changes to the username generation to have a more brother view

Web/modules/database/user.py

@@ -97,18 +97,18 @@ def build_name_synonym(first_name, last_name=''):
     last = _clean_name_fragment(last_name)
 
     if first and last:
-        return (first[:2] + last[:2]).title()
+        return (first[:3] + last[:3]).title()
 
     combined = (first + last)
     if not combined:
         return 'User'
-    return combined[:4].title()
+    return combined[:6].title()
 
 
 def build_username_from_name(first_name, last_name=''):
     """
     Build a deterministic username abbreviation from first and last name.
-    Uses 2 letters from each name and stores it lowercase.
+    Uses 3 letters from each name and stores it lowercase.
     
     Args:
         first_name (str): First name
@@ -123,12 +123,12 @@ def build_username_from_name(first_name, last_name=''):
 
 def build_unique_username_from_name(first_name, last_name=''):
     """
-    Build a unique username from the first 2 letters of the first name and
-    the first 2 letters of the last name.
+    Build a unique username from the first 3 letters of the first name and
+    the first 3 letters of the last name.
     """
     first = _clean_name_fragment(first_name)
     last = _clean_name_fragment(last_name)
-    base_username = (first[:2] + last[:2]).lower()
+    base_username = (first[:3] + last[:3]).lower()
 
     if not base_username:
         base_username = 'user'
@@ -594,8 +594,8 @@ def student_card_exists(student_card_id):
         return False
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
-    users = db['users']
-    exists = users.find_one({'StudentCardId': normalized}) is not None
+    users = db['student_cards']
+    exists = users.find_one({'SchülerName': normalized}) is not None
     client.close()
     return exists
 
@@ -607,8 +607,8 @@ def get_user_by_student_card(student_card_id):
         return None
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
-    users = db['users']
-    found_user = users.find_one({'StudentCardId': normalized})
+    users = db['student_cards']
+    found_user = users.find_one({'SchülerName': normalized})
     client.close()
     return found_user
 

Web/templates/main_admin.html

@@ -2309,6 +2309,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
 </script>
 
 <div class="admin-content-container">
+    {% if current_permissions.actions.get('can_edit', False) %}
     <!-- Admin conflict warning banner (populated by JS) -->
     <div id="conflict-banner" style="display:none; background:#fff3cd; border:1px solid #ffc107; border-left:4px solid #fd7e14; color:#856404; padding:12px 16px; border-radius:4px; margin-bottom:16px; position:relative;">
         <strong>⚠ Buchungskonflikte erkannt:</strong>
@@ -2335,6 +2336,8 @@ document.addEventListener('DOMContentLoaded', ()=>{
             .catch(() => {});
     });
     </script>
+    {% endif %}
+
     <div class="content">
         <h1 style="position:relative;">Inventar Objekte
             <div class="view-switch-group">
@@ -2344,14 +2347,17 @@ document.addEventListener('DOMContentLoaded', ()=>{
                 <button id="toggle-favorites-view" class="view-toggle-btn" title="Nur Merkliste anzeigen">
                     <span id="favorites-view-icon">🔖</span>
                 </button>
+                {% if current_permissions.actions.get('can_delete', False) %}
                 <div class="bulk-delete-inline-wrap">
                     <button type="button" id="bulk-delete-drawer-toggle" class="view-toggle-btn bulk-delete-drawer-toggle" aria-expanded="false" title="Massenlöschung" onclick="toggleBulkDeleteDrawer()">
                         <span class="drawer-icon">⚙</span>
                     </button>
                 </div>
+                {% endif %}
             </div>
         </h1>
         <div id="items-indicator" class="items-indicator">Objekte im System: 0</div>
+        {% if current_permissions.actions.get('can_delete', False) %}
         <div id="bulk-delete-drawer" class="bulk-delete-drawer" aria-hidden="true">
             <div class="bulk-delete-content">
                 <strong>Massenlöschung nach Kriterien</strong>
@@ -2364,6 +2370,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                 <button type="button" id="bulk-delete-button" class="danger" onclick="deleteSelectedItems()" disabled>Auswahl löschen</button>
             </div>
         </div>
+        {% endif %}
         <div class="filter-container">
             <div class="filter-group">
                 <div class="filter-header">
@@ -2469,6 +2476,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
     </div>
 
     <!-- Add the edit modal form -->
+    {% if current_permissions.actions.get('can_edit', False) %}
     <div id="edit-modal" class="item-modal">
         <div class="modal-content">
             <span class="close-modal" onclick="closeEditModal()">&times;</span>
@@ -2646,6 +2654,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
             </form>
         </div>
     </div>
+    {% endif %}
 </div>
 
 <!-- Schedule Appointment Modal -->
@@ -2724,7 +2733,6 @@ document.addEventListener('DOMContentLoaded', ()=>{
     </div>
 </div>
 
-<!-- Initialize template variables before any JavaScript code -->
 <script>
     // Create a global object to hold server-side template values
     window.serverVars = {};
@@ -3239,7 +3247,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
             return;
         }
 
-        fetch('{{ url_for('bulk_delete_items') }}', {
+        fetch("{{ url_for('bulk_delete_items') }}", {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
@@ -3703,6 +3711,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                                         Für Löschung markieren
                                     </label>
                                 </div>
+                                {% if current_permissions.actions.get('can_borrow', False) %}
                                 ${isAvailableForBorrow && !item.BlockedNow ? 
                                     `<form method="POST" action="{{ url_for('ausleihen', id='') }}${item._id}">
                                         ${isGroupedItem ? `
@@ -3724,12 +3733,21 @@ document.addEventListener('DOMContentLoaded', ()=>{
                                 :
                                     `<button class="ausleihen disabled-button" disabled>${item.BlockedNow ? 'Reserviert' : 'Ausgeliehen'}</button>`
                                 }
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_delete', False) %}
                                 <form method="POST" action="{{ url_for('delete_item', id='') }}${item._id}" style="display:inline;" onsubmit="return confirm('Sind Sie sicher, dass Sie dieses Objekt löschen möchten?')">
                                     <button class="delete-button" type="submit">Löschen</button>
                                 </form>
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_edit', False) %}
                                 <button class="edit-button" onclick="openEditModalForSelectedUnit('${item._id}', 'specific-item-card-${item._id}')">Bearbeiten</button>
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_insert', False) %}
                                 <button class="duplicate-button" onclick="duplicateItem('${item._id}')">Duplizieren</button>
+                                {% endif %}
+                                {% if current_permissions.pages.get('admin_school_settings', False) %}
                                 ${canScheduleItem ? `<button class="schedule-button" onclick="openScheduleModal('${item._id}')">Reservieren</button>` : ''}
+                                {% endif %}
                             </div>
                         `;
                         itemsContainer.appendChild(card);
@@ -4506,10 +4524,10 @@ document.addEventListener('DOMContentLoaded', ()=>{
             : '<div style="font-size:0.92rem;color:#64748b;">Keine Beschädigungs-Historie vorhanden.</div>';
         
         modalContent.innerHTML = `
-            <h2>${item.Name}</h2>
+            <h2>${escapeHtml(item.Name || '')}</h2>
             ${borrowerInfoHtml}
             ${appointmentInfoHtml}
-            
+                
             <div class="modal-image-container">
                 ${imagesHtml}
                 ${item.Images && item.Images.length > 1 ? `
@@ -4518,66 +4536,67 @@ document.addEventListener('DOMContentLoaded', ()=>{
                     <div class="image-counter">1/${item.Images.length}</div>
                 ` : ''}
             </div>
-            
+
             <div class="modal-details">
                 <div class="detail-group">
                     <div class="detail-label">Ort:</div>
-                    <div class="detail-value">${item.Ort || '-'}</div>
+                    <div class="detail-value">${escapeHtml(item.Ort || '-')}</div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Status:</div>
                     <div class="detail-value ${isBorrowed ? 'status-borrowed' : ''}">
                         ${isBorrowed ? 'Ausgeliehen' : 'Verfügbar'}
                     </div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Unterrichtsfach:</div>
-                    <div class="detail-value">${filter1Array.join(', ') || '-'}</div>
+                    <div class="detail-value">${escapeHtml(filter1Array.join(', ') || '-')}</div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Jahrgangsstufe:</div>
-                    <div class="detail-value">${filter2Array.join(', ') || '-'}</div>
+                    <div class="detail-value">${escapeHtml(filter2Array.join(', ') || '-')}</div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Schlagwort:</div>
-                    <div class="detail-value">${filter3Array.join(', ') || '-'}</div>
+                    <div class="detail-value">${escapeHtml(filter3Array.join(', ') || '-')}</div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Code:</div>
-                    <div class="detail-value">${item.Code_4 || '-'}</div>
+                    <div class="detail-value">${escapeHtml(item.Code_4 || '-')}</div>
                 </div>
-
+            
                 <div class="detail-group">
                     <div class="detail-label">Anzahl:</div>
-                    <div class="detail-value">${item.GroupedDisplayCount || 1}</div>
+                    <div class="detail-value">${escapeHtml(String(item.GroupedDisplayCount || 1))}</div>
                 </div>
-
+            
                 ${isGroupedItem ? `
                 <div class="detail-group">
                     <div class="detail-label">Verfügbar:</div>
-                    <div class="detail-value">${availableGroupedCount}</div>
+                    <div class="detail-value">${escapeHtml(String(availableGroupedCount))}</div>
                 </div>` : ''}
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Anschaffungsjahr:</div>
-                    <div class="detail-value">${item.Anschaffungsjahr || '-'}</div>
-                </div>
-                
-                <div class="detail-group">
-                    <div class="detail-label">Anschaffungskosten:</div>
-                    <div class="detail-value">${item.Anschaffungskosten ? item.Anschaffungskosten + ' €' : '-'}</div>
-                </div>
-                
-                <div class="detail-group full-width">
-                    <div class="detail-label">Beschreibung:</div>
-                    <div class="detail-value">${item.Beschreibung || '-'}</div>
+                    <div class="detail-value">${escapeHtml(String(item.Anschaffungsjahr || '-'))}</div>
                 </div>
 
