Compare commits

..

12 Commits

5 changed files with 284 additions and 163 deletions
+25 -9
View File
@@ -11862,25 +11862,39 @@ def batch_upload_page():
return render_template('upload_batch.html')
def clean_db_field(val):
"""Bereinigt Werte, die fälschlicherweise als String-Listen aus der CSV kommen."""
"""Bereinigt Werte, die fälschlicherweise als String-Listen oder mit Klammern aus der CSV kommen."""
import ast
import pandas as pd
if not val or pd.isna(val):
return None
val_str = str(val).strip()
# Erkennt und entpackt String-Listen wie "['100465']" oder '["100465"]'
if (val_str.startswith("['") and val_str.endswith("']")) or (val_str.startswith('["') and val_str.endswith('"]')):
inner = val_str[2:-2].strip()
return inner if inner and inner != "''" and inner != '""' else None
# Wenn es wie eine Liste aussieht (z.B. "['100177']" oder "['']")
if val_str.startswith("[") and val_str.endswith("]"):
try:
parsed = ast.literal_eval(val_str)
if isinstance(parsed, list):
# Nimm das erste Element der Liste, wenn vorhanden
for item in parsed:
cleaned_item = str(item).strip()
if cleaned_item and cleaned_item not in ("", "''", '""', "None", "nan"):
return cleaned_item
return None
except Exception:
# Fallback bei Syntaxfehlern
inner = val_str[1:-1].strip().replace("'", "").replace('"', '')
return inner if inner and inner not in ("''", '""') else None
if val_str in ("[]", "['']", '[""]', "nan", "None"):
if val_str in ("[]", "['']", '[""]', "nan", "None", "''", '""'):
return None
return val_str
@app.route('/upload_csv_batch', methods=['POST'])
def upload_csv_batch():
"""
@@ -12064,8 +12078,10 @@ def upload_csv_batch():
reservierbar = bool(row.get('Reservierbar', False))
# Code_4 Behandlung
row_code = clean_db_field(row.get('Code_4', ''))
# Code_4 / Barcode sauber extrahieren und bereinigen
raw_code = row.get('Code_4') or row.get('Barcode') or ''
row_code = clean_db_field(raw_code)
if row_code:
unique_code = row_code
elif item_count > 1:
+119 -4
View File
@@ -54,10 +54,34 @@ def _clean_name_fragment(value):
return cleaned
def _get_tenant_db(client):
def _get_tenant_db(client, tenant_id=None):
"""Return the current tenant database for the request, or fall back to default."""
try:
from tenant import get_tenant_db
if tenant_id is None:
return get_tenant_db(client)
tenant_id = str(tenant_id).strip()
if tenant_id:
try:
from tenant import get_tenant_config
config = get_tenant_config(tenant_id)
if isinstance(config, dict):
explicit_db = config.get('db') or config.get('db_name')
if explicit_db:
db_name = str(explicit_db).strip()
if db_name and not db_name.startswith('inventar_'):
db_name = f'inventar_{db_name}'
if db_name:
return client[db_name]
except Exception:
pass
sanitized = ''.join(c for c in tenant_id.lower() if c.isalnum() or c == '_')
if sanitized:
return client[f'inventar_{sanitized}']
return get_tenant_db(client)
except Exception:
return client[cfg.MONGODB_DB]
@@ -479,8 +503,45 @@ def check_nm_pwd(username, password):
query = {'$or': [{'Username': username}, {'username': username}]}
user_record_fallback = users.find_one(query)
if user_record_fallback is None:
logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
return None
if db_name != cfg.MONGODB_DB:
default_users = client[cfg.MONGODB_DB]['users']
user_record_fallback = default_users.find_one(
{'$or': [
{'Username': dp.encrypt_text(username)},
{'username': dp.encrypt_text(username)},
{'Username': username},
{'username': username},
]}
)
if user_record_fallback is not None:
migrated_record = dict(user_record_fallback)
migrated_record.pop('_id', None)
users.replace_one(
{'$or': [
{'Username': migrated_record.get('Username')},
{'username': migrated_record.get('username')},
]},
migrated_record,
upsert=True,
)
logger.warning(
"Tenant user %r migrated from default DB %r to tenant DB %r.",
dp.encrypt_text(username),
cfg.MONGODB_DB,
db_name,
)
user_record = users.find_one(
{'$or': [
{'Username': migrated_record.get('Username')},
{'username': migrated_record.get('username')},
]}
) or migrated_record
else:
logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
return None
else:
logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
return None
else:
user_record = user_record_fallback
@@ -497,6 +558,59 @@ def check_nm_pwd(username, password):
finally:
client.close()
def add_admin(
username,
password,
name='',
last_name='',
is_student=False,
permission_preset='full_access',
action_permissions=None,
page_permissions=None,
tenant_id=None,
):
"""
Add a new user to the database.
