Changes to the admin_damaged_items

Web/app.py

@@ -10248,74 +10248,58 @@ def get_period_times(booking_date, period_num):
 
 """---------------------------------------------------------Borrowing-----------------------------------------------------------------"""
 
+
 @app.route('/my_borrowed_items')
 def my_borrowed_items():
     """
     Zeigt alle vom aktuellen Benutzer ausgeliehenen und geplanten Objekte an.
-    
-    Returns:
-        Response: Gerendertes Template mit den ausgeliehenen und geplanten Objekten des Benutzers
     """
     if 'username' not in session:
         flash('Bitte melden Sie sich an, um Ihre ausgeliehenen Objekte anzuzeigen', 'error')
         return redirect(url_for('login', next=request.path))
-    
+
     username = session['username']
+
     client = MongoClient(MONGODB_HOST, MONGODB_PORT)
     db = client[MONGODB_DB]
-    items_collection = db.items
-    ausleihungen_collection = db.ausleihungen
-    
-    # Get current time for comparison
-    current_time = datetime.datetime.now()
-    
-    # Check if user is admin
-    user_is_admin = False
-    if 'is_admin' in session:
-        user_is_admin = session['is_admin']
-    
-    # Get items currently borrowed by the user (where Verfuegbar=false and User=username)
-    borrowed_items = list(items_collection.find({'Verfuegbar': False, 'User': username}))
-    
-    # Get active and planned ausleihungen for the user
-    active_ausleihungen = list(ausleihungen_collection.find({
-        'User': username,
-        'Status': 'active'
+    items_collection = db['items']
+    ausleihungen_collection = db['ausleihungen']
+
+    all_ausleihungen = list(ausleihungen_collection.find({
+        'Status': {'$in': ['active', 'planned']}
     }))
-    
-    planned_ausleihungen = list(ausleihungen_collection.find({
-        'User': username,
-        'Status': 'planned'
-    }))
-    
-    # Process items
+
     active_items = []
     planned_items = []
-    processed_item_ids = set()  # Keep track of processed item IDs to avoid duplicates
-    
-    # First, process items that are directly marked as borrowed by the user
-    for item in borrowed_items:
-        # Convert ObjectId to string for template
-        item['_id'] = str(item['_id'])
-        active_items.append(item)
-        processed_item_ids.add(item['_id'])
-    
-    # Process active appointments
-    for appointment in active_ausleihungen:
-        # Get the item ID from the appointment
+    processed_item_ids = set()
+
+    for appointment in all_ausleihungen:
+        raw_user = appointment.get('User', '')
+        try:
+            decrypted_user = decrypt_text(raw_user) if raw_user else ''
+        except Exception as e:
+            app.logger.error(f"Entschlüsselungsfehler: {e}")
+            decrypted_user = ''
+
+        if decrypted_user != username:
+            continue
+
         item_id = appointment.get('Item')
-        
-        if not item_id or str(item_id) in processed_item_ids:
-            continue  # Skip if we already processed this item or no item ID
-        
-        # Get item details
-        item_obj = items_collection.find_one({'_id': ObjectId(item_id)})
-        
+        if not item_id:
+            continue
+
+        try:
+            if isinstance(item_id, str):
+                query_id = ObjectId(item_id)
+            else:
+                query_id = item_id
+            item_obj = items_collection.find_one({'_id': query_id})
+        except Exception:
+            item_obj = None
+
         if item_obj:
-            # Convert ObjectId to string for template
             item_obj['_id'] = str(item_obj['_id'])
-            
-            # Add appointment data
+
             item_obj['AppointmentData'] = {
                 'id': str(appointment['_id']),
                 'start': appointment.get('Start'),
@@ -10324,55 +10308,43 @@ def my_borrowed_items():
                 'period': appointment.get('Period'),
                 'status': appointment.get('VerifiedStatus', appointment.get('Status')),
             }
-            
-            # Mark that this item is part of an active appointment
-            item_obj['ActiveAppointment'] = True
-            
-            # Add to the list only if not already there
-            if str(item_obj['_id']) not in processed_item_ids:
-                active_items.append(item_obj)
-                processed_item_ids.add(str(item_obj['_id']))
-    
-    # Process planned appointments
-    for appointment in planned_ausleihungen:
-        item_id = appointment.get('Item')
-        
-        if not item_id:
-            continue
-        
-        item_obj = items_collection.find_one({'_id': ObjectId(item_id)})
-        
-        if item_obj:
-            item_obj['_id'] = str(item_obj['_id'])
-            
-            # Add appointment data
-            item_obj['AppointmentData'] = {
-                'id': str(appointment['_id']),
-                'start': appointment.get('Start'),
-                'end': appointment.get('End'),
-                'notes': appointment.get('Notes'),
-                'period': appointment.get('Period'),
-                'status': appointment.get('Status'),
-            }
-            
-            planned_items.append(item_obj)
-    
+
+            status = appointment.get('Status')
+            if status == 'active':
+                item_obj['ActiveAppointment'] = True
+                if str(item_obj['_id']) not in processed_item_ids:
+                    active_items.append(item_obj)
+                    processed_item_ids.add(str(item_obj['_id']))
+            elif status == 'planned':
+                planned_items.append(item_obj)
+
+    all_borrowed_items = list(items_collection.find({'Verfuegbar': False}))
+    for item in all_borrowed_items:
+        raw_item_user = item.get('User', '')
+        try:
+            dec_item_user = decrypt_text(raw_item_user) if raw_item_user else ''
+        except Exception:
+            dec_item_user = ''
+
+        if dec_item_user == username and str(item['_id']) not in processed_item_ids:
+            item['_id'] = str(item['_id'])
+            item['ActiveAppointment'] = True
+            item['AppointmentData'] = {'status': 'active (no document)'}
+            active_items.append(item)
+            processed_item_ids.add(item['_id'])
+
     client.close()
-    
-    # DEBUG: Log what we're passing to the template
-    app.logger.info(f"Passing {len(active_items)} active items and {len(planned_items)} planned items to template")
-    if planned_items:
-        for i, item in enumerate(planned_items):
-            app.logger.info(f"Planned item {i+1}: {item['Name']}, Appointment ID: {item['AppointmentData']['id']}")
-    
+
+    # DEBUG Logging
+    app.logger.info(
+        f"Passing {len(active_items)} active items and {len(planned_items)} planned items to template for user {username}")
+
     return render_template(
         'my_borrowed_items.html',
         items=active_items,
-        planned_items=planned_items,
-        user_is_admin=user_is_admin
+        planned_items=planned_items
     )
 
