chore: bump version to v0.8.5

.docker-compose.runtime.override.yml

@@ -1,8 +1,6 @@
 services:
   app:
-    working_dir: /app/Web
-    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "4", "--threads", "2", "--timeout", "30", "--graceful-timeout", "20", "--worker-connections", "100", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
-    image: ghcr.io/aiirondev/legendary-octo-garbanzo:latest
+    image: ghcr.io/aiirondev/legendary-octo-garbanzo:v0.7.42
     build: null
     ports:
       - "10000:8000"

.github/workflows/release-docker.yml

@@ -134,14 +134,22 @@ jobs:
             echo "push_dev=false" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Update .release-version file
+        run: |
+          echo "${{ steps.meta.outputs.tag }}" > .release-version
+          cat .release-version
+
       - name: Create and push tag for manual releases
         if: github.event_name == 'workflow_dispatch'
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add .release-version
+          git commit -m "chore: bump version to $TAG" || true
           git tag "$TAG"
           git push origin "$TAG"
+          git push origin HEAD:${{ github.ref_name }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -198,6 +206,17 @@ jobs:
 
       # development tar omitted: dev releases will be versioned (vX.Y.Z-dev) and handled by update.sh using the tag
 
+      - name: Commit .release-version for tag pushes
+        if: github.event_name == 'push'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          if ! git diff --quiet .release-version; then
+            git add .release-version
+            git commit -m "chore: update version to ${{ steps.meta.outputs.tag }}"
+            git push origin HEAD:${{ github.ref_name }}
+          fi
+
       - name: Create release-only docker bundle
         run: |
           mkdir -p release-bundle

.release-version

@@ -1 +1 @@
-v0.7.42
+v0.8.5

Web/__init__.py

@@ -0,0 +1 @@
+# Web package initialization

Web/app.py

@@ -1,11 +1,3 @@
-'''
-   Copyright 2025-2026 AIIrondev
-
-   Licensed under the Inventarsystem EULA (Endbenutzer-Lizenzvertrag).
-   See Legal/LICENSE for the full license text.
-   Unauthorized commercial use, SaaS hosting, or removal of branding is prohibited.
-   For commercial licensing inquiries: https://github.com/AIIrondev
-'''
 """
 Inventarsystem - Flask Web Application
 
@@ -28,11 +20,24 @@ Features:
 from flask import Flask, render_template, request, redirect, url_for, session, flash, send_from_directory, get_flashed_messages, jsonify, Response, make_response, send_file, abort
 from werkzeug.utils import secure_filename
 from werkzeug.middleware.proxy_fix import ProxyFix
+from werkzeug.exceptions import HTTPException
+from werkzeug.routing import BuildError
 from jinja2 import TemplateNotFound
+import os
+import sys
+
+# Ensure imports work regardless of whether gunicorn starts in /app or /app/Web.
+_CURRENT_DIR = os.path.dirname(os.path.abspath(__file__))
+_PROJECT_ROOT = os.path.dirname(_CURRENT_DIR)
+if _PROJECT_ROOT not in sys.path:
+    sys.path.insert(0, _PROJECT_ROOT)
+if _CURRENT_DIR not in sys.path:
+    sys.path.insert(0, _CURRENT_DIR)
+
 import Web.modules.database.user as us
 import Web.modules.database.items as it
 import Web.modules.database.ausleihung as au
-import Web.modules.logs.audit_log as al
+import Web.modules.log.audit_log as al
 import push_notifications as pn
 import Web.modules.inventarsystem.pdf_export as pdf_export 
 import datetime
@@ -42,7 +47,6 @@ from urllib.parse import urlparse, urlunparse
 import requests
 import csv
 import ipaddress
-import os
 import json
 import datetime
 import time
@@ -63,7 +67,6 @@ except Exception:
 # import qrcode
 # from qrcode.constants import ERROR_CORRECT_L
 import threading
-import sys
 import shutil
 import uuid
 from PIL import Image, ImageOps
@@ -71,15 +74,17 @@ import mimetypes
 import subprocess
 from Web.modules.inventarsystem.data_protection import (
     decrypt_document_fields,
+    decrypt_text,
     encrypt_document_fields,
     encrypt_soft_deleted_media_pack,
 )
+from Web.modules.terminplaner.blueprint import appoint_bp as terminplaner_bp
 
 # Set base directory and centralized settings
 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
 import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
-from tenant import get_tenant_context
+from tenant import get_tenant_context, get_tenant_trial_status, purge_expired_trial_tenants
 
 
 app = Flask(__name__, static_folder='static')  # Correctly set static folder
@@ -105,11 +110,12 @@ app.config['SESSION_COOKIE_SECURE'] = cfg.SSL_ENABLED if os.getenv('INVENTAR_SES
 app.config['PREFERRED_URL_SCHEME'] = 'https' if app.config['SESSION_COOKIE_SECURE'] else 'http'
 # app.config['QR_CODE_FOLDER'] = cfg.QR_CODE_FOLDER  # QR Code storage deactivated
 app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_port=1)
+app.register_blueprint(terminplaner_bp, url_prefix='/terminplaner')
 
 """--------------------------------------------------------------Path Init-------------------------------------------------------"""
 
 if not os.path.exists(app.config['UPLOAD_FOLDER']):
-    os.makedirs(app.config['UPLOAD_FOLDER'])
+    os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True)
 # QR Code directory creation deactivated
 # if not os.path.exists(app.config['QR_CODE_FOLDER']):
 #     os.makedirs(app.config['QR_CODE_FOLDER'])
@@ -151,6 +157,119 @@ def _decrypt_student_card_doc(card_doc):
         return card_doc
     return decrypt_document_fields(card_doc, STUDENT_CARD_ENCRYPTED_FIELDS)
 
+
+def _parse_and_increment_class(klass, max_class=13, graduate_label=''):
+    """Parse a class string like '7A' or '10' and increment the numeric part.
+    If the numeric part would exceed max_class, return graduate_label (or empty).
+    Leaves non-numeric / unparsable values unchanged.
+    """
+    if not klass:
+        return klass
+    s = str(klass).strip()
+    m = re.match(r"^\s*(\d{1,2})(\D.*)?$", s)
+    if not m:
+        return s
+    try:
+        num = int(m.group(1))
+    except Exception:
+        return s
+    suffix = m.group(2) or ''
+    new_num = num + 1
+    if max_class is not None and new_num > int(max_class):
+        return graduate_label or ''
+    return f"{new_num}{suffix}"
+
+
+def rollover_student_card_classes(dry_run=False, *, max_class=None, graduate_label=''):
+    """Increment class years on all student cards.
+
+    Returns a summary dict with counts.
+    """
+    client = None
+    updated = 0
+    examined = 0
+    failures = 0
+    try:
+        client = MongoClient(MONGODB_HOST, MONGODB_PORT)
+        db = client[MONGODB_DB]
+        col = db['student_cards']
+        now = datetime.datetime.now()
+
+        cursor = list(col.find({}, {'Klasse': 1}))
+        for doc in cursor:
+            examined += 1
+            try:
+                # Decrypt to work on plain class string
+                plain = dict(doc)
+                plain = _decrypt_student_card_doc(plain)
+                orig = (plain.get('Klasse') or '').strip()
+                new_class = _parse_and_increment_class(orig, max_class=max_class, graduate_label=graduate_label)
+                if new_class != orig:
+                    if dry_run:
+                        updated += 1
+                        continue
+                    payload = {'Klasse': new_class}
+                    encrypted = encrypt_document_fields(payload, STUDENT_CARD_ENCRYPTED_FIELDS)
+                    update_doc = {'Klasse': encrypted.get('Klasse'), 'Aktualisiert': now}
+                    col.update_one({'_id': doc.get('_id')}, {'$set': update_doc})
+                    updated += 1
+            except Exception:
+                failures += 1
+                app.logger.exception('Failed to process student card rollover for %s', doc.get('_id'))
+    finally:
+        if client:
+            client.close()
+
+    summary = {'examined': examined, 'updated': updated, 'failures': failures, 'dry_run': bool(dry_run)}
+    try:
+        _append_audit_event_standalone('student_cards_rollover', summary)
+    except Exception:
+        app.logger.warning('Audit write failed for student_cards_rollover')
+    return summary
+
+
+# Admin route to trigger rollover manually
+@app.route('/admin/trigger_school_year_rollover', methods=['POST'])
+def admin_trigger_school_year_rollover():
+    if 'username' not in session:
+        return jsonify({'ok': False, 'message': 'Nicht angemeldet.'}), 401
+    if not us.check_admin(session['username']):
+        return jsonify({'ok': False, 'message': 'Administratorrechte erforderlich.'}), 403
+
+    max_class = int(os.getenv('INVENTAR_SCHOOL_MAX_CLASS', '13'))
+    graduate_label = os.getenv('INVENTAR_SCHOOL_GRADUATE_LABEL', '')
+    dry = request.args.get('dry', '0') in ('1', 'true', 'yes')
+    summary = rollover_student_card_classes(dry_run=dry, max_class=max_class, graduate_label=graduate_label)
+    return jsonify({'ok': True, 'summary': summary}), 200
+
+
+# Schedule annual rollover job using APScheduler (configurable via env)
+try:
+        if cfg.SCHEDULER_ENABLED:
+            _rollover_month = getattr(cfg, 'SCHOOL_ROLLOVER_MONTH', 9)
+            _rollover_day = getattr(cfg, 'SCHOOL_ROLLOVER_DAY', 1)
+            _rollover_hour = getattr(cfg, 'SCHOOL_ROLLOVER_HOUR', 3)
+            _rollover_minute = getattr(cfg, 'SCHOOL_ROLLOVER_MIN', 0)
+            _rollover_max_class = getattr(cfg, 'SCHOOL_ROLLOVER_MAX_CLASS', 13)
+            _rollover_grad_label = getattr(cfg, 'SCHOOL_ROLLOVER_GRADUATE_LABEL', '')
+
+            _scheduler = BackgroundScheduler()
+            # Use a cron-style yearly job on the configured month/day
+            _scheduler.add_job(
+                func=lambda: rollover_student_card_classes(dry_run=False, max_class=_rollover_max_class, graduate_label=_rollover_grad_label),
+                trigger='cron',
+                month=_rollover_month,
+                day=_rollover_day,
+                hour=_rollover_hour,
+                minute=_rollover_minute,
+                id='school_year_rollover',
+                replace_existing=True
+            )
+            _scheduler.start()
+            app.logger.info('Scheduled annual school year rollover: %s-%s %s:%s', _rollover_month, _rollover_day, _rollover_hour, _rollover_minute)
+except Exception as e:
+    app.logger.warning('Failed to schedule school year rollover: %s', e)
+
 # Thumbnail sizes
 THUMBNAIL_SIZE = cfg.THUMBNAIL_SIZE
 PREVIEW_SIZE = cfg.PREVIEW_SIZE
@@ -351,6 +470,54 @@ def _enforce_active_session_user():
     flash('Ihre Sitzung ist nicht mehr gültig. Bitte erneut anmelden.', 'error')
     return redirect(url_for('login'))
 
+
+@app.before_request
+def _enforce_trial_tenant_expiry():
+    endpoint = request.endpoint or ''
+    if endpoint == 'static' or endpoint.startswith('static'):
+        return None
+
+    if endpoint in {'login', 'logout', 'impressum', 'license'}:
+        return None
+
+    try:
+        ctx = get_tenant_context()
+        tenant_id = ctx.tenant_id if ctx else session.get('tenant_id')
+        if not tenant_id:
+            return None
+
+        trial_status = get_tenant_trial_status(tenant_id)
+        if not trial_status.get('enabled'):
+            return None
+
+        session['trial_status'] = {
+            'enabled': True,
+            'expired': bool(trial_status.get('expired')),
+            'days_left': trial_status.get('days_left'),
+            'expires_at': trial_status.get('expires_at').isoformat() if trial_status.get('expires_at') else None,
+        }
+
+        if not trial_status.get('expired'):
+            return None
+
+        if request.path.startswith('/api/') or request.is_json:
+            return jsonify({
+                'ok': False,
+                'message': 'Diese Testinstanz ist abgelaufen und wurde deaktiviert.',
+                'expired': True,
+            }), 410
+
+        session.pop('username', None)
+        session.pop('admin', None)
+        session.pop('is_admin', None)
+        session.pop('favorites', None)
+        session.pop('favorites_owner', None)
+        flash('Diese Testinstanz ist abgelaufen und wurde deaktiviert.', 'error')
+        return redirect(url_for('login'))
+    except Exception as exc:
+        app.logger.warning(f'Trial expiry check failed: {exc}')
+        return None
+
 @app.before_request
 def _enforce_module_access():
     endpoint = request.endpoint or ''
@@ -369,11 +536,11 @@ def _enforce_module_access():
                 return jsonify({'ok': False, 'message': msg}), 403
             
             flash(msg, 'info')
-            
+
             if name != 'inventory' and cfg.MODULES.is_enabled('inventory'):
                 return redirect(url_for('home'))
             elif name != 'library' and cfg.MODULES.is_enabled('library'):
-                return redirect(url_for('library_view'))
+                return redirect('/library')
             
             return redirect(url_for('my_borrowed_items'))
 
@@ -433,6 +600,41 @@ def handle_not_found(e):
     return redirect(url_for('login'))
 
 
+@app.errorhandler(BuildError)
+def handle_build_error(e):
+    """Handle url_for endpoint mismatches without crashing the whole request."""
+    app.logger.error(f"BuildError while resolving endpoint: {e}", exc_info=True)
+    if request.is_json or request.path.startswith('/api/'):
+        return jsonify({'error': 'Route resolution failed', 'status': 500}), 500
+
+    # Known fallback for legacy library endpoint naming issues.
+    if 'library_view' in str(e):
+        return redirect('/library')
+
+    if 'username' in session:
+        return redirect(url_for('home'))
+    return redirect(url_for('login'))
+
+
+@app.errorhandler(Exception)
+def handle_unexpected_exception(e):
+    """Last-resort handler to avoid raw 500 pages for unhandled exceptions."""
+    if isinstance(e, HTTPException):
+        return e
+
+    app.logger.error('Unhandled exception', exc_info=True)
+    if request.is_json or request.path.startswith('/api/'):
+        return jsonify({'error': 'Internal server error', 'status': 500}), 500
+
+    if 'username' in session:
+        try:
+            return render_template('error.html', error_code=500, error_message='Interner Serverfehler.'), 500
+        except Exception:
+            return 'Internal Server Error', 500
+
+    return redirect(url_for('login'))
+
+
 def _csrf_error_response(message='CSRF token fehlt oder ist ungültig.'):
     if request.is_json or request.path.startswith('/api/') or request.path in {'/download_book_cover', '/proxy_image', '/log_mobile_issue'}:
         return jsonify({'error': message}), 400
@@ -1059,6 +1261,7 @@ def inject_version():
         'CURRENT_MODULE': current_module,
         'school_periods': SCHOOL_PERIODS,
         'inventory_module_enabled': cfg.MODULES.is_enabled('inventory'),
+        'terminplan_module_enabled': cfg.MODULES.is_enabled('terminplan'),
         'library_module_enabled': cfg.MODULES.is_enabled('library'),
         'student_cards_module_enabled': cfg.MODULES.is_enabled('student_cards'),
         'is_admin': is_admin,
@@ -1070,6 +1273,7 @@ def inject_version():
         'permission_action_options': PERMISSION_ACTION_OPTIONS,
         'permission_page_options': PERMISSION_PAGE_OPTIONS,
         'permission_presets': us.get_permission_preset_definitions(),
+        'trial_status': session.get('trial_status', {}),
     }
 
 
@@ -1086,6 +1290,16 @@ def create_daily_backup():
     except Exception as e:
         app.logger.error(f"Daily backup creation failed: {e}")
 
+
+def cleanup_expired_trial_tenants():
+    """Remove expired trial tenants from config and MongoDB."""
+    try:
+        purged_tenants = purge_expired_trial_tenants()
+        if purged_tenants:
+            app.logger.warning(f"Purged expired trial tenants: {', '.join(purged_tenants)}")
+    except Exception as exc:
+        app.logger.error(f"Trial tenant cleanup failed: {exc}")
+
 def update_appointment_statuses():
     """
     Aktualisiert automatisch die Status aller Terminplaner-Einträge.
@@ -1281,6 +1495,7 @@ def _initialize_scheduler():
             scheduler.add_job(func=create_daily_backup, trigger="interval", hours=cfg.BACKUP_INTERVAL_HOURS)
             scheduler.add_job(func=update_appointment_statuses, trigger="interval", minutes=cfg.SCHEDULER_INTERVAL_MIN)
             scheduler.add_job(func=create_return_reminders, trigger="interval", minutes=cfg.SCHEDULER_INTERVAL_MIN)
+            scheduler.add_job(func=cleanup_expired_trial_tenants, trigger="interval", hours=1)
             scheduler.start()
             _scheduler_initialized = True
             app.logger.info(f"Scheduler started successfully (interval={cfg.SCHEDULER_INTERVAL_MIN} min)")
@@ -1930,11 +2145,6 @@ def _upload_excel_items(scope='inventory'):
         flash('Nicht angemeldet.', 'error')
         return redirect(url_for('login'))
 
-    permissions = _get_current_user_permissions() or us.build_default_permission_payload('standard_user')
-    if not _action_access_allowed(permissions, 'can_insert'):
-        flash('Einfüge-Rechte erforderlich.', 'error')
-        return redirect(url_for('home'))
-
     is_library_scope = scope == 'library'
     file_field = 'library_excel' if is_library_scope else 'inventory_excel'
     fallback_route = 'library_admin' if is_library_scope else 'upload_admin'
@@ -1946,9 +2156,20 @@ def _upload_excel_items(scope='inventory'):
 
     excel_file = request.files.get(file_field)
     if not excel_file or not excel_file.filename:
-        flash('Bitte eine Excel-Datei auswählen.', 'error')
+        flash('Bitte eine Excel- oder CSV-Datei auswählen.', 'error')
         return redirect(url_for(fallback_route))
 
+    # Permission handling: allow authenticated normal users to import CSV for inventory scope
+    permissions = _get_current_user_permissions() or us.build_default_permission_payload('standard_user')
+    has_insert = _action_access_allowed(permissions, 'can_insert')
+    filename_lower = (excel_file.filename or '').lower()
+    is_csv = filename_lower.endswith('.csv')
+    if not has_insert:
+        # Allow CSV imports for authenticated non-admin users only for inventory (non-library)
+        if not (is_csv and not is_library_scope and 'username' in session):
+            flash('Einfüge-Rechte erforderlich.', 'error')
+            return redirect(url_for('home'))
+
     filename_lower = excel_file.filename.lower()
     if not filename_lower.endswith(('.xlsx', '.csv')):
         flash('Nur .xlsx oder .csv Dateien werden unterstützt.', 'error')
@@ -2251,6 +2472,19 @@ def _upload_excel_items(scope='inventory'):
         flash(f'Excel-Import abgeschlossen: {created_total} Artikel importiert, {len(import_errors)} Zeilen fehlgeschlagen.', 'warning')
     else:
         flash(f'Excel-Import erfolgreich: {created_total} Artikel importiert.', 'success')
+    if is_library_scope:
+        try:
+            _append_audit_event_standalone(
+                event_type='library_bulk_import',
+                payload={
+                    'channel': 'upload_library_excel',
+                    'created_total': created_total,
+                    'processed_rows': len(planned_rows),
+                }
+            )
+        except Exception:
+            app.logger.warning('Audit write failed for library_bulk_import')
+
     return redirect(url_for('home_admin'))
 
 
@@ -2369,11 +2603,7 @@ def preview_file(filename):
         if denied:
             return denied
 
-        # Check production path first
-        prod_path = "/var/Inventarsystem/Web/previews"
         dev_path = app.config['PREVIEW_FOLDER']
-        if os.path.exists(os.path.join(prod_path, filename)):
-            return send_from_directory(prod_path, filename)
         if os.path.exists(os.path.join(dev_path, filename)):
             return send_from_directory(dev_path, filename)
             
@@ -2640,7 +2870,7 @@ def home():
         
     if not cfg.MODULES.is_enabled('inventory'):
         if cfg.MODULES.is_enabled('library'):
-            return redirect(url_for('library_view'))
+            return redirect('/library')
         else:
             return "Weder Inventar- noch Bibliotheks-Modul sind aktiviert.", 403
 
@@ -2716,8 +2946,9 @@ def tutorial_page():
         student_max_borrow_days=cfg.STUDENT_MAX_BORROW_DAYS
     )
 
+@app.route('/library/export', defaults={'scope': 'all'})
 @app.route('/library/export/<scope>')
-def library_export_excel(scope):
+def library_export_excel(scope='all'):
     if 'username' not in session:
         return redirect(url_for('login'))
         
