Slight adjustments

- Added `remove_done` function to clean up finished appointments in the database.
- Introduced `get_upcoming_for_user` function to retrieve upcoming appointments for a specific user.
- Updated `backend_server.py` to include a new endpoint for fetching user-specific upcoming events.
- Modified `blueprint.py` to render upcoming events in the user interface.
- Enhanced `terminplan.html` to display a list of upcoming appointments with relevant details and action links.
- Updated configuration to enable the new appointment planning feature.

.docker-build.env

@@ -8,5 +8,4 @@ INVENTAR_APP_MEM_SWAP_LIMIT=768m
 INVENTAR_WORKERS=4
 INVENTAR_THREADS=2
 INVENTAR_WORKER_TIMEOUT=30
-INVENTAR_WORKER_CONNECTIONS=100
-
+INVENTAR_WORKER_CONNECTIONS=100

.docker-compose.runtime.override.yml

@@ -1,5 +1,7 @@
 services:
   app:
+    working_dir: /app/Web
+    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "4", "--threads", "2", "--timeout", "30", "--graceful-timeout", "20", "--worker-connections", "100", "--max-requests", "1000", "--max-requests-jitter", "100", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
     image: ghcr.io/aiirondev/legendary-octo-garbanzo:v0.7.42
     build: null
     ports:

.github/workflows/release-docker.yml

@@ -15,15 +15,6 @@ on:
           - patch
           - minor
           - major
-          - development
-      push_dev:
-        description: "If true, push the :dev image to GHCR for development releases"
-        required: false
-        default: "false"
-        type: choice
-        options:
-          - "true"
-          - "false"
 
 permissions:
   contents: write
@@ -48,13 +39,12 @@ jobs:
           EVENT_NAME: ${{ github.event_name }}
           REF_NAME: ${{ github.ref_name }}
           BUMP_TYPE: ${{ github.event.inputs.bump || 'patch' }}
-          PUSH_DEV: ${{ github.event.inputs.push_dev || 'false' }}
         run: |
           if [ "$EVENT_NAME" = "push" ] && [ -n "$REF_NAME" ]; then
             TAG="$REF_NAME"
           else
-            # Fetch latest release tag via GitHub API (fall back to v3.0.0)
-            latest_tag="v3.0.0"
+            # Fetch latest release tag via GitHub API (fall back to v0.8.31)
+            latest_tag="v0.8.31"
             if meta_json=$(curl -fsSL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "https://api.github.com/repos/$REPO/releases/latest" 2>/dev/null); then
               tag_name=$(printf "%s" "$meta_json" | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
               if [ -n "$tag_name" ]; then
@@ -67,7 +57,7 @@ jobs:
               minor=${BASH_REMATCH[2]}
               patch=${BASH_REMATCH[3]}
             else
-              major=3; minor=0; patch=0
+              major=0; minor=8; patch=31
             fi
 
             # Bump strategy: major / minor / patch
@@ -78,30 +68,28 @@ jobs:
             else
               patch=$((patch + 1))
             fi
-
-            if [ "${BUMP_TYPE:-}" = "development" ]; then
-              TAG="v${major}.${minor}.${patch}-dev"
-            else
-              TAG="v${major}.${minor}.${patch}"
-            fi
+            
+            # Zusammenbau des Tags für den manuellen Run
+            TAG="v${major}.${minor}.${patch}"
           fi
 
+          # Validierung des erzeugten oder übergebenen Tags
           if ! echo "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+(-dev(\.[0-9]+)?)?$'; then
-            echo "Error: tag '$TAG' is not valid semver (vX.Y.Z or vX.Y.Z-dev)"
+            echo "Error: tag '$TAG' is not valid semver (vX.Y.Z)"
             exit 1
           fi
 
           git fetch --tags --force
           LATEST_TAG="$(git tag -l 'v*' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n1)"
           if [ -z "$LATEST_TAG" ]; then
-            LATEST_TAG="v3.0.0"
+            LATEST_TAG="v0.8.31"
           fi
 
           TAG_MAJOR="${TAG#v}"
           TAG_MAJOR="${TAG_MAJOR%%.*}"
           LATEST_MAJOR="$(echo "$LATEST_TAG" | grep -Eo '^v[0-9]+' | tr -d 'v')"
           if [ -z "$LATEST_MAJOR" ]; then
-            LATEST_MAJOR="3"
+            LATEST_MAJOR="0"
           fi
 
           # If not explicitly bumping major, disallow changing major version
@@ -123,33 +111,6 @@ jobs:
           IMAGE="ghcr.io/aiirondev/legendary-octo-garbanzo:${TAG}"
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "image=$IMAGE" >> "$GITHUB_OUTPUT"
-          if [ "${BUMP_TYPE:-}" = "development" ]; then
-            echo "is_development=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "is_development=false" >> "$GITHUB_OUTPUT"
-          fi
-          if [ "${BUMP_TYPE:-}" = "development" ] && [ "${PUSH_DEV:-}" = "true" ]; then
-            echo "push_dev=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "push_dev=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Update .release-version file
-        run: |
-          echo "${{ steps.meta.outputs.tag }}" > .release-version
-          cat .release-version
-
-      - name: Create and push tag for manual releases
-        if: github.event_name == 'workflow_dispatch'
-        run: |
-          TAG="${{ steps.meta.outputs.tag }}"
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add .release-version
-          git commit -m "chore: bump version to $TAG" || true
-          git tag "$TAG"
-          git push origin "$TAG"
-          git push origin HEAD:${{ github.ref_name }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -162,26 +123,16 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push release image
-        if: steps.meta.outputs.is_development != 'true'
         uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
           push: true
+          load: true # Lädt das Image in den lokalen Docker-Daemon für den 'docker save' Schritt
           tags: |
             ${{ steps.meta.outputs.image }}
             ghcr.io/aiirondev/legendary-octo-garbanzo:latest
 
-      - name: Build and push development image (:dev)
-        if: steps.meta.outputs.is_development == 'true' && steps.meta.outputs.push_dev == 'true'
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: |
-            ghcr.io/aiirondev/legendary-octo-garbanzo:dev
-
       - name: Build local image tar for offline deploy
         run: |
           set -euo pipefail
@@ -204,30 +155,17 @@ jobs:
           docker build -t "$IMG" .
           docker save "$IMG" | gzip > "inventarsystem-image-${TAG}.tar.gz"
 
-      # development tar omitted: dev releases will be versioned (vX.Y.Z-dev) and handled by update.sh using the tag
-
-      - name: Commit .release-version for tag pushes
-        if: github.event_name == 'push'
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          if ! git diff --quiet .release-version; then
-            git add .release-version
-            git commit -m "chore: update version to ${{ steps.meta.outputs.tag }}"
-            git push origin HEAD:${{ github.ref_name }}
-          fi
-
       - name: Create release-only docker bundle
         run: |
           mkdir -p release-bundle
           cat > release-bundle/docker-compose.yml <<EOF
           services:
             app:
-              image: ${INVENTAR_APP_IMAGE:-ghcr.io/aiirondev/legendary-octo-garbanzo:${{ steps.meta.outputs.tag }}}
+              image: \${INVENTAR_APP_IMAGE:-ghcr.io/aiirondev/legendary-octo-garbanzo:${{ steps.meta.outputs.tag }}}
               container_name: inventarsystem-app
               restart: unless-stopped
               ports:
-                - "${INVENTAR_HTTP_PORT:-10000}:8000"
+                - "\${INVENTAR_HTTP_PORT:-10000}:8000"
               depends_on:
                 - mongodb
                 - redis
@@ -300,17 +238,6 @@ jobs:
             fi
           done
 
-          cat > release-bundle/DEVELOPMENT.md <<EOF
-          This is a development prerelease bundle for tag: ${{ steps.meta.outputs.tag }}
-
-          This prerelease is intentionally separate from normal releases and will not be used by default.
-
-          To install this prerelease on a target host run:
-
-            ./update.sh ${{ steps.meta.outputs.tag }}
-
-          EOF
-
           # Make any shipped scripts executable
           find release-bundle -maxdepth 1 -type f -name '*.sh' -exec chmod +x {} \; || true
           tar -czf inventarsystem-docker-bundle.tar.gz -C release-bundle .
@@ -319,10 +246,8 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.meta.outputs.tag }}
-          prerelease: ${{ steps.meta.outputs.is_development }}
           files: |
             inventarsystem-docker-bundle.tar.gz
             inventarsystem-image-${{ steps.meta.outputs.tag }}.tar.gz
-            inventarsystem-image-dev.tar.gz
           fail_on_unmatched_files: false
-          generate_release_notes: true
+          generate_release_notes: true

.release-version

@@ -1 +1 @@
-v0.8.2
+v0.8.31.1

Dockerfile

@@ -32,4 +32,4 @@ RUN if [ "$NUITKA_BUILD" = "1" ]; then \
 WORKDIR /app/Web
 EXPOSE 8000
 
-CMD ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "30", "--graceful-timeout", "20", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
+CMD ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "30", "--graceful-timeout", "20", "--max-requests", "1000", "--max-requests-jitter", "100", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]