-
 @app.route('/api/push/vapid-key', methods=['GET'])
 def get_vapid_key():
     """
@@ -10612,15 +10584,24 @@ def notifications_unread_status():
             client.close()
 
 
-@app.route('/admin/damaged_items') 
+@app.route('/admin/damaged_items')
 def admin_damaged_items():
-    """Admin-Übersicht aller aktiven und vergangenen Ausleihen."""
+    """Admin-Übersicht aller Ausleihen von beschädigten Objekten."""
     if 'username' not in session:
-        flash('Administratorrechte erforderlich.', 'error')
+        flash('Anmeldung erforderlich.', 'error')
         return redirect(url_for('login'))
 
+    # SICHERHEIT: Berechtigungsprüfung (wie in admin_borrowings)
+    # Entferne die Kommentare, falls du `us` in dieser Datei importiert hast
+    """
+    current_permissions = us.get_effective_permissions(session['username'])
+    if not current_permissions['pages'].get('admin_damaged_items', False):
+        flash('Ihnen fehlen die nötigen Berechtigungen, um diese Aktion auszuführen.', 'error')
+        return redirect(url_for('home_admin'))
+    """
+
+    # Import sicherstellen
     from modules.inventarsystem.data_protection import decrypt_text
-    from bson.objectid import ObjectId
 
     client = None
     try:
@@ -10629,36 +10610,53 @@ def admin_damaged_items():
         ausleihungen_col = db['ausleihungen']
         items_col = db['items']
 
-        ausleihungen = list(ausleihungen_col.find().sort('Start', -1))
+        alle_ausleihungen = list(ausleihungen_col.find().sort('Start', -1))
 
-        for record in ausleihungen:
-            raw_user = record.get('User', '')
-            if raw_user:
-                record['User'] = decrypt_text(raw_user)
+        beschädigte_ausleihungen = []
 
+        for record in alle_ausleihungen:
             item_id = record.get('Item')
-            if item_id:
-                try:
-                    item_doc = items_col.find_one({'_id': ObjectId(item_id)})
-                    if item_doc:
+            if not item_id:
+                continue
+
+            try:
+                if isinstance(item_id, str):
+                    query_id = ObjectId(item_id)
+                else:
+                    query_id = item_id
+
+                item_doc = items_col.find_one({'_id': query_id})
+
+                if item_doc:
+                    condition_value = str(item_doc.get('Condition', '')).strip().lower()
+                    has_damage = bool(item_doc.get('HasDamage')) or condition_value == 'destroyed' or bool(
+                        item_doc.get('DamageReports'))
+
+                    if has_damage:
+                        raw_user = record.get('User', '')
+                        if raw_user:
+                            record['User'] = decrypt_text(raw_user)
+
                         if item_doc.get('User'):
                             item_doc['User'] = decrypt_text(item_doc['User'])
-                        
+
                         record['ItemDetails'] = item_doc
-                except Exception as e:
-                    app.logger.warning(f"Konnte Item {item_id} für Ausleihe {record.get('_id')} nicht laden: {e}")
+                        beschädigte_ausleihungen.append(record)
+
+            except Exception as e:
+                app.logger.warning(f"Konnte Item {item_id} für Ausleihe {record.get('_id')} nicht laden: {e}")
 
         return render_template(
-            'admin_damaged_items.html',  
-            ausleihungen=ausleihungen,
+            'admin_damaged_items.html',
+            ausleihungen=beschädigte_ausleihungen,
             library_module_enabled=cfg.MODULES.is_enabled('library'),
             student_cards_module_enabled=cfg.MODULES.is_enabled('student_cards'),
             mail_module_enabled=cfg.MODULES.is_enabled('mail')
         )
 
     except Exception as exc:
-        app.logger.error(f"Fehler beim Laden der Ausleihen-Verwaltung: {exc}")
-        flash('Fehler beim Laden der Ausleihen-Übersicht.', 'error')
+        app.logger.error(f"Fehler beim Laden der beschädigten Objekte: {exc}")
+        flash('Fehler beim Laden der Übersicht.', 'error')
         return redirect(url_for('home_admin'))
     finally:
         if client:

Web/modules/database/user.py

@@ -481,7 +481,8 @@ def check_nm_pwd(username, password):
             if user_record_fallback is None:
                 logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
                 return None
-
+            else:
+                user_record = user_record_fallback
 
         stored_password = user_record.get('Password') or user_record.get('password')
 
@@ -621,7 +622,7 @@ def get_user(username):
         def find_in_db(database_name):
             db = client[database_name]
             users = db['users']
-            return users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)})
+            return users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'username': username}) or users.find_one({'Username': username})
 
         tenant_db, tenant_id = _resolve_request_tenant_db()
         if tenant_db: