new implementation of file uploading

Web/app.py

@@ -26,6 +26,7 @@ from jinja2 import TemplateNotFound
 import os
 import sys
 from bs4 import BeautifulSoup
+from gridfs import GridFS
 
 # Ensure imports work regardless of whether gunicorn starts in /app or /app/Web.
 _CURRENT_DIR = os.path.dirname(os.path.abspath(__file__))
@@ -395,6 +396,12 @@ SENSITIVE_AUDIT_FIELDS = ["email", "username", "full_name", "phone", "borrower",
 APP_VERSION = __version__
 RELEASE_STATE_FILE = os.path.join(os.path.dirname(BASE_DIR), '.release-version')
 
+def get_gridfs():
+    """Return a GridFS instance connected to the current tenant's database context."""
+    client = cfg.MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+    db = client[cfg.MONGODB_DB]  # Intercepted by your multi-tenant proxy automatically
+    return GridFS(db)
+
 """ -----------------------------------------------------------------------Before Request Handlers---------------------------------------------------------------------------- """
 
 def _get_csrf_token():
@@ -797,7 +804,7 @@ def _get_school_info_for_export():
 
 
 def _save_school_logo_upload(upload_file, tenant_id=None, tenant_db=None):
-    """Save an uploaded school logo to the shared upload folder with a tenant-specific filename."""
+    """Save an uploaded school logo directly into MongoDB GridFS."""
     if not upload_file or not getattr(upload_file, 'filename', ''):
         return None
 
@@ -813,33 +820,44 @@ def _save_school_logo_upload(upload_file, tenant_id=None, tenant_db=None):
         raise ValueError('Das Logo benötigt eine Dateiendung.')
 
     logo_filename = f'school-logo-{safe_tenant}{extension}'
-    logo_path = os.path.join(app.config['UPLOAD_FOLDER'], logo_filename)
+    thumb_filename = f'school-logo-{safe_tenant}-thumb.png'
 
-    os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True)
-    upload_file.save(logo_path)
+    fs = get_gridfs()
 
-    # Generate a thumbnail for consistent navbar sizing
+    # Read file data into memory
+    upload_file.seek(0)
+    file_bytes = upload_file.read()
+
+    # Save main logo to GridFS
+    fs.put(
+        io.BytesIO(file_bytes),
+        filename=logo_filename,
+        content_type=upload_file.content_type or 'image/png'
+    )
+
+    # Generate thumbnail in-memory and save to GridFS
     try:
-        thumb_filename = f'school-logo-{safe_tenant}-thumb.png'
-        thumb_path = os.path.join(app.config['UPLOAD_FOLDER'], thumb_filename)
-
-        with Image.open(logo_path) as img:
-            # Ensure RGBA for transparency and convert if needed
+        with Image.open(io.BytesIO(file_bytes)) as img:
             if img.mode not in ('RGBA', 'RGB'):
                 img = img.convert('RGBA')
 
-            # Target max size: width up to 520px, height up to 114px (matches CSS constraints)
             max_thumb_size = (520, 114)
             img.thumbnail(max_thumb_size, Image.LANCZOS)
 
-            # Save as PNG for predictable rendering in web UI
-            img.save(thumb_path, format='PNG', optimize=True)
+            thumb_io = io.BytesIO()
+            img.save(thumb_io, format='PNG', optimize=True)
+            thumb_io.seek(0)
+
+            fs.put(
+                thumb_io,
+                filename=thumb_filename,
+                content_type='image/png'
+            )
     except Exception as e:
-        app.logger.warning(f"Thumbnail generation failed for {logo_path}: {e}")
+        app.logger.warning(f"Thumbnail generation failed for logo: {e}")
         thumb_filename = None
 
     return (logo_filename, thumb_filename)
-
 """---------------------------------------------Invoice Generation----------------------------------------------------------------------------- """
 
 def _parse_money_value(value):
@@ -2534,14 +2552,15 @@ def upload_student_cards_excel():
 
 """-------------------------------------------------------------File Serving-----------------------------------------------------------------------------"""
 
+
 @app.route('/uploads/<filename>')
 def uploaded_file(filename):
     """
-    Serve uploaded files from the uploads directory.
-    
+    Serve uploaded files from MongoDB GridFS with local path fallbacks.
+
     Args:
         filename (str): Name of the file to serve
-        
+
     Returns:
         flask.Response: The requested file or placeholder image if not found
     """
@@ -2550,24 +2569,37 @@ def uploaded_file(filename):
         if denied:
             return denied
 
-        # Check production path first (deployed environment)
+        # 1. Try serving from MongoDB GridFS first
+        try:
+            fs = get_gridfs()
+            grid_out = fs.find_one({'filename': filename})
+            if grid_out:
+                return send_file(
+                    io.BytesIO(grid_out.read()),
+                    mimetype=grid_out.content_type or 'application/octet-stream',
+                    download_name=filename
+                )
+        except Exception as grid_err:
+            app.logger.warning(f"GridFS lookup failed for {filename}: {grid_err}")
+
+        # 2. Fallback to production path for legacy local files
         prod_path = "/opt/Inventarsystem/Web/uploads"
         dev_path = app.config['UPLOAD_FOLDER']
         if os.path.exists(os.path.join(prod_path, filename)):
             return send_from_directory(prod_path, filename)
-        # Then check development path
+        # 3. Fallback to development path
         if os.path.exists(os.path.join(dev_path, filename)):
             return send_from_directory(dev_path, filename)
-            
-        # Use a placeholder image if file not found - first try SVG, then PNG
+
+        # 4. Use a placeholder image if file not found - first try SVG, then PNG
         svg_placeholder_path = os.path.join(app.static_folder, 'img', 'no-image.svg')
         png_placeholder_path = os.path.join(app.static_folder, 'img', 'no-image.png')
-        
+
         if os.path.exists(svg_placeholder_path):
             return send_from_directory(app.static_folder, 'img/no-image.svg')
         elif os.path.exists(png_placeholder_path):
             return send_from_directory(app.static_folder, 'img/no-image.png')
-        
+
         # Default placeholder from static folder
         return send_from_directory(app.static_folder, 'favicon.ico')
     except Exception as e:
@@ -10248,74 +10280,58 @@ def get_period_times(booking_date, period_num):
 
 """---------------------------------------------------------Borrowing-----------------------------------------------------------------"""
 
