Refactor MongoClient import: standardize import statements across push_notifications, tenant, and verify_audit_chain modules

Web/app.py

@@ -7116,7 +7116,7 @@ def register():
             name = (request.form.get('name') or '').strip()
             last_name = (request.form.get('last-name') or '').strip()
 
-            # Always generate username from abbreviation logic and auto-extend on collisions.
+            # Generate a username from the first 2 letters of first and last name.
             username = us.build_unique_username_from_name(name, last_name)
             
             permission_preset = (request.form.get('permission_preset') or 'standard_user').strip()

Web/push_notifications.py

@@ -6,13 +6,13 @@ Handles Web Push notifications for users via Service Workers
 import os
 import json
 import datetime
-from pymongo import MongoClient
 from bson import ObjectId
 import requests
 import hashlib
 import logging
 
 import settings as cfg
+from settings import MongoClient
 
 logger = logging.getLogger(__name__)
 

Web/settings.py

@@ -14,6 +14,7 @@ import os
 import json
 import atexit
 from threading import Lock
+from flask import has_request_context
 from pymongo import MongoClient as _PyMongoClient
 
 # Base directory of this Web package
@@ -250,8 +251,29 @@ class _MongoClientProxy:
         return getattr(self._client, name)
 
     def __getitem__(self, name):
+        if has_request_context():
+            try:
+                from tenant import get_tenant_context
+                ctx = get_tenant_context()
+                if ctx and ctx.db_name:
+                    if name == MONGODB_DB or name == MONGODB_DB.lower() or name == 'inventar_default':
+                        return self._client[ctx.db_name]
+            except Exception:
+                pass
         return self._client[name]
 
+    def get_database(self, name=None, *args, **kwargs):
+        if has_request_context():
+            try:
+                from tenant import get_tenant_context
+                ctx = get_tenant_context()
+                if ctx and ctx.db_name:
+                    if name is None or name == MONGODB_DB or name == MONGODB_DB.lower() or name == 'inventar_default':
+                        return self._client.get_database(ctx.db_name, *args, **kwargs)
+            except Exception:
+                pass
+        return self._client.get_database(name, *args, **kwargs)
+
     def __enter__(self):
         return self
 

