fix of the json upload format

- Created '/upload_csv_batch' endpoint to handle CSV parsing and multiple image uploads
- Added automatic WebP conversion and GridFS storage for batch images
- Implemented grouping logic via 'series_group_id' based on item name
- Created '/batch_upload' route and 'upload_batch.html' for a seamless async frontend

Web/modules/database/items.py

@@ -19,11 +19,61 @@ Collection Structure:
   - Status fields: Verfuegbar, User (if currently borrowed)
 """
 from bson.objectid import ObjectId
+from bson.errors import InvalidId
 import datetime
 import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
+import Web.modules.inventarsystem.data_protection as dp
 
 
+def safe_decrypt_user(encrypted_user):
+    """
+    Safely decrypt an encrypted username string.
+    
+    Returns the original string if decryption fails or if input is empty/None.
+    """
+    if not encrypted_user:
+        return encrypted_user
+
+    try:
+        return dp.decrypt_text(encrypted_user)
+    except Exception as e:
+        print(f"Error decrypting user data: {e}")
+        # Return fallback value or None to prevent downstream crashes
+        return "[Decryption Failed]"
+
+
+def decrypt_item_user_data(item):
+    """
+    Decrypts encrypted user fields within an inventory item document in-place.
+    
+    Args:
+        item (dict): MongoDB document representing an item.
+        
+    Returns:
+        dict: The item with decrypted user fields.
+    """
+    if not item:
+        return item
+
+    # 1. Decrypt top-level 'User' field if present
+    if 'User' in item and item['User']:
+        item['User'] = safe_decrypt_user(item['User'])
+
+    # 2. Decrypt nested 'user' field in 'NextAppointment' if present
+    if 'NextAppointment' in item and isinstance(item['NextAppointment'], dict):
+        if 'user' in item['NextAppointment']:
+            item['NextAppointment']['user'] = safe_decrypt_user(item['NextAppointment']['user'])
+
+    return item
+
+def _to_object_id(id_str):
+    """Safely convert a string to ObjectId."""
+    try:
+        return ObjectId(id_str)
+    except (InvalidId, TypeError):
+        return None
+
 LIBRARY_ITEM_TYPES = ('book', 'cd', 'dvd', 'other', 'schoolbook', 'Buch', 'Schulbuch', 'schulbuch')
 
 
@@ -206,14 +256,12 @@ def update_item(id, name, ort, beschreibung, images, verfuegbar, filter1, filter
         db = client[cfg.MONGODB_DB]
         items = db['items']
 
-        # 1. Altes Item laden, um SeriesGroupId zu bestimmen
         old_item = items.find_one({'_id': ObjectId(id)})
         if not old_item:
             return False
 
         series_group_id = old_item.get('SeriesGroupId')
 
-        # 2. Shared Data: Daten, die für ALLE in der Gruppe gleich sind
         shared_update = {
             'Name': name,
             'Ort': ort,
@@ -227,18 +275,15 @@ def update_item(id, name, ort, beschreibung, images, verfuegbar, filter1, filter
             'Reservierbar': reservierbar,
             'ISBN': isbn,
             'ItemType': item_type,
-            'Verfuegbar': verfuegbar, # Wir behalten den Status bei
+            'Verfuegbar': verfuegbar,
             'LastUpdated': datetime.datetime.now()
         }
 
-        # 3. Spezifische Daten: Was NICHT synchronisiert wird
         specific_update = shared_update.copy()
         specific_update['Code_4'] = code_4
 
-        # 4. Das aktuelle Item updaten
         items.update_one({'_id': ObjectId(id)}, {'$set': specific_update})
 
-        # 5. Alle anderen Gruppen-Mitglieder synchronisieren
         if series_group_id:
             items.update_many(
                 {
@@ -279,7 +324,7 @@ def update_item_status(id, verfuegbar, user=None):
         update_query = {'$set': update_data}
 
         if user is not None:
-            update_data['User'] = user
+            update_data['User'] = dp.encrypt_text(user)
         elif verfuegbar:
             # If item is being marked as available, clear the user field
             update_query['$unset'] = {'User': ""}
@@ -432,29 +477,29 @@ def get_borrowed_items():
         print(f"Error retrieving borrowed items: {e}")
         return []
 
-
+def get_item(id, decrypt=True):
-def get_item(id):
     """
-    Retrieve a specific inventory item by its ID.
+    Retrieve an inventory item by ID, with optional decryption.
-    
-    Args:
-        id (str): ID of the item to retrieve
-        
-    Returns:
-        dict: The inventory item document or None if not found
     """
+    item_id = _to_object_id(id)
+    if not item_id:
+        return None
+
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         items = db['items']
-        item = items.find_one(_active_record_query({'_id': ObjectId(id)}))
+        query = _active_record_query({'_id': item_id})
-        client.close()
+        item = items.find_one(query)
+        if item:
+            item['_id'] = str(item['_id'])
+            if decrypt:
+                decrypt_item_user_data(item)
         return item
     except Exception as e:
-        print(f"Error retrieving item: {e}")
+        print(f"Error retrieving item {id}: {e}")
         return None
 
-
 def get_item_by_name(name):
     """
     Retrieve a specific inventory item by its name.
@@ -986,14 +1031,9 @@ def update_item_next_appointment(item_id, appointment_data):
     Update an item with information about its next scheduled appointment.
 