+
 @app.route('/my_borrowed_items')
 def my_borrowed_items():
     """
     Zeigt alle vom aktuellen Benutzer ausgeliehenen und geplanten Objekte an.
-    
-    Returns:
-        Response: Gerendertes Template mit den ausgeliehenen und geplanten Objekten des Benutzers
     """
     if 'username' not in session:
         flash('Bitte melden Sie sich an, um Ihre ausgeliehenen Objekte anzuzeigen', 'error')
         return redirect(url_for('login', next=request.path))
-    
+
     username = session['username']
+
     client = MongoClient(MONGODB_HOST, MONGODB_PORT)
     db = client[MONGODB_DB]
-    items_collection = db.items
-    ausleihungen_collection = db.ausleihungen
-    
-    # Get current time for comparison
-    current_time = datetime.datetime.now()
-    
-    # Check if user is admin
-    user_is_admin = False
-    if 'is_admin' in session:
-        user_is_admin = session['is_admin']
-    
-    # Get items currently borrowed by the user (where Verfuegbar=false and User=username)
-    borrowed_items = list(items_collection.find({'Verfuegbar': False, 'User': username}))
-    
-    # Get active and planned ausleihungen for the user
-    active_ausleihungen = list(ausleihungen_collection.find({
-        'User': username,
-        'Status': 'active'
+    items_collection = db['items']
+    ausleihungen_collection = db['ausleihungen']
+
+    all_ausleihungen = list(ausleihungen_collection.find({
+        'Status': {'$in': ['active', 'planned']}
     }))
-    
-    planned_ausleihungen = list(ausleihungen_collection.find({
-        'User': username,
-        'Status': 'planned'
-    }))
-    
-    # Process items
+
     active_items = []
     planned_items = []
-    processed_item_ids = set()  # Keep track of processed item IDs to avoid duplicates
-    
-    # First, process items that are directly marked as borrowed by the user
-    for item in borrowed_items:
-        # Convert ObjectId to string for template
-        item['_id'] = str(item['_id'])
-        active_items.append(item)
-        processed_item_ids.add(item['_id'])
-    
-    # Process active appointments
-    for appointment in active_ausleihungen:
-        # Get the item ID from the appointment
+    processed_item_ids = set()
+
+    for appointment in all_ausleihungen:
+        raw_user = appointment.get('User', '')
+        try:
+            decrypted_user = decrypt_text(raw_user) if raw_user else ''
+        except Exception as e:
+            app.logger.error(f"Entschlüsselungsfehler: {e}")
+            decrypted_user = ''
+
+        if decrypted_user != username:
+            continue
+
         item_id = appointment.get('Item')
-        
-        if not item_id or str(item_id) in processed_item_ids:
-            continue  # Skip if we already processed this item or no item ID
-        
-        # Get item details
-        item_obj = items_collection.find_one({'_id': ObjectId(item_id)})
-        
+        if not item_id:
+            continue
+
+        try:
+            if isinstance(item_id, str):
+                query_id = ObjectId(item_id)
+            else:
+                query_id = item_id
+            item_obj = items_collection.find_one({'_id': query_id})
+        except Exception:
+            item_obj = None
+
         if item_obj:
-            # Convert ObjectId to string for template
             item_obj['_id'] = str(item_obj['_id'])
-            
-            # Add appointment data
+
             item_obj['AppointmentData'] = {
                 'id': str(appointment['_id']),
                 'start': appointment.get('Start'),
@@ -10324,55 +10340,43 @@ def my_borrowed_items():
                 'period': appointment.get('Period'),
                 'status': appointment.get('VerifiedStatus', appointment.get('Status')),
             }
-            
-            # Mark that this item is part of an active appointment
-            item_obj['ActiveAppointment'] = True
-            
-            # Add to the list only if not already there
-            if str(item_obj['_id']) not in processed_item_ids:
-                active_items.append(item_obj)
-                processed_item_ids.add(str(item_obj['_id']))
-    
-    # Process planned appointments
-    for appointment in planned_ausleihungen:
-        item_id = appointment.get('Item')
-        
-        if not item_id:
-            continue
-        
-        item_obj = items_collection.find_one({'_id': ObjectId(item_id)})
-        
-        if item_obj:
-            item_obj['_id'] = str(item_obj['_id'])
-            
-            # Add appointment data
-            item_obj['AppointmentData'] = {
-                'id': str(appointment['_id']),
-                'start': appointment.get('Start'),
-                'end': appointment.get('End'),
-                'notes': appointment.get('Notes'),
-                'period': appointment.get('Period'),
-                'status': appointment.get('Status'),
-            }
-            
-            planned_items.append(item_obj)
-    
+
+            status = appointment.get('Status')
+            if status == 'active':
+                item_obj['ActiveAppointment'] = True
+                if str(item_obj['_id']) not in processed_item_ids:
+                    active_items.append(item_obj)
+                    processed_item_ids.add(str(item_obj['_id']))
+            elif status == 'planned':
+                planned_items.append(item_obj)
+
+    all_borrowed_items = list(items_collection.find({'Verfuegbar': False}))
+    for item in all_borrowed_items:
+        raw_item_user = item.get('User', '')
+        try:
+            dec_item_user = decrypt_text(raw_item_user) if raw_item_user else ''
+        except Exception:
+            dec_item_user = ''
+
+        if dec_item_user == username and str(item['_id']) not in processed_item_ids:
+            item['_id'] = str(item['_id'])
+            item['ActiveAppointment'] = True
+            item['AppointmentData'] = {'status': 'active (no document)'}
+            active_items.append(item)
+            processed_item_ids.add(item['_id'])
+
     client.close()
-    
-    # DEBUG: Log what we're passing to the template
-    app.logger.info(f"Passing {len(active_items)} active items and {len(planned_items)} planned items to template")
-    if planned_items:
-        for i, item in enumerate(planned_items):
-            app.logger.info(f"Planned item {i+1}: {item['Name']}, Appointment ID: {item['AppointmentData']['id']}")
-    
+
+    # DEBUG Logging
+    app.logger.info(
+        f"Passing {len(active_items)} active items and {len(planned_items)} planned items to template for user {username}")
+
     return render_template(
         'my_borrowed_items.html',
         items=active_items,
-        planned_items=planned_items,
-        user_is_admin=user_is_admin
+        planned_items=planned_items
     )
 
-
 @app.route('/api/push/vapid-key', methods=['GET'])
 def get_vapid_key():
     """
@@ -10612,53 +10616,109 @@ def notifications_unread_status():
             client.close()
 
 
-@app.route('/admin/damaged_items') 
+@app.route('/admin/damaged_items')
 def admin_damaged_items():
-    """Admin-Übersicht aller aktiven und vergangenen Ausleihen."""
+    """Admin-Übersicht aller defekten, reparierten oder zerstörten Items."""
     if 'username' not in session:
-        flash('Administratorrechte erforderlich.', 'error')
+        flash('Anmeldung erforderlich.', 'error')
         return redirect(url_for('login'))
 
     from modules.inventarsystem.data_protection import decrypt_text
-    from bson.objectid import ObjectId
 
     client = None
     try:
         client = MongoClient(MONGODB_HOST, MONGODB_PORT)
         db = client[MONGODB_DB]
-        ausleihungen_col = db['ausleihungen']
         items_col = db['items']
+        ausleihungen_col = db['ausleihungen']
 
-        ausleihungen = list(ausleihungen_col.find().sort('Start', -1))
+        # 1. Alle Items suchen, die einen Schaden haben, repariert oder zerstört sind
+        query = {
+            '$or': [
+                {'HasDamage': True},
+                {'DamageReports': {'$exists': True, '$not': {'$size': 0}}},
+                {'Condition': {'$in': ['destroyed', 'broken', 'damaged', 'repaired', 'fixed']}}
+            ]
+        }
 
-        for record in ausleihungen:
-            raw_user = record.get('User', '')
-            if raw_user:
-                record['User'] = decrypt_text(raw_user)
+        raw_items = list(items_col.find(query).sort('LastUpdated', -1))
+        damaged_items = []
 
-            item_id = record.get('Item')
-            if item_id:
-                try:
-                    item_doc = items_col.find_one({'_id': ObjectId(item_id)})
-                    if item_doc:
-                        if item_doc.get('User'):
-                            item_doc['User'] = decrypt_text(item_doc['User'])
-                        
-                        record['ItemDetails'] = item_doc
-                except Exception as e:
-                    app.logger.warning(f"Konnte Item {item_id} für Ausleihe {record.get('_id')} nicht laden: {e}")
+        for item in raw_items:
+            # Dynamischen Status ermitteln (wie zuvor besprochen)
+            condition_value = str(item.get('Condition', '')).strip().lower()
+            has_damage_flag = bool(item.get('HasDamage'))
+            has_reports = bool(item.get('DamageReports'))
+
+            if condition_value == 'destroyed':
+                status_text = 'Komplett zerstört'
+                status_color = 'danger'  # Rot
+            elif condition_value in ['repaired', 'fixed'] or (has_reports and not has_damage_flag):
+                status_text = 'Bereits repariert'
+                status_color = 'success'  # Grün
+            else:
+                status_text = 'Aktuelles Problem'
+                status_color = 'warning'  # Gelb
+
+            # Schadensberichte analysieren
+            damage_reports = item.get('DamageReports', [])
+            latest_report = damage_reports[-1] if damage_reports else {}
+
+            # Prüfen, ob es eine aktive oder geplante Ausleihe für dieses Item gibt
+            active_borrow = ausleihungen_col.find_one({
+                'Item': item.get('_id'),  # Suche mit ObjectId
+                'Status': {'$in': ['active', 'planned']}
+            })
+
+            # Falls die ID in der Ausleihen-Collection als String hinterlegt ist (Fallback)
+            if not active_borrow:
+                active_borrow = ausleihungen_col.find_one({
+                    'Item': str(item.get('_id')),
+                    'Status': {'$in': ['active', 'planned']}
+                })
+
+            # Benutzernamen der Ausleihe entschlüsseln
+            if active_borrow and active_borrow.get('User'):
+                active_borrow['User'] = decrypt_text(active_borrow['User'])
+
+            # Direkt am Item hinterlegten Nutzer entschlüsseln
+            item_user = decrypt_text(item.get('User')) if item.get('User') else ''
+
+            # Datenstruktur exakt für dein Jinja2 Template aufbauen
+            damaged_items.append({
+                'id': str(item['_id']),
+                'name': item.get('Name', ''),
+                'code': item.get('Code_4', ''),
+                'item_type': item.get('ItemType', ''),
+                'author': item.get('Author', item.get('Autor', '')),  # Deckt beide Schreibweisen ab
+                'isbn': item.get('ISBN', ''),
+                'borrow_user': item_user,
+                'damage_count': len(damage_reports),
+                'condition': item.get('Condition', '-'),
+                'available': item.get('Verfuegbar', False),
+
+                # Letzte Meldung
+                'latest_damage_description': latest_report.get('description', ''),
+                'latest_damage_by': latest_report.get('reported_by', ''),
+                'latest_damage_at': latest_report.get('reported_at', ''),
+
+                # Status & Ausleihe
+                'status_text': status_text,
+                'status_color': status_color,
+                'active_borrow': active_borrow
+            })
 
         return render_template(
-            'admin_damaged_items.html',  
-            ausleihungen=ausleihungen,
+            'admin_damaged_items.html',
+            damaged_items=damaged_items,
             library_module_enabled=cfg.MODULES.is_enabled('library'),
             student_cards_module_enabled=cfg.MODULES.is_enabled('student_cards'),
             mail_module_enabled=cfg.MODULES.is_enabled('mail')
         )
 
     except Exception as exc:
-        app.logger.error(f"Fehler beim Laden der Ausleihen-Verwaltung: {exc}")
-        flash('Fehler beim Laden der Ausleihen-Übersicht.', 'error')
+        app.logger.error(f"Fehler beim Laden der defekten Items: {exc}")
+        flash('Fehler beim Laden der Übersicht.', 'error')
         return redirect(url_for('home_admin'))
     finally:
         if client:
@@ -10783,7 +10843,7 @@ def admin_school_settings():
         flash('Bitte melden Sie sich mit einem administrativen Konto an.', 'error')
         return redirect(url_for('login'))
     current_permissions = us.get_effective_permissions(session['username'])
-            
+
     if not current_permissions['actions'].get('can_manage_settings', False):
         flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
         return redirect(url_for('home_admin'))
@@ -10827,21 +10887,22 @@ def admin_school_settings():
                     school_info['logo_path'] = saved_logo_filename
                     school_info['logo_thumb'] = saved_thumb_filename or ''
 
