changes to the manage-tenant.sh

Web/app.py

@@ -18,7 +18,6 @@ Features:
 """
 
 from flask import Flask, render_template, request, redirect, url_for, session, flash, send_from_directory, get_flashed_messages, jsonify, Response, make_response, send_file, abort
-from flask_wtf import csrf
 from werkzeug.utils import secure_filename
 from werkzeug.middleware.proxy_fix import ProxyFix
 from werkzeug.exceptions import HTTPException
@@ -11863,10 +11862,40 @@ def batch_upload_page():
 
     return render_template('upload_batch.html')
 
+def clean_db_field(val):
+    """Bereinigt Werte, die fälschlicherweise als String-Listen oder mit Klammern aus der CSV kommen."""
+    import ast
+    import pandas as pd
+
+    if not val or pd.isna(val):
+        return None
+
+    val_str = str(val).strip()
+
+    # Wenn es wie eine Liste aussieht (z.B. "['100177']" oder "['']")
+    if val_str.startswith("[") and val_str.endswith("]"):
+        try:
+            parsed = ast.literal_eval(val_str)
+            if isinstance(parsed, list):
+                # Nimm das erste Element der Liste, wenn vorhanden
+                for item in parsed:
+                    cleaned_item = str(item).strip()
+                    if cleaned_item and cleaned_item not in ("", "''", '""', "None", "nan"):
+                        return cleaned_item
+                return None
+        except Exception:
+            # Fallback bei Syntaxfehlern
+            inner = val_str[1:-1].strip().replace("'", "").replace('"', '')
+            return inner if inner and inner not in ("''", '""') else None
+
+    if val_str in ("[]", "['']", '[""]', "nan", "None", "''", '""'):
+        return None
+
+    return val_str
+
 
 
 @app.route('/upload_csv_batch', methods=['POST'])
-@csrf.exempt
 def upload_csv_batch():
     """
     Route for batch adding new items to the inventory via CSV.
@@ -11880,13 +11909,6 @@ def upload_csv_batch():
     username = session.get('username', 'System')
 
     def generate_unique_batch_code(base_code, position):
-        """
-        Generiert einen eindeutigen Code für einen Artikel innerhalb einer Serie (Batch).
-
-        :param base_code: Der Code des ersten Artikels in der Gruppe (String oder None).
-        :param position: Die Position des aktuellen Artikels in der Gruppe (Integer).
-        :return: Ein eindeutiger Code als String.
-        """
         if base_code:
             return f"{base_code}-{position}"
         else:
@@ -11906,7 +11928,7 @@ def upload_csv_batch():
 
     # 2. CSV Einlesen und Validieren
     try:
-        df = pd.read_csv(csv_file, sep=';')
+        df = pd.read_csv(csv_file, sep=',')
     except Exception as e:
         app.logger.error(f"[Upload {upload_session_id}] Fehler beim Lesen der CSV: {str(e)}")
         return jsonify({"success": False, "message": f"Fehler beim Lesen der CSV: {str(e)}"}), 400
@@ -11915,8 +11937,8 @@ def upload_csv_batch():
         return jsonify({"success": False, "message": "Die CSV muss zwingend eine 'Name' Spalte enthalten."}), 400
 
     # 3. Bilder verarbeiten & Duplikate im selben Durchlauf filtern (Hash-Matching)
-    image_mapping = {}      # Original-Dateiname (ohne Ext) -> GridFS Filename (.webp)
+    image_mapping = {}
-    processed_hashes = {}   # SHA-256 Hash -> GridFS Filename (.webp)
+    processed_hashes = {}
     processed_count = 0
     dedup_count = 0
     error_count = 0
@@ -11936,18 +11958,14 @@ def upload_csv_batch():
                 error_count += 1
                 continue
 
-            # SHA-256 Hash des Bildinhalts zur Erkennung identischer Bilder
             img_hash = hashlib.sha256(image_bytes).hexdigest()
 
             if img_hash in processed_hashes:
-                # Bild ist identisch zu einem bereits verarbeiteten Bild im selben Batch
                 existing_filename = processed_hashes[img_hash]
                 image_mapping[base_name_no_ext] = existing_filename
                 dedup_count += 1
-                app.logger.info(f"{image_log_prefix} Duplikat erkannt ({original_secure_name}). Wiederverwendung von: {existing_filename}")
                 continue
 
-            # Neues Bild verarbeiten und nach WebP konvertieren
             optimized_io = io.BytesIO()
             with Image.open(io.BytesIO(image_bytes)) as img:
                 if img.mode not in ('RGB', 'RGBA'):
@@ -11964,8 +11982,7 @@ def upload_csv_batch():
             optimized_io.seek(0)
             new_filename = f"{uuid.uuid4().hex}_{int(time.time())}.webp"
 
-            # In GridFS speichern
+            fs.put(
-            file_id = fs.put(
                 optimized_io,
                 filename=new_filename,
                 content_type='image/webp',
@@ -11976,7 +11993,6 @@ def upload_csv_batch():
                 }
             )
 