README.md

@@ -556,6 +556,14 @@ sudo chmod 644 certs/inventarsystem.crt
 
 ## Fehlerbehebung
 
+### Logs Auslesen
+
+```bash
+docker logs inventarsystem-app-1
+docker exec inventarsystem-app-1 cat /data/logs/application.log | tail -n 100
+docker compose exec mongodb mongosh
+```
+
 ### Webserver startet nicht
 
 ```bash

Web/modules/database/ausleihung.py

@@ -1235,5 +1235,5 @@ def reset_item_completely(item_id):
     except Exception as e:
         return {
             'success': False,
-            'message': f'Fehler beim Zurücksetzen: {str(e)}'
+            'message': f'Fehler beim Zurücksetzen.'
         }

Web/modules/database/items.py

@@ -18,21 +18,13 @@ Collection Structure:
   - Optional fields: Images, Filter, Filter2, Filter3, Anschaffungsjahr, Anschaffungskosten, Code_4
   - Status fields: Verfuegbar, User (if currently borrowed)
 """
-'''
-   Copyright 2025-2026 AIIrondev
-
-   Licensed under the Inventarsystem EULA (Endbenutzer-Lizenzvertrag).
-   See Legal/LICENSE for the full license text.
-   Unauthorized commercial use, SaaS hosting, or removal of branding is prohibited.
-   For commercial licensing inquiries: https://github.com/AIIrondev
-'''
 from bson.objectid import ObjectId
 import datetime
 import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
 
 
-LIBRARY_ITEM_TYPES = ('book', 'cd', 'dvd', 'media')
+LIBRARY_ITEM_TYPES = ('book', 'cd', 'dvd', 'media', 'schulbuch')
 
 
 def _non_library_query(extra_query=None):
@@ -57,7 +49,7 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
              ansch_jahr=None, ansch_kost=None, code_4=None, reservierbar=True,
              series_group_id=None, series_count=1, series_position=1,
              is_grouped_sub_item=False, parent_item_id=None,
-             isbn=None, item_type='general'):
+             isbn=None, item_type='general', library_category=None):
     """
     Add a new item to the inventory.
     
@@ -78,6 +70,9 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
         series_position (int, optional): Position inside the batch (1-based)
         is_grouped_sub_item (bool, optional): Whether this item is hidden as sub-item
         parent_item_id (str, optional): Parent item id if this is a sub-item
+        isbn (str, optional): ISBN for books or media items
+        item_type (str, optional): Type of the item (e.g., 'general', 'book', 'cd')
+        library_category (str, optional): Library category for the item
         
     Returns:
         ObjectId: ID of the new item or None if failed
@@ -105,6 +100,7 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
             'Anschaffungskosten': ansch_kost,
             'Code_4': code_4,
             'ISBN': isbn,
+            'library_category': library_category,
             'ItemType': item_type,
             'SeriesGroupId': series_group_id,
             'SeriesCount': series_count,
@@ -202,69 +198,61 @@ def get_group_item_ids(id):
         return []
 
 
-def update_item(id, name, ort, beschreibung, images=None, verfuegbar=True, 
-                filter=None, filter2=None, filter3=None, ansch_jahr=None, ansch_kost=None, code_4=None, reservierbar=True,
-                isbn=None, item_type='general'):
-    """
-    Update an existing inventory item.
-    
-    Args:
-        id (str): ID of the item to update
-        name (str): Name of the item
-        ort (str): Location of the item
-        beschreibung (str): Description of the item
-        images (list, optional): List of image filenames for the item
-        verfuegbar (bool, optional): Availability status of the item
-        filter (str, optional): Primary filter/category for the item
-        filter2 (str, optional): Secondary filter/category for the item
-        filter3 (str, optional): Tertiary filter/category for the item
-        ansch_jahr (int, optional): Year of acquisition
-        ansch_kost (float, optional): Cost of acquisition
-        code_4 (str, optional): 4-digit identification code
-        reservierbar (bool, optional): Whether the item can be reserved in advance
-        
-    Returns:
-        bool: True if successful, False otherwise
-    """
+def update_item(id, name, ort, beschreibung, images, verfuegbar, filter1, filter2, filter3, 
+                ansch_jahr, ansch_kost, code_4, reservierbar, isbn=None, item_type='general'):
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         items = db['items']
 
-        # Set default values for optional parameters
-        if images is None:
-            images = []
+        # 1. Altes Item laden, um SeriesGroupId zu bestimmen
+        old_item = items.find_one({'_id': ObjectId(id)})
+        if not old_item:
+            return False
+            
+        series_group_id = old_item.get('SeriesGroupId')
 
-        update_data = {
+        # 2. Shared Data: Daten, die für ALLE in der Gruppe gleich sind
+        shared_update = {
             'Name': name,
             'Ort': ort,
             'Beschreibung': beschreibung,
             'Images': images,
-            'Verfuegbar': verfuegbar,
-            'Reservierbar': reservierbar,
-            'Filter': filter,
+            'Filter': filter1,
             'Filter2': filter2,
             'Filter3': filter3,
             'Anschaffungsjahr': ansch_jahr,
             'Anschaffungskosten': ansch_kost,
-            'Code_4': code_4,
+            'Reservierbar': reservierbar,
             'ISBN': isbn,
             'ItemType': item_type,
+            'Verfuegbar': verfuegbar, # Wir behalten den Status bei
             'LastUpdated': datetime.datetime.now()
         }
 
-        result = items.update_one(
-            {'_id': ObjectId(id)},
-            {'$set': update_data}
-        )
+        # 3. Spezifische Daten: Was NICHT synchronisiert wird
+        specific_update = shared_update.copy()
+        specific_update['Code_4'] = code_4
+
+        # 4. Das aktuelle Item updaten
+        items.update_one({'_id': ObjectId(id)}, {'$set': specific_update})
+
+        # 5. Alle anderen Gruppen-Mitglieder synchronisieren
+        if series_group_id:
+            items.update_many(
+                {
+                    'SeriesGroupId': series_group_id,
+                    '_id': {'$ne': ObjectId(id)}
+                },
+                {'$set': shared_update}
+            )
 
         client.close()
-        return result.modified_count > 0
+        return True
     except Exception as e:
         print(f"Error updating item: {e}")
         return False
 
-
 def update_item_status(id, verfuegbar, user=None):
     """
     Update the availability status of an inventory item.

Web/modules/database/settings.py

@@ -71,6 +71,15 @@ DEFAULTS = {
         'logo_path': '',
         'logo_thumb': '',
         'logo_thumb': '',
+        # School-level rollover configuration for advancing class years
+        'rollover': {
+            'month': 9,
+            'day': 1,
+            'hour': 3,
+            'minute': 0,
+            'max_class': 13,
+            'graduate_label': ''
+        },
     },
     'schoolPeriods': {
         "1": {"start": "08:00", "end": "08:45", "label": "1. Stunde (08:00 - 08:45)"},
@@ -88,6 +97,9 @@ DEFAULTS = {
         'inventory': {
             'enabled': True
         },
+        'terminplan': {
+            'enabled': True
+        },
         'library': {
             'enabled': False
         },
@@ -157,32 +169,18 @@ def _get_int_env(name, default):
 def get_version():
     # Prefer an explicit release marker if present (created by release process).
     project_root = os.path.abspath(os.path.join(BASE_DIR, '..', '..', '..'))
-    release_file = os.path.join(project_root, '.release-version')
+    release_file = os.path.join(project_root, '.docker-build.env')
     try:
         if os.path.isfile(release_file):
             with open(release_file, 'r', encoding='utf-8') as f:
-                val = f.read().strip()
-                if val:
-                    return val
+                var = f.readline()
+                for i in var:
+                    i = i.split(":")
+                    i.pop[0]
+                    return str(i)
     except Exception:
         pass
 
-    # Fallback to .docker-build.env (legacy behaviour)
-    env_path = os.path.join(project_root, '.docker-build.env')
-    try:
-        with open(env_path, 'r', encoding='utf-8') as f:
-            for l in f:
-                if l.startswith('INVENTAR_APP_IMAGE='):
-                    return l.split(':', 1)[1].strip()
-    except Exception:
-        pass
-
-    # Final fallback: use config.json value or packaged default
-    try:
-        return _get(_conf, ['ver'], DEFAULTS.get('version', '0.0.0'))
-    except Exception:
-        return DEFAULTS.get('version', '0.0.0')
-
 # Expose settings
 APP_VERSION = get_version()
 DEBUG = _get_bool_env('INVENTAR_DEBUG', _get(_conf, ['dbg'], DEFAULTS['debug']))
@@ -221,10 +219,30 @@ SSL_ENABLED = _get(_conf, ['ssl', 'enabled'], DEFAULTS['ssl']['enabled'])
 SSL_CERT = _get(_conf, ['ssl', 'cert'], DEFAULTS['ssl']['cert'])
 SSL_KEY = _get(_conf, ['ssl', 'key'], DEFAULTS['ssl']['key'])
 
+# Email settings
+EMAIL_ENABLED = _get(_conf, ['email', 'enabled'], False)
+EMAIL_SMTP_HOST = _get(_conf, ['email', 'smtp_host'], 'smtp.gmail.com')
+EMAIL_SMTP_PORT = int(_get(_conf, ['email', 'smtp_port'], 587))
+EMAIL_USE_TLS = bool(_get(_conf, ['email', 'use_tls'], True))
+EMAIL_USERNAME = _get(_conf, ['email', 'username'], '')
+EMAIL_PASSWORD = _get(_conf, ['email', 'password'], '')
+EMAIL_FROM_ADDRESS = _get(_conf, ['email', 'from_address'], EMAIL_USERNAME)
+EMAIL_DEFAULT_SENDER_NAME = _get(_conf, ['email', 'default_sender_name'], 'Inventarsystem')
+EMAIL_TIMEOUT_SECONDS = int(_get(_conf, ['email', 'timeout_seconds'], 30))
+
 # School periods
 SCHOOL_PERIODS = _get(_conf, ['schoolPeriods'], DEFAULTS['schoolPeriods'])
 SCHOOL_INFO_DEFAULT = _get(_conf, ['school'], DEFAULTS['school'])
 
+# School rollover configuration (can be set in config.json under `school.rollover`)
+SCHOOL_ROLLOVER = _get(_conf, ['school', 'rollover'], DEFAULTS['school'].get('rollover', {}))
+SCHOOL_ROLLOVER_MONTH = int(os.getenv('INVENTAR_SCHOOL_ROLLOVER_MONTH', str(SCHOOL_ROLLOVER.get('month', 9))))
+SCHOOL_ROLLOVER_DAY = int(os.getenv('INVENTAR_SCHOOL_ROLLOVER_DAY', str(SCHOOL_ROLLOVER.get('day', 1))))
+SCHOOL_ROLLOVER_HOUR = int(os.getenv('INVENTAR_SCHOOL_ROLLOVER_HOUR', str(SCHOOL_ROLLOVER.get('hour', 3))))
+SCHOOL_ROLLOVER_MIN = int(os.getenv('INVENTAR_SCHOOL_ROLLOVER_MIN', str(SCHOOL_ROLLOVER.get('minute', 0))))
+SCHOOL_ROLLOVER_MAX_CLASS = int(os.getenv('INVENTAR_SCHOOL_MAX_CLASS', str(SCHOOL_ROLLOVER.get('max_class', 13))))
+SCHOOL_ROLLOVER_GRADUATE_LABEL = os.getenv('INVENTAR_SCHOOL_GRADUATE_LABEL', str(SCHOOL_ROLLOVER.get('graduate_label', '')))
+
 # Optional feature modules
 TENANT_CONFIGS = _get(_conf, ['tenants'], {})
 
@@ -257,17 +275,23 @@ class _TenantAwareBool:
 from Web.modules.module_registry import registry as MODULES
 
 INVENTORY_MODULE_ENABLED = _TenantAwareBool('inventory', _get(_conf, ['modules', 'inventory', 'enabled'], DEFAULTS['modules']['inventory']['enabled']))
+TERMINPLAN_MODULE_ENABLED = _TenantAwareBool('terminplan', _get(_conf, ['modules', 'terminplan', 'enabled'], DEFAULTS['modules']['terminplan']['enabled']))
 LIBRARY_MODULE_ENABLED = _TenantAwareBool('library', _get(_conf, ['modules', 'library', 'enabled'], DEFAULTS['modules']['library']['enabled']))
 STUDENT_CARDS_MODULE_ENABLED = _TenantAwareBool('student_cards', _get(_conf, ['modules', 'student_cards', 'enabled'], DEFAULTS['modules']['student_cards']['enabled']))
 
 def _match_inventory(path):
     if not path: return False
     if path == '/' or path.startswith('/home'): return True
-    return path.startswith(('/scanner', '/inventory', '/upload_admin', '/manage_filters', '/manage_locations', '/admin_borrowings', '/admin_damaged_items', '/admin/borrowings', '/admin/damaged_items', '/terminplan'))
+    return path.startswith(('/scanner', '/inventory', '/upload_admin', '/manage_filters', '/manage_locations', '/admin_borrowings', '/admin_damaged_items', '/admin/borrowings', '/admin/damaged_items'))
+
+def _match_terminplan(path):
+    if not path:
+        return False
+    return path.startswith(('/terminplan', '/terminplaner'))
 
 def _match_library(path):
     if not path: return False
-    return path.startswith(('/library', '/library_', '/student_cards'))
+    return path.startswith(('/library', '/library_', '/student_cards', '/admin_damaged_items', '/admin_borrowings', '/admin/library'))
 
 def _match_student_cards(path):
     if not path: return False
@@ -275,6 +299,7 @@ def _match_student_cards(path):
 
 # Register core modules into the pipeline
 MODULES.register('inventory', INVENTORY_MODULE_ENABLED, _match_inventory)
+MODULES.register('terminplan', TERMINPLAN_MODULE_ENABLED, _match_terminplan)
 MODULES.register('library', LIBRARY_MODULE_ENABLED, _match_library)
 MODULES.register('student_cards', STUDENT_CARDS_MODULE_ENABLED, _match_student_cards)
 

Web/modules/database/termine.py

@@ -0,0 +1,314 @@
+"""
+Apointment Managment
+=========================
+
+This module manages appointments in the database. It provides comprehensive 
+functionality for creating, updating, retrieving appointments items.
+
+Key Features:
+- Creating and updating appointments
+- Retrieving items by ID
+- Managing time slots
+- client retrival
+
+Collection Structure:
+- appointments:
+  - Required fields: user, start_date, end_date, daytime, slots, slot_time
+  - Optional fields: Images, Filter, Filter2, Filter3, Anschaffungsjahr, Anschaffungskosten, Code_4
+  - Status fields: slots_used_by
+"""
+import Web.modules.database.settings as cfg
+import Web.modules.inventarsystem.data_protection as dp
+from Web.modules.database.settings import MongoClient
+from bson.objectid import ObjectId
+import datetime 
+import ast
+
+
+def _get_tenant_db(client):
+    try:
+        from tenant import get_tenant_db
+        return get_tenant_db(client)
+    except Exception:
+        return client[cfg.MONGODB_DB]
+
+def _active_record_query(extra_query=None):
+    """Build a query that excludes logically deleted records."""
+    base_query = {'Deleted': {'$ne': True}}
+    if extra_query:
+        base_query.update(extra_query)
+    return base_query
+
+def _decrypt_appointment(item):
+    """Helper function to safely decrypt appointment fields back to their original types."""
+    if not item:
+        return item
+    
+    try:
+        if 'user' in item and item['user']:
+            item['user'] = dp.decrypt_text(item['user'])
+        
+        if 'note' in item and item['note']:
+            item['note'] = dp.decrypt_text(item['note'])
+            
+        if 'title' in item and item['title']:
+            item['title'] = dp.decrypt_text(item['title'])
+            
+        if 'mail' in item and item['mail']:
+            decrypted_mail = dp.decrypt_text(item['mail'])
+            try:
+                item['mail'] = ast.literal_eval(decrypted_mail)
+            except Exception:
+                item['mail'] = decrypted_mail
+
+        if 'custom_fields' in item and item['custom_fields']:
+            item['custom_fields'] = [dp.decrypt_text(field) for field in item['custom_fields']]
+
+        if 'slots_booked' in item and item['slots_booked']:
+            # If it's a string, it was encrypted during an update execution
+            if isinstance(item['slots_booked'], str):
+                decrypted_slots = dp.decrypt_text(item['slots_booked'])
+                try:
+                    item['slots_booked'] = ast.literal_eval(decrypted_slots)
+                except Exception:
+                    item['slots_booked'] = decrypted_slots
+    except Exception as e:
+        print(f"Error during decryption: {e}")
+        
+    return item
+
+
+def add(date_start: str, date_end: str, time_span: list, slots: int, slot_lenght: int, user: str, mail: list=[], note:str="", calendar_enabled: bool=False, title: str="", custom_fields: list = (), clients_p_slot: int=1):
+    client = None
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = _get_tenant_db(client)
+        items = db['appointments']
+
+        item = {
+            'date_start': date_start,
+            'date_end': date_end,
+            'time_span': time_span,
+            'slots': slots,
+            'slot_lenght': slot_lenght,
+            'user': dp.encrypt_text(user.strip()),
+            'mail': dp.encrypt_text(str(mail)),
+            'note': dp.encrypt_text(note),
+            'title': dp.encrypt_text(title),
+            'custom_fields': [dp.encrypt_text(str(field)) for field in custom_fields],
+            'calendar_enabled': bool(calendar_enabled),
+            'clients_per_slot': clients_p_slot,
+            'slots_booked': [],  # -> [(start_time, (names),(custom1, custom2,...)), ...]the list gets there indexes as the slot 1-defined so is can be counted without an extra variable
+            'Created': datetime.datetime.now(),
+            'LastUpdated': datetime.datetime.now()
+        }
+        result = items.insert_one(item)
+        return result.inserted_id
+    except Exception as e:
+        print(f"Exception occurred in add: {e}")
+        return None
+    finally:
+        if client:
+            client.close()
+
+def get_item(id):
+    """Retrieve a specific appointment by its ID and decrypt it."""
+    client = None
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = _get_tenant_db(client)
+        items = db['appointments']
+        item = items.find_one(_active_record_query({'_id': ObjectId(id)}))
+        
+        return _decrypt_appointment(item)
+    except Exception as e:
+        print(f"Error retrieving item: {e}")
+        return None
+    finally:
+        if client:
+            client.close()
+
+def update(id, slots_used: list):
+    """Update an existing appointment's booked slots securely."""
+    client = None
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = _get_tenant_db(client)
+        items = db['appointments']
+
+        update_data = {
+            'slots_booked': dp.encrypt_text(str(slots_used)),
+            'LastUpdated': datetime.datetime.now()
+        }
+
+        result = items.update_one(
+            {'_id': ObjectId(id)},
+            {'$set': update_data}
+        )
+
+        return result.modified_count > 0
+    except Exception as e:
+        print(f"Error updating item: {e}")
+        return False
+    finally:
+        if client:
+            client.close()
+
+def remove_slot(id, date_start_time, name):
+    """
+    Remove a booked slot from an appointment's encrypted `slots_booked` list.
+    
+    Because the array is stored as an encrypted string blob, we must decrypt, 
+    modify it in Python, and re-encrypt it.
+    """
+    client = None
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = _get_tenant_db(client)
+        items = db['appointments']
+
+        item = items.find_one({'_id': ObjectId(id)})
+        if not item or 'slots_booked' not in item or not item['slots_booked']:
+            return False
+
+        try:
+            decrypted_slots = dp.decrypt_text(item['slots_booked'])
+            slots_list = ast.literal_eval(decrypted_slots)
+        except Exception as e:
+            print(f"Failed to decrypt or parse slots: {e}")
+            return False
+
+        # Structure format note: [(start_time, (names), (custom1, custom2...)), ...]
+        updated_slots = []
+        removed_any = False
+        
+        for slot in slots_list:
+            slot_start = slot[0]
+            slot_names = slot[1]
+            
+
+            if slot_start == date_start_time and (slot_names == name or name in slot_names):
+                removed_any = True
+                continue 
+            updated_slots.append(slot)
+
+        if not removed_any:
+            return False 
+
+        result = items.update_one(
+            {'_id': ObjectId(id)},
+            {
+                '$set': {
+                    'slots_booked': dp.encrypt_text(str(updated_slots)),
+                    'LastUpdated': datetime.datetime.now()
+                }
+            }
+        )
+
+        return result.modified_count > 0
+    except Exception as e:
+        print(f"Error removing slot: {e}")
+        return False
+    finally:
+        if client:
+            client.close()
+
+
+def remove(id):
+    """
+    Hard-delete an appointment plan by its ID.
+    (Note: If your docstring mentions a soft-delete 'Deleted' flag, 
+    change items.delete_one to items.update_one with {'$set': {'Deleted': True}})
+    """
+    client = None
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = _get_tenant_db(client)
+        items = db['appointments']
+
+        result = items.delete_one({'_id': ObjectId(id)})
+
+        return result.deleted_count > 0
+    except Exception as e:
+        print(f"Error removing appointment: {e}")
+        return False
+    finally:
+        if client:
+            client.close()
+
+
+def remove_done():
+    """Remove all expired appointments whose end date is prior to today in a single call."""
+    client = None
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = _get_tenant_db(client)
+        items = db['appointments']
+
+        today = datetime.date.today().strftime('%Y-%m-%d')
+
+        result = items.delete_many(
+            _active_record_query(
+                {
+                    'date_end': {'$lt': today},
+                }
+            )
+        )
+
+        return result.deleted_count > 0
+    except Exception as e:
+        print(f"Error cleaning up finished appointments: {e}")
+        return False
+    finally:
+        if client:
+            client.close()
+
+
+def get_upcoming_for_user(user: str, limit: int = 25):
+    """
+    Return upcoming appointment plans for a user, handling encrypted database records.
+    """
+    try:
+        if hasattr(globals(), 'remove_done'):
+            remove_done()
+    except Exception:
+        pass
+
+    client = None
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        db = _get_tenant_db(client)
+        items = db['appointments']
+
+        today = datetime.date.today().strftime('%Y-%m-%d')
+        target_user = str(user or '').strip()
+
+        cursor = items.find(
+            _active_record_query({
+                'date_end': {'$gte': today},
+            })
+        ).sort('date_start', 1)
+
+        results = []
+        for item in cursor:
+            decrypted_item = _decrypt_appointment(item)
+            if not decrypted_item:
+                continue
+
+            if decrypted_item.get('user', '').strip() != target_user:
+                continue
+
+            decrypted_item['_id'] = str(decrypted_item.get('_id'))
+            results.append(decrypted_item)
+            
+            if len(results) >= max(1, int(limit)):
+                break
+
+        return results
+    except Exception as e:
+        print(f"Error retrieving upcoming appointments: {e}")
+        return []
+    finally:
+        if client:
+            client.close()
+

Web/modules/database/user.py

@@ -20,6 +20,8 @@ import string
 from bson.objectid import ObjectId
 import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
+import hmac
+import os
 
 logger = logging.getLogger('app')
 logger.setLevel(logging.DEBUG)
@@ -430,103 +432,84 @@ def check_password_strength(password):
     return True
 
 
-def hashing(password):
+def hashing(password, salt=None):
     """
-    Hash a password using SHA-512.
+    Hasht ein Passwort mit scrypt. 
+    - Wenn kein Salt übergeben wird, wird ein sicherer, zufälliger Salt generiert (für neue Passwörter).
+    - Format für neue Hashes: v1$<salt_hex>$<hash_hex>
+    """
+    password_bytes = password.encode('utf-8') # Explizit UTF-8 für Plattformunabhängigkeit
     
-    Args:
-        password (str): Password to hash
-        
-    Returns:
-        str: Hexadecimal digest of the hashed password
+    if salt is None:
+        # Neuer Benutzer / Passwortänderung -> Dynamischer Salt
+        random_salt = os.urandom(16)
+        hashed = hashlib.scrypt(password_bytes, salt=random_salt, n=16384, r=8, p=1)
+        return f"v1${random_salt.hex()}${hashed.hex()}"
+    else:
+        # Bestehender Benutzer (wird zur Verifizierung aufgerufen)
+        hashed = hashlib.scrypt(password_bytes, salt=salt, n=16384, r=8, p=1)
+        return hashed.hex()
+
+
+def verify_password(provided_password, stored_password_string):
     """
-    return hashlib.sha512(password.encode()).hexdigest()
+    Verifiziert ein Passwort gegen einen gespeicherten Hash-String.
+    Unterstützt das alte Format (statischer Salt) und das neue Format (v1$...).
+    """
+    if not stored_password_string:
+        return False
+
+    # Überprüfung für das neue, sichere Format
+    if stored_password_string.startswith("v1$"):
+        try:
+            _, salt_hex, hash_hex = stored_password_string.split("$")
+            salt_bytes = bytes.fromhex(salt_hex)
+            # Berechne den Hash des eingegebenen Passworts mit dem extrahierten Salt
+            calculated_hash = hashing(provided_password, salt=salt_bytes)
+            # Timing-Attack-sicherer Vergleich
+            return hmac.compare_digest(calculated_hash, hash_hex)
+        except (ValueError, TypeError):
+            logger.error("Ungültiges Hash-Format in der Datenbank entdeckt.")
+            return False
+    else:
+        # Abwärtskompatibilität: Altes Format mit statischem Salt b'some_salt'
+        old_static_salt = b'some_salt'
+        calculated_hash = hashing(provided_password, salt=old_static_salt)
+        return hmac.compare_digest(calculated_hash, stored_password_string)
 
 
 def check_nm_pwd(username, password):
     """
-    Verify username and password combination.
-    
-    Args:
-        username (str): Username to check
-        password (str): Password to verify
-        
-    Returns:
-        dict: User document if credentials are valid, None otherwise
+    Überprüft die Kombination aus Benutzername und Passwort (optimiert).
     """
     db_name, tenant_id = _resolve_request_tenant_db()
-    ctx = None
-    try:
-        from tenant import get_tenant_context
-        ctx = get_tenant_context()
-    except Exception:
-        ctx = None
-
     if not db_name:
         if _has_tenant_configs():
-            logger.warning(
-                "Refusing default DB fallback for login because tenant configs exist and no tenant was resolved."
-            )
+            logger.warning("Default DB fallback verweigert, da Tenant-Konfigurationen existieren.")
             return None
         db_name = cfg.MONGODB_DB
 
-    logger.info(
-        "check_nm_pwd start: username=%r tenant=%r db=%r host=%r port=%r uri=%r",
-        username,
-        tenant_id,
-        db_name,
-        cfg.MONGODB_HOST,
-        cfg.MONGODB_PORT,
-        getattr(cfg, 'MONGODB_URI', None),
-    )
-
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     try:
-        hashed_password = hashing(password)
-        logger.info("check_nm_pwd password hash for username=%r: %s", username, hashed_password)
-        available_dbs = []
-        try:
-            available_dbs = client.list_database_names()
-            logger.debug("MongoDB connected. Available databases=%s", available_dbs)
-        except Exception as exc:
-            logger.exception("Unable to list MongoDB databases: %s", exc)
-
         db = client[db_name]
-        try:
-            existing_collections = db.list_collection_names()
-        except Exception as exc:
-            logger.exception("Unable to list collections for db=%r: %s", db_name, exc)
-            existing_collections = []
-        logger.debug("Tenant db=%r collections=%s", db_name, existing_collections)
-
         users = db['users']
+        
         query = {'$or': [{'Username': username}, {'username': username}]}
-        logger.debug("Running user lookup on %r: %s", db_name, query)
         user_record = users.find_one(query)
 
         if user_record is None:
-            logger.warning("No user document found in db=%r for username=%r", db_name, username)
-            if db_name not in available_dbs:
-                logger.warning("Tenant database %r is missing from available MongoDB databases", db_name)
-            if 'users' not in existing_collections:
-                logger.warning("Tenant database %r has no users collection", db_name)
+            logger.warning("Kein Benutzer für %r in DB %r gefunden.", username, db_name)
             return None
 
-        logger.info("Found user document for username=%r in db=%r: %s", username, db_name, user_record)
         stored_password = user_record.get('Password') or user_record.get('password')
-        if stored_password is None:
-            logger.warning("User document for username=%r in db=%r has no password field", username, db_name)
+        
+        if not verify_password(password, stored_password):
+            logger.warning("Falsches Passwort für Benutzer %r in DB %r.", username, db_name)
             return None
 
-        if stored_password != hashed_password:
-            logger.warning(
-                "Password mismatch for username=%r in db=%r: provided_hash=%s stored_hash=%s",
-                username,
-                db_name,
-                hashed_password,
-                stored_password,
-            )
-            return None
+        # Automatische Migration alter Hashes auf das neue Format
+        if not stored_password.startswith("v1$"):
+            users.update_one({'_id': user_record['_id']}, {'$set': {'Password': hashing(password)}})
 
         return user_record
     finally:
@@ -556,44 +539,46 @@ def add_user(
         bool: True if user was added successfully, False if password was too weak
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = _get_tenant_db(client)
-    users = db['users']
-    if not check_password_strength(password):
-        return False
-    permission_defaults = build_default_permission_payload(permission_preset)
-    if isinstance(action_permissions, dict):
-        for key, value in action_permissions.items():
-            permission_defaults['actions'][str(key)] = bool(value)
-    if isinstance(page_permissions, dict):
-        for key, value in page_permissions.items():
-            permission_defaults['pages'][str(key)] = bool(value)
+    try:
+        db = _get_tenant_db(client)
+        users = db['users']
+        if not check_password_strength(password):
+            return False
+        permission_defaults = build_default_permission_payload(permission_preset)
+        if isinstance(action_permissions, dict):
+            for key, value in action_permissions.items():
+                permission_defaults['actions'][str(key)] = bool(value)
+        if isinstance(page_permissions, dict):
+            for key, value in page_permissions.items():
+                permission_defaults['pages'][str(key)] = bool(value)
 
-    user_doc = {
-        'Username': username,
-        'Password': hashing(password),
-        'Admin': False,
-        'active_ausleihung': None,
-        'name': name.strip() if name else '',
-        'last_name': last_name.strip() if last_name else '',
-        'IsStudent': bool(is_student),
-        'PermissionPreset': permission_defaults['preset'],
-        'ActionPermissions': permission_defaults['actions'],
-        'PagePermissions': permission_defaults['pages'],
-    }
+        user_doc = {
+            'Username': username,
+            'Password': hashing(password),
+            'Admin': False,
+            'active_ausleihung': None,
+            'name': name.strip() if name else '',
+            'last_name': last_name.strip() if last_name else '',
+            'IsStudent': bool(is_student),
+            'PermissionPreset': permission_defaults['preset'],
+            'ActionPermissions': permission_defaults['actions'],
+            'PagePermissions': permission_defaults['pages'],
+        }
 
-    normalized_card = normalize_student_card_id(student_card_id)
-    if bool(is_student):
-        if normalized_card:
-            user_doc['StudentCardId'] = normalized_card
-        if max_borrow_days is not None:
-            try:
-                user_doc['MaxBorrowDays'] = int(max_borrow_days)
-            except (TypeError, ValueError):
-                pass
+        normalized_card = normalize_student_card_id(student_card_id)
+        if bool(is_student):
+            if normalized_card:
+                user_doc['StudentCardId'] = normalized_card
+            if max_borrow_days is not None:
+                try:
+                    user_doc['MaxBorrowDays'] = int(max_borrow_days)
+                except (TypeError, ValueError):
+                    pass
 
-    users.insert_one(user_doc)
-    client.close()
-    return True
+        users.insert_one(user_doc)
+        return True
+    finally:
+        client.close()
 
 
 def student_card_exists(student_card_id):

Web/modules/emailservice/email.py

@@ -0,0 +1,51 @@
+from email.mime.text import MIMEText
+from email.mime.multipart import MIMEMultipart
+from modules.module_registry import ModuleRegistry as mr
+import smtplib
+
+import Web.modules.database.settings as cfg
+
+
+def _build_smtp_client():
+    smtp = smtplib.SMTP(cfg.EMAIL_SMTP_HOST, cfg.EMAIL_SMTP_PORT, timeout=cfg.EMAIL_TIMEOUT_SECONDS)
+    smtp.ehlo()
+    if cfg.EMAIL_USE_TLS:
+        smtp.starttls()
+        smtp.ehlo()
+    if cfg.EMAIL_USERNAME:
+        smtp.login(cfg.EMAIL_USERNAME, cfg.EMAIL_PASSWORD or '')
+    return smtp
+
+def send(email: list, subject: str, note: str, sender: str) -> bool:
+  """
+  Sends the email with the link to the Clients
+
+  Input:
+  - email: Email list of all the addresses to send the link to ["","",""]
+  - subject: Subject of the email
+  - note: Note that is send with the Emails
+
+  Output:
+  - bool: true if the sending worked and false if it didnt
+  """
+  if not mr.registry.is_enabled('mail'):
+    return False
+  else:
+    msg = MIMEMultipart()
+    msg['Subject'] = subject
+    msg['From'] = sender or cfg.EMAIL_FROM_ADDRESS or cfg.EMAIL_USERNAME
+    msg['To'] = ', '.join(email) if isinstance(email, (list, tuple)) else str(email)
+    msg.attach(MIMEText(note))
+    smtp = None
+    try:
+      smtp = _build_smtp_client()
+      smtp.sendmail(from_addr=msg['From'], to_addrs=email, msg=msg.as_string())
+      return True
+    except Exception:
+      return False
+    finally:
+      try:
+        if smtp:
+          smtp.quit()
+      except Exception:
+        pass

Web/modules/log/audit_log.py

@@ -10,6 +10,7 @@ import hashlib
 import json
 import random
 import time
+from Web.modules.inventarsystem.data_protection import encrypt_document_fields, decrypt_document_fields
 
 from pymongo.errors import DuplicateKeyError
 
@@ -24,21 +25,34 @@ def _entry_hash(prev_hash, payload):
     base = f"{prev_hash}|{_stable_json(payload)}"
     return hashlib.sha256(base.encode("utf-8")).hexdigest()
 
-
-def append_audit_event(db, event_type, actor, payload, request_ip=None, source="web", max_retries=5):
+def get_decrypted_audit_logs(db, query=None, decrypt_fields=None):
     """
-    Append an audit event to a tamper-evident chain.
-
+    Retrieve and decrypt audit logs for analysis.
+    
     Args:
-        db: MongoDB database handle.
-        event_type (str): Event category.
-        actor (str): User/system who performed the action.
-        payload (dict): Event details.
-        request_ip (str, optional): Request origin.
-        source (str): Source subsystem.
+        query (dict): MongoDB query filter.
+        decrypt_fields (list): Fields within the 'payload' that should be decrypted.
+    """
+    logs = db["audit_log"]
+    cursor = logs.find(query or {}).sort("chain_index", 1)
+    
+    results = []
+    for entry in cursor:
+        # Decrypt specific fields if provided
+        if decrypt_fields:
+            decrypt_document_fields(entry.get("payload", {}), decrypt_fields)
+        results.append(entry)
+        
+    return results
 
-    Returns:
-        dict: Inserted audit entry.
+
+def append_audit_event(db, event_type, actor, payload, request_ip=None, source="web", max_retries=5, encrypt_fields=None):
+    """
+    Append an audit event, optionally encrypting specific payload fields.
+    
+    Args:
+        ...
+        encrypt_fields (list, optional): List of keys in 'payload' to encrypt.
     """
     logs = db["audit_log"]
     attempts = 0
@@ -49,15 +63,24 @@ def append_audit_event(db, event_type, actor, payload, request_ip=None, source="
         chain_index = int(previous.get("chain_index", 0)) + 1 if previous else 1
 
         timestamp = datetime.datetime.utcnow()
+        
+        # 1. Create the payload dictionary
+        event_payload = payload or {}
+        
+        # 2. Encrypt sensitive fields in-place if requested
+        if encrypt_fields:
+            encrypt_document_fields(event_payload, encrypt_fields)
+
         entry_payload = {
             "event_type": event_type,
             "actor": actor or "system",
             "source": source,
             "ip": request_ip or "",
-            "payload": payload or {},
+            "payload": event_payload,
             "timestamp": timestamp.isoformat() + "Z",
         }
 
+        # 3. Hash the payload (which now contains encrypted values)
         entry_hash = _entry_hash(prev_hash, entry_payload)
 
         entry = {

Web/modules/log/ausleihung_log.py

@@ -21,7 +21,7 @@ def log_status_change(ausleihung_id, old_status, new_status, user=None):
         ausleihung_id: Die ID der Ausleihung
         old_status: Der alte Status
         new_status: Der neue Status
-        user: Der Benutzer, der die Änderung vorgenommen hat (optional)
+
     """
     try:
         # Erstelle Log-Verzeichnis, falls es nicht existiert
@@ -34,10 +34,9 @@ def log_status_change(ausleihung_id, old_status, new_status, user=None):
         
         # Protokolliere die Änderung
         timestamp = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
-        user_info = f" by {user}" if user else ""
         
         with open(log_file, 'a', encoding='utf-8') as f:
-            f.write(f"{timestamp}: Ausleihung {ausleihung_id} - Status changed from '{old_status}' to '{new_status}'{user_info}\n")
+            f.write(f"{timestamp}: Ausleihung {ausleihung_id} - Status changed from '{old_status}' to '{new_status}'\n")
             
         return True
     except Exception as e:

Web/modules/terminplaner/__init__.py

@@ -1 +1 @@
-print("hello")
+# Web.modules package initialization

Web/modules/terminplaner/backend_server.py

@@ -0,0 +1,462 @@
+"""
+Class for all funktions of the executive -> Lehrer
+"""
+import datetime
+from datetime import timedelta
+from flask import url_for, has_request_context, request
+import Web.modules.emailservice.email as mail_service
+import Web.modules.database.termine as termin
+import Web.modules.database.settings as cfg
+from Web.tenant import get_tenant_context
+import Web.modules.inventarsystem.data_protection as dp
+
+
+def _resolve_public_base_url() -> str:
+    if has_request_context():
+        try:
+            return request.url_root.rstrip('/')
+        except Exception:
+            pass
+
+    tenant_context = get_tenant_context()
+    subdomain = ''
+    if tenant_context:
+        subdomain = getattr(tenant_context, 'subdomain', '') or getattr(tenant_context, 'tenant_id', '') or ''
+    return f"https://{subdomain}.invario.eu" if subdomain else "https://invario.eu"
+
+
+def _current_tenant_id() -> str:
+    tenant_context = get_tenant_context()
+    if tenant_context and getattr(tenant_context, 'tenant_id', None):
+        return str(tenant_context.tenant_id)
+    if has_request_context():
+        try:
+            return str(request.args.get('tenant', '') or request.args.get('tenant_id', '') or '').strip()
+        except Exception:
+            return ''
+    return ''
+
+
+def _normalize_time_span(time_span):
+    if isinstance(time_span, list):
+        return [str(entry).strip() for entry in time_span if str(entry).strip()]
+    if isinstance(time_span, tuple):
+        return [str(entry).strip() for entry in time_span if str(entry).strip()]
+    if isinstance(time_span, str):
+        normalized = []
+        for line in time_span.replace(';', '\n').replace(',', '\n').splitlines():
+            value = line.strip()
+            if value:
+                normalized.append(value)
+        return normalized
+    return []
+
+
+def _normalize_mail_list(mail):
+    if isinstance(mail, list):
+        return [str(entry).strip() for entry in mail if str(entry).strip()]
+    if isinstance(mail, tuple):
+        return [str(entry).strip() for entry in mail if str(entry).strip()]
+    if isinstance(mail, str):
+        return [entry.strip() for entry in mail.replace(';', ',').split(',') if entry.strip()]
+    return []
+
+def _escape_ics_text(value):
+    return str(value or '').replace('\\', '\\\\').replace(';', '\\;').replace(',', '\\,').replace('\r\n', '\n').replace('\n', '\\n').replace('\r', '')
+
+
+def _format_ics_date(date_value):
+    if isinstance(date_value, datetime.datetime):
+        return date_value.strftime('%Y%m%dT%H%M%SZ')
+    if isinstance(date_value, datetime.date):
+        return date_value.strftime('%Y%m%d')
+    return ''
+
+
+def build_calendar_ics(appointment_id: str) -> str | None:
+    item = termin.get_item(appointment_id)
+    if not item:
+        return None
+
+    date_start = item.get('date_start')
+    date_end = item.get('date_end')
+    time_span = item.get('time_span', []) or []
+    creator = item.get('user', 'Terminplaner')
+    note = item.get('note', '') or ''
+    titel = item.get('title', '') or ''
+    tenant_id = _current_tenant_id()
+    try:
+        link = url_for('terminplaner.client', appointment_id=str(appointment_id), tenant=tenant_id or None, _external=True)
+    except Exception:
+        host = _resolve_public_base_url()
+        link = host + "/terminplaner/client/" + str(appointment_id)
+        if tenant_id:
+            link += f"?tenant={tenant_id}"
+
+    try:
+        start_date = datetime.datetime.strptime(str(date_start), '%Y-%m-%d').date()
+        end_date = datetime.datetime.strptime(str(date_end), '%Y-%m-%d').date()
+    except Exception:
+        return None
+
+    uid = f"terminplaner-{appointment_id}@invario.eu"
+    
+    created_at = datetime.datetime.now(datetime.timezone.utc).strftime('%Y%m%dT%H%M%SZ')
+    
+    summary = titel if titel else f"Terminplan für {creator}"
+    
+    description_lines = [
+        f"Buchungslink: {link}",
+        f"Zeitraum: {date_start} bis {date_end}",
+    ]
+    if time_span:
+        description_lines.append('Zeitfenster: ' + '; '.join(str(entry) for entry in time_span))
+    if note:
+        description_lines.append('Notiz: ' + str(note))
+    if titel and not summary == titel: 
+        description_lines.append('Titel: ' + str(titel))
+
+    ics_lines = [
+        'BEGIN:VCALENDAR',
+        'VERSION:2.0',
+        'PRODID:-//Inventarsystem//Terminplaner//DE',
+        'CALSCALE:GREGORIAN',
+        'METHOD:PUBLISH',
+        'BEGIN:VEVENT',
+        f'UID:{uid}',
+        f'DTSTAMP:{created_at}',
+        f'SUMMARY:{_escape_ics_text(summary)}',
+        f'DESCRIPTION:{_escape_ics_text(chr(10).join(description_lines))}',
+        f'URL:{_escape_ics_text(link)}',
+        f'DTSTART;VALUE=DATE:{_format_ics_date(start_date)}',
+        f'DTEND;VALUE=DATE:{_format_ics_date(end_date + datetime.timedelta(days=1))}',
+        'END:VEVENT',
+        'END:VCALENDAR',
+        '',
+    ]
+    return '\r\n'.join(ics_lines)
+
+
+def build_client_slot_ics(appointment_id: str, slot_start: str, client_name: str = '') -> str | None:
+    """Build a single-slot ICS export for a client booking candidate."""
+    item = termin.get_item(appointment_id)
+    if not item:
+        return None
+
+    try:
+        start_dt = datetime.datetime.strptime(str(slot_start).strip(), '%Y-%m-%d %H:%M')
+    except Exception:
+        return None
+
+    try:
+        slot_minutes = int(item.get('slot_length') or item.get('slot_lenght') or 0)
+    except Exception:
+        slot_minutes = 0
+        
+    if slot_minutes <= 0:
+        slot_minutes = 45
+
+    end_dt = start_dt + datetime.timedelta(minutes=slot_minutes)
+    tenant_id = _current_tenant_id()
+
+    try:
+        link = url_for('terminplaner.client', appointment_id=str(appointment_id), tenant=tenant_id or None, _external=True)
+    except Exception:
+        host = _resolve_public_base_url()
+        link = host + '/terminplaner/client/' + str(appointment_id)
+        if tenant_id:
+            link += f'?tenant={tenant_id}'
+
+    title_name = item.get('title') or f"Terminbuchung mit {client_name}" if client_name else "Terminbuchung"
+    summary = f"{title_name} - Terminbuchung"
+    description_lines = [
+        f"Buchungslink: {link}",
+        f"Geplanter Termin: {start_dt.strftime('%d.%m.%Y %H:%M')} - {end_dt.strftime('%H:%M')}",
+    ]
+
+    uid = f"terminplaner-slot-{appointment_id}-{start_dt.strftime('%Y%m%d%H%M')}@invario.eu"
+    created_at = datetime.datetime.now(datetime.timezone.utc).strftime('%Y%m%dT%H%M%SZ')
+    dt_start = start_dt.strftime('%Y%m%dT%H%M%S')
+    dt_end = end_dt.strftime('%Y%m%dT%H%M%S')
+
+    ics_lines = [
+        'BEGIN:VCALENDAR',
+        'VERSION:2.0',
+        'PRODID:-//Inventarsystem//Terminplaner Client Slot//DE',
+        'CALSCALE:GREGORIAN',
+        'METHOD:PUBLISH',
+        'BEGIN:VEVENT',
+        f'UID:{uid}',
+        f'DTSTAMP:{created_at}',
+        f'SUMMARY:{_escape_ics_text(summary)}',
+        f'DESCRIPTION:{_escape_ics_text(chr(10).join(description_lines))}',
+        f'URL:{_escape_ics_text(link)}',
+        f'DTSTART:{dt_start}',
+        f'DTEND:{dt_end}',
+        f'Titel:{_escape_ics_text(summary)}',
+        'END:VEVENT',
+        'END:VCALENDAR',
+        '',
+    ]
+    return '\r\n'.join(ics_lines)
+
+
+def new(date_start: str, date_end: str, time_span: list, slots, slot_length, user: str, mail: list=None, note:str="", calendar_enabled: bool=False, title: str="", custom_fields: list = (), clients_per_slot: int=1) -> dict:
+    """
+    Generates a link for the executive to send to his clients to book a time Slot
+    """
+    try:
+        slots_int = int(slots)
+    except (ValueError, TypeError):
+        slots_int = 0
+        
+    try:
+        custom_fields.pop(-1)
+    except :
+        pass
+
+    try:
+        slot_length_int = int(slot_length)
+    except (ValueError, TypeError):
+        slot_length_int = 45
+
+    normalized_time_span = _normalize_time_span(time_span)
+    normalized_mail = _normalize_mail_list(mail or [])
+    
+    id = termin.add(date_start, date_end, normalized_time_span, slots_int, slot_length_int, user, normalized_mail, note, calendar_enabled=calendar_enabled, title=title, custom_fields=custom_fields, clients_p_slot=clients_per_slot)
+    id_str = str(id)
+    tenant_id = _current_tenant_id()
+
+    try:
+        link = url_for('terminplaner.client', appointment_id=id_str, tenant=tenant_id or None, _external=True)
+    except Exception:
+        host = _resolve_public_base_url()
+        link = host + "/terminplaner/client/" + id_str
+        if tenant_id:
+            link += f"?tenant={tenant_id}"
+            
+    subject = f"{title} - Bitte Termin vereinbaren" if title else f"Terminanfrage von {user} - Bitte Termin vereinbaren"
+    note_link = note + f"Bitte klicken sie auf den folgenden Link um einen Termin zu vereinbaren: {link}"
+    calendar_link = None
+    
+    if calendar_enabled:
+        try:
+            calendar_link = url_for('terminplaner.calendar_export', appointment_id=id_str, tenant=tenant_id or None, _external=True)
+        except Exception:
+            host = _resolve_public_base_url()
+            calendar_link = host + "/terminplaner/calendar/" + id_str + ".ics"
+            if tenant_id:
+                calendar_link += f"?tenant={tenant_id}"
+
+    email_body = note_link
+    if calendar_link:
+        email_body += f"\n\nKalendereintrag: {calendar_link}"
+
+    if normalized_mail and cfg.EMAIL_ENABLED:
+        mail_service.send(normalized_mail, subject, email_body)
+
+    return {
+        'appointment_id': id_str,
+        'link': link,
+        'calendar_link': calendar_link,
+    }
+    
+        
+def book_slot(id, date_start_time, name, custom: tuple = ()):
+    try:
+        item = termin.get_item(id)
+        if not item:
+            return False
+
+        slots = item.get('slots_booked', []) or []
+        if not isinstance(slots, list):
+            slots = []
+
+        # 1. Check overall total booking capacity 
+        capacity = int(item.get('slots', 0) or 0)
+        if capacity and len(slots) >= capacity:
+            return False
+
+        # 2. Prevent the exact same user from double-booking the exact same slot
+        for existing in slots:
+            if isinstance(existing, (list, tuple)) and len(existing) >= 2:
+                if existing[0] == date_start_time and existing[1] == name:
+                    return False
+
+        # 3. Check concurrent capacity for this specific time slot
+        clients_per_slot = int(item.get('clients_per_slot', 1) or 1)
+        bookings_at_time = sum(
+            1 for existing in slots 
+            if isinstance(existing, (list, tuple)) and len(existing) > 0 and existing[0] == date_start_time
+        )
+        
+        if bookings_at_time >= clients_per_slot:
+            return False
+
+        # Append the new booking successfully
+        slots.append((date_start_time, name, custom))
+        success = termin.update(id, slots)
+        return bool(success)
+        
+    except Exception as e:
+        print(f"Error booking slot: {e}")
+        return False
+
+
+def remove_slot(id, date_start_time, name):
+    try:
+        if hasattr(termin, 'remove_slot'):
+            removed = termin.remove_slot(id, date_start_time, name)
+            if removed:
+                return True
+
+        item = termin.get_item(id)
+        if not item:
+            return False
+
+        slots = item.get('slots_booked', []) or []
+        new_slots = []
+        for s in slots:
+            try:
+                if isinstance(s, (list, tuple)) and len(s) >= 2 and s[0] == date_start_time and s[1] == name:
+                    continue
+            except Exception:
+                pass
+            new_slots.append(s)
+
+        success = termin.update(id, new_slots)
+        return bool(success)
+    except Exception as e:
+        print(f"Error removing slot: {e}")
+        return False
+
+
+def remove_appointment(id):
+    try:
+        return bool(termin.remove(id))
+    except Exception as e:
+        print(f"Error removing appointment: {e}")
+        return False
+
+def get_available(id):
+    try:
+        termin_range = termin.get_item(id)
+        if not termin_range:
+            return {}
+
+        date_start = termin_range.get('date_start')
+        date_end = termin_range.get('date_end')
+        time_span = termin_range.get('time_span', [])
+        
+        # Safe integer parsing without heavy try-except blocks
+        try:
+            total_slots = int(termin_range.get('slots', 0) or 0)
+        except (ValueError, TypeError):
+            total_slots = 0
+
+        # Support both spellings gracefully
+        raw_length = termin_range.get('slot_length') or termin_range.get('slot_lenght') or 0
+        try:
+            slot_length = int(raw_length)
+        except (ValueError, TypeError):
+            slot_length = raw_length
+
+        clients_per_slot = int(termin_range.get('clients_per_slot', 1) or 1)
+        booked = termin_range.get('slots_booked', []) or []
+
+        # Normalize the bookings list safely
+        normalized = []
+        bookings_by_time = {}  # Tracks how many people are in each specific time slot
+        
+        for s in booked:
+            if isinstance(s, (list, tuple)) and len(s) >= 2:
+                slot_time = s[0]
+                item = {'start': slot_time, 'name': s[1]}
+            elif isinstance(s, dict):
+                slot_time = s.get('start')
+                item = s
+            else:
+                slot_time = str(s)
+                item = {'value': s}
+                
+            normalized.append(item)
+            
+            # Count concurrent bookings per timestamp
+            if slot_time:
+                bookings_by_time[slot_time] = bookings_by_time.get(slot_time, 0) + 1
+
+        # Calculate remaining total capacity safely
+        slots_used = len(normalized)
+        slots_left = max(0, total_slots - slots_used)
+
+        return {
+            'date_start': date_start,
+            'date_end': date_end,
+            'time_span': time_span,
+            'slot_length': slot_length,
+            'slot_lenght': slot_length,
+            'slots_total': total_slots,
+            'clients_per_slot': clients_per_slot,
+            'slots_booked': normalized,
+            'slots_left': slots_left,
+            'bookings_by_time': bookings_by_time
+        }
+    except Exception as e:
+        print(f"Error getting available slots: {e}")
+        return {}
+
+def get_available_user(id):
+    return get_available(id)
+
+def get_user_upcoming_events(user: str, limit: int = 25) -> list[dict]:
+    user_name = str(user or '').strip()
+    if not user_name:
+        return []
+
+    appointments = termin.get_upcoming_for_user(user_name, limit=limit)
+    host = _resolve_public_base_url()
+    tenant_id = _current_tenant_id()
+
+    result = []
+    for item in appointments:
+        appointment_id = str(item.get('_id') or '')
+        if not appointment_id:
+            continue
+
+        try:
+            link = url_for('terminplaner.client', appointment_id=appointment_id, tenant=tenant_id or None, _external=True)
+        except Exception:
+            link = host + '/terminplaner/client/' + appointment_id
+            if tenant_id:
+                link += f'?tenant={tenant_id}'
+
+        try:
+            calendar_link = url_for('terminplaner.calendar_export', appointment_id=appointment_id, tenant=tenant_id or None, _external=True)
+        except Exception:
+            calendar_link = host + '/terminplaner/calendar/' + appointment_id + '.ics'
+            if tenant_id:
+                calendar_link += f'?tenant={tenant_id}'
+
+        slots_total = int(item.get('slots', 0) or 0)
+        slots_booked = item.get('slots_booked', []) or []
+        if not isinstance(slots_booked, list):
+            slots_booked = []
+
+        result.append(
+            {
+                'appointment_id': appointment_id,
+                'date_start': str(item.get('date_start') or ''),
+                'date_end': str(item.get('date_end') or ''),
+                'time_span': item.get('time_span', []) or [],
+                'slots_total': slots_total,
+                'slots_booked': len(slots_booked),
+                'slots_left': max(0, slots_total - len(slots_booked)),
+                'note': str(item.get('note') or ''),
+                'link': link,
+                'calendar_link': calendar_link if item.get('calendar_enabled') else None,
+                'title': str(item.get('title') or ''),
+                'custom_fields': list(item.get('custom_fields')),
+            }
+        )
+
+    return result

Web/modules/terminplaner/blueprint.py

@@ -0,0 +1,561 @@
+from flask import Blueprint, render_template, request, session, url_for, redirect, flash, make_response, Response, send_file
+import Web.modules.terminplaner.backend_server as appointment_service
+import Web.modules.database.settings as cfg
+import Web.modules.database.termine as termin
+import Web.modules.database.user as us
+from Web.modules.terminplaner.backend_server import _resolve_public_base_url
+import csv
+import io
+import qrcode
+import os
+import tempfile
+from reportlab.lib.pagesizes import A4
+from reportlab.lib.styles import getSampleStyleSheet, ParagraphStyle
+from reportlab.lib.units import cm
+from reportlab.lib.colors import grey, HexColor
+from reportlab.platypus import SimpleDocTemplate, Paragraph, Spacer, Image
+
+
+# Create a blueprint instance
+appoint_bp = Blueprint('terminplaner', __name__)
+
+
+def _get_school_info_for_export():
+    """
+    Get school information for PDF exports from configuration or database.
+    Returns default info if not configured.
+    """
+    try:
+        if hasattr(cfg, 'get_school_info'):
+            return cfg.get_school_info()
+
+        school_info = {
+            'name': 'Schulname',
+            'address': 'Schuladresse',
+            'postal_code': 'PLZ',
+            'city': 'Stadt',
+            'school_number': '000000',
+            'it_admin': 'IT-Beauftragter/in',
+            'logo_path': '',
+        }
+        return school_info
+    except Exception:
+        # Return defaults if anything fails
+        return {
+            'name': 'Schulname',
+            'address': 'Schuladresse', 
+            'postal_code': 'PLZ',
+            'city': 'Stadt',
+            'school_number': '000000',
+            'it_admin': 'IT-Beauftragter/in',
+            'logo_path': '',
+        }
+
+
+def _require_module_enabled():
+    if not cfg.MODULES.is_enabled('terminplan'):
+        flash('Der Terminplaner ist deaktiviert.', 'info')
+        return redirect(url_for('home'))
+    return None
+
+
+def _appointment_not_found_response():
+    return render_template(
+        'terminplaner_not_found.html',
+        error_code=404,
+        error_message='Der Termin wurde nicht gefunden.',
+    ), 404
+
+
+def _current_tenant_id():
+    try:
+        from Web.tenant import get_tenant_context
+        ctx = get_tenant_context()
+        if ctx and getattr(ctx, 'tenant_id', None):
+            return str(ctx.tenant_id)
+    except Exception:
+        pass
+    return str(session.get('tenant_id', '') or '').strip()
+
+@appoint_bp.route('/client/<appointment_id>/export_csv')
+def export_csv(appointment_id):
+    """
+    Generiert einen CSV-Export aller Buchungen für den Ersteller.
+    """
+    # 1. Berechtigungsprüfung (analog zur Client-Route)
+    current_user = str(session.get('username', '') or '').strip()
+    appointment_item = termin.get_item(appointment_id) or {}
+    appointment_owner = str(appointment_item.get('user', '') or '').strip()
+    
+    can_view = False
+    if current_user:
+        try:
+            can_view = bool(us.check_admin(current_user) or current_user == appointment_owner)
+        except Exception:
+            can_view = bool(current_user == appointment_owner)
+            
+    if not can_view:
+        flash('Nicht autorisiert für diesen Export.', 'error')
+        return redirect(url_for('terminplaner.client', appointment_id=appointment_id))
+
+    custom_fields = appointment_item.get('custom_fields', [])
+    bookings = appointment_item.get('slots_booked', []) or []
+
+    # 2. CSV im Speicher erstellen
+    si = io.StringIO()
+    # Wir nutzen ein Semikolon als Trennzeichen – das öffnet Excel im deutschsprachigen Raum direkt fehlerfrei
+    cw = csv.writer(si, delimiter=';', quoting=csv.QUOTE_MINIMAL)
+    
+    # Tabellenkopf schreiben
+    headers = ['Zeitpunkt', 'Name'] + list(custom_fields)
+    cw.writerow(headers)
+    
+    # Datenzeilen schreiben
+    for booking in bookings:
+        if isinstance(booking, (list, tuple)):
+            row = [booking[0], booking[1]]
+            
+            # Antworten holen und sicherstellen, dass Lücken (falls vorhanden) mit Leerstrings gefüllt werden
+            answers = booking[2] if len(booking) > 2 else []
+            for i in range(len(custom_fields)):
+                if i < len(answers):
+                    row.append(answers[i])
+                else:
+                    row.append('')
+            cw.writerow(row)
+
+    # 3. Response vorbereiten und UTF-8-BOM für Excel mitsenden
+    response_content = si.getvalue()
+    output = make_response(response_content)
+    
+    output.data = b'\xef\xbb\xbf' + output.data
+    
+    # Dateiname generieren
+    title_slug = appointment_item.get('title', 'export').replace(' ', '_')
+    output.headers["Content-Disposition"] = f"attachment; filename=buchungen_{title_slug}.csv"
+    output.headers["Content-Type"] = "text/csv; charset=utf-8"
+    
+    return output
+
+@appoint_bp.route('/client/<appointment_id>', methods=['POST', 'GET'])
+def client(appointment_id):
+    """
+    The Route for the terminplaner to work with the client and allow owners to manage it.
+    """
+    guard = _require_module_enabled()
+    if guard:
+        return guard
+
+    available = appointment_service.get_available(appointment_id)
+    if not available:
+        return _appointment_not_found_response()
+
+    current_user = str(session.get('username', '') or '').strip()
+    appointment_item = termin.get_item(appointment_id) or {}
+    appointment_owner = str(appointment_item.get('user', '') or '').strip()
+    
+    custom_fields = appointment_item.get('custom_fields', [])
+
+    # Permissions check
+    can_view_booking_names = False
+    if current_user:
+        try:
+            can_view_booking_names = bool(us.check_admin(current_user) or current_user == appointment_owner)
+        except Exception:
+            can_view_booking_names = bool(current_user == appointment_owner)
+
+    # Sanitize data for public/client view
+    available_for_view = dict(available)
+    if not can_view_booking_names:
+        sanitized_bookings = []
+        for booking in (available.get('slots_booked') or []):
+            if isinstance(booking, dict):
+                sanitized_bookings.append({'start': booking.get('start', '')})
+            elif isinstance(booking, (list, tuple)) and len(booking) >= 1:
+                sanitized_bookings.append({'start': booking[0]})
+            else:
+                sanitized_bookings.append({'start': ''})
+        available_for_view['slots_booked'] = sanitized_bookings
+
+    if request.method == 'POST':
+        action = request.form.get('action', 'book')
+
+        # Case 1: Admin/Owner cancels a booking
+        if action == 'delete' and can_view_booking_names:
+            slot_time = request.form.get('slot_time')
+            client_name = request.form.get('target_client_name')
+            
+            current_slots = appointment_item.get('slots_booked', []) or []
+            
+            # Keep everything EXCEPT the item targeted for deletion
+            updated_slots = [
+                slot for slot in current_slots 
+                if not (isinstance(slot, (list, tuple)) and slot[0] == slot_time and slot[1] == client_name)
+            ]
+            
+            if termin.update(appointment_id, updated_slots):
+                flash('Buchung wurde erfolgreich gelöscht.', 'success')
+            else:
+                flash('Fehler beim Löschen der Buchung.', 'error')
+                
+            return redirect(url_for('terminplaner.client', appointment_id=appointment_id, tenant=_current_tenant_id() or None))
+
+        # Case 2: Client books a slot
+        elif action == 'book':
+            start_daytime = request.form.get('start_day_time')
+            username = request.form.get('client_name')
+            custom_answers = tuple(request.form.getlist('custom_answers'))  # Cast to tuple for DB safety
+
+            if not start_daytime or not username:
+                flash('Bitte Name und gewünschte Uhrzeit angeben.', 'error')
+                return render_template(
+                    'termin_client.html',
+                    appointment_id=appointment_id,
+                    available=available_for_view,
+                    current_user=session.get('username', ''),
+                    tenant_id=_current_tenant_id(),
+                    can_view_booking_names=can_view_booking_names,
+                    custom_fields=custom_fields,
+                    appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
+                )
+
+            if appointment_service.book_slot(appointment_id, start_daytime, username, custom=custom_answers):
+                return redirect(
+                    url_for(
+                        'terminplaner.client_success',
+                        appointment_id=appointment_id,
+                        tenant=_current_tenant_id() or None,
+                        start=start_daytime,
+                        name=username,
+                    )
+                )
+
+            flash('Der Termin konnte nicht gespeichert werden. Eventuell ist der Slot bereits voll.', 'error')
+
+    return render_template(
+        'termin_client.html',
+        appointment_id=appointment_id,
+        available=available_for_view,
+        current_user=session.get('username', ''),
+        tenant_id=_current_tenant_id(),
+        can_view_booking_names=can_view_booking_names,
+        custom_fields=custom_fields,
+        appointment_item=appointment_item,
+        appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
+    )
+
+
+@appoint_bp.route('/client/success/<appointment_id>', methods=['GET'])
+def client_success(appointment_id):
+    guard = _require_module_enabled()
+    if guard:
+        return guard
+
+    slot_start = str(request.args.get('start', '') or '').strip()
+    client_name = str(request.args.get('name', '') or '').strip()
+
+    return render_template(
+        'termin_client_success.html',
+        appointment_id=appointment_id,
+        slot_start=slot_start,
+        client_name=client_name,
+        tenant_id=_current_tenant_id(),
+    )
+
+
+@appoint_bp.route('/delete/<appointment_id>', methods=['POST'])
+def delete_appointment(appointment_id):
+    guard = _require_module_enabled()
+    if guard:
+        return guard
+
+    if 'username' not in session:
+        flash('Bitte mit einem Konto anmelden.', 'error')
+        return redirect(url_for('login'))
+
+    appointment = termin.get_item(appointment_id)
+    if not appointment:
+        return _appointment_not_found_response()
+
+    current_user = str(session.get('username', '')).strip()
+    appointment_user = str(appointment.get('user', '')).strip()
+    if not us.check_admin(current_user) and appointment_user != current_user:
+        flash('Sie dürfen diesen Termin nicht löschen.', 'error')
+        return redirect(url_for('terminplaner.main', tenant=_current_tenant_id() or None))
+
+    if termin.remove(appointment_id):
+        flash('Der Terminplan wurde gelöscht.', 'success')
+    else:
+        flash('Der Terminplan konnte nicht gelöscht werden.', 'error')
+
+    return redirect(url_for('terminplaner.main', tenant=_current_tenant_id() or None))
+
+@appoint_bp.route('/configure', methods=['GET', 'POST'])
+def configure():
+    """
+    Route for authenticated persons to configure a new appointment schedule
+    """
+    guard = _require_module_enabled()
+    if guard:
+        return guard
+
+    if 'username' not in session:
+        flash('Bitte mit einem Konto anmelden.', 'error')
+        return redirect(url_for('login'))
+
+    if request.method == "POST":
+        start = request.form.get('start_date')
+        end = request.form.get('end_date')
+        time = request.form.get('time_frame')
+        slots_amount = request.form.get('slots_amounts')
+        slot_length = request.form.get('slot_length') 
+        mail = request.form.get('mail', '')
+        note = request.form.get('note', '')
+        add_to_calendar = request.form.get('add_to_calendar') == 'on'
+        title = request.form.get('title', '').strip()
+        custom = request.form.getlist('custom_fields')
+        
+        try:
+            clients_p_slot = int(request.form.get('clients_per_slot', 1))
+        except (ValueError, TypeError):
+            clients_p_slot = 1
+
+        if not start or not end or not time or not slots_amount or not slot_length or not title:
+            flash('Bitte alle Pflichtfelder ausfüllen.', 'error')
+            return render_template(
+                'termin_configure.html',
+                school_periods=cfg.SCHOOL_PERIODS,
+                generated_link=None,
+                email_service_enabled=cfg.EMAIL_ENABLED,
+            )
+
+        # Call the database service function (standardized to match your underlying code)
+        inserted_id = appointment_service.new(
+            date_start=start, 
+            date_end=end, 
+            time_span=time, 
+            slots=slots_amount, 
+            slot_length=slot_length, 
+            user=session["username"], 
+            mail=mail, 
+            note=note, 
+            calendar_enabled=add_to_calendar, 
+            title=title, 
+            custom_fields=custom,
+            clients_per_slot=clients_p_slot
+        )
+
+        if not inserted_id:
+            flash('Fehler beim Erstellen des Terminplans.', 'error')
+            return redirect(url_for('terminplaner.configure'))
+
+        flash('Der Terminplan wurde angelegt.', 'success')
+        return render_template(
+            'termin_configure.html',
+            school_periods=cfg.SCHOOL_PERIODS,
+            generated_link=inserted_id['link'],
+            calendar_link=None, 
+            add_to_calendar=add_to_calendar,
+            email_service_enabled=cfg.EMAIL_ENABLED,
+            title=title,
+            appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
+        )
+
+    return render_template(
+        'termin_configure.html',
+        school_periods=cfg.SCHOOL_PERIODS,
+        generated_link=None,
+        calendar_link=None,
+        add_to_calendar=False,
+        email_service_enabled=cfg.EMAIL_ENABLED,
+        title=None,
+        appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
+    )
+
+
+@appoint_bp.route('/calendar/<appointment_id>.ics', methods=['GET'])
+def calendar_export(appointment_id):
+    guard = _require_module_enabled()
+    if guard:
+        return guard
+
+    ics_content = appointment_service.build_calendar_ics(appointment_id)
+    if not ics_content:
+        return _appointment_not_found_response()
+
+    title = str(request.args.get('title', '') or '').strip() or appointment_id
+
+    response = Response(ics_content, mimetype='text/calendar; charset=utf-8')
+    response.headers['Content-Disposition'] = f'attachment; filename=terminplan-{title}-{appointment_id}.ics'
+    return response
+
+
+@appoint_bp.route('/client_ics/<appointment_id>.ics', methods=['GET'])
+def client_slot_calendar_export(appointment_id):
+    guard = _require_module_enabled()
+    if guard:
+        return guard
+
+    slot_start = str(request.args.get('start', '') or '').strip()
+    client_name = str(request.args.get('name', '') or '').strip()
+    ics_content = appointment_service.build_client_slot_ics(appointment_id, slot_start, client_name=client_name)
+    if not ics_content:
+        return _appointment_not_found_response()
+
+    title = str(request.args.get('title', '') or '').strip() or appointment_id
+
+    response = Response(ics_content, mimetype='text/calendar; charset=utf-8')
+    response.headers['Content-Disposition'] = f'attachment; filename=termin-{title}-{appointment_id}-{slot_start.replace(" ", "_").replace(":", "")}.ics'
+    return response
+
+
+@appoint_bp.route('/export_pdf_brief/<plan_id>', methods=['GET'])
+def export_pdf_brief(plan_id):
+    # 1. Daten holen (Hier als Beispiel, passe dies auf deine Datenbank an)
+    # terminplan = Terminplan.query.get(plan_id)
+
+    school_info = _get_school_info_for_export()
+
+    school_name = school_info.get('name', 'Schulname')
+    address = school_info.get('address', 'Adresse')
+    postal_code = school_info.get('postal_code', 'PLZ')
+    city = school_info.get('city', 'Stadt')
+    school_number = school_info.get('school_number', '000000')
+    it_admin = school_info.get('it_admin', 'IT-Beauftragter/in')
+    tenant_id = _current_tenant_id()
+
+    try:
+        link = url_for('terminplaner.client', appointment_id=plan_id, tenant=tenant_id or None, _external=True)
+    except Exception:
+        host = _resolve_public_base_url()
+        link = host + "/terminplaner/client/" + plan_id
+        if tenant_id:
+            link += f"?tenant={tenant_id}"
+
+    schul_daten = {
+        "schulname": school_name,
+        "strasse": address,
+        "plz_ort": f"{postal_code} {city}",
+        "schulnummer": school_number,
+        "it_admin": it_admin
+    }
+    
+    plan_daten = {
+        "titel": termin.get_item(plan_id).get('title', 'Terminplan'), # terminplan.title
+        "link": link, # terminplan.link
+        "notizen": termin.get_item(plan_id).get('note', '') # terminplan.note
+    }
+
+    # 2. QR-Code Bild im temporären Ordner erstellen
+    qr = qrcode.QRCode(version=1, box_size=10, border=0)
+    qr.add_data(plan_daten["link"])
+    qr.make(fit=True)
+    img = qr.make_image(fill_color="black", back_color="white")
+    
+    fd, qr_path = tempfile.mkstemp(suffix=".png")
+    os.close(fd)
+    img.save(qr_path)
+
+    # 3. PDF im Speicher aufbauen (BytesIO)
+    pdf_buffer = io.BytesIO()
+    doc = SimpleDocTemplate(
+        pdf_buffer,
+        pagesize=A4,
+        rightMargin=2*cm,
+        leftMargin=2.5*cm,
+        topMargin=2.5*cm,
+        bottomMargin=2*cm
+    )
+    
+    styles = getSampleStyleSheet()
+    styles.add(ParagraphStyle(name='Sender', fontSize=8, textColor=grey))
+    styles.add(ParagraphStyle(name='Address', fontSize=10, leading=14))
+    styles.add(ParagraphStyle(name='Date', fontSize=10, alignment=2))
+    styles.add(ParagraphStyle(name='Subject', fontSize=14, fontName='Helvetica-Bold', spaceAfter=16, textColor=HexColor('#0f4c5c')))
+    styles.add(ParagraphStyle(name='Body', fontSize=11, leading=16, spaceAfter=12))
+    styles.add(ParagraphStyle(name='Notes', fontSize=10, leading=14, textColor=HexColor("#444444")))
+    
+    elements = []
+    
+    # Absenderzeile
+    sender_text = f"<u>{schul_daten['schulname']} • {schul_daten['strasse']} • {schul_daten['plz_ort']}</u>"
+    elements.append(Paragraph(sender_text, styles['Sender']))
+    elements.append(Spacer(1, 1.5*cm))
+    
+    # Sichtfenster-Adresse (Generisch)
+    elements.append(Paragraph("An die<br/>Teilnehmerinnen und Teilnehmer<br/>des Termins", styles['Address']))
+    elements.append(Spacer(1, 2*cm))
+    
+    # Datum (Hier statisch zum Test, ggf. dynamisch per datetime)
+    import datetime
+    heute = datetime.datetime.now().strftime("%d.%m.%Y")
+    elements.append(Paragraph(f"{schul_daten['plz_ort']}, den {heute}", styles['Date']))
+    elements.append(Spacer(1, 1*cm))
+    
+    # Betreff
+    elements.append(Paragraph(f"Einladung zur Terminbuchung: {plan_daten['titel']}", styles['Subject']))
+    
+    # Text
+    elements.append(Paragraph("Sehr geehrte Damen und Herren,", styles['Body']))
+    elements.append(Paragraph("hiermit möchten wir Sie herzlich einladen, einen Termin für unsere anstehende Veranstaltung zu buchen. Um den Prozess für alle Beteiligten so einfach und effizient wie möglich zu gestalten, nutzen wir unser Online-Buchungssystem.", styles['Body']))
+    elements.append(Spacer(1, 0.5*cm))
+    
+    # Link
+    elements.append(Paragraph("<b>Ihr persönlicher Buchungslink:</b>", styles['Body']))
+    link_html = f'<a href="{plan_daten["link"]}?" color="#16697a">{plan_daten["link"]}</a>'
+    elements.append(Paragraph(link_html, styles['Body']))
+    
+    # Das vorhin erstellte QR-Code Bild einfügen
+    elements.append(Spacer(1, 0.2*cm))
+    elements.append(Image(qr_path, width=3*cm, height=3*cm, hAlign='LEFT'))
+    elements.append(Spacer(1, 0.5*cm))
+    
+    # Notizen (falls vorhanden)
+    if plan_daten.get('notizen'):
+        elements.append(Paragraph("<b>Zusätzliche Informationen zum Termin:</b>", styles['Body']))
+        elements.append(Paragraph(plan_daten['notizen'], styles['Notes']))
+        
+    elements.append(Spacer(1, 1.5*cm))
+    
+    # Grußformel
+    elements.append(Paragraph("Mit freundlichen Grüßen,", styles['Body']))
+    elements.append(Spacer(1, 1.5*cm))
+    elements.append(Paragraph(f"<b>{schul_daten['schulname']}</b>", styles['Body']))
+    
+    # PDF fertigstellen
+    doc.build(elements)
+    
+    # Temporäres Bild löschen