-                    # remove previous files if different
+                    fs = get_gridfs()
+                    # Remove previous logo files from GridFS if different
                     if previous_logo_path and previous_logo_path != saved_logo_filename:
-                        previous_logo_file = os.path.join(app.config['UPLOAD_FOLDER'], previous_logo_path)
-                        if os.path.exists(previous_logo_file):
-                            try:
-                                os.remove(previous_logo_file)
-                            except Exception:
-                                pass
+                        try:
+                            old_logo_file = fs.find_one({'filename': previous_logo_path})
+                            if old_logo_file:
+                                fs.delete(old_logo_file._id)
+                        except Exception:
+                            pass
                     if previous_thumb_path and previous_thumb_path != saved_thumb_filename:
-                        previous_thumb_file = os.path.join(app.config['UPLOAD_FOLDER'], previous_thumb_path)
-                        if os.path.exists(previous_thumb_file):
-                            try:
-                                os.remove(previous_thumb_file)
-                            except Exception:
-                                pass
+                        try:
+                            old_thumb_file = fs.find_one({'filename': previous_thumb_path})
+                            if old_thumb_file:
+                                fs.delete(old_thumb_file._id)
+                        except Exception:
+                            pass
             except Exception as exc:
                 flash(f'Logo konnte nicht hochgeladen werden: {exc}', 'error')
                 return redirect(url_for('admin_school_settings'))
@@ -10867,7 +10928,7 @@ def admin_school_settings():
             try:
                 updated_school = cfg.update_school_info(school_info)
                 current_school = updated_school
-                
+
                 # Also process filter names
                 filter_name_1 = request.form.get('filter_name_1')
                 if filter_name_1: it.set_filter_name(1, filter_name_1.strip())
@@ -12241,9 +12302,6 @@ def test_push_notification():
     if 'username' not in session:
         return jsonify({'success': False, 'error': 'Not authenticated'}), 401
     
-    if not us.is_admin(session['username']):
-        return jsonify({'success': False, 'error': 'Admin access required'}), 403
-    
     try:
         data = request.get_json(silent=True) or {}
         target_user = data.get('target_user', session['username'])

Web/modules/database/items.py

@@ -19,11 +19,61 @@ Collection Structure:
   - Status fields: Verfuegbar, User (if currently borrowed)
 """
 from bson.objectid import ObjectId
+from bson.errors import InvalidId
 import datetime
 import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
+import Web.modules.inventarsystem.data_protection as dp
 
 
+def safe_decrypt_user(encrypted_user):
+    """
+    Safely decrypt an encrypted username string.
+    
+    Returns the original string if decryption fails or if input is empty/None.
+    """
+    if not encrypted_user:
+        return encrypted_user
+
+    try:
+        return dp.decrypt_text(encrypted_user)
+    except Exception as e:
+        print(f"Error decrypting user data: {e}")
+        # Return fallback value or None to prevent downstream crashes
+        return "[Decryption Failed]"
+
+
+def decrypt_item_user_data(item):
+    """
+    Decrypts encrypted user fields within an inventory item document in-place.
+    
+    Args:
+        item (dict): MongoDB document representing an item.
+        
+    Returns:
+        dict: The item with decrypted user fields.
+    """
+    if not item:
+        return item
+
+    # 1. Decrypt top-level 'User' field if present
+    if 'User' in item and item['User']:
+        item['User'] = safe_decrypt_user(item['User'])
+
+    # 2. Decrypt nested 'user' field in 'NextAppointment' if present
+    if 'NextAppointment' in item and isinstance(item['NextAppointment'], dict):
+        if 'user' in item['NextAppointment']:
+            item['NextAppointment']['user'] = safe_decrypt_user(item['NextAppointment']['user'])
+
+    return item
+
+def _to_object_id(id_str):
+    """Safely convert a string to ObjectId."""
+    try:
+        return ObjectId(id_str)
+    except (InvalidId, TypeError):
+        return None
+
 LIBRARY_ITEM_TYPES = ('book', 'cd', 'dvd', 'other', 'schoolbook', 'Buch', 'Schulbuch', 'schulbuch')
 
 
@@ -52,7 +102,7 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
              isbn=None, item_type='general', library_category=None, is_library=False):
     """
     Add a new item to the inventory.
-    
+
     Args:
         name (str): Name of the item
         ort (str): Location of the item
@@ -73,7 +123,7 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
         isbn (str, optional): ISBN for books or media items
         item_type (str, optional): Type of the item (e.g., 'general', 'book', 'cd')
         library_category (str, optional): Library category for the item
-        
+
     Returns:
         ObjectId: ID of the new item or None if failed
     """
@@ -102,7 +152,7 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
             'ISBN': isbn,
             'library_category': library_category,
             'ItemType': item_type,
-            'is_library': is_library, 
+            'is_library': is_library,
             'SeriesGroupId': series_group_id,
             'SeriesCount': series_count,
             'SeriesPosition': series_position,
@@ -124,10 +174,10 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
 def remove_item(id):
     """
     Soft-delete an item from the inventory.
-    
+
     Args:
         id (str): ID of the item to remove
-        
+
     Returns:
         bool: True if successful, False otherwise
     """
@@ -199,21 +249,19 @@ def get_group_item_ids(id):
         return []
 
 
-def update_item(id, name, ort, beschreibung, images, verfuegbar, filter1, filter2, filter3, 
+def update_item(id, name, ort, beschreibung, images, verfuegbar, filter1, filter2, filter3,
                 ansch_jahr, ansch_kost, code_4, reservierbar, isbn=None, item_type='general'):
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         items = db['items']
 
-        # 1. Altes Item laden, um SeriesGroupId zu bestimmen
         old_item = items.find_one({'_id': ObjectId(id)})
         if not old_item:
             return False
-            
+
         series_group_id = old_item.get('SeriesGroupId')
 
-        # 2. Shared Data: Daten, die für ALLE in der Gruppe gleich sind
         shared_update = {
             'Name': name,
             'Ort': ort,
@@ -227,18 +275,15 @@ def update_item(id, name, ort, beschreibung, images, verfuegbar, filter1, filter
             'Reservierbar': reservierbar,
             'ISBN': isbn,
             'ItemType': item_type,
-            'Verfuegbar': verfuegbar, # Wir behalten den Status bei
+            'Verfuegbar': verfuegbar,
             'LastUpdated': datetime.datetime.now()
         }
 
-        # 3. Spezifische Daten: Was NICHT synchronisiert wird
         specific_update = shared_update.copy()
         specific_update['Code_4'] = code_4
 
-        # 4. Das aktuelle Item updaten
         items.update_one({'_id': ObjectId(id)}, {'$set': specific_update})
 
-        # 5. Alle anderen Gruppen-Mitglieder synchronisieren
         if series_group_id:
             items.update_many(
                 {
@@ -257,12 +302,12 @@ def update_item(id, name, ort, beschreibung, images, verfuegbar, filter1, filter
 def update_item_status(id, verfuegbar, user=None):
     """
     Update the availability status of an inventory item.
-    
+
     Args:
         id (str): ID of the item to update
         verfuegbar (bool): New availability status
         user (str, optional): Username of person who borrowed the item
-        
+
     Returns:
         bool: True if successful, False otherwise
     """
@@ -279,7 +324,7 @@ def update_item_status(id, verfuegbar, user=None):
         update_query = {'$set': update_data}
 
         if user is not None:
-            update_data['User'] = user
+            update_data['User'] = dp.encrypt_text(user)
         elif verfuegbar:
             # If item is being marked as available, clear the user field
             update_query['$unset'] = {'User': ""}
@@ -299,11 +344,11 @@ def update_item_status(id, verfuegbar, user=None):
 def update_item_exemplare_status(id, exemplare_status):
     """
     Update the exemplar status of an inventory item.
-    
+
     Args:
         id (str): ID of the item to update
         exemplare_status (list): List of status objects for each exemplar
-        
+
     Returns:
         bool: True if successful, False otherwise
     """
@@ -332,32 +377,32 @@ def update_item_exemplare_status(id, exemplare_status):
 def is_code_unique(code_4, exclude_id=None):
     """
     Check if a given code is unique (not used by any other item).
-    
+
     Args:
         code_4 (str): The code to check
         exclude_id (str, optional): ID of item to exclude from the check (for edit operations)
-        
+
     Returns:
         bool: True if code is unique, False if already in use
     """
     if not code_4 or code_4.strip() == "":
         # Empty codes are not considered unique
         return False
-        
+
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = client[cfg.MONGODB_DB]
     items = db['items']
-    
+
     # Build query to find items with this code
     query = {'Code_4': code_4, 'Deleted': {'$ne': True}}
-    
+
     # If we're editing an item, exclude it from the uniqueness check
     if exclude_id:
         query['_id'] = {'$ne': ObjectId(exclude_id)}
-    
+
     # Check if any items with this code exist
     count = items.count_documents(query)
-    
+
     client.close()
     return count == 0
 