"""
if not check_password_strength(password):
return False
client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
try:
db = _get_tenant_db(client, tenant_id)
users = db['users']
permission_defaults = build_default_permission_payload(permission_preset)
if isinstance(action_permissions, dict):
for key, value in action_permissions.items():
permission_defaults['actions'][str(key)] = bool(value)
if isinstance(page_permissions, dict):
for key, value in page_permissions.items():
permission_defaults['pages'][str(key)] = bool(value)
safe_name = name.strip() if name else ''
safe_last_name = last_name.strip() if last_name else ''
user_doc = {
'Username': username,
'Password': hashing(password),
'Admin': True,
'active_ausleihung': None,
'name': dp.encrypt_text(safe_name) if safe_name else '',
'last_name': dp.encrypt_text(safe_last_name) if safe_last_name else '',
'IsStudent': bool(is_student),
'PermissionPreset': permission_defaults['preset'],
'ActionPermissions': permission_defaults['actions'],
'PagePermissions': permission_defaults['pages'],
}
users.insert_one(user_doc)
return True
finally:
client.close()
def add_user(
username,
@@ -509,6 +623,7 @@ def add_user(
permission_preset='standard_user',
action_permissions=None,
page_permissions=None,
tenant_id=None,
):
"""
Add a new user to the database.
@@ -518,7 +633,7 @@ def add_user(
client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
try:
db = _get_tenant_db(client)
db = _get_tenant_db(client, tenant_id)
users = db['users']
permission_defaults = build_default_permission_payload(permission_preset)
+57 -48
View File
@@ -48,7 +48,7 @@
</div>
<script>
// 1. Ein echter CSV-Parser, der Zeilenumbrüche und Kommas in Texten korrekt ignoriert
// 1. Robuster CSV-Parser, der Zeilenumbrüche und Kommas in Texten korrekt ignoriert
function parseCSV(csvString) {
const rows = [];
let currentRow = [];
@@ -70,7 +70,6 @@ function parseCSV(csvString) {
} else if ((char === '\n' || char === '\r') && !insideQuotes) {
if (char === '\r' && nextChar === '\n') i++; // Windows Umbrüche überspringen
currentRow.push(currentCell);
// Leere Zeilen ignorieren
if (currentRow.length > 1 || currentRow[0] !== '') {
rows.push(currentRow);
}
@@ -94,7 +93,6 @@ function rowToCSV(rowArray) {
return rowArray.map(cell => {
if (cell === null || cell === undefined) return '';
let cellStr = String(cell);
// Wenn kritische Zeichen drin sind, sauber in Anführungszeichen verpacken
if (cellStr.includes(',') || cellStr.includes('"') || cellStr.includes('\n') || cellStr.includes('\r')) {
return '"' + cellStr.replace(/"/g, '""') + '"';
}
@@ -102,7 +100,7 @@ function rowToCSV(rowArray) {
}).join(',');
}
// 3. Bildnamen extrahieren (bleibt wie es war)
// 3. Bildnamen extrahieren
function extractImageNames(cellValue) {
if (!cellValue) return [];
let raw = String(cellValue).replace(/^["']|["']$/g, '').trim();
@@ -155,11 +153,10 @@ document.getElementById('batchUploadForm').addEventListener('submit', async func
imageMap.set(file.name.toLowerCase(), file);
});
const BATCH_SIZE = 50;
const BATCH_SIZE = 20;
try {
const csvText = await csvFile.text();
// Hier rufen wir jetzt unseren sicheren Parser auf!
