corrected type mismatch

- Created '/upload_csv_batch' endpoint to handle CSV parsing and multiple image uploads
- Added automatic WebP conversion and GridFS storage for batch images
- Implemented grouping logic via 'series_group_id' based on item name
- Created '/batch_upload' route and 'upload_batch.html' for a seamless async frontend

.github/workflows/release-docker.yml

@@ -4,17 +4,20 @@ on:
   push:
     tags:
       - "v*"
+    branches:
+      - main
   workflow_dispatch:
     inputs:
-      bump:
-        description: "Version bump type (major stays fixed from latest release)"
+      release_type:
+        description: "Release type"
         required: false
         default: "patch"
         type: choice
         options:
-          - patch
-          - minor
           - major
+          - minor
+          - patch
+          - dev
 
 permissions:
   contents: write
@@ -38,12 +41,70 @@ jobs:
           REPO: ${{ gitea.repository }}
           EVENT_NAME: ${{ gitea.event_name }}
           REF_NAME: ${{ gitea.ref_name }}
-          BUMP_TYPE: ${{ gitea.event.inputs.bump || 'patch' }}
+          RELEASE_TYPE: ${{ gitea.event.inputs.release_type || 'patch' }}
           DOCKER_API_VERSION: '1.44'
         run: |
-          if [ "$EVENT_NAME" = "push" ] && [ -n "$REF_NAME" ]; then
+          latest_stable_tag() {
+            local releases_file="$1"
+            python3 -c "import json, sys; releases = json.load(open(sys.argv[1], encoding='utf-8')); print(next((release.get('tag_name', '').strip() for release in releases if not release.get('prerelease') and not release.get('draft')), ''))" "$releases_file"
+          }
+
+          next_dev_suffix() {
+            local releases_file="$1"
+            local base_tag="$2"
+            python3 -c "import json, re, sys; releases_path, base_tag = sys.argv[1], sys.argv[2].strip(); pattern = re.compile(r'^' + re.escape(base_tag) + r'-dev\\.(\\d+)$'); releases = json.load(open(releases_path, encoding='utf-8')); highest = max([int(match.group(1)) for release in releases for match in [pattern.match(release.get('tag_name', '').strip())] if match], default=0); print(highest + 1)" "$releases_file" "$base_tag"
+          }
+
+          make_dev_tag() {
+            local releases_file="$1"
+            local stable_tag="$2"
+            local major minor patch next_suffix
+
+            if [[ "$stable_tag" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+              major=${BASH_REMATCH[1]}
+              minor=${BASH_REMATCH[2]}
+              patch=${BASH_REMATCH[3]}
+            else
+              major=0
+              minor=8
+              patch=31
+            fi
+
+            patch=$((patch + 1))
+            next_suffix="$(next_dev_suffix "$releases_file" "v${major}.${minor}.${patch}")"
+            printf 'v%s.%s.%s-dev.%s' "$major" "$minor" "$patch" "$next_suffix"
+          }
+
+          releases_file="$(mktemp)"
+          trap 'rm -f "${releases_file:-}"' EXIT
+
+          if [ "$EVENT_NAME" = "push" ] && [ "$REF_NAME" = "main" ]; then
+            prerelease=true
+            if ! curl -fsSL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/json" "https://git.invario-software.eu/api/v1/repos/$REPO/releases" -o "$releases_file"; then
+              echo "Error: could not fetch release list"
+              exit 1
+            fi
+            latest_tag="$(latest_stable_tag "$releases_file")"
+            if [ -z "$latest_tag" ]; then
+              latest_tag="v0.8.31"
+            fi
+            TAG="$(make_dev_tag "$releases_file" "$latest_tag")"
+          elif [ "$EVENT_NAME" = "workflow_dispatch" ] && [ "$RELEASE_TYPE" = "dev" ]; then
+            prerelease=true
+            if ! curl -fsSL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/json" "https://git.invario-software.eu/api/v1/repos/$REPO/releases" -o "$releases_file"; then
+              echo "Error: could not fetch release list"
+              exit 1
+            fi
+            latest_tag="$(latest_stable_tag "$releases_file")"
+            if [ -z "$latest_tag" ]; then
+              latest_tag="v0.8.31"
+            fi
+            TAG="$(make_dev_tag "$releases_file" "$latest_tag")"
+          elif [ "$EVENT_NAME" = "push" ] && [ -n "$REF_NAME" ]; then
+            prerelease=false
             TAG="$REF_NAME"
           else
+            prerelease=false
             latest_tag="v0.8.31"
             if meta_json=$(curl -fsSL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/json" "https://git.invario-software.eu/api/v1/repos/$REPO/releases/latest" 2>/dev/null); then
               tag_name=$(printf "%s" "$meta_json" | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
@@ -60,14 +121,14 @@ jobs:
               major=0; minor=8; patch=31
             fi
 
-            if [ "${BUMP_TYPE:-}" = "major" ]; then
+            if [ "${RELEASE_TYPE:-}" = "major" ]; then
               major=$((major + 1)); minor=0; patch=0
-            elif [ "${BUMP_TYPE:-}" = "minor" ]; then
+            elif [ "${RELEASE_TYPE:-}" = "minor" ]; then
               minor=$((minor + 1)); patch=0
             else
               patch=$((patch + 1))
             fi
-            
+
             TAG="v${major}.${minor}.${patch}"
           fi
 
@@ -109,6 +170,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "image=$IMAGE" >> "$GITHUB_OUTPUT"
           echo "lower_repo=$LOWER_REPO" >> "$GITHUB_OUTPUT"
+          echo "prerelease=$prerelease" >> "$GITHUB_OUTPUT"
 
       - name: Ensure Docker CLI is available and up to date
         run: |
@@ -148,6 +210,7 @@ jobs:
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push release image
+        if: steps.meta.outputs.prerelease != 'true'
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -157,6 +220,16 @@ jobs:
             ${{ steps.meta.outputs.image }}
             git.invario-software.eu/${{ steps.meta.outputs.lower_repo }}:latest
 
+      - name: Build and push prerelease image
+        if: steps.meta.outputs.prerelease == 'true'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: |
+            ${{ steps.meta.outputs.image }}
+
       - name: Create release-only docker bundle
         run: |
             mkdir -p release-bundle
@@ -253,5 +326,6 @@ jobs:
         uses: https://gitea.com/actions/gitea-release-action@v1
         with:
           tag_name: ${{ steps.meta.outputs.tag }}
+          prerelease: ${{ steps.meta.outputs.prerelease }}
           files: |
             inventarsystem-docker-bundle.tar.gz

Web/modules/database/settings.py

@@ -319,15 +319,15 @@ THUMBNAIL_FOLDER = _get(_conf, ['upload', 'thumbnail_folder'], DEFAULTS['upload'
 PREVIEW_FOLDER = _get(_conf, ['upload', 'preview_folder'], DEFAULTS['upload']['preview_folder'])
 QR_CODE_FOLDER = _get(_conf, ['upload', 'qrcode_folder'], DEFAULTS['upload']['qrcode_folder'])
 
-# Normalize to absolute paths to avoid cwd issues
+# This guarantees exact matching with Docker volume mounts
 if not os.path.isabs(UPLOAD_FOLDER):
-    UPLOAD_FOLDER = os.path.join(BASE_DIR, os.path.relpath(UPLOAD_FOLDER, BASE_DIR))
+    UPLOAD_FOLDER = os.path.abspath(os.path.join(BASE_DIR, "uploads"))
 if not os.path.isabs(THUMBNAIL_FOLDER):
-    THUMBNAIL_FOLDER = os.path.join(BASE_DIR, os.path.relpath(THUMBNAIL_FOLDER, BASE_DIR))
+    THUMBNAIL_FOLDER = os.path.abspath(os.path.join(BASE_DIR, "thumbnails"))
 if not os.path.isabs(PREVIEW_FOLDER):
-    PREVIEW_FOLDER = os.path.join(BASE_DIR, os.path.relpath(PREVIEW_FOLDER, BASE_DIR))
+    PREVIEW_FOLDER = os.path.abspath(os.path.join(BASE_DIR, "previews"))
 if not os.path.isabs(QR_CODE_FOLDER):
-    QR_CODE_FOLDER = os.path.join(BASE_DIR, os.path.relpath(QR_CODE_FOLDER, BASE_DIR))
+    QR_CODE_FOLDER = os.path.abspath(os.path.join(BASE_DIR, "QRCodes"))
 MAX_UPLOAD_MB = _get(_conf, ['upload', 'max_size_mb'], DEFAULTS['upload']['max_size_mb'])
 IMAGE_MAX_UPLOAD_MB = _get(_conf, ['upload', 'image_max_size_mb'], DEFAULTS['upload']['image_max_size_mb'])
 VIDEO_MAX_UPLOAD_MB = _get(_conf, ['upload', 'video_max_size_mb'], DEFAULTS['upload']['video_max_size_mb'])

Web/modules/database/user.py

@@ -20,6 +20,7 @@ import string
 from bson.objectid import ObjectId
 import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
+import Web.modules.inventarsystem.data_protection as dp
 import hmac
 import os
 
@@ -53,10 +54,34 @@ def _clean_name_fragment(value):
     return cleaned
 
 
-def _get_tenant_db(client):
+def _get_tenant_db(client, tenant_id=None):
     """Return the current tenant database for the request, or fall back to default."""
     try:
         from tenant import get_tenant_db
+        if tenant_id is None:
+            return get_tenant_db(client)
+
+        tenant_id = str(tenant_id).strip()
+        if tenant_id:
+            try:
+                from tenant import get_tenant_config
+
+                config = get_tenant_config(tenant_id)
+                if isinstance(config, dict):
+                    explicit_db = config.get('db') or config.get('db_name')
+                    if explicit_db:
+                        db_name = str(explicit_db).strip()
+                        if db_name and not db_name.startswith('inventar_'):
+                            db_name = f'inventar_{db_name}'
+                        if db_name:
+                            return client[db_name]
+            except Exception:
+                pass
+
+            sanitized = ''.join(c for c in tenant_id.lower() if c.isalnum() or c == '_')
+            if sanitized:
+                return client[f'inventar_{sanitized}']
+
         return get_tenant_db(client)
     except Exception:
         return client[cfg.MONGODB_DB]
@@ -109,13 +134,6 @@ def build_username_from_name(first_name, last_name=''):
     """
     Build a deterministic username abbreviation from first and last name.
     Uses 3 letters from each name and stores it lowercase.
-    
-    Args:
-        first_name (str): First name
-        last_name (str): Last name (optional)
-        
-    Returns:
-        str: Generated username
     """
     alias = build_name_synonym(first_name, last_name)
     return alias.lower()
@@ -324,7 +342,6 @@ def get_effective_permissions(username):
         return build_default_permission_payload('full_access')
 
     preset_key = user.get('PermissionPreset')
-    print(preset_key)
     payload = build_default_permission_payload(preset_key)
     payload['actions'] = _normalize_bool_map(user.get('ActionPermissions', {}), payload['actions'])
     payload['pages'] = _normalize_bool_map(user.get('PagePermissions', {}), payload['pages'])
@@ -352,10 +369,10 @@ def update_user_permissions(username, preset_key, action_permissions=None, page_
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.update_one({'Username': username}, {'$set': update_data})
+    result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': update_data})
 
     if result.matched_count == 0:
-        result = users.update_one({'username': username}, {'$set': update_data})
+        result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': update_data})
 
     client.close()
     return result.matched_count > 0
@@ -367,7 +384,7 @@ def get_favorites(username):
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': username}) or users.find_one({'username': username})
+    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
     client.close()
     if not user:
         return []
@@ -382,7 +399,7 @@ def add_favorite(username, item_id):
         db = _get_tenant_db(client)
         users = db['users']
         users.update_one(
-            {'$or': [{'Username': username}, {'username': username}]},
+            {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]},
             {'$addToSet': {'favorites': ObjectId(item_id)}}
         )
         client.close()
@@ -397,7 +414,7 @@ def remove_favorite(username, item_id):
         db = _get_tenant_db(client)
         users = db['users']
         users.update_one(
-            {'$or': [{'Username': username}, {'username': username}]},
+            {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]},
             {'$pull': {'favorites': ObjectId(item_id)}}
         )
         client.close()
@@ -406,16 +423,9 @@ def remove_favorite(username, item_id):
         return False
 
 
-
 def check_password_strength(password):
     """
     Check if a password meets minimum security requirements.
-    
-    Args:
-        password (str): Password to check
-        
-    Returns:
-        bool: True if password is strong enough, False otherwise
     """
     if password is None:
         return False
@@ -435,19 +445,15 @@ def check_password_strength(password):
 
 def hashing(password, salt=None):
     """
-    Hasht ein Passwort mit scrypt. 
-    - Wenn kein Salt übergeben wird, wird ein sicherer, zufälliger Salt generiert (für neue Passwörter).
-    - Format für neue Hashes: v1$<salt_hex>$<hash_hex>
+    Hasht ein Passwort mit scrypt.
     """
-    password_bytes = password.encode('utf-8') # Explizit UTF-8 für Plattformunabhängigkeit
-    
+    password_bytes = password.encode('utf-8')
+
     if salt is None:
-        # Neuer Benutzer / Passwortänderung -> Dynamischer Salt
         random_salt = os.urandom(16)
         hashed = hashlib.scrypt(password_bytes, salt=random_salt, n=16384, r=8, p=1)
         return f"v1${random_salt.hex()}${hashed.hex()}"
     else:
-        # Bestehender Benutzer (wird zur Verifizierung aufgerufen)
         hashed = hashlib.scrypt(password_bytes, salt=salt, n=16384, r=8, p=1)
         return hashed.hex()
 
@@ -455,25 +461,20 @@ def hashing(password, salt=None):
 def verify_password(provided_password, stored_password_string):
     """
     Verifiziert ein Passwort gegen einen gespeicherten Hash-String.
-    Unterstützt das alte Format (statischer Salt) und das neue Format (v1$...).
     """
     if not stored_password_string:
         return False
 
-    # Überprüfung für das neue, sichere Format
     if stored_password_string.startswith("v1$"):
         try:
             _, salt_hex, hash_hex = stored_password_string.split("$")
             salt_bytes = bytes.fromhex(salt_hex)
-            # Berechne den Hash des eingegebenen Passworts mit dem extrahierten Salt
             calculated_hash = hashing(provided_password, salt=salt_bytes)
-            # Timing-Attack-sicherer Vergleich
             return hmac.compare_digest(calculated_hash, hash_hex)
         except (ValueError, TypeError):
             logger.error("Ungültiges Hash-Format in der Datenbank entdeckt.")
             return False
     else:
-        # Abwärtskompatibilität: Altes Format mit statischem Salt b'some_salt'
         old_static_salt = b'some_salt'
         calculated_hash = hashing(provided_password, salt=old_static_salt)
         return hmac.compare_digest(calculated_hash, stored_password_string)
@@ -494,28 +495,122 @@ def check_nm_pwd(username, password):
     try:
         db = client[db_name]
         users = db['users']
-        
-        query = {'$or': [{'Username': username}, {'username': username}]}
+
+        query = {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]}
         user_record = users.find_one(query)
 
         if user_record is None:
-            logger.warning("Kein Benutzer für %r in DB %r gefunden.", username, db_name)
-            return None
+            query = {'$or': [{'Username': username}, {'username': username}]}
+            user_record_fallback = users.find_one(query)
+            if user_record_fallback is None:
+                if db_name != cfg.MONGODB_DB:
+                    default_users = client[cfg.MONGODB_DB]['users']
+                    user_record_fallback = default_users.find_one(
+                        {'$or': [
+                            {'Username': dp.encrypt_text(username)},
+                            {'username': dp.encrypt_text(username)},
+                            {'Username': username},
+                            {'username': username},
+                        ]}
+                    )
+                    if user_record_fallback is not None:
+                        migrated_record = dict(user_record_fallback)
+                        migrated_record.pop('_id', None)
+                        users.replace_one(
+                            {'$or': [
+                                {'Username': migrated_record.get('Username')},
+                                {'username': migrated_record.get('username')},
+                            ]},
+                            migrated_record,
+                            upsert=True,
+                        )
+                        logger.warning(
+                            "Tenant user %r migrated from default DB %r to tenant DB %r.",
+                            dp.encrypt_text(username),
+                            cfg.MONGODB_DB,
+                            db_name,
+                        )
+                        user_record = users.find_one(
+                            {'$or': [
+                                {'Username': migrated_record.get('Username')},
+                                {'username': migrated_record.get('username')},
+                            ]}
+                        ) or migrated_record
+                    else:
+                        logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
+                        return None
+                else:
+                    logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
+                    return None
+            else:
+                user_record = user_record_fallback
 
         stored_password = user_record.get('Password') or user_record.get('password')
-        
+
         if not verify_password(password, stored_password):
-            logger.warning("Falsches Passwort für Benutzer %r in DB %r.", username, db_name)
+            logger.warning("Falsches Passwort für Benutzer %r in DB %r.", dp.encrypt_text(username), db_name)
             return None
 
-        # Automatische Migration alter Hashes auf das neue Format
-        if not stored_password.startswith("v1$"):
+        if stored_password and not stored_password.startswith("v1$"):
             users.update_one({'_id': user_record['_id']}, {'$set': {'Password': hashing(password)}})
 
         return user_record
     finally:
         client.close()
 
+def add_admin(
+    username,
+    password,
+    name='',
+    last_name='',
+    is_student=False,
+    permission_preset='full_access',
+    action_permissions=None,
+    page_permissions=None,
+    tenant_id=None,
+):
+    """
+    Add a new user to the database.
+    """
+    if not check_password_strength(password):
+        return False
+
+    client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+    try:
+        db = _get_tenant_db(client, tenant_id)
+        users = db['users']
+
+        permission_defaults = build_default_permission_payload(permission_preset)
+
+        if isinstance(action_permissions, dict):
+            for key, value in action_permissions.items():
+                permission_defaults['actions'][str(key)] = bool(value)
+
+        if isinstance(page_permissions, dict):
+            for key, value in page_permissions.items():
+                permission_defaults['pages'][str(key)] = bool(value)
+
+        safe_name = name.strip() if name else ''
+        safe_last_name = last_name.strip() if last_name else ''
+
+        user_doc = {
+            'Username': username,
+            'Password': hashing(password),
+            'Admin': True,
+            'active_ausleihung': None,
+            'name': dp.encrypt_text(safe_name) if safe_name else '',
+            'last_name': dp.encrypt_text(safe_last_name) if safe_last_name else '',
+            'IsStudent': bool(is_student),
+            'PermissionPreset': permission_defaults['preset'],
+            'ActionPermissions': permission_defaults['actions'],
+            'PagePermissions': permission_defaults['pages'],
+        }
+
+        users.insert_one(user_doc)
+        return True
+    finally:
+        client.close()
+
 
 def add_user(
     username,
@@ -528,43 +623,39 @@ def add_user(
     permission_preset='standard_user',
     action_permissions=None,
     page_permissions=None,
+    tenant_id=None,
 ):
     """
     Add a new user to the database.
-    
-    Args:
-        username (str): Username for the new user
-        password (str): Password for the new user
-        
-    Returns:
-        bool: True if user was added successfully, False if password was too weak
     """
+    if not check_password_strength(password):
+        return False
+
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     try:
-        db = _get_tenant_db(client)
+        db = _get_tenant_db(client, tenant_id)
         users = db['users']
-        if not check_password_strength(password):
-            return False
+
         permission_defaults = build_default_permission_payload(permission_preset)
+
         if isinstance(action_permissions, dict):
             for key, value in action_permissions.items():
                 permission_defaults['actions'][str(key)] = bool(value)
+
         if isinstance(page_permissions, dict):
             for key, value in page_permissions.items():
                 permission_defaults['pages'][str(key)] = bool(value)
 