@@ -367,7 +412,7 @@ def is_code_unique(code_4, exclude_id=None):
 def get_items():
     """
     Retrieve all inventory items.
-    
+
     Returns:
         list: List of all inventory item documents with string IDs
     """
@@ -390,7 +435,7 @@ def get_items():
 def get_available_items():
     """
     Retrieve all available inventory items.
-    
+
     Returns:
         list: List of available inventory item documents with string IDs
     """
@@ -413,7 +458,7 @@ def get_available_items():
 def get_borrowed_items():
     """
     Retrieve all currently borrowed inventory items.
-    
+
     Returns:
         list: List of borrowed inventory item documents with string IDs
     """
@@ -432,36 +477,36 @@ def get_borrowed_items():
         print(f"Error retrieving borrowed items: {e}")
         return []
 
+def get_item(id, decrypt=True):
+    """
+    Retrieve an inventory item by ID, with optional decryption.
+    """
+    item_id = _to_object_id(id)
+    if not item_id:
+        return None
 
-def get_item(id):
-    """
-    Retrieve a specific inventory item by its ID.
-    
-    Args:
-        id (str): ID of the item to retrieve
-        
-    Returns:
-        dict: The inventory item document or None if not found
-    """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         items = db['items']
-        item = items.find_one(_active_record_query({'_id': ObjectId(id)}))
-        client.close()
+        query = _active_record_query({'_id': item_id})
+        item = items.find_one(query)
+        if item:
+            item['_id'] = str(item['_id'])
+            if decrypt:
+                decrypt_item_user_data(item)
         return item
     except Exception as e:
-        print(f"Error retrieving item: {e}")
+        print(f"Error retrieving item {id}: {e}")
         return None
 
-
 def get_item_by_name(name):
     """
     Retrieve a specific inventory item by its name.
-    
+
     Args:
         name (str): Name of the item to retrieve
-        
+
     Returns:
         dict: The inventory item document or None if not found
     """
@@ -480,10 +525,10 @@ def get_item_by_name(name):
 def get_items_by_filter(filter_value):
     """
     Retrieve inventory items matching a specific filter/category.
-    
+
     Args:
         filter_value (str): Filter value to search for
-        
+
     Returns:
         list: List of items matching the filter in primary, secondary, or tertiary category
     """
@@ -491,7 +536,7 @@ def get_items_by_filter(filter_value):
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         items = db['items']
-        
+
         # Use $or to find matches in any filter field
         query = _active_record_query(_non_library_query({
             '$or': [
@@ -500,14 +545,14 @@ def get_items_by_filter(filter_value):
                 {'Filter3': filter_value}
             ]
         }))
-        
+
         results = list(items.find(query))
         client.close()
-        
+
         # Convert ObjectId to string
         for item in results:
             item['_id'] = str(item['_id'])
-            
+
         return results
     except Exception as e:
         print(f"Error retrieving items by filter: {e}")
@@ -517,7 +562,7 @@ def get_items_by_filter(filter_value):
 def get_filters():
     """
     Retrieve all unique filter/category values from the inventory.
-    
+
     Returns:
         list: Combined list of all primary, secondary and tertiary filter values
     """
@@ -529,16 +574,16 @@ def get_filters():
         filters = items.distinct('Filter', non_library)
         filters2 = items.distinct('Filter2', non_library)
         filters3 = items.distinct('Filter3', non_library)
-        
+
         # Combine filters and remove None/empty values
         all_filters = [f for f in filters + filters2 + filters3 if f]
-        
+
         # Remove duplicates while preserving order
         unique_filters = []
         for f in all_filters:
             if f not in unique_filters:
                 unique_filters.append(f)
-                
+
         client.close()
         return unique_filters
     except Exception as e:
@@ -549,7 +594,7 @@ def get_filters():
 def get_primary_filters():
     """
     Retrieve all unique primary filter values.
-    
+
     Returns:
         list: List of all primary filter values
     """
@@ -559,7 +604,7 @@ def get_primary_filters():
         items = db['items']
         filters = [f for f in items.distinct('Filter', _active_record_query(_non_library_query())) if f]
         client.close()
-        
+
         # Add predefined values
         predefined = get_predefined_filter_values(1)
         return sorted(list(set(filters + predefined)))
@@ -571,7 +616,7 @@ def get_primary_filters():
 def get_secondary_filters():
     """
     Retrieve all unique secondary filter values.
-    
+
     Returns:
         list: List of all secondary filter values
     """
@@ -581,7 +626,7 @@ def get_secondary_filters():
         items = db['items']
         filters = [f for f in items.distinct('Filter2', _active_record_query(_non_library_query())) if f]
         client.close()
-        
+
         # Add predefined values
         predefined = get_predefined_filter_values(2)
         return sorted(list(set(filters + predefined)))
@@ -593,7 +638,7 @@ def get_secondary_filters():
 def get_tertiary_filters():
     """
     Retrieve all unique tertiary filter values.
-    
+
     Returns:
         list: List of all tertiary filter values
     """
@@ -603,7 +648,7 @@ def get_tertiary_filters():
         items = db['items']
         filters = [f for f in items.distinct('Filter3', _active_record_query(_non_library_query())) if f]
         client.close()
-        
+
         # Add predefined values
         predefined = get_predefined_filter_values(3)
         return sorted(list(set(filters + predefined)))
@@ -615,10 +660,10 @@ def get_tertiary_filters():
 def get_item_by_code_4(code_4):
     """
     Retrieve inventory items matching a specific 4-digit code.
-    
+
     Args:
         code_4 (str): 4-digit code to search for
-        
+
     Returns:
         list: List of items matching the code
     """
@@ -627,11 +672,11 @@ def get_item_by_code_4(code_4):
         db = client[cfg.MONGODB_DB]
         items = db['items']
         results = list(items.find(_active_record_query(_non_library_query({"Code_4": code_4}))))
-        
+
         # Convert ObjectId to string
         for item in results:
             item['_id'] = str(item['_id'])
-            
+
         client.close()
         return results
     except Exception as e:
@@ -645,10 +690,10 @@ def unstuck_item(id):
     """
     Remove all borrowing records for a specific item to reset its status.
     Used to fix problematic or stuck items.
-    
+
     Args:
         id (str): ID of the item to unstick
-        
+
     Returns:
         bool: True if successful, False otherwise
     """
@@ -664,7 +709,7 @@ def unstuck_item(id):
                 'LastUpdated': datetime.datetime.now()
             }}
         )
-        
+
         # Also reset the item status
         items = db['items']
         items.update_one(
@@ -677,7 +722,7 @@ def unstuck_item(id):
                 '$unset': {'User': ""}
             }
         )
-        
+
         client.close()
         return True
     except Exception as e:
@@ -688,24 +733,24 @@ def unstuck_item(id):
 def get_predefined_filter_values(filter_num):
     """
     Get predefined values for a specific filter.
-    
+
     Args:
         filter_num (int): Filter number (1 for Unterrichtsfach, 2 for Jahrgangsstufe)
-        
+
     Returns:
         list: List of predefined filter values
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = client[cfg.MONGODB_DB]
-    
+
     # Use a dedicated collection for filter presets
     filter_presets = db['filter_presets']
-    
+
     # Find the document for the specified filter
     filter_doc = filter_presets.find_one({'filter_num': filter_num})
-    
+
     client.close()
-    
+
     if filter_doc and 'values' in filter_doc:
         # Sort values alphabetically
         return sorted(filter_doc['values'])
@@ -725,60 +770,60 @@ def get_predefined_filter_values(filter_num):
 def add_predefined_filter_value(filter_num, value):
     """
     Add a new predefined value to a filter.
-    
+
     Args:
         filter_num (int): Filter number (1 for Unterrichtsfach, 2 for Jahrgangsstufe)
         value (str): Value to add
-        
+
     Returns:
         bool: True if value was added, False if it already existed
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = client[cfg.MONGODB_DB]
     filter_presets = db['filter_presets']
-    
+
     # Check if value already exists
     filter_doc = filter_presets.find_one({
         'filter_num': filter_num,
         'values': value
     })
-    
+
     if filter_doc:
         # Value already exists
         client.close()
         return False
-    
+
     # Add the value to the filter
     result = filter_presets.update_one(
         {'filter_num': filter_num},
         {'$push': {'values': value}},
         upsert=True
     )
-    
+
     client.close()
     return result.modified_count > 0 or result.upserted_id is not None
 
 def remove_predefined_filter_value(filter_num, value):
     """
     Remove a predefined value from a filter.
-    
+
     Args:
         filter_num (int): Filter number (1 for Unterrichtsfach, 2 for Jahrgangsstufe)
         value (str): Value to remove
-        
+
     Returns:
         bool: True if value was removed, False otherwise
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = client[cfg.MONGODB_DB]
     filter_presets = db['filter_presets']
-    
+
     # Remove the value from the filter
     result = filter_presets.update_one(
         {'filter_num': filter_num},
         {'$pull': {'values': value}}
     )
-    
+
     client.close()
     return result.modified_count > 0
 