const allRows = parseCSV(csvText);
if (allRows.length <= 1) {
@@ -171,10 +168,8 @@ document.getElementById('batchUploadForm').addEventListener('submit', async func
log(`${dataRows.length} Einträge gefunden. Bereite Batches vor...`);
// Spalten-Index von "Images" sicher ermitteln
const imagesColIndex = headerRow.findIndex(h => h.toLowerCase().trim() === 'images');
// In Batches aufteilen
const batches = [];
for (let i = 0; i < dataRows.length; i += BATCH_SIZE) {
batches.push(dataRows.slice(i, i + BATCH_SIZE));
@@ -183,63 +178,77 @@ document.getElementById('batchUploadForm').addEventListener('submit', async func
progressBar.max = batches.length;
progressBar.value = 0;
// Sequenzieller Upload mit Fehlertoleranz pro Batch
for (let b = 0; b < batches.length; b++) {
const batchRows = batches[b];
progressText.textContent = `Lade Batch ${b + 1} von ${batches.length} hoch...`;
const requiredImagesForBatch = new Set();
try {
const requiredImagesForBatch = new Set();
if (imagesColIndex !== -1) {
batchRows.forEach(rowCols => {
if (rowCols[imagesColIndex]) {
const imgNames = extractImageNames(rowCols[imagesColIndex]);
imgNames.forEach(name => {
const fileMatch = imageMap.get(name.toLowerCase());
if (fileMatch) {
requiredImagesForBatch.add(fileMatch);
}
});
if (imagesColIndex !== -1) {
batchRows.forEach(rowCols => {
if (rowCols[imagesColIndex]) {
const imgNames = extractImageNames(rowCols[imagesColIndex]);
imgNames.forEach(name => {
const fileMatch = imageMap.get(name.toLowerCase());
if (fileMatch) {
requiredImagesForBatch.add(fileMatch);
}
});
}
});
}
const batchCsvArray = [headerRow, ...batchRows];
const batchCsvText = batchCsvArray.map(rowToCSV).join('\n');
const batchCsvBlob = new Blob([batchCsvText], { type: 'text/csv' });
const formData = new FormData();
formData.append('csv_file', batchCsvBlob, `batch_${b + 1}.csv`);
if (csrfToken) {
formData.append('csrf_token', csrfToken);
}
requiredImagesForBatch.forEach(imgFile => {
formData.append('images', imgFile);
});
log(`Batch ${b + 1}: ${batchRows.length} Items & ${requiredImagesForBatch.size} zugehörige Bilder.`);
const response = await fetch('/upload_csv_batch', {
method: 'POST',
body: formData,
headers: {
'X-CSRFToken': csrfToken || ''
}
});
}
// Sicherer Zusammenbau des CSV-Batches
const batchCsvArray = [headerRow, ...batchRows];
const batchCsvText = batchCsvArray.map(rowToCSV).join('\n');
const batchCsvBlob = new Blob([batchCsvText], { type: 'text/csv' });
const responseText = await response.text();
let result;
const formData = new FormData();
formData.append('csv_file', batchCsvBlob, `batch_${b + 1}.csv`);
if (csrfToken) {
formData.append('csrf_token', csrfToken);
}
requiredImagesForBatch.forEach(imgFile => {
formData.append('images', imgFile);
});
log(`Batch ${b + 1}: ${batchRows.length} Items & ${requiredImagesForBatch.size} zugehörige Bilder.`);
const response = await fetch('/upload_csv_batch', {
method: 'POST',
body: formData,
headers: {
'X-CSRFToken': csrfToken || ''
try {
result = JSON.parse(responseText);
} catch (parseErr) {
throw new Error(`Server-Fehler (Status ${response.status}). HTML statt JSON erhalten.`);
}
});
const result = await response.json();
if (!response.ok || !result.success) {
throw new Error(result.message || `Server-Fehler ${response.status}`);
}
if (!response.ok || !result.success) {
throw new Error(result.message || `Server-Fehler ${response.status}`);
log(`Batch ${b + 1} erfolgreich abgeschlossen.`);
} catch (batchErr) {
log(`⚠️ FEHLER in Batch ${b + 1}: ${batchErr.message}. Überspringe und fahre fort...`);