@@ -2737,7 +2968,7 @@ def library_export_excel(scope):
         filename = f"Bibliothek_Ausgeliehen_{username}.xlsx"
     elif scope == 'all_borrowed':
         if not is_admin_user:
-            return redirect(url_for('library_view'))
+            return redirect('/library')
         query['Verfuegbar'] = False
         filename = "Bibliothek_Alle_Ausleihen.xlsx"
     elif scope == 'schulbuecher':
@@ -2751,7 +2982,7 @@ def library_export_excel(scope):
     client.close()
     
     excel_file = excel_export.generate_library_excel(items)
-    return flask.send_file(
+    return send_file(
         excel_file,
         mimetype='application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
         as_attachment=True,
@@ -2939,6 +3170,7 @@ def api_library_items():
 
         query = {
             'ItemType': {'$in': ['book', 'cd', 'dvd', 'media']},
+            'IsGroupedSubItem': {'$ne': True},
             'Deleted': {'$ne': True}
         }
 
@@ -2961,20 +3193,45 @@ def api_library_items():
 
         total_count = items_db.count_documents(query)
         
-        library_items = list(
-            items_db.find(query, projection)
-            .sort([('Name', 1), ('_id', 1)])
-            .skip(offset)
-            .limit(limit)
-        )
+        raw_items = list(items_db.find(query, projection).sort([('Name', 1), ('_id', 1)]).skip(offset).limit(limit))
 
-        item_ids = [str(item.get('_id')) for item in library_items if item.get('_id')]
+        # Build maps for grouping by parent-child relationship (grouped sub-items)
+        parent_ids_list = [str(itm.get('_id')) for itm in raw_items if itm.get('_id')]
+        children_by_parent = {}
+        child_items = []
+        if parent_ids_list:
+            child_projection = {
+                'Name': 1,
+                'Autor': 1,
+                'Author': 1,
+                'ISBN': 1,
+                'Code_4': 1,
+                'Code4': 1,
+                'ItemType': 1,
+                'Verfuegbar': 1,
+                'Condition': 1,
+                'HasDamage': 1,
+                'User': 1,
+                'Ort': 1,
+                'Beschreibung': 1,
+                'Image': 1,
+                'ParentItemId': 1,
+            }
+            child_items = list(items_db.find({
+                'ParentItemId': {'$in': parent_ids_list},
+                'IsGroupedSubItem': True,
+                'Deleted': {'$ne': True}
+            }, child_projection))
+            for child in child_items:
+                parent_id = str(child.get('ParentItemId') or '')
+                if not parent_id:
+                    continue
+                children_by_parent.setdefault(parent_id, []).append(child)
+
+        all_ids = parent_ids_list + [str(child.get('_id')) for child in child_items if child.get('_id')]
         active_records = []
-        if item_ids:
-            active_records = list(ausleihungen_db.find(
-                {'Item': {'$in': item_ids}, 'Status': 'active'},
-                {'Item': 1, 'User': 1}
-            ))
+        if all_ids:
+            active_records = list(ausleihungen_db.find({'Item': {'$in': all_ids}, 'Status': 'active'}, {'Item': 1, 'User': 1}))
 
         active_item_ids = set()
         active_user_by_item = {}
@@ -2985,32 +3242,76 @@ def api_library_items():
             active_item_ids.add(item_id)
             if item_id not in active_user_by_item:
                 active_user_by_item[item_id] = rec.get('User', '')
-        
-        client.close()
-        
-        # Convert ObjectId to string for JSON serialization
-        for item in library_items:
-            item_id = str(item['_id'])
-            item['_id'] = item_id
-            if item.get('Code4') in (None, '') and item.get('Code_4') not in (None, ''):
-                item['Code4'] = item.get('Code_4')
 
-            condition_value = str(item.get('Condition', '')).strip().lower()
-            has_damage = bool(item.get('HasDamage')) or condition_value == 'destroyed'
-            has_active_borrow = item_id in active_item_ids
+        # Build aggregated list: iterate ordered parent list and include children like inventory module
+        aggregated = []
+        for parent in raw_items:
+            pid = str(parent.get('_id'))
+            children = children_by_parent.get(pid, [])
 
-            if has_damage and not has_active_borrow:
-                item['LibraryDisplayStatus'] = 'damaged'
-            elif has_active_borrow or item.get('Verfuegbar') is False:
-                item['LibraryDisplayStatus'] = 'borrowed'
+            # Compute grouped counts and availability
+            grouped_units = [parent] + children
+            grouped_all_codes = []
+            available_units = []
+            for unit in grouped_units:
+                unit_id = str(unit.get('_id'))
+                code = unit.get('Code_4') or unit.get('Code4') or ''
+                if code:
+                    grouped_all_codes.append(code)
+                if unit.get('Verfuegbar', True):
+                    available_units.append({'id': unit_id, 'code': code, 'label': f"{code} ({unit.get('Name','')})"})
+
+            # Convert ObjectId to string for JSON serialization on parent doc copy
+            doc = dict(parent)
+            doc['_id'] = str(parent.get('_id'))
+            if doc.get('Code4') in (None, '') and doc.get('Code_4') not in (None, ''):
+                doc['Code4'] = doc.get('Code_4')
+
+            condition_value = str(doc.get('Condition', '')).strip().lower()
+            has_damage = bool(doc.get('HasDamage')) or condition_value == 'destroyed'
+            has_active_borrow = any(str(unit.get('_id')) in active_item_ids for unit in grouped_units)
+
+            # Prefer 'available' when any grouped unit is available
+            if has_damage and len(available_units) == 0:
+                doc['LibraryDisplayStatus'] = 'damaged'
+            elif len(available_units) > 0:
+                doc['LibraryDisplayStatus'] = 'available'
+            elif has_active_borrow or doc.get('Verfuegbar') is False:
+                doc['LibraryDisplayStatus'] = 'borrowed'
             else:
-                item['LibraryDisplayStatus'] = 'available'
+                doc['LibraryDisplayStatus'] = 'available'
 
-            item['BorrowedBy'] = active_user_by_item.get(item_id) or item.get('User', '')
+            # Determine borrower: prefer any active borrow on grouped units, fallback to parent.User
+            borrower = ''
+            for unit in grouped_units:
+                u_id = str(unit.get('_id'))
+                if active_user_by_item.get(u_id):
+                    borrower = active_user_by_item.get(u_id)
+                    break
+            if not borrower:
+                borrower = doc.get('User', '')
+            # Decrypt if value is encrypted (decrypt_text returns original if not encrypted)
+            try:
+                borrower = decrypt_text(borrower) if borrower else ''
+            except Exception:
+                # Fallback: keep original string if decryption fails
+                borrower = borrower or ''
 
-        count = len(library_items)
+            doc['BorrowedBy'] = borrower
+
+            doc['GroupedDisplayCount'] = 1 + len(children)
+            doc['Quantity'] = doc['GroupedDisplayCount']
+            doc['AvailableGroupedCount'] = len(available_units)
+            doc['GroupedAvailableUnits'] = available_units
+            doc['GroupedAllCodes'] = grouped_all_codes
+
+            aggregated.append(doc)
+
+        client.close()
+
+        count = len(aggregated)
         return jsonify({
-            'items': library_items,
+            'items': aggregated,
             'offset': offset,
             'limit': limit,
             'count': count,
@@ -3194,28 +3495,82 @@ def api_item_detail(item_id):
         client = MongoClient(MONGODB_HOST, MONGODB_PORT)
         db = client[MONGODB_DB]
         ausleihungen_col = db['ausleihungen']
+        items_col = db['items']
 
-        active_borrow = ausleihungen_col.find_one(
-            {'Item': str(item.get('_id')), 'Status': 'active'},
-            {'User': 1}
-        )
-        client.close()
+        # Determine parent/group id (if this is a child, use its ParentItemId)
+        parent_id = str(item.get('ParentItemId') or str(item.get('_id')))
 
+        # Load all group units (parent + children)
+        group_units_cursor = items_col.find({
+            '$or': [
+                {'_id': ObjectId(parent_id)},
+                {'ParentItemId': parent_id}
+            ],
+            'Deleted': {'$ne': True}
+        })
+        group_units = list(group_units_cursor)
+        if not group_units:
+            # Fallback: just use the single item
+            group_units = [item]
+
+        group_unit_ids = [str(u.get('_id')) for u in group_units if u.get('_id')]
+
+        # Fetch all borrow records for the whole group (active + history)
+        borrow_records = list(ausleihungen_col.find({'Item': {'$in': group_unit_ids}}).sort('Start', -1))
+
+        # Compute availability and damage state across group
+        available_units = [u for u in group_units if u.get('Verfuegbar', True)]
         condition_value = str(item.get('Condition', '')).strip().lower()
         has_damage = bool(item.get('HasDamage')) or condition_value == 'destroyed'
-        if has_damage and not active_borrow:
+
+        if has_damage and len(available_units) == 0:
             status_label = 'Defekt/Zerstört'
-        elif item.get('Verfuegbar') is False or active_borrow:
+        elif len(available_units) > 0:
+            status_label = 'Verfügbar'
+        elif any(r.get('Status') == 'active' for r in borrow_records):
             status_label = 'Ausgeliehen'
         else:
             status_label = 'Verfügbar'
 
+        # Prefer the most recent active borrower across the group
         borrower_value = ''
-        if active_borrow:
-            borrower_value = active_borrow.get('User', '')
-        elif item.get('User'):
-            borrower_value = item.get('User')
-        
+        for rec in borrow_records:
+            if rec.get('Status') == 'active' and rec.get('User'):
+                try:
+                    borrower_value = decrypt_text(rec.get('User'))
+                except Exception:
+                    borrower_value = rec.get('User')
+                break
+        if not borrower_value and item.get('User'):
+            try:
+                borrower_value = decrypt_text(item.get('User'))
+            except Exception:
+                borrower_value = item.get('User')
+
+        # Helper to format datetimes
+        def fmt_dt(dt):
+            try:
+                return dt.strftime('%d.%m.%Y %H:%M') if dt else ''
+            except Exception:
+                return str(dt) if dt else ''
+
+        # Build HTML for borrow records (if any)
+        borrows_html = ''
+        if borrow_records:
+            rows = []
+            for rec in borrow_records:
+                user_raw = rec.get('User') or ''
+                try:
+                    user = decrypt_text(user_raw) if user_raw else ''
+                except Exception:
+                    user = user_raw
+                status = rec.get('Status', '')
+                start = fmt_dt(rec.get('Start'))
+                end = fmt_dt(rec.get('End'))
+                notes = html.escape(str(rec.get('Notes') or ''))
+                rows.append(f"<li><strong>{html.escape(user or '-')}</strong> — {html.escape(status)} — {html.escape(start)} → {html.escape(end)}{(' — ' + notes) if notes else ''}</li>")
+            borrows_html = f"<h3>Ausleihhistorie</h3><ul>{''.join(rows)}</ul>"
+
         # Basic detail HTML
         detail_html = f"""
         <h2>{html.escape(item.get('Name', 'Untitled'))}</h2>
@@ -3224,7 +3579,10 @@ def api_item_detail(item_id):
         <p><strong>Beschreibung:</strong> {html.escape(item.get('Beschreibung', '-'))}</p>
         <p><strong>Status:</strong> {html.escape(status_label)}</p>
         {f'<p><strong>Ausgeliehen von:</strong> {html.escape(str(borrower_value))}</p>' if borrower_value and status_label == 'Ausgeliehen' else ''}
+        {borrows_html}
         """
+        client.close()
+        return detail_html, 200
         return detail_html, 200
     except Exception as e:
         app.logger.error(f"Error fetching item detail: {e}")
@@ -3295,6 +3653,19 @@ def api_library_item_update(item_id):
             update_doc['ISBN'] = ''
 
         items_col.update_one({'_id': ObjectId(item_id)}, {'$set': update_doc})
+        try:
+            _append_audit_event_standalone(
+                event_type='library_item_updated',
+                payload={
+                    'channel': 'library_table',
+                    'item_id': item_id,
+                    'updated_fields': list(update_doc.keys()),
+                    'isbn': update_doc.get('ISBN', ''),
+                }
+            )
+        except Exception:
+            app.logger.warning('Audit write failed for library_item_updated')
+
         client.close()
 
         return jsonify({'ok': True, 'message': 'Bibliotheksmedium aktualisiert.'}), 200
@@ -4134,6 +4505,7 @@ def logout():
     session.pop('is_admin', None)
     session.pop('favorites', None)
     session.pop('favorites_owner', None)
+    session.pop('tenant_id', None)
     return redirect(url_for('login'))
 
 
@@ -4705,16 +5077,15 @@ def upload_item():
 
     item_isbn = ''
     item_type = 'general'
-    if cfg.MODULES.is_enabled('library'):
-        item_isbn = normalize_and_validate_isbn(isbn_raw)
-        if isbn_raw and not item_isbn:
-            error_msg = 'Ungültige ISBN. Bitte ISBN-10 oder ISBN-13 verwenden.'
-            if is_mobile:
-                return jsonify({'success': False, 'message': error_msg}), 400
-            flash(error_msg, 'error')
-            return redirect(url_for(success_redirect_endpoint))
-        if item_isbn:
+    if cfg.MODULES.is_enabled('library') and isbn_raw:
+        normalized_isbn = normalize_and_validate_isbn(isbn_raw)
+        if normalized_isbn:
+            item_isbn = normalized_isbn
             item_type = 'book'
+        else:
+            item_isbn = isbn_raw
+            if upload_mode == 'library':
+                item_type = 'book'
 
     if upload_mode == 'library':
         if not cfg.MODULES.is_enabled('library'):
@@ -4723,8 +5094,8 @@ def upload_item():
                 return jsonify({'success': False, 'message': error_msg}), 400
             flash(error_msg, 'error')
             return redirect(url_for(success_redirect_endpoint))
-        if not item_isbn:
-            error_msg = 'Für Bücher ist eine gültige ISBN erforderlich.'
+        if not isbn_raw:
+            error_msg = 'Für Bücher ist eine ISBN oder ein Barcode erforderlich.'
             if is_mobile:
                 return jsonify({'success': False, 'message': error_msg}), 400
             flash(error_msg, 'error')
@@ -5514,7 +5885,21 @@ def upload_item():
     # Create QR code for the item (deactivated)
     # create_qr_code(str(item_id))
         success_msg = f'Element wurde erfolgreich hinzugefügt ({len(created_item_ids)} erstellt)'
-        
+        if upload_mode == 'library':
+            try:
+                _append_audit_event_standalone(
+                    event_type='library_item_created',
+                    payload={
+                        'channel': 'upload_admin',
+                        'created_item_ids': created_item_ids,
+                        'created_count': len(created_item_ids),
+                        'isbn': item_isbn,
+                        'codes': created_item_ids and [it.get_item(cid).get('Code_4') for cid in created_item_ids] or []
+                    }
+                )
+            except Exception:
+                app.logger.warning('Audit write failed for library_item_created')
+
         if is_mobile:
             return jsonify({
                 'success': True, 
@@ -5818,6 +6203,79 @@ def delete_item(id):
     return redirect(url_for('home_admin'))
 
 
+@app.route('/delete_library_item/<id>', methods=['POST'])
+def delete_library_item(id):
+    """
+    Route to soft-delete library items (books/media) revisionssicher.
+    Requires admin and library module enabled.
+    """
+    if 'username' not in session:
+        flash('Nicht angemeldet.', 'error')
+        return redirect(url_for('login'))
+    if not us.check_admin(session['username']):
+        flash('Administratorrechte erforderlich.', 'error')
+        return redirect(url_for('login'))
+    if not cfg.MODULES.is_enabled('library'):
+        flash('Bibliotheks-Modul ist deaktiviert.', 'error')
+        return redirect(url_for('home_admin'))
+
+    # Verify item exists and is a library item
+    try:
+        item_doc = it.get_item(id)
+    except Exception:
+        item_doc = None
+
+    if not item_doc:
+        flash('Element nicht gefunden.', 'error')
+        return redirect(url_for('library_admin'))
+
+    if item_doc.get('ItemType') not in LIBRARY_ITEM_TYPES:
+        flash('Element ist kein Bibliotheksmedium.', 'error')
+        return redirect(url_for('library_admin'))
+
+    group_item_ids = it.get_group_item_ids(id)
+    if not group_item_ids:
+        flash('Element nicht gefunden.', 'error')
+        return redirect(url_for('library_admin'))
+
+    client = None
+    try:
+        client = MongoClient(MONGODB_HOST, MONGODB_PORT)
+        db = client[MONGODB_DB]
+        result = _soft_delete_item_groups(db, [id], session.get('username', ''))
+        success = bool(result.get('success'))
+        soft_deleted = int(result.get('soft_deleted_items', 0))
+        archived_files = int((result.get('archive') or {}).get('archived_files', 0))
+
+        try:
+            _append_audit_event_standalone(
+                event_type='library_item_deleted',
+                payload={
+                    'root_item_id': id,
+                    'group_item_ids': result.get('group_item_ids', []),
+                    'soft_deleted_items': soft_deleted,
+                    'archived_files': archived_files,
+                }
+            )
+        except Exception:
+            app.logger.warning('Audit write failed for library_item_deleted')
+
+    except Exception as e:
+        app.logger.error(f"Error deleting library item {id}: {e}")
+        success = False
+        archived_files = 0
+    finally:
+        if client:
+            client.close()
+
+    if success:
+        flash(f'Bibliotheksmedium revisionssicher deaktiviert ({soft_deleted} Versionen, {archived_files} Mediendateien archiviert).', 'success')
+    else:
+        flash('Fehler beim Löschen des Bibliotheksmediums.', 'error')
+
+    return redirect(url_for('library_admin'))
+
+
 @app.route('/bulk_delete_items', methods=['POST'])
 def bulk_delete_items():
     """Soft-delete multiple selected item groups in one request."""
@@ -6065,6 +6523,20 @@ def report_damage(id):
         except Exception as log_err:
             app.logger.warning(f"Damage report log write failed for item {id}: {log_err}")
 
+        try:
+            _append_audit_event_standalone(
+                event_type='item_damage_reported',
+                payload={
+                    'item_id': id,
+                    'item_name': item_doc.get('Name', ''),
+                    'reported_by': session.get('username'),
+                    'description': description,
+                    'damage_count': damage_count,
+                }
+            )
+        except Exception:
+            app.logger.warning('Audit write failed for item_damage_reported')
+
         return jsonify({
             'success': True,
             'message': 'Schaden erfolgreich erfasst.',
@@ -6147,6 +6619,18 @@ def mark_damage_repaired(id):
         except Exception as log_err:
             app.logger.warning(f"Damage repair log write failed for item {id}: {log_err}")
 
+        try:
+            _append_audit_event_standalone(
+                event_type='item_damage_repaired',
+                payload={
+                    'item_id': id,
+                    'resolved_by': session.get('username'),
+                    'resolved_count': len(open_reports),
+                }
+            )
+        except Exception:
+            app.logger.warning('Audit write failed for item_damage_repaired')
+
         return jsonify({
             'success': True,
             'message': 'Schäden als repariert markiert.',
@@ -7082,6 +7566,10 @@ def terminplan():
         if 'username' not in session:
             flash('Ihnen ist es nicht gestattet auf dieser Internetanwendung, die eben besuchte Adrrese zu nutzen, versuchen sie es erneut nach dem sie sich mit einem berechtigten Nutzer angemeldet haben!', 'error')
             return redirect(url_for('login'))
+
+        if not cfg.MODULES.is_enabled('terminplan'):
+            flash('Der Terminplaner ist deaktiviert.', 'info')
+            return redirect(url_for('home'))
         
         # Make sure the template exists
         template_path = os.path.join(BASE_DIR, 'templates', 'terminplan.html')

Web/modules/__init__.py

@@ -0,0 +1 @@
+# Web.modules package initialization

Web/modules/bibliothek/__init__.py

@@ -0,0 +1 @@
+# Web.modules.bibliothek package initialization

Web/modules/database/ausleihung.py

@@ -103,7 +103,7 @@ def get_current_status(ausleihung, log_changes=False, user=None):
     if log_changes and new_status != original_status and '_id' in ausleihung:
         try:
             # Importieren Sie das Modul nur bei Bedarf, um zirkuläre Importe zu vermeiden
-            import Web.modules.logs.ausleihung_log as ausleihung_log
+            import Web.modules.log.ausleihung_log as ausleihung_log
             ausleihung_log.log_status_change(
                 str(ausleihung['_id']), 
                 original_status, 