@@ -786,45 +831,45 @@ def remove_predefined_filter_value(filter_num, value):
 def edit_predefined_filter_value(filter_num, old_value, new_value):
     """
     Edit a predefined value from a filter and update all matching items.
-    
+
     Args:
         filter_num (int): Filter number (1 for Unterrichtsfach, 2 for Jahrgangsstufe)
         old_value (str): Value to replace
         new_value (str): New value
-        
+
     Returns:
         bool: True if value was updated, False otherwise
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = client[cfg.MONGODB_DB]
     filter_presets = db['filter_presets']
-    
+
     # Check if the new value already exists
     existing = filter_presets.find_one({
         'filter_num': filter_num,
         'values': new_value
     })
-    
+
     if existing and old_value != new_value:
         client.close()
         return False
-        
+
     # Update the value in the filter
     result = filter_presets.update_one(
         {'filter_num': filter_num, 'values': old_value},
         {'$set': {'values.$': new_value}}
     )
-    
+
     if result.modified_count > 0:
         items = db['items']
         filter_field = 'Filter' if filter_num == 1 else f'Filter{filter_num}'
-        
+
         # Also update all items that use this filter
         items.update_many(
             {filter_field: old_value},
             {'$set': {filter_field: new_value}}
         )
-        
+
     client.close()
     return result.modified_count > 0
 
@@ -862,22 +907,22 @@ def set_filter_name(filter_num, name):
 def get_predefined_locations():
     """
     Get list of all predefined locations/placement options.
-    
+
     Returns:
         list: List of predefined location strings
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
-        
+
         # Check if settings collection exists, create if not
         if 'settings' not in db.list_collection_names():
             db.create_collection('settings')
-        
+
         # Get settings document or create if it doesn't exist
         settings_collection = db['settings']
         location_settings = settings_collection.find_one({'setting_type': 'predefined_locations'})
-        
+
         if not location_settings:
             # Create default settings document if it doesn't exist
             settings_collection.insert_one({
@@ -885,12 +930,12 @@ def get_predefined_locations():
                 'locations': []
             })
             return []
-        
+
         # Return the predefined locations
         locations = location_settings.get('locations', [])
         client.close()
         return sorted(locations)
-        
+
     except Exception as e:
         print(f"Error getting predefined locations: {str(e)}")
         return []
@@ -899,28 +944,28 @@ def get_predefined_locations():
 def add_predefined_location(location):
     """
     Add a new predefined location.
-    
+
     Args:
         location (str): Location to add
-        
+
     Returns:
         bool: True if added successfully, False if already exists
     """
     if not location or not isinstance(location, str):
         return False
-    
+
     location = location.strip()
     if not location:
         return False
-        
+
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         settings_collection = db['settings']
-        
+
         # Check if settings document exists, create if not
         location_settings = settings_collection.find_one({'setting_type': 'predefined_locations'})
-        
+
         if not location_settings:
             # Create with the new location
             settings_collection.insert_one({
@@ -929,22 +974,22 @@ def add_predefined_location(location):
             })
             client.close()
             return True
-        
+
         # Check if location already exists (case-insensitive)
         current_locations = location_settings.get('locations', [])
         if any(loc.lower() == location.lower() for loc in current_locations):
             client.close()
             return False
-        
+
         # Add the new location
         settings_collection.update_one(
             {'setting_type': 'predefined_locations'},
             {'$push': {'locations': location}}
         )
-        
+
         client.close()
         return True
-        
+
     except Exception as e:
         print(f"Error adding predefined location: {str(e)}")
         return False
@@ -953,29 +998,29 @@ def add_predefined_location(location):
 def remove_predefined_location(location):
     """
     Remove a predefined location.
-    
+
     Args:
         location (str): Location to remove
-        
+
     Returns:
         bool: True if removed successfully
     """
     if not location:
         return False
-        
+
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         settings_collection = db['settings']
-        
+
         result = settings_collection.update_one(
             {'setting_type': 'predefined_locations'},
             {'$pull': {'locations': location}}
         )
-        
+
         client.close()
         return result.modified_count > 0
-        
+
     except Exception as e:
         print(f"Error removing predefined location: {str(e)}")
         return False
@@ -984,17 +1029,12 @@ def remove_predefined_location(location):
 def update_item_next_appointment(item_id, appointment_data):
     """
     Update an item with information about its next scheduled appointment.
-    
+
     Args:
-        item_id (str): ID of the item to update
-        appointment_data (dict): Appointment information containing:
-            - date: Date of the appointment
-            - start_period: Start period number
-            - end_period: End period number
-            - user: Username who scheduled the appointment
-            - notes: Optional notes
-            - appointment_id: ID of the appointment booking
-            
+        item_id (str): ID of the item
+        appointment_data (dict or None): Dictionary containing appointment details
+                                         (e.g., user, start_time, end_time) or None to clear it.
+
     Returns:
         bool: True if successful, False otherwise
     """
@@ -1002,35 +1042,33 @@ def update_item_next_appointment(item_id, appointment_data):
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         items = db['items']
-        
-        # Format the appointment data for storage
-        # Ensure date is a datetime object for MongoDB storage
-        appointment_date = appointment_data['date']
-        if isinstance(appointment_date, datetime.date) and not isinstance(appointment_date, datetime.datetime):
-            # Convert date to datetime for MongoDB compatibility
-            appointment_date = datetime.datetime.combine(appointment_date, datetime.time())
-        
-        next_appointment = {
-            'date': appointment_date,
-            'end_date': appointment_data.get('end_date', appointment_date),
-            'start_period': appointment_data['start_period'],
-            'end_period': appointment_data['end_period'],
-            'user': appointment_data['user'],
-            'notes': appointment_data.get('notes', ''),
-            'appointment_id': appointment_data['appointment_id'],
-            'scheduled_at': datetime.datetime.now()
-        }
-        
-        update_data = {
-            'NextAppointment': next_appointment,
-            'LastUpdated': datetime.datetime.now()
-        }
-        
+
+        # If clearing the appointment
+        if appointment_data is None:
+            update_query = {
+                '$unset': {'NextAppointment': ""},
+                '$set': {'LastUpdated': datetime.datetime.now()}
+            }
+        else:
+            # Create a copy so we don't mutate the original dictionary passed in
+            data_to_save = appointment_data.copy()
+
+            # Encrypt the user field if it exists to match the decryption logic at the top
+            if 'user' in data_to_save and data_to_save['user']:
+                data_to_save['user'] = dp.encrypt_text(data_to_save['user'])
+
+            update_query = {
+                '$set': {
+                    'NextAppointment': data_to_save,
+                    'LastUpdated': datetime.datetime.now()
+                }
+            }
+
         result = items.update_one(
             {'_id': ObjectId(item_id)},
-            {'$set': update_data}
+            update_query
         )
-        
+
         client.close()
         return result.modified_count > 0
     except Exception as e:
@@ -1041,10 +1079,10 @@ def update_item_next_appointment(item_id, appointment_data):
 def clear_item_next_appointment(item_id):
     """
     Clear the next appointment information from an item.
-    
+
     Args:
         item_id (str): ID of the item to update
-        
+
     Returns:
         bool: True if successful, False otherwise
     """
@@ -1052,12 +1090,12 @@ def clear_item_next_appointment(item_id):
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         items = db['items']
-        
+
         result = items.update_one(
             {'_id': ObjectId(item_id)},
             {'$unset': {'NextAppointment': ""}, '$set': {'LastUpdated': datetime.datetime.now()}}
         )
-        
+
         client.close()
         return result.modified_count > 0
     except Exception as e:
@@ -1068,7 +1106,7 @@ def clear_item_next_appointment(item_id):
 def get_items_with_appointments():
     """
     Retrieve all items that have scheduled appointments.
-    
+
     Returns:
         list: List of items with NextAppointment field
     """
@@ -1076,7 +1114,7 @@ def get_items_with_appointments():
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         items = db['items']
-        
+
         items_return = items.find({'NextAppointment': {'$exists': True}, 'Deleted': {'$ne': True}})
         items_list = []
         for item in items_return:
@@ -1088,31 +1126,25 @@ def get_items_with_appointments():
         print(f"Error retrieving items with appointments: {e}")
         return []
 
-def get_current_status(item_id):
+def get_current_status(item_id, decrypt=True):
     """
-    Retrieve the current status of an item, including availability and user.
-    
-    Args:
-        item_id (str): ID of the item to check
-        
-    Returns:
-        dict: Current status of the item or None if not found
+    Retrieve the current status of an item, decrypting the user field if present.
     """
+    oid = _to_object_id(item_id)
+    if not oid:
+        return None
+
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         items = db['items']
-        
-        item = items.find_one({'_id': ObjectId(item_id)}, {'Verfuegbar': 1, 'User': 1})
-        
+        item = items.find_one({'_id': oid}, {'Verfuegbar': 1, 'User': 1})
         if item:
-            # Convert ObjectId to string for consistency
             item['_id'] = str(item['_id'])
-            client.close()
+            if decrypt:
+                decrypt_item_user_data(item)
             return item
-        else:
-            client.close()
-            return None
+        return None
     except Exception as e:
-        print(f"Error retrieving current status: {e}")
+        print(f"Error retrieving current status for item {item_id}: {e}")
         return None