     Args:
-        item_id (str): ID of the item to update
+        item_id (str): ID of the item
-        appointment_data (dict): Appointment information containing:
+        appointment_data (dict or None): Dictionary containing appointment details
-            - date: Date of the appointment
+                                         (e.g., user, start_time, end_time) or None to clear it.
-            - start_period: Start period number
-            - end_period: End period number
-            - user: Username who scheduled the appointment
-            - notes: Optional notes
-            - appointment_id: ID of the appointment booking
 
     Returns:
         bool: True if successful, False otherwise
@@ -1003,32 +1043,30 @@ def update_item_next_appointment(item_id, appointment_data):
         db = client[cfg.MONGODB_DB]
         items = db['items']
 
-        # Format the appointment data for storage
+        # If clearing the appointment
-        # Ensure date is a datetime object for MongoDB storage
+        if appointment_data is None:
-        appointment_date = appointment_data['date']
+            update_query = {
-        if isinstance(appointment_date, datetime.date) and not isinstance(appointment_date, datetime.datetime):
+                '$unset': {'NextAppointment': ""},
-            # Convert date to datetime for MongoDB compatibility
+                '$set': {'LastUpdated': datetime.datetime.now()}
-            appointment_date = datetime.datetime.combine(appointment_date, datetime.time())
+            }
+        else:
+            # Create a copy so we don't mutate the original dictionary passed in
+            data_to_save = appointment_data.copy()
 
-        next_appointment = {
+            # Encrypt the user field if it exists to match the decryption logic at the top
-            'date': appointment_date,
+            if 'user' in data_to_save and data_to_save['user']:
-            'end_date': appointment_data.get('end_date', appointment_date),
+                data_to_save['user'] = dp.encrypt_text(data_to_save['user'])
-            'start_period': appointment_data['start_period'],
-            'end_period': appointment_data['end_period'],
-            'user': appointment_data['user'],
-            'notes': appointment_data.get('notes', ''),
-            'appointment_id': appointment_data['appointment_id'],
-            'scheduled_at': datetime.datetime.now()
-        }
 
-        update_data = {
+            update_query = {
-            'NextAppointment': next_appointment,
+                '$set': {
-            'LastUpdated': datetime.datetime.now()
+                    'NextAppointment': data_to_save,
-        }
+                    'LastUpdated': datetime.datetime.now()
+                }
+            }
 
         result = items.update_one(
             {'_id': ObjectId(item_id)},
-            {'$set': update_data}
+            update_query
         )
 
         client.close()
@@ -1088,31 +1126,25 @@ def get_items_with_appointments():
         print(f"Error retrieving items with appointments: {e}")
         return []
 
-def get_current_status(item_id):
+def get_current_status(item_id, decrypt=True):
     """
-    Retrieve the current status of an item, including availability and user.
+    Retrieve the current status of an item, decrypting the user field if present.
-    
-    Args:
-        item_id (str): ID of the item to check
-        
-    Returns:
-        dict: Current status of the item or None if not found
     """
+    oid = _to_object_id(item_id)
+    if not oid:
+        return None
+
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         items = db['items']
-        
+        item = items.find_one({'_id': oid}, {'Verfuegbar': 1, 'User': 1})
-        item = items.find_one({'_id': ObjectId(item_id)}, {'Verfuegbar': 1, 'User': 1})
-        
         if item:
-            # Convert ObjectId to string for consistency
             item['_id'] = str(item['_id'])
-            client.close()
+            if decrypt:
+                decrypt_item_user_data(item)
             return item
-        else:
+        return None
-            client.close()
+    except Exception as e:
-            return None
+        print(f"Error retrieving current status for item {item_id}: {e}")
-    except Exception as e:
-        print(f"Error retrieving current status: {e}")
         return None

Web/modules/database/settings.py

@@ -319,15 +319,15 @@ THUMBNAIL_FOLDER = _get(_conf, ['upload', 'thumbnail_folder'], DEFAULTS['upload'
 PREVIEW_FOLDER = _get(_conf, ['upload', 'preview_folder'], DEFAULTS['upload']['preview_folder'])
 QR_CODE_FOLDER = _get(_conf, ['upload', 'qrcode_folder'], DEFAULTS['upload']['qrcode_folder'])
 