-            # In Hash-Tabelle und Mapping sichern
             processed_hashes[img_hash] = new_filename
             image_mapping[base_name_no_ext] = new_filename
             processed_count += 1
@@ -11991,8 +12007,8 @@ def upload_csv_batch():
     except Exception:
         predefined_locations = []
 
-    # 5. Dataframe bereinigen & gruppieren
+    # 5. Dataframe bereinigen
-    df['Name'] = df['Name'].fillna('Unbenannt').astype(str)
+    df['Name'] = df['Name'].fillna('Unbenannt').astype(str).str.strip()
     df = df.fillna({
         'Ort': 'Unbekannt',
         'Beschreibung': '',
@@ -12001,21 +12017,28 @@ def upload_csv_batch():
         'Anschaffungskosten': ''
     })
 
-    created_item_ids = []
+    # --- WICHTIG: Gruppierung über einen normalisierten Schlüssel ermöglichen ---
-    grouped_items = df.groupby('Name')
+    # Erstellt eine unsichtbare Hilfsspalte, die Leerzeichen/Groß-Kleinschreibung ignoriert,
+    # damit identische Artikel-Typen sauber als Serie erkannt werden.
+    df['GroupKey'] = df['Name'].str.lower()
 
-    for name, group in grouped_items:
+    created_item_ids = []
+    grouped_items = df.groupby('GroupKey')
+
+    for group_key, group in grouped_items:
         item_count = len(group)
         series_group_id = str(uuid.uuid4()) if item_count > 1 else None
         parent_item_id = None
 
+        # Originalen Namen des ersten Elements der Gruppe übernehmen
+        actual_group_name = group.iloc[0]['Name']
+
         # Basis-Code für automatisierte Seriencodes ermitteln
-        first_row_code = str(group.iloc[0].get('Code_4', '')).strip()
+        first_row_code = clean_db_field(group.iloc[0].get('Code_4', ''))
         base_code = first_row_code if first_row_code else None
 
         for position, (index, row) in enumerate(group.iterrows(), start=1):
 
-            # Ort automatisch zu predefined_locations hinzufügen, falls neu
             ort_val = str(row['Ort']).strip()
             if ort_val and ort_val not in predefined_locations:
                 try:
@@ -12024,7 +12047,7 @@ def upload_csv_batch():
                 except Exception as e:
                     app.logger.warning(f"Ort {ort_val} konnte nicht hinzugefügt werden: {e}")
 
-            # Bilder für diesen Artikel zuordnen
+            # Bilder zuordnen und pro Artikel deduplizieren
             item_image_filenames = []
             if 'Images' in row and pd.notna(row['Images']):
                 try:
@@ -12034,19 +12057,13 @@ def upload_csv_batch():
                             base_img_name = os.path.splitext(img_name)[0]
                             if base_img_name in image_mapping:
                                 item_image_filenames.append(image_mapping[base_img_name])
-                            else:
-                                app.logger.warning(f"Bild {img_name} in CSV definiert, aber nicht hochgeladen.")
                 except (ValueError, SyntaxError):
                     pass
 
-            # --- NEU: BILDER-REFERENZEN PRO ARTIKEL DEDUPLIZIEREN ---
-            # Falls die CSV z.B. ['bild1.jpg', 'bild1.jpg'] enthält, filtern wir das hier heraus,
-            # damit die GridFS-Datei nicht doppelt als Referenz gespeichert wird.
             unique_image_filenames = []
             for img in item_image_filenames:
                 if img not in unique_image_filenames:
                     unique_image_filenames.append(img)
-            # --------------------------------------------------------
 
             def parse_filter_col(col_data):
                 try:
@@ -12061,26 +12078,28 @@ def upload_csv_batch():
 
             reservierbar = bool(row.get('Reservierbar', False))
 
-            # Code_4 Behandlung: Falls in CSV definiert nutzen, sonst Batch-Code erzeugen
+            # Code_4 / Barcode sauber extrahieren und bereinigen
-            row_code = str(row.get('Code_4', '')).strip()
+            raw_code = row.get('Code_4') or row.get('Barcode') or ''
+            row_code = clean_db_field(raw_code)
+
             if row_code:
                 unique_code = row_code
-            elif 'generate_unique_batch_code' in globals():
+            elif item_count > 1:
                 unique_code = generate_unique_batch_code(base_code, position)
             else:
                 unique_code = None
 