-        if permission_preset == "full_access":
-            can_admin_preset_based = True 
-        else:
-            can_admin_preset_based = False
-        
+        safe_name = name.strip() if name else ''
+        safe_last_name = last_name.strip() if last_name else ''
+
         user_doc = {
             'Username': username,
             'Password': hashing(password),
-            'Admin': can_admin_preset_based,
+            'Admin': (permission_preset == "full_access"),
             'active_ausleihung': None,
-            'name': name.strip() if name else '',
-            'last_name': last_name.strip() if last_name else '',
+            'name': dp.encrypt_text(safe_name) if safe_name else '',
+            'last_name': dp.encrypt_text(safe_last_name) if safe_last_name else '',
             'IsStudent': bool(is_student),
             'PermissionPreset': permission_defaults['preset'],
             'ActionPermissions': permission_defaults['actions'],
@@ -601,7 +692,7 @@ def student_card_exists(student_card_id):
 
 
 def get_user_by_student_card(student_card_id):
-    """Return user by student card id or None."""
+    """Return user dict by student card id or None."""
     normalized = normalize_student_card_id(student_card_id)
     if not normalized:
         return None
@@ -610,65 +701,44 @@ def get_user_by_student_card(student_card_id):
     users = db['student_cards']
     found_user = users.find_one({'SchülerName': normalized})
     client.close()
+
+    # Do not call dp.decrypt_text() here because found_user is a MongoDB dictionary.
     return found_user
 
 
 def make_admin(username):
-    """
-    Grant administrator privileges to a user.
-    
-    Args:
-        username (str): Username of the user to promote
-        
-    Returns:
-        bool: True if user was promoted successfully
-    """
+    """Grant administrator privileges to a user."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.update_one({'Username': username}, {'$set': {'Admin': True}})
+    result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': True}})
     if result.matched_count == 0:
-        result = users.update_one({'username': username}, {'$set': {'Admin': True}})
+        result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': True}})
     client.close()
     return result.matched_count > 0
 
+
 def remove_admin(username):
-    """
-    Remove administrator privileges from a user.
-    
-    Args:
-        username (str): Username of the user to demote
-        
-    Returns:
-        bool: True if user was demoted successfully
-    """
+    """Remove administrator privileges from a user."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.update_one({'Username': username}, {'$set': {'Admin': False}})
+    result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': False}})
     if result.matched_count == 0:
-        result = users.update_one({'username': username}, {'$set': {'Admin': False}})
+        result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': False}})
     client.close()
     return result.matched_count > 0
 
+
 def get_user(username):
-    """
-    Retrieve a specific user by username.
-    
-    Args:
-        username (str): Username to search for
-        
-    Returns:
-        dict: User document or None if not found
-    """
+    """Retrieve a specific user by username."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     try:
         def find_in_db(database_name):
             db = client[database_name]
             users = db['users']
-            return users.find_one({'Username': username}) or users.find_one({'username': username})
+            return users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'username': username}) or users.find_one({'Username': username})
 
-        # Try current tenant first when available
         tenant_db, tenant_id = _resolve_request_tenant_db()
         if tenant_db:
             user = find_in_db(tenant_db)
@@ -681,7 +751,6 @@ def get_user(username):
             )
             return None
 
-        # Fallback to default configured database
         user = find_in_db(cfg.MONGODB_DB)
         if user:
             return user
@@ -692,147 +761,89 @@ def get_user(username):
 
 
 def check_admin(username):
-    """
-    Check if a user has administrator privileges.
-    
-    Args:
-        username (str): Username to check
-        
-    Returns:
-        bool: True if user is an administrator, False otherwise
-    """
+    """Check if a user has administrator privileges."""
     user = get_user(username)
     return bool(user and user.get('Admin', False))
 
 
 def update_active_ausleihung(username, id_item, ausleihung):
-    """
-    Update a user's active borrowing record.
-    
-    Args:
-        username (str): Username of the user
-        id_item (str): ID of the borrowed item
-        ausleihung (str): ID of the borrowing record
-        
-    Returns:
-        bool: True if successful
-    """
+    """Update a user's active borrowing record."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    users.update_one({'Username': username}, {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}})
+
+    result = users.update_one(
+        {'Username': dp.encrypt_text(username)},
+        {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}}
+    )
+    if result.matched_count == 0:
+        users.update_one(
+            {'username': dp.encrypt_text(username)},
+            {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}}
+        )
     client.close()
     return True
 
 
 def get_active_ausleihung(username):
-    """
-    Get a user's active borrowing record.
-    
-    Args:
-        username (str): Username of the user
-        
-    Returns:
-        dict: Active borrowing information or None
-    """
+    """Get a user's active borrowing record."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': username})
-    return user['active_ausleihung']
+
+    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
+    client.close()
+
+    if not user:
+        return None
+    return user.get('active_ausleihung')
 
 
 def has_active_borrowing(username):
-    """
-    Check if a user currently has an active borrowing.
-    
-    Args:
-        username (str): Username to check
-        
-    Returns:
-        bool: True if user has an active borrowing, False otherwise
-    """
+    """Check if a user currently has an active borrowing."""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         users = db['users']
-        
-        user = users.find_one({'username': username})
-        if not user:
-            user = users.find_one({'Username': username})
-            
-        if not user:
-            client.close()
-            return False
-            
-        has_active = user.get('active_borrowing', False)
-        
+
+        user = users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'Username': dp.encrypt_text(username)})
         client.close()
-        return has_active
+
+        if not user:
+            return False
+
+        return user.get('active_borrowing', False)
     except Exception as e:
         return False
 
 
 def delete_user(username):
-    """
-    Delete a user from the database.
-    Administrative function for removing user accounts.
-    
-    Args:
-        username (str): Username of the account to delete
-        
-    Returns:
-        bool: True if user was deleted successfully, False otherwise
-    """
+    """Delete a user from the database."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.delete_one({'username': username})
-    client.close()
+
+    result = users.delete_one({'username': dp.encrypt_text(username)})
     if result.deleted_count == 0:
-        # Try with different field name
-        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = _get_tenant_db(client)
-        users = db['users']
-        result = users.delete_one({'Username': username})
-        client.close()
-    
+        result = users.delete_one({'Username': dp.encrypt_text(username)})
+
+    client.close()
     return result.deleted_count > 0
 
 
 def update_active_borrowing(username, item_id, status):
-    """
-    Update a user's active borrowing status.
-    
-    Args:
-        username (str): Username of the user
-        item_id (str): ID of the borrowed item or None if returning
-        status (bool): True if borrowing, False if returning
-        
-    Returns:
-        bool: True if successful, False on error
-    """
+    """Update a user's active borrowing status."""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         users = db['users']
-        result = users.update_one(
-            {'username': username}, 
-            {'$set': {
-                'active_borrowing': status,
-                'borrowed_item': item_id if status else None
-            }}
-        )
-        
+
+        update_data = {'$set': {'active_borrowing': status, 'borrowed_item': item_id if status else None}}
+
+        result = users.update_one({'username': dp.encrypt_text(username)}, update_data)
         if result.matched_count == 0:
-            result = users.update_one(
-                {'Username': username}, 
-                {'$set': {
-                    'active_borrowing': status,
-                    'borrowed_item': item_id if status else None
-                }}
-            )
-            
+            result = users.update_one({'Username': dp.encrypt_text(username)}, update_data)
+
         client.close()
         return result.modified_count > 0
     except Exception as e:
@@ -840,43 +851,37 @@ def update_active_borrowing(username, item_id, status):
 
 
 def get_name(username):
-    """
-    Retrieve the name that is assosiated with the username.
-
-    Returns:
-        str: String of name
-    """
+    """Retrieve the name that is associated with the username."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': username})
-    name = user.get("name")
-    return name
+
+    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
+    client.close()
+
+    if not user or not user.get("name"):
+        return ""
+
+    return dp.decrypt_text(user.get("name"))
 
 
 def get_last_name(username):
-    """
-    Retrieve the last_name that is assosiated with the username.
-
-    Returns:
-        str: String of last_name
-    """
+    """Retrieve the last_name that is associated with the username."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': username})
-    name = user.get("last_name")
-    return name
+
+    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
+    client.close()
+
+    if not user or not user.get("last_name"):
+        return ""
+
+    return dp.decrypt_text(user.get("last_name"))
 
 
 def get_all_users():
-    """
-    Retrieve all users from the database.
-    Administrative function for user management.
-    
-    Returns:
-        list: List of all user documents
-    """
+    """Retrieve all users from the database."""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
@@ -887,65 +892,58 @@ def get_all_users():
     except Exception as e:
         return []
 
+
 def update_password(username, new_password):
-    """
-    Update a user's password with a new one.
-    
-    Args:
-        username (str): Username of the user
-        new_password (str): New password to set
-        
-    Returns:
-        bool: True if password was updated successfully, False otherwise
-    """
+    """Update a user's password with a new one."""
     try:
         if not check_password_strength(new_password):
             return False
-            
+
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         users = db['users']
-        
-        # Hash the new password
+
         hashed_password = hashing(new_password)
-        
-        # Update the user's password
+
         result = users.update_one(
-            {'Username': username}, 
+            {'Username': dp.encrypt_text(username)},
             {'$set': {'Password': hashed_password}}
         )
-        
+        if result.matched_count == 0:
+            result = users.update_one(
+                {'username': dp.encrypt_text(username)},
+                {'$set': {'Password': hashed_password}}
+            )
+
         client.close()
         return result.modified_count > 0
     except Exception as e:
         print(f"Error updating password: {e}")
         return False
- 
+
+
 def update_user_name(username, name, last_name):
-    """
-    Update a user's name and last name.
-
-    Args:
-        username (str): Username of the user
-        name (str): New first name
-        last_name (str): New last name
-
-    Returns:
-        bool: True if updated successfully, False otherwise
-    """
+    """Update a user's name and last name."""
     try:
-        name_alias = build_name_synonym(name, last_name)
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         users = db['users']
-        
+
+        safe_name = dp.encrypt_text(name.strip()) if name else ''
+        safe_last_name = dp.encrypt_text(last_name.strip()) if last_name else ''
+
         result = users.update_one(
-            {'Username': username}, 
-            {'$set': {'name': name_alias, 'last_name': ''}}
+            {'Username': dp.encrypt_text(username)},
+            {'$set': {'name': safe_name, 'last_name': safe_last_name}}
         )
-        
+        if result.matched_count == 0:
+            result = users.update_one(
+                {'username': dp.encrypt_text(username)},
+                {'$set': {'name': safe_name, 'last_name': safe_last_name}}
+            )
+
         client.close()
         return True
     except Exception as e:
         print(f"Error updating user name: {e}")
-        return False
+        return False

Web/requirements.txt

@@ -17,4 +17,5 @@ cryptography>=42.0.0
 pywebpush
 py-vapid>=1.9.0
 beautifulsoup4
-pywebpush
+pywebpush
+pandas

Web/templates/admin_damaged_items.html

@@ -7,7 +7,7 @@
   <div style="display:flex; justify-content:space-between; align-items:flex-start; gap:12px; flex-wrap:wrap; margin-bottom:16px;">
     <div>
       <h1 style="margin:0;">Defekte Items</h1>
-      <p style="margin:6px 0 0; color:#64748b;">Eigenes Verwaltungsfenster fuer gemeldete Defekte mit schneller Reparatur-Funktion.</p>
+      <p style="margin:6px 0 0; color:#64748b;">Eigenes Verwaltungsfenster für gemeldete Defekte mit schneller Reparatur-Funktion.</p>
     </div>
     <div style="display:flex; gap:8px; flex-wrap:wrap;">
       <a class="btn btn-outline-secondary" href="{{ url_for('admin_borrowings') }}">Ausleihen</a>
@@ -42,7 +42,13 @@
             {% if item.isbn %}<div style="font-size:0.82rem; color:#64748b;">ISBN: {{ item.isbn }}</div>{% endif %}
           </td>
           <td style="padding:11px; border-bottom:1px solid #eef2f7; vertical-align:top;">
-            <div style="display:inline-block; padding:3px 9px; border-radius:999px; background:#fee2e2; color:#991b1b; font-size:0.75rem; font-weight:700;">Defekt</div>
+
+            <!-- HIER IST DIE ÄNDERUNG: Dynamischer Status-Badge -->
+            <div class="badge bg-{{ item.status_color }} rounded-pill" style="font-size:0.75rem; font-weight:700; padding:4px 10px;">
+              {{ item.status_text }}
+            </div>
+            <!-- ENDE DER ÄNDERUNG -->
+
             <div style="font-size:0.84rem; color:#475569; margin-top:6px;">Meldungen: {{ item.damage_count }}</div>
             <div style="font-size:0.84rem; color:#475569;">Condition: {{ item.condition or '-' }}</div>
             <div style="font-size:0.84rem; color:#475569;">Verfuegbar: {{ 'Ja' if item.available else 'Nein' }}</div>
@@ -66,7 +72,12 @@
             {% endif %}
           </td>
           <td style="padding:11px; border-bottom:1px solid #eef2f7; vertical-align:top;">
+            <!-- Button wird ausgeblendet, falls das Item bereits repariert ist -->
+            {% if item.condition not in ['repaired', 'fixed'] %}
             <button class="btn btn-success btn-sm" onclick="repairDamage('{{ item.id }}', this)">Als repariert markieren</button>
+            {% else %}
+            <span class="text-success" style="font-size: 0.85rem;"><i class="bi bi-check-circle"></i> Repariert</span>
+            {% endif %}
           </td>
         </tr>
         {% endfor %}
@@ -118,4 +129,4 @@ function repairDamage(itemId, button) {
     });
 }
 </script>
-{% endblock %}
+{% endblock %}