-# Normalize to absolute paths to avoid cwd issues
+# This guarantees exact matching with Docker volume mounts
 if not os.path.isabs(UPLOAD_FOLDER):
-    UPLOAD_FOLDER = os.path.join(BASE_DIR, os.path.relpath(UPLOAD_FOLDER, BASE_DIR))
+    UPLOAD_FOLDER = os.path.abspath(os.path.join(BASE_DIR, "uploads"))
 if not os.path.isabs(THUMBNAIL_FOLDER):
-    THUMBNAIL_FOLDER = os.path.join(BASE_DIR, os.path.relpath(THUMBNAIL_FOLDER, BASE_DIR))
+    THUMBNAIL_FOLDER = os.path.abspath(os.path.join(BASE_DIR, "thumbnails"))
 if not os.path.isabs(PREVIEW_FOLDER):
-    PREVIEW_FOLDER = os.path.join(BASE_DIR, os.path.relpath(PREVIEW_FOLDER, BASE_DIR))
+    PREVIEW_FOLDER = os.path.abspath(os.path.join(BASE_DIR, "previews"))
 if not os.path.isabs(QR_CODE_FOLDER):
-    QR_CODE_FOLDER = os.path.join(BASE_DIR, os.path.relpath(QR_CODE_FOLDER, BASE_DIR))
+    QR_CODE_FOLDER = os.path.abspath(os.path.join(BASE_DIR, "QRCodes"))
 MAX_UPLOAD_MB = _get(_conf, ['upload', 'max_size_mb'], DEFAULTS['upload']['max_size_mb'])
 IMAGE_MAX_UPLOAD_MB = _get(_conf, ['upload', 'image_max_size_mb'], DEFAULTS['upload']['image_max_size_mb'])
 VIDEO_MAX_UPLOAD_MB = _get(_conf, ['upload', 'video_max_size_mb'], DEFAULTS['upload']['video_max_size_mb'])

Web/modules/database/user.py

@@ -20,6 +20,7 @@ import string
 from bson.objectid import ObjectId
 import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
+import Web.modules.inventarsystem.data_protection as dp
 import hmac
 import os
 
@@ -109,13 +110,6 @@ def build_username_from_name(first_name, last_name=''):
     """
     Build a deterministic username abbreviation from first and last name.
     Uses 3 letters from each name and stores it lowercase.
-    
-    Args:
-        first_name (str): First name
-        last_name (str): Last name (optional)
-        
-    Returns:
-        str: Generated username
     """
     alias = build_name_synonym(first_name, last_name)
     return alias.lower()
@@ -324,7 +318,6 @@ def get_effective_permissions(username):
         return build_default_permission_payload('full_access')
 
     preset_key = user.get('PermissionPreset')
-    print(preset_key)
     payload = build_default_permission_payload(preset_key)
     payload['actions'] = _normalize_bool_map(user.get('ActionPermissions', {}), payload['actions'])
     payload['pages'] = _normalize_bool_map(user.get('PagePermissions', {}), payload['pages'])
@@ -352,10 +345,10 @@ def update_user_permissions(username, preset_key, action_permissions=None, page_
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.update_one({'Username': username}, {'$set': update_data})
+    result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': update_data})
 
     if result.matched_count == 0:
-        result = users.update_one({'username': username}, {'$set': update_data})
+        result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': update_data})
 
     client.close()
     return result.matched_count > 0
@@ -367,7 +360,7 @@ def get_favorites(username):
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': username}) or users.find_one({'username': username})
+    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
     client.close()
     if not user:
         return []
@@ -382,7 +375,7 @@ def add_favorite(username, item_id):
         db = _get_tenant_db(client)
         users = db['users']
         users.update_one(
-            {'$or': [{'Username': username}, {'username': username}]},
+            {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]},
             {'$addToSet': {'favorites': ObjectId(item_id)}}
         )
         client.close()
@@ -397,7 +390,7 @@ def remove_favorite(username, item_id):
         db = _get_tenant_db(client)
         users = db['users']
         users.update_one(
-            {'$or': [{'Username': username}, {'username': username}]},
+            {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]},
             {'$pull': {'favorites': ObjectId(item_id)}}
         )
         client.close()
@@ -406,16 +399,9 @@ def remove_favorite(username, item_id):
         return False
 
 
-
 def check_password_strength(password):
     """
     Check if a password meets minimum security requirements.
-    
-    Args:
-        password (str): Password to check
-        
-    Returns:
-        bool: True if password is strong enough, False otherwise
     """
     if password is None:
         return False
@@ -436,18 +422,14 @@ def check_password_strength(password):
 def hashing(password, salt=None):
     """
     Hasht ein Passwort mit scrypt.
-    - Wenn kein Salt übergeben wird, wird ein sicherer, zufälliger Salt generiert (für neue Passwörter).
-    - Format für neue Hashes: v1$<salt_hex>$<hash_hex>
     """
-    password_bytes = password.encode('utf-8') # Explizit UTF-8 für Plattformunabhängigkeit
+    password_bytes = password.encode('utf-8')
 
     if salt is None:
-        # Neuer Benutzer / Passwortänderung -> Dynamischer Salt
         random_salt = os.urandom(16)
         hashed = hashlib.scrypt(password_bytes, salt=random_salt, n=16384, r=8, p=1)
         return f"v1${random_salt.hex()}${hashed.hex()}"
     else:
-        # Bestehender Benutzer (wird zur Verifizierung aufgerufen)
         hashed = hashlib.scrypt(password_bytes, salt=salt, n=16384, r=8, p=1)
         return hashed.hex()
 