-            # DB Insert (exakt abgestimmt auf die 10 positionellen Argumente)
+            # DB Insert
             item_id = it.add_item(
-                str(row['Name']),                             # 1. Name
+                str(actual_group_name),                       # 1. Name
                 ort_val,                                      # 2. Ort
                 str(row['Beschreibung']),                     # 3. Beschreibung
-                unique_image_filenames,                       # 4. Image Filenames (GridFS) -> HIER GEÄNDERT
+                unique_image_filenames,                       # 4. Image Filenames (GridFS)
                 filter_upload,                                # 5. Filter 1
                 filter_upload2,                               # 6. Filter 2
                 filter_upload3,                               # 7. Filter 3
-                str(row['Anschaffungsjahr']) if row['Anschaffungsjahr'] else None,   # 8. Jahr
+                clean_db_field(row.get('Anschaffungsjahr')),  # 8. Jahr
-                str(row['Anschaffungskosten']) if row['Anschaffungskosten'] else None, # 9. Kosten
+                clean_db_field(row.get('Anschaffungskosten')),# 9. Kosten
                 unique_code,                                  # 10. Unique Code / Code_4
                 reservierbar=reservierbar,
                 series_group_id=series_group_id,
@@ -12099,16 +12118,11 @@ def upload_csv_batch():
                 if position == 1:
                     parent_item_id = str(item_id)
             else:
-                app.logger.error(f"Fehler beim Erstellen von Item: {row['Name']} (Index {index})")
+                app.logger.error(f"Fehler beim Erstellen von Item: {actual_group_name} (Index {index})")
-
-    app.logger.info(
-        f"Batch Upload abgeschlossen: {len(created_item_ids)} Items erstellt. "
-        f"{processed_count} neue Bilder hochgeladen, {dedup_count} Bild-Duplikate zusammengeführt."
-    )
 
     return jsonify({
         "success": True,
-        "message": f"Upload erfolgreich. {len(created_item_ids)} Items importiert. {processed_count} neue Bilder gespeichert ({dedup_count} Duplikate zusammengeführt).",
+        "message": f"Upload erfolgreich. {len(created_item_ids)} Items importiert.",
         "created_count": len(created_item_ids),
         "images_processed": processed_count,
         "images_deduplicated": dedup_count,

Web/modules/database/user.py

@@ -54,10 +54,34 @@ def _clean_name_fragment(value):
     return cleaned
 
 
-def _get_tenant_db(client):
+def _get_tenant_db(client, tenant_id=None):
     """Return the current tenant database for the request, or fall back to default."""
     try:
         from tenant import get_tenant_db
+        if tenant_id is None:
+            return get_tenant_db(client)
+
+        tenant_id = str(tenant_id).strip()
+        if tenant_id:
+            try:
+                from tenant import get_tenant_config
+
+                config = get_tenant_config(tenant_id)
+                if isinstance(config, dict):
+                    explicit_db = config.get('db') or config.get('db_name')
+                    if explicit_db:
+                        db_name = str(explicit_db).strip()
+                        if db_name and not db_name.startswith('inventar_'):
+                            db_name = f'inventar_{db_name}'
+                        if db_name:
+                            return client[db_name]
+            except Exception:
+                pass
+
+            sanitized = ''.join(c for c in tenant_id.lower() if c.isalnum() or c == '_')
+            if sanitized:
+                return client[f'inventar_{sanitized}']
+
         return get_tenant_db(client)
     except Exception:
         return client[cfg.MONGODB_DB]
@@ -479,8 +503,45 @@ def check_nm_pwd(username, password):
             query = {'$or': [{'Username': username}, {'username': username}]}
             user_record_fallback = users.find_one(query)
             if user_record_fallback is None:
-                logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
+                if db_name != cfg.MONGODB_DB:
-                return None
+                    default_users = client[cfg.MONGODB_DB]['users']
+                    user_record_fallback = default_users.find_one(
+                        {'$or': [
+                            {'Username': dp.encrypt_text(username)},
+                            {'username': dp.encrypt_text(username)},
+                            {'Username': username},
+                            {'username': username},
+                        ]}
+                    )
+                    if user_record_fallback is not None:
+                        migrated_record = dict(user_record_fallback)
+                        migrated_record.pop('_id', None)
+                        users.replace_one(
+                            {'$or': [
+                                {'Username': migrated_record.get('Username')},
+                                {'username': migrated_record.get('username')},
+                            ]},
+                            migrated_record,
+                            upsert=True,
+                        )
+                        logger.warning(
+                            "Tenant user %r migrated from default DB %r to tenant DB %r.",
+                            dp.encrypt_text(username),
+                            cfg.MONGODB_DB,
+                            db_name,
+                        )
+                        user_record = users.find_one(
+                            {'$or': [
+                                {'Username': migrated_record.get('Username')},
+                                {'username': migrated_record.get('username')},
+                            ]}
+                        ) or migrated_record
+                    else:
+                        logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
+                        return None
+                else:
+                    logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
+                    return None
             else:
                 user_record = user_record_fallback
 
@@ -497,6 +558,59 @@ def check_nm_pwd(username, password):
     finally:
         client.close()
 
+def add_admin(
+    username,
+    password,
+    name='',
+    last_name='',
+    is_student=False,
+    permission_preset='full_access',
+    action_permissions=None,
+    page_permissions=None,
+    tenant_id=None,
+):
+    """
+    Add a new user to the database.
+    """
+    if not check_password_strength(password):
+        return False
+
+    client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+    try:
+        db = _get_tenant_db(client, tenant_id)
+        users = db['users']
+
+        permission_defaults = build_default_permission_payload(permission_preset)
+
+        if isinstance(action_permissions, dict):
+            for key, value in action_permissions.items():
+                permission_defaults['actions'][str(key)] = bool(value)
+
+        if isinstance(page_permissions, dict):
+            for key, value in page_permissions.items():
+                permission_defaults['pages'][str(key)] = bool(value)
+
+        safe_name = name.strip() if name else ''
+        safe_last_name = last_name.strip() if last_name else ''
+
+        user_doc = {
+            'Username': username,
+            'Password': hashing(password),
+            'Admin': True,
+            'active_ausleihung': None,
+            'name': dp.encrypt_text(safe_name) if safe_name else '',
+            'last_name': dp.encrypt_text(safe_last_name) if safe_last_name else '',
+            'IsStudent': bool(is_student),
+            'PermissionPreset': permission_defaults['preset'],
+            'ActionPermissions': permission_defaults['actions'],
+            'PagePermissions': permission_defaults['pages'],
+        }
+
+        users.insert_one(user_doc)
+        return True
+    finally:
+        client.close()
+
 
 def add_user(
     username,
@@ -509,6 +623,7 @@ def add_user(
     permission_preset='standard_user',
     action_permissions=None,
     page_permissions=None,
+    tenant_id=None,
 ):
     """
     Add a new user to the database.
@@ -518,7 +633,7 @@ def add_user(
 
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     try:
-        db = _get_tenant_db(client)
+        db = _get_tenant_db(client, tenant_id)
         users = db['users']
 
         permission_defaults = build_default_permission_payload(permission_preset)

Web/templates/upload_batch.html

@@ -3,163 +3,119 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Batch Upload - CSV & Bilder</title>
+    <title>Batch Upload</title>
+
+    <!-- CSRF-Token für JavaScript bereitstellen -->
+    <meta name="csrf-token" content="{{ session.get('_csrf_token', '') }}">
+
     <style>
-        :root {
+        body { font-family: sans-serif; padding: 20px; background: #f4f7f6; }
-            --primary-color: #4a90e2;
+        .upload-container { background: white; padding: 20px; border-radius: 8px; max-width: 500px; margin: 0 auto; }
-            --background-color: #f4f7f6;
+        .form-group { margin-bottom: 15px; }
-            --text-color: #333;
+        label { display: block; font-weight: bold; margin-bottom: 5px; }
-            --border-radius: 8px;
+        input[type="file"] { width: 100%; padding: 8px; box-sizing: border-box; }
-        }
+        .btn-submit { width: 100%; padding: 10px; background: #4a90e2; color: white; border: none; border-radius: 4px; font-weight: bold; cursor: pointer; }
-
+        .btn-submit:disabled { background: #ccc; }
-        body {
+        #uploadProgress { margin-top: 20px; display: none; }
-            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
+        progress { width: 100%; height: 20px; }
-            background-color: var(--background-color);
+        #logList { background: #fafafa; border: 1px solid #eee; padding: 10px; max-height: 150px; overflow-y: auto; font-size: 0.85em; list-style: none; }
-            color: var(--text-color);
-            display: flex;
-            justify-content: center;
-            align-items: center;
-            min-height: 100vh;
-            margin: 0;
-            padding: 20px;
-            box-sizing: border-box;
-        }
-
-        .upload-container {
-            background: white;
-            padding: 2rem;
-            border-radius: var(--border-radius);
-            box-shadow: 0 4px 6px rgba(0,0,0,0.1);
-            width: 100%;
-            max-width: 500px;
-        }
-
-        h2 {
-            margin-top: 0;
-            color: var(--primary-color);
-            text-align: center;
-        }
-
-        .form-group {
-            margin-bottom: 1.5rem;
-        }
-
-        label {
-            display: block;
-            font-weight: 600;
-            margin-bottom: 0.5rem;
-        }
-
-        input[type="file"] {
-            display: block;
-            width: 100%;
-            padding: 0.5rem;
-            border: 1px dashed #ccc;
-            border-radius: var(--border-radius);
-            background: #fafafa;
-            cursor: pointer;
-            box-sizing: border-box;
-        }
-
-        .btn-submit {
-            width: 100%;
-            padding: 0.75rem;
-            background-color: var(--primary-color);
-            color: white;
-            border: none;
-            border-radius: var(--border-radius);
-            font-size: 1rem;
-            font-weight: 600;
-            cursor: pointer;
-            transition: background-color 0.3s ease;
-        }
-
-        .btn-submit:hover {
-            background-color: #357abd;
-        }
-
-        .btn-submit:disabled {
-            background-color: #a0c4e8;
-            cursor: not-allowed;
-        }
-
-        /* Fortschritts- und Log-Bereich */
-        #uploadProgress {
-            margin-top: 2rem;
-            display: none;
-        }
-
-        #progressText {
-            font-size: 1rem;
-            margin-bottom: 0.5rem;
-            color: var(--primary-color);
-            text-align: center;
-        }
-
-        progress {
-            width: 100%;
-            height: 20px;
-            border-radius: var(--border-radius);
-        }
-
-        #logList {
-            margin-top: 1rem;
-            padding: 10px;
-            font-size: 0.85rem;
-            color: #555;
-            max-height: 150px;
-            overflow-y: auto;
-            background: #fafafa;
-            border: 1px solid #ddd;
-            border-radius: var(--border-radius);
-            list-style-type: none;
-        }
-
-        #logList li {
-            margin-bottom: 5px;
-            padding-bottom: 5px;
-            border-bottom: 1px solid #eee;
-        }
-
-        #logList li:last-child {
-            border-bottom: none;
-            margin-bottom: 0;
-            padding-bottom: 0;
-        }
     </style>
-    <meta name="csrf-token" content="{{ csrf_token() }}">
 </head>
 <body>
 
-    <div class="upload-container">
+<div class="upload-container">
-        <h2>Inventar Batch Upload</h2>
+    <h2>Inventar Batch Upload</h2>
 
-        <!-- ID auf "batchUploadForm" geändert, damit das JS es findet -->
+    <form id="batchUploadForm">
-        <form id="batchUploadForm">
+        <div class="form-group">
-            <div class="form-group">
+            <label for="csv_file">1. items.csv auswählen</label>
-                <label for="csv_file">1. items.csv Datei auswählen</label>
+            <input type="file" id="csv_file" name="csv_file" accept=".csv" required>
-                <input type="file" id="csv_file" name="csv_file" accept=".csv" required>
-            </div>
-
-            <div class="form-group">
-                <label for="images">2. Bilder auswählen</label>
-                <input type="file" id="images" name="images" accept="image/*" multiple required>
-                <small style="color: #666; display: block; margin-top: 5px;">Du kannst mehrere Bilder markieren (Strg/Cmd gedrückt halten).</small>
-            </div>
-
-            <!-- ID auf "uploadBtn" geändert -->
-            <button type="submit" id="uploadBtn" class="btn-submit">Daten hochladen</button>
-        </form>
-
-        <!-- Fehlender Container für den Fortschrittsbalken und Logs hinzugefügt -->
-        <div id="uploadProgress">
-            <div id="progressText">Starte Upload...</div>
-            <progress id="progressBar" value="0" max="100"></progress>
-            <ul id="logList"></ul>
         </div>
+
+        <div class="form-group">
+            <label for="images">2. Bilder auswählen</label>
+            <input type="file" id="images" name="images" accept="image/*" multiple required>
+        </div>
+
+        <button type="submit" id="uploadBtn" class="btn-submit">Daten hochladen</button>
+    </form>
+
+    <div id="uploadProgress">
+        <div id="progressText">Bereite Upload vor...</div>
+        <progress id="progressBar" value="0" max="100"></progress>
+        <ul id="logList"></ul>
     </div>
+</div>
 
 <script>
+// 1. Robuster CSV-Parser, der Zeilenumbrüche und Kommas in Texten korrekt ignoriert
+function parseCSV(csvString) {
+    const rows = [];
+    let currentRow = [];
+    let currentCell = '';
+    let insideQuotes = false;
+
+    for (let i = 0; i < csvString.length; i++) {
+        const char = csvString[i];
+        const nextChar = csvString[i + 1];
+
+        if (char === '"' && insideQuotes && nextChar === '"') {
+            currentCell += '"';
+            i++; // Escaped Quotes ("") überspringen
+        } else if (char === '"') {
+            insideQuotes = !insideQuotes;
+        } else if (char === ',' && !insideQuotes) {
+            currentRow.push(currentCell);
+            currentCell = '';
+        } else if ((char === '\n' || char === '\r') && !insideQuotes) {
+            if (char === '\r' && nextChar === '\n') i++; // Windows Umbrüche überspringen
+            currentRow.push(currentCell);
+            if (currentRow.length > 1 || currentRow[0] !== '') {
+                rows.push(currentRow);
+            }
+            currentRow = [];
+            currentCell = '';
+        } else {
+            currentCell += char;
+        }
+    }
+    if (currentCell !== '' || currentRow.length > 0) {
+        currentRow.push(currentCell);
+        if (currentRow.length > 1 || currentRow[0] !== '') {
+            rows.push(currentRow);
+        }
+    }
+    return rows;
+}
+
+// 2. Baut das Array wieder sicher zu einer sauberen CSV-Zeile für das Backend zusammen
+function rowToCSV(rowArray) {
+    return rowArray.map(cell => {
+        if (cell === null || cell === undefined) return '';
+        let cellStr = String(cell);
+        if (cellStr.includes(',') || cellStr.includes('"') || cellStr.includes('\n') || cellStr.includes('\r')) {
+            return '"' + cellStr.replace(/"/g, '""') + '"';
+        }
+        return cellStr;
+    }).join(',');
+}
+
+// 3. Bildnamen extrahieren
+function extractImageNames(cellValue) {
+    if (!cellValue) return [];
+    let raw = String(cellValue).replace(/^["']|["']$/g, '').trim();
+    if (raw.startsWith('[') && raw.endsWith(']')) {
+        try {
+            const jsonValid = raw.replace(/'/g, '"');
+            return JSON.parse(jsonValid);
+        } catch (e) {
+            const matches = raw.match(/['"]([^'"]+)['"]/g);
+            if (matches) return matches.map(m => m.replace(/['"]/g, ''));
+        }
+    }
+    return raw ? [raw] : [];
+}
+
 document.getElementById('batchUploadForm').addEventListener('submit', async function(e) {
     e.preventDefault();
 