Web/templates/edit_library.html

@@ -0,0 +1,505 @@
+<!--
+   Copyright 2025-2026 AIIrondev
+   Licensed under the Inventarsystem EULA.
+-->
+{% extends "base.html" %}
+
+{% block title %}{{ page_title|default('Artikel bearbeiten') }} - Inventarsystem{% endblock %}
+
+{% block content %}
+<style>
+    .edit-container {
+        max-width: 800px;
+        margin: 0 auto;
+        padding: 20px;
+        background-color: var(--ui-surface);
+        border-radius: 8px;
+        box-shadow: 0 2px 10px rgba(0,0,0,0.1);
+    }
+
+    .edit-form h1 {
+        color: var(--ui-text);
+        margin-bottom: 30px;
+        text-align: center;
+        font-size: 2em;
+    }
+
+    .form-group {
+        margin-bottom: 20px;
+    }
+
+    .form-group label {
+        display: block;
+        margin-bottom: 5px;
+        font-weight: bold;
+        color: var(--ui-text);
+    }
+
+    .form-group input,
+    .form-group select,
+    .form-group textarea {
+        width: 100%;
+        padding: 10px;
+        border: 1px solid #ddd;
+        border-radius: 4px;
+        font-size: 16px;
+        box-sizing: border-box;
+    }
+
+    .form-group textarea {
+        height: 100px;
+        resize: vertical;
+    }
+
+    .filter-inputs {
+        background-color: var(--ui-surface-soft);
+        padding: 20px;
+        border-radius: 5px;
+        margin: 20px 0;
+    }
+
+    .filter-inputs h3 {
+        color: var(--ui-text);
+        margin-bottom: 15px;
+        font-size: 1.2em;
+    }
+
+    .multi-filter {
+        display: grid;
+        grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+        gap: 15px;
+    }
+
+    .filter-dropdown-select {
+        width: 100%;
+        padding: 8px;
+        border: 1px solid #ddd;
+        border-radius: 4px;
+        background-color: white;
+    }
+
+    .isbn-input-group {
+        display: flex;
+        gap: 10px;
+        align-items: center;
+    }
+
+    .isbn-input-group input {
+        flex: 1;
+    }
+
+    .fetch-isbn-button {
+        background-color: #007bff;
+        color: white;
+        border: none;
+        padding: 8px 12px;
+        border-radius: 4px;
+        cursor: pointer;
+        white-space: nowrap;
+        transition: background-color 0.2s ease;
+    }
+
+    .fetch-isbn-button:hover {
+        background-color: #0056b3;
+    }
+
+    /* Scanner Elements */
+    #code4-scanner video, #code4-scanner canvas,
+    #isbn-scanner video, #isbn-scanner canvas {
+        width: 100%;
+        max-width: 640px;
+        height: auto;
+        border-radius: 5px;
+        box-shadow: 0 2px 8px rgba(0,0,0,0.1);
+    }
+
+    #code4-scanner canvas, #isbn-scanner canvas {
+        position: absolute;
+        top: 0;
+        left: 0;
+    }
+
+    #code4-scanner, #isbn-scanner {
+        position: relative;
+        overflow: hidden;
+    }
+
+    /* Image Management */
+    .existing-images-grid {
+        display: flex;
+        flex-wrap: wrap;
+        gap: 15px;
+        margin-top: 10px;
+    }
+
+    .existing-image-card {
+        border: 1px solid #ddd;
+        border-radius: 5px;
+        padding: 8px;
+        text-align: center;
+        background: #fff;
+        width: 120px;
+    }
+
+    .existing-image-card img {
+        width: 100%;
+        height: 100px;
+        object-fit: cover;
+        border-radius: 4px;
+    }
+
+    .existing-image-card label {
+        font-size: 0.8em;
+        margin-top: 5px;
+        cursor: pointer;
+        font-weight: normal;
+    }
+
+    .add-new-btn {
+        background-color: #007bff;
+        color: white;
+        border: none;
+        padding: 5px 10px;
+        border-radius: 3px;
+        cursor: pointer;
+        margin-top: 5px;
+        font-size: 12px;
+    }
+
+    .submit-button {
+        background-color: #28a745;
+        color: white;
+        border: none;
+        padding: 15px 30px;
+        border-radius: 5px;
+        font-size: 18px;
+        font-weight: bold;
+        cursor: pointer;
+        width: 100%;
+        margin-top: 20px;
+        transition: background-color 0.2s ease;
+    }
+
+    .submit-button:hover {
+        background-color: #218838;
+    }
+
+    .edit-new-location-container {
+        display: none;
+        margin-top: 10px;
+    }
+</style>
+
+<div class="edit-container">
+    <div class="edit-form">
+        <h1>{{ page_title|default('Artikel bearbeiten') }}</h1>
+        <form method="POST" action="{{ url_for('item_edit', id=item._id) }}" enctype="multipart/form-data">
+            <input type="hidden" name="item_id" value="{{ item._id }}">
+
+            {% if show_library_features %}
+            <!-- ================= LIBRARY SPECIFIC FIELDS ================= -->
+            <div class="form-group">
+                <label for="isbn">ISBN / Barcode:</label>
+                <div class="isbn-input-group">
+                    <input type="text" id="isbn" name="isbn" value="{{ item.ISBN|default('') }}" placeholder="ISBN oder Barcode eingeben...">
+                    <button type="button" id="scan-isbn-btn" class="fetch-isbn-button">Barcode scannen</button>
+                    <button type="button" class="fetch-isbn-button" onclick="fetchBookInfo('edit')">Informationen abrufen</button>
+                </div>
+                <div id="isbn-scanner" style="width:100%; max-width:520px; display:none; margin-top:10px;"></div>
+                <small id="isbn-scan-status" style="display:block; color:#666; margin-top:6px;"></small>
+                <div id="book-info-container"></div>
+            </div>
+
+            <div class="filter-inputs" style="margin-bottom: 20px;">
+                <h3>Medientyp</h3>
+                <div class="form-group">
+                    <select name="item_type_input" id="item_type_input">
+                        <option value="Buch" {% if item.ItemType == 'Buch' %}selected{% endif %}>Buch</option>
+                        <option value="Schulbuch" {% if item.ItemType == 'Schulbuch' %}selected{% endif %}>Schulbuch</option>
+                        <option value="CD" {% if item.ItemType == 'CD' %}selected{% endif %}>CD</option>
+                        <option value="DVD" {% if item.ItemType == 'DVD' %}selected{% endif %}>DVD</option>
+                        <option value="Sonstiges" {% if item.ItemType == 'Sonstiges' %}selected{% endif %}>Sonstiges</option>
+                    </select>
+                </div>
+                <h3>Bibliotheks-Kategorie:</h3>
+                <div class="form-group">
+                    <input type="text" name="library_category" id="library_category" value="{{ item.library_category|default('') }}" placeholder="z.B. Belletristik, Sachbücher, etc.">
+                </div>
+            </div>
+            {% endif %}
+
+            <!-- ================= COMMON CORE FIELDS ================= -->
+            <div class="form-group">
+                <label for="name">Name / Titel:</label>
+                <input type="text" id="name" name="name" value="{{ item.Name|default('') }}" required>
+            </div>
+
+            <div class="form-group">
+                <label for="ort">Ort / Standort:</label>
+                <select id="ort" name="ort" data-selected="{{ item.Ort|default('') }}" required>
+                    <option value="">-- Bitte Ort auswählen --</option>
+                    {% if item.Ort %}
+                    <option value="{{ item.Ort }}" selected>{{ item.Ort }}</option>
+                    {% endif %}
+                </select>
+                <button type="button" class="add-new-btn" id="add-new-location-btn">Neuen Ort hinzufügen</button>
+                <div id="new-location-container" class="edit-new-location-container">
+                    <input type="text" id="new-location-input" placeholder="Neuen Ort eingeben">
+                    <button type="button" onclick="addNewLocation()">Hinzufügen</button>
+                    <button type="button" onclick="cancelAddLocation()">Abbrechen</button>
+                </div>
+            </div>
+
+            <div class="form-group">
+                <label for="beschreibung">Beschreibung:</label>
+                <textarea id="beschreibung" name="beschreibung" required>{{ item.Beschreibung|default('') }}</textarea>
+            </div>
+
+            <div class="form-group" id="primary_code_group">
+                <label for="code_4">Basis-Code (Haupt-Barcode)</label>
+                <div style="display: flex; gap: 10px;">
+                    <input type="text" id="code_4" name="code_4" class="form-control" value="{{ item.Code_4|default('') }}" required>
+                    <button type="button" id="scan-code4-btn" class="fetch-isbn-button">Barcode scannen</button>
+                </div>
+                <div id="code4-scanner" style="display:none; margin-top: 10px;"></div>
+                <small id="code4-scan-status" class="form-text text-muted"></small>
+            </div>
+
+            <div class="form-group" id="individual_codes_group">
+                <label for="individual_codes">Weitere Einzelcodes der Gruppe (je Zeile ein Code)</label>
+                <textarea id="individual_codes" name="individual_codes" rows="4" class="form-control" placeholder="z.B.&#10;ABC-001&#10;ABC-002">{{ item.IndividualCodes|default('') }}</textarea>
+                <small style="display:block; color:#666; margin-top: 5px;">Der Basis-Code steht oben. Alle weiteren Gruppenmitglieder werden hier untereinander aufgeführt.</small>
+            </div>
+
+            <!-- ================= SYSTEM FILTERS 1-3 (ALWAYS RENDERED) ================= -->
+            <div class="filter-inputs">
+                <h3>Unterrichtsfach (Filter 1):</h3>
+                <div class="multi-filter">
+                    {% for idx in range(4) %}
+                    <div class="form-group">
+                        <label for="filter1-{{ idx + 1 }}">Wert {{ idx + 1 }}:</label>
+                        <select id="filter1-{{ idx + 1 }}" name="filter" class="filter-dropdown-select" data-selected="{{ item.Filter[idx] if item.Filter and item.Filter|length > idx else '' }}">
+                            <option value="">-- Optional --</option>
+                        </select>
+                    </div>
+                    {% endfor %}
+                </div>
+
+                <h3>Jahrgangsstufe (Filter 2):</h3>
+                <div class="multi-filter">
+                    {% for idx in range(4) %}
+                    <div class="form-group">
+                        <label for="filter2-{{ idx + 1 }}">Wert {{ idx + 1 }}:</label>
+                        <select id="filter2-{{ idx + 1 }}" name="filter2" class="filter-dropdown-select" data-selected="{{ item.Filter2[idx] if item.Filter2 and item.Filter2|length > idx else '' }}">
+                            <option value="">-- Optional --</option>
+                        </select>
+                    </div>
+                    {% endfor %}
+                </div>
+
+                <h3>Schlagwort (Filter 3):</h3>
+                <div class="multi-filter">
+                    {% for idx in range(4) %}
+                    <div class="form-group">
+                        <label for="filter3-{{ idx + 1 }}">Wert {{ idx + 1 }}:</label>
+                        <input type="text" id="filter3-{{ idx + 1 }}" name="filter3" value="{{ item.Filter3[idx] if item.Filter3 and item.Filter3|length > idx else '' }}">
+                    </div>
+                    {% endfor %}
+                </div>
+            </div>
+
+            <!-- ================= DATES & FINANCIALS ================= -->
+            <div class="form-group">
+                <label for="anschaffungsjahr">Anschaffungsjahr:</label>
+                <input type="date" id="anschaffungsjahr" name="anschaffungsjahr" value="{{ item.Anschaffungsjahr|default('') }}">
+            </div>
+            <div class="form-group">
+                <label for="anschaffungskosten">Anschaffungskosten (€):</label>
+                <input type="text" id="anschaffungskosten" name="anschaffungskosten" value="{{ item.Anschaffungskosten|default('') }}">
+            </div>
+
+            {% if not show_library_features %}
+            <!-- ================= INVENTORY IMAGE MANAGEMENT ================= -->
+            <div class="form-group">
+                <label>Bestehende Bilder behalten:</label>
+                {% if item.Images and item.Images|length > 0 %}
+                <div class="existing-images-grid">
+                    {% for img in item.Images %}
+                    <div class="existing-image-card">
+                        <img src="{{ url_for('uploaded_file', filename=img) }}" alt="Bild">
+                        <label>
+                            <input type="checkbox" name="existing_images" value="{{ img }}" checked>
+                            Behalten
+                        </label>
+                    </div>
+                    {% endfor %}
+                </div>
+                {% else %}
+                <p style="color:#777; font-size:0.9em;">Keine Bilder vorhanden.</p>
+                {% endif %}
+
+                <label for="images" style="margin-top:15px;">Neue Bilder/Videos hinzufügen:</label>
+                <input type="file" id="images" name="images" accept=".jpg, .jpeg, .png, .gif, .mp4, .mov, .avi, .mkv, .webm" multiple>
+            </div>
+            {% endif %}
+
+            <div class="form-group">
+                <label for="reservierbar" style="display:inline-block; width:auto; margin-right:10px;">Reservierbar:</label>
+                <input type="checkbox" id="reservierbar" name="reservierbar" style="width:auto;" {% if item.Reservierbar %}checked{% endif %}>
+            </div>
+
+            <button type="submit" class="submit-button">Änderungen speichern</button>
+        </form>
+    </div>
+</div>
+
+<script src="https://cdn.jsdelivr.net/npm/@ericblade/quagga2/dist/quagga.js"></script>
+<script>
+    let scannerRunning = false;
+    let activeScannerCallback = null;
+    let code4LastScanned = '';
+    let code4LastScannedAt = 0;
+
+    function loadAndSelectFilterValues(filterNumber) {
+        fetch(`/get_predefined_filter_values/${filterNumber}`)
+            .then(res => res.json())
+            .then(data => {
+                for (let i = 1; i <= 4; i++) {
+                    const select = document.getElementById(`filter${filterNumber}-${i}`);
+                    if (!select) continue;
+
+                    const selectedValue = select.getAttribute('data-selected') || '';
+
+                    data.values.forEach(val => {
+                        if (!val || String(val).trim() === '') return;
+                        const opt = document.createElement('option');
+                        opt.value = val;
+                        opt.textContent = val;
+                        select.appendChild(opt);
+                    });
+
+                    if (selectedValue && !Array.from(select.options).some(o => o.value === selectedValue)) {
+                        const customOpt = document.createElement('option');
+                        customOpt.value = selectedValue;
+                        customOpt.textContent = selectedValue;
+                        select.appendChild(customOpt);
+                    }
+
+                    select.value = selectedValue;
+                }
+            })
+            .catch(err => console.error(`Error loading Filter ${filterNumber}:`, err));
+    }
+
+    function loadLocationOptions() {
+        fetch('/get_predefined_locations')
+            .then(res => res.json())
+            .then(data => {
+                const select = document.getElementById('ort');
+                if (!select) return;
+                const currentVal = select.getAttribute('data-selected') || select.value;
+
+                data.locations.forEach(loc => {
+                    if (!Array.from(select.options).some(o => o.value === loc)) {
+                        const opt = document.createElement('option');
+                        opt.value = loc;
+                        opt.textContent = loc;
+                        select.appendChild(opt);
+                    }
+                });
+
+                select.value = currentVal;
+            })
+            .catch(err => console.error('Error loading locations:', err));
+    }
+
+    function addNewLocation() {
+        const input = document.getElementById('new-location-input');
+        const val = input.value.trim();
+        if (!val) return;
+        const select = document.getElementById('ort');
+        const opt = document.createElement('option');
+        opt.value = val;
+        opt.textContent = val;
+        opt.selected = true;
+        select.appendChild(opt);
+        document.getElementById('new-location-container').style.display = 'none';
+        input.value = '';
+    }
+
+    function cancelAddLocation() {
+        document.getElementById('new-location-container').style.display = 'none';
+        document.getElementById('new-location-input').value = '';
+    }
+
+    function runEngineInitialization(targetSelector, activeCallback, completionMsg, errorStatusSetter) {
+        if (scannerRunning) { Quagga.stop(); scannerRunning = false; }
+        activeScannerCallback = activeCallback;
+
+        Quagga.init({
+            inputStream: { name: "Live", type: "LiveStream", target: document.querySelector(targetSelector), constraints: { width: 640, height: 480, facingMode: "environment" } },
+            decoder: { readers: ["code_128_reader", "ean_reader", "code_39_reader", "upc_reader"] }
+        }, function(err) {
+            if (err) { errorStatusSetter("Kamera-Fehler.", true); return; }
+            Quagga.start(); scannerRunning = true; errorStatusSetter(completionMsg, false);
+        });
+    }
+
+    function killScannerHardware() {
+        if (!scannerRunning) return;
+        Quagga.stop(); scannerRunning = false; activeScannerCallback = null;
+    }
+
+    Quagga.onDetected(function(data) {
+        if (!data || !data.codeResult || !data.codeResult.code) return;
+        if (typeof activeScannerCallback === "function") activeScannerCallback(String(data.codeResult.code).trim());
+    });
+
+    function startCode4Scanner() {
+        const scannerBox = document.getElementById('code4-scanner');
+        const scanBtn = document.getElementById('scan-code4-btn');
+        const baseField = document.getElementById('code_4');
+        const indArea = document.getElementById('individual_codes');
+
+        if (scannerBox.style.display !== 'none') {
+            killScannerHardware(); scannerBox.style.display = 'none'; scanBtn.textContent = 'Barcode scannen'; return;
+        }
+
+        scannerBox.style.display = 'block'; scanBtn.textContent = 'Scanner stoppen';
+        runEngineInitialization('#code4-scanner', function(decodedText) {
+            const now = Date.now();
+            if (decodedText === code4LastScanned && (now - code4LastScannedAt) < 1500) return;
+            code4LastScanned = decodedText; code4LastScannedAt = now;
+
+            killScannerHardware(); scannerBox.style.display = 'none'; scanBtn.textContent = 'Barcode scannen';
+
+            if (!baseField.value.trim()) {
+                baseField.value = decodedText;
+            } else {
+                let codes = indArea.value.split('\n').map(c => c.trim()).filter(c => c);
+                if (!codes.includes(decodedText) && baseField.value.trim() !== decodedText) {
+                    codes.push(decodedText);
+                    indArea.value = codes.join('\n');
+                }
+            }
+        }, 'Scanner läuft...', msg => { document.getElementById('code4-scan-status').textContent = msg; });
+    }
+
+    document.addEventListener('DOMContentLoaded', function() {
+        loadLocationOptions();
+
+        // Always load Filter 1 and Filter 2 options for all items
+        loadAndSelectFilterValues(1);
+        loadAndSelectFilterValues(2);
+
+        const scanCodeBtn = document.getElementById('scan-code4-btn');
+        if (scanCodeBtn) scanCodeBtn.addEventListener('click', startCode4Scanner);
+
+        const addLocBtn = document.getElementById('add-new-location-btn');
+        if (addLocBtn) addLocBtn.addEventListener('click', () => {
+            const c = document.getElementById('new-location-container');
+            c.style.display = c.style.display === 'none' ? 'block' : 'none';
+        });
+    });
+</script>
+{% endblock %}

Web/templates/library_table.html

@@ -355,6 +355,28 @@
         color: #6b7280;
     }
 
+    /* Small confirmation popup (toast) */
+    .small-popup {
+        position: fixed;
+        bottom: 24px;
+        left: 50%;
+        transform: translateX(-50%);
+        background: rgba(17, 24, 39, 0.96);
+        color: #fff;
+        padding: 12px 16px;
+        border-radius: 8px;
+        box-shadow: 0 6px 24px rgba(2,6,23,0.6);
+        z-index: 2000;
+        display: flex;
+        gap: 10px;
+        align-items: center;
+        max-width: 90%;
+        font-size: 0.95em;
+    }
+    .small-popup.ok { background: rgba(16,185,129,0.95); color: #032; }
+    .small-popup.error { background: rgba(239,68,68,0.95); color: #210; }
+    .small-popup .close-x { margin-left: 8px; cursor: pointer; font-weight: 700; }
+
     /* Modal styles */
     .modal {
         display: none;
@@ -502,9 +524,19 @@
                 <option value="card_only">Nur Ausweis erfassen</option>
                 <option value="quick_toggle">Schnellmodus: Ausweis + Mediencode</option>
             </select>
-            <input type="text" id="activeStudentCard" placeholder="Aktiver Ausweis (gescannt)" readonly>
+            <input type="text" id="activeStudentCard" placeholder="Aktiver Ausweis (gescannt)" >
+            <input type="text" id="manualItemCode" placeholder="Manueller Mediencode (optional)" style="min-width:180px;">
             <button id="resetCardBtn" class="button" type="button">Ausweis löschen</button>
             <button id="toggleScannerBtn" class="button" type="button">Scanner starten</button>
+            <label style="display:flex; align-items:center; gap:8px; margin-left:6px;">
+                <input type="checkbox" id="keyboardScannerToggle">
+                <span style="font-size:0.9em;">Physischer Scanner</span>
+            </label>
+            <label style="display:flex; align-items:center; gap:8px; margin-left:6px;">
+                <input type="checkbox" id="returnOnlyToggle">
+                <span style="font-size:0.9em;">Nur Rückgabe (nur Mediencode)</span>
+            </label>
+            <button id="manualReturnBtn" class="button" type="button" style="margin-left:6px; background:#10b981;color:white;">Rückgabe per Code</button>
         </div>
         <div id="scanStatus" class="library-scan-status">
             Hinweis: Im Schnellmodus zuerst den Schülerausweis scannen, danach den Buch-/Mediencode.
@@ -632,6 +664,16 @@
     let activeStudentCardId = '';
     let lastScanValue = '';
     let lastScanAt = 0;
+    // Keyboard-scanner support (physical scanners that act as keyboard wedges)
+    let keyboardScannerEnabled = false;
+    let keyboardScanBuffer = '';
+    let keyboardLastKeyAt = 0;
+    const KEYBOARD_SCAN_INTERCHAR_MS = 100; // max time between keystrokes to consider them one scan
+    let editLibraryState = {
+        itemId: '',
+        seriesGroupId: '',
+        groupMembers: []
+    };
     
     const canEditLibraryItems = (document.getElementById('libraryTableContainer')?.dataset.canEdit === '1');
 
@@ -758,7 +800,7 @@
             return `
         <tr>
             <td class="table-title">${escapeHtml(item.Name || 'Untitled')}</td>
-            <td>${escapeHtml(item.ISBN || item.Code_4 || item.Code4 || '-')}</td>
+            <td>${escapeHtml(item.ISBN || '-')}</td>
             <td>${getItemTypeLabel(item.ItemType || 'book')}</td>
             <td style="font-weight:600; text-align:center;">${item.Quantity || item.GroupedDisplayCount || 1}</td>
             <td>
@@ -905,6 +947,13 @@
         const currentCallback = activeScannerCallback;
         stopScanner();
     
+        const returnOnly = (document.getElementById('returnOnlyToggle') || {}).checked;
+        if (returnOnly) {
+            // direct return flow
+            returnByCode(barcode);
+            return;
+        }
+
         if (typeof currentCallback === "function") {
             currentCallback(barcode);
         } else {
@@ -912,6 +961,50 @@
         }
     });
 
+    // =========================================================================
+    // Keyboard scanner handling (physical scanners that send chars then Enter)
+    // =========================================================================
+    function keyboardScanKeydownHandler(e) {
+        // Only active when explicitly enabled
+        if (!keyboardScannerEnabled) return;
+
+        // Ignore if focus is in an input/textarea/contenteditable to avoid interfering with typing
+        const active = document.activeElement;
+        if (active && (active.tagName === 'INPUT' || active.tagName === 'TEXTAREA' || active.isContentEditable)) return;
+
+        const now = Date.now();
+
+        // If Enter/Return pressed -> finalize buffer
+        if (e.key === 'Enter') {
+            const code = keyboardScanBuffer.trim();
+            keyboardScanBuffer = '';
+            keyboardLastKeyAt = 0;
+            if (!code) return;
+            // If return-only mode is active, attempt direct return
+            const returnOnly = (document.getElementById('returnOnlyToggle') || {}).checked;
+            if (returnOnly) {
+                returnByCode(code);
+                return;
+            }
+
+            // Process exactly like a camera scan
+            handleScanSuccess(code);
+            return;
+        }
+
+        // Only accept common printable characters; ignore modifier keys
+        if (e.key.length === 1) {
+            // If time gap too big, start new buffer
+            if (keyboardLastKeyAt && (now - keyboardLastKeyAt) > KEYBOARD_SCAN_INTERCHAR_MS) {
+                keyboardScanBuffer = '';
+            }
+            keyboardScanBuffer += e.key;
+            keyboardLastKeyAt = now;
+            // Prevent default so scanner input doesn't accidentally move focus or trigger shortcuts
+            e.preventDefault();
+        }
+    }
+
     function handleScanSuccess(decodedText) {
         const scannedCode = normalizeScannedCode(decodedText);
         if (!scannedCode) return;
@@ -934,12 +1027,21 @@
     }
 
     async function processQuickToggleScan(scannedCode) {
+        // 1. Prüfen, ob "Nur Rückgabe"-Modus aktiv ist
+        const returnOnly = (document.getElementById('returnOnlyToggle') || {}).checked;
+        if (returnOnly) {
+            await returnByCode(scannedCode);
+            return;
+        }
+
+        // 2. Wenn kein Ausweis gesetzt ist, wird der Code als Ausweis interpretiert
         if (!activeStudentCardId) {
             setActiveStudentCard(scannedCode);
             setScanStatus(`Ausweis gesetzt: ${activeStudentCardId}`, 'ok');
             return;
         }
-    
+
+        // 3. Ausleihe/Rückgabe verarbeiten (wenn Ausweis vorhanden)
         try {
             setScanStatus('Verarbeite Mediencode...', 'warn');
             const response = await fetch('/api/library_scan_action', {
@@ -950,21 +1052,24 @@
                     item_code: scannedCode
                 })
             });
-        
+
             const result = await response.json();
             if (!response.ok || !result.ok) {
                 setScanStatus(result.message || 'Scan-Aktion fehlgeschlagen.', 'error');
                 return;
             }
-        
+
             if (result.action === 'borrowed') {
                 setScanStatus(`Ausgeliehen: ${result.item_name}`, 'ok');
+                showSmallConfirm(`Ausgeliehen: ${result.item_name}`, 'ok');
             } else if (result.action === 'returned') {
                 setScanStatus(`Zurückgegeben: ${result.item_name}`, 'ok');
+                showSmallConfirm(`Zurückgegeben: ${result.item_name}`, 'ok');
             } else {
                 setScanStatus(result.message || 'Aktion durchgeführt.', 'ok');
+                showSmallConfirm(result.message || 'Aktion durchgeführt.', 'ok');
             }
-        
+
             await loadLibraryItems();
         } catch (err) {
             console.error('Quick scan action failed:', err);
@@ -972,6 +1077,33 @@
         }
     }
 
+    async function returnByCode(code) {
+        if (!code) return;
+        setScanStatus('Verarbeite Rückgabe...', 'warn');
+        try {
+            const resp = await fetch('/api/library_return_by_code', {
+                method: 'POST',
+                headers: {'Content-Type': 'application/json'},
+                body: JSON.stringify({ item_code: code })
+            });
+            const result = await resp.json();
+            if (!resp.ok || !result.ok) {
+                setScanStatus(result.message || 'Rückgabe fehlgeschlagen.', 'error');
+                showSmallConfirm(result.message || 'Rückgabe fehlgeschlagen.', 'error');
+                return false;
+            }
+            setScanStatus(result.message || `Zurückgegeben: ${result.item_name || ''}`, 'ok');
+            showSmallConfirm(result.message || `Zurückgegeben: ${result.item_name || ''}`, 'ok');
+            await loadLibraryItems();
+            return true;
+        } catch (err) {
+            console.error('Return by code failed:', err);
+            setScanStatus('Fehler bei Rückgabe.', 'error');
+            showSmallConfirm('Fehler bei Rückgabe.', 'error');
+            return false;
+        }
+    }
+
     function scanIntoEditCode() {
         const scanReaderWrap = document.getElementById('scanReaderWrap');
         const editCodeInput = document.getElementById('edit-code4');
@@ -979,15 +1111,15 @@
         if (!scanReaderWrap || !editCodeInput || !scanEditBtn) {
             return;
         }
-    
+
         if (scannerRunning && scanReaderWrap.style.display !== 'none') {
             stopScanner();
             scanEditBtn.textContent = 'Barcode scannen';
             return;
         }
-    
+
         scanEditBtn.textContent = 'Scanner schließen';
-    
+
         startScanner(function(decodedText) {
             editCodeInput.value = decodedText;
             if(typeof validateCodeField === "function") {
@@ -1006,16 +1138,16 @@
             alert('Dieses Medium ist als defekt/zerstört markiert und kann nicht ausgeliehen werden.');
             return;
         }
-    
+
         const defaultCardId = activeStudentCardId || '';
         const cardId = (window.prompt('Bitte Schülerausweis-ID eingeben:', defaultCardId) || '').trim().toUpperCase();
         if (!cardId) {
             alert('Ausleihe abgebrochen: Für Bibliotheksmedien ist eine gültige Schülerausweis-ID erforderlich.');
             return;
         }
-    
+
         setActiveStudentCard(cardId);
-    
+
         const durationInput = (window.prompt('Ausleihdauer in Tagen (optional):') || '').trim();
         const maxAvailable = Math.max(1, parseInt(selectedItem?.AvailableGroupedCount || selectedItem?.Quantity || 1, 10) || 1);
         const countPrompt = (window.prompt(`Anzahl ausleihen? (Standard: 1, verfügbar: ${maxAvailable})`, '1') || '').trim();
@@ -1027,29 +1159,29 @@
             alert(`Es sind nur ${maxAvailable} Exemplar(e) verfügbar.`);
             return;
         }
-    
+
         const form = document.createElement('form');
         form.method = 'POST';
         form.action = `/ausleihen/${itemId}`;
-    
+
         const csrfField = document.createElement('input');
         csrfField.type = 'hidden';
         csrfField.name = 'csrf_token';
         csrfField.value = '{{ csrf_token }}';
         form.appendChild(csrfField);
-    
+
         const cardField = document.createElement('input');
         cardField.type = 'hidden';
         cardField.name = 'borrower_card_id';
         cardField.value = cardId;
         form.appendChild(cardField);
-    
+
         const returnTargetField = document.createElement('input');
         returnTargetField.type = 'hidden';
         returnTargetField.name = 'return_to';
         returnTargetField.value = 'library';
         form.appendChild(returnTargetField);
-    
+
         if (durationInput) {
             const durationField = document.createElement('input');
             durationField.type = 'hidden';
@@ -1057,13 +1189,13 @@
             durationField.value = durationInput;
             form.appendChild(durationField);
         }
-    
+
         const countField = document.createElement('input');
         countField.type = 'hidden';
         countField.name = 'exemplare_count';
         countField.value = String(borrowCount || 1);
         form.appendChild(countField);
-    
+
         document.body.appendChild(form);
         form.submit();
     }
@@ -1075,13 +1207,28 @@
         el.classList.remove('ok', 'warn', 'error');
         if (kind) el.classList.add(kind);
     }
-    
+
+    function showSmallConfirm(message, kind='ok') {
+        // Append the small helper text in German
+        const helper = 'Sie können fortfahren. Dies ist nur eine kleine Benachrichtigung.';
+        const el = document.createElement('div');
+        el.className = `small-popup ${kind === 'error' ? 'error' : 'ok'}`;
+        el.innerHTML = `<div>${escapeHtml(String(message || ''))}</div><div style="opacity:0.9; margin-left:8px; font-size:0.85em;">${helper}</div><div class="close-x">&times;</div>`;
+        document.body.appendChild(el);
+        // close handler
+        el.querySelector('.close-x').addEventListener('click', () => {
+            if (el && el.parentNode) el.parentNode.removeChild(el);
+        });
+        // auto remove after 3 seconds
+        setTimeout(() => { try { if (el && el.parentNode) el.parentNode.removeChild(el); } catch(e){} }, 3000);
+    }
+
     function setActiveStudentCard(cardId) {
         activeStudentCardId = (cardId || '').trim().toUpperCase();
         const input = document.getElementById('activeStudentCard');
         if (input) input.value = activeStudentCardId;
     }
-    
+
     function normalizeScannedCode(code) {
         return (code || '').trim();
     }
@@ -1145,7 +1292,8 @@
         const toggleBtn = document.getElementById('toggleScannerBtn');
         const resetBtn = document.getElementById('resetCardBtn');
         const modeSelect = document.getElementById('scanModeSelect');
-    
+        const keyboardToggle = document.getElementById('keyboardScannerToggle');
+
         if (toggleBtn) {
             toggleBtn.addEventListener('click', async () => {
                 if (scannerRunning) {
@@ -1155,14 +1303,14 @@
                 }
             });
         }
-    
+
         if (resetBtn) {
             resetBtn.addEventListener('click', () => {
                 setActiveStudentCard('');
                 setScanStatus('Ausweis zurückgesetzt. Bitte neu scannen.', 'warn');
             });
         }
-    
+
         if (modeSelect) {
             modeSelect.addEventListener('change', () => {
                 if (modeSelect.value === 'quick_toggle' && !activeStudentCardId) {
@@ -1172,11 +1320,24 @@
                 }
             });
         }
+
+        if (keyboardToggle) {
+            keyboardToggle.addEventListener('change', () => {
+                keyboardScannerEnabled = !!keyboardToggle.checked;
+                if (keyboardScannerEnabled) {
+                    document.addEventListener('keydown', keyboardScanKeydownHandler);
+                    setScanStatus('Physischer Scanner aktiv (Schnellmodus empfohlen).', 'ok');
+                } else {
+                    document.removeEventListener('keydown', keyboardScanKeydownHandler);
+                    setScanStatus('Physischer Scanner deaktiviert.', 'warn');
+                }
+            });
+        }
     }
 
     // Run when DOM structure is entirely ready
-    document.addEventListener('DOMContentLoaded', () => {
-        wireScannerUi();       // Setup scanner control buttons 
+    document.addEventListener('DOMContentLoaded', async () => {
+        wireScannerUi();       // Setup scanner control buttons
         loadLibraryItems();   // Fetch your database items right away!
 
         // Safely connect standard Filters and Search inputs inside DOMContentLoaded
@@ -1205,7 +1366,7 @@
                 document.getElementById('filterISBN').value = '';
                 document.getElementById('filterType').value = '';
                 document.getElementById('filterStatus').value = '';
-                activeFilters = { isbn: '', type: '', status: '' };
+                activeFilters = {isbn: '', type: '', status: ''};
                 applyFiltersAndSearch(true);
             });
         }
@@ -1226,44 +1387,107 @@
             });
         }
 
-        // Edit Modal Form processing
+        const manualReturnBtn = document.getElementById('manualReturnBtn');
+        const manualItemCode = document.getElementById('manualItemCode');
+        if (manualReturnBtn && manualItemCode) {
+            manualReturnBtn.addEventListener('click', async () => {
+                const code = (manualItemCode.value || '').trim();
+                if (!code) {
+                    alert('Bitte einen Mediencode eingeben.');
+                    return;
+                }
+                await returnByCode(code);
+            });
+        }
+
         const editForm = document.getElementById('editLibraryForm');
         if (editForm) {
-            editForm.addEventListener('submit', async function(e) {
-                e.preventDefault(); 
+            editForm.addEventListener('submit', async function (e) {
+                e.preventDefault();
 
                 const itemId = document.getElementById('editLibraryItemId').value;
+                const currentItem = libraryItems.find(i => i._id === itemId);
+                if (!currentItem) return;
 
-                const updatedData = {
+                const codeInputs = Array.from(document.querySelectorAll('#editLibraryCodesContainer input[data-item-id]'));
+
+                // Daten aus dem Formular sammeln
+                const sharedPayload = {
                     name: document.getElementById('editLibraryName').value,
                     item_type: document.getElementById('editLibraryType').value,
                     isbn: document.getElementById('editLibraryIsbn').value,
-                    code_4: document.getElementById('editLibraryCode4').value, 
                     ort: document.getElementById('editLibraryLocation').value,
-                    beschreibung: document.getElementById('editLibraryDescription').value
+                    beschreibung: document.getElementById('editLibraryDescription').value,
+                    ansch_jahr: currentItem.Anschaffungsjahr || '',
+                    ansch_kost: currentItem.Anschaffungskosten || '',
+                    reservierbar: currentItem.Reservierbar !== false,
                 };
 
+                const codeByItemId = new Map(codeInputs.map(input => [input.dataset.itemId, (input.value || '').trim()]));
+                const groupMembers = editLibraryState.groupMembers.length > 0 ? editLibraryState.groupMembers : [currentItem];
+                const isGroupedEdit = Boolean(currentItem.SeriesGroupId) && groupMembers.length > 1;
+
+                // API-Aufruf
                 try {
-                    const response = await fetch(`/api/library_item/${itemId}/update`, {
-                        method: 'POST',
-                        headers: {
-                            'Content-Type': 'application/json',
-                            'X-CSRFToken': '{{ csrf_token }}', 
-                            'X-CSRF-Token': '{{ csrf_token }}'
-                        },
-                        body: JSON.stringify(updatedData)
-                    });
+                    if (isGroupedEdit) {
+                        const payload = {
+                            series_group_id: currentItem.SeriesGroupId,
+                            ...sharedPayload,
+                            items: groupMembers.map(member => ({
+                                id: member._id,
+                                code_4: codeByItemId.get(member._id) || ''
+                            }))
+                        };
 
-                    const result = await response.json();
+                        const response = await fetch('/update_group', {
+                            method: 'POST',
+                            headers: {
+                                'Content-Type': 'application/json',
+                                'X-CSRFToken': '{{ csrf_token }}',
+                                'X-CSRF-Token': '{{ csrf_token }}'
+                            },
+                            body: JSON.stringify(payload)
+                        });
 
-                    if (response.ok && result.ok) {
-                        alert(result.message || 'Medium erfolgreich aktualisiert!');
-                        closeEditLibraryModal();
-
-                        pagingState.loading = false; 
-                        loadLibraryItems(); 
+                        const result = await response.json();
+                        if (response.ok && result.success) {
+                            alert(result.message || 'Gruppe erfolgreich aktualisiert!');
+                            closeEditLibraryModal();
+                            pagingState.loading = false;
+                            await loadLibraryItems();
+                        } else {
+                            alert(result.message || 'Fehler beim Speichern der Gruppenänderungen.');
+                        }
                     } else {
-                        alert(result.message || 'Fehler beim Speichern der Änderungen.');
+                        const primaryCodeInput = codeInputs[0];
+                        const payload = {
+                            name: sharedPayload.name,
+                            item_type: sharedPayload.item_type,
+                            isbn: sharedPayload.isbn,
+                            code_4: primaryCodeInput ? primaryCodeInput.value.trim() : (currentItem.Code_4 || currentItem.Code4 || '').trim(),
+                            ort: sharedPayload.ort,
+                            beschreibung: sharedPayload.beschreibung
+                        };
+
+                        const response = await fetch(`/api/library_item/${itemId}/update`, {
+                            method: 'POST',
+                            headers: {
+                                'Content-Type': 'application/json',
+                                'X-CSRFToken': '{{ csrf_token }}',
+                                'X-CSRF-Token': '{{ csrf_token }}'
+                            },
+                            body: JSON.stringify(payload)
+                        });
+
+                        const result = await response.json();
+                        if (response.ok && result.ok) {
+                            alert(result.message || 'Medium erfolgreich aktualisiert!');
+                            closeEditLibraryModal();
+                            pagingState.loading = false;
+                            await loadLibraryItems();
+                        } else {
+                            alert(result.message || 'Fehler beim Speichern der Änderungen.');
+                        }
                     }
                 } catch (error) {
                     console.error('Update failed:', error);
@@ -1273,195 +1497,76 @@
         }
     });
 
-    window.openEditLibraryItem = function(itemId) {
-        const item = libraryItems.find(i => i._id === itemId);
-        if (!item) return;
-
-        // 1. Felder befüllen
-        document.getElementById('editLibraryItemId').value = item._id;
-        document.getElementById('editLibraryName').value = item.Name;
-        document.getElementById('editLibraryType').value = item.ItemType;
-        document.getElementById('editLibraryIsbn').value = item.ISBN || '';
-        document.getElementById('editLibraryCode4').value = item.Code_4 || '';
-        document.getElementById('editLibraryLocation').value = item.Ort;
-        document.getElementById('editLibraryDescription').value = item.Beschreibung;
-
-        // 2. Gruppen-Logik
-        const warningDiv = document.getElementById('editLibraryGroupWarning');
-        const codesContainer = document.getElementById('editLibraryAllCodes');
-
-        if (item.SeriesGroupId) {
-            // Filtern aus dem aktuell geladenen Array
-            let groupMembers = libraryItems.filter(i => i.SeriesGroupId === item.SeriesGroupId);
-
-            // SCHLÜSSEL: Wenn die Anzahl der gefundenen Elemente nicht mit SeriesCount übereinstimmt,
-            // haben wir die Gruppe noch nicht vollständig geladen.
-            if (groupMembers.length < (item.SeriesCount || 0)) {
-                console.warn("Gruppe noch nicht vollständig geladen. Anzeige ggf. unvollständig.");
-                // Optional: Zeige einen Ladehinweis im Modal
-                codesContainer.textContent = "Lade restliche Gruppenmitglieder...";
-            } else {
-                // Daten sind vollständig -> Anzeigen
-                const codeList = groupMembers
-                    .sort((a, b) => (a.SeriesPosition || 0) - (b.SeriesPosition || 0))
-                    .map(m => m.Code_4 || "---")
-                    .join(', ');
-
-                codesContainer.textContent = codeList;
+    async function fetchLibraryGroupMembers(seriesGroupId) {
+        if (!seriesGroupId) return [];
+        try {
+            const response = await fetch(`/api/library_group/${encodeURIComponent(seriesGroupId)}`);
+            if (!response.ok) {
+                throw new Error(`HTTP ${response.status}`);
             }
 
-            document.getElementById('editLibraryGroupCount').textContent = groupMembers.length + " / " + (item.SeriesCount || "?");
-            warningDiv.style.display = 'block';
-        } else {
-            warningDiv.style.display = 'none';
+            const payload = await response.json();
+            return Array.isArray(payload.items) ? payload.items : [];
+        } catch (error) {
+            console.warn('Falling back to loaded library items for group editing:', error);
+            return (libraryItems || []).filter(item => item.SeriesGroupId === seriesGroupId);
         }
-
-        document.getElementById('editLibraryModal').style.display = 'flex';
-    };
-
-    function closeEditLibraryModal() {
-        document.getElementById('editLibraryModal').style.display = 'none';
     }
 
-    /**
-     * Event-Listener für das Formular (Initialisierung)
-     */
-    document.addEventListener('DOMContentLoaded', function() {
-        const editForm = document.getElementById('editLibraryForm');
-        if (editForm) {
-            editForm.addEventListener('submit', async function(e) {
-                e.preventDefault();
+    function renderLibraryGroupCodeFields(groupMembers, currentItemId) {
+        const codesContainer = document.getElementById('editLibraryCodesContainer');
+        const groupWarning = document.getElementById('editLibraryGroupWarning');
+        const groupCount = document.getElementById('editLibraryGroupCount');
+        const groupHint = document.getElementById('editLibraryGroupHint');
 
-                const itemId = document.getElementById('editLibraryItemId').value;
-                const currentItem = libraryItems.find(i => i._id === itemId);
+        if (!codesContainer) return;
 
-                if (!currentItem) return;
+        const items = Array.isArray(groupMembers) ? groupMembers.slice() : [];
+        items.sort((a, b) => (a.SeriesPosition || 0) - (b.SeriesPosition || 0) || String(a.Name || '').localeCompare(String(b.Name || '')));
 
-                // 1. Alle Mitglieder der Gruppe finden, um die Code-Liste aufzubauen
-                const groupMembers = libraryItems.filter(i => i.SeriesGroupId === currentItem.SeriesGroupId);
-                const individualUpdates = groupMembers.map(member => ({
-                    id: member._id,
-                    // Wenn dies das bearbeitete Item ist, nimm den neuen Code, sonst den alten
-                    code_4: (member._id === itemId) ? document.getElementById('editLibraryCode4').value : member.Code_4
-                }));
-
-                // 2. Payload für das Backend bauen
-                const payload = {
-                    series_group_id: currentItem.SeriesGroupId,
-                    name: document.getElementById('editLibraryName').value,
-                    ort: document.getElementById('editLibraryLocation').value,
-                    beschreibung: document.getElementById('editLibraryDescription').value,
-                    isbn: document.getElementById('editLibraryIsbn').value,
-                    item_type: document.getElementById('editLibraryType').value,
-                    items: individualUpdates
-                };
-
-                // 3. Request an die Gruppen-Update Route
-                try {
-                    const response = await fetch('/update_group', {
-                        method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
-                        body: JSON.stringify(payload)
-                    });
-
-                    const result = await response.json();
-                    if (result.success) {
-                        alert('Gruppe erfolgreich synchronisiert!');
-                        closeEditLibraryModal();
-                        await loadLibraryItems(); // Daten neu laden
-                        // renderTable(); // Ggf. Tabelle neu rendern
-                    } else {
-                        await loadLibraryItems();
-                        closeEditLibraryModal();
-                    }
-                } catch (error) {
-                    console.error('Update failed:', error);
-                    alert('Netzwerkfehler.');
-                }
-            });
+        editLibraryState.groupMembers = items;
 
+        if (groupWarning) {
+            groupWarning.style.display = items.length > 1 ? 'block' : 'none';
         }
-    });
+        if (groupCount) {
+            const totalCount = items.length || 1;
+            const declaredCount = items[0]?.SeriesCount || totalCount;
+            groupCount.textContent = `${totalCount} / ${declaredCount}`;
+        }
+        if (groupHint) {
+            groupHint.textContent = items.length > 1
+                ? 'Jeder Code gehört zu einem eigenen Exemplar. Änderungen werden für alle Codes gespeichert.'
+                : 'Einzelnes Exemplar. Der Code wird direkt gespeichert.';
+        }
+
+        if (!items.length) {
+            codesContainer.innerHTML = '<div style="padding:10px 0; color:#6b7280;">Keine Codes geladen.</div>';
+            return;
+        }
+
+        codesContainer.innerHTML = items.map((member, index) => {
+            const codeValue = member.Code_4 || member.Code4 || '';
+            const labelParts = [];
+            if (member.SeriesPosition !== undefined && member.SeriesPosition !== null) {
+                labelParts.push(`Exemplar ${member.SeriesPosition}`);
+            } else {
+                labelParts.push(`Exemplar ${index + 1}`);
+            }
+            if (member._id === currentItemId) {
+                labelParts.push('aktuelles Medium');
+            }
+            return `
+            <div style="display:flex; flex-direction:column; gap:6px; margin-bottom:10px;">
+                <label for="editLibraryCode-${member._id}" style="font-weight:600; font-size:0.9em; color:var(--ui-text);">${escapeHtml(labelParts.join(' · '))}</label>
+                <input id="editLibraryCode-${member._id}" data-item-id="${escapeHtml(member._id)}" value="${escapeHtml(codeValue)}" placeholder="Mediencode" style="width:100%; padding:8px 10px; border:1px solid #d0d7e2; border-radius:6px;">
+            </div>
+            `;
+        }).join('');
+    }
+
+    function openEditLibraryItem(itemId) {
+        window.location.href = `/item_edit/${itemId}`;
+    }
 </script>
-
-<div id="editLibraryModal" class="modal" style="display:none;">
-    <div class="modal-content" style="max-width: 760px; padding: 25px; border-radius: 8px;">
-        <span class="close" onclick="closeEditLibraryModal()" style="cursor: pointer; float: right; font-size: 24px;">&times;</span>
-        <h3 style="margin-top:0;">Bibliotheksmedium bearbeiten</h3>
-        
-        <!-- Bereich für Gruppen-Informationen (Hier konsolidiert!) -->
-        <div id="editLibraryGroupWarning" style="display:none; background-color: #fff; padding: 15px; border-radius: 6px; margin-bottom: 20px; border: 1px solid #0ea5e9;">
-            <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 10px; border-bottom: 1px solid #eee; padding-bottom: 10px;">
-                <strong style="color: #0ea5e9;">Gruppen-Range (Total: <span id="editLibraryGroupCount"></span>)</strong>
-            </div>
-            
-            <p style="margin: 5px 0; font-size: 12px; color: #555;">
-                Alle aufgeführten Codes gehören zu diesem Datensatz:
-            </p>
-            
-            <!-- Hier werden die Codes per JS eingefügt -->
-            <div id="editLibraryAllCodes" style="display: flex; flex-wrap: wrap; gap: 5px; margin-top: 10px;"></div>
-            
-            <div style="margin-top: 15px; font-size: 11px; background: #e0f2fe; padding: 8px; border-radius: 4px;">
-                <strong>Hinweis:</strong> Änderungen an Titel/Ort/Beschreibung werden auf <strong>alle</strong> Exemplare der Range übertragen.
-            </div>
-        </div>
-
-        <form id="editLibraryForm">
-            <input type="hidden" id="editLibraryItemId">
-            <div class="edit-grid">
-                <div class="full">
-                    <label for="editLibraryName">Titel</label>
-                    <input id="editLibraryName" required style="width: 100%;">
-                </div>
-                <div>
-                    <label for="editLibraryType">Medientyp</label>
-                    <select id="editLibraryType" style="width: 100%;">
-                        <option value="Buch">Buch</option>
-                        <option value="Schulbuch">Schulbuch</option>
-                        <option value="cd">CD</option>
-                        <option value="dvd">DVD</option>
-                        <option value="other">Sonstige Medien</option>
-                    </select>
-                </div>
-                <div>
-                    <label for="editLibraryIsbn">ISBN</label>
-                    <input id="editLibraryIsbn" placeholder="optional ISBN-10/13" style="width: 100%;">
-                </div>
-                <div>
-                    <label for="editLibraryCode4">Code</label>
-                    <input id="editLibraryCode4" placeholder="optional Mediencode" style="width: 100%;">
-                </div>
-                <div class="full">
-                    <label for="editLibraryLocation">Ort</label>
-                    <input id="editLibraryLocation" required style="width: 100%;">
-                </div>
-                <div class="full">
-                    <label for="editLibraryDescription">Beschreibung</label>
-                    <textarea id="editLibraryDescription" rows="4" required style="width: 100%;"></textarea>
-                </div>
-            </div>
-            <div class="edit-actions" style="margin-top:20px;">
-                <button type="submit" class="button" style="background:#0ea5e9;color:#fff;">Speichern & Synchronisieren</button>
-                <button type="button" class="button" onclick="closeEditLibraryModal()">Abbrechen</button>
-            </div>
-        </form>
-    </div>
-</div>
-<div id="editLibraryGroupWarning" style="display:none; background-color: #fff; padding: 15px; border-radius: 6px; margin-bottom: 20px; border: 1px solid #0ea5e9;">
-    <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 10px; border-bottom: 1px solid #eee; padding-bottom: 10px;">
-        <strong style="color: #0ea5e9;">Gruppen-Range (Total: <span id="editLibraryGroupCount"></span>)</strong>
-    </div>
-
-    <p style="margin: 5px 0; font-size: 12px; color: #555;">
-        Alle Codes in dieser Gruppe:
-    </p>
-
-    <!-- Hier wird die Liste als Komma-Text eingefügt -->
-    <div id="editLibraryAllCodes" style="font-family: monospace; font-size: 14px; font-weight: bold; color: #333; margin-top: 5px;"></div>
-
-    <div style="margin-top: 15px; font-size: 11px; background: #e0f2fe; padding: 8px; border-radius: 4px;">
-        <strong>Hinweis:</strong> Änderungen an Titel/Ort/Beschreibung werden auf <strong>alle</strong> Exemplare der Range übertragen.
-    </div>
-</div>
 {% endblock %}

Web/templates/main_admin.html

@@ -4315,6 +4315,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                             hiddenInput.value = image;
                             editForm.appendChild(hiddenInput);
                         }
+
                     });
                 }
 
@@ -4569,12 +4570,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                     <div class="detail-label">Code:</div>
                     <div class="detail-value">${escapeHtml(item.Code_4 || '-')}</div>
                 </div>
-            
-                <div class="detail-group">
-                    <div class="detail-label">Anzahl:</div>
-                    <div class="detail-value">${escapeHtml(String(item.GroupedDisplayCount || 1))}</div>
-                </div>
-            
+
                 ${isGroupedItem ? `
                 <div class="detail-group">
                     <div class="detail-label">Verfügbar:</div>
@@ -5637,6 +5633,61 @@ document.addEventListener('DOMContentLoaded', ()=>{
         futureAppointments.sort((a, b) => new Date(a.date) - new Date(b.date));
         return futureAppointments[0];
     }
+
+    // Load location options
+    function loadLocationOptions() {
+        fetch('/get_predefined_locations')
+            .then(response => response.json())
+            .then(data => {
+                const ortSelect = document.getElementById('ort');
+                if (ortSelect) {
+                    // Clear existing options except the first one
+                    while (ortSelect.children.length > 1) {
+                        ortSelect.removeChild(ortSelect.lastChild);
+                    }
+
+                    // Add new options - data.locations contains the array
+                    data.locations.forEach(location => {
+                        const option = document.createElement('option');
+                        option.value = location;
+                        option.textContent = location;
+                        ortSelect.appendChild(option);
+                    });
+                }
+            })
+            .catch(error => {
+                console.error('Error loading location options:', error);
+            });
+    }
+
+    // Function to add new location
+    function addNewLocation() {
+        const newLocationInput = document.getElementById('new-location-input');
+        const newLocation = newLocationInput.value.trim();
+
+        if (!newLocation) {
+            alert('Bitte geben Sie einen Ort ein.');
+            return;
+        }
+
+        // Add to dropdown
+        const ortSelect = document.getElementById('ort');
+        const option = document.createElement('option');
+        option.value = newLocation;
+        option.textContent = newLocation;
+        option.selected = true;
+        ortSelect.appendChild(option);
+
+        // Hide the input container
+        document.getElementById('new-location-container').style.display = 'none';
+        newLocationInput.value = '';
+    }
+
+    // Function to cancel adding new location
+    function cancelAddLocation() {
+        document.getElementById('new-location-container').style.display = 'none';
+        document.getElementById('new-location-input').value = '';
+    }
 </script>
 
 <!-- Include edit item functions -->

Web/templates/manage_filters.html

@@ -19,7 +19,7 @@
         <div class="col-md-4">
             <div class="card mb-4">
                 <div class="card-header">
-                    <h2 class="card-title h5 mb-0">{{ filter_names.get('1', 'Fach/Kategorie') }} (Filter 1)</h2>
+                    <h2 class="card-title h5 mb-0">{{ filter_names.get('1', 'Jahrgang') }} (Filter 1)</h2>
                 </div>
                 <div class="card-body">
                     <form method="POST" action="{{ url_for('add_filter_value', filter_num=1) }}" class="mb-4">
@@ -67,7 +67,7 @@
         <div class="col-md-4">
             <div class="card mb-4">
                 <div class="card-header">
-                    <h2 class="card-title h5 mb-0">{{ filter_names.get('2', 'System/Bereich') }} (Filter 2)</h2>
+                    <h2 class="card-title h5 mb-0">{{ filter_names.get('2', 'Fach') }} (Filter 2)</h2>
                 </div>
                 <div class="card-body">
                     <form method="POST" action="{{ url_for('add_filter_value', filter_num=2) }}" class="mb-4">
@@ -110,54 +110,6 @@
                 </div>
             </div>
         </div>
-
-        <!-- Filter 3 -->
-        <div class="col-md-4">
-            <div class="card mb-4">
-                <div class="card-header">
-                    <h2 class="card-title h5 mb-0">{{ filter_names.get('3', 'Typ/Art') }} (Filter 3)</h2>
-                </div>
-                <div class="card-body">
-                    <form method="POST" action="{{ url_for('add_filter_value', filter_num=3) }}" class="mb-4">
-                        <div class="input-group">
-                            <input type="text" name="value" class="form-control" placeholder="Neuer Wert..." required>
-                            <button type="submit" class="btn btn-primary">Hinzufügen</button>
-                        </div>
-                    </form>
-                    
-                    <h5 class="mb-3">Vorhandene Werte</h5>
-                    {% if filter3_values %}
-                    <div class="list-group">
-                        {% for value in filter3_values %}
-                        <div class="list-group-item">
-                            <div class="d-flex justify-content-between align-items-center mb-2">
-                                <span>{{ value }}</span>
-                                <div>
-                                    <button type="button" class="btn btn-sm btn-secondary me-1" onclick="toggleEdit('edit-3-{{ loop.index }}')">Bearbeiten</button>
-                                    <form method="POST" action="{{ url_for('remove_filter_value', filter_num=3, value=value) }}" class="d-inline">
-                                        <button type="submit" class="btn btn-sm btn-danger"
-                                                onclick="return confirm('Sind Sie sicher, dass Sie den Wert \"' + '{{ value }}'.replace(/'/g, '\\\'') + '\" löschen möchten?');">
-                                            Entfernen
-                                        </button>
-                                    </form>
-                                </div>
-                            </div>
-                            <form id="edit-3-{{ loop.index }}" method="POST" action="{{ url_for('edit_filter_value', filter_num=3, old_value=value) }}" style="display: none;" class="mt-2">
-                                <div class="input-group input-group-sm">
-                                    <input type="text" name="new_value" class="form-control" value="{{ value }}" required>
-                                    <button type="submit" class="btn btn-primary" onclick="return confirm('Tipp: Das Ändern des Namens aktualisiert auch alle Einträge in der Datenbank, die diesen Filter verwenden. Fortfahren?');">Speichern</button>
-                                    <button type="button" class="btn btn-secondary" onclick="toggleEdit('edit-3-{{ loop.index }}')">Abbrechen</button>
-                                </div>
-                            </form>
-                        </div>
-                        {% endfor %}
-                    </div>
-                    {% else %}
-                    <div class="alert alert-info">Keine Werte definiert.</div>
-                    {% endif %}
-                </div>
-            </div>
-        </div>
     </div>
     
     <div class="alert alert-warning">

Web/templates/student_cards_admin.html

@@ -229,7 +229,7 @@
 <div class="container">
     <div class="student-card-header">
         <div>
-            <h1>📚 Bibliotheksausweise (Bibliotek)</h1>
+            <h1>📚 Bibliotheksausweise (Bibliothek)</h1>
         </div>
         <div class="export-buttons">
             <a href="{{ url_for('student_card_barcode_download') }}" class="btn-print" style="background: #28a745;">📥 Alle Ausweise (PDF)</a>

Web/templates/tutorial.html

@@ -280,7 +280,7 @@
         <button type="button" data-target-step="0">1. Startseite</button>
         <button type="button" data-target-step="1">2. {{ 'Artikel erfassen' if is_admin else 'Artikel finden' }}</button>
         {% if library_module_enabled %}
-        <button type="button" data-target-step="2">3. Bibliotek</button>
+        <button type="button" data-target-step="2">3. Bibliothek</button>
         {% endif %}
         <button type="button" data-target-step="{{ '3' if library_module_enabled else '2' }}">4. Alltag</button>
       </div>
@@ -341,7 +341,7 @@
 
       {% if library_module_enabled %}
       <article class="workflow-step" data-step-index="2" data-step-key="library">
-        <h3>Bibliotek-Bereich</h3>
+        <h3>Bibliothek-Bereich</h3>
         <p>Dieser Bereich ist speziell für Bücher und Medienausleihe.</p>
         <ul>
           {% if is_admin %}
@@ -358,7 +358,7 @@
         </ul>
 
         <div class="tutorial-actions">
-          <a class="btn btn-outline-primary btn-sm" href="{{ url_for('library_view') }}">Zur Bibliotek</a>
+          <a class="btn btn-outline-primary btn-sm" href="{{ url_for('library_view') }}">Zur Bibliothek</a>
           {% if is_admin %}
           <a class="btn btn-outline-secondary btn-sm" href="{{ url_for('library_loans_admin') }}">Ausleihen ansehen</a>
           {% endif %}

Web/templates/upload_admin.html

@@ -761,6 +761,21 @@
         <h1>{{ page_title|default('Artikel hochladen') }}</h1>
         <form method="POST" action="{{ url_for('upload_item') }}" enctype="multipart/form-data">
             <input type="hidden" name="upload_mode" value="{{ upload_mode|default('item') }}">
+
+            {% if show_library_features %}
+            <div class="form-group">
+                <label for="isbn">ISBN/Barcode (für Bild-Suche):</label>
+                <div class="isbn-input-group">
+                    <input type="text" id="isbn" name="isbn" placeholder="ISBN oder Barcode eingeben..." required>
+                    <button type="button" id="scan-isbn-btn" class="fetch-isbn-button">Barcode scannen</button>
+                    <button type="button" class="fetch-isbn-button" onclick="fetchBookInfo('upload')">Informationen abrufen</button>
+                </div>
+                <div id="isbn-scanner" style="width:100%; max-width:520px; display:none; margin-top:10px;"></div>
+                <small id="isbn-scan-status" style="display:block; color:#666; margin-top:6px;">Scannen oder manuell eingeben. Gültige ISBNs helfen beim Abruf von Buchdaten, andere Codes werden trotzdem akzeptiert.</small>
+                <div id="book-info-container" class="book-info-container"></div>
+            </div>
+            {% endif %}
+
             <div class="form-group">
                 <label for="name">Name:</label>
                 <input type="text" id="name" name="name" required>
@@ -784,7 +799,44 @@
                 <label for="beschreibung">Beschreibung:</label>
                 <textarea id="beschreibung" name="beschreibung" required></textarea>
             </div>
-            
+
+            <div class="form-group">
+                <label for="scan_mode">Erfassungs-Modus:</label>
+                <select id="scan_mode" name="scan_mode" class="form-control" onchange="toggleScanMode()">
+                    <option value="single">Einzel-Code (Scanner stoppt nach 1 Scan) ↓ </option>
+                    <option value="continuous">Fortlaufend scannen (Mehrere Codes nacheinander)</option>
+                    <option value="range">Code-Bereich generieren (z.B. ABC-001 bis ABC-010)</option>
+                </select>
+            </div>
+
+            <div id="range_generator_group" class="form-group" style="display:none; background: #f9f9f9; padding: 15px; border-radius: 5px; border: 1px solid #ddd; margin-bottom: 15px;">
+                <label style="font-weight: bold;">Code-Bereich automatisch generieren:</label>
+                <div style="display: flex; gap: 10px; margin-bottom: 10px; align-items: center;">
+                    <input type="text" id="range_prefix" placeholder="Präfix optional (z.B. IT-)" class="form-control" style="flex: 2;">
+                    <input type="number" id="range_start" placeholder="Start (z.B. 1)" class="form-control" style="flex: 1;">
+                    <span style="font-weight: bold;">bis</span>
+                    <input type="text" id="range_end" placeholder="Ende (z.B. 020)" class="form-control" style="flex: 1;">
+                </div>
+                <small style="display:block; color:#666; margin-bottom: 10px;">Tipp: Der Präfix ist optional. Die Anzahl der Ziffern im "Ende"-Feld bestimmt die führenden Nullen (z.B. Ende "050" macht aus Start "1" einen "001").</small>
+                <button type="button" class="btn btn-secondary" onclick="generateCodeRange()">Bereich generieren & einfügen</button>
+            </div>
+
+            <div class="form-group" id="primary_code_group">
+                <label for="code_4">Basis-Code</label>
+                <div style="display: flex; gap: 10px;">
+                    <input type="text" id="code_4" name="code_4" class="form-control" placeholder="Haupt-Barcode" required>
+                    <button type="button" id="scan-code4-btn" class="btn btn-primary">Barcode scannen</button>
+                </div>
+                <div id="code4-scanner" style="display:none; margin-top: 10px;"></div>
+                <small id="code4-scan-status" class="form-text text-muted"></small>
+            </div>
+
+            <div class="form-group" id="individual_codes_group">
+                <label for="individual_codes">Weitere Einzelcodes (je Zeile ein Code)</label>
+                <textarea id="individual_codes" name="individual_codes" rows="6" placeholder="z.B.&#10;ABC-001&#10;ABC-002" class="form-control"></textarea>
+                <small style="display:block; color:#666; margin-top: 5px;">Bei Anzahl > 1 können hier individuelle Codes pro Item gesetzt werden. Der Scanner setzt immer zuerst den Basis-Code im Feld oben; weitere Einzelcodes werden hier angehängt.</small>
+            </div>
+
             {% if show_library_features %}
             <!-- Library Mode: Single Customizable Filter -->
             <div class="filter-inputs">
@@ -800,9 +852,9 @@
                     </select>
                     <small style="display:block; color:#666;">Wählen Sie einen Medientyp aus zur Klassifizierung.</small>
                 </div>
-                <h3>Kategorie/Typ:</h3>
+                <h3>Kategorie/Typ/Fach:</h3>
                 <div class="form-group">
-                    <input type="text" name="library_category" id="library_category" placeholder="z.B. Belletristik, Sachbücher, Nachschlagewerke, etc.">
+                    <input type="text" name="library_category" id="library_category" placeholder="z.B. Belletristik, Sachbücher, Nachschlagewerke, etc. (optional)">
                     <small style="display:block; color:#666;">Geben Sie hier eine beliebige Kategorie ein zur freien Klassifizierung.</small>
                 </div>
             </div>
@@ -902,42 +954,6 @@
                 <label for="anschaffungskosten">Anschaffungskosten (€)</label>
                 <input id="anschaffungskosten" name="anschaffungskosten">
             </div>
-           <div class="form-group">
-                <label for="scan_mode">Erfassungs-Modus:</label>
-                <select id="scan_mode" name="scan_mode" class="form-control" onchange="toggleScanMode()">
-                    <option value="single">Einzel-Code (Scanner stoppt nach 1 Scan)</option>
-                    <option value="continuous">Fortlaufend scannen (Mehrere Codes nacheinander)</option>
-                    <option value="range">Code-Bereich generieren (z.B. ABC-001 bis ABC-010)</option>
-                </select>
-            </div>
-
-            <div id="range_generator_group" class="form-group" style="display:none; background: #f9f9f9; padding: 15px; border-radius: 5px; border: 1px solid #ddd; margin-bottom: 15px;">
-                <label style="font-weight: bold;">Code-Bereich automatisch generieren:</label>
-                <div style="display: flex; gap: 10px; margin-bottom: 10px; align-items: center;">
-                    <input type="text" id="range_prefix" placeholder="Präfix (z.B. IT-)" class="form-control" style="flex: 2;">
-                    <input type="number" id="range_start" placeholder="Start (z.B. 1)" class="form-control" style="flex: 1;">
-                    <span style="font-weight: bold;">bis</span>
-                    <input type="text" id="range_end" placeholder="Ende (z.B. 020)" class="form-control" style="flex: 1;">
-                </div>
-                <small style="display:block; color:#666; margin-bottom: 10px;">Tipp: Die Anzahl der Ziffern im "Ende"-Feld bestimmt die führenden Nullen (z.B. Ende "050" macht aus Start "1" einen "001").</small>
-                <button type="button" class="btn btn-secondary" onclick="generateCodeRange()">Bereich generieren & einfügen</button>
-            </div>
-
-            <div class="form-group" id="primary_code_group">
-                <label for="code_4">Basis-Code</label>
-                <div style="display: flex; gap: 10px;">
-                    <input type="text" id="code_4" name="code_4" class="form-control" placeholder="Haupt-Barcode" required>
-                    <button type="button" id="scan-code4-btn" class="btn btn-primary">Barcode scannen</button>
-                </div>
-                <div id="code4-scanner" style="display:none; margin-top: 10px;"></div>
-                <small id="code4-scan-status" class="form-text text-muted"></small>
-            </div>
-
-            <div class="form-group" id="individual_codes_group">
-                <label for="individual_codes">Weitere Einzelcodes (je Zeile ein Code)</label>
-                <textarea id="individual_codes" name="individual_codes" rows="6" placeholder="z.B.&#10;ABC-001&#10;ABC-002" class="form-control"></textarea>
-                <small style="display:block; color:#666; margin-top: 5px;">Bei Anzahl > 1 können hier individuelle Codes pro Item gesetzt werden. Der Scanner setzt immer zuerst den Basis-Code im Feld oben; weitere Einzelcodes werden hier angehängt.</small>
-            </div>
             <!-- Image upload (hidden for library mode) -->
             <div class="form-group" {% if show_library_features %}style="display:none;"{% endif %}>
                 <label for="images">Bilder/Videos:</label>
@@ -946,27 +962,12 @@
                 <!-- Add image preview area -->
                 <div class="image-preview-container" id="image-preview-container"></div>
             </div>
-            
-            <!-- ISBN fields (library page only) -->
-            {% if show_library_features %}
-            <div class="form-group">
-                <label for="isbn">ISBN/Barcode (für Bild-Suche):</label>
-                <div class="isbn-input-group">
-                    <input type="text" id="isbn" name="isbn" placeholder="ISBN oder Barcode eingeben..." required>
-                    <button type="button" id="scan-isbn-btn" class="fetch-isbn-button">Barcode scannen</button>
-                    <button type="button" class="fetch-isbn-button" onclick="fetchBookInfo('upload')">Informationen abrufen</button>
-                </div>
-                <div id="isbn-scanner" style="width:100%; max-width:520px; display:none; margin-top:10px;"></div>
-                <small id="isbn-scan-status" style="display:block; color:#666; margin-top:6px;">Scannen oder manuell eingeben. Gültige ISBNs helfen beim Abruf von Buchdaten, andere Codes werden trotzdem akzeptiert.</small>
-                <div id="book-info-container" class="book-info-container"></div>
-            </div>
-            
+
             <div class="form-group">
                 <label for="reservierbar" style="display:inline-block; width:auto; margin-right:10px;">Reservierbar:</label>
                 <input type="checkbox" id="reservierbar" name="reservierbar" style="width:auto;">
                 <small style="display:block; color:#666;">Wenn deaktiviert, kann der Artikel nicht im Voraus reserviert werden (Sofort-Ausleihe bleibt möglich).</small>
             </div>
-            {% endif %}
 
             <button type="submit" class="submit-button">{{ 'Bücher hochladen' if show_library_features else 'Artikel hochladen' }}</button>
         </form>
@@ -1023,6 +1024,90 @@
 <script>
     const libraryModuleEnabled = {{ 'true' if library_module_enabled else 'false' }};
 
+    function getFocusableFormFields(form) {
+        if (!form) return [];
+        return Array.from(form.querySelectorAll('input, select, textarea, button'))
+            .filter((element) => {
+                if (element.disabled || element.getAttribute('aria-hidden') === 'true') return false;
+                const style = window.getComputedStyle(element);
+                if (style.display === 'none' || style.visibility === 'hidden') return false;
+                const tagName = element.tagName.toLowerCase();
+                const type = (element.type || '').toLowerCase();
+                return tagName !== 'button' || type !== 'button';
+            });
+    }
+
+    function focusNextFormField(currentField) {
+        const form = currentField && currentField.form ? currentField.form : null;
+        const fields = getFocusableFormFields(form || document);
+        const currentIndex = fields.indexOf(currentField);
+
+        if (currentIndex >= 0) {
+            for (let i = currentIndex + 1; i < fields.length; i++) {
+                const nextField = fields[i];
+                const nextStyle = window.getComputedStyle(nextField);
+                if (nextStyle.display !== 'none' && nextStyle.visibility !== 'hidden') {
+                    nextField.focus();
+                    if (nextField.tagName.toLowerCase() === 'select') {
+                        nextField.click();
+                    }
+                    return true;
+                }
+            }
+        }
+
+        if (form) {
+            const submitButton = form.querySelector('button[type="submit"]');
+            if (submitButton) {
+                submitButton.focus();
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    function handleIsbnLookupFromScanner() {
+        const isbnField = document.getElementById('isbn');
+        if (!isbnField) return false;
+
+        const normalizedIsbn = typeof normalizeIsbnClient === 'function' ? normalizeIsbnClient(isbnField.value) : isbnField.value.trim();
+        if (!normalizedIsbn) return false;
+
+        if (typeof updateIsbnLiveValidation === 'function') {
+            updateIsbnLiveValidation();
+        }
+
+        if (typeof fetchBookInfo === 'function') {
+            fetchBookInfo('upload');
+        }
+
+        return true;
+    }
+
+    document.addEventListener('DOMContentLoaded', function () {
+        document.querySelectorAll('form').forEach(function (form) {
+            form.addEventListener('keydown', function (event) {
+                const target = event.target;
+                if (event.key !== 'Enter') return;
+                if (!target || target.tagName === 'TEXTAREA' && !event.shiftKey) return;
+                const tagName = target.tagName.toLowerCase();
+                const type = (target.type || '').toLowerCase();
+                if (!['input', 'select', 'textarea'].includes(tagName)) return;
+                if (['button', 'submit', 'reset', 'file', 'checkbox', 'radio', 'hidden'].includes(type)) return;
+
+                event.preventDefault();
+
+                if (target.id === 'isbn' || target.name === 'isbn') {
+                    handleIsbnLookupFromScanner();
+                    return;
+                }
+
+                focusNextFormField(target);
+            });
+        });
+    });
+
     // Function to check if a file is a video
     function isVideoFile(filename) {
         const videoExtensions = ['.mp4', '.mov', '.avi', '.mkv', '.webm', '.flv', '.m4v', '.3gp'];
@@ -1194,7 +1279,7 @@
         let generatedCodes = [];
         for (let i = start; i <= end; i++) {
             let numStr = i.toString().padStart(paddingLength, '0');
-            generatedCodes.push(`${prefix}${numStr}`);
+            generatedCodes.push(prefix ? `${prefix}${numStr}` : numStr);
         }
 
         const codeField = document.getElementById('code_4');
@@ -1384,10 +1469,32 @@
             scanModeSelect.addEventListener('change', toggleScanMode);
         }
 
-        // 4. ISBN Live-Validierung
+        // 4. ISBN Live-Validierung und automatische Abfrage nach Scan/Enter
         const isbnInput = document.getElementById('isbn');
-        if (isbnInput && typeof updateIsbnLiveValidation === 'function') {
-            isbnInput.addEventListener('input', updateIsbnLiveValidation);
+        if (isbnInput) {
+            if (typeof updateIsbnLiveValidation === 'function') {
+                isbnInput.addEventListener('input', updateIsbnLiveValidation);
+            }
+
+            let isbnLookupTimer = null;
+            isbnInput.addEventListener('input', function () {
+                clearTimeout(isbnLookupTimer);
+                const normalizedIsbn = typeof normalizeIsbnClient === 'function' ? normalizeIsbnClient(isbnInput.value) : isbnInput.value.trim();
+                if (normalizedIsbn) {
+                    isbnLookupTimer = setTimeout(function () {
+                        handleIsbnLookupFromScanner();
+                    }, 250);
+                }
+            });
+
+            isbnInput.addEventListener('change', function () {
+                if (typeof normalizeIsbnClient === 'function') {
+                    const normalizedIsbn = normalizeIsbnClient(isbnInput.value);
+                    if (normalizedIsbn) {
+                        handleIsbnLookupFromScanner();
+                    }
+                }
+            });
         }
     });
     // Load predefined filter values for dropdowns

Web/templates/upload_batch.html

@@ -0,0 +1,262 @@
+<!DOCTYPE html>
+<html lang="de">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Batch Upload</title>
+
+    <!-- CSRF-Token für JavaScript bereitstellen -->
+    <meta name="csrf-token" content="{{ session.get('_csrf_token', '') }}">
+
+    <style>
+        body { font-family: sans-serif; padding: 20px; background: #f4f7f6; }
+        .upload-container { background: white; padding: 20px; border-radius: 8px; max-width: 500px; margin: 0 auto; }
+        .form-group { margin-bottom: 15px; }
+        label { display: block; font-weight: bold; margin-bottom: 5px; }
+        input[type="file"] { width: 100%; padding: 8px; box-sizing: border-box; }
+        .btn-submit { width: 100%; padding: 10px; background: #4a90e2; color: white; border: none; border-radius: 4px; font-weight: bold; cursor: pointer; }
+        .btn-submit:disabled { background: #ccc; }
+        #uploadProgress { margin-top: 20px; display: none; }
+        progress { width: 100%; height: 20px; }
+        #logList { background: #fafafa; border: 1px solid #eee; padding: 10px; max-height: 150px; overflow-y: auto; font-size: 0.85em; list-style: none; }
+    </style>
+</head>
+<body>
+
+<div class="upload-container">
+    <h2>Inventar Batch Upload</h2>
+
+    <form id="batchUploadForm">
+        <div class="form-group">
+            <label for="csv_file">1. items.csv auswählen</label>
+            <input type="file" id="csv_file" name="csv_file" accept=".csv" required>
+        </div>
+
+        <div class="form-group">
+            <label for="images">2. Bilder auswählen</label>
+            <input type="file" id="images" name="images" accept="image/*" multiple required>
+        </div>
+
+        <button type="submit" id="uploadBtn" class="btn-submit">Daten hochladen</button>
+    </form>
+
+    <div id="uploadProgress">
+        <div id="progressText">Bereite Upload vor...</div>
+        <progress id="progressBar" value="0" max="100"></progress>
+        <ul id="logList"></ul>
+    </div>
+</div>
+
+<script>
+// 1. Robuster CSV-Parser, der Zeilenumbrüche und Kommas in Texten korrekt ignoriert
+function parseCSV(csvString) {
+    const rows = [];
+    let currentRow = [];
+    let currentCell = '';
+    let insideQuotes = false;
+
+    for (let i = 0; i < csvString.length; i++) {
+        const char = csvString[i];
+        const nextChar = csvString[i + 1];
+
+        if (char === '"' && insideQuotes && nextChar === '"') {
+            currentCell += '"';
+            i++; // Escaped Quotes ("") überspringen
+        } else if (char === '"') {
+            insideQuotes = !insideQuotes;
+        } else if (char === ',' && !insideQuotes) {
+            currentRow.push(currentCell);
+            currentCell = '';
+        } else if ((char === '\n' || char === '\r') && !insideQuotes) {
+            if (char === '\r' && nextChar === '\n') i++; // Windows Umbrüche überspringen
+            currentRow.push(currentCell);
+            if (currentRow.length > 1 || currentRow[0] !== '') {
+                rows.push(currentRow);
+            }
+            currentRow = [];
+            currentCell = '';
+        } else {
+            currentCell += char;
+        }
+    }
+    if (currentCell !== '' || currentRow.length > 0) {
+        currentRow.push(currentCell);
+        if (currentRow.length > 1 || currentRow[0] !== '') {
+            rows.push(currentRow);
+        }
+    }
+    return rows;
+}
+
+// 2. Baut das Array wieder sicher zu einer sauberen CSV-Zeile für das Backend zusammen
+function rowToCSV(rowArray) {
+    return rowArray.map(cell => {
+        if (cell === null || cell === undefined) return '';
+        let cellStr = String(cell);
+        if (cellStr.includes(',') || cellStr.includes('"') || cellStr.includes('\n') || cellStr.includes('\r')) {
+            return '"' + cellStr.replace(/"/g, '""') + '"';
+        }
+        return cellStr;
+    }).join(',');
+}
+
+// 3. Bildnamen extrahieren
+function extractImageNames(cellValue) {
+    if (!cellValue) return [];
+    let raw = String(cellValue).replace(/^["']|["']$/g, '').trim();
+    if (raw.startsWith('[') && raw.endsWith(']')) {
+        try {
+            const jsonValid = raw.replace(/'/g, '"');
+            return JSON.parse(jsonValid);
+        } catch (e) {
+            const matches = raw.match(/['"]([^'"]+)['"]/g);
+            if (matches) return matches.map(m => m.replace(/['"]/g, ''));
+        }
+    }
+    return raw ? [raw] : [];
+}
+
+document.getElementById('batchUploadForm').addEventListener('submit', async function(e) {
+    e.preventDefault();
+
+    const csvInput = document.getElementById('csv_file');
+    const imageInput = document.getElementById('images');
+    const uploadBtn = document.getElementById('uploadBtn');
+    const progressContainer = document.getElementById('uploadProgress');
+    const progressBar = document.getElementById('progressBar');
+    const progressText = document.getElementById('progressText');
+    const logList = document.getElementById('logList');
+
+    const csrfToken = document.querySelector('meta[name="csrf-token"]')?.getAttribute('content');
+
+    if (!csvInput.files.length) {
+        alert("Bitte wähle eine CSV-Datei aus.");
+        return;
+    }
+
+    uploadBtn.disabled = true;
+    progressContainer.style.display = 'block';
+    logList.innerHTML = '';
+
+    const log = (msg) => {
+        const li = document.createElement('li');
+        li.textContent = msg;
+        logList.appendChild(li);
+        logList.scrollTop = logList.scrollHeight;
+    };
+
+    const csvFile = csvInput.files[0];
+    const allImages = Array.from(imageInput.files);
+
+    const imageMap = new Map();
+    allImages.forEach(file => {
+        imageMap.set(file.name.toLowerCase(), file);
+    });
+
+    const BATCH_SIZE = 20;
+
+    try {
+        const csvText = await csvFile.text();
+        const allRows = parseCSV(csvText);
+
+        if (allRows.length <= 1) {
+            throw new Error("CSV-Datei ist leer oder enthält nur Kopfzeilen.");
+        }
+
+        const headerRow = allRows[0];
+        const dataRows = allRows.slice(1);
+
+        log(`${dataRows.length} Einträge gefunden. Bereite Batches vor...`);
+
+        const imagesColIndex = headerRow.findIndex(h => h.toLowerCase().trim() === 'images');
+
+        const batches = [];
+        for (let i = 0; i < dataRows.length; i += BATCH_SIZE) {
+            batches.push(dataRows.slice(i, i + BATCH_SIZE));
+        }
+
+        progressBar.max = batches.length;
+        progressBar.value = 0;
+
+        // Sequenzieller Upload mit Fehlertoleranz pro Batch
+        for (let b = 0; b < batches.length; b++) {
+            const batchRows = batches[b];
+            progressText.textContent = `Lade Batch ${b + 1} von ${batches.length} hoch...`;
+
+            try {
+                const requiredImagesForBatch = new Set();
+
+                if (imagesColIndex !== -1) {
+                    batchRows.forEach(rowCols => {
+                        if (rowCols[imagesColIndex]) {
+                            const imgNames = extractImageNames(rowCols[imagesColIndex]);
+                            imgNames.forEach(name => {
+                                const fileMatch = imageMap.get(name.toLowerCase());
+                                if (fileMatch) {
+                                    requiredImagesForBatch.add(fileMatch);
+                                }
+                            });
+                        }
+                    });
+                }
+
+                const batchCsvArray = [headerRow, ...batchRows];
+                const batchCsvText = batchCsvArray.map(rowToCSV).join('\n');
+                const batchCsvBlob = new Blob([batchCsvText], { type: 'text/csv' });
+
+                const formData = new FormData();
+                formData.append('csv_file', batchCsvBlob, `batch_${b + 1}.csv`);
+
+                if (csrfToken) {
+                    formData.append('csrf_token', csrfToken);
+                }
+
+                requiredImagesForBatch.forEach(imgFile => {
+                    formData.append('images', imgFile);
+                });
+
+                log(`Batch ${b + 1}: ${batchRows.length} Items & ${requiredImagesForBatch.size} zugehörige Bilder.`);
+
+                const response = await fetch('/upload_csv_batch', {
+                    method: 'POST',
+                    body: formData,
+                    headers: {
+                        'X-CSRFToken': csrfToken || ''
+                    }
+                });
+
+                const responseText = await response.text();
+                let result;
+
+                try {
+                    result = JSON.parse(responseText);
+                } catch (parseErr) {
+                    throw new Error(`Server-Fehler (Status ${response.status}). HTML statt JSON erhalten.`);
+                }
+
+                if (!response.ok || !result.success) {
+                    throw new Error(result.message || `Server-Fehler ${response.status}`);
+                }
+
+                log(`Batch ${b + 1} erfolgreich abgeschlossen.`);
+
+            } catch (batchErr) {
+                log(`⚠️ FEHLER in Batch ${b + 1}: ${batchErr.message}. Überspringe und fahre fort...`);
+                console.error(`Batch ${b + 1} fehlgeschlagen:`, batchErr);
+            }
+
+            progressBar.value = b + 1;
+        }
+
+        progressText.textContent = "Upload-Prozess beendet!";
+        uploadBtn.disabled = false;
+
+    } catch (err) {
+        alert("Upload abgebrochen: " + err.message);
+        log("Fehler: " + err.message);
+        uploadBtn.disabled = false;
+    }
+});
+</script>
+</body>
+</html>

Web/templates/user_del.html

@@ -17,15 +17,11 @@
     <div class="user-management-container">
         <h2>Benutzer</h2>
 
-        <form method="POST" action="{{ url_for('admin_anonymize_names') }}" class="mb-3">
-            <button
-                type="submit"
-                class="btn btn-outline-danger"
-                onclick="return confirm('Sollen alle gespeicherten Klarnamen dauerhaft in Synonym-Kuerzel umgewandelt werden?')"
-            >
-                Gespeicherte Namen anonymisieren
-            </button>
-        </form>
+        <div class="mb-3">
+            <a href="{{ url_for('register') }}" class="btn btn-success">
+                Neuen Benutzer registrieren
+            </a>
+        </div>
 
         <div class="filter-bar mb-3">
             <div class="row g-2 align-items-end">

Web/tenant.py

@@ -166,6 +166,11 @@ def _find_registered_tenant_id(candidate):
     return None
 
 
+def _resolve_registered_tenant_id(candidate):
+    """Return the canonical registered tenant id for a candidate, or None."""
+    return _find_registered_tenant_id(candidate)
+
+
 def _is_ip_host(hostname):
     hostname = str(hostname or '').strip()
     if not hostname:
@@ -185,6 +190,8 @@ def get_tenant_config(tenant_id=None):
         ctx = get_tenant_context()
         tenant_id = ctx.tenant_id if ctx and ctx.tenant_id else 'default'
 
+    tenant_id = _resolve_registered_tenant_id(tenant_id) or tenant_id
+
     if tenant_id in TENANT_REGISTRY:
         return TENANT_REGISTRY[tenant_id] or {}
         
@@ -481,20 +488,22 @@ class TenantContext:
             or request.args.get('tenantId', '').strip()
         )
         if tenant_from_query:
-            matched_tenant = _find_registered_tenant_id(tenant_from_query) or tenant_from_query
-            self.tenant_id = matched_tenant
-            self.config = get_tenant_config(matched_tenant)
-            session['tenant_id'] = matched_tenant
-            return self._get_db_name(matched_tenant)
+            matched_tenant = _resolve_registered_tenant_id(tenant_from_query)
+            if matched_tenant:
+                self.tenant_id = matched_tenant
+                self.config = get_tenant_config(matched_tenant)
+                session['tenant_id'] = matched_tenant
+                return self._get_db_name(matched_tenant)
 
         # Priority 1: X-Tenant-ID header (for testing/internal APIs)
         tenant_from_header = request.headers.get('X-Tenant-ID', '').strip()
         if tenant_from_header:
-            matched_tenant = _find_registered_tenant_id(tenant_from_header) or tenant_from_header
-            self.tenant_id = matched_tenant
-            self.config = get_tenant_config(matched_tenant)
-            session['tenant_id'] = matched_tenant
-            return self._get_db_name(matched_tenant)
+            matched_tenant = _resolve_registered_tenant_id(tenant_from_header)
+            if matched_tenant:
+                self.tenant_id = matched_tenant
+                self.config = get_tenant_config(matched_tenant)
+                session['tenant_id'] = matched_tenant
+                return self._get_db_name(matched_tenant)
 
         # Priority 2: Port/host based tenant mapping
         host_candidates = _request_host_candidates()
@@ -544,11 +553,11 @@ class TenantContext:
                 if len(parts) >= 2:
                     potential_subdomain = parts[0]
                     if potential_subdomain not in ('www', 'api', 'admin', 'app', 'mail'):
-                        matched_tenant = _find_registered_tenant_id(potential_subdomain)
+                        matched_tenant = _resolve_registered_tenant_id(potential_subdomain)
                         if not matched_tenant and potential_subdomain.startswith('school'):
-                            matched_tenant = _find_registered_tenant_id('schule' + potential_subdomain[len('school'):])
+                            matched_tenant = _resolve_registered_tenant_id('schule' + potential_subdomain[len('school'):])
                         elif not matched_tenant and potential_subdomain.startswith('schule'):
-                            matched_tenant = _find_registered_tenant_id('school' + potential_subdomain[len('schule'):])
+                            matched_tenant = _resolve_registered_tenant_id('school' + potential_subdomain[len('schule'):])
                         if matched_tenant:
                             self.subdomain = potential_subdomain
                             self.tenant_id = matched_tenant
@@ -565,12 +574,21 @@ class TenantContext:
         # Priority 4: sticky tenant from the authenticated session
         session_tenant = session.get('tenant_id', '').strip() if session.get('tenant_id') else ''
         if session_tenant:
-            self.tenant_id = session_tenant
-            self.config = get_tenant_config(session_tenant)
+            matched_tenant = _resolve_registered_tenant_id(session_tenant)
+            if matched_tenant:
+                self.tenant_id = matched_tenant
+                self.config = get_tenant_config(matched_tenant)
+                session['tenant_id'] = matched_tenant
+                logger.info(
+                    f"Tenant resolution by session: host={primary_host} tenant={matched_tenant} config={self.config}"
+                )
+                return self._get_db_name(matched_tenant)
+            session.pop('tenant_id', None)
             logger.info(
-                f"Tenant resolution by session: host={primary_host} tenant={session_tenant} config={self.config}"
+                "Discarded stale tenant session reference: host=%s tenant=%s",
+                primary_host,
+                session_tenant,
             )
-            return self._get_db_name(session_tenant)
 
         # Fallback to default tenant if no tenant identifier found.
         # If no explicit 'default' tenant config exists, use configured MongoDB DB.

manage-tenant.sh

@@ -12,6 +12,250 @@ fi
 # Resolve script directory so config paths are deterministic even when called via sudo
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CONFIG_FILE="$SCRIPT_DIR/config.json"
+NGINX_DOMAIN_BASE="${INVENTAR_TENANT_DOMAIN_BASE:-invario-software.de}"
+NGINX_PROXY_HOST="${INVENTAR_NGINX_PROXY_HOST:-172.17.0.1}"
+NGINX_SITES_AVAILABLE="${INVENTAR_NGINX_SITES_AVAILABLE:-/etc/nginx/sites-available}"
+NGINX_SITES_ENABLED="${INVENTAR_NGINX_SITES_ENABLED:-/etc/nginx/sites-enabled}"
+NGINX_SITE_PREFIX="${INVENTAR_NGINX_SITE_PREFIX:-inventarsystem}"
+CERTBOT_EMAIL="${INVENTAR_CERTBOT_EMAIL:-}"
+
+tenant_domain() {
+    printf '%s.%s' "$1" "$NGINX_DOMAIN_BASE"
+}
+
+tenant_nginx_site_path() {
+    printf '%s/%s-%s.conf' "$NGINX_SITES_AVAILABLE" "$NGINX_SITE_PREFIX" "$1"
+}
+
+tenant_nginx_enabled_path() {
+    printf '%s/%s-%s.conf' "$NGINX_SITES_ENABLED" "$NGINX_SITE_PREFIX" "$1"
+}
+
+run_host_command() {
+    if [ "$(id -u)" -eq 0 ]; then
+        "$@"
+    elif command -v sudo >/dev/null 2>&1; then
+        sudo "$@"
+    else
+        return 127
+    fi
+}
+
+reload_host_nginx() {
+    if command -v nginx >/dev/null 2>&1 || command -v sudo >/dev/null 2>&1; then
+        if ! run_host_command nginx -t; then
+            echo "Warning: nginx configuration test failed; skipping reload."
+            return 1
+        fi
+
+        if command -v systemctl >/dev/null 2>&1; then
+            if ! run_host_command systemctl reload nginx; then
+                echo "Warning: systemctl reload nginx failed."
+                return 1
+            fi
+        else
+            if ! run_host_command nginx -s reload; then
+                echo "Warning: nginx reload failed."
+                return 1
+            fi
+        fi
+    fi
+}
+
+write_tenant_nginx_config() {
+    local tenant_id="$1"
+    local port="$2"
+    local domain site_path enabled_path
+
+    domain="$(tenant_domain "$tenant_id")"
+    site_path="$(tenant_nginx_site_path "$tenant_id")"
+    enabled_path="$(tenant_nginx_enabled_path "$tenant_id")"
+
+    if [ -z "$port" ]; then
+        echo "Warning: No port configured for tenant '$tenant_id'; skipping nginx vhost creation."
+        return 0
+    fi
+
+    if ! run_host_command mkdir -p "$NGINX_SITES_AVAILABLE" "$NGINX_SITES_ENABLED"; then
+        echo "Warning: Unable to prepare nginx site directories; skipping reverse-proxy setup."
+        return 0
+    fi
+
+    local have_cert=false
+
+    if [ -f "/etc/letsencrypt/live/$domain/fullchain.pem" ] && [ -f "/etc/letsencrypt/live/$domain/privkey.pem" ]; then
+        have_cert=true
+    else
+        if [ "$(id -u)" -eq 0 ]; then
+            cat > "$site_path" <<EOF
+# ==========================================
+#  INVENTARSYSTEM ($tenant_id)
+# ==========================================
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $domain;
+    client_max_body_size 100M;
+
+    location / {
+        proxy_pass http://$NGINX_PROXY_HOST:$port;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+EOF
+        else
+            sudo tee "$site_path" >/dev/null <<EOF
+# ==========================================
+#  INVENTARSYSTEM ($tenant_id)
+# ==========================================
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $domain;
+    client_max_body_size 100M;
+
+    location / {
+        proxy_pass http://$NGINX_PROXY_HOST:$port;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+EOF
+        fi
+
+        if ! run_host_command ln -sfn "$site_path" "$enabled_path"; then
+            echo "Warning: Could not enable nginx site for tenant '$tenant_id'."
+            return 1
+        fi
+
+        if ! reload_host_nginx; then
+            echo "Warning: Initial nginx reload failed for tenant '$tenant_id'."
+        fi
+
+        if command -v certbot >/dev/null 2>&1 || command -v sudo >/dev/null 2>&1; then
+            local certbot_args=(certbot --nginx --non-interactive --agree-tos -d "$domain")
+            if [ -n "$CERTBOT_EMAIL" ]; then
+                certbot_args+=(--email "$CERTBOT_EMAIL")
+            else
+                certbot_args+=(--register-unsafely-without-email)
+            fi
+
+            if ! run_host_command "${certbot_args[@]}"; then
+                echo "Warning: certbot failed for tenant '$tenant_id'; keeping HTTP-only vhost for now."
+                return 1
+            fi
+
+            have_cert=true
+        fi
+    fi
+
+    if [ "$have_cert" != true ]; then
+        echo "Warning: No TLS certificate available for tenant '$tenant_id'; leaving HTTP-only nginx config in place."
+        return 1
+    fi
+
+    if [ "$(id -u)" -eq 0 ]; then
+        cat > "$site_path" <<EOF
+# ==========================================
+#  INVENTARSYSTEM ($tenant_id)
+# ==========================================
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name $domain;
+    client_max_body_size 100M;
+
+    ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;
+
+    location / {
+        proxy_pass http://$NGINX_PROXY_HOST:$port;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+
+# Gezielte HTTP zu HTTPS Weiterleitung für $tenant_id
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $domain;
+    return 301 https://$domain\$request_uri;
+}
+EOF
+    else
+        sudo tee "$site_path" >/dev/null <<EOF
+# ==========================================
+#  INVENTARSYSTEM ($tenant_id)
+# ==========================================
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name $domain;
+    client_max_body_size 100M;
+
+    ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;
+
+    location / {
+        proxy_pass http://$NGINX_PROXY_HOST:$port;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+
+# Gezielte HTTP zu HTTPS Weiterleitung für $tenant_id
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $domain;
+    return 301 https://$domain\$request_uri;
+}
+EOF
+    fi
+
+    if ! run_host_command ln -sfn "$site_path" "$enabled_path"; then
+        echo "Warning: Could not enable nginx site for tenant '$tenant_id'."
+        return 1
+    fi
+
+    if ! reload_host_nginx; then
+        echo "Warning: nginx reload after tenant '$tenant_id' configuration update failed."
+        return 1
+    fi
+}
+
+remove_tenant_nginx_config() {
+    local tenant_id="$1"
+    local domain site_path enabled_path
+
+    domain="$(tenant_domain "$tenant_id")"
+    site_path="$(tenant_nginx_site_path "$tenant_id")"
+    enabled_path="$(tenant_nginx_enabled_path "$tenant_id")"
+
+    if [ -f "$enabled_path" ] || [ -L "$enabled_path" ]; then
+        run_host_command rm -f "$enabled_path" || true
+    fi
+
+    if [ -f "$site_path" ]; then
+        run_host_command rm -f "$site_path" || true
+    fi
+
+    if command -v certbot >/dev/null 2>&1 || command -v sudo >/dev/null 2>&1; then
+        run_host_command certbot delete --cert-name "$domain" --non-interactive >/dev/null 2>&1 || true
+    fi
+
+    reload_host_nginx || true
+}
 
 ensure_runtime_config_json() {
     local config_path backup_path
@@ -200,65 +444,36 @@ sys.path.insert(0, "/app")
 sys.path.insert(0, "/app/Web")
 from Web.modules.database import settings
 from pymongo import MongoClient
+import Web.modules.inventarsystem.data_protection as dp
+import Web.modules.database.user as us
 
 tenant_id = sys.argv[1].lower()
 mode = sys.argv[2]
 sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
-db_name = f"inventar_{sanitized}"
-client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
+db_name = f"inventar_{sanitized}" if sanitized else settings.MONGODB_DB
+
+client = MongoClient(settings.MONGODB_HOST, settings.MONGODB_PORT)
 db = client[db_name]
-
-pw_bytes = "admin123".encode("utf-8")
-random_salt = os.urandom(16)
-hashed = hashlib.scrypt(pw_bytes, salt=random_salt, n=16384, r=8, p=1)
-hashed_pw_string = f"v1${random_salt.hex()}${hashed.hex()}"
-
-action_permissions = {
-    "can_borrow": True,
-    "can_insert": True,
-    "can_edit": True,
-    "can_delete": True,
-    "can_manage_users": True,
-    "can_manage_settings": True,
-    "can_view_logs": True,
+users = db["users"]
+permission_defaults = us.build_default_permission_payload("full_access")
+admin_doc = {
+    "Username": "admin",
+    "Password": us.hashing("admin123"),
+    "Admin": True,
+    "active_ausleihung": None,
+    "name": dp.encrypt_text("admin"),
+    "last_name": dp.encrypt_text("admin"),
+    "IsStudent": False,
+    "PermissionPreset": permission_defaults["preset"],
+    "ActionPermissions": permission_defaults["actions"],
+    "PagePermissions": permission_defaults["pages"],
 }
-
-page_permissions = {
-    "home": True,
-    "tutorial_page": True,
-    "my_borrowed_items": True,
-    "notifications_view": True,
-    "impressum": True,
-    "license": True,
-    "library_view": True,
-    "terminplan": True,
-    "home_admin": True,
-    "upload_admin": True,
-    "library_admin": True,
-    "admin_borrowings": True,
-    "library_loans_admin": True,
-    "admin_damaged_items": True,
-    "admin_audit_dashboard": True,
-    "logs": True,
-    "manage_filters": True,
-    "manage_locations": True,
-}
-
-if db.users.count_documents({"Username": "admin"}) == 0:
-    db.users.insert_one({
-        "Username": "admin",
-        "Password": hashed_pw_string,
-        "Admin": True,
-        "active_ausleihung": None,
-        "name": "Admin",
-        "last_name": "User",
-        "IsStudent": False,
-        "PermissionPreset": "full_access",
-        "ActionPermissions": action_permissions,
-        "PagePermissions": page_permissions,
-    })
+users.replace_one({"Username": "admin"}, admin_doc, upsert=True)
+print("Fallback successfully applied")
 
 if mode == "trial":
+    client = MongoClient(settings.MONGODB_HOST, settings.MONGODB_PORT)
+    db = client[db_name]
     db.settings.update_one(
         {"setting_type": "tenant_trial"},
         {"$set": {
@@ -271,6 +486,8 @@ if mode == "trial":
         upsert=True,
     )
 
+client.close()
+
 print(f"Tenant {sys.argv[1]} database initialized. Default admin: admin / admin123")
 PY
 }
@@ -532,15 +749,18 @@ ${YELLOW}Nutzung:${RESET} $0 <befehl> [tenant_id] [optionen]
 
 ${BLUE}${BOLD}VERFÜGBARE BEFEHLE:${RESET}
   ${GREEN}add${RESET} <tenant_id> [port]
-    Legt einen neuen Tenant an, registriert den Port und initialisiert 
-    die MongoDB-Datenbank mit einem Standard-Admin (${YELLOW}admin / admin123${RESET}).
+        Legt einen neuen Tenant an, registriert den Port, richtet den nginx-Host
+        für ${YELLOW}<tenant_id>.invario-software.de${RESET} ein und initialisiert
+        die MongoDB-Datenbank mit einem Standard-Admin (${YELLOW}admin / admin123${RESET}).
 