Web/modules/database/items.py

@@ -18,14 +18,6 @@ Collection Structure:
   - Optional fields: Images, Filter, Filter2, Filter3, Anschaffungsjahr, Anschaffungskosten, Code_4
   - Status fields: Verfuegbar, User (if currently borrowed)
 """
-'''
-   Copyright 2025-2026 AIIrondev
-
-   Licensed under the Inventarsystem EULA (Endbenutzer-Lizenzvertrag).
-   See Legal/LICENSE for the full license text.
-   Unauthorized commercial use, SaaS hosting, or removal of branding is prohibited.
-   For commercial licensing inquiries: https://github.com/AIIrondev
-'''
 from bson.objectid import ObjectId
 import datetime
 import Web.modules.database.settings as cfg

Web/modules/database/settings.py

@@ -71,6 +71,15 @@ DEFAULTS = {
         'logo_path': '',
         'logo_thumb': '',
         'logo_thumb': '',
+        # School-level rollover configuration for advancing class years
+        'rollover': {
+            'month': 9,
+            'day': 1,
+            'hour': 3,
+            'minute': 0,
+            'max_class': 13,
+            'graduate_label': ''
+        },
     },
     'schoolPeriods': {
         "1": {"start": "08:00", "end": "08:45", "label": "1. Stunde (08:00 - 08:45)"},
@@ -88,6 +97,9 @@ DEFAULTS = {
         'inventory': {
             'enabled': True
         },
+        'terminplan': {
+            'enabled': True
+        },
         'library': {
             'enabled': False
         },
@@ -100,9 +112,29 @@ DEFAULTS = {
 }
 
 # Load configuration file
-CONFIG_PATH = os.path.join(BASE_DIR, '..', 'config.json')
+def _resolve_config_path():
+    """Resolve runtime config path with robust fallbacks for Docker deployments."""
+    env_path = os.getenv('INVENTAR_CONFIG_PATH', '').strip()
+    if env_path:
+        return env_path
+
+    candidates = [
+        os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(BASE_DIR))), 'config.json'),
+        os.path.join(os.path.dirname(os.path.dirname(BASE_DIR)), 'config.json'),
+        os.path.join(os.path.dirname(BASE_DIR), 'config.json'),
+        os.path.join(BASE_DIR, '..', 'config.json'),
+    ]
+
+    for candidate in candidates:
+        if os.path.isfile(candidate):
+            return os.path.abspath(candidate)
+
+    return os.path.abspath(candidates[0])
+
+
+CONFIG_PATH = _resolve_config_path()
 try:
-    with open(CONFIG_PATH, 'r') as f:
+    with open(CONFIG_PATH, 'r', encoding='utf-8') as f:
         _conf = json.load(f)
 except Exception:
     _conf = {}
@@ -135,10 +167,19 @@ def _get_int_env(name, default):
         return int(default)
 
 def get_version():
-    with open(os.path.join(BASE_DIR, '..', '.docker-build.env'), 'r') as f:
-        for l in f:
-            if l.startswith('INVENTAR_APP_IMAGE='):
-                return l.split(':', 1)[1].strip()
+    # Prefer an explicit release marker if present (created by release process).
+    project_root = os.path.abspath(os.path.join(BASE_DIR, '..', '..', '..'))
+    release_file = os.path.join(project_root, '.docker-build.env')
+    try:
+        if os.path.isfile(release_file):
+            with open(release_file, 'r', encoding='utf-8') as f:
+                var = f.readline()
+                for i in var:
+                    i = i.split(":")
+                    i.pop[0]
+                    return str(i)
+    except Exception:
+        pass
 
 # Expose settings
 APP_VERSION = get_version()
@@ -178,10 +219,30 @@ SSL_ENABLED = _get(_conf, ['ssl', 'enabled'], DEFAULTS['ssl']['enabled'])
 SSL_CERT = _get(_conf, ['ssl', 'cert'], DEFAULTS['ssl']['cert'])
 SSL_KEY = _get(_conf, ['ssl', 'key'], DEFAULTS['ssl']['key'])
 
+# Email settings
+EMAIL_ENABLED = _get(_conf, ['email', 'enabled'], False)
+EMAIL_SMTP_HOST = _get(_conf, ['email', 'smtp_host'], 'smtp.gmail.com')
+EMAIL_SMTP_PORT = int(_get(_conf, ['email', 'smtp_port'], 587))
+EMAIL_USE_TLS = bool(_get(_conf, ['email', 'use_tls'], True))
+EMAIL_USERNAME = _get(_conf, ['email', 'username'], '')
+EMAIL_PASSWORD = _get(_conf, ['email', 'password'], '')
+EMAIL_FROM_ADDRESS = _get(_conf, ['email', 'from_address'], EMAIL_USERNAME)
+EMAIL_DEFAULT_SENDER_NAME = _get(_conf, ['email', 'default_sender_name'], 'Inventarsystem')
+EMAIL_TIMEOUT_SECONDS = int(_get(_conf, ['email', 'timeout_seconds'], 30))
+
 # School periods
 SCHOOL_PERIODS = _get(_conf, ['schoolPeriods'], DEFAULTS['schoolPeriods'])
 SCHOOL_INFO_DEFAULT = _get(_conf, ['school'], DEFAULTS['school'])
 
+# School rollover configuration (can be set in config.json under `school.rollover`)
+SCHOOL_ROLLOVER = _get(_conf, ['school', 'rollover'], DEFAULTS['school'].get('rollover', {}))
+SCHOOL_ROLLOVER_MONTH = int(os.getenv('INVENTAR_SCHOOL_ROLLOVER_MONTH', str(SCHOOL_ROLLOVER.get('month', 9))))
+SCHOOL_ROLLOVER_DAY = int(os.getenv('INVENTAR_SCHOOL_ROLLOVER_DAY', str(SCHOOL_ROLLOVER.get('day', 1))))
+SCHOOL_ROLLOVER_HOUR = int(os.getenv('INVENTAR_SCHOOL_ROLLOVER_HOUR', str(SCHOOL_ROLLOVER.get('hour', 3))))
+SCHOOL_ROLLOVER_MIN = int(os.getenv('INVENTAR_SCHOOL_ROLLOVER_MIN', str(SCHOOL_ROLLOVER.get('minute', 0))))
+SCHOOL_ROLLOVER_MAX_CLASS = int(os.getenv('INVENTAR_SCHOOL_MAX_CLASS', str(SCHOOL_ROLLOVER.get('max_class', 13))))
+SCHOOL_ROLLOVER_GRADUATE_LABEL = os.getenv('INVENTAR_SCHOOL_GRADUATE_LABEL', str(SCHOOL_ROLLOVER.get('graduate_label', '')))
+
 # Optional feature modules
 TENANT_CONFIGS = _get(_conf, ['tenants'], {})
 
@@ -214,13 +275,20 @@ class _TenantAwareBool:
 from Web.modules.module_registry import registry as MODULES
 
 INVENTORY_MODULE_ENABLED = _TenantAwareBool('inventory', _get(_conf, ['modules', 'inventory', 'enabled'], DEFAULTS['modules']['inventory']['enabled']))
+TERMINPLAN_MODULE_ENABLED = _TenantAwareBool('terminplan', _get(_conf, ['modules', 'terminplan', 'enabled'], DEFAULTS['modules']['terminplan']['enabled']))
 LIBRARY_MODULE_ENABLED = _TenantAwareBool('library', _get(_conf, ['modules', 'library', 'enabled'], DEFAULTS['modules']['library']['enabled']))
 STUDENT_CARDS_MODULE_ENABLED = _TenantAwareBool('student_cards', _get(_conf, ['modules', 'student_cards', 'enabled'], DEFAULTS['modules']['student_cards']['enabled']))
 
 def _match_inventory(path):
     if not path: return False
     if path == '/' or path.startswith('/home'): return True
-    return path.startswith(('/scanner', '/inventory', '/upload_admin', '/manage_filters', '/manage_locations', '/admin_borrowings', '/admin_damaged_items', '/admin/borrowings', '/admin/damaged_items', '/terminplan'))
+    return path.startswith(('/scanner', '/inventory', '/upload_admin', '/manage_filters', '/manage_locations', '/admin_borrowings', '/admin_damaged_items', '/admin/borrowings', '/admin/damaged_items'))
+
+
+def _match_terminplan(path):
+    if not path:
+        return False
+    return path.startswith(('/terminplan', '/terminplaner'))
 
 def _match_library(path):
     if not path: return False
@@ -232,6 +300,7 @@ def _match_student_cards(path):
 
 # Register core modules into the pipeline
 MODULES.register('inventory', INVENTORY_MODULE_ENABLED, _match_inventory)
+MODULES.register('terminplan', TERMINPLAN_MODULE_ENABLED, _match_terminplan)
 MODULES.register('library', LIBRARY_MODULE_ENABLED, _match_library)
 MODULES.register('student_cards', STUDENT_CARDS_MODULE_ENABLED, _match_student_cards)
 

Web/modules/database/termine.py

@@ -0,0 +1,165 @@
+"""
+Apointment Managment
+=========================
+
+This module manages appointments in the database. It provides comprehensive 
+functionality for creating, updating, retrieving appointments items.
+
+Key Features:
+- Creating and updating appointments
+- Retrieving items by ID
+- Managing time slots
+- client retrival
+
+Collection Structure:
+- appointments:
+  - Required fields: user, start_date, end_date, daytime, slots, slot_time
+  - Optional fields: Images, Filter, Filter2, Filter3, Anschaffungsjahr, Anschaffungskosten, Code_4
+  - Status fields: slots_used_by
+"""
+import Web.modules.database.settings as cfg
+from Web.modules.database.settings import MongoClient
+from bson.objectid import ObjectId
+import datetime 
+
+def _active_record_query(extra_query=None):
+    """Build a query that excludes logically deleted records."""
+    base_query = {'Deleted': {'$ne': True}}
+    if extra_query:
+        base_query.update(extra_query)
+    return base_query
+
+
+def add(date_start: str, date_end: str, time_span: list, slots: int, slot_lenght: int, user: str, mail: list=[], note:str=""):
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+        items = db['appointments']
+
+        item = {
+            'date_start': date_start,
+            'date_end': date_end,
+            'time_span': time_span,
+            'slots': slots,
+            'slot_lenght': slot_lenght,
+            'user': user,
+            'mail': mail,
+            'note': note,
+            'slots_booked': [], # -> [(start_time, name), ...]the list gets there indexes as the slot 1-defined so is can be counted without an extra variable
+            'Created': datetime.datetime.now(),
+            'LastUpdated': datetime.datetime.now()
+        }
+        result = items.insert_one(item)
+        return result.inserted_id
+    except Exception as e:
+        print(f"Exception accured: {e}")
+
+
+def get_item(id):
+    """
+    Retrieve a specific appointment by its ID.
+    
+    Args:
+        id (str): ID of the appointsment to retrieve
+        
+    Returns:
+        dict: The appointment document or None if not found
+    """
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+        items = db['appointments']
+        item = items.find_one(_active_record_query({'_id': ObjectId(id)}))
+        client.close()
+        return item
+    except Exception as e:
+        print(f"Error retrieving item: {e}")
+        return None
+
+def update(id,slots_used: list):
+    """
+    Update an existing appointment.
+    
+    Args:
+        id (str): ID of the item to update
+        
+        
+    Returns:
+        bool: True if successful, False otherwise
+    """
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+        items = db['appointments']
+
+        update_data = {
+            'slots_booked': [slots_used],
+            'LastUpdated': datetime.datetime.now()
+        }
+
+        result = items.update_one(
+            {'_id': ObjectId(id)},
+            {'$set': update_data}
+        )
+
+        client.close()
+        return result.modified_count > 0
+    except Exception as e:
+        print(f"Error updating item: {e}")
+        return False
+
+
+def remove_slot(id, date_start_time, name):
+    """
+    Remove a booked slot from an appointment's `slots_booked`.
+
+    Args:
+        id (str): Appointment ID
+        date_start_time: The start time value used when booking
+        name (str): Name associated with the booking
+
+    Returns:
+        bool: True if a slot was removed, False otherwise
+    """
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+        items = db['appointments']
+
+        # Attempt to pull the exact element (stored as an array/tuple)
+        result = items.update_one(
+            {'_id': ObjectId(id)},
+            {'$pull': {'slots_booked': [date_start_time, name]}}
+        )
+
+        client.close()
+        return result.modified_count > 0
+    except Exception as e:
+        print(f"Error removing slot: {e}")
+        return False
+
+
+def remove(id):
+    """
+    Soft-delete an appointment by setting its `Deleted` flag.
+
+    Args:
+        id (str): Appointment ID
+
+    Returns:
+        bool: True if the appointment was marked deleted, False otherwise
+    """
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = client[cfg.MONGODB_DB]
+        items = db['appointments']
+
+        result = items.delete_one({'_id': ObjectId(id)})
+
+        client.close()
+        return result.modified_count > 0
+    except Exception as e:
+        print(f"Error removing appointment: {e}")
+        return False
+
+ 

Web/modules/database/user.py

@@ -12,6 +12,7 @@ Provides methods for creating, validating, and retrieving user information.
 '''
 import hashlib
 import copy
+import importlib
 import logging
 import re
 import secrets
@@ -59,6 +60,35 @@ def _get_tenant_db(client):
         return client[cfg.MONGODB_DB]
 
 
+def _has_tenant_configs():
+    for module_name in ('tenant', 'Web.tenant'):
+        try:
+            tenant_module = importlib.import_module(module_name)
+            tenant_registry = getattr(tenant_module, 'TENANT_REGISTRY', None)
+            if isinstance(tenant_registry, dict) and tenant_registry:
+                return True
+        except Exception:
+            continue
+    return isinstance(getattr(cfg, 'TENANT_CONFIGS', None), dict) and bool(cfg.TENANT_CONFIGS)
+
+
+def _resolve_request_tenant_db():
+    for module_name in ('tenant', 'Web.tenant'):
+        try:
+            tenant_module = importlib.import_module(module_name)
+            get_tenant_context = getattr(tenant_module, 'get_tenant_context', None)
+            if not callable(get_tenant_context):
+                continue
+            ctx = get_tenant_context()
+            if ctx and ctx.tenant_id:
+                return ctx.db_name or ctx.resolve_tenant(), ctx.tenant_id
+            if ctx and ctx.db_name and not _has_tenant_configs():
+                return ctx.db_name, None
+        except Exception as exc:
+            logger.debug("Tenant context import %s failed: %s", module_name, exc)
+    return None, None
+
+
 def build_name_synonym(first_name, last_name=''):
     """Build a deterministic, non-personalized short alias from 2 letters each."""
     first = _clean_name_fragment(first_name)
@@ -424,22 +454,26 @@ def check_nm_pwd(username, password):
     Returns:
         dict: User document if credentials are valid, None otherwise
     """
-    db_name = cfg.MONGODB_DB
-    tenant_db = None
+    db_name, tenant_id = _resolve_request_tenant_db()
     ctx = None
     try:
         from tenant import get_tenant_context
         ctx = get_tenant_context()
-        if ctx and ctx.tenant_id:
-            tenant_db = ctx.db_name or ctx.resolve_tenant()
-            db_name = tenant_db
-    except Exception as exc:
-        logger.exception(f"Failed to resolve tenant context in check_nm_pwd: {exc}")
+    except Exception:
+        ctx = None
+
+    if not db_name:
+        if _has_tenant_configs():
+            logger.warning(
+                "Refusing default DB fallback for login because tenant configs exist and no tenant was resolved."
+            )
+            return None
+        db_name = cfg.MONGODB_DB
 
     logger.info(
         "check_nm_pwd start: username=%r tenant=%r db=%r host=%r port=%r uri=%r",
         username,
-        ctx.tenant_id if ctx else None,
+        tenant_id,
         db_name,
         cfg.MONGODB_HOST,
         cfg.MONGODB_PORT,
@@ -644,15 +678,17 @@ def get_user(username):
             return users.find_one({'Username': username}) or users.find_one({'username': username})
 
         # Try current tenant first when available
-        try:
-            from tenant import get_tenant_context
-            ctx = get_tenant_context()
-            if ctx and ctx.db_name:
-                user = find_in_db(ctx.db_name)
-                if user:
-                    return user
-        except Exception:
-            pass
+        tenant_db, tenant_id = _resolve_request_tenant_db()
+        if tenant_db:
+            user = find_in_db(tenant_db)
+            if user:
+                return user
+
+        if _has_tenant_configs() and tenant_db is None:
+            logger.warning(
+                "Refusing default DB fallback for user lookup because tenant configs exist and no tenant was resolved."
+            )
+            return None
 
         # Fallback to default configured database
         user = find_in_db(cfg.MONGODB_DB)

Web/modules/emailservice/__init__.py

@@ -0,0 +1 @@
+# Web.modules.emailservice package initialization

Web/modules/emailservice/email.py

@@ -0,0 +1,47 @@
+from email.mime.text import MIMEText
+from email.mime.multipart import MIMEMultipart
+import smtplib
+
+import Web.modules.database.settings as cfg
+
+
+def _build_smtp_client():
+    smtp = smtplib.SMTP(cfg.EMAIL_SMTP_HOST, cfg.EMAIL_SMTP_PORT, timeout=cfg.EMAIL_TIMEOUT_SECONDS)
+    smtp.ehlo()
+    if cfg.EMAIL_USE_TLS:
+        smtp.starttls()
+        smtp.ehlo()
+    if cfg.EMAIL_USERNAME:
+        smtp.login(cfg.EMAIL_USERNAME, cfg.EMAIL_PASSWORD or '')
+    return smtp
+
+def send(email: list, subject: str, note: str, sender: str) -> bool:
+  """
+  Sends the email with the link to the Clients
+
+  Input:
+  - email: Email list of all the addresses to send the link to ["","",""]
+  - subject: Subject of the email
+  - note: Note that is send with the Emails
+
+  Output:
+  - bool: true if the sending worked and false if it didnt
+  """
+  msg = MIMEMultipart()
+  msg['Subject'] = subject
+  msg['From'] = sender or cfg.EMAIL_FROM_ADDRESS or cfg.EMAIL_USERNAME
+  msg['To'] = ', '.join(email) if isinstance(email, (list, tuple)) else str(email)
+  msg.attach(MIMEText(note))
+  smtp = None
+  try:
+    smtp = _build_smtp_client()
+    smtp.sendmail(from_addr=msg['From'], to_addrs=email, msg=msg.as_string())
+    return True
+  except Exception:
+    return False
+  finally:
+    try:
+      if smtp:
+        smtp.quit()
+    except Exception:
+      pass