@@ -171,6 +127,8 @@ document.getElementById('batchUploadForm').addEventListener('submit', async func
     const progressText = document.getElementById('progressText');
     const logList = document.getElementById('logList');
 
+    const csrfToken = document.querySelector('meta[name="csrf-token"]')?.getAttribute('content');
+
     if (!csvInput.files.length) {
         alert("Bitte wähle eine CSV-Datei aus.");
         return;
@@ -184,128 +142,118 @@ document.getElementById('batchUploadForm').addEventListener('submit', async func
         const li = document.createElement('li');
         li.textContent = msg;
         logList.appendChild(li);
-        logList.scrollTop = logList.scrollHeight; // Auto-scroll
+        logList.scrollTop = logList.scrollHeight;
     };
 
     const csvFile = csvInput.files[0];
     const allImages = Array.from(imageInput.files);
-    const BATCH_SIZE = 50;
+
+    const imageMap = new Map();
+    allImages.forEach(file => {
+        imageMap.set(file.name.toLowerCase(), file);
+    });
+
+    const BATCH_SIZE = 20;
 
     try {
-        // 1. CSV-Datei lesen
         const csvText = await csvFile.text();
+        const allRows = parseCSV(csvText);
 
-        // 2. CSV in Zeilen aufteilen
+        if (allRows.length <= 1) {
-        let rows = csvText.split(/\r?\n/).filter(row => row.trim().length > 0);
-
-        if (rows.length <= 1) {
             throw new Error("CSV-Datei ist leer oder enthält nur Kopfzeilen.");
         }
 
-        const header = rows[0];
+        const headerRow = allRows[0];
-        let dataRows = rows.slice(1);
+        const dataRows = allRows.slice(1);
 
-        // 3. Client-seitige Deduplizierung (Entfernt exakte Duplikat-Zeilen)
+        log(`${dataRows.length} Einträge gefunden. Bereite Batches vor...`);
-        const uniqueRowsSet = new Set();
-        const uniqueDataRows = [];
-        let duplicateCount = 0;
 
-        for (const row of dataRows) {
+        const imagesColIndex = headerRow.findIndex(h => h.toLowerCase().trim() === 'images');
-            if (uniqueRowsSet.has(row)) {
-                duplicateCount++;
-            } else {
-                uniqueRowsSet.add(row);
-                uniqueDataRows.push(row);
-            }
-        }
 
-        log(`${uniqueDataRows.length} einzigartige Einträge gefunden. ${duplicateCount} Duplikate entfernt.`);
-
-        // Den Index der "Images" Spalte finden
-        const headers = header.split(';');
-        const imagesColIndex = headers.findIndex(h => h.trim().replace(/['"]/g, '') === 'Images');
-
-        // 4. In Batches (Häppchen) aufteilen
         const batches = [];
-        for (let i = 0; i < uniqueDataRows.length; i += BATCH_SIZE) {
+        for (let i = 0; i < dataRows.length; i += BATCH_SIZE) {
-            batches.push(uniqueDataRows.slice(i, i + BATCH_SIZE));
+            batches.push(dataRows.slice(i, i + BATCH_SIZE));
         }
 
         progressBar.max = batches.length;
         progressBar.value = 0;
 
-        // 5. Batches nacheinander hochladen
+        // Sequenzieller Upload mit Fehlertoleranz pro Batch
         for (let b = 0; b < batches.length; b++) {
             const batchRows = batches[b];
             progressText.textContent = `Lade Batch ${b + 1} von ${batches.length} hoch...`;
-            log(`Bereite Batch ${b + 1} vor (${batchRows.length} Artikel)...`);
-
-            // CSV für diesen Batch neu zusammensetzen
-            const batchCsvText = [header, ...batchRows].join('\n');
-            const batchCsvBlob = new Blob([batchCsvText], { type: 'text/csv' });
-
-            // Benötigte Bilder für diesen Batch extrahieren
-            const requiredImageNames = new Set();
-            if (imagesColIndex !== -1) {
-                batchRows.forEach(row => {
-                    const cols = row.split(',');
-                    if (cols[imagesColIndex]) {
-                        try {
-                            let imgStr = cols[imagesColIndex].trim().replace(/^"|"$/g, '').replace(/'/g, '"');
-                            if (imgStr.startsWith('[') && imgStr.endsWith(']')) {
-                                const parsedImages = JSON.parse(imgStr);
-                                parsedImages.forEach(img => requiredImageNames.add(img));
-                            }
-                        } catch (err) {
-                            console.warn("Konnte Bild-Array nicht parsen in Zeile:", row);
-                        }
-                    }
-                });
-            }
-
-            // Bilder auf die für diesen Batch benötigten filtern
-            const batchImages = allImages.filter(img => requiredImageNames.has(img.name));
-
-            // FormData zusammenbauen
-            const formData = new FormData();
-            formData.append('csv_file', batchCsvBlob, `batch_${b+1}.csv`);
-            batchImages.forEach(img => {
-                formData.append('images', img);
-            });
 
             try {
-                const csrfToken = document.querySelector('meta[name="csrf-token"]').getAttribute('content');
+                const requiredImagesForBatch = new Set();
+
+                if (imagesColIndex !== -1) {
+                    batchRows.forEach(rowCols => {
+                        if (rowCols[imagesColIndex]) {
+                            const imgNames = extractImageNames(rowCols[imagesColIndex]);
+                            imgNames.forEach(name => {
+                                const fileMatch = imageMap.get(name.toLowerCase());
+                                if (fileMatch) {
+                                    requiredImagesForBatch.add(fileMatch);
+                                }
+                            });
+                        }
+                    });
+                }
+
+                const batchCsvArray = [headerRow, ...batchRows];
+                const batchCsvText = batchCsvArray.map(rowToCSV).join('\n');
+                const batchCsvBlob = new Blob([batchCsvText], { type: 'text/csv' });
+
+                const formData = new FormData();
+                formData.append('csv_file', batchCsvBlob, `batch_${b + 1}.csv`);
+
+                if (csrfToken) {
+                    formData.append('csrf_token', csrfToken);
+                }
+
+                requiredImagesForBatch.forEach(imgFile => {
+                    formData.append('images', imgFile);
+                });
+
+                log(`Batch ${b + 1}: ${batchRows.length} Items & ${requiredImagesForBatch.size} zugehörige Bilder.`);
 
                 const response = await fetch('/upload_csv_batch', {
                     method: 'POST',
                     body: formData,
                     headers: {
-                        'X-CSRFToken': csrfToken
+                        'X-CSRFToken': csrfToken || ''
                     }
                 });
 
-                const result = await response.json();
+                const responseText = await response.text();
+                let result;
 
-                if (!response.ok || !result.success) {
+                try {
-                    throw new Error(result.message || `Server antwortete mit Status ${response.status}`);
+                    result = JSON.parse(responseText);
+                } catch (parseErr) {
+                    throw new Error(`Server-Fehler (Status ${response.status}). HTML statt JSON erhalten.`);
                 }
 
-                log(`Batch ${b + 1} erfolgreich: ${result.message}`);
+                if (!response.ok || !result.success) {
+                    throw new Error(result.message || `Server-Fehler ${response.status}`);
+                }
+
+                log(`Batch ${b + 1} erfolgreich abgeschlossen.`);
+
             } catch (batchErr) {
-                log(`Fehler in Batch ${b + 1}: ${batchErr.message}`);
+                log(`⚠️ FEHLER in Batch ${b + 1}: ${batchErr.message}. Überspringe und fahre fort...`);
-                alert(`Upload wurde bei Batch ${b + 1} aufgrund eines Fehlers abgebrochen. Prüfe die Logs.`);
+                console.error(`Batch ${b + 1} fehlgeschlagen:`, batchErr);
-                break; // Stoppt weitere Uploads, wenn einer fehlschlägt
             }
 
             progressBar.value = b + 1;
         }
 
-        progressText.textContent = "Upload-Vorgang abgeschlossen!";
+        progressText.textContent = "Upload-Prozess beendet!";
         uploadBtn.disabled = false;
 
-    } catch (error) {
+    } catch (err) {
-        alert("Fehler bei der Verarbeitung des Uploads: " + error.message);
+        alert("Upload abgebrochen: " + err.message);
-        log("Fehler: " + error.message);
+        log("Fehler: " + err.message);
         uploadBtn.disabled = false;
     }
 });

manage-tenant.sh

@@ -201,65 +201,35 @@ sys.path.insert(0, "/app/Web")
 from Web.modules.database import settings
 from pymongo import MongoClient
 import Web.modules.inventarsystem.data_protection as dp
+import Web.modules.database.user as us
 