Web/templates/base.html

@@ -206,6 +206,82 @@
             white-space: nowrap;
         }
 
+        body.tutorial-tooltips-active [data-tutorial-tip] {
+            position: relative;
+            border-radius: 10px;
+            outline: 1px dashed rgba(59, 130, 246, 0.35);
+            outline-offset: 2px;
+            cursor: help;
+        }
+
+        body.tutorial-tooltips-active [data-tutorial-tip]::before {
+            content: '💡';
+            position: absolute;
+            top: 50%;
+            right: -26px;
+            transform: translateY(-50%);
+            width: 20px;
+            height: 20px;
+            display: inline-flex;
+            align-items: center;
+            justify-content: center;
+            border-radius: 999px;
+            background: rgba(59, 130, 246, 0.15);
+            color: #0f172a;
+            font-size: 0.75rem;
+            pointer-events: none;
+        }
+
+        body.tutorial-tooltips-active [data-tutorial-tip]::after {
+            content: attr(data-tutorial-tip);
+            position: absolute;
+            top: calc(100% + 10px);
+            left: 50%;
+            transform: translateX(-50%) translateY(6px);
+            min-width: 220px;
+            max-width: 280px;
+            padding: 10px 12px;
+            border-radius: 14px;
+            background: rgba(15, 23, 42, 0.92);
+            color: #f8fafc;
+            font-size: 0.9rem;
+            line-height: 1.4;
+            text-align: left;
+            opacity: 0;
+            visibility: hidden;
+            pointer-events: none;
+            box-shadow: 0 24px 48px rgba(15, 23, 42, 0.22);
+            z-index: 9999;
+            white-space: normal;
+        }
+
+        body.tutorial-tooltips-active [data-tutorial-tip]:hover::after {
+            opacity: 1;
+            visibility: visible;
+            transform: translateX(-50%) translateY(10px);
+        }
+
+        .tutorial-tooltip-indicator {
+            position: fixed;
+            top: 92px;
+            right: 16px;
+            z-index: 2000;
+            display: none;
+            align-items: center;
+            gap: 10px;
+            padding: 10px 14px;
+            border-radius: 999px;
+            background: rgba(56, 189, 248, 0.12);
+            border: 1px solid rgba(56, 189, 248, 0.25);
+            color: #0f172a;
+            font-size: 0.95rem;
+            box-shadow: 0 10px 30px rgba(15, 23, 42, 0.12);
+        }
+
+        body.tutorial-tooltips-active .tutorial-tooltip-indicator {
+            display: inline-flex;
+        }
+
         /* iPad/Tablet responsive adjustments */
         @media (max-width: 1024px) {
             .navbar .container-fluid {
@@ -952,24 +1028,24 @@
                 <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="inventoryNavList">
                     {% if current_permissions.pages.get('home', True) %}
                     <li class="nav-item" data-nav-fixed="true">
-                        <a class="nav-link {% if current_path == url_for('home') %}nav-active{% endif %}" href="{{ url_for('home') }}">Artikel</a>
+                        <a class="nav-link {% if current_path == url_for('home') %}nav-active{% endif %}" href="{{ url_for('home') }}" data-tutorial-tip="Starten Sie hier mit dem Materialbestand und suchen Sie nach Artikeln.">Artikel</a>
                     </li>
                     {% endif %}
                     {% if 'username' in session %}
                     {% if current_permissions.pages.get('my_borrowed_items', True) %}
                     <li class="nav-item">
-                        <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}">Meine Ausleihen</a>
+                        <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}" data-tutorial-tip="Ihre aktuellen Ausleihen und Rückgaben finden Sie hier.">Meine Ausleihen</a>
                     </li>
                     {% endif %}
                     {% if current_permissions.pages.get('tutorial_page', True) %}
                     <li class="nav-item">
-                        <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}">Tutorial</a>
+                        <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}" data-tutorial-tip="Öffnen Sie das Tutorial, um das System Schritt für Schritt kennenzulernen.">Tutorial</a>
                     </li>
                     {% endif %}
                     {% endif %}
                     {% if 'username' in session and current_permissions.pages.get('upload_admin', True) and current_permissions.actions.get('can_insert', True) %}
                     <li class="nav-item">
-                        <a class="nav-link nav-priority-link {% if current_path == url_for('upload_admin') %}nav-active{% endif %}" href="{{ url_for('upload_admin') }}">➕ Hochladen</a>
+                        <a class="nav-link nav-priority-link {% if current_path == url_for('upload_admin') %}nav-active{% endif %}" href="{{ url_for('upload_admin') }}" data-tutorial-tip="Hier können Sie neue Artikel ins Inventar einpflegen.">➕ Hochladen</a>
                     </li>
                     {% endif %}
                     <li class="nav-item" data-nav-fixed="true">
@@ -1071,24 +1147,24 @@
                 <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="libraryNavList">
                     {% if current_permissions.pages.get('library_view', True) %}
                     <li class="nav-item" data-nav-fixed="true">
-                        <a class="nav-link {% if current_path == url_for('library_view') %}nav-active{% endif %}" href="{{ url_for('library_view') }}">Medien</a>
+                        <a class="nav-link {% if current_path == url_for('library_view') %}nav-active{% endif %}" href="{{ url_for('library_view') }}" data-tutorial-tip="Die Bibliothek zeigt Ihnen alle Medien und verfügbaren Bücher.">Medien</a>
                     </li>
                     {% endif %}
                     {% if 'username' in session %}
                     {% if current_permissions.pages.get('my_borrowed_items', True) %}
                     <li class="nav-item">
-                        <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}">Meine Medien</a>
+                        <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}" data-tutorial-tip="Hier sehen Sie Ihre bibliotheksbezogenen Ausleihen.">Meine Medien</a>
                     </li>
                     {% endif %}
                     {% if current_permissions.pages.get('tutorial_page', True) %}
                     <li class="nav-item">
-                        <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}">Tutorial</a>
+                        <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}" data-tutorial-tip="Nutzen Sie das Tutorial, um die Bibliotheksfunktionen kennenzulernen.">Tutorial</a>
                     </li>
                     {% endif %}
                     {% endif %}
                     {% if 'username' in session and current_permissions.actions.get('can_insert', True) and current_permissions.pages.get('library_admin', True) %}
                     <li class="nav-item">
-                        <a class="nav-link nav-priority-link {% if current_path == url_for('library_admin') %}nav-active{% endif %}" href="{{ url_for('library_admin') }}">📖 Hochladen</a>
+                        <a class="nav-link nav-priority-link {% if current_path == url_for('library_admin') %}nav-active{% endif %}" href="{{ url_for('library_admin') }}" data-tutorial-tip="Neue Bibliotheksmedien können hier aufgenommen werden.">📖 Hochladen</a>
                     </li>
                     {% endif %}
                     <li class="nav-item" data-nav-fixed="true">
@@ -1999,6 +2075,28 @@
             });
         });
     </script>
+    <script>
+        (function () {
+            const username = {{ (session['username'] if 'username' in session else '')|tojson }};
+            const tooltipModeKey = username ? ('inventarsystem_tutorial_tooltips_enabled_' + username) : 'inventarsystem_tutorial_tooltips_enabled';
+            const enabled = localStorage.getItem(tooltipModeKey) === '1';
+
+            function applyTooltipMode(active) {
+                document.body.classList.toggle('tutorial-tooltips-active', active);
+                let indicator = document.getElementById('tutorialTooltipIndicator');
+                if (!indicator) {
+                    indicator = document.createElement('div');
+                    indicator.id = 'tutorialTooltipIndicator';
+                    indicator.className = 'tutorial-tooltip-indicator';
+                    indicator.textContent = 'Tutorial-Modus aktiv: Tooltips sind eingeschaltet';
+                    document.body.appendChild(indicator);
+                }
+                indicator.style.display = active ? 'inline-flex' : 'none';
+            }
+
+            applyTooltipMode(enabled);
+        })();
+    </script>
 
 </body>
 </html>

Web/templates/tutorial.html

@@ -189,6 +189,38 @@
     font-size: 1rem;
   }
 
+  .tutorial-tooltip-toggle {
+    display: flex;
+    flex-direction: column;
+    gap: 8px;
+    margin-top: 20px;
+    padding: 16px;
+    border-radius: 18px;
+    background: rgba(224, 242, 254, 0.9);
+    border: 1px solid #bae6fd;
+  }
+
+  .tutorial-tooltip-toggle label {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    font-weight: 700;
+    color: #0f172a;
+  }
+
+  .tutorial-tooltip-toggle input[type="checkbox"] {
+    width: 20px;
+    height: 20px;
+    accent-color: #2563eb;
+  }
+
+  .tooltip-description {
+    margin: 0;
+    color: #475569;
+    font-size: 0.95rem;
+    line-height: 1.5;
+  }
+
   .workflow-controls {
     display: flex;
     gap: 8px;
@@ -230,6 +262,13 @@
       <span class="tutorial-pill">Format: Ruhig und geführt</span>
       <span class="tutorial-pill">Benutzer: {{ username }}</span>
     </div>
+    <div class="tutorial-tooltip-toggle">
+      <label for="toggleTutorialTooltips">
+        <input type="checkbox" id="toggleTutorialTooltips" />
+        Tutorial-Tooltips für das gesamte System aktivieren
+      </label>
+      <p class="tooltip-description">Wenn aktiviert, erscheinen auf allen Seiten erklärende Hinweise und Icons für die wichtigsten Navigationselemente.</p>
+    </div>
   </section>
 
   <div class="tutorial-grid">
@@ -438,8 +477,32 @@
       renderStep();
     });
 
+    const tooltipToggle = document.getElementById('toggleTutorialTooltips');
+    const tooltipModeKey = 'inventarsystem_tutorial_tooltips_enabled_{{ username }}';
+
+    function setTooltipMode(enabled) {
+      localStorage.setItem(tooltipModeKey, enabled ? '1' : '0');
+      document.body.classList.toggle('tutorial-tooltips-active', enabled);
+    }
+
+    function loadTooltipMode() {
+      const saved = localStorage.getItem(tooltipModeKey);
+      const enabled = saved === '1';
+      if (tooltipToggle) {
+        tooltipToggle.checked = enabled;
+      }
+      setTooltipMode(enabled);
+    }
+
+    if (tooltipToggle) {
+      tooltipToggle.addEventListener('change', function () {
+        setTooltipMode(this.checked);
+      });
+    }
+
     loadState();
     renderStep();
+    loadTooltipMode();
   })();
 </script>
 {% endblock %}

Web/tenant.py

@@ -146,10 +146,17 @@ class TenantContext:
                 self.config = get_tenant_config(potential_subdomain)
                 return self._get_db_name(potential_subdomain)
 
-        # Fallback to default tenant if no tenant identifier found
+        # Fallback to default tenant if no tenant identifier found.
-        self.tenant_id = 'default'
+        # If no explicit 'default' tenant config exists, use configured MongoDB DB.
-        self.config = get_tenant_config('default')
+        if 'default' in TENANT_REGISTRY:
-        return self._get_db_name('default')
+            self.tenant_id = 'default'
+            self.config = get_tenant_config('default')
+            return self._get_db_name('default')
+
+        self.tenant_id = None
+        self.config = {}
+        self.db_name = cfg.MONGODB_DB
+        return self.db_name
 
     def _get_db_name(self, tenant_id):
         """
@@ -214,8 +221,8 @@ def get_tenant_db(mongo_client):
     ctx = get_tenant_context()
     if ctx:
         return ctx.get_database(mongo_client)
-    # Fallback to default database
+    # Fallback to configured default database
-    return mongo_client['inventar_default']
+    return mongo_client[cfg.MONGODB_DB]
 
 
 def register_tenant(tenant_id, config=None):

Web/user.py

@@ -13,6 +13,8 @@ Provides methods for creating, validating, and retrieving user information.
 import hashlib
 import copy
 import re
+import secrets
+import string
 from bson.objectid import ObjectId
 import settings as cfg
 from settings import MongoClient
@@ -43,24 +45,33 @@ def _clean_name_fragment(value):
     return cleaned
 
 
+def _get_tenant_db(client):
+    """Return the current tenant database for the request, or fall back to default."""
+    try:
+        from tenant import get_tenant_db
+        return get_tenant_db(client)
+    except Exception:
+        return client[cfg.MONGODB_DB]
+
+
 def build_name_synonym(first_name, last_name=''):
-    """Build a deterministic, non-personalized short alias like 'SimFri'."""
+    """Build a deterministic, non-personalized short alias from 2 letters each."""
     first = _clean_name_fragment(first_name)
     last = _clean_name_fragment(last_name)
 
     if first and last:
-        return (first[:3] + last[:3]).title()
+        return (first[:2] + last[:2]).title()
 
     combined = (first + last)
     if not combined:
         return 'User'
-    return combined[:6].title()
+    return combined[:4].title()
 
 
 def build_username_from_name(first_name, last_name=''):
     """
     Build a deterministic username abbreviation from first and last name.
-    Uses the same short alias logic (e.g. SimFri) and stores it lowercase.
+    Uses 2 letters from each name and stores it lowercase.
     
     Args:
         first_name (str): First name
@@ -75,32 +86,23 @@ def build_username_from_name(first_name, last_name=''):
 
 def build_unique_username_from_name(first_name, last_name=''):
     """
-    Build a unique username based on the abbreviation logic.
+    Build a unique username from the first 2 letters of the first name and
-    If a collision occurs, increase the username by one additional letter
+    the first 2 letters of the last name.
-    from the combined cleaned name until it is unique.
     """
     first = _clean_name_fragment(first_name)
     last = _clean_name_fragment(last_name)
-    combined = (first + last).lower()
+    base_username = (first[:2] + last[:2]).lower()
 
-    base_username = build_username_from_name(first_name, last_name)
+    if not base_username:
-    if not combined:
+        base_username = 'user'
-        combined = base_username or 'user'
 
-    start_len = len(base_username) if base_username else min(6, len(combined))
+    if not get_user(base_username):
-    start_len = max(1, min(start_len, len(combined)))
+        return base_username
 
-    # Main strategy: take one more letter on each collision.
-    for length in range(start_len, len(combined) + 1):
-        candidate = combined[:length]
-        if not get_user(candidate):
-            return candidate
-
-    # Fallback if full combined name is already taken repeatedly.
     suffix = 2
-    while get_user(f"{combined}{suffix}"):
+    while get_user(f"{base_username}{suffix}"):
         suffix += 1
-    return f"{combined}{suffix}"
+    return f"{base_username}{suffix}"
 
 
 ACTION_PERMISSION_KEYS = (
@@ -310,7 +312,7 @@ def update_user_permissions(username, preset_key, action_permissions=None, page_
     }
 
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     result = users.update_one({'Username': username}, {'$set': update_data})
 
@@ -325,7 +327,7 @@ def update_user_permissions(username, preset_key, action_permissions=None, page_
 def get_favorites(username):
     """Return a list of favorite item ObjectId strings for the user."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     user = users.find_one({'Username': username}) or users.find_one({'username': username})
     client.close()
@@ -339,7 +341,7 @@ def add_favorite(username, item_id):
     """Add an item to user's favorites (idempotent)."""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         users.update_one(
             {'$or': [{'Username': username}, {'username': username}]},
@@ -354,7 +356,7 @@ def remove_favorite(username, item_id):
     """Remove an item from user's favorites."""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         users.update_one(
             {'$or': [{'Username': username}, {'username': username}]},
@@ -417,13 +419,31 @@ def check_nm_pwd(username, password):
     Returns:
         dict: User document if credentials are valid, None otherwise
     """
+    db_name = cfg.MONGODB_DB
+    tenant_db = None
+    try:
+        from tenant import get_tenant_context
+        ctx = get_tenant_context()
+        if ctx and ctx.tenant_id:
+            tenant_db = ctx.db_name or ctx.resolve_tenant()
+            db_name = tenant_db
+    except Exception:
+        pass
+
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    try:
-    users = db['users']
+        hashed_password = hashing(password)
-    hashed_password = hashlib.sha512(password.encode()).hexdigest()
+
-    user = users.find_one({'Username': username, 'Password': hashed_password})
+        def find_user_in_db(database_name):
-    client.close()
+            db = client[database_name]
-    return user
+            users = db['users']
+            return users.find_one({'Username': username, 'Password': hashed_password}) or users.find_one({'username': username, 'Password': hashed_password})
+
+        return find_user_in_db(db_name)
+    finally:
+        client.close()
+
+    return None
 
 
 def add_user(
@@ -449,7 +469,7 @@ def add_user(
         bool: True if user was added successfully, False if password was too weak
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     if not check_password_strength(password):
         return False
@@ -471,7 +491,7 @@ def add_user(
         'Admin': False,
         'active_ausleihung': None,
         'name': name_alias,
-        'last_name': '',
+        'last_name': last_name.strip() if last_name else '',
         'IsStudent': bool(is_student),
         'PermissionPreset': permission_defaults['preset'],
         'ActionPermissions': permission_defaults['actions'],
@@ -499,7 +519,7 @@ def student_card_exists(student_card_id):
     if not normalized:
         return False
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     exists = users.find_one({'StudentCardId': normalized}) is not None
     client.close()
@@ -512,7 +532,7 @@ def get_user_by_student_card(student_card_id):
     if not normalized:
         return None
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     found_user = users.find_one({'StudentCardId': normalized})
     client.close()
@@ -530,11 +550,13 @@ def make_admin(username):
         bool: True if user was promoted successfully
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
-    users.update_one({'Username': username}, {'$set': {'Admin': True}})
+    result = users.update_one({'Username': username}, {'$set': {'Admin': True}})
+    if result.matched_count == 0:
+        result = users.update_one({'username': username}, {'$set': {'Admin': True}})
     client.close()
-    return True
+    return result.matched_count > 0
 
 def remove_admin(username):
     """
@@ -547,11 +569,13 @@ def remove_admin(username):
         bool: True if user was demoted successfully
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
-    users.update_one({'Username': username}, {'$set': {'Admin': False}})
+    result = users.update_one({'Username': username}, {'$set': {'Admin': False}})
+    if result.matched_count == 0:
+        result = users.update_one({'username': username}, {'$set': {'Admin': False}})
     client.close()
-    return True
+    return result.matched_count > 0
 
 def get_user(username):
     """
@@ -564,11 +588,31 @@ def get_user(username):
         dict: User document or None if not found
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    try:
-    users = db['users']
+        def find_in_db(database_name):
-    users_return = users.find_one({'Username': username})
+            db = client[database_name]
-    client.close()
+            users = db['users']
-    return users_return
+            return users.find_one({'Username': username}) or users.find_one({'username': username})
+
+        # Try current tenant first when available
+        try:
+            from tenant import get_tenant_context
+            ctx = get_tenant_context()
+            if ctx and ctx.db_name:
+                user = find_in_db(ctx.db_name)
+                if user:
+                    return user
+        except Exception:
+            pass
+
+        # Fallback to default configured database
+        user = find_in_db(cfg.MONGODB_DB)
+        if user:
+            return user
+
+        return None
+    finally:
+        client.close()
 
 
 def check_admin(username):
@@ -581,12 +625,8 @@ def check_admin(username):
     Returns:
         bool: True if user is an administrator, False otherwise
     """
-    client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+    user = get_user(username)
-    db = client[cfg.MONGODB_DB]
+    return bool(user and user.get('Admin', False))
-    users = db['users']
-    user = users.find_one({'Username': username})
-    client.close()
-    return user and user.get('Admin', False)
 
 
 def update_active_ausleihung(username, id_item, ausleihung):
@@ -602,7 +642,7 @@ def update_active_ausleihung(username, id_item, ausleihung):
         bool: True if successful
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     users.update_one({'Username': username}, {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}})
     client.close()
@@ -620,7 +660,7 @@ def get_active_ausleihung(username):
         dict: Active borrowing information or None
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     user = users.find_one({'Username': username})
     return user['active_ausleihung']
@@ -638,7 +678,7 @@ def has_active_borrowing(username):
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         
         user = users.find_one({'username': username})
@@ -669,14 +709,14 @@ def delete_user(username):
         bool: True if user was deleted successfully, False otherwise
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     result = users.delete_one({'username': username})
     client.close()
     if result.deleted_count == 0:
         # Try with different field name
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         result = users.delete_one({'Username': username})
         client.close()
@@ -698,7 +738,7 @@ def update_active_borrowing(username, item_id, status):
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         result = users.update_one(
             {'username': username}, 
@@ -731,7 +771,7 @@ def get_name(username):
         str: String of name
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     user = users.find_one({'Username': username})
     name = user.get("name")
@@ -746,7 +786,7 @@ def get_last_name(username):
         str: String of last_name
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     user = users.find_one({'Username': username})
     name = user.get("last_name")
@@ -763,7 +803,7 @@ def get_all_users():
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         all_users = list(users.find())
         client.close()
@@ -787,7 +827,7 @@ def update_password(username, new_password):
             return False
             
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         
         # Hash the new password
@@ -820,7 +860,7 @@ def update_user_name(username, name, last_name):
     try:
         name_alias = build_name_synonym(name, last_name)
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         
         result = users.update_one(

Web/verify_audit_chain.py

@@ -4,9 +4,8 @@
 import json
 import sys
 
-from pymongo import MongoClient
-
 import settings as cfg
+from settings import MongoClient
 import audit_log as al
 
 

docker-compose-multitenant.yml

@@ -106,11 +106,16 @@ services:
       INVENTAR_DELETED_ARCHIVE_FOLDER: /data/deleted-archives
       
       # Performance Tuning
-      INVENTAR_WORKER_CLASS: gevent
+      INVENTAR_WORKER_CLASS: ${INVENTAR_WORKER_CLASS:-gevent}
-      INVENTAR_WORKERS: "4"
+      INVENTAR_WORKERS: "${INVENTAR_WORKERS:-4}"
-      INVENTAR_THREADS: "2"
+      INVENTAR_THREADS: "${INVENTAR_THREADS:-2}"
-      INVENTAR_WORKER_TIMEOUT: "30"
+      INVENTAR_WORKER_TIMEOUT: "${INVENTAR_WORKER_TIMEOUT:-30}"
-      INVENTAR_WORKER_CONNECTIONS: "100"
+      INVENTAR_WORKER_CONNECTIONS: "${INVENTAR_WORKER_CONNECTIONS:-100}"
+      
+      # Auto-scaled runtime settings
+      INVENTAR_APP_CPUS: ${INVENTAR_APP_CPUS:-1.0}
+      INVENTAR_APP_MEM_LIMIT: ${INVENTAR_APP_MEM_LIMIT:-256m}
+      INVENTAR_APP_MEM_SWAP_LIMIT: ${INVENTAR_APP_MEM_SWAP_LIMIT:-512m}
       
       # Multi-Tenant
       INVENTAR_MULTITENANT_ENABLED: "true"
@@ -131,9 +136,9 @@ services:
     # Resource Limits (per instance)
     # With 10 instances: each gets ~150MB, totaling ~1.5GB
     # Adjust based on server resources
-    mem_limit: 256m
+    mem_limit: "${INVENTAR_APP_MEM_LIMIT:-256m}"
-    memswap_limit: 512m
+    memswap_limit: "${INVENTAR_APP_MEM_SWAP_LIMIT:-512m}"
-    cpus: "1.0"
+    cpus: "${INVENTAR_APP_CPUS:-1.0}"
     