+    if os.path.exists(qr_path):
+        os.remove(qr_path)
+    
+    # Buffer auf Anfang zurücksetzen
+    pdf_buffer.seek(0)
+    
+    # An Nutzer ausliefern
+    return send_file(
+        pdf_buffer,
+        mimetype='application/pdf',
+        as_attachment=True,
+        download_name=f"Einladung_{plan_daten['titel'].replace(' ', '_')}.pdf"
+    )
+
+@appoint_bp.route('/')
+def main():
+    guard = _require_module_enabled()
+    if guard:
+        return guard
+
+    current_user = session.get('username', '')
+    upcoming_events = appointment_service.get_user_upcoming_events(current_user) if current_user else []
+    tenant_id = _current_tenant_id()
+
+
+    return render_template(
+        'terminplaner.html',
+        school_periods=cfg.SCHOOL_PERIODS,
+        current_user=current_user,
+        upcoming_events=upcoming_events,
+        tenant_id=tenant_id,
+        appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
+    )

Web/push_notifications.py

@@ -13,6 +13,7 @@ import logging
 
 import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
+from Web.modules.inventarsystem.data_protection import encrypt_text, decrypt_text
 
 logger = logging.getLogger(__name__)
 
@@ -44,16 +45,22 @@ if not VAPID_PUBLIC_KEY or not VAPID_PRIVATE_KEY:
             serialization.PublicFormat.UncompressedPoint
         )
         
-        VAPID_PUBLIC_KEY = b64urlencode(raw_pub)
+        VAPID_PUBLIC_KEY = b64urlencode(raw_pub).decode('utf-8')
         VAPID_PRIVATE_KEY = VAPID_PRIVATE_PEM
     except Exception as e:
         logger.error(f'Could not load or generate VAPID keys: {e}')
 
 # Push service endpoint (typically Firebase or Web Push Service)
-PUSH_SERVICE_URL = 'https://fcm.googleapis.com/fcm/send'  # Firebase Cloud Messaging
 FCM_API_KEY = os.getenv('FCM_API_KEY', '')  # Firebase API key
 
 
+def _get_username_hash(username):
+    """Generates a deterministic hash for database lookups."""
+    if not username:
+        return None
+    return hashlib.sha256(username.encode('utf-8')).hexdigest()
+
+
 def get_push_subscriptions_collection(db=None):
     """Get MongoDB push subscriptions collection"""
     if db is None:
@@ -64,71 +71,68 @@ def get_push_subscriptions_collection(db=None):
 
 def get_user_subscriptions(username):
     """
-    Get all active push subscriptions for a user
-    
-    Args:
-        username (str): Username
-        
-    Returns:
-        list: List of subscription documents
+    Get all active push subscriptions for a user, decrypting data on the fly.
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         subs_col = get_push_subscriptions_collection(db)
         
-        subscriptions = list(subs_col.find({
-            'Username': username,
+        # Query using the deterministic hash, NOT the encrypted text directly
+        user_hash = _get_username_hash(username)
+        
+        encrypted_subscriptions = list(subs_col.find({
+            'UsernameHash': user_hash,
             'IsActive': True
         }))
         
         client.close()
-        return subscriptions
+        
+        # Decrypt endpoints and keys before returning
+        decrypted_subs = []
+        for sub in encrypted_subscriptions:
+            try:
+                sub['Endpoint'] = decrypt_text(sub.get('Endpoint'))
+                
+                # Keys are stored as encrypted JSON strings
+                decrypted_keys_str = decrypt_text(sub.get('Keys'))
+                sub['Keys'] = json.loads(decrypted_keys_str) if decrypted_keys_str else {}
+                
+                decrypted_subs.append(sub)
+            except Exception as e:
+                logger.error(f"Failed to decrypt subscription payload for hash {user_hash}: {e}")
+                
+        return decrypted_subs
     except Exception as e:
-        logger.error(f'Error getting push subscriptions for {username}: {e}')
+        logger.error(f'Error getting push subscriptions for user: {e}')
         return []
 
 
 def save_push_subscription(username, subscription_obj):
     """
-    Save a new push subscription for a user
-    
-    Args:
-        username (str): Username
-        subscription_obj (dict): Subscription object from Service Worker
-        {
-            'endpoint': 'https://...',
-            'keys': {
-                'p256dh': '...',
-                'auth': '...'
-            }
-        }
-        
-    Returns:
-        bool: Success status
+    Save a new push subscription for a user with field-level encryption.
     """
     try:
-        if not subscription_obj.get('endpoint'):
-            logger.warning(f'Invalid subscription object for {username}')
+        endpoint = subscription_obj.get('endpoint')
+        if not endpoint:
+            logger.warning('Invalid subscription object: missing endpoint')
             return False
         
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         subs_col = get_push_subscriptions_collection(db)
         
-        # Create unique hash of subscription to avoid duplicates
-        sub_hash = hashlib.md5(
-            f"{username}:{subscription_obj['endpoint']}".encode()
+        # Create unique hash of subscription using plaintext data to avoid duplicates
+        sub_hash = hashlib.shake_256(
+            f"{username}:{endpoint}".encode('utf-8')
         ).hexdigest()
         
-        # Check if subscription already exists
+        # Check if subscription already exists by Hash
         existing = subs_col.find_one({
-            'Username': username,
             'SubscriptionHash': sub_hash
         })
         
         if existing:
-            # Update last used time
             subs_col.update_one(
                 {'_id': existing['_id']},
                 {'$set': {
@@ -136,15 +140,19 @@ def save_push_subscription(username, subscription_obj):
                     'IsActive': True
                 }}
             )
-            logger.info(f'Updated existing subscription for {username}')
+            logger.info('Updated existing push subscription')
             client.close()
             return True
         
-        # Save new subscription
+        # Format keys as JSON string for your encrypt_text module
+        keys_str = json.dumps(subscription_obj.get('keys', {}))
+        
+        # Save new subscription, encrypting sensitive fields
         subscription_doc = {
-            'Username': username,
-            'Endpoint': subscription_obj['endpoint'],
-            'Keys': subscription_obj.get('keys', {}),
+            'UsernameHash': _get_username_hash(username),
+            'Username': encrypt_text(username),
+            'Endpoint': encrypt_text(endpoint),
+            'Keys': encrypt_text(keys_str),
             'SubscriptionHash': sub_hash,
             'IsActive': True,
             'CreatedAt': datetime.datetime.now(),
@@ -153,36 +161,31 @@ def save_push_subscription(username, subscription_obj):
         }
         
         subs_col.insert_one(subscription_doc)
-        logger.info(f'Saved new push subscription for {username}')
+        logger.info('Saved new encrypted push subscription')
         client.close()
         return True
         
     except Exception as e:
-        logger.error(f'Error saving push subscription for {username}: {e}')
+        logger.error(f'Error saving push subscription: {e}')
         return False
 
 
 def remove_push_subscription(username, endpoint):
     """
-    Remove a push subscription
-    
-    Args:
-        username (str): Username
-        endpoint (str): Subscription endpoint URL
-        
-    Returns:
-        bool: Success status
+    Remove a push subscription by making it inactive.
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         subs_col = get_push_subscriptions_collection(db)
         
+        # Recreate the deterministic hash to find the specific subscription
+        sub_hash = hashlib.shake_256(
+            f"{username}:{endpoint}".encode('utf-8')
+        ).hexdigest()
+        
         result = subs_col.update_one(
-            {
-                'Username': username,
-                'Endpoint': endpoint
-            },
+            {'SubscriptionHash': sub_hash},
             {'$set': {'IsActive': False}}
         )
         
@@ -190,31 +193,19 @@ def remove_push_subscription(username, endpoint):
         return result.modified_count > 0
         
     except Exception as e:
-        logger.error(f'Error removing push subscription for {username}: {e}')
+        logger.error(f'Error removing push subscription: {e}')
         return False
 
 
 def send_push_notification(username, title, body, icon=None, url='/', reference=None, tag='notification'):
     """
-    Send a push notification to all user's subscriptions
-    
-    Args:
-        username (str): Target username
-        title (str): Notification title
-        body (str): Notification body
-        icon (str, optional): Icon URL
-        url (str, optional): URL to open on click
-        reference (dict, optional): Reference data (item_id, etc)
-        tag (str, optional): Notification tag for grouping
-        
-    Returns:
-        int: Number of successfully sent notifications
+    Send a push notification to all user's subscriptions.
     """
     try:
         subscriptions = get_user_subscriptions(username)
         
         if not subscriptions:
-            logger.debug(f'No active push subscriptions for {username}')
+            logger.debug('No active push subscriptions for user')
             return 0
         
         sent_count = 0
@@ -232,19 +223,18 @@ def send_push_notification(username, title, body, icon=None, url='/', reference=
             if success:
                 sent_count += 1
             else:
-                # Mark subscription as inactive if send fails
                 _mark_subscription_inactive(subscription['_id'])
         
-        logger.info(f'Sent push notification to {username}: {sent_count}/{len(subscriptions)} subscriptions')
+        logger.info(f'Sent push notification: {sent_count}/{len(subscriptions)} subscriptions')
         return sent_count
         
     except Exception as e:
-        logger.error(f'Error sending push notification to {username}: {e}')
+        logger.error(f'Error sending push notification: {e}')
         return 0
 
 
 def _send_to_subscription(subscription, title, body, icon, url, reference, tag):
-    """Send push notification to a specific subscription"""
+    """Send push notification to a specific decrypted subscription"""
     try:
         payload = {
             'title': title,
@@ -256,20 +246,17 @@ def _send_to_subscription(subscription, title, body, icon, url, reference, tag):
             'reference': reference or {},
         }
         
-        # If using Firebase Cloud Messaging
         if FCM_API_KEY and subscription.get('Endpoint', '').startswith('https://fcm.'):
             return _send_fcm_notification(subscription, payload)
         
-        # Otherwise use standard Web Push Protocol
         return _send_web_push_notification(subscription, payload)
         
     except Exception as e:
-        logger.error(f'Error sending to subscription {subscription.get("_id")}: {e}')
+        logger.error(f'Error sending to subscription: {e}')
         return False
 
 
 def _send_fcm_notification(subscription, payload):
-    """Send notification via Firebase Cloud Messaging"""
     try:
         if not FCM_API_KEY:
             logger.warning('FCM_API_KEY not configured')
@@ -311,9 +298,7 @@ def _send_fcm_notification(subscription, payload):
 
 
 def _send_web_push_notification(subscription, payload):
-    """Send notification using standard Web Push Protocol"""
     try:
-        # This requires pywebpush library
         from pywebpush import webpush
         
         webpush(
@@ -325,13 +310,13 @@ def _send_web_push_notification(subscription, payload):
             vapid_private_key=VAPID_PRIVATE_KEY,
             vapid_claims={'sub': VAPID_SUBJECT},
             timeout=10,
-            ttl=3600  # Notification expires after 1 hour if device is offline
+            ttl=3600 
         )
         
         return True
         
     except ImportError:
-        logger.warning('pywebpush not installed, install with: pip install pywebpush')
+        logger.warning('pywebpush not installed. pip install pywebpush')
         return False
     except Exception as e:
         logger.error(f'Web push error: {e}')
@@ -339,7 +324,6 @@ def _send_web_push_notification(subscription, payload):
 
 
 def _mark_subscription_inactive(subscription_id):
-    """Mark a subscription as inactive (e.g., after failed send)"""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
@@ -349,37 +333,21 @@ def _mark_subscription_inactive(subscription_id):
             {'_id': ObjectId(subscription_id)},
             {'$set': {'IsActive': False}}
         )
-        
         client.close()
     except Exception as e:
         logger.error(f'Error marking subscription inactive: {e}')
 
 
 def send_push_to_all_admins(title, body, icon=None, url='/', reference=None):
-    """
-    Send a push notification to all admin users
-    
-    Args:
-        title (str): Notification title
-        body (str): Notification body
-        icon (str, optional): Icon URL
-        url (str, optional): URL to open on click
-        reference (dict, optional): Reference data
-        
-    Returns:
-        int: Total notifications sent
-    """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         users_col = db['users']
         
-        # Get all admin users
         admin_users = list(users_col.find(
             {'Admin': True},
             {'Username': 1}
         ))
-        
         client.close()
         
         total_sent = 0
@@ -404,10 +372,6 @@ def send_push_to_all_admins(title, body, icon=None, url='/', reference=None):
 
 
 def cleanup_inactive_subscriptions():
-    """
-    Remove inactive subscriptions older than 30 days
-    Run this periodically as a maintenance task
-    """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
@@ -429,22 +393,19 @@ def cleanup_inactive_subscriptions():
         return 0
 
 
-# Database collection schema
 def ensure_push_subscriptions_collection():
-    """Ensure the push_subscriptions collection exists with proper indexes"""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         subs_col = get_push_subscriptions_collection(db)
         
-        # Create indexes
-        subs_col.create_index('Username')
-        subs_col.create_index([('Username', 1), ('IsActive', 1)])
-        subs_col.create_index([('CreatedAt', 1)])  # TTL-like usage
+        subs_col.create_index('UsernameHash')
+        subs_col.create_index([('UsernameHash', 1), ('IsActive', 1)])
+        subs_col.create_index([('CreatedAt', 1)]) 
         subs_col.create_index('SubscriptionHash', unique=True)
         
         logger.info('Push subscriptions collection indexes created')
         client.close()
         
     except Exception as e:
-        logger.error(f'Error ensuring push subscriptions collection: {e}')
+        logger.error(f'Error ensuring push subscriptions collection: {e}')

Web/requirements.txt

@@ -1,5 +1,4 @@
 flask
-bson
 werkzeug
 gunicorn
 pymongo
@@ -16,3 +15,4 @@ openpyxl