   ${GREEN}trial${RESET} <tenant_id> [port] [tage]
     Erstellt einen temporären Test-Tenant. Standardlaufzeit: 7 Tage.
-    Läuft automatisch ab und löscht sich selbst.
+        Läuft automatisch ab, löscht sich selbst und bekommt die gleiche nginx/
+        Certbot-Anbindung wie ein normaler Tenant.
 
   ${GREEN}remove${RESET} [-y|--yes] <tenant_id>
-    Löscht einen Tenant, seine Konfiguration, Ports und die Datenbank.
+        Löscht einen Tenant, seine Konfiguration, Ports, nginx-VHost und das
+        zugehörige Let's-Encrypt-Zertifikat sowie die Datenbank.
     Nutze ${RED}-y${RESET}, um die Bestätigungsabfrage zu überspringen.
 
   ${GREEN}restart-tenant${RESET} <tenant_id>
@@ -601,11 +821,16 @@ case "$COMMAND" in
             register_tenant_port "$TENANT_ID" "$PORT_ARG"
             update_runtime_ports "$PORT_ARG"
             sync_tenant_port_map
+            if ! write_tenant_nginx_config "$TENANT_ID" "$PORT_ARG"; then
+                echo "Warning: nginx/certbot provisioning for '$TENANT_ID' could not be completed automatically."
+            fi
             if [ -n "$(docker ps -qf 'name=app' | head -n 1)" ]; then
                 restart_app_container
             fi
         fi
 
+        
+
         echo "Adding new tenant '$TENANT_ID'..."
         echo "Initializing database for $TENANT_ID..."
         initialize_tenant_database "$TENANT_ID" "standard"
@@ -630,6 +855,9 @@ case "$COMMAND" in
             register_tenant_port "$TENANT_ID" "$PORT_ARG"
             update_runtime_ports "$PORT_ARG"
             sync_tenant_port_map
+            if ! write_tenant_nginx_config "$TENANT_ID" "$PORT_ARG"; then
+                echo "Warning: nginx/certbot provisioning for trial tenant '$TENANT_ID' could not be completed automatically."
+            fi
         fi
 
         write_trial_tenant_config "$TENANT_ID" "$PORT_ARG" "$DAYS_ARG"
@@ -642,11 +870,11 @@ case "$COMMAND" in
         initialize_tenant_database "$TENANT_ID" "trial"
         echo "Trial tenant '$TENANT_ID' successfully configured. It will expire after $DAYS_ARG day(s) and self-delete."
         ;;
-    
+
     remove)
         FORCE_REMOVE=false
         TENANT_ARG="${2:-}"
-        
+
         if [ "$TENANT_ARG" = "--yes" ] || [ "$TENANT_ARG" = "-y" ]; then
             FORCE_REMOVE=true
             TENANT_ID="${3:-}"
@@ -671,40 +899,31 @@ case "$COMMAND" in
         echo "Removing tenant '$TENANT_ID'..."
         APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
         port_to_remove=""
-        
+
         if [ -n "$APP_CONTAINER" ]; then
-            # Zuerst die Datenbank via PyMongo hart droppen (Erzwungenes Löschen)
-            port_to_remove="$(docker exec "$APP_CONTAINER" python3 - "$TENANT_ID" <<'PY'
-import sys, re
-sys.path.insert(0, '/app')
-sys.path.insert(0, '/app/Web')
-from tenant import delete_tenant, get_tenant_config
-from Web.modules.database import settings
-from pymongo import MongoClient
+            # MongoDB-Datenbank via PyMongo direkt im Container droppen
+            docker exec -i "$APP_CONTAINER" python3 -c '
+    import sys, os
+    try:
+        import pymongo
+        tenant_id = sys.argv[1]
+        mongo_uri = os.environ.get("MONGO_URI", "mongodb://localhost:27017/")
+        client = pymongo.MongoClient(mongo_uri, serverSelectionTimeoutMS=2000)
+        db_name = f"inventar_{tenant_id}"
+        if db_name in client.list_database_names():
+            client.drop_database(db_name)
+            print(f"Dropped database: {db_name}")
+    except Exception as e:
+        print(f"Error dropping database: {e}", file=sys.stderr)
+    ' "$TENANT_ID" > /dev/null 2>&1
 
-tenant_id = sys.argv[1]
-tenant_cfg = get_tenant_config(tenant_id)
-port = tenant_cfg.get('port')
+            # Konfiguration und Port via Host-Funktion bereinigen und Port ermitteln
+            if port_to_remove="$(remove_tenant_port "$TENANT_ID" 2>/dev/null)"; then
+                :
+            else
+                port_to_remove=""
+            fi
 
-# Datenbanknamen exakt rekonstruieren
-sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
-db_name = f"inventar_{sanitized}"
-
-try:
-    client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
-    client.drop_database(db_name)
-    print(f"MongoDB database '{db_name}' dropped successfully.", file=sys.stderr)
-except Exception as e:
-    print(f"Warning: Could not drop database '{db_name}': {e}", file=sys.stderr)
-
-if not delete_tenant(tenant_id):
-    print(f'Error: failed to delete tenant {tenant_id}', file=sys.stderr)
-    sys.exit(1)
-
-if port is not None:
-    print(port)
-PY
-            )"
             echo "Tenant '$TENANT_ID' database and config removed."
         else
             echo "Warning: Application container not running. Tenant database may still exist in MongoDB."
@@ -718,6 +937,7 @@ PY
         if [ -n "$port_to_remove" ]; then
             remove_runtime_port "$port_to_remove"
         fi
+        remove_tenant_nginx_config "$TENANT_ID"
         sync_tenant_port_map
         if [ -n "$(docker ps -qf 'name=app' | head -n 1)" ]; then
             restart_app_container
@@ -727,7 +947,7 @@ PY
         else
             echo "Removed tenant '$TENANT_ID'. No port mapping was present."
         fi
-        ;;
+    ;;
 
     restart-tenant)
         TENANT_ID="${2:-}"

requirements.txt

@@ -17,4 +17,5 @@ cryptography>=42.0.0
 pywebpush
 py-vapid>=1.9.0
 beautifulsoup4
-pywebpush
+pywebpush
+pandas

update.sh

@@ -9,13 +9,13 @@ LOG_DIR="$PROJECT_DIR/logs"
 LOG_FILE="$LOG_DIR/update.log"
 STATE_FILE="$PROJECT_DIR/.release-version"
 REPO_SLUG="Invario/Inventarsystem"
-API_URL="https://git.invario-software.eu/api/v1/repos/$REPO_SLUG/releases/latest"
+API_BASE_URL="https://git.invario-software.eu/api/v1/repos/$REPO_SLUG"
 BUNDLE_ASSET="inventarsystem-docker-bundle.tar.gz"
 ENV_FILE="$PROJECT_DIR/.docker-build.env"
 APP_IMAGE_REPO="git.invario-software.eu/invario/inventarsystem"
 COMPOSE_FILE="docker-compose-multitenant.yml"
 MIN_ROOT_FREE_MB="${INVENTAR_MIN_ROOT_FREE_MB:-2048}"
-MODE="release"
+MODE="stable"
 
 mkdir -p "$LOG_DIR"
 chmod 777 "$LOG_DIR" 2>/dev/null || true
@@ -119,6 +119,7 @@ usage() {
 Usage: $0 [options]
 
 Options:
+  -dev               Install the latest prerelease build
   --multitenant      Use docker-compose-multitenant.yml (default)
   -h, --help         Show this help message
 EOF
@@ -127,6 +128,10 @@ EOF
 parse_args() {
     while [[ $# -gt 0 ]]; do
         case "$1" in
+            -dev)
+                MODE="development"
+                shift
+                ;;
             --multitenant)
                 COMPOSE_FILE="docker-compose-multitenant.yml"
                 shift
@@ -179,7 +184,8 @@ create_backup() {
 
 fetch_release_metadata() {
     local meta_file="$1"
-    curl -fsSL "$API_URL" -o "$meta_file"
+    local endpoint="${2:-latest}"
+    curl -fsSL "$API_BASE_URL/releases/$endpoint" -o "$meta_file"
 }
 
 parse_latest_tag() {
@@ -207,6 +213,124 @@ for asset in data.get('assets', []):
 PY
 }
 
+parse_release_tag() {
+    local meta_file="$1"
+    python3 - <<'PY' "$meta_file"
+import json, sys
+with open(sys.argv[1], 'r', encoding='utf-8') as f:
+    data = json.load(f)
+print(data.get('tag_name', '').strip())
+PY
+}
+
+strip_prerelease_suffix() {
+    local tag="$1"
+    python3 - <<'PY' "$tag"
+import re, sys
+tag = sys.argv[1].strip()
+match = re.match(r'^(v\d+\.\d+\.\d+)', tag)
+print(match.group(1) if match else tag)
+PY
+}
+
+compare_semver_tags() {
+    local left_tag="$1"
+    local right_tag="$2"
+    python3 - <<'PY' "$left_tag" "$right_tag"
+import re, sys
+
+def parse(tag):
+    match = re.match(r'^v(\d+)\.(\d+)\.(\d+)', tag.strip())
+    if not match:
+        return None
+    return tuple(int(part) for part in match.groups())
+
+left = parse(sys.argv[1])
+right = parse(sys.argv[2])
+if left is None or right is None:
+    print('unknown')
+elif left > right:
+    print('gt')
+elif left < right:
+    print('lt')
+else:
+    print('eq')
+PY
+}
+
+parse_prerelease_flag() {
+    local meta_file="$1"
+    python3 - <<'PY' "$meta_file"
+import json, sys
+with open(sys.argv[1], 'r', encoding='utf-8') as f:
+    data = json.load(f)
+print('true' if data.get('prerelease') else 'false')
+PY
+}
+
+latest_stable_release() {
+    local meta_file="$1"
+    local releases_file="$2"
+    local release_count=0
+
+    if ! curl -fsSL "$API_BASE_URL/releases" -o "$releases_file"; then
+        return 1
+    fi
+
+    if ! python3 - <<'PY' "$releases_file" "$meta_file"
+import json, sys
+releases_path, target_path = sys.argv[1], sys.argv[2]
+with open(releases_path, 'r', encoding='utf-8') as f:
+    releases = json.load(f)
+for release in releases:
+    if not release.get('prerelease') and not release.get('draft'):
+        with open(target_path, 'w', encoding='utf-8') as out:
+            json.dump(release, out)
+        raise SystemExit(0)
+raise SystemExit(1)
+PY
+    then
+        return 1
+    fi
+    return 0
+}
+
+latest_prerelease() {
+    local meta_file="$1"
+    local releases_file="$2"
+
+    if ! curl -fsSL "$API_BASE_URL/releases" -o "$releases_file"; then
+        return 1
+    fi
+
+    if ! python3 - <<'PY' "$releases_file" "$meta_file"
+import json, sys
+releases_path, target_path = sys.argv[1], sys.argv[2]
+with open(releases_path, 'r', encoding='utf-8') as f:
+    releases = json.load(f)
+for release in releases:
+    if release.get('prerelease') and not release.get('draft'):
+        with open(target_path, 'w', encoding='utf-8') as out:
+            json.dump(release, out)
+        raise SystemExit(0)
+raise SystemExit(1)
+PY
+    then
+        return 1
+    fi
+    return 0
+}
+
+fetch_latest_release_bundle() {
+    local release_meta="$1"
+    local bundle_url
+    bundle_url="$(parse_asset_url "$release_meta" "$BUNDLE_ASSET")"
+    if [ -z "$bundle_url" ]; then
+        return 1
+    fi
+    printf '%s' "$bundle_url"
+}
+
 refresh_runtime_scripts_from_main() {
     local start_url stop_url restart_url update_url
     start_url="https://git.invario-software.eu/$REPO_SLUG/raw/branch/main/start.sh"
@@ -368,12 +492,66 @@ main() {
     archive_logs
     create_backup
 
-    # If user requested a development install, perform a simple dev deploy flow
+    # If user requested a development install, deploy the latest prerelease.
     if [ "$MODE" = "development" ]; then
         log_message "Requested development install"
-        local tag="dev"
-        local app_image="$APP_IMAGE_REPO:$tag"
-        local compose_path="$PROJECT_DIR/$COMPOSE_FILE"
+        local tag meta_file releases_file stable_meta_file stable_tag prerelease_tag prerelease_base_tag bundle_url app_image compose_path
+        local tmp_dir
+
+        tmp_dir="$(mktemp -d)"
+        meta_file="$tmp_dir/prerelease.json"
+        stable_meta_file="$tmp_dir/stable.json"
+        releases_file="$tmp_dir/releases.json"
+        trap 'rm -rf "${tmp_dir:-}"' EXIT
+
+        if ! fetch_release_metadata "$stable_meta_file" "latest"; then
+            log_message "ERROR: Could not fetch latest stable release metadata"
+            exit 1
+        fi
+
+        stable_tag="$(parse_release_tag "$stable_meta_file")"
+        if [ -z "$stable_tag" ]; then
+            log_message "ERROR: Could not determine latest stable release tag"
+            exit 1
+        fi
+
+        if latest_prerelease "$meta_file" "$releases_file"; then
+            prerelease_tag="$(parse_release_tag "$meta_file")"
+            prerelease_base_tag="$(strip_prerelease_suffix "$prerelease_tag")"
+        else
+            prerelease_tag=""
+            prerelease_base_tag=""
+        fi
+
+        if [ -n "$prerelease_tag" ]; then
+            case "$(compare_semver_tags "$stable_tag" "$prerelease_base_tag")" in
+                gt|eq)
+                    log_message "Latest stable release ($stable_tag) supersedes prerelease ($prerelease_tag); using stable release"
+                    tag="$stable_tag"
+                    meta_file="$stable_meta_file"
+                    ;;
+                lt)
+                    tag="$prerelease_tag"
+                    ;;
+                *)
+                    log_message "WARNING: Could not compare stable and prerelease versions; preferring prerelease when available"
+                    tag="$prerelease_tag"
+                    ;;
+            esac
+        else
+            log_message "No prerelease found; falling back to stable release $stable_tag"
+            tag="$stable_tag"
+            meta_file="$stable_meta_file"
+        fi
+
+        bundle_url="$(fetch_latest_release_bundle "$meta_file")"
+        if [ -z "$bundle_url" ]; then
+            log_message "ERROR: Release asset not found: $BUNDLE_ASSET"
+            exit 1
+        fi
+
+        app_image="$APP_IMAGE_REPO:$tag"
+        compose_path="$PROJECT_DIR/$COMPOSE_FILE"
 
         if [ ! -f "$compose_path" ]; then
             log_message "ERROR: compose file not found: $compose_path"
@@ -399,6 +577,9 @@ EOF
             exit 1
         fi
 
+        download_and_extract_bundle "$bundle_url" "$tmp_dir"
+        refresh_runtime_scripts_from_main
+
         # Bring up stack
         docker compose -f "$compose_path" --env-file "$ENV_FILE" pull mongodb redis >> "$LOG_FILE" 2>&1 || true
         docker compose -f "$compose_path" --env-file "$ENV_FILE" up -d --remove-orphans >> "$LOG_FILE" 2>&1
@@ -409,7 +590,7 @@ EOF
         fi
 
         echo "$tag" > "$STATE_FILE"
-        log_message "Development update completed successfully"
+        log_message "Development update completed successfully to prerelease $tag"
         exit 0
     fi
 
@@ -419,8 +600,8 @@ EOF
 
     trap 'rm -rf "${tmp_dir:-}"' EXIT
 
-    log_message "Checking latest Gitea release for $REPO_SLUG..."
-    if ! fetch_release_metadata "$meta_file"; then
+    log_message "Checking latest stable Gitea release for $REPO_SLUG..."
+    if ! fetch_release_metadata "$meta_file" "latest"; then
         log_message "WARNING: Could not fetch release metadata. Falling back to self-healing start path."
         if INVENTAR_SETUP_CRON=0 bash "$PROJECT_DIR/start.sh" >> "$LOG_FILE" 2>&1; then
             if verify_stack_health; then
@@ -436,7 +617,7 @@ EOF
         exit 0
     fi
 
-    latest_tag="$(parse_latest_tag "$meta_file")"
+    latest_tag="$(parse_release_tag "$meta_file")"
     if [ -z "$latest_tag" ]; then
         log_message "WARNING: Could not determine latest release tag. Falling back to self-healing start path."
         if INVENTAR_SETUP_CRON=0 bash "$PROJECT_DIR/start.sh" >> "$LOG_FILE" 2>&1; then