@@ -455,25 +437,20 @@ def hashing(password, salt=None):
 def verify_password(provided_password, stored_password_string):
     """
     Verifiziert ein Passwort gegen einen gespeicherten Hash-String.
-    Unterstützt das alte Format (statischer Salt) und das neue Format (v1$...).
     """
     if not stored_password_string:
         return False
 
-    # Überprüfung für das neue, sichere Format
     if stored_password_string.startswith("v1$"):
         try:
             _, salt_hex, hash_hex = stored_password_string.split("$")
             salt_bytes = bytes.fromhex(salt_hex)
-            # Berechne den Hash des eingegebenen Passworts mit dem extrahierten Salt
             calculated_hash = hashing(provided_password, salt=salt_bytes)
-            # Timing-Attack-sicherer Vergleich
             return hmac.compare_digest(calculated_hash, hash_hex)
         except (ValueError, TypeError):
             logger.error("Ungültiges Hash-Format in der Datenbank entdeckt.")
             return False
     else:
-        # Abwärtskompatibilität: Altes Format mit statischem Salt b'some_salt'
         old_static_salt = b'some_salt'
         calculated_hash = hashing(provided_password, salt=old_static_salt)
         return hmac.compare_digest(calculated_hash, stored_password_string)
@@ -495,21 +472,25 @@ def check_nm_pwd(username, password):
         db = client[db_name]
         users = db['users']
 
-        query = {'$or': [{'Username': username}, {'username': username}]}
+        query = {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]}
         user_record = users.find_one(query)
 
         if user_record is None:
-            logger.warning("Kein Benutzer für %r in DB %r gefunden.", username, db_name)
+            query = {'$or': [{'Username': username}, {'username': username}]}
-            return None
+            user_record_fallback = users.find_one(query)
+            if user_record_fallback is None:
+                logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
+                return None
+            else:
+                user_record = user_record_fallback
 
         stored_password = user_record.get('Password') or user_record.get('password')
 
         if not verify_password(password, stored_password):
-            logger.warning("Falsches Passwort für Benutzer %r in DB %r.", username, db_name)
+            logger.warning("Falsches Passwort für Benutzer %r in DB %r.", dp.encrypt_text(username), db_name)
             return None
 
-        # Automatische Migration alter Hashes auf das neue Format
+        if stored_password and not stored_password.startswith("v1$"):
-        if not stored_password.startswith("v1$"):
             users.update_one({'_id': user_record['_id']}, {'$set': {'Password': hashing(password)}})
 
         return user_record
@@ -531,40 +512,35 @@ def add_user(
 ):
     """
     Add a new user to the database.
-    
-    Args:
-        username (str): Username for the new user
-        password (str): Password for the new user
-        
-    Returns:
-        bool: True if user was added successfully, False if password was too weak
     """
+    if not check_password_strength(password):
+        return False
+
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     try:
         db = _get_tenant_db(client)
         users = db['users']
-        if not check_password_strength(password):
+
-            return False
         permission_defaults = build_default_permission_payload(permission_preset)
+
         if isinstance(action_permissions, dict):
             for key, value in action_permissions.items():
                 permission_defaults['actions'][str(key)] = bool(value)
+
         if isinstance(page_permissions, dict):
             for key, value in page_permissions.items():
                 permission_defaults['pages'][str(key)] = bool(value)
 
-        if permission_preset == "full_access":
+        safe_name = name.strip() if name else ''
-            can_admin_preset_based = True 
+        safe_last_name = last_name.strip() if last_name else ''
-        else:
-            can_admin_preset_based = False
 
         user_doc = {
-            'Username': username,
+            'Username': dp.encrypt_text(username),
             'Password': hashing(password),
-            'Admin': can_admin_preset_based,
+            'Admin': (permission_preset == "full_access"),
             'active_ausleihung': None,
-            'name': name.strip() if name else '',
+            'name': dp.encrypt_text(safe_name) if safe_name else '',
-            'last_name': last_name.strip() if last_name else '',
+            'last_name': dp.encrypt_text(safe_last_name) if safe_last_name else '',
             'IsStudent': bool(is_student),
             'PermissionPreset': permission_defaults['preset'],
             'ActionPermissions': permission_defaults['actions'],
@@ -601,7 +577,7 @@ def student_card_exists(student_card_id):
 
 
 def get_user_by_student_card(student_card_id):
-    """Return user by student card id or None."""
+    """Return user dict by student card id or None."""
     normalized = normalize_student_card_id(student_card_id)
     if not normalized:
         return None
@@ -610,65 +586,44 @@ def get_user_by_student_card(student_card_id):
     users = db['student_cards']
     found_user = users.find_one({'SchülerName': normalized})
     client.close()
+
+    # Do not call dp.decrypt_text() here because found_user is a MongoDB dictionary.
     return found_user
 
 
 def make_admin(username):
-    """
+    """Grant administrator privileges to a user."""
-    Grant administrator privileges to a user.
-    
-    Args:
-        username (str): Username of the user to promote
-        
-    Returns:
-        bool: True if user was promoted successfully
-    """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.update_one({'Username': username}, {'$set': {'Admin': True}})
+    result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': True}})
     if result.matched_count == 0:
-        result = users.update_one({'username': username}, {'$set': {'Admin': True}})
+        result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': True}})
     client.close()
     return result.matched_count > 0
 