 tenant_id = sys.argv[1].lower()
 mode = sys.argv[2]
 sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
-db_name = f"inventar_{sanitized}"
+db_name = f"inventar_{sanitized}" if sanitized else settings.MONGODB_DB
-client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
+
+client = MongoClient(settings.MONGODB_HOST, settings.MONGODB_PORT)
 db = client[db_name]
-
+users = db["users"]
-pw_bytes = "admin123".encode("utf-8")
+permission_defaults = us.build_default_permission_payload("full_access")
-random_salt = os.urandom(16)
+admin_doc = {
-hashed = hashlib.scrypt(pw_bytes, salt=random_salt, n=16384, r=8, p=1)
+    "Username": "admin",
-hashed_pw_string = f"v1${random_salt.hex()}${hashed.hex()}"
+    "Password": us.hashing("admin123"),
-
+    "Admin": True,
-action_permissions = {
+    "active_ausleihung": None,
-    "can_borrow": True,
+    "name": dp.encrypt_text("admin"),
-    "can_insert": True,
+    "last_name": dp.encrypt_text("admin"),
-    "can_edit": True,
+    "IsStudent": False,
-    "can_delete": True,
+    "PermissionPreset": permission_defaults["preset"],
-    "can_manage_users": True,
+    "ActionPermissions": permission_defaults["actions"],
-    "can_manage_settings": True,
+    "PagePermissions": permission_defaults["pages"],
-    "can_view_logs": True,
 }
-
+users.replace_one({"Username": "admin"}, admin_doc, upsert=True)
-page_permissions = {
+print("Fallback successfully applied")
-    "home": True,
-    "tutorial_page": True,
-    "my_borrowed_items": True,
-    "notifications_view": True,
-    "impressum": True,
-    "license": True,
-    "library_view": True,
-    "terminplan": True,
-    "home_admin": True,
-    "upload_admin": True,
-    "library_admin": True,
-    "admin_borrowings": True,
-    "library_loans_admin": True,
-    "admin_damaged_items": True,
-    "admin_audit_dashboard": True,
-    "logs": True,
-    "manage_filters": True,
-    "manage_locations": True,
-}
-
-if db.users.count_documents({"Username": dp.encrypt_text("admin")}) == 0:
-    db.users.insert_one({
-        "Username":  dp.encrypt_text("admin"),
-        "Password": hashed_pw_string,
-        "Admin": True,
-        "active_ausleihung": None,
-        "name": dp.encrypt_text("Admin"),
-        "last_name": dp.encrypt_text("User"),
-        "IsStudent": False,
-        "PermissionPreset": "full_access",
-        "ActionPermissions": action_permissions,
-        "PagePermissions": page_permissions,
-    })
 
 if mode == "trial":
+    client = MongoClient(settings.MONGODB_HOST, settings.MONGODB_PORT)
+    db = client[db_name]
     db.settings.update_one(
         {"setting_type": "tenant_trial"},
         {"$set": {
@@ -272,6 +242,8 @@ if mode == "trial":
         upsert=True,
     )
 
+client.close()
+
 print(f"Tenant {sys.argv[1]} database initialized. Default admin: admin / admin123")
 PY
 }
@@ -674,38 +646,29 @@ case "$COMMAND" in
         port_to_remove=""
 
         if [ -n "$APP_CONTAINER" ]; then
-            # Zuerst die Datenbank via PyMongo hart droppen (Erzwungenes Löschen)
+            # MongoDB-Datenbank via PyMongo direkt im Container droppen
-            port_to_remove="$(docker exec "$APP_CONTAINER" python3 - "$TENANT_ID" <<'PY'
+            docker exec -i "$APP_CONTAINER" python3 -c '
-import sys, re
+    import sys, os
-sys.path.insert(0, '/app')
+    try:
-sys.path.insert(0, '/app/Web')
+        import pymongo
-from tenant import delete_tenant, get_tenant_config
+        tenant_id = sys.argv[1]
-from Web.modules.database import settings
+        mongo_uri = os.environ.get("MONGO_URI", "mongodb://localhost:27017/")
-from pymongo import MongoClient
+        client = pymongo.MongoClient(mongo_uri, serverSelectionTimeoutMS=2000)
+        db_name = f"inventar_{tenant_id}"
+        if db_name in client.list_database_names():
+            client.drop_database(db_name)
+            print(f"Dropped database: {db_name}")
+    except Exception as e:
+        print(f"Error dropping database: {e}", file=sys.stderr)
+    ' "$TENANT_ID" > /dev/null 2>&1
 
-tenant_id = sys.argv[1]
+            # Konfiguration und Port via Host-Funktion bereinigen und Port ermitteln
-tenant_cfg = get_tenant_config(tenant_id)
+            if port_to_remove="$(remove_tenant_port "$TENANT_ID" 2>/dev/null)"; then
-port = tenant_cfg.get('port')
+                :
+            else
+                port_to_remove=""
+            fi
 
-# Datenbanknamen exakt rekonstruieren
-sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
-db_name = f"inventar_{sanitized}"
-
-try:
-    client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
-    client.drop_database(db_name)
-    print(f"MongoDB database '{db_name}' dropped successfully.", file=sys.stderr)
-except Exception as e:
-    print(f"Warning: Could not drop database '{db_name}': {e}", file=sys.stderr)
-
-if not delete_tenant(tenant_id):
-    print(f'Error: failed to delete tenant {tenant_id}', file=sys.stderr)
-    sys.exit(1)
-
-if port is not None:
-    print(port)
-PY
-            )"
             echo "Tenant '$TENANT_ID' database and config removed."
         else
             echo "Warning: Application container not running. Tenant database may still exist in MongoDB."
@@ -728,7 +691,7 @@ PY
         else
             echo "Removed tenant '$TENANT_ID'. No port mapping was present."
         fi
-        ;;
+    ;;
 
     restart-tenant)
         TENANT_ID="${2:-}"