console.error(`Batch ${b + 1} fehlgeschlagen:`, batchErr);
}
log(`Batch ${b + 1} abgeschlossen.`);
progressBar.value = b + 1;
}
progressText.textContent = "Upload erfolgreich beendet! Keine verschobenen Spalten mehr.";
progressText.textContent = "Upload-Prozess beendet!";
uploadBtn.disabled = false;
} catch (err) {
+35 -17
View File
@@ -166,6 +166,11 @@ def _find_registered_tenant_id(candidate):
return None
def _resolve_registered_tenant_id(candidate):
"""Return the canonical registered tenant id for a candidate, or None."""
return _find_registered_tenant_id(candidate)
def _is_ip_host(hostname):
hostname = str(hostname or '').strip()
if not hostname:
@@ -185,6 +190,8 @@ def get_tenant_config(tenant_id=None):
ctx = get_tenant_context()
tenant_id = ctx.tenant_id if ctx and ctx.tenant_id else 'default'
tenant_id = _resolve_registered_tenant_id(tenant_id) or tenant_id
if tenant_id in TENANT_REGISTRY:
return TENANT_REGISTRY[tenant_id] or {}
@@ -481,20 +488,22 @@ class TenantContext:
or request.args.get('tenantId', '').strip()
)
if tenant_from_query:
matched_tenant = _find_registered_tenant_id(tenant_from_query) or tenant_from_query
self.tenant_id = matched_tenant
self.config = get_tenant_config(matched_tenant)
session['tenant_id'] = matched_tenant
return self._get_db_name(matched_tenant)
matched_tenant = _resolve_registered_tenant_id(tenant_from_query)
if matched_tenant:
self.tenant_id = matched_tenant
self.config = get_tenant_config(matched_tenant)
session['tenant_id'] = matched_tenant
return self._get_db_name(matched_tenant)
# Priority 1: X-Tenant-ID header (for testing/internal APIs)
tenant_from_header = request.headers.get('X-Tenant-ID', '').strip()
if tenant_from_header:
matched_tenant = _find_registered_tenant_id(tenant_from_header) or tenant_from_header
self.tenant_id = matched_tenant
self.config = get_tenant_config(matched_tenant)
session['tenant_id'] = matched_tenant
return self._get_db_name(matched_tenant)
matched_tenant = _resolve_registered_tenant_id(tenant_from_header)
if matched_tenant:
self.tenant_id = matched_tenant
self.config = get_tenant_config(matched_tenant)
session['tenant_id'] = matched_tenant
return self._get_db_name(matched_tenant)
# Priority 2: Port/host based tenant mapping
host_candidates = _request_host_candidates()
@@ -544,11 +553,11 @@ class TenantContext:
if len(parts) >= 2:
potential_subdomain = parts[0]
if potential_subdomain not in ('www', 'api', 'admin', 'app', 'mail'):
matched_tenant = _find_registered_tenant_id(potential_subdomain)
matched_tenant = _resolve_registered_tenant_id(potential_subdomain)
if not matched_tenant and potential_subdomain.startswith('school'):
matched_tenant = _find_registered_tenant_id('schule' + potential_subdomain[len('school'):])
matched_tenant = _resolve_registered_tenant_id('schule' + potential_subdomain[len('school'):])
elif not matched_tenant and potential_subdomain.startswith('schule'):
matched_tenant = _find_registered_tenant_id('school' + potential_subdomain[len('schule'):])
matched_tenant = _resolve_registered_tenant_id('school' + potential_subdomain[len('schule'):])
if matched_tenant:
self.subdomain = potential_subdomain
self.tenant_id = matched_tenant
@@ -565,12 +574,21 @@ class TenantContext:
# Priority 4: sticky tenant from the authenticated session
session_tenant = session.get('tenant_id', '').strip() if session.get('tenant_id') else ''
if session_tenant:
self.tenant_id = session_tenant
self.config = get_tenant_config(session_tenant)
matched_tenant = _resolve_registered_tenant_id(session_tenant)
if matched_tenant:
self.tenant_id = matched_tenant