+
 def remove_admin(username):
-    """
+    """Remove administrator privileges from a user."""
-    Remove administrator privileges from a user.
-    
-    Args:
-        username (str): Username of the user to demote
-        
-    Returns:
-        bool: True if user was demoted successfully
-    """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.update_one({'Username': username}, {'$set': {'Admin': False}})
+    result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': False}})
     if result.matched_count == 0:
-        result = users.update_one({'username': username}, {'$set': {'Admin': False}})
+        result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': False}})
     client.close()
     return result.matched_count > 0
 
+
 def get_user(username):
-    """
+    """Retrieve a specific user by username."""
-    Retrieve a specific user by username.
-    
-    Args:
-        username (str): Username to search for
-        
-    Returns:
-        dict: User document or None if not found
-    """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     try:
         def find_in_db(database_name):
             db = client[database_name]
             users = db['users']
-            return users.find_one({'Username': username}) or users.find_one({'username': username})
+            return users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'username': username}) or users.find_one({'Username': username})
 
-        # Try current tenant first when available
         tenant_db, tenant_id = _resolve_request_tenant_db()
         if tenant_db:
             user = find_in_db(tenant_db)
@@ -681,7 +636,6 @@ def get_user(username):
             )
             return None
 
-        # Fallback to default configured database
         user = find_in_db(cfg.MONGODB_DB)
         if user:
             return user
@@ -692,146 +646,88 @@ def get_user(username):
 
 
 def check_admin(username):
-    """
+    """Check if a user has administrator privileges."""
-    Check if a user has administrator privileges.
-    
-    Args:
-        username (str): Username to check
-        
-    Returns:
-        bool: True if user is an administrator, False otherwise
-    """
     user = get_user(username)
     return bool(user and user.get('Admin', False))
 
 
 def update_active_ausleihung(username, id_item, ausleihung):
-    """
+    """Update a user's active borrowing record."""
-    Update a user's active borrowing record.
-    
-    Args:
-        username (str): Username of the user
-        id_item (str): ID of the borrowed item
-        ausleihung (str): ID of the borrowing record
-        
-    Returns:
-        bool: True if successful
-    """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    users.update_one({'Username': username}, {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}})
+
+    result = users.update_one(
+        {'Username': dp.encrypt_text(username)},
+        {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}}
+    )
+    if result.matched_count == 0:
+        users.update_one(
+            {'username': dp.encrypt_text(username)},
+            {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}}
+        )
     client.close()
     return True
 
 
 def get_active_ausleihung(username):
-    """
+    """Get a user's active borrowing record."""
-    Get a user's active borrowing record.
-    
-    Args:
-        username (str): Username of the user
-        
-    Returns:
-        dict: Active borrowing information or None
-    """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': username})
+
-    return user['active_ausleihung']
+    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
+    client.close()
+
+    if not user:
+        return None
+    return user.get('active_ausleihung')
 
 
 def has_active_borrowing(username):
-    """
+    """Check if a user currently has an active borrowing."""
-    Check if a user currently has an active borrowing.
-    
-    Args:
-        username (str): Username to check
-        
-    Returns:
-        bool: True if user has an active borrowing, False otherwise
-    """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         users = db['users']
 
-        user = users.find_one({'username': username})
+        user = users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'Username': dp.encrypt_text(username)})
-        if not user:
+        client.close()
-            user = users.find_one({'Username': username})
 
         if not user:
-            client.close()
             return False
 
-        has_active = user.get('active_borrowing', False)
+        return user.get('active_borrowing', False)
-        
-        client.close()
-        return has_active
     except Exception as e:
         return False
 
 
 def delete_user(username):
-    """
+    """Delete a user from the database."""
-    Delete a user from the database.
-    Administrative function for removing user accounts.
-    
-    Args:
-        username (str): Username of the account to delete
-        
-    Returns:
-        bool: True if user was deleted successfully, False otherwise
-    """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    result = users.delete_one({'username': username})
-    client.close()
-    if result.deleted_count == 0:
-        # Try with different field name
-        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = _get_tenant_db(client)
-        users = db['users']
-        result = users.delete_one({'Username': username})
-        client.close()
 
+    result = users.delete_one({'username': dp.encrypt_text(username)})
+    if result.deleted_count == 0:
+        result = users.delete_one({'Username': dp.encrypt_text(username)})
+
+    client.close()
     return result.deleted_count > 0
 
 
 def update_active_borrowing(username, item_id, status):
-    """
+    """Update a user's active borrowing status."""
-    Update a user's active borrowing status.
-    
-    Args:
-        username (str): Username of the user
-        item_id (str): ID of the borrowed item or None if returning
-        status (bool): True if borrowing, False if returning
-        
-    Returns:
-        bool: True if successful, False on error
-    """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         users = db['users']
-        result = users.update_one(
-            {'username': username}, 
-            {'$set': {
-                'active_borrowing': status,
-                'borrowed_item': item_id if status else None
-            }}
-        )
 
