         )
-        
         client.close()
     except Exception as e:
         logger.error(f'Error marking subscription inactive: {e}')
 
 
 def send_push_to_all_admins(title, body, icon=None, url='/', reference=None):
-    """
-    Send a push notification to all admin users
-    
-    Args:
-        title (str): Notification title
-        body (str): Notification body
-        icon (str, optional): Icon URL
-        url (str, optional): URL to open on click
-        reference (dict, optional): Reference data
-        
-    Returns:
-        int: Total notifications sent
-    """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         users_col = db['users']
         
-        # Get all admin users
         admin_users = list(users_col.find(
             {'Admin': True},
             {'Username': 1}
         ))
-        
         client.close()
         
         total_sent = 0
@@ -404,10 +372,6 @@ def send_push_to_all_admins(title, body, icon=None, url='/', reference=None):
 
 
 def cleanup_inactive_subscriptions():
-    """
-    Remove inactive subscriptions older than 30 days
-    Run this periodically as a maintenance task
-    """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
@@ -429,22 +393,19 @@ def cleanup_inactive_subscriptions():
         return 0
 
 
-# Database collection schema
 def ensure_push_subscriptions_collection():
-    """Ensure the push_subscriptions collection exists with proper indexes"""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         subs_col = get_push_subscriptions_collection(db)
         
-        # Create indexes
-        subs_col.create_index('Username')
-        subs_col.create_index([('Username', 1), ('IsActive', 1)])
-        subs_col.create_index([('CreatedAt', 1)])  # TTL-like usage
+        subs_col.create_index('UsernameHash')
+        subs_col.create_index([('UsernameHash', 1), ('IsActive', 1)])
+        subs_col.create_index([('CreatedAt', 1)]) 
         subs_col.create_index('SubscriptionHash', unique=True)
         
         logger.info('Push subscriptions collection indexes created')
         client.close()
         
     except Exception as e:
-        logger.error(f'Error ensuring push subscriptions collection: {e}')
+        logger.error(f'Error ensuring push subscriptions collection: {e}')

Web/templates/base.html

@@ -1144,6 +1144,17 @@
                         <li class="nav-item dropdown ms-lg-auto">
                             <a class="nav-link dropdown-toggle" href="#" id="termMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false" title="Weitere Optionen">Mehr Optionen</a>
                             <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="termMoreDropdown">
+                                {% if 'username' in session %}
+                                {% if current_permissions.pages.get('tutorial_page', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('tutorial_page') }}">Tutorial</a></li>
+                                {% endif %}
+                                <li><a class="dropdown-item" href="{{ url_for('admin_school_settings') }}">Schulstammdaten</a></li>
+                                {% if current_permissions.actions.get('can_view_logs', True) and current_permissions.pages.get('admin_audit_dashboard', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('admin_audit_dashboard') }}">Audit Dashboard</a></li>
+                                {% endif %}
+                                <li><hr class="dropdown-divider"></li>
+                                {% endif %}
+                                
                                 {% if current_permissions.pages.get('home', True) %}
                                 <li><a class="dropdown-item" href="{{ url_for('home') }}">Inventarsystem</a></li>
                                 {% endif %}
@@ -1155,6 +1166,42 @@
                             </ul>
                         </li>
                     </ul>
+                    <div class="d-flex">
+                        {% if 'username' in session %}
+                            <div class="function-search-wrap">
+                                <form class="function-search-form" data-function-search="true">
+                                    <input
+                                        class="function-search-input"
+                                        type="search"
+                                        name="function_search"
+                                        placeholder="Funktion suchen..."
+                                        list="function-search-options"
+                                        autocomplete="off"
+                                    >
+                                    <button class="function-search-btn" type="submit">Los</button>
+                                </form>
+                            </div>
+                            {% if current_tenant_db %}
+                            <span class="navbar-text tenant-badge" title="Aktive Tenant-Datenbank">{{ current_tenant_db }}</span>
+                        {% endif %}
+                        <span class="navbar-text text-light me-3">{{ session['username'] }}</span>
+                            <div class="dropdown me-2 user-menu-wrap">
+                                <button class="btn btn-secondary dropdown-toggle user-menu-btn" type="button" id="invUserMenuDropdown" data-bs-toggle="dropdown" aria-expanded="false" data-notification-button="true">
+                                    👤
+                                    <span class="user-notification-dot {% if unread_notification_count and unread_notification_count > 0 %}visible{% endif %}" aria-hidden="true"></span>
+                                </button>
+                                <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invUserMenuDropdown">
+                                    {% if current_permissions.pages.get('notifications_view', True) %}
+                                    <li><a class="dropdown-item" href="{{ url_for('notifications_view') }}">Benachrichtigungen</a></li>
+                                    {% endif %}
+                                    <li><hr class="dropdown-divider"></li>
+                                    <li><a class="dropdown-item" href="{{ url_for('change_password') }}">Passwort ändern</a></li>
+                                    <li><hr class="dropdown-divider"></li>
+                                    <li><a class="dropdown-item" href="{{ url_for('logout') }}">Logout</a></li>
+                                </ul>
+                            </div>
+                        {% endif %}
+                    </div>
                 </div>
             </div>
         </nav>

Web/templates/library_table.html

@@ -1057,7 +1057,7 @@
         document.getElementById('detailModal').style.display = 'none';
     }
 
-// =========================================================================
+    // =========================================================================
     // 5. EVENT LISTENERS INITIALIZATION & ON-LOAD INITIALIZER
     // =========================================================================
     function wireScannerUi() {