Web/modules/database/settings.py

@@ -319,15 +319,15 @@ THUMBNAIL_FOLDER = _get(_conf, ['upload', 'thumbnail_folder'], DEFAULTS['upload'
 PREVIEW_FOLDER = _get(_conf, ['upload', 'preview_folder'], DEFAULTS['upload']['preview_folder'])
 QR_CODE_FOLDER = _get(_conf, ['upload', 'qrcode_folder'], DEFAULTS['upload']['qrcode_folder'])
 
-# Normalize to absolute paths to avoid cwd issues
+# This guarantees exact matching with Docker volume mounts
 if not os.path.isabs(UPLOAD_FOLDER):
-    UPLOAD_FOLDER = os.path.join(BASE_DIR, os.path.relpath(UPLOAD_FOLDER, BASE_DIR))
+    UPLOAD_FOLDER = os.path.abspath(os.path.join(BASE_DIR, "uploads"))
 if not os.path.isabs(THUMBNAIL_FOLDER):
-    THUMBNAIL_FOLDER = os.path.join(BASE_DIR, os.path.relpath(THUMBNAIL_FOLDER, BASE_DIR))
+    THUMBNAIL_FOLDER = os.path.abspath(os.path.join(BASE_DIR, "thumbnails"))
 if not os.path.isabs(PREVIEW_FOLDER):
-    PREVIEW_FOLDER = os.path.join(BASE_DIR, os.path.relpath(PREVIEW_FOLDER, BASE_DIR))
+    PREVIEW_FOLDER = os.path.abspath(os.path.join(BASE_DIR, "previews"))
 if not os.path.isabs(QR_CODE_FOLDER):
-    QR_CODE_FOLDER = os.path.join(BASE_DIR, os.path.relpath(QR_CODE_FOLDER, BASE_DIR))
+    QR_CODE_FOLDER = os.path.abspath(os.path.join(BASE_DIR, "QRCodes"))
 MAX_UPLOAD_MB = _get(_conf, ['upload', 'max_size_mb'], DEFAULTS['upload']['max_size_mb'])
 IMAGE_MAX_UPLOAD_MB = _get(_conf, ['upload', 'image_max_size_mb'], DEFAULTS['upload']['image_max_size_mb'])
 VIDEO_MAX_UPLOAD_MB = _get(_conf, ['upload', 'video_max_size_mb'], DEFAULTS['upload']['video_max_size_mb'])

Web/modules/database/user.py

@@ -20,6 +20,7 @@ import string
 from bson.objectid import ObjectId
 import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
+import Web.modules.inventarsystem.data_protection as dp
 import hmac
 import os
 
@@ -109,13 +110,6 @@ def build_username_from_name(first_name, last_name=''):
     """
     Build a deterministic username abbreviation from first and last name.
     Uses 3 letters from each name and stores it lowercase.
-    
-    Args:
-        first_name (str): First name
-        last_name (str): Last name (optional)
-        
-    Returns:
-        str: Generated username
     """
     alias = build_name_synonym(first_name, last_name)
     return alias.lower()
@@ -324,7 +318,6 @@ def get_effective_permissions(username):
         return build_default_permission_payload('full_access')
 
     preset_key = user.get('PermissionPreset')
-    print(preset_key)
     payload = build_default_permission_payload(preset_key)
     payload['actions'] = _normalize_bool_map(user.get('ActionPermissions', {}), payload['actions'])
     payload['pages'] = _normalize_bool_map(user.get('PagePermissions', {}), payload['pages'])
@@ -352,10 +345,10 @@ def update_user_permissions(username, preset_key, action_permissions=None, page_
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.update_one({'Username': username}, {'$set': update_data})
+    result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': update_data})
 
     if result.matched_count == 0:
-        result = users.update_one({'username': username}, {'$set': update_data})
+        result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': update_data})
 
     client.close()
     return result.matched_count > 0
@@ -367,7 +360,7 @@ def get_favorites(username):
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': username}) or users.find_one({'username': username})
+    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
     client.close()
     if not user:
         return []
@@ -382,7 +375,7 @@ def add_favorite(username, item_id):
         db = _get_tenant_db(client)
         users = db['users']
         users.update_one(
-            {'$or': [{'Username': username}, {'username': username}]},
+            {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]},
             {'$addToSet': {'favorites': ObjectId(item_id)}}
         )
         client.close()
@@ -397,7 +390,7 @@ def remove_favorite(username, item_id):
         db = _get_tenant_db(client)
         users = db['users']
         users.update_one(
-            {'$or': [{'Username': username}, {'username': username}]},
+            {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]},
             {'$pull': {'favorites': ObjectId(item_id)}}
         )
         client.close()
@@ -406,16 +399,9 @@ def remove_favorite(username, item_id):
         return False
 
 
-
 def check_password_strength(password):
     """
     Check if a password meets minimum security requirements.
-    
-    Args:
-        password (str): Password to check
-        
-    Returns:
-        bool: True if password is strong enough, False otherwise
     """
     if password is None:
         return False
@@ -435,19 +421,15 @@ def check_password_strength(password):
 
 def hashing(password, salt=None):
     """
-    Hasht ein Passwort mit scrypt. 
-    - Wenn kein Salt übergeben wird, wird ein sicherer, zufälliger Salt generiert (für neue Passwörter).
-    - Format für neue Hashes: v1$<salt_hex>$<hash_hex>
+    Hasht ein Passwort mit scrypt.
     """
-    password_bytes = password.encode('utf-8') # Explizit UTF-8 für Plattformunabhängigkeit
-    
+    password_bytes = password.encode('utf-8')
+
     if salt is None:
-        # Neuer Benutzer / Passwortänderung -> Dynamischer Salt
         random_salt = os.urandom(16)
         hashed = hashlib.scrypt(password_bytes, salt=random_salt, n=16384, r=8, p=1)
         return f"v1${random_salt.hex()}${hashed.hex()}"
     else:
-        # Bestehender Benutzer (wird zur Verifizierung aufgerufen)
         hashed = hashlib.scrypt(password_bytes, salt=salt, n=16384, r=8, p=1)
         return hashed.hex()
 
@@ -455,25 +437,20 @@ def hashing(password, salt=None):
 def verify_password(provided_password, stored_password_string):
     """
     Verifiziert ein Passwort gegen einen gespeicherten Hash-String.
-    Unterstützt das alte Format (statischer Salt) und das neue Format (v1$...).
     """
     if not stored_password_string:
         return False
 
-    # Überprüfung für das neue, sichere Format
     if stored_password_string.startswith("v1$"):
         try:
             _, salt_hex, hash_hex = stored_password_string.split("$")
             salt_bytes = bytes.fromhex(salt_hex)
-            # Berechne den Hash des eingegebenen Passworts mit dem extrahierten Salt
             calculated_hash = hashing(provided_password, salt=salt_bytes)
-            # Timing-Attack-sicherer Vergleich
             return hmac.compare_digest(calculated_hash, hash_hex)
         except (ValueError, TypeError):
             logger.error("Ungültiges Hash-Format in der Datenbank entdeckt.")
             return False
     else:
-        # Abwärtskompatibilität: Altes Format mit statischem Salt b'some_salt'
         old_static_salt = b'some_salt'
         calculated_hash = hashing(provided_password, salt=old_static_salt)
         return hmac.compare_digest(calculated_hash, stored_password_string)
@@ -494,22 +471,26 @@ def check_nm_pwd(username, password):
     try:
         db = client[db_name]
         users = db['users']
-        
-        query = {'$or': [{'Username': username}, {'username': username}]}
+
+        query = {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]}
         user_record = users.find_one(query)
 
         if user_record is None:
-            logger.warning("Kein Benutzer für %r in DB %r gefunden.", username, db_name)
-            return None
+            query = {'$or': [{'Username': username}, {'username': username}]}
+            user_record_fallback = users.find_one(query)
+            if user_record_fallback is None:
+                logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
+                return None
+            else:
+                user_record = user_record_fallback
 
         stored_password = user_record.get('Password') or user_record.get('password')
-        
+
         if not verify_password(password, stored_password):
-            logger.warning("Falsches Passwort für Benutzer %r in DB %r.", username, db_name)
+            logger.warning("Falsches Passwort für Benutzer %r in DB %r.", dp.encrypt_text(username), db_name)
             return None
 
-        # Automatische Migration alter Hashes auf das neue Format
-        if not stored_password.startswith("v1$"):
+        if stored_password and not stored_password.startswith("v1$"):
             users.update_one({'_id': user_record['_id']}, {'$set': {'Password': hashing(password)}})
 
         return user_record
@@ -531,40 +512,35 @@ def add_user(
 ):
     """
     Add a new user to the database.
-    
-    Args:
-        username (str): Username for the new user
-        password (str): Password for the new user
-        
-    Returns:
-        bool: True if user was added successfully, False if password was too weak
     """
+    if not check_password_strength(password):
+        return False
+
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     try:
         db = _get_tenant_db(client)
         users = db['users']
-        if not check_password_strength(password):
-            return False
+
         permission_defaults = build_default_permission_payload(permission_preset)
+
         if isinstance(action_permissions, dict):
             for key, value in action_permissions.items():
                 permission_defaults['actions'][str(key)] = bool(value)
+
         if isinstance(page_permissions, dict):
             for key, value in page_permissions.items():
                 permission_defaults['pages'][str(key)] = bool(value)
 