self.config = get_tenant_config(matched_tenant)
session['tenant_id'] = matched_tenant
logger.info(
f"Tenant resolution by session: host={primary_host} tenant={matched_tenant} config={self.config}"
)
return self._get_db_name(matched_tenant)
session.pop('tenant_id', None)
logger.info(
f"Tenant resolution by session: host={primary_host} tenant={session_tenant} config={self.config}"
"Discarded stale tenant session reference: host=%s tenant=%s",
primary_host,
session_tenant,
)
return self._get_db_name(session_tenant)
# Fallback to default tenant if no tenant identifier found.
# If no explicit 'default' tenant config exists, use configured MongoDB DB.
+48 -85
View File
@@ -201,65 +201,35 @@ sys.path.insert(0, "/app/Web")
from Web.modules.database import settings
from pymongo import MongoClient
import Web.modules.inventarsystem.data_protection as dp
import Web.modules.database.user as us
tenant_id = sys.argv[1].lower()
mode = sys.argv[2]
sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
db_name = f"inventar_{sanitized}"
client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
db_name = f"inventar_{sanitized}" if sanitized else settings.MONGODB_DB
client = MongoClient(settings.MONGODB_HOST, settings.MONGODB_PORT)
db = client[db_name]
pw_bytes = "admin123".encode("utf-8")
random_salt = os.urandom(16)
hashed = hashlib.scrypt(pw_bytes, salt=random_salt, n=16384, r=8, p=1)
hashed_pw_string = f"v1${random_salt.hex()}${hashed.hex()}"
action_permissions = {
"can_borrow": True,
"can_insert": True,
"can_edit": True,
"can_delete": True,
"can_manage_users": True,
"can_manage_settings": True,
"can_view_logs": True,
users = db["users"]
permission_defaults = us.build_default_permission_payload("full_access")
admin_doc = {
"Username": "admin",
"Password": us.hashing("admin123"),
"Admin": True,
"active_ausleihung": None,
"name": dp.encrypt_text("admin"),
"last_name": dp.encrypt_text("admin"),
"IsStudent": False,
"PermissionPreset": permission_defaults["preset"],
"ActionPermissions": permission_defaults["actions"],
"PagePermissions": permission_defaults["pages"],
}
page_permissions = {
"home": True,
"tutorial_page": True,
"my_borrowed_items": True,
"notifications_view": True,
"impressum": True,
"license": True,
"library_view": True,
"terminplan": True,
"home_admin": True,
"upload_admin": True,
"library_admin": True,
"admin_borrowings": True,
"library_loans_admin": True,
"admin_damaged_items": True,
"admin_audit_dashboard": True,
"logs": True,
"manage_filters": True,
"manage_locations": True,
}
if db.users.count_documents({"Username": dp.encrypt_text("admin")}) == 0:
db.users.insert_one({
"Username": dp.encrypt_text("admin"),
"Password": hashed_pw_string,
"Admin": True,
"active_ausleihung": None,
"name": dp.encrypt_text("Admin"),
"last_name": dp.encrypt_text("User"),
"IsStudent": False,
"PermissionPreset": "full_access",
"ActionPermissions": action_permissions,
"PagePermissions": page_permissions,
})
users.replace_one({"Username": "admin"}, admin_doc, upsert=True)
print("Fallback successfully applied")
if mode == "trial":
client = MongoClient(settings.MONGODB_HOST, settings.MONGODB_PORT)
db = client[db_name]
db.settings.update_one(
{"setting_type": "tenant_trial"},
{"$set": {
@@ -272,6 +242,8 @@ if mode == "trial":
upsert=True,
)
client.close()
print(f"Tenant {sys.argv[1]} database initialized. Default admin: admin / admin123")
PY
}
@@ -643,11 +615,11 @@ case "$COMMAND" in
initialize_tenant_database "$TENANT_ID" "trial"
echo "Trial tenant '$TENANT_ID' successfully configured. It will expire after $DAYS_ARG day(s) and self-delete."