     # Health check for load balancer
     healthcheck:

manage-tenant.sh

@@ -124,6 +124,96 @@ EOF
     fi
 }
 
+remove_tenant_port() {
+    local tenant_id="$1"
+    local config_path="$CONFIG_FILE"
+    local port
+
+    port="$(python3 - "$config_path" "$tenant_id" <<'PY'
+import json, sys, os
+path, tenant_id = sys.argv[1], sys.argv[2]
+if not os.path.isfile(path):
+    sys.exit(1)
+with open(path, 'r', encoding='utf-8') as f:
+    cfg = json.load(f)
+tenants = cfg.get('tenants', {})
+if not isinstance(tenants, dict) or tenant_id not in tenants or not isinstance(tenants[tenant_id], dict):
+    sys.exit(2)
+removed = tenants.pop(tenant_id, None)
+cfg['tenants'] = tenants
+with open(path, 'w', encoding='utf-8') as f:
+    json.dump(cfg, f, indent=4, ensure_ascii=False)
+if removed is not None:
+    port = removed.get('port')
+    if port is not None:
+        print(port)
+PY
+)"
+
+    local status=$?
+    if [ $status -eq 1 ]; then
+        echo "Error: config file not found: $config_path"
+        return 1
+    fi
+    if [ $status -eq 2 ]; then
+        return 2
+    fi
+
+    if [ -n "$port" ]; then
+        echo "$port"
+    fi
+    return 0
+}
+
+remove_runtime_port() {
+    local removed_port="$1"
+    local env_file="$PWD/.docker-build.env"
+    local current_ports=""
+    local port_list=()
+    local new_ports=()
+    local first_port=""
+
+    if [ ! -f "$env_file" ]; then
+        return 0
+    fi
+
+    current_ports="$(awk -F= '/^INVENTAR_HTTP_PORTS=/{print $2; exit}' "$env_file" | tr -d ' ' || true)"
+    if [ -z "$current_ports" ]; then
+        current_ports="$(awk -F= '/^INVENTAR_HTTP_PORT=/{print $2; exit}' "$env_file" | tr -d ' ' || true)"
+    fi
+
+    if [ -z "$current_ports" ]; then
+        return 0
+    fi
+
+    IFS=',' read -r -a port_list <<<"${current_ports// /,}"
+    for port in "${port_list[@]}"; do
+        if [ -n "$port" ] && [ "$port" != "$removed_port" ]; then
+            new_ports+=("$port")
+        fi
+    done
+
+    if [ ${#new_ports[@]} -eq 0 ]; then
+        sed -i '/^INVENTAR_HTTP_PORTS=/d;/^INVENTAR_HTTP_PORT=/d' "$env_file"
+        return 0
+    fi
+
+    first_port="${new_ports[0]}"
+    local ports_csv="$(IFS=,; echo "${new_ports[*]}")"
+
+    if grep -q '^INVENTAR_HTTP_PORTS=' "$env_file" 2>/dev/null; then
+        sed -i "s|^INVENTAR_HTTP_PORTS=.*|INVENTAR_HTTP_PORTS=$ports_csv|" "$env_file"
+    else
+        printf '\nINVENTAR_HTTP_PORTS=%s\n' "$ports_csv" >> "$env_file"
+    fi
+
+    if grep -q '^INVENTAR_HTTP_PORT=' "$env_file" 2>/dev/null; then
+        sed -i "s|^INVENTAR_HTTP_PORT=.*|INVENTAR_HTTP_PORT=$first_port|" "$env_file"
+    else
+        printf '\nINVENTAR_HTTP_PORT=%s\n' "$first_port" >> "$env_file"
+    fi
+}
+
 if [ -z "${1:-}" ]; then
     show_help
 fi
@@ -157,11 +247,53 @@ case "$COMMAND" in
         APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
         if [ -n "$APP_CONTAINER" ]; then
             docker exec $APP_CONTAINER python3 -c "
-import sys; sys.path.insert(0, '/app/Web'); import settings; from pymongo import MongoClient; import hashlib
+import sys, re; sys.path.insert(0, '/app/Web'); import settings; from pymongo import MongoClient; import hashlib
+tenant_id = sys.argv[1].lower()
+sanitized = ''.join(c for c in tenant_id if c.isalnum() or c == '_')
+db_name = f'inventar_{sanitized}'
 client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
-db = client[f'{settings.MONGODB_DB}_{sys.argv[1]}']
+db = client[db_name]
 hashed_pw = hashlib.sha512('admin123'.encode()).hexdigest()
-db.users.insert_one({'Username': 'admin', 'Password': hashed_pw, 'Role': 'admin', 'Name': 'Admin', 'Nachname': 'User'})
+if db.users.count_documents({'Username': 'admin'}) == 0:
+    db.users.insert_one({
+        'Username': 'admin',
+        'Password': hashed_pw,
+        'Admin': True,
+        'active_ausleihung': None,
+        'name': 'Admin',
+        'last_name': 'User',
+        'IsStudent': False,
+        'PermissionPreset': 'full_access',
+        'ActionPermissions': {
+            'can_borrow': True,
+            'can_insert': True,
+            'can_edit': True,
+            'can_delete': True,
+            'can_manage_users': True,
+            'can_manage_settings': True,
+            'can_view_logs': True,
+        },
+        'PagePermissions': {
+            'home': True,
+            'tutorial_page': True,
+            'my_borrowed_items': True,
+            'notifications_view': True,
+            'impressum': True,
+            'license': True,
+            'library_view': True,
+            'terminplan': True,
+            'home_admin': True,
+            'upload_admin': True,
+            'library_admin': True,
+            'admin_borrowings': True,
+            'library_loans_admin': True,
+            'admin_damaged_items': True,
+            'admin_audit_dashboard': True,
+            'logs': True,
+            'manage_filters': True,
+            'manage_locations': True,
+        },
+    })
 print(f'Tenant {sys.argv[1]} database initialized. Default admin: admin / admin123')
 " "$TENANT_ID"
             echo "Tenant '$TENANT_ID' successfully added. Ready to use."
@@ -183,14 +315,28 @@ print(f'Tenant {sys.argv[1]} database initialized. Default admin: admin / admin1
             APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
             if [ -n "$APP_CONTAINER" ]; then
                 docker exec $APP_CONTAINER python3 -c "
-import sys; sys.path.insert(0, '/app/Web'); import settings; from pymongo import MongoClient
+import sys; sys.path.insert(0, '/app/Web'); from tenant import TenantContext; import settings; from pymongo import MongoClient
+ctx = TenantContext()
+db_name = ctx._get_db_name(sys.argv[1])
 client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
-client.drop_database(f'{settings.MONGODB_DB}_{sys.argv[1]}')
+client.drop_database(db_name)
 print(f'Database for tenant {sys.argv[1]} dropped.')
 " "$TENANT_ID"
-                echo "Tenant '$TENANT_ID' removed successfully."
+                echo "Tenant '$TENANT_ID' database removed."
             else
-                echo "Error: Application container not running."
+                echo "Warning: Application container not running. Tenant database may still exist in MongoDB."
+            fi
+
+            port_to_remove=""
+            if port_to_remove="$(remove_tenant_port "$TENANT_ID" 2>/dev/null)"; then
+                if [ -n "$port_to_remove" ]; then
+                    remove_runtime_port "$port_to_remove"
+                    echo "Removed tenant '$TENANT_ID' from config.json and cleaned runtime port $port_to_remove."
+                else
+                    echo "Removed tenant '$TENANT_ID' from config.json. No port mapping was present."
+                fi
+            else
+                echo "Warning: tenant '$TENANT_ID' was not configured in config.json or could not be removed."
             fi
         else
             echo "Removal canceled."
@@ -259,7 +405,7 @@ sys.path.insert(0, '/app/Web')
 import settings
 from pymongo import MongoClient
 client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
-prefix = f'{settings.MONGODB_DB}_'
+prefix = 'inventar_'
 dbs = [d for d in client.list_database_names() if d.startswith(prefix)]
 if dbs:
     for db in dbs:

restart.sh

@@ -7,6 +7,60 @@ cd "$SCRIPT_DIR"
 COMPOSE_FILE="docker-compose-multitenant.yml"
 ENV_FILE="$SCRIPT_DIR/.docker-build.env"
 RUNTIME_COMPOSE_OVERRIDE_FILE="$SCRIPT_DIR/.docker-compose.runtime.override.yml"
+
+parse_port_list() {
+    local raw="$1"
+    local port
+    local ports=()
+    raw="${raw//,/ }"
+    for port in $raw; do
+        port="${port//[[:space:]]/}"
+        if [ -n "$port" ] && printf '%s\n' "$port" | grep -qE '^[0-9]+$'; then
+            ports+=("$port")
+        fi
+    done
+    printf '%s\n' "${ports[@]}"
+}
+
+write_runtime_override() {
+    local current_ports=""
+    local app_image=""
+    local ports=()
+
+    if [ -f "$ENV_FILE" ]; then
+        app_image="$(awk -F= '/^INVENTAR_APP_IMAGE=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+        current_ports="$(awk -F= '/^INVENTAR_HTTP_PORTS=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+        if [ -z "$current_ports" ]; then
+            current_ports="$(awk -F= '/^INVENTAR_HTTP_PORT=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+        fi
+    fi
+
+    if [ -n "$app_image" ]; then
+        if [ -n "$current_ports" ]; then
+            mapfile -t ports < <(parse_port_list "$current_ports")
+        fi
+
+        cat > "$RUNTIME_COMPOSE_OVERRIDE_FILE" <<EOF
+services:
+  app:
+    image: $app_image
+    build: null
+EOF
+        if [ ${#ports[@]} -gt 1 ]; then
+            cat >> "$RUNTIME_COMPOSE_OVERRIDE_FILE" <<EOF
+    ports:
+EOF
+            for port in "${ports[@]}"; do
+                cat >> "$RUNTIME_COMPOSE_OVERRIDE_FILE" <<EOF
+      - "$port:8000"
+EOF
+            done
+        fi
+    else
+        rm -f "$RUNTIME_COMPOSE_OVERRIDE_FILE"
+    fi
+}
+
 while [[ $# -gt 0 ]]; do
     case "$1" in
         --multitenant)
@@ -29,6 +83,7 @@ if ! command -v docker >/dev/null 2>&1; then
 fi
 
 echo "Rebuilding and/or restarting app container using $COMPOSE_FILE..."
+write_runtime_override
 compose_args=(-f "$COMPOSE_FILE")
 if [ -f "$RUNTIME_COMPOSE_OVERRIDE_FILE" ]; then
     compose_args+=( -f "$RUNTIME_COMPOSE_OVERRIDE_FILE" )