+        update_data = {'$set': {'active_borrowing': status, 'borrowed_item': item_id if status else None}}
+
+        result = users.update_one({'username': dp.encrypt_text(username)}, update_data)
         if result.matched_count == 0:
-            result = users.update_one(
+            result = users.update_one({'Username': dp.encrypt_text(username)}, update_data)
-                {'Username': username}, 
-                {'$set': {
-                    'active_borrowing': status,
-                    'borrowed_item': item_id if status else None
-                }}
-            )
 
         client.close()
         return result.modified_count > 0
@@ -840,43 +736,37 @@ def update_active_borrowing(username, item_id, status):
 
 
 def get_name(username):
-    """
+    """Retrieve the name that is associated with the username."""
-    Retrieve the name that is assosiated with the username.
-
-    Returns:
-        str: String of name
-    """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': username})
+
-    name = user.get("name")
+    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
-    return name
+    client.close()
+
+    if not user or not user.get("name"):
+        return ""
+
+    return dp.decrypt_text(user.get("name"))
 
 
 def get_last_name(username):
-    """
+    """Retrieve the last_name that is associated with the username."""
-    Retrieve the last_name that is assosiated with the username.
-
-    Returns:
-        str: String of last_name
-    """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
     users = db['users']
-    user = users.find_one({'Username': username})
+
-    name = user.get("last_name")
+    user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
-    return name
+    client.close()
+
+    if not user or not user.get("last_name"):
+        return ""
+
+    return dp.decrypt_text(user.get("last_name"))
 
 
 def get_all_users():
-    """
+    """Retrieve all users from the database."""
-    Retrieve all users from the database.
-    Administrative function for user management.
-    
-    Returns:
-        list: List of all user documents
-    """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
@@ -887,17 +777,9 @@ def get_all_users():
     except Exception as e:
         return []
 
+
 def update_password(username, new_password):
-    """
+    """Update a user's password with a new one."""
-    Update a user's password with a new one.
-    
-    Args:
-        username (str): Username of the user
-        new_password (str): New password to set
-        
-    Returns:
-        bool: True if password was updated successfully, False otherwise
-    """
     try:
         if not check_password_strength(new_password):
             return False
@@ -906,14 +788,17 @@ def update_password(username, new_password):
         db = _get_tenant_db(client)
         users = db['users']
 
-        # Hash the new password
         hashed_password = hashing(new_password)
 
-        # Update the user's password
         result = users.update_one(
-            {'Username': username}, 
+            {'Username': dp.encrypt_text(username)},
             {'$set': {'Password': hashed_password}}
         )
+        if result.matched_count == 0:
+            result = users.update_one(
+                {'username': dp.encrypt_text(username)},
+                {'$set': {'Password': hashed_password}}
+            )
 
         client.close()
         return result.modified_count > 0
@@ -921,28 +806,26 @@ def update_password(username, new_password):
         print(f"Error updating password: {e}")
         return False
 
+
 def update_user_name(username, name, last_name):
-    """
+    """Update a user's name and last name."""
-    Update a user's name and last name.
-
-    Args:
-        username (str): Username of the user
-        name (str): New first name
-        last_name (str): New last name
-
-    Returns:
-        bool: True if updated successfully, False otherwise
-    """
     try:
-        name_alias = build_name_synonym(name, last_name)
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         users = db['users']
 
+        safe_name = dp.encrypt_text(name.strip()) if name else ''
+        safe_last_name = dp.encrypt_text(last_name.strip()) if last_name else ''
+
         result = users.update_one(
-            {'Username': username}, 
+            {'Username': dp.encrypt_text(username)},
-            {'$set': {'name': name_alias, 'last_name': ''}}
+            {'$set': {'name': safe_name, 'last_name': safe_last_name}}
         )
+        if result.matched_count == 0:
+            result = users.update_one(
+                {'username': dp.encrypt_text(username)},
+                {'$set': {'name': safe_name, 'last_name': safe_last_name}}
+            )
 
