Implement Web Push Notifications system

- Add push_notifications.py module for managing subscriptions and sending notifications
- Create Flask API endpoints for subscription management (/api/push/*)
- Integrate push sending with existing notification system (_create_notification)
- Create frontend JavaScript library (push-notifications.js) for client-side subscription
- Update base.html template with manifest link and Service Worker registration
- Add manifest.json and service-worker.js for PWA support
- Add pywebpush dependency to requirements.txt
- Create generate-vapid-keys.sh script for VAPID key generation
- Add comprehensive documentation (WEB_PUSH_NOTIFICATIONS.md)

Features:
- Subscribe/unsubscribe users from push notifications
- Store subscriptions in MongoDB with automatic indexing
- Send push to individual users or all admins
- Notification deduplication and versioning
- Service Worker handles offline caching and push events
- Full PWA support for mobile app installation
- VAPID authentication for secure push communication

.gitignore

@@ -2,4 +2,6 @@ dist
 logs
 certs
 build
-.venv
+.venv
+__pycache__
+.pyc

BOOKING_DEBUG.md

@@ -0,0 +1,177 @@
+# Fehlersuche: Geplante Ausleihen werden nicht automatisch aktiviert
+
+## 🔍 Mögliche Ursachen
+
+### 1. **Termin wurde für falsches Datum erstellt**
+Die meisten Probleme entstehen, weil der Termin für ein **falsches Datum** (z.B. morgen statt heute) erstellt wurde.
+
+### 2. **Scheduler läuft nicht**
+Der automatische Scheduler kann deaktiviert sein oder nicht starten.
+
+### 3. **Zeitzonen-Problem**
+Die Startzeit kann in einer anderen Zeitzone gespeichert sein als erwartet.
+
+---
+
+## ✅ SOFORT-FIX: Manuell aktivieren
+
+Falls du eine geplante Ausleihe sofort aktivieren möchtest, nutze diesen Befehl auf dem Server:
+
+```bash
+docker exec inventarsystem-mongodb mongosh --eval "
+db.ausleihungen.updateOne(
+  {_id: ObjectId('BOOKING_ID_HIER')},
+  {\$set: {Status: 'active', LastUpdated: new Date()}}
+)" Inventarsystem
+```
+
+Ersetze `BOOKING_ID_HIER` mit der ID deiner Ausleihe.
+
+---
+
+## 🔧 DEBUG: Alle geplanten Ausleihen anschauen
+
+Führe auf deinem Server aus:
+
+```bash
+docker exec inventarsystem-mongodb mongosh --eval "
+db.ausleihungen.find({Status: 'planned'}).pretty()
+" Inventarsystem
+```
+
+Das zeigt dir:
+- **Start**: Das gespeicherte Startdatum/Uhrzeit
+- **Periode**: Die Schulstunde (falls verwendet)
+- **Erstellungs-Zeit vs. aktuelle Zeit**: Vergleich
+
+---
+
+## 🎯 PROBLEM 1: Falsches Datum beim Erstellen
+
+**Symptom**: Start-Zeit ist in der Zukunft (z.B. morgen statt heute)
+
+**Lösung**: 
+1. In der Kalender-Ansicht das **richtige Datum** auswählen
+2. Die **aktuelle Uhrzeit** für den Beginn nutzen (nicht eine zukünftige Zeit)
+3. Für Schulstunden: Stelle sicher die **heutige Schulstunde** zu wählen
+
+---
+
+## 🎯 PROBLEM 2: Scheduler läuft nicht
+
+**Symptom**: Keine Logs über Termin-Aktivierungen
+
+**Überprüfung**:
+
+```bash
+# 1. Container-Logs anschauen
+docker logs inventarsystem-app | grep -i "scheduler\|appointment\|status update"
+
+# 2. Scheduler ist aktiviert?
+docker exec inventarsystem-app python3 -c "
+import sys
+sys.path.insert(0, '/app/Web')
+import settings as cfg
+print(f'Scheduler aktiviert: {cfg.SCHEDULER_ENABLED}')
+print(f'Scheduler Intervall: {cfg.SCHEDULER_INTERVAL_MIN} Minuten')
+"
+```
+
+**Lösung wenn deaktiviert**:
+- In `config.json` ändern:
+  ```json
+  "scheduler": {
+    "enabled": true,
+    "interval_minutes": 1
+  }
+  ```
+- Container neu starten: `docker-compose restart app`
+
+---
+
+## 🎯 PROBLEM 3: Startzeit als nur-Zeit (kein Datum)
+
+**Symptom**: Start-Zeit zeigt nur "13:30" ohne Datum
+
+**Überprüfung**: In der Datenbank nach `{Start: {$type: "string"}}` suchen statt datetime
+
+**Lösung**: Die Ausleihe muss mit einem vollständigen Datum+Uhrzeit erstellt werden.
+
+---
+
+## 🚀 AUTOMATISCHE AKTIVIERUNG TESTEN
+
+Nach dem Fix: Erstelle eine Ausleihe für:
+- **Heute** (das aktuelle Datum)
+- **Schulstunde 7** (13:30-14:15)
+- Startzeitpunkt sollte **jetzt oder in 1 Minute** sein
+
+Warte 2 Minuten. Der Status sollte von `planned` zu `active` wechseln.
+
+---
+
+## 📊 SCHEDULER STATUS ÜBERPRÜFEN
+
+```bash
+# Zeige die letzten 50 Log-Zeilen
+docker logs --tail 50 inventarsystem-app | tail -20
+
+# Suche nach "Appointment status update"
+docker logs inventarsystem-app 2>/dev/null | grep -i "Appointment status" | tail -5
+```
+
+Erwartete Log-Ausgabe:
+```
+Appointment status update finished: X changed (Y active, Z completed)
+```
+
+---
+
+## 🔍 DETAILLIERTE DEBUG-INFOS
+
+Wenn obiges nicht funktioniert, führe dies aus:
+
+```bash
+docker exec inventarsystem-app python3 -c "
+from pymongo import MongoClient
+import datetime
+
+client = MongoClient('mongodb', 27017)
+db = client['Inventarsystem']
+aus = db['ausleihungen']
+
+print('=== GEPLANTE AUSLEIHEN ===')
+for b in aus.find({'Status': 'planned'}).limit(3):
+    print(f\"Start: {b.get('Start')} | Typ: {type(b.get('Start')).__name__}\")
+    print(f\"Periode: {b.get('Period')} | User: {b.get('User')}\")
+    print(f\"Jetzt > Start? {datetime.datetime.now() > b.get('Start', datetime.datetime.max)}\")
+    print()
+"
+```
+
+---
+
+## 💡 EMPFOHLENE EINSTELLUNG FÜR SCHULEN
+
+In `config.json` verwende diese Werte:
+
+```json
+{
+  "scheduler": {
+    "enabled": true,
+    "interval_minutes": 1,
+    "backup_interval_hours": 24
+  }
+}
+```
+
+Dies checkt **jede Minute** ob Termine aktiviert werden sollen - perfekt für Schulstunden.
+
+---
+
+## Weitere Hilfe?
+
+Falls das nicht funktioniert:
+1. Schreib mir die **exakte Uhrzeit** wann du die Ausleihe erstellt hast
+2. Und wann sie hätte aktiviert werden sollen
+3. Zeige mir ein Beispiel aus der DB mit `docker exec inventarsystem-mongodb mongosh...`

WEB_PUSH_NOTIFICATIONS.md

@@ -0,0 +1,442 @@
+# Web Push Notifications für Inventarsystem
+
+## Überblick
+
+Web Push Notifications ermöglichen es, Benutzer über wichtige Ereignisse in Echtzeit zu benachrichtigen, auch wenn sie die Anwendung nicht aktiv nutzen. Diese Implementierung nutzt:
+
+- **Service Workers** für Hintergrundprozesse und Offline-Unterstützung
+- **Web Push API** für Benachrichtigungen auf Desktop und Mobil
+- **MongoDB** zur Speicherung von Subscriptions
+- **VAPID-Authentifizierung** für sichere Push-Kommunikation
+
+## Architektur
+
+```
+┌─────────────────────────────────────────────────────┐
+│  Browser / Client-Side                              │
+├─────────────────────────────────────────────────────┤
+│  • Service Worker (static/service-worker.js)        │
+│  • Push Notification Manager (js/push-notifications) │
+│  • Web App Manifest (manifest.json)                 │
+└─────────────────────────────────────────────────────┘
+           ↕ (Push Subscriptions / Notifications)
+┌─────────────────────────────────────────────────────┐
+│  Server / Backend                                   │
+├─────────────────────────────────────────────────────┤
+│  • Flask API Endpoints (/api/push/*)                │
+│  • Push Notification Manager (push_notifications.py)│
+│  • MongoDB Collections (push_subscriptions)         │
+│  • VAPID Key Management                             │
+└─────────────────────────────────────────────────────┘
+           ↕ (VAPID-signed push messages)
+┌─────────────────────────────────────────────────────┐
+│  Push Service (Firebase, Web Push Service)          │
+├─────────────────────────────────────────────────────┤
+│  • Stores subscriptions                             │
+│  • Delivers push messages to browsers               │
+└─────────────────────────────────────────────────────┘
+```
+
+## Setup & Konfiguration
+
+### 1. VAPID-Schlüssel generieren
+
+VAPID-Schlüssel sind erforderlich für die Authentifizierung mit dem Push-Dienst:
+
+```bash
+cd /path/to/Inventarsystem
+bash generate-vapid-keys.sh
+```
+
+Dies erzeugt ein Schlüsselpaar. **Speichern Sie den Private Key sicher!**
+
+Beispielausgabe:
+```
+PUBLIC KEY (share with browsers):
+BBxyz...xyz
+
+PRIVATE KEY (keep secret!):
+AAabc...abc
+```
+
+### 2. Umgebungsvariablen setzen
+
+Speichern Sie die Schlüssel als Umgebungsvariablen:
+
+```bash
+export VAPID_PUBLIC_KEY="BBxyz...xyz"
+export VAPID_PRIVATE_KEY="AAabc...abc"
+export VAPID_SUBJECT="mailto:admin@inventarsystem.local"
+```
+
+Für Docker:
+```bash
+# In .env oder docker-compose.yml
+VAPID_PUBLIC_KEY=BBxyz...xyz
+VAPID_PRIVATE_KEY=AAabc...abc
+VAPID_SUBJECT=mailto:admin@inventarsystem.local
+```
+
+### 3. Abhängigkeiten installieren
+
+```bash
+pip install -r requirements.txt
+# oder
+pip install pywebpush
+```
+
+### 4. MongoDB Collection initialisieren
+
+Die `push_subscriptions` Collection wird automatisch erstellt beim ersten Speichern einer Subscription. Indizes werden automatisch erstellt durch:
+
+```python
+from Web.push_notifications import ensure_push_subscriptions_collection
+ensure_push_subscriptions_collection()
+```
+
+## API Endpoints
+
+### `POST /api/push/subscribe`
+
+Speichert eine Notification Subscription des Benutzers.
+
+**Request:**
+```json
+{
+    "subscription": {
+        "endpoint": "https://fcm.googleapis.com/fcm/send/...",
+        "keys": {
+            "p256dh": "BCOA...",
+            "auth": "kXA..."
+        }
+    }
+}
+```
+
+**Response:**
+```json
+{
+    "success": true,
+    "message": "Successfully subscribed to push notifications"
+}
+```
+
+---
+
+### `POST /api/push/unsubscribe`
+
+Deaktiviert eine Notification Subscription.
+
+**Request:**
+```json
+{
+    "endpoint": "https://fcm.googleapis.com/fcm/send/..."
+}
+```
+
+**Response:**
+```json
+{
+    "success": true,
+    "message": "Successfully unsubscribed from push notifications"
+}
+```
+
+---
+
+### `GET /api/push/subscriptions`
+
+Listet alle aktiven Subscriptions des aktuellen Benutzers auf.
+
+**Response:**
+```json
+{
+    "success": true,
+    "count": 2,
+    "subscriptions": [
+        {
+            "id": "507f1f77bcf86cd799439011",
+            "endpoint": "https://...",
+            "created_at": "2026-04-10T14:30:00",
+            "last_used": "2026-04-10T15:45:00",
+            "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)..."
+        }
+    ]
+}
+```
+
+---
+
+### `GET /api/push/vapid-key`
+
+Ruft den öffentlichen VAPID-Schlüssel ab (erforderlich für Browser).
+
+**Response:**
+```json
+{
+    "success": true,
+    "vapid_key": "BBxyz...xyz"
+}
+```
+
+---
+
+### `POST /api/push/test` (Admin only)
+
+Sendet eine Test-Benachrichtigung.
+
+**Request:**
+```json
+{
+    "target_user": "username"  // optional, default: current user
+}
+```
+
+**Response:**
+```json
+{
+    "success": true,
+    "message": "Test push sent to 2 subscription(s)"
+}
+```
+
+## Frontend Integration
+
+### Aktivierung in Settings
+
+Fügen Sie einen Container in Ihre Einstellungsseite ein:
+
+```html
+<div id="push-notification-settings"></div>
+
+<script src="{{ url_for('static', filename='js/push-notifications.js') }}"></script>
+<script>
+    document.addEventListener('DOMContentLoaded', function() {
+        showPushNotificationSettings();
+    });
+</script>
+```
+
+Dies zeigt einen Button und Subscription-Status an.
+
+### Manuelle Steuerung
+
+```javascript
+// Initialisieren
+await pushNotificationManager.init();
+
+// Benachrichtigungen aktivieren
+await pushNotificationManager.subscribe();
+
+// Benachrichtigungen deaktivieren
+await pushNotificationManager.unsubscribe();
+
+// Status prüfen
+const isSubscribed = await pushNotificationManager.isSubscribed();
+
+// Test-Benachrichtigung senden (Admin)
+await pushNotificationManager.sendTestNotification();
+```
+
+## Backend Integration
+
+### Benachrichtigungen versenden
+
+```python
+from Web import push_notifications as pn
+
+# Benachrichtigung an einen Benutzer
+pn.send_push_notification(
+    'username',
+    'Titel',
+    'Nachricht',
+    url='/my_borrowed_items',
+    reference={'item_id': '123', 'type': 'borrowing'}
+)
+
+# Benachrichtigung an alle Admins
+pn.send_push_to_all_admins(
+    'Admin Alert',
+    'Wichtiges Ereignis',
+    url='/main_admin'
+)
+```
+
+### Integration mit Notification-System
+
+Benachrichtigungen werden automatisch über Push versendet, wenn erstellt:
+
+```python
+# In app.py
+_create_notification(
+    db,
+    audience='user',
+    notif_type='borrowing_activated',
+    title='Ausleihung aktiviert',
+    message='Ihre geplante Ausleihung ist jetzt aktiv',
+    target_user='john_doe',
+    reference={'url': '/my_borrowed_items', 'item_id': '123'}
+)
+# → Schreibt in DB + sendet Push-Benachrichtigung
+```
+
+## MongoDB Schema
+
+### Collection: `push_subscriptions`
+
+```json
+{
+    "_id": ObjectId("..."),
+    "Username": "john_doe",
+    "Endpoint": "https://fcm.googleapis.com/fcm/send/...",
+    "Keys": {
+        "p256dh": "BCOA...",
+        "auth": "kXA..."
+    },
+    "SubscriptionHash": "abc123def456...",
+    "IsActive": true,
+    "CreatedAt": ISODate("2026-04-10T14:30:00Z"),
+    "LastUsed": ISODate("2026-04-10T15:45:00Z"),
+    "UserAgent": "Mozilla/5.0..."
+}
+```
+
+**Indizes:**
+- `Username` - Schnelle Abfrage nach Benutzer
+- `{Username: 1, IsActive: 1}` - Abfrage aktiver Subscriptions
+- `CreatedAt` - Zeitbasierte Bereinigung
+- `SubscriptionHash` - Eindeutigkeit, Duplikat-Verhinderung
+
+## Service Worker
+
+### Funktionen
+
+Die Service Worker (`static/service-worker.js`) behandelt:
+
+1. **Push Events** - Empfängt und zeigt Benachrichtigungen an
+2. **Click Handler** - Öffnet relevante URLs bei Benachrichtigungs-Klick
+3. **Offline Caching** - Speichert statische Assets offline
+4. **Background Sync** - Synchronisiert Daten im Hintergrund
+5. **Installation** - Installiert sich selbst und lädt Cache vor
+
+### Push-Payload-Format
+
+```json
+{
+    "title": "Ausleihung aktiviert",
+    "body": "Ihre geplante Ausleihung ist jetzt aktiv",
+    "icon": "/static/img/logo-192x192.png",
+    "badge": "/static/img/badge-72x72.png",
+    "tag": "notification-borrowing_activated",
+    "url": "/my_borrowed_items",
+    "reference": {
+        "item_id": "123",
+        "type": "borrowing"
+    }
+}
+```
+
+## Troubleshooting
+
+### Benachrichtigungen werden nicht empfangen
+
+1. **VAPID-Schlüssel nicht gesetzt**
+   ```bash
+   # Überprüfen
+   curl http://localhost:5000/api/push/vapid-key
+   # Sollte VAPID_PUBLIC_KEY zurückgeben, nicht "nicht konfiguriert"
+   ```
+
+2. **Service Worker nicht registriert**
+   - Browser DevTools → Application → Service Workers
+   - Sollte "activated and running" anzeigen
+   - Überprüfen Sie Console auf Fehler
+
+3. **Notification Permission verweigert**
+   - Browser-Einstellungen überprüfen
+   - Site-Benachrichtigungsberechtigungen zurücksetzen
+   - `chrome://settings/content/notifications` (Chrome)
+
+4. **No active subscriptions**
+   ```bash
+   # MongoDB überprüfen
+   db.push_subscriptions.find({Username: "username"})
+   # Sollte aktive Subscriptions anzeigen
+   ```
+
+### Debug-Befehle
+
+```bash
+# Alle Subscriptions anzeigen
+docker exec inventarsystem-mongodb mongosh --eval \
+  'db.push_subscriptions.find({}).pretty()' Inventarsystem
+
+# Test-Push senden
+curl -X POST http://localhost:5000/api/push/test \
+  -H "Content-Type: application/json" \
+  -c cookies.txt -b cookies.txt
+
+# Logs überprüfen
+docker logs inventarsystem-app | grep -i "push\|notification"
+```
+
+## Browser-Unterstützung
+
+| Browser | Desktop | Mobile | Service Worker | Push API |
+|---------|---------|--------|-----------------|----------|
+| Chrome | ✅ | ✅ | ✅ | ✅ |
+| Firefox | ✅ | ✅ | ✅ | ✅ |
+| Safari | ⚠️ | ✅ | ⚠️ | ⚠️ |
+| Edge | ✅ | ✅ | ✅ | ✅ |
+
+**Safari-Hinweis:** Verwendet Web Push über APNs mit Einschränkungen.
+
+## Best Practices
+
+### 1. Notification Häufigkeit
+- Nicht mehr als 1 Benachrichtigung pro Minute pro Benutzer
+- Sammelns Sie verwandte Events
+
+### 2. Payload-Größe
+- Halten Sie Nachrichten kurz (<100 Zeichen)
+- Verwenden Sie `reference` für Kontext, nicht `body`
+
+### 3. Sicherheit
+- **Private Key**: Niemals in Code commiten!
+- **Secrets**: Nur als Umgebungsvariablen speichern
+- **Validate**: Server-seitig alle Subscription-Daten validieren
+
+### 4. Datenschutz
+- Dokumentieren Sie Push-Sammlung (DSGVO)
+- Bieten Sie einfache Opt-out-Möglichkeit
+- Speichern Sie keine PII in Push-Nachrichten
+
+### 5. Wartung
+
+Stale Subscriptions automatisch bereinigen:
+
+```python
+# In Scheduler oder Cron-Job
+from Web.push_notifications import cleanup_inactive_subscriptions
+cleanup_inactive_subscriptions()  # Entfernt inaktive Subs älter als 30 Tage
+```
+
+## Performance-Tipps
+
+1. **Batch-Sends**: Senden Sie mehrere Pushes in einem Query
+2. **Async**: Verwenden Sie Background Tasks für Push-Sending
+3. **Redis**: Nutzen Sie Cache für häufig angeforderte VAPID-Keys
+4. **Indexes**: MongoDB-Indexes auf `Username`, `IsActive` sollten vorhanden sein
+
+## Zukünftige Erweiterungen
+
+- [ ] Action Buttons in Benachrichtigungen (Approve/Deny)
+- [ ] Benachrichtigungs-Kategorien und Gruppierung
+- [ ] Rich-Media-Unterstützung (Bilder, Video)
+- [ ] Scheduled Notifications
+- [ ] Analytics & Delivery Tracking
+
+---
+
+**Version:** 1.0 (Inventarsystem v0.5+)
+**Letzte Aktualisierung:** April 2026

Web/app.py

@@ -32,6 +32,7 @@ import user as us
 import items as it
 import ausleihung as au
 import audit_log as al
+import push_notifications as pn
 import datetime
 from apscheduler.schedulers.background import BackgroundScheduler
 from bson.objectid import ObjectId
@@ -745,8 +746,30 @@ def _create_notification(db, *, audience, notif_type, title, message, target_use
 
     if audience == 'user' and target_user:
         _bump_notification_version(f'user:{target_user}')
+        # Send push notification to user
+        try:
+            pn.send_push_notification(
+                target_user,
+                title,
+                message,
+                url=reference.get('url', '/') if reference else '/',
+                reference=reference,
+                tag=f'notification-{notif_type}'
+            )
+        except Exception as e:
+            app.logger.warning(f'Failed to send push notification to {target_user}: {e}')
     elif audience == 'admin':
         _bump_notification_version('admin')
+        # Send push notification to all admins
+        try:
+            pn.send_push_to_all_admins(
+                title,
+                message,
+                url=reference.get('url', '/') if reference else '/',
+                reference=reference
+            )
+        except Exception as e:
+            app.logger.warning(f'Failed to send push to admins: {e}')
 
     return True
 
@@ -1123,6 +1146,8 @@ def update_appointment_statuses():
 
         for appointment in appointments_to_check:
             old_status = appointment.get('Status')
+            activation_user = str(appointment.get('User') or '').strip()
+            activation_item_name = str(appointment.get('Item') or 'Termin')
 
             # Aktuellen Status bestimmen
             new_status = au.get_current_status(appointment, log_changes=True, user='scheduler')
@@ -1138,6 +1163,7 @@ def update_appointment_statuses():
                     item_id_str = appointment.get('Item')
                     conflict_detected = False
                     conflict_note = ''
+                    item_name = item_id_str or 'Termin'
                     if item_id_str:
                         try:
                             item_doc = items_col.find_one(
@@ -1145,6 +1171,8 @@ def update_appointment_statuses():
                                 {'Verfuegbar': 1, 'User': 1, 'Name': 1, 'Exemplare': 1}
                             )
                             if item_doc:
+                                item_name = item_doc.get('Name', item_id_str)
+                                activation_item_name = item_name
                                 total_exemplare = int(item_doc.get('Exemplare', 1))
                                 # Count how many active (non-planned) borrows currently hold this item
                                 active_borrows = ausleihungen.count_documents({
@@ -1191,8 +1219,46 @@ def update_appointment_statuses():
                     updated_count += 1
                     if new_status == 'active':
                         activated_count += 1
+                        # Make item unshareable if no conflict is detected
+                        if old_status == 'planned' and appointment.get('Item') and not extra_fields.get('ConflictDetected', False):
+                            try:
+                                it.update_item_status(str(appointment.get('Item')), False, activation_user)
+                            except Exception as e:
+                                app.logger.warning(f"Could not update item status to False for {appointment['_id']}: {e}")
+
                     elif new_status == 'completed':
                         completed_count += 1
+                        # Make item available again
+                        if appointment.get('Item'):
+                            try:
+                                it.update_item_status(str(appointment.get('Item')), True)
+                            except Exception as e:
+                                app.logger.warning(f"Could not update item status to True for {appointment['_id']}: {e}")
+
+                # Create activation notification even if another worker already updated the status.
+                if old_status == 'planned' and new_status == 'active' and activation_user:
+                    try:
+                        _create_notification(
+                            db,
+                            audience='user',
+                            notif_type='appointment_activated',
+                            title='Reservierung ist jetzt aktiv',
+                            message=(
+                                f"Deine geplante Ausleihe für {activation_item_name} startet jetzt."
+                            ),
+                            target_user=activation_user,
+                            reference={
+                                'appointment_id': str(appointment.get('_id')),
+                                'item_id': str(appointment.get('Item') or ''),
+                                'event': 'activated',
+                            },
+                            unique_key=f"appointment:activated:{appointment.get('_id')}",
+                            severity='info',
+                        )
+                    except Exception as notif_err:
+                        app.logger.warning(
+                            f"Failed to create activation notification for {appointment.get('_id')}: {notif_err}"
+                        )
 
         client.close()
 
@@ -1204,17 +1270,70 @@ def update_appointment_statuses():
     except Exception as e:
         app.logger.error(f"Automatic appointment status update failed: {e}")
 
-# Schedule jobs
+# Schedule jobs - only start scheduler if this is the main process or a single-worker deployment
+# This prevents race conditions in multi-worker Gunicorn environments
 scheduler = BackgroundScheduler()
-if cfg.SCHEDULER_ENABLED:
-    scheduler.add_job(func=create_daily_backup, trigger="interval", hours=cfg.BACKUP_INTERVAL_HOURS)
-    scheduler.add_job(func=update_appointment_statuses, trigger="interval", minutes=cfg.SCHEDULER_INTERVAL_MIN)
-    scheduler.add_job(func=create_return_reminders, trigger="interval", minutes=cfg.SCHEDULER_INTERVAL_MIN)
-    scheduler.start()
+_scheduler_initialized = False
+
+def _initialize_scheduler():
+    """Initialize the background scheduler in a safe way for multi-worker deployments."""
+    global _scheduler_initialized
+    if _scheduler_initialized or not cfg.SCHEDULER_ENABLED:
+        return
+    
+    try:
+        # For multi-worker Gunicorn, use a lock file to ensure only one instance starts the scheduler
+        # Clean up any stale lock file from previous runs (older than 5 minutes)
+        scheduler_lock_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), '.scheduler_lock')
+        try:
+            if os.path.exists(scheduler_lock_path):
+                lock_age = time.time() - os.path.getmtime(scheduler_lock_path)
+                if lock_age > 300:  # 5 minutes - indicates a stale lock from a previous container run
+                    os.remove(scheduler_lock_path)
+                    app.logger.info(f"Removed stale scheduler lock file (age: {lock_age:.0f}s)")
+        except Exception:
+            pass  # If we can't clean up, continue anyway
+        
+        try:
+            # Try to create the lock file - only succeeds if it doesn't exist
+            lock_fd = os.open(scheduler_lock_path, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o644)
+            os.close(lock_fd)
+            should_start = True
+        except FileExistsError:
+            should_start = False
+            app.logger.warning("Scheduler lock exists - another process is already running the scheduler")
+        
+        if should_start:
+            scheduler.add_job(func=create_daily_backup, trigger="interval", hours=cfg.BACKUP_INTERVAL_HOURS)
+            scheduler.add_job(func=update_appointment_statuses, trigger="interval", minutes=cfg.SCHEDULER_INTERVAL_MIN)
+            scheduler.add_job(func=create_return_reminders, trigger="interval", minutes=cfg.SCHEDULER_INTERVAL_MIN)
+            scheduler.start()
+            _scheduler_initialized = True
+            app.logger.info(f"Scheduler started successfully (interval={cfg.SCHEDULER_INTERVAL_MIN} min)")
+        else:
+            app.logger.info("Scheduler skipped - another worker instance is running it")
+    except Exception as e:
+        app.logger.error(f"Failed to initialize scheduler: {e}")
+        _scheduler_initialized = False
+
+# Initialize scheduler on app startup
+_initialize_scheduler()
 
 # Register shutdown handler to stop scheduler when app is terminated
 import atexit
-atexit.register(lambda: scheduler.shutdown() if cfg.SCHEDULER_ENABLED else None)
+def _shutdown_scheduler():
+    if cfg.SCHEDULER_ENABLED and _scheduler_initialized:
+        try:
+            scheduler.shutdown()
+            lock_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), '.scheduler_lock')
+            try:
+                os.remove(lock_path)
+            except Exception:
+                pass
+        except Exception as e:
+            app.logger.error(f"Error during scheduler shutdown: {e}")
+
+atexit.register(_shutdown_scheduler)
 
 def allowed_file(filename, file_content=None, max_size_mb=cfg.MAX_UPLOAD_MB):
     """
@@ -4040,6 +4159,9 @@ def get_items():
             'Filter3': 1,
             'Ort': 1,
             'User': 1,
+            'BlockedNow': 1,
+            'Reservierbar': 1,
+            'HasDamage': 1,
             'ItemType': 1,
         }
 
@@ -4183,6 +4305,83 @@ def get_item_json(id):
         return jsonify({'error': str(e)}), 500
 
 
+@app.route('/get_bookings')
+def get_bookings():
+    """Return calendar bookings for the current user session."""
+    if 'username' not in session:
+        return jsonify({'ok': False, 'error': 'unauthorized'}), 401
+
+    client = None
+    try:
+        username = session.get('username')
+        start = request.args.get('start')
+        end = request.args.get('end')
+
+        bookings = au.get_ausleihungen(status=['planned', 'active', 'completed'], start=start, end=end)
+
+        client = MongoClient(MONGODB_HOST, MONGODB_PORT)
+        db = client[MONGODB_DB]
+        items_col = db['items']
+
+        result = []
+        for booking in bookings:
+            start_dt = booking.get('Start')
+            if not start_dt:
+                continue
+
+            end_dt = booking.get('End')
+            if not end_dt and isinstance(start_dt, datetime.datetime):
+                end_dt = start_dt + datetime.timedelta(minutes=45)
+            elif not end_dt:
+                end_dt = start_dt
+
+            item_id = str(booking.get('Item') or '')
+            item_doc = None
+            if item_id:
+                try:
+                    item_doc = items_col.find_one({'_id': ObjectId(item_id)})
+                except Exception:
+                    item_doc = None
+
+            item_name = item_id or 'Ausleihe'
+            item_borrower = ''
+            if item_doc:
+                item_name = item_doc.get('Name') or item_doc.get('Code_4') or item_name
+                borrower_info = item_doc.get('BorrowerInfo') or {}
+                borrower_name = borrower_info.get('User') if isinstance(borrower_info, dict) else ''
+                item_borrower = str(item_doc.get('User') or borrower_name or '')
+
+            status = booking.get('Status') or 'unknown'
+            if status == 'active':
+                status = 'current'
+
+            period = booking.get('Period')
+            title = item_name
+            if period:
+                title = f"{title} - {period}. Std"
+
+            result.append({
+                'id': str(booking.get('_id')),
+                'title': title,
+                'start': start_dt.isoformat() if isinstance(start_dt, datetime.datetime) else str(start_dt),
+                'end': end_dt.isoformat() if isinstance(end_dt, datetime.datetime) else str(end_dt),
+                'status': status,
+                'itemId': item_id,
+                'userName': str(booking.get('User') or ''),
+                'notes': str(booking.get('Notes') or ''),
+                'period': period,
+                'isCurrentUser': str(booking.get('User') or '') == username,
+                'itemBorrower': item_borrower,
+            })
+
+        return jsonify({'ok': True, 'bookings': result})
+    except Exception as e:
+        return jsonify({'ok': False, 'error': str(e), 'bookings': []}), 500
+    finally:
+        if client:
+            client.close()
+
+
 @app.route('/api/booking_conflicts')
 def api_booking_conflicts():
     """
@@ -6577,17 +6776,19 @@ def plan_booking():
         
     try:
         # Extract form data
-        item_id = html.escape(request.form.get('item_id'))
-        start_date_str = html.escape(request.form.get('booking_date'))  # Changed from start_date to booking_date
-        end_date_str = html.escape(request.form.get('booking_end_date'))  # Changed from end_date to booking_end_date
-        period_start = html.escape(request.form.get('period_start'))
-        period_end = html.escape(request.form.get('period_end'))
-        notes = html.escape(request.form.get('notes', ''))
-        booking_type = html.escape(request.form.get('booking_type', 'single'))
+        item_id = (request.form.get('item_id') or '').strip()
+        start_date_str = (request.form.get('booking_date') or request.form.get('start_date') or '').strip()
+        end_date_str = (request.form.get('booking_end_date') or request.form.get('end_date') or '').strip()
+        period_start = (request.form.get('period_start') or '').strip()
+        period_end = (request.form.get('period_end') or '').strip()
+        notes = html.escape(request.form.get('notes', '') or '')
+        booking_type = (request.form.get('booking_type', 'single') or 'single').strip().lower()
         
         # Validate inputs
-        if not all([item_id, start_date_str, end_date_str, period_start]):
+        if not all([item_id, start_date_str, period_start]):
             return {"success": False, "error": "Missing required fields"}, 400
+        if not end_date_str:
+            end_date_str = start_date_str
             
         # Parse dates
         try:
@@ -6850,10 +7051,13 @@ def register():
         return redirect(url_for('login'))
     if 'username' in session:
         if request.method == 'POST':
-            username = request.form['username']
             password = request.form['password']
             name = (request.form.get('name') or '').strip()
             last_name = (request.form.get('last-name') or '').strip()
+
+            # Always generate username from abbreviation logic and auto-extend on collisions.
+            username = us.build_unique_username_from_name(name, last_name)
+            
             permission_preset = (request.form.get('permission_preset') or 'standard_user').strip()
             use_custom_permissions = request.form.get('use_custom_permissions') == 'on'
             is_student = bool(request.form.get('is_student')) if cfg.STUDENT_CARDS_MODULE_ENABLED else False
@@ -6862,9 +7066,6 @@ def register():
             if not username or not password or not name or not last_name:
                 flash('Bitte füllen Sie alle Felder aus', 'error')
                 return redirect(url_for('register'))
-            if us.get_user(username):
-                flash('Benutzer existiert bereits', 'error')
-                return redirect(url_for('register'))
             if not us.check_password_strength(password):
                 flash('Passwort ist zu schwach', 'error')
                 return redirect(url_for('register'))
@@ -8857,8 +9058,7 @@ def my_borrowed_items():
     
     planned_ausleihungen = list(ausleihungen_collection.find({
         'User': username,
-        'Status': 'planned',
-        'Start': {'$gt': current_time}
+        'Status': 'planned'
     }))
     
     # DEBUG: Log the number of planned appointments found
@@ -9490,21 +9690,76 @@ def schedule_appointment():
             print(f"Error checking for booking conflicts: {e}")
             return jsonify({'success': False, 'message': f'Fehler beim Prüfen der Verfügbarkeit: {str(e)}'}), 500
             
-        # Create the appointment as a planned booking
+        # Check if the appointment should already be active
+        now = datetime.datetime.now()
+        initial_status = 'active' if start_datetime <= now else 'planned'
+        
+        # Create the appointment
         try:
-            appointment_id = au.add_planned_booking(
+            # Use add_ausleihung directly to set the correct initial status
+            appointment_id = au.add_ausleihung(
                 item_id=item_id,
                 user=session['username'],
                 start_date=start_datetime,
                 end_date=end_datetime,
                 notes=notes,
+                status=initial_status,
                 period=booking_period # Will be None for multi-day
             )
             
+            # If it became active immediately, log it and send a notification
+            if initial_status == 'active' and appointment_id:
+                app.logger.info(f"Appointment {appointment_id} scheduled retroactively as active.")
+                
+                # Make the item unavailable since it is now actively borrowed
+                try:
+                    it.update_item_status(item_id, False, session['username'])
+                except Exception as update_err:
+                    app.logger.warning(f"Failed to update item status when retroactively activating: {update_err}")
+
+                # We can also notify the user right away
+                item_name = item.get('Name', 'Unbekannt')
+                
+                # Log audit event
+                _append_audit_event_standalone(
+                    'ausleihung_started',
+                    {
+                        'borrow_id': str(appointment_id),
+                        'item_id': item_id,
+                        'item_name': item_name,
+                        'user': session['username'],
+                        'status_before': 'planned',
+                        'status_after': 'active'
+                    }
+                )
+                
+                # Send notification
+                try:
+                    client_temp = MongoClient(MONGODB_HOST, MONGODB_PORT)
+                    db_temp = client_temp[MONGODB_DB]
+                    _create_notification(
+                        db_temp,
+                        audience='user',
+                        notif_type='appointment_activated',
+                        title='Reservierung ist jetzt aktiv',
+                        message=f"Deine geplante Ausleihe für {item_name} startet jetzt.",
+                        target_user=session['username'],
+                        reference={
+                            'appointment_id': str(appointment_id),
+                            'item_id': str(item_id),
+                            'event': 'activated',
+                        },
+                        unique_key=f"appointment:activated:{appointment_id}",
+                        severity='info'
+                    )
+                    client_temp.close()
+                except Exception as notif_err:
+                    app.logger.error(f"Error sending immediate active notification: {notif_err}")
+
             if not appointment_id:
                 return jsonify({'success': False, 'message': 'Termin konnte nicht erstellt werden'}), 500
         except Exception as e:
-            print(f"Error creating planned booking: {e}")
+            print(f"Error creating booking: {e}")
             return jsonify({'success': False, 'message': f'Fehler beim Erstellen des Termins: {str(e)}'}), 500
         
         # If we got this far, we have a valid appointment_id
@@ -9591,6 +9846,16 @@ def cancel_ausleihung_route(id):
         if au.cancel_ausleihung(id):
             print(f"Successfully canceled ausleihung with ID: {id}")
             flash('Ausleihung wurde erfolgreich storniert', 'success')
+            
+            # If the booking was already active, make the item available again
+            item_id = str(ausleihung.get('Item')) if ausleihung.get('Item') is not None else None
+            if ausleihung_status == 'active' and item_id:
+                try:
+                    it.update_item_status(item_id, True)
+                    print(f"Restored availability of item {item_id} after active cancellation")
+                except Exception as status_err:
+                    print(f"Warning: could not restore availability of item {item_id}: {status_err}")
+
             _append_audit_event_standalone(
                 'ausleihung_cancelled',
                 {
@@ -10498,3 +10763,182 @@ def get_optimal_image_quality(img, target_size_kb=80):
             return quality
     
     return best_quality
+
+
+# ============================================================================
+# PUSH NOTIFICATION API ENDPOINTS
+# ============================================================================
+
+@app.route('/api/push/subscribe', methods=['POST'])
+def subscribe_to_push():
+    """
+    Subscribe a user to push notifications
+    
+    Expects JSON payload:
+    {
+        'subscription': {
+            'endpoint': '...',
+            'keys': {'p256dh': '...', 'auth': '...'}
+        }
+    }
+    """
+    if 'username' not in session:
+        return jsonify({'success': False, 'error': 'Not authenticated'}), 401
+    
+    try:
+        data = request.get_json() or {}
+        subscription = data.get('subscription')
+        
+        if not subscription or not subscription.get('endpoint'):
+            return jsonify({'success': False, 'error': 'Invalid subscription'}), 400
+        
+        username = session['username']
+        success = pn.save_push_subscription(username, subscription)
+        
+        if success:
+            app.logger.info(f'Push subscription saved for {username}')
+            return jsonify({
+                'success': True,
+                'message': 'Successfully subscribed to push notifications'
+            })
+        else:
+            return jsonify({'success': False, 'error': 'Failed to save subscription'}), 500
+            
+    except Exception as e:
+        app.logger.error(f'Error subscribing to push: {e}')
+        return jsonify({'success': False, 'error': str(e)}), 500
+
+
+@app.route('/api/push/unsubscribe', methods=['POST'])
+def unsubscribe_from_push():
+    """
+    Unsubscribe a user from push notifications
+    
+    Expects JSON payload:
+    {
+        'endpoint': '...'
+    }
+    """
+    if 'username' not in session:
+        return jsonify({'success': False, 'error': 'Not authenticated'}), 401
+    
+    try:
+        data = request.get_json() or {}
+        endpoint = data.get('endpoint')
+        
+        if not endpoint:
+            return jsonify({'success': False, 'error': 'Missing endpoint'}), 400
+        
+        username = session['username']
+        success = pn.remove_push_subscription(username, endpoint)
+        
+        if success:
+            app.logger.info(f'Push subscription removed for {username}')
+            return jsonify({
+                'success': True,
+                'message': 'Successfully unsubscribed from push notifications'
+            })
+        else:
+            return jsonify({'success': False, 'error': 'Subscription not found'}), 404
+            
+    except Exception as e:
+        app.logger.error(f'Error unsubscribing from push: {e}')
+        return jsonify({'success': False, 'error': str(e)}), 500
+
+
+@app.route('/api/push/subscriptions', methods=['GET'])
+def get_push_subscriptions():
+    """
+    Get all push subscriptions for the current user
+    """
+    if 'username' not in session:
+        return jsonify({'success': False, 'error': 'Not authenticated'}), 401
+    
+    try:
+        username = session['username']
+        subscriptions = pn.get_user_subscriptions(username)
+        
+        # Convert ObjectIds to strings for JSON serialization
+        subs_data = []
+        for sub in subscriptions:
+            subs_data.append({
+                'id': str(sub['_id']),
+                'endpoint': sub.get('Endpoint', ''),
+                'created_at': sub.get('CreatedAt', '').isoformat() if sub.get('CreatedAt') else '',
+                'last_used': sub.get('LastUsed', '').isoformat() if sub.get('LastUsed') else '',
+                'user_agent': sub.get('UserAgent', ''),
+            })
+        
+        return jsonify({
+            'success': True,
+            'subscriptions': subs_data,
+            'count': len(subs_data)
+        })
+        
+    except Exception as e:
+        app.logger.error(f'Error getting push subscriptions: {e}')
+        return jsonify({'success': False, 'error': str(e)}), 500
+
+
+@app.route('/api/push/vapid-key', methods=['GET'])
+def get_vapid_key():
+    """
+    Get the VAPID public key for push notifications
+    Used by the service worker to communicate with push service
+    """
+    try:
+        vapid_key = pn.VAPID_PUBLIC_KEY
+        if not vapid_key:
+            app.logger.warning('VAPID_PUBLIC_KEY not configured')
+            return jsonify({
+                'success': False,
+                'error': 'Push notifications not configured on server'
+            }), 501
+        
+        return jsonify({
+            'success': True,
+            'vapid_key': vapid_key
+        })
+        
+    except Exception as e:
+        app.logger.error(f'Error getting VAPID key: {e}')
+        return jsonify({'success': False, 'error': str(e)}), 500
+
+
+@app.route('/api/push/test', methods=['POST'])
+def test_push_notification():
+    """
+    Send a test push notification (admin only)
+    """
+    if 'username' not in session:
+        return jsonify({'success': False, 'error': 'Not authenticated'}), 401
+    
+    if not us.is_admin(session['username']):
+        return jsonify({'success': False, 'error': 'Admin access required'}), 403
+    
+    try:
+        data = request.get_json() or {}
+        target_user = data.get('target_user', session['username'])
+        
+        sent = pn.send_push_notification(
+            target_user,
+            'Test Benachrichtigung',
+            'Dies ist eine Test-Benachrichtigung von Inventarsystem',
+            url='/',
+            tag='test-notification'
+        )
+        
+        if sent > 0:
+            return jsonify({
+                'success': True,
+                'message': f'Test push sent to {sent} subscription(s)'
+            })
+        else:
+            return jsonify({
+                'success': False,
+                'error': 'No active subscriptions for user'
+            }), 404
+            
+    except Exception as e:
+        app.logger.error(f'Error sending test push: {e}')
+        return jsonify({'success': False, 'error': str(e)}), 500

Web/ausleihung.py

@@ -85,6 +85,11 @@ def get_current_status(ausleihung, log_changes=False, user=None):
         new_status = 'completed'
     # Wenn die aktuelle Zeit vor dem Startdatum liegt, ist die Ausleihung geplant
     elif current_time < start_time:
+        # DEBUG: Log info wenn Booking noch lange in der Zukunft ist
+        time_until_start = (start_time - current_time).total_seconds()
+        if time_until_start > 3600:  # Mehr als 1 Stunde entfernt
+            ausleihung_id = str(ausleihung.get('_id', 'unknown'))[:12]
+            print(f"[DEBUG] Ausleihe {ausleihung_id} startet in {time_until_start/3600:.1f} Stunden ({start_time}), noch geplant")
         new_status = 'planned'
     # Wenn kein Enddatum gesetzt ist oder die aktuelle Zeit vor dem Enddatum liegt,
     # ist die Ausleihung aktiv

Web/items.py

@@ -287,15 +287,17 @@ def update_item_status(id, verfuegbar, user=None):
             'LastUpdated': datetime.datetime.now()
         }
 
+        update_query = {'$set': update_data}
+
         if user is not None:
             update_data['User'] = user
         elif verfuegbar:
             # If item is being marked as available, clear the user field
-            update_data['$unset'] = {'User': ""}
+            update_query['$unset'] = {'User': ""}
 
         result = items.update_one(
             {'_id': ObjectId(id)},
-            {'$set': update_data}
+            update_query
         )
 
         client.close()

Web/push_notifications.py

@@ -0,0 +1,421 @@
+"""
+Push Notification Management System
+Handles Web Push notifications for users via Service Workers
+"""
+
+import os
+import json
+import datetime
+from pymongo import MongoClient
+from bson import ObjectId
+import requests
+import hashlib
+import logging
+
+import settings as cfg
+
+logger = logging.getLogger(__name__)
+
+# VAPID keys for push notifications (should be in environment variables)
+VAPID_PUBLIC_KEY = os.getenv('VAPID_PUBLIC_KEY', '')
+VAPID_PRIVATE_KEY = os.getenv('VAPID_PRIVATE_KEY', '')
+VAPID_SUBJECT = os.getenv('VAPID_SUBJECT', f'mailto:admin@{os.getenv("SERVER_NAME", "localhost")}')
+
+# Push service endpoint (typically Firebase or Web Push Service)
+PUSH_SERVICE_URL = 'https://fcm.googleapis.com/fcm/send'  # Firebase Cloud Messaging
+FCM_API_KEY = os.getenv('FCM_API_KEY', '')  # Firebase API key
+
+
+def get_push_subscriptions_collection(db=None):
+    """Get MongoDB push subscriptions collection"""
+    if db is None:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+    return db['push_subscriptions']
+
+
+def get_user_subscriptions(username):
+    """
+    Get all active push subscriptions for a user
+    
+    Args:
+        username (str): Username
+        
+    Returns:
+        list: List of subscription documents
+    """
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+        subs_col = get_push_subscriptions_collection(db)
+        
+        subscriptions = list(subs_col.find({
+            'Username': username,
+            'IsActive': True
+        }))
+        
+        client.close()
+        return subscriptions
+    except Exception as e:
+        logger.error(f'Error getting push subscriptions for {username}: {e}')
+        return []
+
+
+def save_push_subscription(username, subscription_obj):
+    """
+    Save a new push subscription for a user
+    
+    Args:
+        username (str): Username
+        subscription_obj (dict): Subscription object from Service Worker
+        {
+            'endpoint': 'https://...',
+            'keys': {
+                'p256dh': '...',
+                'auth': '...'
+            }
+        }
+        
+    Returns:
+        bool: Success status
+    """
+    try:
+        if not subscription_obj.get('endpoint'):
+            logger.warning(f'Invalid subscription object for {username}')
+            return False
+        
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+        subs_col = get_push_subscriptions_collection(db)
+        
+        # Create unique hash of subscription to avoid duplicates
+        sub_hash = hashlib.md5(
+            f"{username}:{subscription_obj['endpoint']}".encode()
+        ).hexdigest()
+        
+        # Check if subscription already exists
+        existing = subs_col.find_one({
+            'Username': username,
+            'SubscriptionHash': sub_hash
+        })
+        
+        if existing:
+            # Update last used time
+            subs_col.update_one(
+                {'_id': existing['_id']},
+                {'$set': {
+                    'LastUsed': datetime.datetime.now(),
+                    'IsActive': True
+                }}
+            )
+            logger.info(f'Updated existing subscription for {username}')
+            client.close()
+            return True
+        
+        # Save new subscription
+        subscription_doc = {
+            'Username': username,
+            'Endpoint': subscription_obj['endpoint'],
+            'Keys': subscription_obj.get('keys', {}),
+            'SubscriptionHash': sub_hash,
+            'IsActive': True,
+            'CreatedAt': datetime.datetime.now(),
+            'LastUsed': datetime.datetime.now(),
+            'UserAgent': subscription_obj.get('userAgent', ''),
+        }
+        
+        subs_col.insert_one(subscription_doc)
+        logger.info(f'Saved new push subscription for {username}')
+        client.close()
+        return True
+        
+    except Exception as e:
+        logger.error(f'Error saving push subscription for {username}: {e}')
+        return False
+
+
+def remove_push_subscription(username, endpoint):
+    """
+    Remove a push subscription
+    
+    Args:
+        username (str): Username
+        endpoint (str): Subscription endpoint URL
+        
+    Returns:
+        bool: Success status
+    """
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+        subs_col = get_push_subscriptions_collection(db)
+        
+        result = subs_col.update_one(
+            {
+                'Username': username,
+                'Endpoint': endpoint
+            },
+            {'$set': {'IsActive': False}}
+        )
+        
+        client.close()
+        return result.modified_count > 0
+        
+    except Exception as e:
+        logger.error(f'Error removing push subscription for {username}: {e}')
+        return False
+
+
+def send_push_notification(username, title, body, icon=None, url='/', reference=None, tag='notification'):
+    """
+    Send a push notification to all user's subscriptions
+    
+    Args:
+        username (str): Target username
+        title (str): Notification title
+        body (str): Notification body
+        icon (str, optional): Icon URL
+        url (str, optional): URL to open on click
+        reference (dict, optional): Reference data (item_id, etc)
+        tag (str, optional): Notification tag for grouping
+        
+    Returns:
+        int: Number of successfully sent notifications
+    """
+    try:
+        subscriptions = get_user_subscriptions(username)
+        
+        if not subscriptions:
+            logger.debug(f'No active push subscriptions for {username}')
+            return 0
+        
+        sent_count = 0
+        
+        for subscription in subscriptions:
+            success = _send_to_subscription(
+                subscription,
+                title,
+                body,
+                icon,
+                url,
+                reference,
+                tag
+            )
+            if success:
+                sent_count += 1
+            else:
+                # Mark subscription as inactive if send fails
+                _mark_subscription_inactive(subscription['_id'])
+        
+        logger.info(f'Sent push notification to {username}: {sent_count}/{len(subscriptions)} subscriptions')
+        return sent_count
+        
+    except Exception as e:
+        logger.error(f'Error sending push notification to {username}: {e}')
+        return 0
+
+
+def _send_to_subscription(subscription, title, body, icon, url, reference, tag):
+    """Send push notification to a specific subscription"""
+    try:
+        payload = {
+            'title': title,
+            'body': body,
+            'icon': icon or '/static/img/logo-192x192.png',
+            'badge': '/static/img/badge-72x72.png',
+            'tag': tag,
+            'url': url,
+            'reference': reference or {},
+        }
+        
+        # If using Firebase Cloud Messaging
+        if FCM_API_KEY and subscription.get('Endpoint', '').startswith('https://fcm.'):
+            return _send_fcm_notification(subscription, payload)
+        
+        # Otherwise use standard Web Push Protocol
+        return _send_web_push_notification(subscription, payload)
+        
+    except Exception as e:
+        logger.error(f'Error sending to subscription {subscription.get("_id")}: {e}')
+        return False
+
+
+def _send_fcm_notification(subscription, payload):
+    """Send notification via Firebase Cloud Messaging"""
+    try:
+        if not FCM_API_KEY:
+            logger.warning('FCM_API_KEY not configured')
+            return False
+        
+        fcm_payload = {
+            'to': subscription['Endpoint'],
+            'notification': {
+                'title': payload['title'],
+                'body': payload['body'],
+                'icon': payload['icon'],
+                'badge': payload['badge'],
+                'tag': payload['tag'],
+                'click_action': payload['url'],
+            },
+            'data': {
+                'url': payload['url'],
+                'type': payload.get('type', 'info'),
+            }
+        }
+        
+        headers = {
+            'Authorization': f'key={FCM_API_KEY}',
+            'Content-Type': 'application/json'
+        }
+        
+        response = requests.post(
+            'https://fcm.googleapis.com/fcm/send',
+            json=fcm_payload,
+            headers=headers,
+            timeout=10
+        )
+        
+        return response.status_code == 200
+        
+    except Exception as e:
+        logger.error(f'FCM notification error: {e}')
+        return False
+
+
+def _send_web_push_notification(subscription, payload):
+    """Send notification using standard Web Push Protocol"""
+    try:
+        # This requires pywebpush library
+        from pywebpush import webpush
+        
+        webpush(
+            subscription_info={
+                'endpoint': subscription['Endpoint'],
+                'keys': subscription.get('Keys', {})
+            },
+            data=json.dumps(payload),
+            vapid_private_key=VAPID_PRIVATE_KEY,
+            vapid_claims={'sub': VAPID_SUBJECT},
+            timeout=10
+        )
+        
+        return True
+        
+    except ImportError:
+        logger.warning('pywebpush not installed, install with: pip install pywebpush')
+        return False
+    except Exception as e:
+        logger.error(f'Web push error: {e}')
+        return False
+
+
+def _mark_subscription_inactive(subscription_id):
+    """Mark a subscription as inactive (e.g., after failed send)"""
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+        subs_col = get_push_subscriptions_collection(db)
+        
+        subs_col.update_one(
+            {'_id': ObjectId(subscription_id)},
+            {'$set': {'IsActive': False}}
+        )
+        
+        client.close()
+    except Exception as e:
+        logger.error(f'Error marking subscription inactive: {e}')
+
+
+def send_push_to_all_admins(title, body, icon=None, url='/', reference=None):
+    """
+    Send a push notification to all admin users
+    
+    Args:
+        title (str): Notification title
+        body (str): Notification body
+        icon (str, optional): Icon URL
+        url (str, optional): URL to open on click
+        reference (dict, optional): Reference data
+        
+    Returns:
+        int: Total notifications sent
+    """
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+        users_col = db['users']
+        
+        # Get all admin users
+        admin_users = list(users_col.find(
+            {'IsAdmin': True},
+            {'Username': 1}
+        ))
+        
+        client.close()
+        
+        total_sent = 0
+        for admin_doc in admin_users:
+            sent = send_push_notification(
+                admin_doc['Username'],
+                title,
+                body,
+                icon,
+                url,
+                reference,
+                tag='admin-notification'
+            )
+            total_sent += sent
+        
+        logger.info(f'Sent push to all admins: {total_sent} notifications')
+        return total_sent
+        
+    except Exception as e:
+        logger.error(f'Error sending push to admins: {e}')
+        return 0
+
+
+def cleanup_inactive_subscriptions():
+    """
+    Remove inactive subscriptions older than 30 days
+    Run this periodically as a maintenance task
+    """
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+        subs_col = get_push_subscriptions_collection(db)
+        
+        cutoff_date = datetime.datetime.now() - datetime.timedelta(days=30)
+        
+        result = subs_col.delete_many({
+            'IsActive': False,
+            'LastUsed': {'$lt': cutoff_date}
+        })
+        
+        client.close()
+        logger.info(f'Cleaned up {result.deleted_count} inactive subscriptions')
+        return result.deleted_count
+        
+    except Exception as e:
+        logger.error(f'Error cleaning up subscriptions: {e}')
+        return 0
+
+
+# Database collection schema
+def ensure_push_subscriptions_collection():
+    """Ensure the push_subscriptions collection exists with proper indexes"""
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+        subs_col = get_push_subscriptions_collection(db)
+        
+        # Create indexes
+        subs_col.create_index('Username')
+        subs_col.create_index([('Username', 1), ('IsActive', 1)])
+        subs_col.create_index([('CreatedAt', 1)])  # TTL-like usage
+        subs_col.create_index('SubscriptionHash', unique=True)
+        
+        logger.info('Push subscriptions collection indexes created')
+        client.close()
+        
+    except Exception as e:
+        logger.error(f'Error ensuring push subscriptions collection: {e}')

Web/static/js/push-notifications.js

@@ -0,0 +1,470 @@
+/**
+ * Push Notification Management
+ * Handles subscription, unsubscription, and UI updates for web push notifications
+ */
+
+class PushNotificationManager {
+    constructor() {
+        this.serviceWorkerRegistration = null;
+        this.vapidKey = null;
+        this.isSupported = this.checkSupport();
+    }
+
+    /**
+     * Check if push notifications are supported
+     */
+    checkSupport() {
+        return (
+            'serviceWorker' in navigator &&
+            'PushManager' in window &&
+            'Notification' in window
+        );
+    }
+
+    /**
+     * Initialize push notification system
+     * Must be called after page load
+     */
+    async init() {
+        if (!this.isSupported) {
+            console.log('Push notifications not supported in this browser');
+            return false;
+        }
+
+        try {
+            // Get service worker registration
+            const registrations = await navigator.serviceWorker.getRegistrations();
+            this.serviceWorkerRegistration = registrations.find(
+                reg => reg.scope === window.location.origin + '/'
+            );
+
+            if (!this.serviceWorkerRegistration) {
+                console.warn('Service Worker not found, retrying...');
+                // Try registering if not already done
+                try {
+                    this.serviceWorkerRegistration = await navigator.serviceWorker.register('/static/service-worker.js');
+                } catch (err) {
+                    console.error('Failed to register Service Worker:', err);
+                    return false;
+                }
+            }
+
+            // Fetch VAPID public key from server
+            const keyResponse = await fetch('/api/push/vapid-key');
+            if (keyResponse.ok) {
+                const keyData = await keyResponse.json();
+                this.vapidKey = keyData.vapid_key;
+            } else {
+                console.warn('Failed to fetch VAPID key');
+                return false;
+            }
+
+            return true;
+        } catch (error) {
+            console.error('Failed to initialize push notifications:', error);
+            return false;
+        }
+    }
+
+    /**
+     * Request notification permission from user
+     */
+    async requestPermission() {
+        if (!this.isSupported) {
+            console.warn('Push notifications not supported');
+            return false;
+        }
+
+        if (Notification.permission === 'granted') {
+            console.log('Push notifications already permitted');
+            return true;
+        }
+
+        if (Notification.permission === 'denied') {
+            console.warn('Push notifications have been denied by user');
+            return false;
+        }
+
+        try {
+            const permission = await Notification.requestPermission();
+            return permission === 'granted';
+        } catch (error) {
+            console.error('Error requesting notification permission:', error);
+            return false;
+        }
+    }
+
+    /**
+     * Subscribe to push notifications
+     */
+    async subscribe() {
+        if (!this.isSupported) {
+            console.error('Push notifications not supported');
+            return false;
+        }
+
+        if (!this.serviceWorkerRegistration) {
+            console.error('Service Worker not initialized');
+            return false;
+        }
+
+        if (!this.vapidKey) {
+            console.error('VAPID key not available');
+            return false;
+        }
+
+        try {
+            // Check if already subscribed
+            const existingSubscription = await this.serviceWorkerRegistration.pushManager.getSubscription();
+            if (existingSubscription) {
+                console.log('Already subscribed to push notifications');
+                return await this.saveSubscriptionToServer(existingSubscription);
+            }
+
+            // Request permission if needed
+            const hasPermission = await this.requestPermission();
+            if (!hasPermission) {
+                console.warn('User denied notification permission');
+                return false;
+            }
+
+            // Subscribe to push service
+            const subscription = await this.serviceWorkerRegistration.pushManager.subscribe({
+                userVisibleOnly: true,
+                applicationServerKey: this.urlBase64ToUint8Array(this.vapidKey)
+            });
+
+            // Save subscription to server
+            return await this.saveSubscriptionToServer(subscription);
+        } catch (error) {
+            console.error('Failed to subscribe to push notifications:', error);
+            return false;
+        }
+    }
+
+    /**
+     * Unsubscribe from push notifications
+     */
+    async unsubscribe() {
+        if (!this.serviceWorkerRegistration) {
+            console.error('Service Worker not initialized');
+            return false;
+        }
+
+        try {
+            const subscription = await this.serviceWorkerRegistration.pushManager.getSubscription();
+            if (!subscription) {
+                console.warn('No active push subscription');
+                return false;
+            }
+
+            // Remove subscription on server
+            const success = await this.removeSubscriptionFromServer(subscription);
+
+            // Unsubscribe from push service
+            if (success) {
+                await subscription.unsubscribe();
+                return true;
+            }
+
+            return false;
+        } catch (error) {
+            console.error('Failed to unsubscribe from push notifications:', error);
+            return false;
+        }
+    }
+
+    /**
+     * Check if user is subscribed to push notifications
+     */
+    async isSubscribed() {
+        if (!this.serviceWorkerRegistration) {
+            return false;
+        }
+
+        try {
+            const subscription = await this.serviceWorkerRegistration.pushManager.getSubscription();
+            return subscription !== null;
+        } catch (error) {
+            console.error('Failed to check subscription status:', error);
+            return false;
+        }
+    }
+
+    /**
+     * Save subscription to server
+     */
+    async saveSubscriptionToServer(subscription) {
+        try {
+            const response = await fetch('/api/push/subscribe', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    subscription: subscription.toJSON()
+                })
+            });
+
+            if (response.ok) {
+                const data = await response.json();
+                console.log('Subscription saved to server:', data.message);
+                return true;
+            } else {
+                const error = await response.json();
+                console.error('Failed to save subscription:', error.error);
+                return false;
+            }
+        } catch (error) {
+            console.error('Error communicating with server:', error);
+            return false;
+        }
+    }
+
+    /**
+     * Remove subscription from server
+     */
+    async removeSubscriptionFromServer(subscription) {
+        try {
+            const response = await fetch('/api/push/unsubscribe', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    endpoint: subscription.endpoint
+                })
+            });
+
+            if (response.ok) {
+                console.log('Subscription removed from server');
+                return true;
+            } else {
+                const error = await response.json();
+                console.error('Failed to remove subscription:', error.error);
+                return false;
+            }
+        } catch (error) {
+            console.error('Error communicating with server:', error);
+            return false;
+        }
+    }
+
+    /**
+     * Get all subscriptions for current user
+     */
+    async getSubscriptions() {
+        try {
+            const response = await fetch('/api/push/subscriptions');
+            if (response.ok) {
+                const data = await response.json();
+                return data.subscriptions || [];
+            }
+            return [];
+        } catch (error) {
+            console.error('Error fetching subscriptions:', error);
+            return [];
+        }
+    }
+
+    /**
+     * Send test notification (admin only)
+     */
+    async sendTestNotification(targetUser = null) {
+        try {
+            const response = await fetch('/api/push/test', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    target_user: targetUser
+                })
+            });
+
+            if (response.ok) {
+                const data = await response.json();
+                console.log('Test notification sent:', data.message);
+                return true;
+            } else {
+                const error = await response.json();
+                console.error('Failed to send test notification:', error.error);
+                return false;
+            }
+        } catch (error) {
+            console.error('Error sending test notification:', error);
+            return false;
+        }
+    }
+
+    /**
+     * Convert VAPID key from base64 string to Uint8Array
+     * Required for subscribing to push service
+     */
+    urlBase64ToUint8Array(base64String) {
+        const padding = '='.repeat((4 - base64String.length % 4) % 4);
+        const base64 = (base64String + padding)
+            .replace(/\-/g, '+')
+            .replace(/_/g, '/');
+
+        const rawData = window.atob(base64);
+        const outputArray = new Uint8Array(rawData.length);
+
+        for (let i = 0; i < rawData.length; ++i) {
+            outputArray[i] = rawData.charCodeAt(i);
+        }
+
+        return outputArray;
+    }
+}
+
+// Create global instance
+const pushNotificationManager = new PushNotificationManager();
+
+/**
+ * Show notification subscription UI (typically in settings)
+ */
+function showPushNotificationSettings() {
+    const container = document.getElementById('push-notification-settings');
+    if (!container) return;
+
+    if (!pushNotificationManager.isSupported) {
+        container.innerHTML = '<p class="text-muted">Push-Benachrichtigungen werden in diesem Browser nicht unterstützt.</p>';
+        return;
+    }
+
+    const html = `
+        <div class="push-notification-settings">
+            <h5>Push-Benachrichtigungen</h5>
+            <p>Erhalten Sie Benachrichtigungen für wichtige Ereignisse direkt auf Ihrem Gerät.</p>
+            
+            <div id="push-status" style="margin: 15px 0;"></div>
+            
+            <button id="toggle-push-btn" class="btn btn-primary" style="margin-bottom: 10px;">
+                Benachrichtigungen aktivieren
+            </button>
+            
+            <div id="subscriptions-list" style="margin-top: 15px;"></div>
+        </div>
+    `;
+
+    container.innerHTML = html;
+
+    // Set up button handler
+    const toggleBtn = document.getElementById('toggle-push-btn');
+    pushNotificationManager.init().then(() => {
+        updatePushStatus();
+    });
+
+    toggleBtn.addEventListener('click', togglePushNotifications);
+}
+
+/**
+ * Update push notification status display
+ */
+async function updatePushStatus() {
+    const statusDiv = document.getElementById('push-status');
+    const toggleBtn = document.getElementById('toggle-push-btn');
+
+    if (!statusDiv || !toggleBtn) return;
+
+    const isSubscribed = await pushNotificationManager.isSubscribed();
+    const permission = Notification.permission;
+
+    let statusHtml = '<div class="alert alert-info">';
+
+    if (isSubscribed) {
+        statusHtml += '<strong>✓ Aktiv:</strong> Sie erhalten Push-Benachrichtigungen.';
+        toggleBtn.textContent = 'Benachrichtigungen deaktivieren';
+        toggleBtn.classList.remove('btn-primary');
+        toggleBtn.classList.add('btn-danger');
+    } else if (permission === 'denied') {
+        statusHtml += '<strong>✗ Blockiert:</strong> Benachrichtigungen wurden abgelehnt. Bitte überprüfen Sie Ihre Browser-Einstellungen.';
+        toggleBtn.disabled = true;
+        toggleBtn.textContent = 'Benachrichtigungen deaktiviert';
+    } else {
+        statusHtml += '<strong>○ Inaktiv:</strong> Sie erhalten derzeit keine Push-Benachrichtigungen.';
+        toggleBtn.textContent = 'Benachrichtigungen aktivieren';
+        toggleBtn.classList.add('btn-primary');
+        toggleBtn.classList.remove('btn-danger');
+    }
+
+    statusHtml += '</div>';
+    statusDiv.innerHTML = statusHtml;
+
+    // Show subscriptions list
+    const subscriptionsList = document.getElementById('subscriptions-list');
+    if (subscriptionsList && isSubscribed) {
+        const subs = await pushNotificationManager.getSubscriptions();
+        if (subs.length > 0) {
+            let subsHtml = '<h6>Aktive Abos:</h6><ul class="list-group">';
+            subs.forEach(sub => {
+                const endpoint = new URL(sub.endpoint);
+                subsHtml += `<li class="list-group-item"><small>${endpoint.hostname}</small><br><small class="text-muted">${sub.created_at}</small></li>`;
+            });
+            subsHtml += '</ul>';
+            subscriptionsList.innerHTML = subsHtml;
+        }
+    }
+}
+
+/**
+ * Toggle push notifications on/off
+ */
+async function togglePushNotifications() {
+    const isSubscribed = await pushNotificationManager.isSubscribed();
+
+    if (isSubscribed) {
+        // Unsubscribe
+        const success = await pushNotificationManager.unsubscribe();
+        if (success) {
+            showAlert('Benachrichtigungen deaktiviert', 'success');
+        } else {
+            showAlert('Fehler beim Deaktivieren der Benachrichtigungen', 'danger');
+        }
+    } else {
+        // Subscribe
+        const success = await pushNotificationManager.subscribe();
+        if (success) {
+            showAlert('Benachrichtigungen aktiviert!', 'success');
+        } else {
+            showAlert('Fehler beim Aktivieren der Benachrichtigungen', 'danger');
+        }
+    }
+
+    // Update status display
+    updatePushStatus();
+}
+
+/**
+ * Show an alert message
+ */
+function showAlert(message, type = 'info') {
+    // Try to show toast or alert
+    const alertDiv = document.createElement('div');
+    alertDiv.className = `alert alert-${type} alert-dismissible fade show`;
+    alertDiv.innerHTML = `
+        ${message}
+        <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
+    `;
+
+    // Find a good place to show the alert
+    const container = document.querySelector('.container-fluid') || document.body;
+    const firstElement = container.firstChild;
+
+    if (firstElement) {
+        container.insertBefore(alertDiv, firstElement);
+    } else {
+        container.appendChild(alertDiv);
+    }
+
+    // Auto-dismiss after 5 seconds
+    setTimeout(() => {
+        alertDiv.remove();
+    }, 5000);
+}
+
+// Auto-initialize on page load
+document.addEventListener('DOMContentLoaded', async () => {
+    await pushNotificationManager.init();
+});

Web/static/manifest.json

@@ -0,0 +1,134 @@
+{
+  "name": "Inventarsystem",
+  "short_name": "Inventar",
+  "description": "Verwaltungssystem für Schulinventare mit Ausleihmanagement",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "orientation": "portrait-primary",
+  "background_color": "#ffffff",
+  "theme_color": "#007bff",
+  "dir": "ltr",
+  "lang": "de-DE",
+  "prefer_related_applications": false,
+  "related_applications": [],
+  "icons": [
+    {
+      "src": "/static/img/logo-72x72.png",
+      "sizes": "72x72",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/static/img/logo-96x96.png",
+      "sizes": "96x96",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/static/img/logo-128x128.png",
+      "sizes": "128x128",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/static/img/logo-144x144.png",
+      "sizes": "144x144",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/static/img/logo-152x152.png",
+      "sizes": "152x152",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/static/img/logo-192x192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/static/img/logo-384x384.png",
+      "sizes": "384x384",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/static/img/logo-512x512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/static/img/logo-192x192-maskable.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "maskable"
+    },
+    {
+      "src": "/static/img/logo-512x512-maskable.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
+    }
+  ],
+  "screenshots": [
+    {
+      "src": "/static/img/screenshot-540x720.png",
+      "sizes": "540x720",
+      "type": "image/png",
+      "form_factor": "narrow"
+    },
+    {
+      "src": "/static/img/screenshot-1280x720.png",
+      "sizes": "1280x720",
+      "type": "image/png",
+      "form_factor": "wide"
+    }
+  ],
+  "categories": ["education", "productivity"],
+  "shortcuts": [
+    {
+      "name": "Meine Ausleihungen",
+      "short_name": "Ausleihungen",
+      "description": "Zeige meine aktuellen Ausleihungen",
+      "url": "/my_borrowed_items",
+      "icons": [
+        {
+          "src": "/static/img/shortcut-96x96.png",
+          "sizes": "96x96"
+        }
+      ]
+    },
+    {
+      "name": "Kalender",
+      "short_name": "Kalender",
+      "description": "Kalender für Ausleihplanungen",
+      "url": "/terminplan",
+      "icons": [
+        {
+          "src": "/static/img/shortcut-96x96.png",
+          "sizes": "96x96"
+        }
+      ]
+    }
+  ],
+  "share_target": {
+    "action": "/share",
+    "method": "POST",
+    "enctype": "multipart/form-data",
+    "params": {
+      "title": "title",
+      "text": "text",
+      "url": "url",
+      "files": [
+        {
+          "name": "media",
+          "accept": ["image/*", "video/*"]
+        }
+      ]
+    }
+  }
+}

Web/static/service-worker.js

@@ -0,0 +1,185 @@
+/**
+ * Service Worker for Web Push Notifications
+ * Handles incoming push events and displays notifications
+ */
+
+const CACHE_NAME = 'inventarsystem-v1';
+const ASSETS_TO_CACHE = [
+    '/',
+    '/static/css/styles.css',
+    '/static/js/scripts.js',
+    '/offline.html'
+];
+
+// Install event - cache assets
+self.addEventListener('install', (event) => {
+    console.log('[Service Worker] Installing...');
+    event.waitUntil(
+        caches.open(CACHE_NAME).then((cache) => {
+            return cache.addAll(ASSETS_TO_CACHE).catch((err) => {
+                console.warn('[Service Worker] Cache add error:', err);
+                // Don't fail the installation
+                return Promise.resolve();
+            });
+        })
+    );
+    self.skipWaiting();
+});
+
+// Activate event - clean up old caches
+self.addEventListener('activate', (event) => {
+    console.log('[Service Worker] Activating...');
+    event.waitUntil(
+        caches.keys().then((cacheNames) => {
+            return Promise.all(
+                cacheNames.map((cacheName) => {
+                    if (cacheName !== CACHE_NAME) {
+                        console.log('[Service Worker] Deleting old cache:', cacheName);
+                        return caches.delete(cacheName);
+                    }
+                })
+            );
+        })
+    );
+    self.clients.claim();
+});
+
+// Push event - handle incoming push notifications
+self.addEventListener('push', (event) => {
+    console.log('[Service Worker] Push notification received');
+    
+    let notificationData = {
+        title: 'Inventarsystem',
+        body: 'Neue Benachrichtigung',
+        icon: '/static/img/logo-192x192.png',
+        badge: '/static/img/badge-72x72.png',
+        tag: 'inventarsystem-notification',
+        requireInteraction: false,
+    };
+
+    // Parse the push event data if available
+    if (event.data) {
+        try {
+            const data = event.data.json();
+            notificationData = {
+                title: data.title || notificationData.title,
+                body: data.message || data.body || notificationData.body,
+                icon: data.icon || notificationData.icon,
+                badge: data.badge || notificationData.badge,
+                tag: data.tag || notificationData.tag,
+                requireInteraction: data.requireInteraction || false,
+                data: {
+                    url: data.url || '/',
+                    reference: data.reference || null,
+                    type: data.type || 'info',
+                },
+            };
+            console.log('[Service Worker] Push data parsed:', notificationData);
+        } catch (err) {
+            console.error('[Service Worker] Failed to parse push data:', err);
+            notificationData.body = event.data.text();
+        }
+    }
+
+    event.waitUntil(
+        self.registration.showNotification(notificationData.title, {
+            body: notificationData.body,
+            icon: notificationData.icon,
+            badge: notificationData.badge,
+            tag: notificationData.tag,
+            requireInteraction: notificationData.requireInteraction,
+            data: notificationData.data,
+            actions: [
+                {
+                    action: 'open',
+                    title: 'Öffnen',
+                    icon: '/static/img/open-icon.png'
+                },
+                {
+                    action: 'close',
+                    title: 'Schließen',
+                    icon: '/static/img/close-icon.png'
+                }
+            ],
+        })
+    );
+});
+
+// Notification click event - handle user clicks on notifications
+self.addEventListener('notificationclick', (event) => {
+    console.log('[Service Worker] Notification clicked:', event.action);
+    event.notification.close();
+
+    const urlToOpen = event.notification.data.url || '/';
+
+    event.waitUntil(
+        clients.matchAll({
+            type: 'window',
+            includeUncontrolled: true
+        }).then((windowClients) => {
+            // Check if the app is already open
+            for (let i = 0; i < windowClients.length; i++) {
+                const client = windowClients[i];
+                if (client.url === urlToOpen && 'focus' in client) {
+                    return client.focus();
+                }
+            }
+            // If not open, open a new window
+            if (clients.openWindow) {
+                return clients.openWindow(urlToOpen);
+            }
+        })
+    );
+});
+
+// Notification close event - track when users dismiss notifications
+self.addEventListener('notificationclose', (event) => {
+    console.log('[Service Worker] Notification closed');
+    // Could send analytics here
+});
+
+// Background fetch event (optional, for large data syncs)
+self.addEventListener('sync', (event) => {
+    console.log('[Service Worker] Background sync triggered:', event.tag);
+    if (event.tag === 'sync-notifications') {
+        event.waitUntil(
+            fetch('/api/notifications/sync').then((response) => {
+                console.log('[Service Worker] Notifications synced');
+            })
+        );
+    }
+});
+
+// Fetch event - serve cached content when offline
+self.addEventListener('fetch', (event) => {
+    // Skip non-GET requests
+    if (event.request.method !== 'GET') {
+        return;
+    }
+
+    // Skip API calls - always use network
+    if (event.request.url.includes('/api/')) {
+        return;
+    }
+
+    event.respondWith(
+        caches.match(event.request).then((response) => {
+            if (response) {
+                return response;
+            }
+            return fetch(event.request).then((response) => {
+                // Cache successful responses
+                if (response && response.status === 200) {
+                    const responseToCache = response.clone();
+                    caches.open(CACHE_NAME).then((cache) => {
+                        cache.put(event.request, responseToCache);
+                    });
+                }
+                return response;
+            }).catch(() => {
+                // Return offline page
+                return caches.match('/offline.html');
+            });
+        })
+    );
+});

Web/templates/base.html

@@ -24,6 +24,7 @@
     <link rel="stylesheet" href="{{ url_for('static', filename='css/styles.css', v=ASSET_VERSION) }}">
     <link rel="stylesheet" href="{{ url_for('static', filename='css/planned_appointments.css', v=ASSET_VERSION) }}">
     <link rel="icon" href="{{ url_for('static', filename='favicon.ico') }}">
+    <link rel="manifest" href="{{ url_for('static', filename='manifest.json') }}">>
     <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/js/bootstrap.bundle.min.js"></script>
     <script>
         (function () {
@@ -1752,5 +1753,28 @@
     <!-- Mobile compatibility scripts -->
     <script src="{{ url_for('static', filename='js/mobile_compatibility.js') }}"></script>
     <script src="{{ url_for('static', filename='js/ios_fixes.js') }}"></script>
+    
+    <!-- Service Worker Registration for Push Notifications -->
+    <script>
+        document.addEventListener('DOMContentLoaded', function() {
+            // Register service worker for push notifications and offline support
+            if ('serviceWorker' in navigator) {
+                navigator.serviceWorker.register('{{ url_for("static", filename="service-worker.js") }}')
+                    .then(function(registration) {
+                        console.log('Service Worker registered successfully:', registration);
+                        
+                        // Check if we have permission for push notifications
+                        if ('Notification' in window && Notification.permission === 'granted') {
+                            console.log('Push notifications already enabled');
+                        }
+                    })
+                    .catch(function(error) {
+                        console.warn('Service Worker registration failed:', error);
+                    });
+            } else {
+                console.log('Service Workers not supported in this browser');
+            }
+        });
+    </script>
 </body>
 </html>

Web/templates/main.html

@@ -799,10 +799,8 @@
     }
 
     function loadItems(offset = 0, append = false) {
-        // Für Pages nach der ersten: Explizit vollständige Daten laden (light_mode=false)
-        // Erste Page: light_mode wird automatisch enablet
-        const lightModeParam = offset > 0 ? '&light_mode=false' : '';
-        return fetch(`{{ url_for('get_items') }}?offset=${offset}&limit=${MAIN_ITEMS_PAGE_SIZE}${lightModeParam}`)
+        // Keep list payload lightweight; full details are fetched on-demand in openItemQuick.
+        return fetch(`{{ url_for('get_items') }}?offset=${offset}&limit=${MAIN_ITEMS_PAGE_SIZE}&light_mode=true`)
             .then(response => response.json())
             .then(data => {
                 const itemsContainer = document.querySelector('#items-container');
@@ -1073,12 +1071,9 @@
                                 
                                 // Stop event from bubbling up
                                 e.stopPropagation();
-                                
-                                // Get full item data with correct image paths
-                                const modalItemData = {...item};
-                                modalItemData.Images = item.Images ? item.Images.map(img => "{{ url_for('uploaded_file', filename='') }}" + img) : [];
-                                
-                                openItemModal(modalItemData);
+
+                                // Always load full, up-to-date item details for the modal.
+                                openItemQuick(item._id);
                             });
                         }
                     } catch (err) {
@@ -1414,6 +1409,76 @@
     }
 
     function openItemModal(item) {
+        const escapeHtml = (value) => String(value ?? '')
+            .replace(/&/g, '&')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#39;');
+
+        const formatHistoryDate = (value) => {
+            if (!value) return '-';
+            const dt = new Date(value);
+            if (Number.isNaN(dt.getTime())) {
+                return escapeHtml(value);
+            }
+            return dt.toLocaleString('de-DE', { day: '2-digit', month: '2-digit', year: 'numeric', hour: '2-digit', minute: '2-digit' });
+        };
+
+        const damageReports = Array.isArray(item.DamageReports) ? item.DamageReports : [];
+        const damageRepairs = Array.isArray(item.DamageRepairs) ? item.DamageRepairs : [];
+        const damageHistoryEntries = [];
+
+        damageReports.forEach((report) => {
+            damageHistoryEntries.push({
+                type: 'report',
+                rawDate: report?.reported_at || null,
+                dateLabel: formatHistoryDate(report?.reported_at),
+                actor: escapeHtml(report?.reported_by || '-'),
+                description: escapeHtml(report?.description || 'Schaden gemeldet'),
+                meta: '',
+            });
+        });
+
+        damageRepairs.forEach((repair) => {
+            const resolvedReports = Array.isArray(repair?.resolved_reports) ? repair.resolved_reports : [];
+            damageHistoryEntries.push({
+                type: 'repair',
+                rawDate: repair?.repaired_at || null,
+                dateLabel: formatHistoryDate(repair?.repaired_at),
+                actor: escapeHtml(repair?.repaired_by || '-'),
+                description: 'Als repariert markiert',
+                meta: `${resolvedReports.length} Meldung(en) abgeschlossen`,
+            });
+        });
+
+        damageHistoryEntries.sort((a, b) => {
+            const ta = a.rawDate ? new Date(a.rawDate).getTime() : 0;
+            const tb = b.rawDate ? new Date(b.rawDate).getTime() : 0;
+            return (Number.isNaN(tb) ? 0 : tb) - (Number.isNaN(ta) ? 0 : ta);
+        });
+
+        const damageHistoryHtml = damageHistoryEntries.length
+            ? damageHistoryEntries.map((entry) => {
+                const badgeStyle = entry.type === 'repair'
+                    ? 'background:#dcfce7;color:#166534;'
+                    : 'background:#fee2e2;color:#991b1b;';
+                const badgeText = entry.type === 'repair' ? 'Repariert' : 'Schaden';
+                const metaLine = entry.meta ? `<div style="font-size:0.84rem;color:#4b5563;">${escapeHtml(entry.meta)}</div>` : '';
+                return `
+                    <div style="border:1px solid #dbe3ee;border-radius:8px;padding:10px;background:#fff;display:grid;gap:6px;">
+                        <div style="display:flex;flex-wrap:wrap;gap:8px;align-items:center;">
+                            <span style="display:inline-block;padding:2px 8px;border-radius:999px;font-size:0.75rem;font-weight:700;${badgeStyle}">${badgeText}</span>
+                            <span style="font-size:0.84rem;color:#475569;">${entry.dateLabel}</span>
+                        </div>
+                        <div style="font-size:0.9rem;color:#0f172a;"><strong>Von:</strong> ${entry.actor}</div>
+                        <div style="font-size:0.92rem;color:#1f2937;">${entry.description}</div>
+                        ${metaLine}
+                    </div>
+                `;
+            }).join('')
+            : '<div style="font-size:0.92rem;color:#64748b;">Keine Beschädigungs-Historie vorhanden.</div>';
+
         // Get modal elements
         const modal = document.getElementById('item-modal');
         const modalContent = document.getElementById('modal-content-wrapper');
@@ -1571,6 +1636,19 @@
                     <div class="detail-value">${item.Beschreibung || '-'}</div>
                 </div>
 
+                <div class="detail-group full-width" style="margin-top:12px;">
+                    <div class="detail-label" style="font-weight:600; color:#374151;">Beschädigungs-Historie</div>
+                    <div class="detail-value">
+                        <button id="toggle-damage-history" class="calendar-toggle-btn" style="margin-bottom:12px; padding:10px 16px; border-radius:6px; background:#f3f4f6; border:1px solid #d1d5db; font-weight:500; cursor:pointer; display:inline-flex; align-items:center; gap:8px; transition:all 0.2s ease;">
+                            <span>🛠️</span>
+                            <span id="toggle-damage-history-text">Historie anzeigen</span>
+                        </button>
+                        <div id="damage-history-panel" style="display:none; margin-top:8px; border:1px solid #e7edf5; border-radius:10px; padding:12px; background:#f8fafc;">
+                            <div style="display:grid; gap:10px;">${damageHistoryHtml}</div>
+                        </div>
+                    </div>
+                </div>
+
                 <div class="detail-group full-width" style="margin-top:14px; padding:12px; border:1px solid #e5e7eb; border-radius:10px; background:#fbfbfd; box-shadow: 0 1px 1px rgba(0,0,0,0.03);">
                     <div class="detail-label" style="font-weight:600; color:#374151;">Verfügbarkeit prüfen</div>
                     <div class="detail-value">
@@ -1687,6 +1765,9 @@
         const detailsPanel = document.getElementById('calendar-day-details');
         const detailsDate = document.getElementById('cal-details-date');
         const detailsList = document.getElementById('cal-details-list');
+        const damageToggleBtn = document.getElementById('toggle-damage-history');
+        const damageHistoryPanel = document.getElementById('damage-history-panel');
+        const damageToggleText = document.getElementById('toggle-damage-history-text');
 
         let bookings = [];
         let currentDate = new Date();
@@ -1847,6 +1928,16 @@
             renderCalendar();
         });
 
+        damageToggleBtn?.addEventListener('click', () => {
+            const shouldOpen = damageHistoryPanel.style.display === 'none';
+            damageHistoryPanel.style.display = shouldOpen ? 'block' : 'none';
+            if (damageToggleText) {
+                damageToggleText.textContent = shouldOpen ? 'Historie verbergen' : 'Historie anzeigen';
+            }
+            damageToggleBtn.style.background = shouldOpen ? '#e0e7ff' : '#f3f4f6';
+            damageToggleBtn.style.borderColor = shouldOpen ? '#818cf8' : '#d1d5db';
+        });
+
         // Availability checker (user)
         const availDate = document.getElementById('avail-date');
         const availStart = document.getElementById('avail-start');

Web/templates/main_admin.html

@@ -3415,10 +3415,8 @@ document.addEventListener('DOMContentLoaded', ()=>{
     }
 
     function loadItems(offset = 0, append = false) {
-        // Für Pages nach der ersten: Explizit vollständige Daten laden (light_mode=false)
-        // Erste Page: light_mode wird automatisch enablet
-        const lightModeParam = offset > 0 ? '&light_mode=false' : '';
-        return fetch(`{{ url_for('get_items') }}?offset=${offset}&limit=${MAIN_ADMIN_ITEMS_PAGE_SIZE}${lightModeParam}`)
+        // Keep list payload lightweight; full details are fetched on-demand in openItemQuick.
+        return fetch(`{{ url_for('get_items') }}?offset=${offset}&limit=${MAIN_ADMIN_ITEMS_PAGE_SIZE}&light_mode=true`)
             .then(response => response.json())
             .then(data => {
                 const itemsContainer = document.querySelector('#items-container');
@@ -3592,6 +3590,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                             }
                         }
                         const damageCount = Array.isArray(item.DamageReports) ? item.DamageReports.length : 0;
+                        const hasDamage = Boolean(item.HasDamage) || damageCount > 0;
                         const groupedCount = Number(item.GroupedDisplayCount || 1);
                         const availableGroupedCount = Number(item.AvailableGroupedCount ?? (item.Verfuegbar ? 1 : 0));
                         const isGroupedItem = groupedCount > 1;
@@ -3608,7 +3607,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                                 <p class="item-col-filter3"><strong>Thema:</strong> ${filter3Display}${filter3More}</p>
                                 <p class="item-col-code"><strong>Barcode:</strong> ${item.Code_4 || '-'}</p>
                                 <p class="item-col-count"><strong>Anzahl:</strong> ${groupedCount}</p>
-                                ${damageCount > 0 ? `<div class="damage-badge">Schäden gemeldet: ${damageCount}</div>` : ''}
+                                ${hasDamage ? `<div class="damage-badge">${damageCount > 0 ? `Schäden gemeldet: ${damageCount}` : 'Schäden gemeldet'}</div>` : ''}
                                 <div class="image-container">
                                     ${imagesHtml}
                                 </div>
@@ -3680,11 +3679,8 @@ document.addEventListener('DOMContentLoaded', ()=>{
                                 }
                                 
                                 e.stopPropagation();
-                                
-                                const modalItemData = {...item};
-                                modalItemData.Images = item.Images ? item.Images.map(img => "{{ url_for('uploaded_file', filename='') }}" + img) : [];
-                                
-                                openItemModal(modalItemData);
+
+                                openItemQuick(item._id);
                             });
                         }
                     } catch (err) {
@@ -4004,6 +4000,22 @@ document.addEventListener('DOMContentLoaded', ()=>{
         applyFilters();
     }
 
+    // Open item modal with fresh details from backend.
+    function openItemQuick(id) {
+        fetch(`/get_item/${id}`)
+            .then(response => response.json())
+            .then(item => {
+                if (item && !item.error) {
+                    openItemModal(item);
+                } else {
+                    console.error('Item details could not be loaded:', item);
+                }
+            })
+            .catch(err => {
+                console.error('Error loading item details:', err);
+            });
+    }
+
     function openEditModalForSelectedUnit(defaultItemId, selectId) {
         let targetItemId = defaultItemId;
 
@@ -4303,14 +4315,58 @@ document.addEventListener('DOMContentLoaded', ()=>{
         }
 
         const damageReports = Array.isArray(item.DamageReports) ? item.DamageReports : [];
-        const damageInfoHtml = damageReports.length > 0
-            ? `<ul class="damage-list">${damageReports.map(report => {
-                const desc = escapeHtml(report?.description || '-');
-                const by = escapeHtml(report?.reported_by || 'Unbekannt');
-                const at = escapeHtml(formatDamageTimestamp(report?.reported_at));
-                return `<li><strong>${at}</strong> durch ${by}<br>${desc}</li>`;
-            }).join('')}</ul>`
-            : 'Keine Schäden erfasst.';
+        const damageRepairs = Array.isArray(item.DamageRepairs) ? item.DamageRepairs : [];
+        const damageHistoryEntries = [];
+
+        damageReports.forEach(report => {
+            damageHistoryEntries.push({
+                type: 'report',
+                timestamp: report?.reported_at || null,
+                dateLabel: escapeHtml(formatDamageTimestamp(report?.reported_at)),
+                actor: escapeHtml(report?.reported_by || 'Unbekannt'),
+                description: escapeHtml(report?.description || 'Schaden gemeldet'),
+                meta: '',
+            });
+        });
+
+        damageRepairs.forEach(repair => {
+            const resolvedReports = Array.isArray(repair?.resolved_reports) ? repair.resolved_reports : [];
+            damageHistoryEntries.push({
+                type: 'repair',
+                timestamp: repair?.repaired_at || null,
+                dateLabel: escapeHtml(formatDamageTimestamp(repair?.repaired_at)),
+                actor: escapeHtml(repair?.repaired_by || 'Unbekannt'),
+                description: 'Als repariert markiert',
+                meta: `${resolvedReports.length} Meldung(en) abgeschlossen`,
+            });
+        });
+
+        damageHistoryEntries.sort((a, b) => {
+            const ta = a.timestamp ? new Date(a.timestamp).getTime() : 0;
+            const tb = b.timestamp ? new Date(b.timestamp).getTime() : 0;
+            return (Number.isNaN(tb) ? 0 : tb) - (Number.isNaN(ta) ? 0 : ta);
+        });
+
+        const damageHistoryHtml = damageHistoryEntries.length > 0
+            ? damageHistoryEntries.map(entry => {
+                const badgeStyle = entry.type === 'repair'
+                    ? 'background:#dcfce7;color:#166534;'
+                    : 'background:#fee2e2;color:#991b1b;';
+                const badgeText = entry.type === 'repair' ? 'Repariert' : 'Schaden';
+                const metaLine = entry.meta ? `<div style="font-size:0.84rem;color:#4b5563;">${escapeHtml(entry.meta)}</div>` : '';
+                return `
+                    <div style="border:1px solid #dbe3ee;border-radius:8px;padding:10px;background:#fff;display:grid;gap:6px;">
+                        <div style="display:flex;flex-wrap:wrap;gap:8px;align-items:center;">
+                            <span style="display:inline-block;padding:2px 8px;border-radius:999px;font-size:0.75rem;font-weight:700;${badgeStyle}">${badgeText}</span>
+                            <span style="font-size:0.84rem;color:#475569;">${entry.dateLabel}</span>
+                        </div>
+                        <div style="font-size:0.9rem;color:#0f172a;"><strong>Von:</strong> ${entry.actor}</div>
+                        <div style="font-size:0.92rem;color:#1f2937;">${entry.description}</div>
+                        ${metaLine}
+                    </div>
+                `;
+            }).join('')
+            : '<div style="font-size:0.92rem;color:#64748b;">Keine Beschädigungs-Historie vorhanden.</div>';
         
         modalContent.innerHTML = `
             <h2>${item.Name}</h2>
@@ -4385,9 +4441,17 @@ document.addEventListener('DOMContentLoaded', ()=>{
                     <div class="detail-value">${item.Beschreibung || '-'}</div>
                 </div>
 
-                <div class="detail-group full-width">
-                    <div class="detail-label">Schäden:</div>
-                    <div class="detail-value">${damageInfoHtml}</div>
+                <div class="detail-group full-width" style="margin-top:12px;">
+                    <div class="detail-label" style="font-weight:600; color:#374151;">Beschädigungs-Historie</div>
+                    <div class="detail-value">
+                        <button id="toggle-damage-history" class="calendar-toggle-btn" style="margin-bottom:12px; padding:10px 16px; border-radius:6px; background:#f3f4f6; border:1px solid #d1d5db; font-weight:500; cursor:pointer; display:inline-flex; align-items:center; gap:8px; transition:all 0.2s ease;">
+                            <span>🛠️</span>
+                            <span id="toggle-damage-history-text">Historie anzeigen</span>
+                        </button>
+                        <div id="damage-history-panel" style="display:none; margin-top:8px; border:1px solid #e7edf5; border-radius:10px; padding:12px; background:#f8fafc;">
+                            <div style="display:grid; gap:10px;">${damageHistoryHtml}</div>
+                        </div>
+                    </div>
                 </div>
 
                 <div class="detail-group full-width" style="margin-top:12px; padding:10px; border:1px solid #e3e3e3; border-radius:8px;">
@@ -4486,6 +4550,9 @@ document.addEventListener('DOMContentLoaded', ()=>{
         const detailsPanel = document.getElementById('calendar-day-details');
         const detailsDate = document.getElementById('cal-details-date');
         const detailsList = document.getElementById('cal-details-list');
+        const damageToggleBtn = document.getElementById('toggle-damage-history');
+        const damageHistoryPanel = document.getElementById('damage-history-panel');
+        const damageToggleText = document.getElementById('toggle-damage-history-text');
 
         let bookings = [];
         let currentDate = new Date();
@@ -4645,6 +4712,16 @@ document.addEventListener('DOMContentLoaded', ()=>{
             renderCalendar();
         });
 
+        damageToggleBtn?.addEventListener('click', () => {
+            const shouldOpen = damageHistoryPanel.style.display === 'none';
+            damageHistoryPanel.style.display = shouldOpen ? 'block' : 'none';
+            if (damageToggleText) {
+                damageToggleText.textContent = shouldOpen ? 'Historie verbergen' : 'Historie anzeigen';
+            }
+            damageToggleBtn.style.background = shouldOpen ? '#e0e7ff' : '#f3f4f6';
+            damageToggleBtn.style.borderColor = shouldOpen ? '#818cf8' : '#d1d5db';
+        });
+
 
         // Availability checker
         const availDate = document.getElementById('avail-date');

Web/templates/register.html

@@ -34,22 +34,22 @@
         <div class="form-card">
             <form method="POST" action="{{ url_for('register') }}">
                 <div class="form-group">
-                    <label for="username">Benutzername</label>
-                    <div class="input-container">
-                        <span class="input-icon">👤</span>
-                        <input type="text" id="username" name="username" placeholder="Geben Sie einen Benutzernamen ein" required>
-                    </div>
                     <label for="name">Vorname</label>
                     <div class="input-container">
                         <span class="input-icon">👤</span>
-                        <input type="text" id="name" name="name" placeholder="Geben Sie den Vornamen ein" required>
+                        <input type="text" id="name" name="name" placeholder="Geben Sie den Vornamen ein" required onchange="generateUsername()" oninput="generateUsername()">
                     </div>
                     <label for="last-name">Nachname</label>
                     <div class="input-container">
                         <span class="input-icon">👤</span>
-                        <input type="text" id="last-name" name="last-name" placeholder="Geben Sie den Nachnamen ein" required>
+                        <input type="text" id="last-name" name="last-name" placeholder="Geben Sie den Nachnamen ein" required onchange="generateUsername()" oninput="generateUsername()">
                     </div>
-                    <p class="anonymize-hint">Klarnamen werden nur zur Erzeugung eines Kuerzels (z.B. SimFri) verwendet und nicht als Klarname gespeichert.</p>
+                    <label for="username">Benutzername <span style="color: #9ca3af;">(wird automatisch generiert)</span></label>
+                    <div class="input-container">
+                        <span class="input-icon">👤</span>
+                        <input type="text" id="username" name="username" placeholder="Automatisch aus Name und Nachname" readonly style="background-color: #f3f4f6; cursor: not-allowed;">
+                    </div>
+                    <p class="anonymize-hint">Klarnamen werden nur zur Erzeugung des Benutzernamens als Kürzel (z.B. SimFri) verwendet; bei Kollision wird automatisch ein Buchstabe mehr genommen.</p>
                 </div>
                 