Web/modules/log/__init__.py

@@ -0,0 +1 @@
+# Web.modules.log package initialization

Web/modules/log/audit_log.py

@@ -0,0 +1,149 @@
+"""
+Tamper-evident audit logging helpers.
+
+The audit chain stores each entry with a hash of the previous entry.
+Any mutation in history breaks the chain verification.
+"""
+
+import datetime
+import hashlib
+import json
+import random
+import time
+
+from pymongo.errors import DuplicateKeyError
+
+
+def _stable_json(value):
+    """Serialize dictionaries in a stable way for deterministic hashing."""
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=str)
+
+
+def _entry_hash(prev_hash, payload):
+    """Build the chained entry hash from previous hash + canonical payload."""
+    base = f"{prev_hash}|{_stable_json(payload)}"
+    return hashlib.sha256(base.encode("utf-8")).hexdigest()
+
+
+def append_audit_event(db, event_type, actor, payload, request_ip=None, source="web", max_retries=5):
+    """
+    Append an audit event to a tamper-evident chain.
+
+    Args:
+        db: MongoDB database handle.
+        event_type (str): Event category.
+        actor (str): User/system who performed the action.
+        payload (dict): Event details.
+        request_ip (str, optional): Request origin.
+        source (str): Source subsystem.
+
+    Returns:
+        dict: Inserted audit entry.
+    """
+    logs = db["audit_log"]
+    attempts = 0
+
+    while attempts <= max_retries:
+        previous = logs.find_one(sort=[("chain_index", -1)])
+        prev_hash = previous.get("entry_hash", "") if previous else ""
+        chain_index = int(previous.get("chain_index", 0)) + 1 if previous else 1
+
+        timestamp = datetime.datetime.utcnow()
+        entry_payload = {
+            "event_type": event_type,
+            "actor": actor or "system",
+            "source": source,
+            "ip": request_ip or "",
+            "payload": payload or {},
+            "timestamp": timestamp.isoformat() + "Z",
+        }
+
+        entry_hash = _entry_hash(prev_hash, entry_payload)
+
+        entry = {
+            **entry_payload,
+            "created_at": timestamp,
+            "prev_hash": prev_hash,
+            "entry_hash": entry_hash,
+            "chain_index": chain_index,
+        }
+
+        try:
+            logs.insert_one(entry)
+            return entry
+        except DuplicateKeyError:
+            attempts += 1
+            if attempts > max_retries:
+                raise
+            # Exponential backoff with jitter to avoid retry storms.
+            delay = min(0.25, (0.005 * (2 ** attempts)) + random.random() * 0.01)
+            time.sleep(delay)
+
+
+def ensure_audit_indexes(db):
+    """Create indexes required for fast and safe audit operations."""
+    logs = db["audit_log"]
+    logs.create_index("chain_index", unique=True, name="audit_chain_index_unique")
+    logs.create_index("created_at", name="audit_created_at_idx")
+    logs.create_index("event_type", name="audit_event_type_idx")
+
+
+def verify_audit_chain(db):
+    """Verify hash chain integrity across all stored audit entries."""
+    logs = db["audit_log"]
+    entries = list(logs.find({}, {"_id": 1, "event_type": 1, "actor": 1, "source": 1, "ip": 1, "payload": 1, "timestamp": 1, "prev_hash": 1, "entry_hash": 1, "chain_index": 1}).sort("chain_index", 1))
+
+    previous_hash = ""
+    previous_index = 0
+    mismatches = []
+
+    for entry in entries:
+        chain_index = int(entry.get("chain_index", 0))
+        prev_hash = entry.get("prev_hash", "")
+        entry_hash = entry.get("entry_hash", "")
+
+        payload = {
+            "event_type": entry.get("event_type", ""),
+            "actor": entry.get("actor", ""),
+            "source": entry.get("source", ""),
+            "ip": entry.get("ip", ""),
+            "payload": entry.get("payload", {}),
+            "timestamp": entry.get("timestamp", ""),
+        }
+
+        expected_hash = _entry_hash(previous_hash, payload)
+
+        if chain_index != previous_index + 1:
+            mismatches.append({
+                "chain_index": chain_index,
+                "error": "chain_index_gap",
+                "expected": previous_index + 1,
+                "found": chain_index,
+            })
+
+        if prev_hash != previous_hash:
+            mismatches.append({
+                "chain_index": chain_index,
+                "error": "prev_hash_mismatch",
+                "expected": previous_hash,
+                "found": prev_hash,
+            })
+
+        if entry_hash != expected_hash:
+            mismatches.append({
+                "chain_index": chain_index,
+                "error": "entry_hash_mismatch",
+                "expected": expected_hash,
+                "found": entry_hash,
+            })
+
+        previous_hash = entry_hash
+        previous_index = chain_index
+
+    return {
+        "ok": len(mismatches) == 0,
+        "count": len(entries),
+        "last_chain_index": previous_index,
+        "last_hash": previous_hash,
+        "mismatches": mismatches,
+    }

Web/modules/log/ausleihung_log.py

@@ -0,0 +1,45 @@
+'''
+   Copyright 2025-2026 AIIrondev
+
+   Licensed under the Inventarsystem EULA (Endbenutzer-Lizenzvertrag).
+   See Legal/LICENSE for the full license text.
+   Unauthorized commercial use, SaaS hosting, or removal of branding is prohibited.
+   For commercial licensing inquiries: https://github.com/AIIrondev
+'''
+"""
+Funktion zum Protokollieren von Statusänderungen bei Ausleihungen
+"""
+import os
+import datetime
+from bson.objectid import ObjectId
+
+def log_status_change(ausleihung_id, old_status, new_status, user=None):
+    """
+    Protokolliert eine Statusänderung einer Ausleihung in einer Log-Datei.
+    
+    Args:
+        ausleihung_id: Die ID der Ausleihung
+        old_status: Der alte Status
+        new_status: Der neue Status
+        user: Der Benutzer, der die Änderung vorgenommen hat (optional)
+    """
+    try:
+        # Erstelle Log-Verzeichnis, falls es nicht existiert
+        log_dir = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'logs')
+        if not os.path.exists(log_dir):
+            os.makedirs(log_dir)
+        
+        # Log-Datei für Statusänderungen
+        log_file = os.path.join(log_dir, 'ausleihungen_status_changes.log')
+        
+        # Protokolliere die Änderung
+        timestamp = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
+        user_info = f" by {user}" if user else ""
+        
+        with open(log_file, 'a', encoding='utf-8') as f:
+            f.write(f"{timestamp}: Ausleihung {ausleihung_id} - Status changed from '{old_status}' to '{new_status}'{user_info}\n")
+            
+        return True
+    except Exception as e:
+        print(f"Fehler beim Protokollieren der Statusänderung: {e}")
+        return False

Web/modules/terminplaner/__init__.py

@@ -1 +1 @@
-print("hello")
+# Web.modules package initialization

Web/modules/terminplaner/backend_server.py

@@ -0,0 +1,217 @@
+"""
+Class for all funktions of the executive -> Lehrer
+"""
+import datetime
+import emailservice.email as mail_service
+import Web.modules.database.termine as termin
+import Web.modules.database.settings as cfg
+from tenant import get_tenant_context
+
+
+def _normalize_time_span(time_span):
+    if isinstance(time_span, list):
+        return [str(entry).strip() for entry in time_span if str(entry).strip()]
+    if isinstance(time_span, tuple):
+        return [str(entry).strip() for entry in time_span if str(entry).strip()]
+    if isinstance(time_span, str):
+        normalized = []
+        for line in time_span.replace(';', '\n').replace(',', '\n').splitlines():
+            value = line.strip()
+            if value:
+                normalized.append(value)
+        return normalized
+    return []
+
+
+def _normalize_mail_list(mail):
+    if isinstance(mail, list):
+        return [str(entry).strip() for entry in mail if str(entry).strip()]
+    if isinstance(mail, tuple):
+        return [str(entry).strip() for entry in mail if str(entry).strip()]
+    if isinstance(mail, str):
+        return [entry.strip() for entry in mail.replace(';', ',').split(',') if entry.strip()]
+    return []
+
+def new(date_start: str, date_end: str, time_span: list, slots: int, slot_lenght: int, user: str, mail: list=[], note:str="") -> str:
+    """
+    Generates a link for the executive to send to his clients to book a time Slot
+    
+    Input:
+    - date_start: start of the time frae area
+    - date_end: end of the time frame area
+    - time_span: Time window for the days as a list [(first day Time Frame), (second day Time frame), (third etc.)]
+    - slots: amount of slots that are available
+    - slot_lenght: the lenght of a slot in minutes
+
+    Output:
+    - link: The link for the user to send to the clients
+    """
+    normalized_time_span = _normalize_time_span(time_span)
+    normalized_mail = _normalize_mail_list(mail)
+    id = termin.add(date_start, date_end, normalized_time_span, slots, slot_lenght, user, normalized_mail, note)
+
+    tenant_context = get_tenant_context()
+    subdomain = ''
+    if tenant_context:
+        subdomain = getattr(tenant_context, 'subdomain', '') or getattr(tenant_context, 'tenant_id', '') or ''
+
+    host = f"https://{subdomain}.invario.eu" if subdomain else "invario.eu"
+    link = host + "/terminplaner/client" + "?" + "client_id=" + id 
+    subject = f"Terminanfrage von {user}"
+    note_link = note + f"Bitte klicken sie auf den folgenden Link um einen Termin zu vereinbaren: {link}"
+    if normalized_mail:
+        mail_service.send(normalized_mail, subject, note_link)
+    return link
+    
+        
+def book_slot(id, date_start_time, name):
+    """
+    Updates slot for the booking per a id
+
+    Input:
+    - id: the id is the id you get from the
+    - date_start_time: the date of the booking that was selected with date and time
+    - name: name that the client gave himself
+    
+    Output:
+    - bool: if worked or not
+    """
+    try:
+        # Retrieve the current appointment
+        item = termin.get_item(id)
+        if not item:
+            return False
+
+        slots = item.get('slots_booked', []) or []
+        if not isinstance(slots, list):
+            slots = []
+
+        capacity = int(item.get('slots', 0) or 0)
+        if capacity and len(slots) >= capacity:
+            return False
+
+        for existing in slots:
+            if isinstance(existing, (list, tuple)) and len(existing) >= 2:
+                if existing[0] == date_start_time and existing[1] == name:
+                    return False
+
+        # Append the new booking as a tuple (start_time, name)
+        slots.append((date_start_time, name))
+
+        # Update the appointment in the database
+        success = termin.update(id, slots)
+        return bool(success)
+    except Exception as e:
+        print(f"Error booking slot: {e}")
+        return False
+
+
+def remove_slot(id, date_start_time, name):
+    """
+    Remove a booked slot for an appointment.
+
+    Returns True if the removal succeeded, False otherwise.
+    """
+    try:
+        # Prefer DB-level remove if available
+        if hasattr(termin, 'remove_slot'):
+            removed = termin.remove_slot(id, date_start_time, name)
+            if removed:
+                return True
+
+        # Fallback: fetch, filter, and replace the slot list
+        item = termin.get_item(id)
+        if not item:
+            return False
+
+        slots = item.get('slots_booked', []) or []
+        new_slots = []
+        for s in slots:
+            try:
+                # s may be list or tuple like [start_time, name]
+                if isinstance(s, (list, tuple)) and len(s) >= 2 and s[0] == date_start_time and s[1] == name:
+                    continue
+            except Exception:
+                pass
+            new_slots.append(s)
+
+        success = termin.update(id, new_slots)
+        return bool(success)
+    except Exception as e:
+        print(f"Error removing slot: {e}")
+        return False
+
+
+def remove_appointment(id):
+    """
+    Remove an entire appointment by id.
+    """
+    try:
+        return bool(termin.remove(id))
+    except Exception as e:
+        print(f"Error removing appointment: {e}")
+        return False
+
+def get_available(id):
+    """
+    Gets the available time slots -> more over it returns the time frame and the allready booked slots also the lenght.
+    And checks if there are slots left.
+
+    Input:
+    - id: id of the appointment
+
+    Output:
+    - dict: all the needet information -> [Start_date, End_date, (first day Time Frame, 
+    second day Time frame, third etc.), slot lenght, (bookedslots -> list)]
+    """
+    try:
+        termin_range = termin.get_item(id)
+        if not termin_range:
+            return {}
+
+        date_start = termin_range.get('date_start')
+        date_end = termin_range.get('date_end')
+        time_span = termin_range.get('time_span', [])
+        slot_lenght = termin_range.get('slot_lenght')
+        total_slots = termin_range.get('slots', 0)
+        booked = termin_range.get('slots_booked', []) or []
+
+        # Normalize booked entries to dicts for easier consumption
+        normalized = []
+        for s in booked:
+            if isinstance(s, (list, tuple)) and len(s) >= 2:
+                normalized.append({'start': s[0], 'name': s[1]})
+            elif isinstance(s, dict):
+                normalized.append(s)
+            else:
+                normalized.append({'value': s})
+
+        slots_used = len(normalized)
+        slots_left = max(0, total_slots - slots_used)
+
+        return {
+            'date_start': date_start,
+            'date_end': date_end,
+            'time_span': time_span,
+            'slot_lenght': slot_lenght,
+            'slots_total': total_slots,
+            'slots_booked': normalized,
+            'slots_left': slots_left,
+        }
+    except Exception as e:
+        print(f"Error getting available slots: {e}")
+        return {}
+
+def get_available_user(id):
+    """
+    Gets the available time slots -> more over it returns the time frame and the allready booked slots also the lenght.
+    And checks if there are slots left.
+
+    Input:
+    - id: id of the appointment
+
+    Output:
+    - dict: all the needet information -> [Start_date, End_date, (first day Time Frame, 
+    second day Time frame, third etc.), slot lenght, (bookedslots -> list)]
+    """
+    return get_available(id)

Web/modules/terminplaner/blueprint.py

@@ -0,0 +1,96 @@
+from flask import Blueprint, render_template, request, session, url_for, redirect, flash
+import Web.modules.terminplaner.backend_server as appointment_service
+import Web.modules.database.settings as cfg
+
+# Create a blueprint instance
+appoint_bp = Blueprint('terminplaner', __name__)
+
+
+def _require_module_enabled():
+    if not cfg.MODULES.is_enabled('terminplan'):
+        flash('Der Terminplaner ist deaktiviert.', 'info')
+        return redirect(url_for('home'))
+    return None
+
+@appoint_bp.route('/client/<appointment_id>', methods=['POST', 'GET'])
+def client(appointment_id):
+    """
+    The Route for the terminplaner to work with the client
+    """
+    guard = _require_module_enabled()
+    if guard:
+        return guard
+
+    available = appointment_service.get_available(appointment_id)
+    if not available:
+        flash('Der Termin wurde nicht gefunden.', 'error')
+        return redirect(url_for('terminplan'))
+
+    if request.method == 'POST':
+        start_daytime = request.form.get('start_day_time')
+        username = request.form.get('client_name')
+        if not start_daytime or not username:
+            flash('Bitte Name und gewünschte Uhrzeit angeben.', 'error')
+            return render_template(
+                'termin_client.html',
+                appointment_id=appointment_id,
+                available=available,
+                current_user=session.get('username', ''),
+            )
+
+        if appointment_service.book_slot(appointment_id, start_daytime, username):
+            flash('Der Termin wurde gespeichert.', 'success')
+            return redirect(url_for('terminplaner.client', appointment_id=appointment_id))
+
+        flash('Der Termin konnte nicht gespeichert werden.', 'error')
+
+    return render_template(
+        'termin_client.html',
+        appointment_id=appointment_id,
+        available=available,
+        current_user=session.get('username', ''),
+    )
+
+@appoint_bp.route('/configure', methods=['GET', 'POST'])
+def configure():
+    """
+    Route for authenticated persons to configure a new appointment for them
+    """
+    guard = _require_module_enabled()
+    if guard:
+        return guard
+
+    if 'username' not in session:
+        flash('Bitte mit einem Konto anmelden.', 'error')
+        return redirect(url_for('login'))
+
+    if request.method == "POST":
+        start = request.form.get('start_date')
+        end = request.form.get('end_date')
+        time = request.form.get('time_frame')
+        slots_amount = request.form.get('slots_amounts')
+        slot_lenght = request.form.get('slot_lenght')
+        mail = request.form.get('mail', '')
+        note = request.form.get('note', '')
+
+        if not start or not end or not time or not slots_amount or not slot_lenght:
+            flash('Bitte alle Pflichtfelder ausfüllen.', 'error')
+            return render_template('termin_configure.html', school_periods=cfg.SCHOOL_PERIODS, generated_link=None)
+
+        link = appointment_service.new(start, end, time, slots_amount, slot_lenght, session["username"], mail, note)
+        flash('Der Terminplan wurde angelegt.', 'success')
+        return render_template('termin_configure.html', school_periods=cfg.SCHOOL_PERIODS, generated_link=link)
+    elif request.method == "GET":
+        return render_template('termin_configure.html', school_periods=cfg.SCHOOL_PERIODS, generated_link=None)
+
+@appoint_bp.route('/')
+def main():
+    guard = _require_module_enabled()
+    if guard:
+        return guard
+
+    return render_template(
+        'terminplaner.html',
+        school_periods=cfg.SCHOOL_PERIODS,
+        current_user=session.get('username', ''),
+    )

Web/templates/base.html

@@ -129,6 +129,14 @@
             --module-brand-icon: "📚";
         }
 
+        html[data-module="terminplan"] {
+            --module-primary-color: #0f4c5c;
+            --module-primary-light: #16697a;
+            --module-accent-color: #2ec4b6;
+            --module-accent-light: rgba(46, 196, 182, 0.1);
+            --module-brand-icon: "📅";
+        }
+
         :root[data-theme="dark"] {
             --module-primary-color: #1a252f;
             --module-primary-light: #2c3e50;
@@ -145,6 +153,12 @@
             --module-accent-color: #8e44ad;
         }
 
+        html[data-theme="dark"][data-module="terminplan"] {
+            --module-primary-color: #082f35;
+            --module-primary-light: #0f4c5c;
+            --module-accent-color: #21b6a8;
+        }
+
         /* Global styles */
         body {
             font-family: "Manrope", "Segoe UI", "Noto Sans", sans-serif;
@@ -930,6 +944,29 @@
                 box-shadow: none;
             }
 
+            .navbar-nav .nav-item.dropdown > .nav-link.dropdown-toggle,
+            .user-menu-wrap > .user-menu-btn {
+                display: none !important;
+            }
+
+            .navbar-nav .nav-item.dropdown > .dropdown-menu,
+            .user-menu-wrap > .dropdown-menu {
+                display: block !important;
+                position: static !important;
+                float: none !important;
+                transform: none !important;
+                inset: auto !important;
+                width: 100%;
+            }
+
+            .navbar-nav .nav-item.dropdown > .dropdown-menu {
+                margin-top: 0;
+            }
+
+            .user-menu-wrap > .dropdown-menu {
+                margin-top: 8px;
+            }
+
             .navbar-nav .dropdown-item {
                 color: rgba(255, 255, 255, 0.9);
                 padding: 12px 16px;
@@ -974,6 +1011,7 @@
                 order: 3;
                 width: 100%;
                 margin: 0;
+                display: none !important;
             }
 
             .function-search-form {
@@ -1054,29 +1092,73 @@
         <span class="module-label">Module:</span>
         <div class="module-tabs">
             {% if inventory_module_enabled %}
-            <a href="{{ url_for('home') }}" 
-               class="module-tab {% if CURRENT_MODULE == 'inventory' %}active{% endif %}" 
-               id="inventoryModule" 
-               data-module="inventory">
+            <a href="{{ url_for('home') }}" class="module-tab {% if CURRENT_MODULE == 'inventory' %}active{% endif %}" id="inventoryModule" data-module="inventory">
                📦 Inventarsystem
             </a>
             {% endif %}
-            {% if inventory_module_enabled and library_module_enabled %}
+            {% if inventory_module_enabled and terminplan_module_enabled %}
+            <div class="module-separator"></div>
+            {% endif %}
+            {% if terminplan_module_enabled %}
+            <a href="{{ url_for('terminplaner.main') }}" class="module-tab {% if CURRENT_MODULE == 'terminplan' %}active{% endif %}" id="terminplanModule" data-module="terminplan">
+               📅 Terminplaner
+            </a>
+            {% endif %}
+            {% if (inventory_module_enabled or terminplan_module_enabled) and library_module_enabled %}
             <div class="module-separator"></div>
             {% endif %}
             {% if library_module_enabled %}
-            <a href="{{ url_for('library_view') }}" 
-               class="module-tab {% if CURRENT_MODULE == 'library' %}active{% endif %}" 
-               id="libraryModule" 
-               data-module="library">
+            <a href="{{ url_for('library_view') }}" class="module-tab {% if CURRENT_MODULE == 'library' %}active{% endif %}" id="libraryModule" data-module="library">
                📚 Bibliothek
             </a>
             {% endif %}
         </div>
     </div>
-    {% endif %}
-        {% if 'username' in session %}
-    {% if CURRENT_MODULE != 'library' and inventory_module_enabled %}
+
+    {% if terminplan_module_enabled and CURRENT_MODULE == 'terminplan' %}
+        <nav class="navbar navbar-expand-lg navbar-dark" id="terminplanNavbar">
+            <div class="container-fluid">
+                <a class="navbar-brand" href="{{ url_for('terminplaner.main') }}" data-icon="📅">Terminplaner</a>
+                <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#terminplanNavContent">
+                    <span class="navbar-toggler-icon"></span>
+                </button>
+                <div class="collapse navbar-collapse" id="terminplanNavContent">
+                    <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="terminplanNavList">
+                        <li class="nav-item" data-nav-fixed="true">
+                            <a class="nav-link {% if current_path == url_for('terminplaner.main') %}nav-active{% endif %}" href="{{ url_for('terminplaner.main') }}" data-tutorial-tip="Die Terminplaner-Übersicht bündelt die wichtigsten Aktionen.">Übersicht</a>
+                        </li>
+                        <li class="nav-item" data-nav-fixed="true">
+                            <a class="nav-link {% if current_path == url_for('terminplan') %}nav-active{% endif %}" href="{{ url_for('terminplan') }}" data-tutorial-tip="Hier sehen Sie den Kalender mit den bestehenden Terminen.">Kalender</a>
+                        </li>
+                        {% if current_permissions.pages.get('terminplan', True) and current_permissions.actions.get('can_insert', True) %}
+                        <li class="nav-item">
+                            <a class="nav-link quick-link-pill {% if current_path == url_for('terminplaner.configure') %}nav-active{% endif %}" href="{{ url_for('terminplaner.configure') }}" data-tutorial-tip="Neuen Terminplan erstellen und an Ihr Team versenden.">Neue Planung</a>
+                        </li>
+                        {% endif %}
+                        <li class="nav-item" data-nav-fixed="true">
+                            <button id="themeToggleBtn" class="btn btn-link nav-link px-3" aria-label="Dark Mode umschalten" title="Theme umschalten">
+                                <span class="theme-icon-light" style="display: none;">☀️</span>
+                                <span class="theme-icon-dark" style="display: none;">🌙</span>
+                            </button>
+                        </li>
+                        <li class="nav-item dropdown ms-lg-auto">
+                            <a class="nav-link dropdown-toggle" href="#" id="termMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false" title="Weitere Optionen">Mehr Optionen</a>
+                            <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="termMoreDropdown">
+                                {% if current_permissions.pages.get('home', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('home') }}">Inventarsystem</a></li>
+                                {% endif %}
+                                {% if current_permissions.pages.get('library_view', True) and library_module_enabled %}
+                                <li><a class="dropdown-item" href="{{ url_for('library_view') }}">Bibliothek</a></li>
+                                {% endif %}
+                                <li><hr class="dropdown-divider"></li>
+                                <li><a class="dropdown-item" href="{{ url_for('logout') }}">Logout</a></li>
+                            </ul>
+                        </li>
+                    </ul>
+                </div>
+            </div>
+        </nav>
+    {% elif CURRENT_MODULE != 'library' and inventory_module_enabled %}
         <nav class="navbar navbar-expand-lg navbar-dark" id="inventoryNavbar">
             <div class="container-fluid">
                 <a class="navbar-brand" href="{{ url_for('home') }}" data-icon="📦">Inventarsystem</a>
@@ -1196,6 +1278,7 @@
                 </div>
             </div>
         </nav>
+    {% endif %}
         {% endif %}
 