         client.close()
         return True

Web/requirements.txt

@@ -18,3 +18,4 @@ pywebpush
 py-vapid>=1.9.0
 beautifulsoup4
 pywebpush
+pandas

Web/templates/admin_damaged_items.html

@@ -7,7 +7,7 @@
   <div style="display:flex; justify-content:space-between; align-items:flex-start; gap:12px; flex-wrap:wrap; margin-bottom:16px;">
     <div>
       <h1 style="margin:0;">Defekte Items</h1>
-      <p style="margin:6px 0 0; color:#64748b;">Eigenes Verwaltungsfenster fuer gemeldete Defekte mit schneller Reparatur-Funktion.</p>
+      <p style="margin:6px 0 0; color:#64748b;">Eigenes Verwaltungsfenster für gemeldete Defekte mit schneller Reparatur-Funktion.</p>
     </div>
     <div style="display:flex; gap:8px; flex-wrap:wrap;">
       <a class="btn btn-outline-secondary" href="{{ url_for('admin_borrowings') }}">Ausleihen</a>
@@ -42,7 +42,13 @@
             {% if item.isbn %}<div style="font-size:0.82rem; color:#64748b;">ISBN: {{ item.isbn }}</div>{% endif %}
           </td>
           <td style="padding:11px; border-bottom:1px solid #eef2f7; vertical-align:top;">
-            <div style="display:inline-block; padding:3px 9px; border-radius:999px; background:#fee2e2; color:#991b1b; font-size:0.75rem; font-weight:700;">Defekt</div>
+
+            <!-- HIER IST DIE ÄNDERUNG: Dynamischer Status-Badge -->
+            <div class="badge bg-{{ item.status_color }} rounded-pill" style="font-size:0.75rem; font-weight:700; padding:4px 10px;">
+              {{ item.status_text }}
+            </div>
+            <!-- ENDE DER ÄNDERUNG -->
+
             <div style="font-size:0.84rem; color:#475569; margin-top:6px;">Meldungen: {{ item.damage_count }}</div>
             <div style="font-size:0.84rem; color:#475569;">Condition: {{ item.condition or '-' }}</div>
             <div style="font-size:0.84rem; color:#475569;">Verfuegbar: {{ 'Ja' if item.available else 'Nein' }}</div>
@@ -66,7 +72,12 @@
             {% endif %}
           </td>
           <td style="padding:11px; border-bottom:1px solid #eef2f7; vertical-align:top;">
+            <!-- Button wird ausgeblendet, falls das Item bereits repariert ist -->
+            {% if item.condition not in ['repaired', 'fixed'] %}
             <button class="btn btn-success btn-sm" onclick="repairDamage('{{ item.id }}', this)">Als repariert markieren</button>
+            {% else %}
+            <span class="text-success" style="font-size: 0.85rem;"><i class="bi bi-check-circle"></i> Repariert</span>
+            {% endif %}
           </td>
         </tr>
         {% endfor %}

Web/templates/main_admin.html

@@ -4570,11 +4570,6 @@ document.addEventListener('DOMContentLoaded', ()=>{
                     <div class="detail-value">${escapeHtml(item.Code_4 || '-')}</div>
                 </div>
 
-                <div class="detail-group">
-                    <div class="detail-label">Anzahl:</div>
-                    <div class="detail-value">${escapeHtml(String(item.GroupedDisplayCount || 1))}</div>
-                </div>
-            
                 ${isGroupedItem ? `
                 <div class="detail-group">
                     <div class="detail-label">Verfügbar:</div>

