feat: Refactor logging module structure and implement audit logging functionality

.docker-compose.runtime.override.yml

@@ -1,8 +1,6 @@
 services:
   app:
-    working_dir: /app/Web
-    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "4", "--threads", "2", "--timeout", "30", "--graceful-timeout", "20", "--worker-connections", "100", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
-    image: ghcr.io/aiirondev/legendary-octo-garbanzo:latest
+    image: ghcr.io/aiirondev/legendary-octo-garbanzo:v0.7.42
     build: null
     ports:
       - "10000:8000"

Web/__init__.py

@@ -0,0 +1 @@
+# Web package initialization

Web/app.py

@@ -31,10 +31,21 @@ from werkzeug.middleware.proxy_fix import ProxyFix
 from werkzeug.exceptions import HTTPException
 from werkzeug.routing import BuildError
 from jinja2 import TemplateNotFound
+import os
+import sys
+
+# Ensure imports work regardless of whether gunicorn starts in /app or /app/Web.
+_CURRENT_DIR = os.path.dirname(os.path.abspath(__file__))
+_PROJECT_ROOT = os.path.dirname(_CURRENT_DIR)
+if _PROJECT_ROOT not in sys.path:
+    sys.path.insert(0, _PROJECT_ROOT)
+if _CURRENT_DIR not in sys.path:
+    sys.path.insert(0, _CURRENT_DIR)
+
 import Web.modules.database.user as us
 import Web.modules.database.items as it
 import Web.modules.database.ausleihung as au
-import Web.modules.logs.audit_log as al
+import Web.modules.log.audit_log as al
 import push_notifications as pn
 import Web.modules.inventarsystem.pdf_export as pdf_export 
 import datetime
@@ -44,7 +55,6 @@ from urllib.parse import urlparse, urlunparse
 import requests
 import csv
 import ipaddress
-import os
 import json
 import datetime
 import time
@@ -65,7 +75,6 @@ except Exception:
 # import qrcode
 # from qrcode.constants import ERROR_CORRECT_L
 import threading
-import sys
 import shutil
 import uuid
 from PIL import Image, ImageOps

Web/modules/__init__.py

@@ -0,0 +1 @@
+# Web.modules package initialization

Web/modules/bibliothek/__init__.py

@@ -0,0 +1 @@
+# Web.modules.bibliothek package initialization

Web/modules/database/ausleihung.py

@@ -103,7 +103,7 @@ def get_current_status(ausleihung, log_changes=False, user=None):
     if log_changes and new_status != original_status and '_id' in ausleihung:
         try:
             # Importieren Sie das Modul nur bei Bedarf, um zirkuläre Importe zu vermeiden
-            import Web.modules.logs.ausleihung_log as ausleihung_log
+            import Web.modules.log.ausleihung_log as ausleihung_log
             ausleihung_log.log_status_change(
                 str(ausleihung['_id']), 
                 original_status, 

Web/modules/database/settings.py

@@ -135,7 +135,7 @@ def _get_int_env(name, default):
         return int(default)
 
 def get_version():
-    with open(os.path.join(BASE_DIR, '..', '.docker-build.env'), 'r') as f:
+    with open(os.path.join(BASE_DIR, '..', '..', '..', '.docker-build.env'), 'r') as f:
         for l in f:
             if l.startswith('INVENTAR_APP_IMAGE='):
                 return l.split(':', 1)[1].strip()