         {% if library_module_enabled and CURRENT_MODULE == 'library' %}
@@ -1308,6 +1391,7 @@
             </div>
         </nav>
         {% endif %}
+        {% endif %}
 
     {% else %}
     <nav class="navbar navbar-expand-lg navbar-dark" id="loginNavbar">
@@ -2055,42 +2139,9 @@
                         return;
                     }
 
-                    // Mobile menu is collapsed: avoid hiding links preemptively.
-                    if (navCollapse && !navCollapse.classList.contains('show')) {
-                        restoreAllNavItems();
-                        return;
-                    }
-
+                    // Mobile burger menu should show the full list without overflow pruning.
                     restoreAllNavItems();
-
-                    const hiddenSources = [];
-                    let candidates = collectTopLevelNavSources();
-                    const overflowBuffer = 12;
-
-                    while (isNavOverflowing(overflowBuffer) && candidates.length > 0) {
-                        const toHide = pickNextNavItemToHide(candidates);
-                        if (!toHide) {
-                            break;
-                        }
-                        toHide.style.display = 'none';
-                        hiddenSources.unshift(toHide);
-                        candidates = collectTopLevelNavSources();
-                    }
-
-                    rebuildOverflowControl(hiddenSources);
-
-                    // One final pass in case the overflow menu label/count itself changed row width.
-                    candidates = collectTopLevelNavSources();
-                    while (isNavOverflowing(overflowBuffer) && candidates.length > 0) {
-                        const toHide = pickNextNavItemToHide(candidates);
-                        if (!toHide) {
-                            break;
-                        }
-                        toHide.style.display = 'none';
-                        hiddenSources.unshift(toHide);
-                        rebuildOverflowControl(hiddenSources);
-                        candidates = collectTopLevelNavSources();
-                    }
+                    return;
                 }
 
                 let resizeTimer = null;

Web/templates/library.html

@@ -72,6 +72,7 @@
     </div>
 
     <!-- Table Header (only in table mode) -->
+    <div class="library-table-wrapper">
     <div class="table-header" id="tableHeader" style="display: none;">
         <div class="table-row">
             <div class="table-cell title-cell">Titel</div>
@@ -166,6 +167,7 @@
             </div>
         {% endif %}
     </div>
+    </div>
 </div>
 
 <!-- Detail Modal -->
@@ -720,5 +722,20 @@ function onScanError(error) {
     background: #fce8e6;
     color: #b3261e;
 }
+
+/* Mobile: allow horizontal scrolling for table-mode views */
+@media (max-width: 900px) {
+    .library-table-wrapper {
+        overflow-x: auto;
+        -webkit-overflow-scrolling: touch;
+        width: 100%;
+    }
+    .library-table-wrapper .table-row {
+        min-width: 720px; /* allow table to have intrinsic width and be scrolled */
+    }
+    .table-header, .item-content.table-mode {
+        display: block; /* keep rows stacked but allow horizontal scroll */
+    }
+}
 </style>
 {% endblock %}

Web/templates/library_table.html

@@ -513,12 +513,13 @@
         <table class="library-items-table">
             <thead>
                 <tr>
-                    <th style="width: 25%;">Titel</th>
-                    <th style="width: 15%;">Autor/Künstler</th>
+                    <th style="width: 24%;">Titel</th>
+                    <th style="width: 14%;">Autor/Künstler</th>
                     <th style="width: 12%;">ISBN/Code</th>
-                    <th style="width: 10%;">Typ</th>
+                    <th style="width: 8%;">Typ</th>
+                    <th style="width: 8%;">Anzahl</th>
                     <th style="width: 12%;">Status</th>
-                    <th style="width: 26%;">Aktionen</th>
+                    <th style="width: 22%;">Aktionen</th>
                 </tr>
             </thead>
             <tbody id="itemsTableBody">
@@ -603,7 +604,7 @@
             }
         } catch (error) {
             console.error('Error loading library items:', error);
-            document.getElementById('itemsTableBody').innerHTML = '<tr><td colspan="6" style="text-align:center; color:#999;">Fehler beim Laden der Bibliothekselemente.</td></tr>';
+            document.getElementById('itemsTableBody').innerHTML = '<tr><td colspan="7" style="text-align:center; color:#999;">Fehler beim Laden der Bibliothekselemente.</td></tr>';
         } finally {
             pagingState.loading = false;
         }
@@ -707,6 +708,7 @@
                 <td>${escapeHtml(item.Autor || item.Author || '-')}</td>
                 <td>${escapeHtml(item.ISBN || item.Code_4 || item.Code4 || '-')}</td>
                 <td>${getItemTypeLabel(item.ItemType || 'book')}</td>
+                <td style="font-weight:600; text-align:center;">${item.Quantity || item.GroupedDisplayCount || 1}</td>
                 <td>
                     <span class="table-status ${statusClass}">
                         ${statusText}
@@ -718,6 +720,7 @@
                         ${actionLabel}
                     </button>
                     ${canEditLibraryItems ? `<button class="button" style="background:#0ea5e9;color:#fff;" onclick="openEditLibraryItem('${item._id}')">Bearbeiten</button>` : ''}
+                    ${canEditLibraryItems ? `<button class="button" style="background:#dc2626;color:#fff; margin-left:6px;" onclick="confirmDeleteLibraryItem('${item._id}')">Löschen</button>` : ''}
                 </td>
             </tr>
                 `;
@@ -737,6 +740,47 @@
         }
     }
 
+    // Confirm and call library item delete endpoint
+    function confirmDeleteLibraryItem(itemId) {
+        if (!itemId) return;
+        if (!confirm('Dieses Bibliotheksmedium revisionssicher löschen? Diese Aktion deaktiviert alle zugehörigen Exemplare und archiviert Medien.')) return;
+        deleteLibraryItem(itemId);
+    }
+
+    async function deleteLibraryItem(itemId) {
+        if (!itemId) return;
+        document.body.style.cursor = 'wait';
+        try {
+            const resp = await fetch(`/delete_library_item/${itemId}`, {
+                method: 'POST',
+                headers: {
+                    'X-CSRFToken': '{{ csrf_token }}',
+                    'X-CSRF-Token': '{{ csrf_token }}'
+                },
+                credentials: 'same-origin'
+            });
+
+            const ct = resp.headers.get('Content-Type') || '';
+            if (ct.includes('application/json')) {
+                const j = await resp.json();
+                if (!resp.ok || j.ok === false) {
+                    alert(j.message || 'Fehler beim Löschen');
+                } else {
+                    alert(j.message || 'Gelöscht');
+                }
+                loadLibraryItems();
+            } else {
+                // Server redirected to HTML (flash messages). Reload to show state.
+                location.reload();
+            }
+        } catch (e) {
+            console.error('Delete failed', e);
+            alert('Fehler beim Löschen des Elements.');
+        } finally {
+            document.body.style.cursor = '';
+        }
+    }
+
     // Filter toggle
     document.getElementById('filterToggleBtn').addEventListener('click', () => {
         filterPanelOpen = !filterPanelOpen;
@@ -820,11 +864,27 @@
         setActiveStudentCard(cardId);
 
         const durationInput = (window.prompt('Ausleihdauer in Tagen (optional):') || '').trim();
+        const maxAvailable = Math.max(1, parseInt(selectedItem?.AvailableGroupedCount || selectedItem?.Quantity || 1, 10) || 1);
+        const countPrompt = (window.prompt(`Anzahl ausleihen? (Standard: 1, verfügbar: ${maxAvailable})`, '1') || '').trim();
+        let borrowCount = parseInt(countPrompt || '1', 10);
+        if (!Number.isFinite(borrowCount) || borrowCount < 1) {
+            borrowCount = 1;
+        }
+        if (borrowCount > maxAvailable) {
+            alert(`Es sind nur ${maxAvailable} Exemplar(e) verfügbar.`);
+            return;
+        }
 
         const form = document.createElement('form');
         form.method = 'POST';
         form.action = `/ausleihen/${itemId}`;
 
+        const csrfField = document.createElement('input');
+        csrfField.type = 'hidden';
+        csrfField.name = 'csrf_token';
+        csrfField.value = '{{ csrf_token }}';
+        form.appendChild(csrfField);
+
         const cardField = document.createElement('input');
         cardField.type = 'hidden';
         cardField.name = 'borrower_card_id';
@@ -845,6 +905,12 @@
             form.appendChild(durationField);
         }
 
+        const countField = document.createElement('input');
+        countField.type = 'hidden';
+        countField.name = 'exemplare_count';
+        countField.value = String(borrowCount || 1);
+        form.appendChild(countField);
+
         document.body.appendChild(form);
         form.submit();
     }

Web/templates/license.html

@@ -1,11 +1,3 @@
-<!--
-   Copyright 2025-2026 AIIrondev
-
-   Licensed under the Inventarsystem EULA (Endbenutzer-Lizenzvertrag).
-   See Legal/LICENSE for the full license text.
-   Unauthorized commercial use, SaaS hosting, or removal of branding is prohibited.
-   For commercial licensing inquiries: https://github.com/AIIrondev
--->
 {% extends "base.html" %}
 
 {% block title %}License - Inventarsystem{% endblock %}
@@ -17,10 +9,6 @@
 
         <!-- Tab navigation -->
         <ul class="nav nav-tabs mt-3" id="legalTabs" role="tablist">
-            <li class="nav-item" role="presentation">
-                <button class="nav-link active" id="tab-eula" data-bs-toggle="tab" data-bs-target="#pane-eula"
-                    type="button" role="tab">EULA</button>
-            </li>
             <li class="nav-item" role="presentation">
                 <button class="nav-link" id="tab-notice" data-bs-toggle="tab" data-bs-target="#pane-notice"
                     type="button" role="tab">NOTICE</button>
@@ -43,139 +31,12 @@
             </li>
         </ul>
 
-        <div class="tab-content" id="legalTabContent">
-
-        <!-- ── EULA ─────────────────────────────────────────────────────── -->
-        <div class="tab-pane fade show active" id="pane-eula" role="tabpanel">
-        <div class="license-content">
-
-            <!-- EULA -->
-            <h2>Endbenutzer-Lizenzvertrag (EULA) und Nutzungsbedingungen</h2>
-            <p><strong>Softwareprojekt:</strong> Inventarsystem<br>
-               <strong>Urheberrechtshalter (Lizenzgeber):</strong> AIIrondev<br>
-               <strong>Gültigkeit:</strong> Stand 2026</p>
-
-            <hr>
-
-            <h3>Präambel</h3>
-            <p>Dieser Endbenutzer-Lizenzvertrag (im Folgenden „Vertrag") stellt eine rechtsgültige Vereinbarung zwischen Ihnen
-            (im Folgenden „Lizenznehmer") und dem Urheber <strong>AIIrondev</strong> (im Folgenden „Lizenzgeber") dar.
-            Durch den Zugriff auf den Quellcode, die Installation, das Kopieren oder die sonstige Nutzung der Software
-            „Inventarsystem" (im Folgenden „Produkt") erklärt sich der Lizenznehmer mit den nachfolgenden Bedingungen
-            vollumfänglich einverstanden.</p>
-            <p>Sollte der Lizenznehmer den Bedingungen dieses Vertrags nicht zustimmen, ist jegliche Nutzung,
-            Vervielfältigung oder Distribution des Produkts mit sofortiger Wirkung untersagt.</p>
-
-            <hr>
-
-            <h3>§ 1 Gegenstand der Lizenz und Eigentumsrechte</h3>
-            <ol>
-                <li>Das Produkt wird dem Lizenznehmer unter Vorbehalt lizenziert, nicht verkauft. Sämtliche
-                    Eigentumsrechte, Urheberrechte und sonstigen geistigen Eigentumsrechte am Produkt sowie an allen
-                    Kopien davon verbleiben ausschließlich beim Lizenzgeber.</li>
-                <li>Diese Lizenz gewährt lediglich ein eingeschränktes Nutzungsrecht unter den in diesem Vertrag
-                    explizit genannten Bedingungen.</li>
-            </ol>
-
-            <h3>§ 2 Zulässiger Nutzungskreis (Privatnutzung)</h3>
-            <ol>
-                <li>Die unentgeltliche Nutzung des Produkts ist ausschließlich <strong>natürlichen Personen für den
-                    rein privaten, häuslichen Gebrauch</strong> gestattet.</li>
-                <li>Die Nutzung umfasst die Verwaltung privater Bestände ohne jegliche Gewinnerzielungsabsicht.</li>
-                <li>Jegliche Nutzung durch <strong>Institutionelle Nutzer</strong> (einschließlich, aber nicht
-                    beschränkt auf: Unternehmen, Einzelunternehmer, Freiberufler, Vereine, Bildungseinrichtungen,
-                    Behörden oder NGOs) ist ausdrücklich <strong>untersagt</strong> und bedarf einer gesonderten,
-                    schriftlichen Lizenzvereinbarung mit dem Lizenzgeber.</li>
-            </ol>
-
-            <h3>§ 3 Funktionale Einschränkungen und Support</h3>
-            <ol>
-                <li>Dem Lizenznehmer wird das Produkt in der jeweils vorliegenden Fassung bereitgestellt („As-Is").</li>
-                <li>Für die kostenlose Privatnutzung besteht <strong>kein Anspruch</strong> auf:
-                    <ul>
-                        <li>Technischen Support oder Beratung.</li>
-                        <li>Bereitstellung von Sicherheits-Updates oder Patches.</li>
-                        <li>Gewährleistung der Kompatibilität mit spezifischen Hardware- oder Softwareumgebungen.</li>
-                    </ul>
-                </li>
-                <li>Der Lizenzgeber behält sich das Recht vor, Funktionen in zukünftigen Versionen zu ändern,
-                    einzuschränken oder kostenpflichtig zu gestalten.</li>
-            </ol>
-
-            <h3>§ 4 Wahrung der Urheberbezeichnung (Branding-Klausel)</h3>
-            <ol>
-                <li>Das Produkt verfügt über fest integrierte Urheberrechtshinweise, insbesondere die Kennzeichnung
-                    <strong>„Powered by AIIrondev"</strong> in der Benutzeroberfläche (Footer/Menü).</li>
-                <li>Es ist dem Lizenznehmer untersagt, diese Hinweise zu entfernen, zu modifizieren, zu verdecken oder
-                    deren Sichtbarkeit durch technische Maßnahmen (z. B. Manipulation von CSS, JavaScript oder
-                    Metadaten) zu beeinträchtigen.</li>
-                <li>Das Entfernen dieser Hinweise führt zum sofortigen und automatischen Erlöschen der
-                    Nutzungslizenz.</li>
-            </ol>
-
-            <h3>§ 5 Verbot der kommerziellen Verwertung &amp; SaaS</h3>
-            <ol>
-                <li>Die Bereitstellung des Produkts als Dienstleistung für Dritte (Software-as-a-Service, SaaS),
-                    insbesondere gegen Entgelt oder zur Generierung von Werbeeinnahmen, ist strikt untersagt.</li>
-                <li>Das Hosting auf öffentlichen Servern mit dem Ziel, Dritten ohne eigene Installation Zugriff auf
-                    die Funktionalität zu gewähren, ist nur mit ausdrücklicher schriftlicher Genehmigung des
-                    Lizenzgebers zulässig.</li>
-            </ol>
-
-            <h3>§ 6 Modifikationen und Contributions</h3>
-            <ol>
-                <li>Der Lizenznehmer darf den Quellcode für den privaten Eigenbedarf modifizieren.</li>
-                <li>Im Falle einer Veröffentlichung von Modifikationen oder der Einreichung von
-                    Verbesserungsvorschlägen (z. B. Pull Requests auf GitHub) räumt der Lizenznehmer dem Lizenzgeber
-                    ein unwiderrufliches, weltweites, zeitlich unbeschränktes und kostenfreies Nutzungs- und
-                    Verwertungsrecht an diesen Änderungen ein. Der Lizenzgeber ist berechtigt, diese Änderungen in
-                    das Hauptprodukt zu übernehmen und unter dieser oder einer anderen Lizenz zu vertreiben.</li>
-            </ol>
-
-            <h3>§ 7 Haftungsbeschränkung</h3>
-            <ol>
-                <li>Die Haftung des Lizenzgebers für Schäden, die aus der Nutzung oder Unmöglichkeit der Nutzung des
-                    Produkts entstehen (einschließlich Datenverlust, Betriebsunterbrechung oder entgangener Gewinn),
-                    ist auf Vorsatz und grobe Fahrlässigkeit beschränkt.</li>
-                <li>Der Lizenzgeber übernimmt keine Haftung für die Richtigkeit der mit dem Produkt verwalteten
-                    Daten.</li>
-            </ol>
-
-            <h3>§ 8 Rechtswahl und Gerichtsstand</h3>
-            <ol>
-                <li>Es gilt ausschließlich das Recht der <strong>Bundesrepublik Deutschland</strong> unter Ausschluss
-                    des UN-Kaufrechts (CISG).</li>
-                <li>Soweit gesetzlich zulässig, wird als Gerichtsstand für alle Streitigkeiten aus diesem Vertrag der
-                    Sitz des Lizenzgebers vereinbart.</li>
-                <li>Sollten einzelne Bestimmungen dieses Vertrags unwirksam sein, bleibt die Wirksamkeit der übrigen
-                    Bestimmungen unberührt (Salvatorische Klausel).</li>
-            </ol>
-
-            <hr>
-
-            <div class="license-exception-notice">
-                <h3>⚠️ Anfragen für Ausnahmegenehmigungen (Kommerzielle Lizenzen)</h3>
-                <p>
-                    Bitte kontaktieren Sie den Urheber direkt über das GitHub-Profil:
-                    <a href="https://github.com/AIIrondev" target="_blank" rel="noopener noreferrer">AIIrondev auf GitHub</a>
-                </p>
-            </div>
-
-        </div><!-- /.license-content -->
-        </div><!-- /#pane-eula -->
-
         <!-- ── NOTICE ────────────────────────────────────────────────────── -->
         <div class="tab-pane fade" id="pane-notice" role="tabpanel">
         <div class="license-content">
             <h2>NOTICE – Urheberrechtliche Hinweise</h2>
-            <p><strong>Inventarsystem</strong><br>Copyright © 2025-2026 AIIrondev</p>
-            <p>Dieses Projekt steht unter dem Inventarsystem EULA (Endbenutzer-Lizenzvertrag). Der vollständige Lizenztext
-            befindet sich in <code>Legal/LICENSE</code>. Die Software wird ausschließlich für den privaten,
-            nicht-kommerziellen Gebrauch bereitgestellt. Unerlaubte kommerzielle Nutzung, SaaS-Hosting oder das Entfernen
-            von Branding ist untersagt. Anfragen für kommerzielle Lizenzen:
-            <a href="https://github.com/AIIrondev" target="_blank" rel="noopener noreferrer">https://github.com/AIIrondev</a></p>
+            <p><strong>Invario Modul Suite</strong><br>Copyright © 2026 Invario UG</p>
 
-            <hr>
             <h3>Drittanbieter-Hinweise</h3>
             <p>Dieses Projekt nutzt oder referenziert die folgende Drittanbieter-Software. Deren jeweilige Lizenzen gelten
             wie angegeben. Dieser NOTICE-Abschnitt dient ausschließlich der Attribution und ändert keine Lizenzbedingungen.</p>
@@ -200,13 +61,6 @@
             <ul>
                 <li>html5-qrcode (MIT) © 2020-2025 Manoj Brahmbhatt (mebjas)</li>
             </ul>
-
-            <h4>Systemkomponenten (nicht im Repository enthalten, ggf. im Deployment genutzt)</h4>
-            <ul>
-                <li>NGINX (2-clause BSD) © Nginx, Inc. and/or its licensors</li>
-                <li>FFmpeg (LGPL/GPL, je nach Konfiguration) © 2000-2025 FFmpeg developers</li>
-            </ul>
-
             <hr>
         </div>
         </div><!-- /#pane-notice -->
@@ -258,9 +112,6 @@
         <div class="license-content">
             <h2>Sicherheitsrichtlinie (Security Policy)</h2>
 
-            <h3>Unterstützte Versionen</h3>
-            <p>Bitte nutzen Sie immer die neueste Version aus dem <code>main</code>-Branch, um Sicherheitsupdates zu erhalten.</p>
-
             <h3>Datenschutzrechtliche Mechanismen</h3>
             <ul>
                 <li><strong>Passwort-Hashing:</strong> Passwörter werden niemals im Klartext gespeichert.</li>
@@ -272,10 +123,7 @@
             <h3>Meldung von Sicherheitslücken</h3>
             <div class="license-exception-notice">
                 <h3>⚠️ Responsible Disclosure</h3>
-                <p>Falls Sie eine Sicherheitslücke entdecken, öffnen Sie bitte <strong>kein öffentliches Issue</strong>.
-                Kontaktieren Sie den Maintainer direkt über die
-                <a href="https://github.com/AIIrondev" target="_blank" rel="noopener noreferrer">GitHub Security Advisory-Funktion</a>
-                oder per E-Mail.</p>
+                <p>Falls Sie eine Sicherheitslücke entdecken, wenden sie sich umgehend an die Email: info@invario.eu .
             </div>
         </div>
         </div><!-- /#pane-security -->

Web/templates/register.html

@@ -55,7 +55,7 @@
                 <div class="form-group">
                     <label for="password">Passwort</label>
                     <div class="password-rules" id="password-rules" aria-live="polite">
-                        <p class="password-rules-title">Passwort-Anforderungen (live):</p>
+                        <p class="password-rules-title">Passwort-Anforderungen:</p>
                         <ul>
                             <li id="pw-rule-length" class="pw-rule">Mindestens 12 Zeichen</li>
                             <li id="pw-rule-lower" class="pw-rule">Mindestens ein Kleinbuchstabe</li>

Web/templates/termin_client.html

@@ -0,0 +1,69 @@
+{% extends "base.html" %}
+
+{% block title %}Termin buchen - Inventarsystem{% endblock %}
+
+{% block content %}
+<div class="container py-4">
+    <div class="row justify-content-center">
+        <div class="col-12 col-xl-10">
+            <div class="row g-4">
+                <div class="col-12 col-lg-5">
+                    <div class="card border-0 shadow-lg rounded-4 h-100">
+                        <div class="card-body p-4 p-md-5">
+                            <p class="text-uppercase text-muted fw-semibold mb-2">Terminplaner</p>
+                            <h1 class="h3 fw-bold mb-3">Termin buchen</h1>
+                            <p class="text-muted mb-4">Wählen Sie einen freien Zeitpunkt und tragen Sie Ihren Namen ein. Der Termin wird anschließend im Plan gespeichert.</p>
+
+                            <div class="p-3 rounded-3 bg-light mb-3">
+                                <div class="fw-semibold">Zeitraum</div>
+                                <div>{{ available.date_start }} bis {{ available.date_end }}</div>
+                            </div>
+                            <div class="p-3 rounded-3 bg-light mb-3">
+                                <div class="fw-semibold">Verfügbare Slots</div>
+                                <div>{{ available.slots_left }} von {{ available.slots_total }} frei</div>
+                            </div>
+                            <div class="p-3 rounded-3 bg-light mb-3">
+                                <div class="fw-semibold">Slot-Länge</div>
+                                <div>{{ available.slot_lenght }} Minuten</div>
+                            </div>
+
+                            {% if available.slots_booked %}
+                            <div class="p-3 rounded-3 bg-light">
+                                <div class="fw-semibold mb-2">Bereits gebucht</div>
+                                <ul class="mb-0 small">
+                                    {% for booking in available.slots_booked %}
+                                    <li>{{ booking.start }}{% if booking.name %} - {{ booking.name }}{% endif %}</li>
+                                    {% endfor %}
+                                </ul>
+                            </div>
+                            {% endif %}
+                        </div>
+                    </div>
+                </div>
+                <div class="col-12 col-lg-7">
+                    <div class="card border-0 shadow-lg rounded-4 h-100">
+                        <div class="card-body p-4 p-md-5 bg-white">
+                            <h2 class="h4 fw-bold mb-4">Buchung absenden</h2>
+                            <form method="post" action="{{ url_for('terminplaner.client', appointment_id=appointment_id) }}" class="vstack gap-3">
+                                <div>
+                                    <label for="start_day_time" class="form-label fw-semibold">Gewünschter Zeitpunkt</label>
+                                    <input type="text" id="start_day_time" name="start_day_time" class="form-control form-control-lg" placeholder="2026-05-29 10:30" required>
+                                    <div class="form-text">Tragen Sie Datum und Uhrzeit im Format YYYY-MM-DD HH:MM ein, sofern kein Kalenderfeld genutzt wird.</div>
+                                </div>
+                                <div>
+                                    <label for="client_name" class="form-label fw-semibold">Ihr Name</label>
+                                    <input type="text" id="client_name" name="client_name" class="form-control form-control-lg" placeholder="Vor- und Nachname" required>
+                                </div>
+                                <div class="d-flex flex-column flex-sm-row gap-2 pt-2">
+                                    <button type="submit" class="btn btn-primary btn-lg">Termin buchen</button>
+                                    <a class="btn btn-outline-secondary btn-lg" href="{{ url_for('terminplaner.main') }}">Zur Übersicht</a>
+                                </div>
+                            </form>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+{% endblock %}

Web/templates/termin_configure.html

@@ -0,0 +1,72 @@
+{% extends "base.html" %}
+
+{% block title %}Terminplan konfigurieren - Inventarsystem{% endblock %}
+
+{% block content %}
+<div class="container py-4">
+    <div class="row justify-content-center">
+        <div class="col-12 col-lg-10 col-xl-8">
+            <div class="card border-0 shadow-lg rounded-4 overflow-hidden">
+                <div class="card-header text-white" style="background: linear-gradient(135deg, #0f4c5c, #16697a);">
+                    <h1 class="h3 mb-1 fw-bold">Terminplan konfigurieren</h1>
+                    <p class="mb-0 opacity-75">Erstellen Sie einen neuen Plan und verschicken Sie anschließend den Buchungslink.</p>
+                </div>
+                <div class="card-body p-4 p-md-5 bg-white">
+                    <form method="post" action="{{ url_for('terminplaner.configure') }}" class="vstack gap-3">
+                        <div class="row g-3">
+                            <div class="col-12 col-md-6">
+                                <label for="start_date" class="form-label fw-semibold">Startdatum</label>
+                                <input type="date" id="start_date" name="start_date" class="form-control form-control-lg" required>
+                            </div>
+                            <div class="col-12 col-md-6">
+                                <label for="end_date" class="form-label fw-semibold">Enddatum</label>
+                                <input type="date" id="end_date" name="end_date" class="form-control form-control-lg" required>
+                            </div>
+                        </div>
+
+                        <div>
+                            <label for="time_frame" class="form-label fw-semibold">Zeitfenster</label>
+                            <textarea id="time_frame" name="time_frame" class="form-control" rows="5" placeholder="Beispiele:\nMontag 08:00-12:00\nDienstag 08:00-12:00" required></textarea>
+                            <div class="form-text">Jede Zeile kann ein eigenes Zeitfenster enthalten.</div>
+                        </div>
+
+                        <div class="row g-3">
+                            <div class="col-12 col-md-6">
+                                <label for="slots_amounts" class="form-label fw-semibold">Anzahl Slots</label>
+                                <input type="number" id="slots_amounts" name="slots_amounts" class="form-control" min="1" value="1" required>
+                            </div>
+                            <div class="col-12 col-md-6">
+                                <label for="slot_lenght" class="form-label fw-semibold">Slot-Länge in Minuten</label>
+                                <input type="number" id="slot_lenght" name="slot_lenght" class="form-control" min="1" value="45" required>
+                            </div>
+                        </div>
+
+                        <div>
+                            <label for="mail" class="form-label fw-semibold">Empfänger-Mails</label>
+                            <input type="text" id="mail" name="mail" class="form-control" placeholder="adresse1@schule.de, adresse2@schule.de">
+                        </div>
+
+                        <div>
+                            <label for="note" class="form-label fw-semibold">Notiz</label>
+                            <textarea id="note" name="note" class="form-control" rows="4" placeholder="Optionaler Einführungstext für die Mail"></textarea>
+                        </div>
+
+                        <div class="d-flex flex-column flex-sm-row gap-2 pt-2">
+                            <button type="submit" class="btn btn-primary btn-lg">Terminplan erzeugen</button>
+                            <a class="btn btn-outline-secondary btn-lg" href="{{ url_for('terminplaner.main') }}">Zur Übersicht</a>
+                        </div>
+                    </form>
+                </div>
+            </div>
+
+            {% if generated_link %}
+            <div class="alert alert-success mt-4 shadow-sm rounded-4">
+                <div class="fw-bold mb-1">Buchungslink erstellt</div>
+                <div class="mb-2">Teilen Sie diesen Link mit den Teilnehmenden:</div>
+                <a href="{{ generated_link }}" class="d-inline-block text-break">{{ generated_link }}</a>
+            </div>
+            {% endif %}
+        </div>
+    </div>
+</div>
+{% endblock %}

Web/templates/terminplaner.html

@@ -0,0 +1,65 @@
+{% extends "base.html" %}
+
+{% block title %}Terminplaner - Inventarsystem{% endblock %}
+
+{% block content %}
+<div class="container py-4">
+    <div class="row justify-content-center">
+        <div class="col-12 col-lg-11 col-xl-10">
+            <section class="p-4 p-md-5 rounded-4 shadow-lg" style="background: linear-gradient(135deg, rgba(15,76,92,0.96), rgba(22,105,122,0.92)); color: #fff;">
+                <div class="d-flex flex-column flex-lg-row justify-content-between gap-4 align-items-start align-items-lg-end">
+                    <div>
+                        <p class="text-uppercase fw-semibold mb-2" style="letter-spacing: .12em; opacity: .8;">Terminplaner</p>
+                        <h1 class="display-6 fw-bold mb-3">Reservierungen und Termine übersichtlich verwalten</h1>
+                        <p class="lead mb-0" style="max-width: 60ch; opacity: .95;">Erstellen Sie neue Terminreihen, teilen Sie Buchungslinks und öffnen Sie den Kalender für bestehende Reservierungen.</p>
+                    </div>
+                    <div class="d-flex flex-wrap gap-2">
+                        <a class="btn btn-light btn-lg fw-semibold" href="{{ url_for('terminplaner.configure') }}">Neue Planung</a>
+                        <a class="btn btn-outline-light btn-lg fw-semibold" href="{{ url_for('terminplan') }}">Kalender öffnen</a>
+                    </div>
+                </div>
+            </section>
+
+            <div class="row g-4 mt-1">
+                <div class="col-12 col-md-4">
+                    <div class="card h-100 shadow-sm border-0 rounded-4">
+                        <div class="card-body p-4">
+                            <div class="display-6 mb-3">🗓️</div>
+                            <h2 class="h4 fw-bold">Kalender</h2>
+                            <p class="mb-4 text-muted">Sehen Sie vorhandene Termine, ihre Auslastung und die aktuellen Reservierungen im Kalender.</p>
+                            <a class="btn btn-primary w-100" href="{{ url_for('terminplan') }}">Zum Kalender</a>
+                        </div>
+                    </div>
+                </div>
+                <div class="col-12 col-md-4">
+                    <div class="card h-100 shadow-sm border-0 rounded-4">
+                        <div class="card-body p-4">
+                            <div class="display-6 mb-3">✍️</div>
+                            <h2 class="h4 fw-bold">Neue Planung</h2>
+                            <p class="mb-4 text-muted">Erstellen Sie einen neuen Terminplan und verschicken Sie den Buchungslink an Ihre Zielgruppe.</p>
+                            <a class="btn btn-outline-primary w-100" href="{{ url_for('terminplaner.configure') }}">Konfiguration öffnen</a>
+                        </div>
+                    </div>
+                </div>
+                <div class="col-12 col-md-4">
+                    <div class="card h-100 shadow-sm border-0 rounded-4">
+                        <div class="card-body p-4">
+                            <div class="display-6 mb-3">🔗</div>
+                            <h2 class="h4 fw-bold">Buchungslink</h2>
+                            <p class="mb-4 text-muted">Die öffentliche Buchungsseite liegt unter dem jeweiligen Terminlink und kann direkt an Teilnehmende weitergegeben werden.</p>
+                            <div class="small text-muted">Die Buchungsseite wird aus dem Terminplan automatisch erzeugt.</div>
+                        </div>
+                    </div>
+                </div>
+            </div>
+
+            {% if current_user %}
+            <div class="mt-4 p-4 rounded-4 bg-white shadow-sm">
+                <h2 class="h5 fw-bold mb-2">Angemeldet als {{ current_user }}</h2>
+                <p class="mb-0 text-muted">Sie können Termine anlegen, den Kalender prüfen und Buchungslinks verteilen.</p>
+            </div>
+            {% endif %}
+        </div>
+    </div>
+</div>
+{% endblock %}

Web/templates/upload_admin.html

@@ -716,6 +716,8 @@
         <p style="margin:0 0 10px 0; color:#555;">Laden Sie eine <strong>.xlsx</strong>- oder <strong>.csv</strong>-Datei hoch. Spalten werden automatisch erkannt (z.B. Name, Ort, Beschreibung, ISBN, Code, Anzahl). Für den Bibliotheksimport ist eine gültige ISBN je Zeile erforderlich.</p>
         <form method="POST" action="{{ url_for('upload_library_excel') }}" enctype="multipart/form-data" style="display:flex; gap:10px; flex-wrap:wrap; align-items:center;">
             <input type="file" name="library_excel" accept=".xlsx,.csv" required>
+            <button type="button" class="btn btn-link" onclick="downloadSampleCsv('library')">Beispiel-CSV herunterladen</button>
+            <button type="button" class="btn btn-outline-secondary" title="Format-Hilfe" onclick="showCsvHelp('library')">?</button>
             <button type="submit" class="btn btn-secondary" name="excel_action" value="validate">Nur validieren</button>
             <button type="submit" class="btn btn-primary" name="excel_action" value="import">Bibliothek importieren</button>
         </form>
@@ -726,6 +728,8 @@
         <p style="margin:0 0 10px 0; color:#555;">Laden Sie eine <strong>.xlsx</strong>- oder <strong>.csv</strong>-Datei hoch. Spalten werden automatisch erkannt (z.B. Name, Ort, Beschreibung, Filter1/2/3, Kosten, Jahr, Code, Anzahl).</p>
         <form method="POST" action="{{ url_for('upload_inventory_excel') }}" enctype="multipart/form-data" style="display:flex; gap:10px; flex-wrap:wrap; align-items:center;">
             <input type="file" name="inventory_excel" accept=".xlsx,.csv" required>
+            <button type="button" class="btn btn-link" onclick="downloadSampleCsv('inventory')">Beispiel-CSV herunterladen</button>
+            <button type="button" class="btn btn-outline-secondary" title="Format-Hilfe" onclick="showCsvHelp('inventory')">?</button>
             <button type="submit" class="btn btn-secondary" name="excel_action" value="validate">Nur validieren</button>
             <button type="submit" class="btn btn-primary" name="excel_action" value="import">Inventar importieren</button>
         </form>
@@ -883,7 +887,7 @@
             <div class="form-group">
                 <label for="individual_codes">Einzelcodes (optional, je Zeile ein Code)</label>
                 <textarea id="individual_codes" name="individual_codes" rows="4" placeholder="z.B.\nABC-001\nABC-002"></textarea>
-                <small style="display:block; color:#666;">Bei Anzahl > 1 können hier individuelle Codes pro Item gesetzt werden. Scanner-Eingaben werden bei Mehrfachanzahl automatisch hier angefügt.</small>
+                <small style="display:block; color:#666;">Bei Anzahl > 1 können hier individuelle Codes pro Item gesetzt werden. Der Scanner setzt immer zuerst den Basis-Code im Feld oben; weitere Einzelcodes können hier bei Bedarf manuell ergänzt werden.</small>
             </div>
             <!-- Image upload (hidden for library mode) -->
             <div class="form-group" {% if show_library_features %}style="display:none;"{% endif %}>
@@ -904,7 +908,7 @@
                     <button type="button" class="fetch-isbn-button" onclick="fetchBookInfo('upload')">Bild abrufen</button>
                 </div>
                 <div id="isbn-scanner" style="width:100%; max-width:520px; display:none; margin-top:10px;"></div>
-                <small id="isbn-scan-status" style="display:block; color:#666; margin-top:6px;">Scannen oder manuell eingeben. Das Buchcover wird automatisch heruntergeladen.</small>
+                <small id="isbn-scan-status" style="display:block; color:#666; margin-top:6px;">Scannen oder manuell eingeben. Gültige ISBNs helfen beim Abruf von Buchdaten, andere Codes werden trotzdem akzeptiert.</small>
                 <div id="book-info-container" class="book-info-container"></div>
             </div>
             
@@ -920,6 +924,53 @@
     </div>
 </div>
 
+<!-- CSV Help Modal -->
+<div id="csv-help-modal" class="popup-overlay" style="display:none;">
+    <div class="duplicate-code-popup" style="max-width:760px;">
+        <button class="popup-close-x" onclick="hideCsvHelp()">×</button>
+        <div class="popup-content">
+            <h3>CSV Import Format</h3>
+            <p id="csv-help-text" style="text-align:left; color:var(--ui-text);"></p>
+            <div style="margin-top:12px; text-align:center;">
+                <button class="popup-close-button" onclick="hideCsvHelp()">Schließen</button>
+            </div>
+        </div>
+    </div>
+</div>
+
+<script>
+    function downloadSampleCsv(scope) {
+        let headers = ['name','ort','beschreibung','filter1','filter2','filter3','anschaffungsjahr','anschaffungskosten','code_4','anzahl','isbn','item_type'];
+        let exampleInventory = ['Projektor','Aula','HD-Projektor für Präsentationen','Medien','Technik','','2019','450.00','PRJ-001','1','','general'];
+        let exampleLibrary = ['Harry Potter und der Stein der Weisen','Bibliothek','Kinderbuch von J.K. Rowling','Belletristik','','','1997','12.99','HP-001','1','9783551354013','book'];
+        let row = exampleInventory;
+        if (scope === 'library') row = exampleLibrary;
+
+        const csvContent = [headers.join(','), row.map(v=> '"'+String(v).replace(/"/g,'""')+'"').join(',')].join('\n');
+        const blob = new Blob([csvContent], { type: 'text/csv;charset=utf-8;' });
+        const url = URL.createObjectURL(blob);
+        const a = document.createElement('a');
+        a.href = url;
+        a.download = scope === 'library' ? 'sample_library_import.csv' : 'sample_inventory_import.csv';
+        document.body.appendChild(a);
+        a.click();
+        document.body.removeChild(a);
+        URL.revokeObjectURL(url);
+    }
+
+    function showCsvHelp(scope) {
+        const invText = `Erlaubte Spalten (Reihenfolge beliebig): name, ort, beschreibung, filter1, filter2, filter3, anschaffungsjahr, anschaffungskosten, code_4, anzahl, isbn, item_type.\n\n` +
+            `Hinweise:\n- Trenne Felder per Komma. Textfelder sollten in Anführungszeichen stehen, wenn sie Kommas enthalten.\n- Für Bibliotheks-Import ist eine gültige ISBN pro Zeile erforderlich (ISBN-10 oder ISBN-13).\n- 'code_4' kann leer bleiben; das System erzeugt in diesem Fall Codes.\n- 'anzahl' legt die Anzahl physischer Exemplare für diese Zeile fest.`;
+        const libText = invText;
+        document.getElementById('csv-help-text').textContent = scope === 'library' ? libText : invText;
+        document.getElementById('csv-help-modal').style.display = 'flex';
+    }
+
+    function hideCsvHelp() {
+        document.getElementById('csv-help-modal').style.display = 'none';
+    }
+</script>
+
 <script src="https://unpkg.com/html5-qrcode@2.0.9/dist/html5-qrcode.min.js"></script>
 <script>
     const libraryModuleEnabled = {{ 'true' if library_module_enabled else 'false' }};
@@ -965,33 +1016,30 @@
         return '';
     }
 
-    function appendIndividualCode(scannedCode) {
-        const textarea = document.getElementById('individual_codes');
-        const itemCountInput = document.getElementById('item_count');
-        if (!textarea || !itemCountInput) return false;
+    function updateIsbnLiveValidation() {
+        const isbnField = document.getElementById('isbn');
+        const statusEl = document.getElementById('isbn-scan-status');
+        if (!isbnField || !statusEl) return;
 
-        const itemCount = Math.max(1, parseInt(itemCountInput.value || '1', 10));
-        if (itemCount <= 1) return false;
+        const rawValue = isbnField.value.trim();
+        isbnField.classList.remove('code-valid', 'code-invalid');
 
-        const existing = textarea.value
-            .split(/\r?\n/)
-            .map(line => line.trim())
-            .filter(Boolean);
-
-        if (existing.includes(scannedCode)) {
-            setCode4ScanStatus(`Code ${scannedCode} ist bereits eingetragen.`, true);
-            return true;
+        if (!rawValue) {
+            statusEl.textContent = 'Scannen oder manuell eingeben. Gültige ISBNs helfen beim Abruf von Buchdaten, andere Codes werden trotzdem akzeptiert.';
+            statusEl.style.color = '#666';
+            return;
         }
 
-        if (existing.length >= itemCount) {
-            setCode4ScanStatus('Es sind bereits genug Einzelcodes für die gewählte Anzahl eingetragen.', true);
-            return true;
+        if (normalizeIsbnClient(rawValue)) {
+            isbnField.classList.add('code-valid');
+            statusEl.textContent = 'Gültiges ISBN-Format erkannt. Der Wert kann gespeichert werden.';
+            statusEl.style.color = '#666';
+            return;
         }
 
-        existing.push(scannedCode);
-        textarea.value = existing.join('\n');
-        setCode4ScanStatus(`Code ${scannedCode} hinzugefügt (${existing.length}/${itemCount}).`);
-        return true;
+        isbnField.classList.add('code-invalid');
+        statusEl.textContent = 'Kein gültiges ISBN-10/13-Format erkannt. Der Wert wird trotzdem akzeptiert.';
+        statusEl.style.color = '#b00020';
     }
 
     function startCode4Scanner() {
@@ -1027,7 +1075,7 @@
             rememberLastUsedCamera: true
         });
         code4ScannerRunning = true;
-        setCode4ScanStatus('Scanner läuft. Mehrere Codes nacheinander möglich.');
+        setCode4ScanStatus('Scanner läuft. Der Scan wird im Basis-Codefeld übernommen.');
 
         code4ScannerInstance.render((decodedText) => {
             const scannedCode = String(decodedText || '').trim();
@@ -1040,12 +1088,9 @@
             code4LastScanned = scannedCode;
             code4LastScannedAt = now;
 
-            const usedForIndividual = appendIndividualCode(scannedCode);
-            if (!usedForIndividual) {
-                codeField.value = scannedCode;
-                validateCodeField(codeField);
-                setCode4ScanStatus(`Code_4 gesetzt: ${scannedCode}`);
-            }
+            codeField.value = scannedCode;
+            validateCodeField(codeField);
+            setCode4ScanStatus(`Code_4 gesetzt: ${scannedCode}`);
         }, () => {});
     }
 
@@ -1094,21 +1139,23 @@
             if (!scannedCode) return;
 
             const normalizedIsbn = normalizeIsbnClient(scannedCode);
-            if (!normalizedIsbn) {
-                setIsbnScanStatus('Kein gültiger ISBN-Barcode erkannt. Bitte erneut scannen.', true);
-                return;
+            isbnField.value = normalizedIsbn || scannedCode;
+            updateIsbnLiveValidation();
+            if (normalizedIsbn) {
+                setIsbnScanStatus(`ISBN gesetzt: ${normalizedIsbn}`);
+            } else {
+                setIsbnScanStatus('Kein gültiges ISBN-Format erkannt, der gescannte Wert bleibt aber im Feld.', true);
             }
 
-            isbnField.value = normalizedIsbn;
-            setIsbnScanStatus(`ISBN gesetzt: ${normalizedIsbn}`);
-
             isbnScannerInstance.clear().catch(() => {});
             scannerBox.style.display = 'none';
             scanButton.textContent = 'ISBN scannen';
             isbnScannerRunning = false;
 
-            // Automatically load book metadata after scan.
-            fetchBookInfo('upload');
+            if (normalizedIsbn) {
+                // Automatically load book metadata after a valid ISBN scan.
+                fetchBookInfo('upload');
+            }
         }, () => {});
     }
 
@@ -1231,7 +1278,7 @@
         const isbn = normalizeIsbnClient(isbnField.value);
         
         if (!isbn) {
-            alert('Bitte eine gültige ISBN-10 oder ISBN-13 eingeben.');
+            infoContainer.innerHTML = '<div class="error-message">Bitte geben Sie eine ISBN oder einen Barcode ein.</div>';
             return;
         }
         
@@ -1645,6 +1692,13 @@
         if (scanIsbnBtn) {
             scanIsbnBtn.addEventListener('click', startIsbnScanner);
         }
+
+        const isbnField = document.getElementById('isbn');
+        if (isbnField) {
+            isbnField.addEventListener('input', updateIsbnLiveValidation);
+            isbnField.addEventListener('blur', updateIsbnLiveValidation);
+            updateIsbnLiveValidation();
+        }
         
         // Setup add new location button
         const addLocationBtn = document.getElementById('add-new-location-btn');

Web/tenant.py

@@ -7,20 +7,61 @@ Supports subdomain-based tenant identification and per-tenant database namespaci
 Each tenant can support up to 20+ users with isolated data and resource pools.
 """
 
-from flask import request, g, has_request_context
+from flask import request, g, session, has_request_context
 from functools import wraps
+import datetime
+import json
 import logging
 import os
 import re
+import ipaddress
 import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
 
 logger = logging.getLogger(__name__)
 
+_TENANT_REGISTRY_MTIME = None
+
+
+def _load_tenant_registry_from_config():
+    registry = {}
+    config_path = getattr(cfg, 'CONFIG_PATH', None)
+    if config_path and os.path.isfile(config_path):
+        try:
+            with open(config_path, 'r', encoding='utf-8') as handle:
+                config = json.load(handle)
+            tenants = config.get('tenants', {})
+            if isinstance(tenants, dict):
+                registry.update(tenants)
+        except Exception as exc:
+            logger.warning("Failed to load tenant registry from config: %s", exc)
+    elif isinstance(getattr(cfg, 'TENANT_CONFIGS', None), dict):
+        registry.update(cfg.TENANT_CONFIGS)
+    return registry
+
+
+def _refresh_tenant_registry():
+    global TENANT_REGISTRY, _TENANT_REGISTRY_MTIME
+    config_path = getattr(cfg, 'CONFIG_PATH', None)
+
+    current_mtime = None
+    if config_path and os.path.isfile(config_path):
+        try:
+            current_mtime = os.path.getmtime(config_path)
+        except OSError:
+            current_mtime = None
+
+    if current_mtime == _TENANT_REGISTRY_MTIME:
+        return TENANT_REGISTRY
+
+    TENANT_REGISTRY.clear()
+    TENANT_REGISTRY.update(_load_tenant_registry_from_config())
+    _TENANT_REGISTRY_MTIME = current_mtime
+    return TENANT_REGISTRY
+
+
 # Tenant registry: maps subdomain/tenant_id to database name
-TENANT_REGISTRY = {}
-if isinstance(getattr(cfg, 'TENANT_CONFIGS', None), dict):
-    TENANT_REGISTRY.update(cfg.TENANT_CONFIGS)
+TENANT_REGISTRY = _load_tenant_registry_from_config()
 
 
 def _get_nested_value(source, path, default=None):
@@ -65,6 +106,27 @@ def _parse_port_from_host(host):
     return host, None
 
 
+def _first_host_token(value):
+    raw = str(value or '').strip()
+    if not raw:
+        return ''
+    return raw.split(',', 1)[0].strip().lower()
+
+
+def _request_host_candidates():
+    candidates = []
+    for header_name in ('X-Forwarded-Host', 'X-Original-Host', 'Host'):
+        token = _first_host_token(request.headers.get(header_name, ''))
+        if token and token not in candidates:
+            candidates.append(token)
+
+    direct_host = _first_host_token(getattr(request, 'host', ''))
+    if direct_host and direct_host not in candidates:
+        candidates.append(direct_host)
+
+    return candidates
+
+
 def _tenant_id_for_port(port):
     """Map a host port to a registered tenant ID via tenant configs or env overrides."""
     for tenant_id, config in TENANT_REGISTRY.items():
@@ -88,8 +150,37 @@ def _tenant_id_for_port(port):
     return None
 
 
+def _find_registered_tenant_id(candidate):
+    candidate = str(candidate or '').strip()
+    if not candidate:
+        return None
+
+    if candidate in TENANT_REGISTRY:
+        return candidate
+
+    lowered = candidate.lower()
+    for tenant_id in TENANT_REGISTRY:
+        if str(tenant_id).lower() == lowered:
+            return tenant_id
+
+    return None
+
+
+def _is_ip_host(hostname):
+    hostname = str(hostname or '').strip()
+    if not hostname:
+        return False
+    try:
+        ipaddress.ip_address(hostname)
+        return True
+    except ValueError:
+        return False
+
+
 def get_tenant_config(tenant_id=None):
     """Return the registered config for a tenant, falling back to default."""
+    _refresh_tenant_registry()
+
     if tenant_id is None:
         ctx = get_tenant_context()
         tenant_id = ctx.tenant_id if ctx and ctx.tenant_id else 'default'
@@ -113,6 +204,29 @@ def _normalize_db_name(db_name):
     return db_name
 
 
+def _module_name_candidates(module_name):
+    normalized = str(module_name or '').strip().lower().replace('-', '_')
+    if not normalized:
+        return []
+
+    candidates = [normalized]
+    alias_groups = {
+        'inventory': {'inventory', 'inventar'},
+        'terminplan': {'terminplan', 'terminplaner', 'termin', 'appointments'},
+        'library': {'library', 'bib', 'bibliothek'},
+        'student_cards': {'student_cards', 'studentcards', 'schuelerausweise', 'schueler_ausweise'},
+    }
+
+    for canonical_name, aliases in alias_groups.items():
+        if normalized in aliases:
+            for alias in (canonical_name, *sorted(aliases)):
+                if alias not in candidates:
+                    candidates.append(alias)
+            break
+
+    return candidates
+
+
 def _tenant_db_aliases(tenant_id):
     aliases = []
     env_map = _parse_tenant_db_map()
@@ -153,8 +267,189 @@ def _resolve_db_alias(tenant_id, db_name):
 def is_tenant_module_enabled(module_name, tenant_id=None, default=False):
     """Resolve whether a feature module is enabled for the current tenant."""
     config = get_tenant_config(tenant_id)
-    enabled = _get_nested_value(config, ['modules', module_name, 'enabled'], default)
-    return bool(enabled)
+    for candidate_name in _module_name_candidates(module_name):
+        enabled = _get_nested_value(config, ['modules', candidate_name, 'enabled'], None)
+        if enabled is not None:
+            return bool(enabled)
+
+    return bool(default)
+
+
+def _parse_datetime_value(value):
+    if value is None or value == '':
+        return None
+    if isinstance(value, datetime.datetime):
+        parsed = value
+    else:
+        text = str(value).strip()
+        if not text:
+            return None
+        try:
+            parsed = datetime.datetime.fromisoformat(text.replace('Z', '+00:00'))
+        except ValueError:
+            return None
+
+    if parsed.tzinfo is not None:
+        parsed = parsed.astimezone(datetime.timezone.utc).replace(tzinfo=None)
+    return parsed
+
+
+def get_tenant_trial_config(tenant_id=None):
+    """Return the optional trial/demo lifecycle settings for a tenant."""
+    config = get_tenant_config(tenant_id)
+    trial_config = _get_nested_value(config, ['trial'], {})
+    if not isinstance(trial_config, dict):
+        trial_config = {}
+
+    demo_config = _get_nested_value(config, ['demo'], {})
+    if isinstance(demo_config, dict):
+        merged = dict(demo_config)
+        merged.update(trial_config)
+        trial_config = merged
+
+    return trial_config
+
+
+def get_tenant_trial_status(tenant_id=None, now=None):
+    """Compute the current trial status for a tenant.
+
+    The config may define either an absolute "expires_at" timestamp or a
+    relative lifetime via "started_at"/"created_at" plus one of
+    "expires_after_days", "ttl_days", or "days".
+    """
+    trial_config = get_tenant_trial_config(tenant_id)
+    now = now or datetime.datetime.now()
+
+    enabled = bool(trial_config.get('enabled') or trial_config.get('active'))
+    if not enabled:
+        return {
+            'enabled': False,
+            'expired': False,
+            'auto_delete': bool(trial_config.get('auto_delete', False)),
+            'started_at': None,
+            'expires_at': None,
+            'days_left': None,
+        }
+
+    started_at = _parse_datetime_value(
+        trial_config.get('started_at')
+        or trial_config.get('created_at')
+        or trial_config.get('activated_at')
+    )
+    expires_at = _parse_datetime_value(trial_config.get('expires_at'))
+
+    if expires_at is None:
+        duration_days = trial_config.get('expires_after_days')
+        if duration_days is None:
+            duration_days = trial_config.get('ttl_days')
+        if duration_days is None:
+            duration_days = trial_config.get('days')
+        try:
+            duration_days = int(duration_days) if duration_days is not None else None
+        except (TypeError, ValueError):
+            duration_days = None
+
+        if duration_days is not None:
+            base_time = started_at or now
+            expires_at = base_time + datetime.timedelta(days=max(0, duration_days))
+
+    expired = bool(expires_at and now >= expires_at)
+    days_left = None
+    if expires_at:
+        remaining = expires_at - now
+        days_left = max(0, int(remaining.total_seconds() // 86400))
+
+    return {
+        'enabled': True,
+        'expired': expired,
+        'auto_delete': bool(trial_config.get('auto_delete', False)),
+        'started_at': started_at,
+        'expires_at': expires_at,
+        'days_left': days_left,
+    }
+
+
+def _get_tenant_db_name_from_config(tenant_id):
+    config = get_tenant_config(tenant_id)
+    explicit_db = None
+    if isinstance(config, dict):
+        explicit_db = config.get('db') or config.get('db_name')
+
+    if explicit_db:
+        return _normalize_db_name(explicit_db)
+
+    sanitized = ''.join(c if c.isalnum() or c == '_' else '' for c in str(tenant_id).lower())
+    return f'inventar_{sanitized}' if sanitized else cfg.MONGODB_DB
+
+
+def delete_tenant(tenant_id, *, drop_database=True, remove_from_config=True):
+    """Delete a tenant's runtime data and optionally remove its config entry."""
+    tenant_id = str(tenant_id or '').strip()
+    if not tenant_id:
+        return False
+
+    db_name = _get_tenant_db_name_from_config(tenant_id)
+
+    if drop_database:
+        try:
+            client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+            try:
+                client.drop_database(db_name)
+            finally:
+                client.close()
+        except Exception as exc:
+            logger.warning("Failed to drop tenant database %s for %s: %s", db_name, tenant_id, exc)
+
+    if remove_from_config:
+        try:
+            config_path = getattr(cfg, 'CONFIG_PATH', None)
+            if config_path and os.path.isfile(config_path):
+                with open(config_path, 'r', encoding='utf-8') as handle:
+                    config = json.load(handle)
+
+                tenants = config.get('tenants', {})
+                if not isinstance(tenants, dict):
+                    tenants = {}
+
+                aliases = set(_tenant_db_aliases(tenant_id))
+                aliases.add(tenant_id)
+                lowered = tenant_id.lower()
+                if lowered.startswith('schule'):
+                    aliases.add('school' + lowered[len('schule'):])
+                elif lowered.startswith('school'):
+                    aliases.add('schule' + lowered[len('school'):])
+
+                removed_any = False
+                for alias in aliases:
+                    if alias in tenants:
+                        tenants.pop(alias, None)
+                        removed_any = True
+
+                if removed_any:
+                    config['tenants'] = tenants
+                    with open(config_path, 'w', encoding='utf-8') as handle:
+                        json.dump(config, handle, indent=4, ensure_ascii=False)
+
+            for alias in [tenant_id, *_tenant_db_aliases(tenant_id)]:
+                TENANT_REGISTRY.pop(alias, None)
+        except Exception as exc:
+            logger.warning("Failed to remove tenant config for %s: %s", tenant_id, exc)
+
+    return True
+
+
+def purge_expired_trial_tenants(now=None):
+    """Delete expired trial tenants that opted into auto-delete."""
+    now = now or datetime.datetime.now()
+    purged_tenants = []
+
+    for tenant_id in list(TENANT_REGISTRY.keys()):
+        status = get_tenant_trial_status(tenant_id, now=now)
+        if status.get('enabled') and status.get('expired') and status.get('auto_delete'):
+            if delete_tenant(tenant_id):
+                purged_tenants.append(tenant_id)
+
+    return purged_tenants
 
 
 class TenantContext:
@@ -181,45 +476,83 @@ class TenantContext:
         # Priority 1: X-Tenant-ID header (for testing/internal APIs)
         tenant_from_header = request.headers.get('X-Tenant-ID', '').strip()
         if tenant_from_header:
-            self.tenant_id = tenant_from_header
-            self.config = get_tenant_config(tenant_from_header)
-            return self._get_db_name(tenant_from_header)
+            matched_tenant = _find_registered_tenant_id(tenant_from_header) or tenant_from_header
+            self.tenant_id = matched_tenant
+            self.config = get_tenant_config(matched_tenant)
+            session['tenant_id'] = matched_tenant
+            return self._get_db_name(matched_tenant)
 
-        # Priority 2: Port-based tenant mapping
-        host = request.host.lower()
-        _, port = _parse_port_from_host(host)
-        self.port = port
-        logger.info(f"Tenant resolution start: request.host={host} request.headers={dict(request.headers)}")
-        if port:
-            tenant_from_port = _tenant_id_for_port(port)
-            if tenant_from_port:
-                self.tenant_id = tenant_from_port
-                self.config = get_tenant_config(tenant_from_port)
-                logger.info(
-                    f"Tenant resolution by port: host={host} port={port} tenant={tenant_from_port} config={self.config}"
-                )
-                return self._get_db_name(tenant_from_port)
-            logger.info(f"Tenant port not mapped: host={host} port={port}")
+        # Priority 2: Port/host based tenant mapping
+        host_candidates = _request_host_candidates()
+        primary_host = host_candidates[0] if host_candidates else _first_host_token(getattr(request, 'host', ''))
+        logger.info(
+            "Tenant resolution start: request.host=%s host_candidates=%s request.headers=%s",
+            getattr(request, 'host', ''),
+            host_candidates,
+            dict(request.headers),
+        )
+
+        for host in host_candidates:
+            hostname, port = _parse_port_from_host(host)
+            if port:
+                self.port = port
+                tenant_from_port = _tenant_id_for_port(port)
+                if tenant_from_port:
+                    self.tenant_id = tenant_from_port
+                    self.config = get_tenant_config(tenant_from_port)
+                    session['tenant_id'] = tenant_from_port
+                    logger.info(
+                        f"Tenant resolution by port: host={host} port={port} tenant={tenant_from_port} config={self.config}"
+                    )
+                    return self._get_db_name(tenant_from_port)
+                logger.info(f"Tenant port not mapped: host={host} port={port}")
 
         # Priority 3: Subdomain extraction
-        parts = host.split('.')
+        for host in host_candidates:
+            host_without_port, _ = _parse_port_from_host(host)
+            host_without_port = (host_without_port or '').strip().lower()
+            if not host_without_port:
+                continue
 