Web/templates/upload_batch.html

@@ -0,0 +1,217 @@
+<!DOCTYPE html>
+<html lang="de">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Batch Upload - CSV & Bilder</title>
+    <style>
+        :root {
+            --primary-color: #4a90e2;
+            --background-color: #f4f7f6;
+            --text-color: #333;
+            --border-radius: 8px;
+        }
+
+        body {
+            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
+            background-color: var(--background-color);
+            color: var(--text-color);
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            min-height: 100vh;
+            margin: 0;
+        }
+
+        .upload-container {
+            background: white;
+            padding: 2rem;
+            border-radius: var(--border-radius);
+            box-shadow: 0 4px 6px rgba(0,0,0,0.1);
+            width: 100%;
+            max-width: 500px;
+        }
+
+        h2 {
+            margin-top: 0;
+            color: var(--primary-color);
+            text-align: center;
+        }
+
+        .form-group {
+            margin-bottom: 1.5rem;
+        }
+
+        label {
+            display: block;
+            font-weight: 600;
+            margin-bottom: 0.5rem;
+        }
+
+        input[type="file"] {
+            display: block;
+            width: 100%;
+            padding: 0.5rem;
+            border: 1px dashed #ccc;
+            border-radius: var(--border-radius);
+            background: #fafafa;
+            cursor: pointer;
+        }
+
+        .btn-submit {
+            width: 100%;
+            padding: 0.75rem;
+            background-color: var(--primary-color);
+            color: white;
+            border: none;
+            border-radius: var(--border-radius);
+            font-size: 1rem;
+            font-weight: 600;
+            cursor: pointer;
+            transition: background-color 0.3s ease;
+        }
+
+        .btn-submit:hover {
+            background-color: #357abd;
+        }
+
+        .btn-submit:disabled {
+            background-color: #a0c4e8;
+            cursor: not-allowed;
+        }
+
+        /* Status & Feedback Messages */
+        #status-message {
+            margin-top: 1rem;
+            padding: 1rem;
+            border-radius: var(--border-radius);
+            display: none;
+            text-align: center;
+        }
+
+        .success {
+            background-color: #d4edda;
+            color: #155724;
+            border: 1px solid #c3e6cb;
+        }
+
+        .error {
+            background-color: #f8d7da;
+            color: #721c24;
+            border: 1px solid #f5c6cb;
+        }
+
+        .loading {
+            background-color: #e2e3e5;
+            color: #383d41;
+            border: 1px solid #d6d8db;
+        }
+
+        .spinner {
+            display: inline-block;
+            width: 1.5rem;
+            height: 1.5rem;
+            border: 3px solid rgba(0,0,0,0.1);
+            border-radius: 50%;
+            border-top-color: var(--primary-color);
+            animation: spin 1s ease-in-out infinite;
+            vertical-align: middle;
+            margin-right: 0.5rem;
+        }
+
+        @keyframes spin {
+            to { transform: rotate(360deg); }
+        }
+    </style>
+</head>
+<body>
+
+    <div class="upload-container">
+        <h2>Inventar Batch Upload</h2>
+
+        <form id="uploadForm">
+            <div class="form-group">
+                <label for="csv_file">1. items.csv Datei auswählen</label>
+                <!-- Akzeptiert nur CSV Dateien -->
+                <input type="file" id="csv_file" name="csv_file" accept=".csv" required>
+            </div>
+
+            <div class="form-group">
+                <label for="images">2. Bilder auswählen</label>
+                <!-- multiple erlaubt das Auswählen mehrerer Bilder gleichzeitig -->
+                <input type="file" id="images" name="images" accept="image/*" multiple required>
+                <small style="color: #666; display: block; margin-top: 5px;">Du kannst mehrere Bilder markieren (Strg/Cmd gedrückt halten).</small>
+            </div>
+
+            <button type="submit" id="submitBtn" class="btn-submit">Daten hochladen</button>
+        </form>
+
+        <div id="status-message"></div>
+    </div>
+
+<script>
+        document.getElementById('uploadForm').addEventListener('submit', async function(e) {
+            e.preventDefault();
+
+            const form = e.target;
+            const submitBtn = document.getElementById('submitBtn');
+            const statusDiv = document.getElementById('status-message');
+
+            submitBtn.disabled = true;
+            submitBtn.innerText = 'Wird verarbeitet...';
+            statusDiv.className = 'loading';
+            statusDiv.style.display = 'block';
+            statusDiv.innerHTML = '<div class="spinner"></div> Lade Dateien hoch und verarbeite Bilder... Bitte warten.';
+
+            const formData = new FormData(form);
+
+            const fetchOptions = {
+                method: 'POST',
+                body: formData,
+                credentials: 'include',
+                headers: {
+                    'X-Requested-With': 'XMLHttpRequest'
+                }
+            };
+
+            const csrfToken = document.querySelector('meta[name="csrf-token"]')?.getAttribute('content');
+
+            if (csrfToken) {
+                fetchOptions.headers = {
+                    'X-CSRFToken': csrfToken
+                };
+            }
+
+            try {
+                const response = await fetch('/upload_csv_batch', fetchOptions);
+
+                // Antwort einmalig als Text auslesen, um sowohl JSON als auch HTML-Fehler abzufangen
+                const responseText = await response.text();
+
+                let result;
+                try {
+                    result = JSON.parse(responseText);
+                } catch (jsonError) {
+                    console.error("Server hat kein JSON gesendet. Antwort war:", responseText);
+                    throw new Error("Der Server hat einen HTML-Fehler zurückgegeben (z.B. Nginx 413 Entity Too Large oder Server-Crash). Siehe F12 Konsole.");
+                }
+
+                if (response.ok && result.success) {
+                    statusDiv.className = 'success';
+                    statusDiv.innerHTML = `<strong>Erfolg!</strong><br>${result.message}`;
+                    form.reset();
+                } else {
+                    statusDiv.className = 'error';
+                    statusDiv.innerHTML = `<strong>Fehler:</strong> ${result.message || 'Ein unbekannter Fehler ist aufgetreten.'}`;
+                }
+
+            } catch (error) {
+                statusDiv.className = 'error';
+                statusDiv.innerHTML = `<strong>Fehler:</strong> ${error.message}`;
+                console.error('Upload Error:', error);
+            } finally {
+                submitBtn.disabled = false;
+                submitBtn.innerText = 'Daten hochladen';
+            }
+        });
+    </script>

manage-tenant.sh

@@ -200,6 +200,7 @@ sys.path.insert(0, "/app")
 sys.path.insert(0, "/app/Web")
 from Web.modules.database import settings
 from pymongo import MongoClient
+import Web.modules.inventarsystem.data_protection as dp
 
 tenant_id = sys.argv[1].lower()
 mode = sys.argv[2]
@@ -244,14 +245,14 @@ page_permissions = {
     "manage_locations": True,
 }
 
-if db.users.count_documents({"Username": "admin"}) == 0:
+if db.users.count_documents({"Username": dp.encrypt_text("admin")}) == 0:
     db.users.insert_one({
-        "Username": "admin",
+        "Username":  dp.encrypt_text("admin"),
         "Password": hashed_pw_string,
         "Admin": True,
         "active_ausleihung": None,
-        "name": "Admin",
+        "name": dp.encrypt_text("Admin"),
-        "last_name": "User",
+        "last_name": dp.encrypt_text("User"),
         "IsStudent": False,
         "PermissionPreset": "full_access",
         "ActionPermissions": action_permissions,

requirements.txt

@@ -18,3 +18,4 @@ pywebpush
 py-vapid>=1.9.0
 beautifulsoup4
 pywebpush
+pandas