-        if permission_preset == "full_access":
-            can_admin_preset_based = True 
-        else:
-            can_admin_preset_based = False
-        
+        safe_name = name.strip() if name else ''
+        safe_last_name = last_name.strip() if last_name else ''
+
         user_doc = {
-            'Username': username,
+            'Username': dp.encrypt_text(username),
             'Password': hashing(password),
-            'Admin': can_admin_preset_based,
+            'Admin': (permission_preset == "full_access"),
             'active_ausleihung': None,
-            'name': name.strip() if name else '',
-            'last_name': last_name.strip() if last_name else '',
+            'name': dp.encrypt_text(safe_name) if safe_name else '',
+            'last_name': dp.encrypt_text(safe_last_name) if safe_last_name else '',
             'IsStudent': bool(is_student),
             'PermissionPreset': permission_defaults['preset'],
             'ActionPermissions': permission_defaults['actions'],
@@ -601,7 +577,7 @@ def student_card_exists(student_card_id):
 
 
 def get_user_by_student_card(student_card_id):
-    """Return user by student card id or None."""
+    """Return user dict by student card id or None."""
     normalized = normalize_student_card_id(student_card_id)
     if not normalized:
         return None
@@ -610,65 +586,44 @@ def get_user_by_student_card(student_card_id):
     users = db['student_cards']
     found_user = users.find_one({'SchülerName': normalized})
     client.close()
+
+    # Do not call dp.decrypt_text() here because found_user is a MongoDB dictionary.
     return found_user
 
 
 def make_admin(username):
-    """
-    Grant administrator privileges to a user.
-    
-    Args:
-        username (str): Username of the user to promote
-        
-    Returns:
-        bool: True if user was promoted successfully
-    """
+    """Grant administrator privileges to a user."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.update_one({'Username': username}, {'$set': {'Admin': True}})
+    result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': True}})
     if result.matched_count == 0:
-        result = users.update_one({'username': username}, {'$set': {'Admin': True}})
+        result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': True}})
     client.close()
     return result.matched_count > 0
 
+
 def remove_admin(username):
-    """
-    Remove administrator privileges from a user.
-    
-    Args:
-        username (str): Username of the user to demote
-        
-    Returns:
-        bool: True if user was demoted successfully
-    """
+    """Remove administrator privileges from a user."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.update_one({'Username': username}, {'$set': {'Admin': False}})
+    result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': False}})
     if result.matched_count == 0:
-        result = users.update_one({'username': username}, {'$set': {'Admin': False}})
+        result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': False}})
     client.close()
     return result.matched_count > 0
 
+
 def get_user(username):
-    """
-    Retrieve a specific user by username.
-    
-    Args:
-        username (str): Username to search for
-        
-    Returns:
-        dict: User document or None if not found
-    """
+    """Retrieve a specific user by username."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     try:
         def find_in_db(database_name):
             db = client[database_name]
             users = db['users']
-            return users.find_one({'Username': username}) or users.find_one({'username': username})
+            return users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'username': username}) or users.find_one({'Username': username})
 
-        # Try current tenant first when available
         tenant_db, tenant_id = _resolve_request_tenant_db()
         if tenant_db:
             user = find_in_db(tenant_db)
@@ -681,7 +636,6 @@ def get_user(username):
             )
             return None
 
-        # Fallback to default configured database
         user = find_in_db(cfg.MONGODB_DB)
         if user:
             return user
@@ -692,147 +646,89 @@ def get_user(username):
 
 
 def check_admin(username):
-    """
-    Check if a user has administrator privileges.
-    
-    Args:
-        username (str): Username to check
-        
-    Returns:
-        bool: True if user is an administrator, False otherwise
-    """
+    """Check if a user has administrator privileges."""
     user = get_user(username)
     return bool(user and user.get('Admin', False))
 
 
 def update_active_ausleihung(username, id_item, ausleihung):
-    """
-    Update a user's active borrowing record.
-    
-    Args:
-        username (str): Username of the user
-        id_item (str): ID of the borrowed item
-        ausleihung (str): ID of the borrowing record
-        
-    Returns:
-        bool: True if successful
-    """
+    """Update a user's active borrowing record."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    users.update_one({'Username': username}, {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}})
+
+    result = users.update_one(
+        {'Username': dp.encrypt_text(username)},
+        {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}}
+    )
+    if result.matched_count == 0:
+        users.update_one(
+            {'username': dp.encrypt_text(username)},
+            {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}}
+        )
     client.close()
     return True
 
 
 def get_active_ausleihung(username):
-    """
-    Get a user's active borrowing record.
-    
-    Args:
-        username (str): Username of the user
-        
-    Returns:
-        dict: Active borrowing information or None
-    """
+    """Get a user's active borrowing record."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': username})
-    return user['active_ausleihung']
+
+    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
+    client.close()
+
+    if not user:
+        return None
+    return user.get('active_ausleihung')
 
 
 def has_active_borrowing(username):
-    """
-    Check if a user currently has an active borrowing.
-    
-    Args:
-        username (str): Username to check
-        
-    Returns:
-        bool: True if user has an active borrowing, False otherwise
-    """
+    """Check if a user currently has an active borrowing."""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         users = db['users']
-        
-        user = users.find_one({'username': username})
-        if not user:
-            user = users.find_one({'Username': username})
-            
-        if not user:
-            client.close()
-            return False
-            
-        has_active = user.get('active_borrowing', False)
-        
+
+        user = users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'Username': dp.encrypt_text(username)})
         client.close()
-        return has_active
+
+        if not user:
+            return False
+
+        return user.get('active_borrowing', False)
     except Exception as e:
         return False
 
 
 def delete_user(username):
-    """
-    Delete a user from the database.
-    Administrative function for removing user accounts.
-    
-    Args:
-        username (str): Username of the account to delete
-        
-    Returns:
-        bool: True if user was deleted successfully, False otherwise
-    """
+    """Delete a user from the database."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.delete_one({'username': username})
-    client.close()
+
+    result = users.delete_one({'username': dp.encrypt_text(username)})
     if result.deleted_count == 0:
-        # Try with different field name
-        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = _get_tenant_db(client)
-        users = db['users']
-        result = users.delete_one({'Username': username})
-        client.close()
-    
+        result = users.delete_one({'Username': dp.encrypt_text(username)})
+
+    client.close()
     return result.deleted_count > 0
 
 
 def update_active_borrowing(username, item_id, status):
-    """
-    Update a user's active borrowing status.
-    
-    Args:
-        username (str): Username of the user
-        item_id (str): ID of the borrowed item or None if returning
-        status (bool): True if borrowing, False if returning
-        
-    Returns:
-        bool: True if successful, False on error
-    """
+    """Update a user's active borrowing status."""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         users = db['users']
-        result = users.update_one(
-            {'username': username}, 
-            {'$set': {
-                'active_borrowing': status,
-                'borrowed_item': item_id if status else None
-            }}
-        )
-        
+
+        update_data = {'$set': {'active_borrowing': status, 'borrowed_item': item_id if status else None}}
+
+        result = users.update_one({'username': dp.encrypt_text(username)}, update_data)
         if result.matched_count == 0:
-            result = users.update_one(
-                {'Username': username}, 
-                {'$set': {
-                    'active_borrowing': status,
-                    'borrowed_item': item_id if status else None
-                }}
-            )
-            
+            result = users.update_one({'Username': dp.encrypt_text(username)}, update_data)
+
         client.close()
         return result.modified_count > 0
     except Exception as e:
@@ -840,43 +736,37 @@ def update_active_borrowing(username, item_id, status):
 
 
 def get_name(username):
-    """
-    Retrieve the name that is assosiated with the username.
-
-    Returns:
-        str: String of name
-    """
+    """Retrieve the name that is associated with the username."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': username})
-    name = user.get("name")
-    return name
+
+    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
+    client.close()
+
+    if not user or not user.get("name"):
+        return ""
+
+    return dp.decrypt_text(user.get("name"))
 
 
 def get_last_name(username):
-    """
-    Retrieve the last_name that is assosiated with the username.
-
-    Returns:
-        str: String of last_name
-    """
+    """Retrieve the last_name that is associated with the username."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': username})
-    name = user.get("last_name")
-    return name
+
+    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
+    client.close()
+
+    if not user or not user.get("last_name"):
+        return ""
+
+    return dp.decrypt_text(user.get("last_name"))
 
 
 def get_all_users():
-    """
-    Retrieve all users from the database.
-    Administrative function for user management.
-    
-    Returns:
-        list: List of all user documents
-    """
+    """Retrieve all users from the database."""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
@@ -887,65 +777,58 @@ def get_all_users():
     except Exception as e:
         return []
 