-        # Extract subdomain from host
-        # Examples: schule1.example.com → schule1
-        #          app.example.com → app (skip wildcard/app)
-        if len(parts) >= 3:
-            potential_subdomain = parts[0]
-
-            # Filter out common non-tenant subdomains
-            if potential_subdomain not in ('www', 'api', 'admin', 'app', 'mail'):
-                self.subdomain = potential_subdomain
-                self.tenant_id = potential_subdomain
-                self.config = get_tenant_config(potential_subdomain)
+            direct_host_match = _find_registered_tenant_id(host_without_port)
+            if direct_host_match:
+                self.subdomain = host_without_port
+                self.tenant_id = direct_host_match
+                self.config = get_tenant_config(direct_host_match)
+                session['tenant_id'] = direct_host_match
                 logger.info(
-                    f"Tenant resolution by subdomain: host={host} tenant={potential_subdomain} config={self.config}"
+                    f"Tenant resolution by direct host match: host={host} tenant={direct_host_match} config={self.config}"
                 )
-                return self._get_db_name(potential_subdomain)
-            logger.info(f"Tenant subdomain ignored: {potential_subdomain}")
+                return self._get_db_name(direct_host_match)
+
+            if host_without_port and not _is_ip_host(host_without_port):
+                parts = host_without_port.split('.')
+                if len(parts) >= 2:
+                    potential_subdomain = parts[0]
+                    if potential_subdomain not in ('www', 'api', 'admin', 'app', 'mail'):
+                        matched_tenant = _find_registered_tenant_id(potential_subdomain)
+                        if matched_tenant:
+                            self.subdomain = potential_subdomain
+                            self.tenant_id = matched_tenant
+                            self.config = get_tenant_config(matched_tenant)
+                            session['tenant_id'] = matched_tenant
+                            logger.info(
+                                f"Tenant resolution by subdomain: host={host} tenant={matched_tenant} config={self.config}"
+                            )
+                            return self._get_db_name(matched_tenant)
+                        logger.info(f"Tenant subdomain not registered: {potential_subdomain}")
+                    else:
+                        logger.info(f"Tenant subdomain ignored: {potential_subdomain}")
+
+        # Priority 4: sticky tenant from the authenticated session
+        session_tenant = session.get('tenant_id', '').strip() if session.get('tenant_id') else ''
+        if session_tenant:
+            self.tenant_id = session_tenant
+            self.config = get_tenant_config(session_tenant)
+            logger.info(
+                f"Tenant resolution by session: host={primary_host} tenant={session_tenant} config={self.config}"
+            )
+            return self._get_db_name(session_tenant)
 
         # Fallback to default tenant if no tenant identifier found.
         # If no explicit 'default' tenant config exists, use configured MongoDB DB.

config.json

@@ -19,6 +19,17 @@
         "cert": "Web/certs/cert.pem",
         "key": "Web/certs/key.pem"
     },
+    "email": {
+        "enabled": false,
+        "smtp_host": "smtp.gmail.com",
+        "smtp_port": 587,
+        "use_tls": true,
+        "username": "",
+        "password": "",
+        "from_address": "",
+        "default_sender_name": "Invario Inventurprogramm",
+        "timeout_seconds": 30
+    },
     "images": {
         "thumbnail_size": [
             150,

docker-compose-multitenant.yml

@@ -95,6 +95,7 @@ services:
       INVENTAR_MONGODB_HOST: mongodb
       INVENTAR_MONGODB_PORT: "27017"
       INVENTAR_MONGODB_DB: inventar_default
+      INVENTAR_CONFIG_PATH: /app/config.json
       
       # Redis Configuration (for sessions and caching)
       INVENTAR_REDIS_HOST: redis

manage-tenant.sh

@@ -9,7 +9,9 @@ if [ ! -f "docker-compose-multitenant.yml" ]; then
     exit 1
 fi
 
-CONFIG_FILE="$PWD/config.json"
+# Resolve script directory so config paths are deterministic even when called via sudo
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CONFIG_FILE="$SCRIPT_DIR/config.json"
 
 ensure_runtime_config_json() {
     local config_path backup_path
@@ -37,6 +39,9 @@ ensure_runtime_config_json() {
         "library": {
             "enabled": false
         },
+            "terminplan": {
+                "enabled": true
+            },
         "student_cards": {
             "enabled": false,
             "default_borrow_days": 14,
@@ -54,6 +59,7 @@ show_help() {
     echo ""
     echo "Commands:"
     echo "  add <tenant_id> [port]       Add a new tenant (initializes database)"
+    echo "  trial <tenant_id> [port] [days] Create a 7-day demo tenant that auto-deletes after expiry"
     echo "  remove <tenant_id>           Remove a tenant completely (deletes data!)"
     echo "  restart-tenant <id>          'Restart' a single tenant (clears cache/sessions)"
     echo "  restart-all                  Restart all application containers (zero-downtime reload)"
@@ -63,6 +69,7 @@ show_help() {
     echo ""
     echo "Examples:"
     echo "  ./manage-tenant.sh add school_a 10001"
+    echo "  ./manage-tenant.sh trial school_demo 10002 7"
     echo "  ./manage-tenant.sh remove test_tenant"
     echo "  ./manage-tenant.sh module school_a inventory=off library=on"
     echo "  ./manage-tenant.sh restart-all"
@@ -70,6 +77,24 @@ show_help() {
     exit 1
 }
 
+tenant_aliases() {
+    local tenant_id="$1"
+    local normalized alias
+    normalized="$(printf '%s' "$tenant_id" | tr '[:upper:]' '[:lower:]')"
+    printf '%s\n' "$tenant_id"
+    if [[ "$normalized" == schule* ]]; then
+        alias="school${normalized#schule}"
+        if [[ "$alias" != "$tenant_id" ]]; then
+            printf '%s\n' "$alias"
+        fi
+    elif [[ "$normalized" == school* ]]; then
+        alias="schule${normalized#school}"
+        if [[ "$alias" != "$tenant_id" ]]; then
+            printf '%s\n' "$alias"
+        fi
+    fi
+}
+
 register_tenant_port() {
     local tenant_id="$1"
     local port="$2"
@@ -85,15 +110,25 @@ with open(path, 'r', encoding='utf-8') as f:
 tenants = cfg.get('tenants')
 if tenants is None or not isinstance(tenants, dict):
     tenants = {}
+aliases = {tenant_id}
+normalized = tenant_id.lower()
+if normalized.startswith('schule'):
+    aliases.add('school' + normalized[len('schule'):])
+elif normalized.startswith('school'):
+    aliases.add('schule' + normalized[len('school'):])
 for tid, conf in tenants.items():
-    if isinstance(conf, dict) and str(conf.get('port')) == port_str and tid != tenant_id:
+    if isinstance(conf, dict) and str(conf.get('port')) == port_str and tid not in aliases:
         print(f"Error: port {port_str} is already mapped to tenant {tid}", file=sys.stderr)
         sys.exit(2)
-existing = tenants.get(tenant_id)
-if existing is None or not isinstance(existing, dict):
-    existing = {}
+existing = {}
+for alias in aliases:
+    alias_cfg = tenants.get(alias)
+    if isinstance(alias_cfg, dict):
+        existing = alias_cfg
+        break
 existing['port'] = int(port_str)
-tenants[tenant_id] = existing
+for alias in aliases:
+    tenants[alias] = dict(existing)
 cfg['tenants'] = tenants
 with open(path, 'w', encoding='utf-8') as f:
     json.dump(cfg, f, indent=4, ensure_ascii=False)
@@ -107,6 +142,177 @@ PY
     fi
 }
 
+write_trial_tenant_config() {
+    local tenant_id="$1"
+    local port="$2"
+    local trial_days="$3"
+
+    if python3 - <<'PY' "$CONFIG_FILE" "$tenant_id" "$port" "$trial_days"
+import json, sys, os, datetime
+
+path, tenant_id, port_str, trial_days_str = sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4]
+if not os.path.isfile(path):
+    print(f"Error: config file not found: {path}", file=sys.stderr)
+    sys.exit(1)
+
+with open(path, 'r', encoding='utf-8') as f:
+    cfg = json.load(f)
+
+tenants = cfg.get('tenants')
+if tenants is None or not isinstance(tenants, dict):
+    tenants = {}
+
+aliases = {tenant_id}
+normalized = tenant_id.lower()
+if normalized.startswith('schule'):
+    aliases.add('school' + normalized[len('schule'):])
+elif normalized.startswith('school'):
+    aliases.add('schule' + normalized[len('school'):])
+
+for tid, conf in tenants.items():
+    if port_str and isinstance(conf, dict) and str(conf.get('port')) == port_str and tid not in aliases:
+        print(f"Error: port {port_str} is already mapped to tenant {tid}", file=sys.stderr)
+        sys.exit(2)
+
+try:
+    trial_days = max(1, int(trial_days_str))
+except ValueError:
+    print(f"Error: trial days must be numeric, got {trial_days_str!r}", file=sys.stderr)
+    sys.exit(3)
+
+now = datetime.datetime.now(datetime.timezone.utc).isoformat()
+trial_config = {
+    'enabled': True,
+    'auto_delete': True,
+    'days': trial_days,
+    'ttl_days': trial_days,
+    'expires_after_days': trial_days,
+    'started_at': now,
+    'created_at': now,
+}
+
+existing = {}
+for alias in aliases:
+    alias_cfg = tenants.get(alias)
+    if isinstance(alias_cfg, dict):
+        existing = alias_cfg
+        break
+
+if port_str:
+    existing['port'] = int(port_str)
+existing['modules'] = {
+    'inventory': {'enabled': True},
+    'library': {'enabled': True},
+    'student_cards': {'enabled': True, 'default_borrow_days': 14, 'max_borrow_days': 365},
+        'terminplan': {'enabled': True},
+}
+existing['trial'] = trial_config
+
+for alias in aliases:
+    tenants[alias] = dict(existing)
+
+cfg['tenants'] = tenants
+with open(path, 'w', encoding='utf-8') as f:
+    json.dump(cfg, f, indent=4, ensure_ascii=False)
+
+print(f"Configured trial tenant {tenant_id} with {trial_days} day(s) and auto-delete enabled")
+PY
+    then
+        echo "Trial tenant $tenant_id configured in config.json"
+    else
+        echo "Failed to configure trial tenant $tenant_id"
+        exit 1
+    fi
+}
+
+initialize_tenant_database() {
+    local tenant_id="$1"
+    local mode="$2"
+
+    APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
+    if [ -z "$APP_CONTAINER" ]; then
+        echo "Warning: Application container is not running. Please start the multi-tenant system first."
+        echo "Data will be initialized upon first access by the tenant."
+        return 0
+    fi
+
+    docker exec "$APP_CONTAINER" python3 -c '
+import sys, re, datetime, hashlib
+sys.path.insert(0, "/app")
+sys.path.insert(0, "/app/Web")
+from Web.modules.database import settings
+from pymongo import MongoClient
+
+tenant_id = sys.argv[1].lower()
+mode = sys.argv[2]
+sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
+db_name = f"inventar_{sanitized}"
+client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
+db = client[db_name]
+hashed_pw = hashlib.sha512("admin123".encode()).hexdigest()
+
+action_permissions = {
+    "can_borrow": True,
+    "can_insert": True,
+    "can_edit": True,
+    "can_delete": True,
+    "can_manage_users": True,
+    "can_manage_settings": True,
+    "can_view_logs": True,
+}
+
+page_permissions = {
+    "home": True,
+    "tutorial_page": True,
+    "my_borrowed_items": True,
+    "notifications_view": True,
+    "impressum": True,
+    "license": True,
+    "library_view": True,
+    "terminplan": True,
+    "home_admin": True,
+    "upload_admin": True,
+    "library_admin": True,
+    "admin_borrowings": True,
+    "library_loans_admin": True,
+    "admin_damaged_items": True,
+    "admin_audit_dashboard": True,
+    "logs": True,
+    "manage_filters": True,
+    "manage_locations": True,
+}
+
+if db.users.count_documents({"Username": "admin"}) == 0:
+    db.users.insert_one({
+        "Username": "admin",
+        "Password": hashed_pw,
+        "Admin": True,
+        "active_ausleihung": None,
+        "name": "Admin",
+        "last_name": "User",
+        "IsStudent": False,
+        "PermissionPreset": "full_access",
+        "ActionPermissions": action_permissions,
+        "PagePermissions": page_permissions,
+    })
+
+if mode == "trial":
+    db.settings.update_one(
+        {"setting_type": "tenant_trial"},
+        {"$set": {
+            "setting_type": "tenant_trial",
+            "enabled": True,
+            "auto_delete": True,
+            "days": 7,
+            "created_at": datetime.datetime.now(datetime.timezone.utc).isoformat(),
+        }},
+        upsert=True,
+    )
+
+print(f"Tenant {sys.argv[1]} database initialized. Default admin: admin / admin123")
+' "$tenant_id" "$mode"
+}
+
 update_runtime_ports() {
     local new_port="$1"
     local env_file="$PWD/.docker-build.env"
@@ -212,13 +418,15 @@ EOF
 }
 
 restart_app_container() {
-    local env_file="$PWD/.docker-build.env"
+    local workdir="$SCRIPT_DIR"
+    local env_file="$SCRIPT_DIR/.docker-build.env"
     local compose_args=()
 
     ensure_runtime_config_json
     
     # If HOST_WORKDIR is set (called from container), use absolute paths so docker daemon resolves them correctly
-    if [ -n "$HOST_WORKDIR" ]; then
+    if [ -n "${HOST_WORKDIR:-}" ]; then
+        workdir="$HOST_WORKDIR"
         compose_args+=( -f "$(readlink -f "$HOST_WORKDIR/docker-compose-multitenant.yml")" )
         if [ -f "$HOST_WORKDIR/.docker-compose.runtime.override.yml" ]; then
             compose_args+=( -f "$(readlink -f "$HOST_WORKDIR/.docker-compose.runtime.override.yml")" )
@@ -228,9 +436,9 @@ restart_app_container() {
         fi
     else
         # Normal case: called directly from host
-        compose_args+=( -f "$PWD/docker-compose-multitenant.yml" )
-        if [ -f "$PWD/.docker-compose.runtime.override.yml" ]; then
-            compose_args+=( -f "$PWD/.docker-compose.runtime.override.yml" )
+        compose_args+=( -f "$workdir/docker-compose-multitenant.yml" )
+        if [ -f "$workdir/.docker-compose.runtime.override.yml" ]; then
+            compose_args+=( -f "$workdir/.docker-compose.runtime.override.yml" )
         fi
         if [ -f "$env_file" ]; then
             compose_args+=( --env-file "$env_file" )
@@ -238,7 +446,7 @@ restart_app_container() {
     fi
     
     # Pass along COMPOSE_PROJECT_NAME if set so the internal docker-compose sees it
-    if [ -n "$COMPOSE_PROJECT_NAME" ]; then
+    if [ -n "${COMPOSE_PROJECT_NAME:-}" ]; then
         compose_args=( -p "$COMPOSE_PROJECT_NAME" "${compose_args[@]}" )
     fi
 
@@ -259,9 +467,20 @@ if not os.path.isfile(path):
 with open(path, 'r', encoding='utf-8') as f:
     cfg = json.load(f)
 tenants = cfg.get('tenants', {})
-if not isinstance(tenants, dict) or tenant_id not in tenants or not isinstance(tenants[tenant_id], dict):
+if not isinstance(tenants, dict):
     sys.exit(2)
-removed = tenants.pop(tenant_id, None)
+aliases = {tenant_id}
+normalized = tenant_id.lower()
+if normalized.startswith('schule'):
+    aliases.add('school' + normalized[len('schule'):])
+elif normalized.startswith('school'):
+    aliases.add('schule' + normalized[len('school'):])
+removed = None
+for alias in list(aliases):
+    alias_cfg = tenants.get(alias)
+    if isinstance(alias_cfg, dict):
+        removed = alias_cfg if removed is None else removed
+        tenants.pop(alias, None)
 cfg['tenants'] = tenants
 with open(path, 'w', encoding='utf-8') as f:
     json.dump(cfg, f, indent=4, ensure_ascii=False)
@@ -373,7 +592,7 @@ case "$COMMAND" in
         APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
         if [ -n "$APP_CONTAINER" ]; then
             docker exec $APP_CONTAINER python3 -c "
-import sys, re; sys.path.insert(0, '/app/Web'); import settings; from pymongo import MongoClient; import hashlib
+import sys, re; sys.path.insert(0, '/app'); sys.path.insert(0, '/app/Web'); from Web.modules.database import settings; from pymongo import MongoClient; import hashlib
 tenant_id = sys.argv[1].lower()
 sanitized = ''.join(c for c in tenant_id if c.isalnum() or c == '_')
 db_name = f'inventar_{sanitized}'
@@ -428,6 +647,36 @@ print(f'Tenant {sys.argv[1]} database initialized. Default admin: admin / admin1
             echo "Data will be initialized upon first access by the tenant."
         fi
         ;;
+
+    trial)
+        if [ -z "$TENANT_ID" ]; then
+            echo "Error: Please provide a tenant_id."
+            exit 1
+        fi
+
+        PORT_ARG="${3:-}"
+        DAYS_ARG="${4:-7}"
+
+        if [ -n "$PORT_ARG" ]; then
+            if ! printf '%s\n' "$PORT_ARG" | grep -qE '^[0-9]+$'; then
+                echo "Error: Port must be a numeric value."
+                exit 1
+            fi
+            register_tenant_port "$TENANT_ID" "$PORT_ARG"
+            update_runtime_ports "$PORT_ARG"
+            sync_tenant_port_map
+        fi
+
+        write_trial_tenant_config "$TENANT_ID" "$PORT_ARG" "$DAYS_ARG"
+
+        if [ -n "$(docker ps -qf 'name=app' | head -n 1)" ]; then
+            restart_app_container
+        fi
+
+        echo "Initializing trial database for $TENANT_ID..."
+        initialize_tenant_database "$TENANT_ID" "trial"
+        echo "Trial tenant '$TENANT_ID' successfully configured. It will expire after $DAYS_ARG day(s) and self-delete."
+        ;;
     
     remove)
         if [ -z "$TENANT_ID" ]; then
@@ -441,7 +690,7 @@ print(f'Tenant {sys.argv[1]} database initialized. Default admin: admin / admin1
             APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
             if [ -n "$APP_CONTAINER" ]; then
                 docker exec $APP_CONTAINER python3 -c "
-import sys; sys.path.insert(0, '/app/Web'); from tenant import TenantContext; import settings; from pymongo import MongoClient
+import sys; sys.path.insert(0, '/app'); sys.path.insert(0, '/app/Web'); from tenant import TenantContext; from Web.modules.database import settings; from pymongo import MongoClient
 ctx = TenantContext()
 db_name = ctx._get_db_name(sys.argv[1])
 client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
@@ -488,7 +737,7 @@ print(f'Database for tenant {sys.argv[1]} dropped.')
         APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
         if [ -n "$APP_CONTAINER" ]; then
             docker exec $APP_CONTAINER python3 -c "
-import sys; sys.path.insert(0, '/app/Web'); import settings; from pymongo import MongoClient
+import sys; sys.path.insert(0, '/app'); sys.path.insert(0, '/app/Web'); from Web.modules.database import settings; from pymongo import MongoClient
 client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
 db = client[f'{settings.MONGODB_DB}_{sys.argv[1]}']
 db.sessions.drop() # Force sign-out / session clear
@@ -535,8 +784,9 @@ PY
         if [ -n "$APP_CONTAINER" ]; then
              docker exec -i "$APP_CONTAINER" python3 - <<'PY'
 import sys
+sys.path.insert(0, '/app')
 sys.path.insert(0, '/app/Web')
-import settings
+from Web.modules.database import settings
 from pymongo import MongoClient
 client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
 prefix = 'inventar_'
@@ -575,11 +825,26 @@ with open(path, 'r', encoding='utf-8') as f:
     cfg = json.load(f)
 
 tenants = cfg.setdefault('tenants', {})
-tenant_cfg = tenants.setdefault(tenant_id, {})
-if 'port' not in tenant_cfg:
-    print(f"Warning: Tenant {tenant_id} doesn't have a port mapping in config.json.", file=sys.stderr)
+aliases = {tenant_id}
+normalized = tenant_id.lower()
+if normalized.startswith('schule'):
+    aliases.add('school' + normalized[len('schule'):])
+elif normalized.startswith('school'):
+    aliases.add('schule' + normalized[len('school'):])
+
+tenant_cfg = None
+for alias in aliases:
+    alias_cfg = tenants.get(alias)
+    if isinstance(alias_cfg, dict):
+        tenant_cfg = alias_cfg
+        break
+if tenant_cfg is None:
+    tenant_cfg = {}
 
 modules = tenant_cfg.setdefault('modules', {})
+port = tenant_cfg.get('port')
+if port is None:
+    print(f"Warning: Tenant {tenant_id} doesn't have a port mapping in config.json.", file=sys.stderr)
 
 for arg in module_args:
     if '=' not in arg:
@@ -591,6 +856,14 @@ for arg in module_args:
     module_cfg['enabled'] = state
     print(f"Module '{mod_name}' set to '{'on' if state else 'off'}' for tenant '{tenant_id}'.")
 
+for alias in aliases:
+    alias_cfg = tenants.get(alias)
+    if not isinstance(alias_cfg, dict):
+        alias_cfg = {}
+    alias_cfg.update(tenant_cfg)
+    alias_cfg['modules'] = modules
+    tenants[alias] = alias_cfg
+
 with open(path, 'w', encoding='utf-8') as f:
     json.dump(cfg, f, indent=4, ensure_ascii=False)
 PY