+                <div class="detail-group">
+                    <div class="detail-label">Anschaffungskosten:</div>
+                    <div class="detail-value">${item.Anschaffungskosten ? escapeHtml(String(item.Anschaffungskosten)) + ' €' : '-'}</div>
+                </div>
+
+                <div class="detail-group full-width">
+                    <div class="detail-label">Beschreibung:</div>
+                    <div class="detail-value">${escapeHtml(item.Beschreibung || '-')}</div>
+                </div>
+            
+                {% if current_permissions.actions.get('can_view_logs', False) %}
                 <div class="detail-group full-width" style="margin-top:12px;">
                     <div class="detail-label" style="font-weight:600; color:#374151;">Beschädigungs-Historie</div>
                     <div class="detail-value">
@@ -4590,7 +4609,8 @@ document.addEventListener('DOMContentLoaded', ()=>{
                         </div>
                     </div>
                 </div>
-
+                {% endif %}
+            
                 <div class="detail-group full-width" style="margin-top:12px; padding:10px; border:1px solid #e3e3e3; border-radius:8px;">
                     <div class="detail-label">Verfügbarkeit prüfen:</div>
                     <div class="detail-value">
@@ -4611,7 +4631,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                     </div>
                 </div>
             </div>
-
+        
             <div class="detail-group full-width" style="margin-top:15px;">
                 <div class="detail-label">Geplante Ausleihen:</div>
                 <div class="detail-value">
@@ -4635,9 +4655,10 @@ document.addEventListener('DOMContentLoaded', ()=>{
                     </div>
                 </div>
             </div>
-            
+
             <div class="modal-actions">
                 ${!isBorrowed ? 
+                    {% if current_permissions.actions.get('can_borrow', False) %}
                     `<form method="POST" action="/ausleihen/${item._id}">
                         ${isGroupedItem ? `
                         <div style="display:flex; gap:8px; flex-wrap:wrap; margin-bottom:8px; align-items:center;">
@@ -4651,6 +4672,9 @@ document.addEventListener('DOMContentLoaded', ()=>{
                         </div>` : ''}
                         <button class="ausleihen" type="submit">Ausleihen</button>
                     </form>` 
+                    {% else %}
+                    `<button class="ausleihen disabled-button" disabled title="Keine Berechtigung">Ausleihen nicht möglich</button>`
+                    {% endif %}
                     : (!isGroupedItem && item.User === currentUsername) ?
                     `<form method="POST" action="/zurueckgeben/${item._id}">
                         <button class="ausleihen" type="submit">Zurückgeben</button>
@@ -4659,7 +4683,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                 }
                 <button class="edit-button" onclick="openEditModalForSelectedUnit('${item._id}', 'specific-item-modal-${item._id}')">Bearbeiten</button>
                 <button class="duplicate-button" onclick="duplicateItem('${item._id}')">Duplizieren</button>
-                ${damageReports.length > 0 ? `<button class="damage-button" onclick="markDamageAsRepaired('${item._id}')">Repariert</button>` : `<button class="damage-button" onclick="registerDamage('${item._id}')">Schaden melden</button>`}
+                ${damageReports && damageReports.length > 0 ? `<button class="damage-button" onclick="markDamageAsRepaired('${item._id}')">Repariert</button>` : `<button class="damage-button" onclick="registerDamage('${item._id}')">Schaden melden</button>`}
                 ${canScheduleItem ? `<button class="schedule-button" onclick="openScheduleModal('${item._id}')">Reservieren</button>` : ''}
                 <form method="POST" action="/delete_item/${item._id}" style="display:inline;" onsubmit="return confirm('Sind Sie sicher?')">
                     <button class="delete-button" type="submit">Löschen</button>