;;
remove)
FORCE_REMOVE=false
TENANT_ARG="${2:-}"
if [ "$TENANT_ARG" = "--yes" ] || [ "$TENANT_ARG" = "-y" ]; then
FORCE_REMOVE=true
TENANT_ID="${3:-}"
@@ -672,40 +644,31 @@ case "$COMMAND" in
echo "Removing tenant '$TENANT_ID'..."
APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
port_to_remove=""
if [ -n "$APP_CONTAINER" ]; then
# Zuerst die Datenbank via PyMongo hart droppen (Erzwungenes Löschen)
port_to_remove="$(docker exec "$APP_CONTAINER" python3 - "$TENANT_ID" <<'PY'
import sys, re
sys.path.insert(0, '/app')
sys.path.insert(0, '/app/Web')
from tenant import delete_tenant, get_tenant_config
from Web.modules.database import settings
from pymongo import MongoClient
# MongoDB-Datenbank via PyMongo direkt im Container droppen
docker exec -i "$APP_CONTAINER" python3 -c '
import sys, os
try:
import pymongo
tenant_id = sys.argv[1]
mongo_uri = os.environ.get("MONGO_URI", "mongodb://localhost:27017/")
client = pymongo.MongoClient(mongo_uri, serverSelectionTimeoutMS=2000)
db_name = f"inventar_{tenant_id}"
if db_name in client.list_database_names():
client.drop_database(db_name)
print(f"Dropped database: {db_name}")
except Exception as e:
print(f"Error dropping database: {e}", file=sys.stderr)
' "$TENANT_ID" > /dev/null 2>&1
tenant_id = sys.argv[1]
tenant_cfg = get_tenant_config(tenant_id)
port = tenant_cfg.get('port')
# Konfiguration und Port via Host-Funktion bereinigen und Port ermitteln
if port_to_remove="$(remove_tenant_port "$TENANT_ID" 2>/dev/null)"; then
:
else
port_to_remove=""
fi
# Datenbanknamen exakt rekonstruieren
sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
db_name = f"inventar_{sanitized}"
try:
client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
client.drop_database(db_name)
print(f"MongoDB database '{db_name}' dropped successfully.", file=sys.stderr)
except Exception as e:
print(f"Warning: Could not drop database '{db_name}': {e}", file=sys.stderr)
if not delete_tenant(tenant_id):
print(f'Error: failed to delete tenant {tenant_id}', file=sys.stderr)
sys.exit(1)
if port is not None:
print(port)
PY
)"
echo "Tenant '$TENANT_ID' database and config removed."
else
echo "Warning: Application container not running. Tenant database may still exist in MongoDB."
@@ -728,7 +691,7 @@ PY
else
echo "Removed tenant '$TENANT_ID'. No port mapping was present."
fi
;;
;;
restart-tenant)
TENANT_ID="${2:-}"