                 <div class="form-group">
@@ -446,6 +446,46 @@ input::placeholder {
 </style>
 
 <script>
+// Function to generate username from first and last name (helper function)
+function cleanNameForUsername(text) {
+    if (!text) return '';
+    // Remove special characters, convert umlauts, lowercase
+    let cleaned = text
+        .replace(/[^a-zA-Zäöüß\s-]/g, '')
+        .trim()
+        .toLowerCase();
+    
+    // Convert German umlauts to ASCII
+    cleaned = cleaned
+        .replace(/ä/g, 'ae')
+        .replace(/ö/g, 'oe')
+        .replace(/ü/g, 'ue')
+        .replace(/ß/g, 'ss');
+    
+    return cleaned;
+}
+
+// Generate username from name and last_name fields
+function generateUsername() {
+    const firstName = cleanNameForUsername(document.getElementById('name').value || '');
+    const lastName = cleanNameForUsername(document.getElementById('last-name').value || '');
+    let username = '';
+    
+    if (firstName && lastName) {
+        username = (firstName.slice(0, 3) + lastName.slice(0, 3));
+    } else if (firstName) {
+        username = firstName.slice(0, 6);
+    } else if (lastName) {
+        username = lastName.slice(0, 6);
+    }
+    
+    // Set the username field
+    const usernameField = document.getElementById('username');
+    if (usernameField) {
+        usernameField.value = username || '';
+    }
+}
+
 document.addEventListener('DOMContentLoaded', function () {
     const permissionPresets = {{ permission_presets | tojson }};
     const presetSelect = document.getElementById('permission-preset');

Web/user.py

@@ -57,6 +57,52 @@ def build_name_synonym(first_name, last_name=''):
     return combined[:6].title()
 
 
+def build_username_from_name(first_name, last_name=''):
+    """
+    Build a deterministic username abbreviation from first and last name.
+    Uses the same short alias logic (e.g. SimFri) and stores it lowercase.
+    
+    Args:
+        first_name (str): First name
+        last_name (str): Last name (optional)
+        
+    Returns:
+        str: Generated username
+    """
+    alias = build_name_synonym(first_name, last_name)
+    return alias.lower()
+
+
+def build_unique_username_from_name(first_name, last_name=''):
+    """
+    Build a unique username based on the abbreviation logic.
+    If a collision occurs, increase the username by one additional letter
+    from the combined cleaned name until it is unique.
+    """
+    first = _clean_name_fragment(first_name)
+    last = _clean_name_fragment(last_name)
+    combined = (first + last).lower()
+
+    base_username = build_username_from_name(first_name, last_name)
+    if not combined:
+        combined = base_username or 'user'
+
+    start_len = len(base_username) if base_username else min(6, len(combined))
+    start_len = max(1, min(start_len, len(combined)))
+
+    # Main strategy: take one more letter on each collision.
+    for length in range(start_len, len(combined) + 1):
+        candidate = combined[:length]
+        if not get_user(candidate):
+            return candidate
+
+    # Fallback if full combined name is already taken repeatedly.
+    suffix = 2
+    while get_user(f"{combined}{suffix}"):
+        suffix += 1
+    return f"{combined}{suffix}"
+
+
 ACTION_PERMISSION_KEYS = (
     'can_borrow',
     'can_insert',

debug_booking.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+"""
+Debug script to check why planned bookings are not being activated
+"""
+import sys
+import os
+import datetime
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'Web'))
+
+from pymongo import MongoClient
+import settings as cfg
+import ausleihung as au
+
+def check_bookings():
+    """Check all planned bookings and their status"""
+    client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+    db = client[cfg.MONGODB_DB]
+    ausleihungen = db['ausleihungen']
+    
+    # Get all planned bookings
+    planned = list(ausleihungen.find({'Status': 'planned'}))
+    
+    print(f"\n📊 Gefundene GEPLANTE Ausleihen: {len(planned)}\n")
+    print("=" * 100)
+    
+    current_time = datetime.datetime.now()
+    print(f"⏰ Aktuelle Zeit: {current_time}\n")
+    
+    for booking in planned:
+        booking_id = str(booking['_id'])
+        user = booking.get('User', 'N/A')
+        item = booking.get('Item', 'N/A')
+        start = booking.get('Start')
+        end = booking.get('End')
+        period = booking.get('Period')
+        status = booking.get('Status')
+        
+        print(f"\n🔹 Ausleihe ID: {booking_id}")
+        print(f"   Benutzer: {user}")
+        print(f"   Item: {item}")
+        print(f"   Status: {status}")
+        print(f"   Schulstunde/Periode: {period}")
+        print(f"   Start: {start} (Typ: {type(start).__name__})")
+        print(f"   Ende: {end} (Typ: {type(end).__name__})")
+        
+        # Check current status
+        current_status = au.get_current_status(booking, log_changes=False)
+        print(f"   ✓ Berechneter Status: {current_status}")
+        
+        if current_status != status:
+            print(f"   ⚠️  STATUS STIMMT NICHT ÜBEREIN! Sollte sein: {current_status}")
+        
+        # Check time comparison
+        if start:
+            time_diff = (current_time - start).total_seconds()
+            if time_diff < 0:
+                print(f"   ⏳ Startet in: {abs(time_diff) / 60:.1f} Minuten")
+            elif time_diff < 3600:
+                print(f"   ✓ Sollte JETZT AKTIV sein! ({time_diff / 60:.1f} Minuten vorbei)")
+            else:
+                print(f"   ✓ Sollte schon {time_diff / 3600:.1f} Stunden aktiv sein!")
+    
+    print("\n" + "=" * 100)
+    
+    # Check active bookings too
+    active = list(ausleihungen.find({'Status': 'active'}))
+    print(f"\n✓ AKTIVE Ausleihen: {len(active)}")
+    for booking in active:
+        print(f"  - {booking.get('User', 'N/A')}: {booking.get('Item', 'N/A')} (Periode: {booking.get('Period')})")
+    
+    client.close()
+
+if __name__ == '__main__':
+    check_bookings()

docker-compose-multitenant.yml

@@ -16,8 +16,10 @@ services:
     container_name: inventarsystem-nginx
     restart: unless-stopped
     depends_on:
-      - app
-      - redis
+      app:
+        condition: service_started
+      redis:
+        condition: service_started
     ports:
       - "${INVENTAR_HTTP_PORT:-80}:80"
       - "${INVENTAR_HTTPS_PORT:-443}:443"

docker-compose.yml

@@ -4,7 +4,8 @@ services:
     container_name: inventarsystem-nginx
     restart: unless-stopped
     depends_on:
-      - app
+      app:
+        condition: service_started
     ports:
       - "${INVENTAR_HTTP_PORT:-80}:80"
       - "${INVENTAR_HTTPS_PORT:-443}:443"

generate-vapid-keys.sh

@@ -0,0 +1,81 @@
+#!/bin/bash
+
+# VAPID Key Generation Script for Web Push Notifications
+# Generates VAPID (Voluntary Application Server Identification) keys required for push notifications
+
+echo "==========================================="
+echo "VAPID Key Generation for Inventarsystem"
+echo "==========================================="
+echo ""
+
+# Check if Python is available
+if ! command -v python3 &> /dev/null; then
+    echo "❌ Error: Python 3 is required but not installed."
+    exit 1
+fi
+
+# Check if pywebpush is installed
+echo "Checking for pywebpush..."
+python3 -c "import pywebpush" 2>/dev/null
+
+if [ $? -ne 0 ]; then
+    echo "Installing pywebpush..."
+    pip3 install pywebpush
+    if [ $? -ne 0 ]; then
+        echo "❌ Error: Failed to install pywebpush"
+        echo "Please install manually: pip3 install pywebpush"
+        exit 1
+    fi
+fi
+
+echo "✓ pywebpush is installed"
+echo ""
+
+# Generate VAPID keys
+echo "Generating VAPID keys..."
+python3 << 'EOF'
+from pywebpush import generate_keys
+
+try:
+    keys = generate_keys()
+    print("✓ VAPID Keys generated successfully!")
+    print("")
+    print("PUBLIC KEY (share with browsers):")
+    print(keys['public_key'])
+    print("")
+    print("PRIVATE KEY (keep secret!):")
+    print(keys['private_key'])
+    print("")
+    print("==========================================="
+    print("Add these to your environment variables:")
+    print("==========================================="
+    print("")
+    print("export VAPID_PUBLIC_KEY='" + keys['public_key'] + "'")
+    print("export VAPID_PRIVATE_KEY='" + keys['private_key'] + "'")
+    print("export VAPID_SUBJECT='mailto:admin@yourdomain.com'")
+    print("")
+    print("Or add to your .env file:")
+    print("")
+    print("VAPID_PUBLIC_KEY=" + keys['public_key'])
+    print("VAPID_PRIVATE_KEY=" + keys['private_key'])
+    print("VAPID_SUBJECT=mailto:admin@yourdomain.com")
+    print("")
+    print("⚠️  IMPORTANT: Keep the PRIVATE KEY secret!")
+    print("==========================================="
+    
+except Exception as e:
+    print(f"❌ Error generating VAPID keys: {e}")
+    exit(1)
+EOF
+
+if [ $? -eq 0 ]; then
+    echo ""
+    echo "✓ Next steps:"
+    echo "1. Copy the PUBLIC KEY to your browser-side code"
+    echo "2. Set the PRIVATE KEY in your server environment"
+    echo "3. Update config.json with your email address"
+    echo "4. Test with: curl http://localhost:5000/api/push/vapid-key"
+else
+    echo "❌ Error generating keys"
+    exit 1
+fi

gunicorn.conf.py

@@ -0,0 +1,42 @@
+"""
+Gunicorn configuration for Inventarsystem.
+
+This configuration ensures that:
+1. The BackgroundScheduler runs reliably in only one worker process
+2. Appointment status updates and reminders work correctly
+3. Multi-worker deployments don't cause race conditions
+"""
+
+import os
+import sys
+from pathlib import Path
+
+# Get project root
+PROJECT_ROOT = Path(__file__).parent
+
+# Basic configuration
+bind = "unix:/tmp/inventarsystem.sock"
+workers = 1  # CRITICAL: Only 1 worker to prevent BackgroundScheduler race conditions
+worker_class = "sync"
+timeout = 60
+graceful_timeout = 20
+max_requests = 1000
+max_requests_jitter = 100
+
+# Logging
+accesslog = str(PROJECT_ROOT / "logs" / "access.log")
+errorlog = str(PROJECT_ROOT / "logs" / "error.log")
+log_level = "info"
+capture_output = True
+
+# Worker initialization hook to ensure scheduler starts only once
+def on_starting(server):
+    """Called just before the master process is initialized."""
+    print("[GUNICORN] Starting Inventarsystem with scheduler support (1 worker only)")
+
+def when_ready(server):
+    """Called just after the server is started."""
+    print("[GUNICORN] Server is ready. Scheduler should be active in the single worker process.")
+
+# Ensure the logs directory exists
+os.makedirs(PROJECT_ROOT / "logs", exist_ok=True)

install.sh

@@ -68,45 +68,85 @@ with open(compose_file, "r", encoding="utf-8") as f:
     lines = f.readlines()
 
 out = []
-in_app = False
-in_build = False
-image_set = False
+in_app_service = False
+app_indent = None
+app_service_indent = None
+build_found = False
 
-for line in lines:
+def leading_spaces(text):
+    return len(text) - len(text.lstrip(" "))
+
+i = 0
+while i < len(lines):
+    line = lines[i]
     stripped = line.lstrip(" ")
-    indent = len(line) - len(stripped)
+    indent = leading_spaces(line)
 
-    if not in_app and re.match(r"^\s{2}app:\s*$", line):
-        in_app = True
-        image_set = False
+    # Check if we're starting the app service
+    if not in_app_service and re.match(r"^\s*app:\s*$", line):
+        in_app_service = True
+        app_indent = indent
+        app_service_indent = None
+        build_found = False
         out.append(line)
-        out.append(f"    image: {target_image}\n")
-        image_set = True
+        i += 1
         continue
 
-    if in_app:
-        if indent == 2 and re.match(r"^[A-Za-z0-9_-]+:\s*$", stripped):
-            in_app = False
-            in_build = False
+    # Check if we've exited the app service (found another top-level service)
+    if in_app_service and indent <= app_indent and re.match(r"^[A-Za-z0-9_-]+:\s*$", stripped):
+        # We've left the app service - insert image if we haven't already
+        if build_found and app_service_indent is not None:
+            out.append(f"{' ' * app_service_indent}image: {target_image}\n")
+        in_app_service = False
+        out.append(line)
+        i += 1
+        continue
 
-        if in_app:
-            if in_build:
-                if indent > 4:
-                    continue
-                in_build = False
+    # Process lines within the app service
+    if in_app_service:
+        if app_service_indent is None and indent > app_indent:
+            app_service_indent = indent
 
-            if re.match(r"^\s{4}build:\s*$", line):
-                in_build = True
-                continue
+        # Check for image key (already has an image, don't add)
+        if re.match(rf"^\s+image:\s*", line):
+            in_app_service = False
+            out.append(line)
+            i += 1
+            continue
 
-            if re.match(r"^\s{4}image:\s*", line):
-                if image_set:
-                    continue
-                out.append(f"    image: {target_image}\n")
-                image_set = True
-                continue
+        # Check for build block
+        if re.match(rf"^\s+build:\s*$", line):
+            build_found = True
+            out.append(line)
+            i += 1
+            # Skip all lines that are part of the build block (indented more than app_service_indent)
+            while i < len(lines):
+                next_line = lines[i]
+                next_indent = leading_spaces(next_line)
+                if next_indent > app_service_indent and next_line.strip():
+                    out.append(next_line)
+                    i += 1
+                else:
+                    break
+            continue
+
+        # Insert image after build block before first property
+        if build_found and app_service_indent is not None and indent == app_service_indent:
+            # Check if this is a property line (not build)
+            if not re.match(rf"^\s+build:", line):
+                out.append(f"{' ' * app_service_indent}image: {target_image}\n")
+                build_found = False  # Mark that we've inserted the image
+
+        out.append(line)
+        i += 1
+        continue
 
     out.append(line)
+    i += 1
+
+# If we ended while still in the app service, append image at the end
+if in_app_service and build_found and app_service_indent is not None:
+    out.append(f"{' ' * app_service_indent}image: {target_image}\n")
 
 with open(compose_file, "w", encoding="utf-8") as f:
     f.writelines(out)

requirements.txt

@@ -12,4 +12,5 @@ redis
 reportlab
 python-barcode
 openpyxl
-cryptography
+cryptography
+pywebpush