start.sh

@@ -504,12 +504,71 @@ ensure_min_docker_disk_space() {
     fi
 }
 
+detect_server_capacity() {
+    local cpus mem_kb mem_gb app_workers app_cpus app_mem app_mem_swap
+
+    cpus="$(nproc 2>/dev/null || echo 1)"
+    mem_kb="$(awk '/MemAvailable:/ {print $2; exit}' /proc/meminfo 2>/dev/null || awk '/MemTotal:/ {print $2; exit}' /proc/meminfo || echo 0)"
+    mem_gb=$(( (mem_kb + 1024*1024 - 1) / (1024*1024) ))
+
+    if [ "$cpus" -ge 8 ] && [ "$mem_gb" -ge 16 ]; then
+        app_workers=8
+        app_cpus="2.0"
+        app_mem="512m"
+        app_mem_swap="1024m"
+    elif [ "$cpus" -ge 4 ] && [ "$mem_gb" -ge 8 ]; then
+        app_workers=4
+        app_cpus="1.0"
+        app_mem="384m"
+        app_mem_swap="768m"
+    elif [ "$cpus" -ge 2 ] && [ "$mem_gb" -ge 4 ]; then
+        app_workers=2
+        app_cpus="0.75"
+        app_mem="320m"
+        app_mem_swap="640m"
+    else
+        app_workers=1
+        app_cpus="0.5"
+        app_mem="256m"
+        app_mem_swap="512m"
+    fi
+
+    if [ -f "$ENV_FILE" ]; then
+        local env_app_cpus env_app_mem env_app_mem_swap env_workers
+        env_app_cpus="$(awk -F= '/^INVENTAR_APP_CPUS=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+        env_app_mem="$(awk -F= '/^INVENTAR_APP_MEM_LIMIT=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+        env_app_mem_swap="$(awk -F= '/^INVENTAR_APP_MEM_SWAP_LIMIT=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+        env_workers="$(awk -F= '/^INVENTAR_WORKERS=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+
+        [ -n "$env_app_cpus" ] && app_cpus="$env_app_cpus"
+        [ -n "$env_app_mem" ] && app_mem="$env_app_mem"
+        [ -n "$env_app_mem_swap" ] && app_mem_swap="$env_app_mem_swap"
+        [ -n "$env_workers" ] && app_workers="$env_workers"
+    fi
+
+    INVENTAR_APP_CPUS="${INVENTAR_APP_CPUS:-$app_cpus}"
+    INVENTAR_APP_MEM_LIMIT="${INVENTAR_APP_MEM_LIMIT:-$app_mem}"
+    INVENTAR_APP_MEM_SWAP_LIMIT="${INVENTAR_APP_MEM_SWAP_LIMIT:-$app_mem_swap}"
+    INVENTAR_WORKERS="${INVENTAR_WORKERS:-$app_workers}"
+    INVENTAR_THREADS="${INVENTAR_THREADS:-2}"
+
+    echo "Detected host capacity: CPUs=$cpus, RAM=${mem_gb}GB"
+    echo "Configured app runtime: INVENTAR_WORKERS=$INVENTAR_WORKERS, INVENTAR_APP_CPUS=$INVENTAR_APP_CPUS, INVENTAR_APP_MEM_LIMIT=$INVENTAR_APP_MEM_LIMIT"
+}
+
 write_env_file() {
     cat > "$ENV_FILE" <<EOF
 NUITKA_BUILD=$NUITKA_BUILD_VALUE
 INVENTAR_HTTP_PORT=$HTTP_PORT_VALUE
 INVENTAR_HTTP_PORTS=${HTTP_PORTS_VALUE// /,}
 INVENTAR_APP_IMAGE=$APP_IMAGE_VALUE
+INVENTAR_APP_CPUS=$INVENTAR_APP_CPUS
+INVENTAR_APP_MEM_LIMIT=$INVENTAR_APP_MEM_LIMIT
+INVENTAR_APP_MEM_SWAP_LIMIT=$INVENTAR_APP_MEM_SWAP_LIMIT
+INVENTAR_WORKERS=$INVENTAR_WORKERS
+INVENTAR_THREADS=$INVENTAR_THREADS
+INVENTAR_WORKER_TIMEOUT=${INVENTAR_WORKER_TIMEOUT:-30}
+INVENTAR_WORKER_CONNECTIONS=${INVENTAR_WORKER_CONNECTIONS:-100}
 EOF
 }
 
@@ -518,7 +577,7 @@ write_runtime_compose_override() {
 services:
   app:
     working_dir: /app/Web
-    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "30", "--graceful-timeout", "20", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
+    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "${INVENTAR_WORKERS:-2}", "--threads", "${INVENTAR_THREADS:-2}", "--timeout", "${INVENTAR_WORKER_TIMEOUT:-30}", "--graceful-timeout", "20", "--worker-connections", "${INVENTAR_WORKER_CONNECTIONS:-100}", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
     image: ${APP_IMAGE_VALUE}
     build: null
 EOF
@@ -595,6 +654,7 @@ configure_nuitka_mode
 resolve_app_image
 configure_host_ports
 ensure_min_docker_disk_space
+detect_server_capacity
 ensure_app_image_loaded
 write_env_file
 write_runtime_compose_override