+
 def update_password(username, new_password):
-    """
-    Update a user's password with a new one.
-    
-    Args:
-        username (str): Username of the user
-        new_password (str): New password to set
-        
-    Returns:
-        bool: True if password was updated successfully, False otherwise
-    """
+    """Update a user's password with a new one."""
     try:
         if not check_password_strength(new_password):
             return False
-            
+
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         users = db['users']
-        
-        # Hash the new password
+
         hashed_password = hashing(new_password)
-        
-        # Update the user's password
+
         result = users.update_one(
-            {'Username': username}, 
+            {'Username': dp.encrypt_text(username)},
             {'$set': {'Password': hashed_password}}
         )
-        
+        if result.matched_count == 0:
+            result = users.update_one(
+                {'username': dp.encrypt_text(username)},
+                {'$set': {'Password': hashed_password}}
+            )
+
         client.close()
         return result.modified_count > 0
     except Exception as e:
         print(f"Error updating password: {e}")
         return False
- 
+
+
 def update_user_name(username, name, last_name):
-    """
-    Update a user's name and last name.
-
-    Args:
-        username (str): Username of the user
-        name (str): New first name
-        last_name (str): New last name
-
-    Returns:
-        bool: True if updated successfully, False otherwise
-    """
+    """Update a user's name and last name."""
     try:
-        name_alias = build_name_synonym(name, last_name)
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         users = db['users']
-        
+
+        safe_name = dp.encrypt_text(name.strip()) if name else ''
+        safe_last_name = dp.encrypt_text(last_name.strip()) if last_name else ''
+
         result = users.update_one(
-            {'Username': username}, 
-            {'$set': {'name': name_alias, 'last_name': ''}}
+            {'Username': dp.encrypt_text(username)},
+            {'$set': {'name': safe_name, 'last_name': safe_last_name}}
         )
-        
+        if result.matched_count == 0:
+            result = users.update_one(
+                {'username': dp.encrypt_text(username)},
+                {'$set': {'name': safe_name, 'last_name': safe_last_name}}
+            )
+
         client.close()
         return True
     except Exception as e:
         print(f"Error updating user name: {e}")
-        return False
+        return False

Web/modules/emailservice/email.py

@@ -37,14 +37,14 @@ def send(email: list | str, subject: str, note: str, sender: str) -> bool:
         <tr>
             <td>
                 <p style="margin:0 0 12px 0;">Mit freundlichen Grüßen</p>
-                <p style="margin:0;"><strong style="font-size:16px;">Automatisierter Email Verteiler für die Schule: {cfg.get_school_info().get("name")}</strong><br></p>
+                <p style="margin:0;"><strong style="font-size:16px;">Automatisierter Email Verteiler für die Schule: {cfg.get_school_info().get("name")}</strong><br></p><br>
                 <p style="margin:12px 0 0 0;"><strong>Invario UG</strong><br>Am Sportplatz 10<br>83052 Bruckmühl</p>
             </td>
         </tr>
     </table>
     """
 
-    text_content = f"{body_message}\n\nMit freundlichen Grüßen\n{sender}\nInvario UG"
+    text_content = f"{body_message}\n\nMit freundlichen Grüßen\n{sender}\n"
 
     html_content = f"""
     <html>

Web/modules/terminplaner/backend_server.py

@@ -252,8 +252,8 @@ def new(date_start: str, date_end: str, time_span: list, slots, slot_length, use
     if calendar_link:
         email_body += f"\n\nKalendereintrag: {calendar_link}"
 
-    if normalized_mail and cfg.EMAIL_ENABLED:
-        mail_service.send(normalized_mail, subject, email_body)
+    #if normalized_mail and cfg.EMAIL_ENABLED:
+    mail_service.send(normalized_mail, subject, email_body, f"Terminplanungssystem {cfg.SCHOOL_INFO_DEFAULT.get("name")}")
 
     return {
         'appointment_id': id_str,

Web/templates/admin_damaged_items.html

@@ -7,7 +7,7 @@
   <div style="display:flex; justify-content:space-between; align-items:flex-start; gap:12px; flex-wrap:wrap; margin-bottom:16px;">
     <div>
       <h1 style="margin:0;">Defekte Items</h1>
-      <p style="margin:6px 0 0; color:#64748b;">Eigenes Verwaltungsfenster fuer gemeldete Defekte mit schneller Reparatur-Funktion.</p>
+      <p style="margin:6px 0 0; color:#64748b;">Eigenes Verwaltungsfenster für gemeldete Defekte mit schneller Reparatur-Funktion.</p>
     </div>
     <div style="display:flex; gap:8px; flex-wrap:wrap;">
       <a class="btn btn-outline-secondary" href="{{ url_for('admin_borrowings') }}">Ausleihen</a>
@@ -42,7 +42,13 @@
             {% if item.isbn %}<div style="font-size:0.82rem; color:#64748b;">ISBN: {{ item.isbn }}</div>{% endif %}
           </td>
           <td style="padding:11px; border-bottom:1px solid #eef2f7; vertical-align:top;">
-            <div style="display:inline-block; padding:3px 9px; border-radius:999px; background:#fee2e2; color:#991b1b; font-size:0.75rem; font-weight:700;">Defekt</div>
+
+            <!-- HIER IST DIE ÄNDERUNG: Dynamischer Status-Badge -->
+            <div class="badge bg-{{ item.status_color }} rounded-pill" style="font-size:0.75rem; font-weight:700; padding:4px 10px;">
+              {{ item.status_text }}
+            </div>
+            <!-- ENDE DER ÄNDERUNG -->
+
             <div style="font-size:0.84rem; color:#475569; margin-top:6px;">Meldungen: {{ item.damage_count }}</div>
             <div style="font-size:0.84rem; color:#475569;">Condition: {{ item.condition or '-' }}</div>
             <div style="font-size:0.84rem; color:#475569;">Verfuegbar: {{ 'Ja' if item.available else 'Nein' }}</div>
@@ -66,7 +72,12 @@
             {% endif %}
           </td>
           <td style="padding:11px; border-bottom:1px solid #eef2f7; vertical-align:top;">
+            <!-- Button wird ausgeblendet, falls das Item bereits repariert ist -->
+            {% if item.condition not in ['repaired', 'fixed'] %}
             <button class="btn btn-success btn-sm" onclick="repairDamage('{{ item.id }}', this)">Als repariert markieren</button>
+            {% else %}
+            <span class="text-success" style="font-size: 0.85rem;"><i class="bi bi-check-circle"></i> Repariert</span>
+            {% endif %}
           </td>
         </tr>
         {% endfor %}
@@ -118,4 +129,4 @@ function repairDamage(itemId, button) {
     });
 }
 </script>
-{% endblock %}
+{% endblock %}

Web/templates/base.html

@@ -1148,7 +1148,7 @@
                                 {% if current_permissions.pages.get('tutorial_page', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('tutorial_page') }}">Tutorial</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('admin_school_settings', False) %}
+                                {% if current_permissions.actions.get('can_manage_settings', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_school_settings') }}">Schulstammdaten</a></li>
                                 {% endif %}
                                 {% if current_permissions.actions.get('can_view_logs', False) or current_permissions.pages.get('admin_audit_dashboard', False) %}
@@ -1257,7 +1257,7 @@
                                 {% if current_permissions.pages.get('manage_locations', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('manage_locations') }}">Orte verwalten</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('admin_school_settings', False) %}
+                                {% if current_permissions.actions.get('can_manage_settings', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_school_settings') }}">Schulstammdaten</a></li>
                                 {% endif %}
                                 {% if current_permissions.pages.get('admin_borrowings', False) %}
@@ -1379,7 +1379,7 @@
                                 <li><a class="dropdown-item" href="{{ url_for('student_cards_admin') }}">Bibliotheksausweis</a></li>
                                 {% endif %}
                                 {% endif %}
-                                {% if current_permissions.pages.get('admin_school_settings', False) %}
+                                {% if current_permissions.actions.get('can_manage_settings', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_school_settings') }}">Schulstammdaten</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
@@ -1698,7 +1698,7 @@
             <option value="Orte verwalten"></option>
             {% endif %}
 
-            {% if current_permissions.pages.get('admin_school_settings', False) %}
+            {% if current_permissions.actions.get('can_manage_settings', False) %}
             <option value="Schulstammdaten"></option>
             {% endif %}
 
@@ -1823,7 +1823,7 @@
                     { label: 'Orte verwalten', keywords: ['orte verwalten', 'orte', 'location'], url: {{ url_for('manage_locations')|tojson }} },
                     {% endif %}
                     
-                    {% if current_permissions.pages.get('admin_school_settings', False) %}
+                    {% if current_permissions.actions.get('can_manage_settings', False) %}
                     { label: 'Schulstammdaten', keywords: ['schule', 'settings', 'stammdaten', 'school settings'], url: {{ url_for('admin_school_settings')|tojson }} },
                     {% endif %}
                     

manage-tenant.sh

@@ -200,6 +200,7 @@ sys.path.insert(0, "/app")
 sys.path.insert(0, "/app/Web")
 from Web.modules.database import settings
 from pymongo import MongoClient
+import Web.modules.inventarsystem.data_protection as dp
 
 tenant_id = sys.argv[1].lower()
 mode = sys.argv[2]
@@ -244,14 +245,14 @@ page_permissions = {
     "manage_locations": True,
 }
 
-if db.users.count_documents({"Username": "admin"}) == 0:
+if db.users.count_documents({"Username": dp.encrypt_text("admin")}) == 0:
     db.users.insert_one({
-        "Username": "admin",
+        "Username":  dp.encrypt_text("admin"),
         "Password": hashed_pw_string,
         "Admin": True,
         "active_ausleihung": None,
-        "name": "Admin",
-        "last_name": "User",
+        "name": dp.encrypt_text("Admin"),
+        "last_name": dp.encrypt_text("User"),
         "IsStudent": False,
         "PermissionPreset": "full_access",
         "ActionPermissions": action_permissions,