Web/modules/emailservice/__init__.py

@@ -0,0 +1 @@
+# Web.modules.emailservice package initialization

Web/modules/log/__init__.py

@@ -0,0 +1 @@
+# Web.modules.logs package initialization

Web/modules/log/audit_log.py

@@ -0,0 +1,149 @@
+"""
+Tamper-evident audit logging helpers.
+
+The audit chain stores each entry with a hash of the previous entry.
+Any mutation in history breaks the chain verification.
+"""
+
+import datetime
+import hashlib
+import json
+import random
+import time
+
+from pymongo.errors import DuplicateKeyError
+
+
+def _stable_json(value):
+    """Serialize dictionaries in a stable way for deterministic hashing."""
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=str)
+
+
+def _entry_hash(prev_hash, payload):
+    """Build the chained entry hash from previous hash + canonical payload."""
+    base = f"{prev_hash}|{_stable_json(payload)}"
+    return hashlib.sha256(base.encode("utf-8")).hexdigest()
+
+
+def append_audit_event(db, event_type, actor, payload, request_ip=None, source="web", max_retries=5):
+    """
+    Append an audit event to a tamper-evident chain.
+
+    Args:
+        db: MongoDB database handle.
+        event_type (str): Event category.
+        actor (str): User/system who performed the action.
+        payload (dict): Event details.
+        request_ip (str, optional): Request origin.
+        source (str): Source subsystem.
+
+    Returns:
+        dict: Inserted audit entry.
+    """
+    logs = db["audit_log"]
+    attempts = 0
+
+    while attempts <= max_retries:
+        previous = logs.find_one(sort=[("chain_index", -1)])
+        prev_hash = previous.get("entry_hash", "") if previous else ""
+        chain_index = int(previous.get("chain_index", 0)) + 1 if previous else 1
+
+        timestamp = datetime.datetime.utcnow()
+        entry_payload = {
+            "event_type": event_type,
+            "actor": actor or "system",
+            "source": source,
+            "ip": request_ip or "",
+            "payload": payload or {},
+            "timestamp": timestamp.isoformat() + "Z",
+        }
+
+        entry_hash = _entry_hash(prev_hash, entry_payload)
+
+        entry = {
+            **entry_payload,
+            "created_at": timestamp,
+            "prev_hash": prev_hash,
+            "entry_hash": entry_hash,
+            "chain_index": chain_index,
+        }
+
+        try:
+            logs.insert_one(entry)
+            return entry
+        except DuplicateKeyError:
+            attempts += 1
+            if attempts > max_retries:
+                raise
+            # Exponential backoff with jitter to avoid retry storms.
+            delay = min(0.25, (0.005 * (2 ** attempts)) + random.random() * 0.01)
+            time.sleep(delay)
+
+
+def ensure_audit_indexes(db):
+    """Create indexes required for fast and safe audit operations."""
+    logs = db["audit_log"]
+    logs.create_index("chain_index", unique=True, name="audit_chain_index_unique")
+    logs.create_index("created_at", name="audit_created_at_idx")
+    logs.create_index("event_type", name="audit_event_type_idx")
+
+
+def verify_audit_chain(db):
+    """Verify hash chain integrity across all stored audit entries."""
+    logs = db["audit_log"]
+    entries = list(logs.find({}, {"_id": 1, "event_type": 1, "actor": 1, "source": 1, "ip": 1, "payload": 1, "timestamp": 1, "prev_hash": 1, "entry_hash": 1, "chain_index": 1}).sort("chain_index", 1))
+
+    previous_hash = ""
+    previous_index = 0
+    mismatches = []
+
+    for entry in entries:
+        chain_index = int(entry.get("chain_index", 0))
+        prev_hash = entry.get("prev_hash", "")
+        entry_hash = entry.get("entry_hash", "")
+
+        payload = {
+            "event_type": entry.get("event_type", ""),
+            "actor": entry.get("actor", ""),
+            "source": entry.get("source", ""),
+            "ip": entry.get("ip", ""),
+            "payload": entry.get("payload", {}),
+            "timestamp": entry.get("timestamp", ""),
+        }
+
+        expected_hash = _entry_hash(previous_hash, payload)
+
+        if chain_index != previous_index + 1:
+            mismatches.append({
+                "chain_index": chain_index,
+                "error": "chain_index_gap",
+                "expected": previous_index + 1,
+                "found": chain_index,
+            })
+
+        if prev_hash != previous_hash:
+            mismatches.append({
+                "chain_index": chain_index,
+                "error": "prev_hash_mismatch",
+                "expected": previous_hash,
+                "found": prev_hash,
+            })
+
+        if entry_hash != expected_hash:
+            mismatches.append({
+                "chain_index": chain_index,
+                "error": "entry_hash_mismatch",
+                "expected": expected_hash,
+                "found": entry_hash,
+            })
+
+        previous_hash = entry_hash
+        previous_index = chain_index
+
+    return {
+        "ok": len(mismatches) == 0,
+        "count": len(entries),
+        "last_chain_index": previous_index,
+        "last_hash": previous_hash,
+        "mismatches": mismatches,
+    }

Web/modules/log/ausleihung_log.py

@@ -0,0 +1,45 @@
+'''
+   Copyright 2025-2026 AIIrondev
+
+   Licensed under the Inventarsystem EULA (Endbenutzer-Lizenzvertrag).
+   See Legal/LICENSE for the full license text.
+   Unauthorized commercial use, SaaS hosting, or removal of branding is prohibited.
+   For commercial licensing inquiries: https://github.com/AIIrondev
+'''
+"""
+Funktion zum Protokollieren von Statusänderungen bei Ausleihungen
+"""
+import os
+import datetime
+from bson.objectid import ObjectId
+
+def log_status_change(ausleihung_id, old_status, new_status, user=None):
+    """
+    Protokolliert eine Statusänderung einer Ausleihung in einer Log-Datei.
+    
+    Args:
+        ausleihung_id: Die ID der Ausleihung
+        old_status: Der alte Status
+        new_status: Der neue Status
+        user: Der Benutzer, der die Änderung vorgenommen hat (optional)
+    """
+    try:
+        # Erstelle Log-Verzeichnis, falls es nicht existiert
+        log_dir = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'logs')
+        if not os.path.exists(log_dir):
+            os.makedirs(log_dir)
+        
+        # Log-Datei für Statusänderungen
+        log_file = os.path.join(log_dir, 'ausleihungen_status_changes.log')
+        
+        # Protokolliere die Änderung
+        timestamp = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
+        user_info = f" by {user}" if user else ""
+        
+        with open(log_file, 'a', encoding='utf-8') as f:
+            f.write(f"{timestamp}: Ausleihung {ausleihung_id} - Status changed from '{old_status}' to '{new_status}'{user_info}\n")
+            
+        return True
+    except Exception as e:
+        print(f"Fehler beim Protokollieren der Statusänderung: {e}")
+        return False