 cryptography>=42.0.0
 pywebpush
 py-vapid>=1.9.0
+beautifulsoup4

Web/templates/base.html

@@ -129,6 +129,14 @@
             --module-brand-icon: "📚";
         }
 
+        html[data-module="terminplan"] {
+            --module-primary-color: #0f4c5c;
+            --module-primary-light: #16697a;
+            --module-accent-color: #2ec4b6;
+            --module-accent-light: rgba(46, 196, 182, 0.1);
+            --module-brand-icon: "📅";
+        }
+
         :root[data-theme="dark"] {
             --module-primary-color: #1a252f;
             --module-primary-light: #2c3e50;
@@ -145,6 +153,12 @@
             --module-accent-color: #8e44ad;
         }
 
+        html[data-theme="dark"][data-module="terminplan"] {
+            --module-primary-color: #082f35;
+            --module-primary-light: #0f4c5c;
+            --module-accent-color: #21b6a8;
+        }
+
         /* Global styles */
         body {
             font-family: "Manrope", "Segoe UI", "Noto Sans", sans-serif;
@@ -1078,29 +1092,120 @@
         <span class="module-label">Module:</span>
         <div class="module-tabs">
             {% if inventory_module_enabled %}
-            <a href="{{ url_for('home') }}" 
-               class="module-tab {% if CURRENT_MODULE == 'inventory' %}active{% endif %}" 
-               id="inventoryModule" 
-               data-module="inventory">
+            <a href="{{ url_for('home') }}" class="module-tab {% if CURRENT_MODULE == 'inventory' %}active{% endif %}" id="inventoryModule" data-module="inventory">
                📦 Inventarsystem
             </a>
             {% endif %}
-            {% if inventory_module_enabled and library_module_enabled %}
+            {% if inventory_module_enabled and terminplan_module_enabled %}
+            <div class="module-separator"></div>
+            {% endif %}
+            {% if terminplan_module_enabled %}
+            <a href="{{ url_for('terminplaner.main') }}" class="module-tab {% if CURRENT_MODULE == 'terminplan' %}active{% endif %}" id="terminplanModule" data-module="terminplan">
+               📅 Terminplaner
+            </a>
+            {% endif %}
+            {% if (inventory_module_enabled or terminplan_module_enabled) and library_module_enabled %}
             <div class="module-separator"></div>
             {% endif %}
             {% if library_module_enabled %}
-            <a href="{{ url_for('library_view') }}" 
-               class="module-tab {% if CURRENT_MODULE == 'library' %}active{% endif %}" 
-               id="libraryModule" 
-               data-module="library">
+            <a href="{{ url_for('library_view') }}" class="module-tab {% if CURRENT_MODULE == 'library' %}active{% endif %}" id="libraryModule" data-module="library">
                📚 Bibliothek
             </a>
             {% endif %}
         </div>
     </div>
-    {% endif %}
-        {% if 'username' in session %}
-    {% if CURRENT_MODULE != 'library' and inventory_module_enabled %}
+
+    {% if terminplan_module_enabled and CURRENT_MODULE == 'terminplan' %}
+        <nav class="navbar navbar-expand-lg navbar-dark" id="terminplanNavbar">
+            <div class="container-fluid">
+                <a class="navbar-brand" href="{{ url_for('terminplaner.main') }}" data-icon="📅">Terminplaner</a>
+                <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#terminplanNavContent">
+                    <span class="navbar-toggler-icon"></span>
+                </button>
+                <div class="collapse navbar-collapse" id="terminplanNavContent">
+                    <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="terminplanNavList">
+                        <li class="nav-item" data-nav-fixed="true">
+                            <a class="nav-link {% if current_path == url_for('terminplaner.main') %}nav-active{% endif %}" href="{{ url_for('terminplaner.main') }}" data-tutorial-tip="Die Terminplaner-Übersicht bündelt die wichtigsten Aktionen.">Übersicht</a>
+                        </li>
+                        <li class="nav-item" data-nav-fixed="true">
+                            <a class="nav-link {% if current_path == url_for('terminplan') %}nav-active{% endif %}" href="{{ url_for('terminplan') }}" data-tutorial-tip="Hier sehen Sie den Kalender mit den bestehenden Terminen.">Kalender</a>
+                        </li>
+                        {% if current_permissions.pages.get('terminplan', True) and current_permissions.actions.get('can_insert', True) %}
+                        <li class="nav-item">
+                            <a class="nav-link quick-link-pill {% if current_path == url_for('terminplaner.configure') %}nav-active{% endif %}" href="{{ url_for('terminplaner.configure') }}" data-tutorial-tip="Neuen Terminplan erstellen und an Ihr Team versenden.">Neue Planung</a>
+                        </li>
+                        {% endif %}
+                        <li class="nav-item" data-nav-fixed="true">
+                            <button id="themeToggleBtn" class="btn btn-link nav-link px-3" aria-label="Dark Mode umschalten" title="Theme umschalten">
+                                <span class="theme-icon-light" style="display: none;">☀️</span>
+                                <span class="theme-icon-dark" style="display: none;">🌙</span>
+                            </button>
+                        </li>
+                        <li class="nav-item dropdown ms-lg-auto">
+                            <a class="nav-link dropdown-toggle" href="#" id="termMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false" title="Weitere Optionen">Mehr Optionen</a>
+                            <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="termMoreDropdown">
+                                {% if 'username' in session %}
+                                {% if current_permissions.pages.get('tutorial_page', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('tutorial_page') }}">Tutorial</a></li>
+                                {% endif %}
+                                <li><a class="dropdown-item" href="{{ url_for('admin_school_settings') }}">Schulstammdaten</a></li>
+                                {% if current_permissions.actions.get('can_view_logs', True) and current_permissions.pages.get('admin_audit_dashboard', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('admin_audit_dashboard') }}">Audit Dashboard</a></li>
+                                {% endif %}
+                                <li><hr class="dropdown-divider"></li>
+                                {% endif %}
+                                
+                                {% if current_permissions.pages.get('home', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('home') }}">Inventarsystem</a></li>
+                                {% endif %}
+                                {% if current_permissions.pages.get('library_view', True) and library_module_enabled %}
+                                <li><a class="dropdown-item" href="{{ url_for('library_view') }}">Bibliothek</a></li>
+                                {% endif %}
+                                <li><hr class="dropdown-divider"></li>
+                                <li><a class="dropdown-item" href="{{ url_for('logout') }}">Logout</a></li>
+                            </ul>
+                        </li>
+                    </ul>
+                    <div class="d-flex">
+                        {% if 'username' in session %}
+                            <div class="function-search-wrap">
+                                <form class="function-search-form" data-function-search="true">
+                                    <input
+                                        class="function-search-input"
+                                        type="search"
+                                        name="function_search"
+                                        placeholder="Funktion suchen..."
+                                        list="function-search-options"
+                                        autocomplete="off"
+                                    >
+                                    <button class="function-search-btn" type="submit">Los</button>
+                                </form>
+                            </div>
+                            {% if current_tenant_db %}
+                            <span class="navbar-text tenant-badge" title="Aktive Tenant-Datenbank">{{ current_tenant_db }}</span>
+                        {% endif %}
+                        <span class="navbar-text text-light me-3">{{ session['username'] }}</span>
+                            <div class="dropdown me-2 user-menu-wrap">
+                                <button class="btn btn-secondary dropdown-toggle user-menu-btn" type="button" id="invUserMenuDropdown" data-bs-toggle="dropdown" aria-expanded="false" data-notification-button="true">
+                                    👤
+                                    <span class="user-notification-dot {% if unread_notification_count and unread_notification_count > 0 %}visible{% endif %}" aria-hidden="true"></span>
+                                </button>
+                                <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invUserMenuDropdown">
+                                    {% if current_permissions.pages.get('notifications_view', True) %}
+                                    <li><a class="dropdown-item" href="{{ url_for('notifications_view') }}">Benachrichtigungen</a></li>
+                                    {% endif %}
+                                    <li><hr class="dropdown-divider"></li>
+                                    <li><a class="dropdown-item" href="{{ url_for('change_password') }}">Passwort ändern</a></li>
+                                    <li><hr class="dropdown-divider"></li>
+                                    <li><a class="dropdown-item" href="{{ url_for('logout') }}">Logout</a></li>
+                                </ul>
+                            </div>
+                        {% endif %}
+                    </div>
+                </div>
+            </div>
+        </nav>
+    {% elif CURRENT_MODULE != 'library' and inventory_module_enabled %}
         <nav class="navbar navbar-expand-lg navbar-dark" id="inventoryNavbar">
             <div class="container-fluid">
                 <a class="navbar-brand" href="{{ url_for('home') }}" data-icon="📦">Inventarsystem</a>
@@ -1220,7 +1325,7 @@
                 </div>
             </div>
         </nav>
-        {% endif %}
+    {% endif %}
 
         {% if library_module_enabled and CURRENT_MODULE == 'library' %}
         <nav class="navbar navbar-expand-lg navbar-dark" id="libraryNavbar">
@@ -1237,11 +1342,6 @@
                         </li>
                         {% endif %}
                         {% if 'username' in session %}
-                        {% if current_permissions.pages.get('my_borrowed_items', True) %}
-                        <li class="nav-item">
-                            <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}" data-tutorial-tip="Hier sehen Sie Ihre bibliotheksbezogenen Ausleihen.">Meine Medien</a>
-                        </li>
-                        {% endif %}
                         {% if current_permissions.pages.get('tutorial_page', True) %}
                         <li class="nav-item">
                             <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}" data-tutorial-tip="Nutzen Sie das Tutorial, um die Bibliotheksfunktionen kennenzulernen.">Tutorial</a>
@@ -1268,10 +1368,7 @@
                                 {% if 'username' in session and (session.get('admin', False) or is_admin) and current_permissions.actions.get('can_manage_settings', True) %}
                                 <li><h6 class="dropdown-header">Bibliotheks-Verwaltung</h6></li>
                                 {% if current_permissions.pages.get('library_loans_admin', True) %}
-                                <li><a class="dropdown-item" href="{{ url_for('library_loans_admin') }}">Ausleihen</a></li>
-                                {% endif %}
-                                {% if current_permissions.pages.get('admin_damaged_items', True) %}
-                                <li><a class="dropdown-item" href="{{ url_for('admin_damaged_items') }}">Defekte Items</a></li>
+                                <li><a class="dropdown-item" href="{{ url_for('library_loans_admin') }}">Ausleihen / Defekte Items</a></li>
                                 {% endif %}
                                 {% if student_cards_module_enabled %}
                                 <li><a class="dropdown-item" href="{{ url_for('student_cards_admin') }}">Bibliotheksausweis</a></li>
@@ -1334,28 +1431,7 @@
         {% endif %}
 
     {% else %}
-    <nav class="navbar navbar-expand-lg navbar-dark" id="loginNavbar">
-        <div class="container-fluid">
-                    <a class="navbar-brand py-0" href="{{ url_for('home') }}">
-                        {% set school_logo_thumb = school_info.get('logo_thumb') if school_info else '' %}
-                        {% set school_logo_path = school_info.get('logo_path') if school_info else '' %}
-                        {% if school_logo_thumb or school_logo_path %}
-                            {% if school_logo_thumb %}
-                                <img src="{{ url_for('uploaded_file', filename=school_logo_thumb) }}" alt="{{ school_info.name or 'Schullogo' }}" class="invario-logo">
-                            {% else %}
-                                <img src="{{ url_for('uploaded_file', filename=school_logo_path) }}" alt="{{ school_info.name or 'Schullogo' }}" class="invario-logo">
-                            {% endif %}
-                        {% else %}
-                            <img src="{{ url_for('static', filename='img/invario-logo.png') }}" alt="Invario" class="invario-logo">
-                        {% endif %}
-                    </a>
-            <ul class="navbar-nav ms-auto mb-2 mb-lg-0">
-                <li class="nav-item">
-                    <a class="nav-link" href="{{ url_for('impressum') }}">Impressum</a>
-                </li>
-            </ul>
-        </div>
-    </nav>
+    <!-- No navbar for anonymous users on public pages. -->
     {% endif %}
     <div class="container">
         {% with messages = get_flashed_messages(with_categories=true) %}
@@ -1369,6 +1445,11 @@
         {% endwith %}
         {% block content %}{% endblock %}
     </div>
+    {% if 'username' not in session %}
+    <div class="guest-impressum-footer">
+        <a href="{{ url_for('impressum') }}">Impressum</a>
+    </div>
+    {% endif %}
     <!-- Cookie consent banner -->
     <style>
         #cookie-banner { position: fixed; bottom: 0; left: 0; right: 0; background: rgba(33,37,41,.98); color: #fff; padding: 14px 16px; display: none; z-index: 2000; box-shadow: 0 -2px 8px rgba(0,0,0,.25); }
@@ -1502,6 +1583,29 @@
             margin-bottom: 2px;
         }
 
+        .guest-impressum-footer {
+            position: fixed;
+            left: 0;
+            right: 0;
+            bottom: 10px;
+            text-align: center;
+            z-index: 1200;
+            pointer-events: none;
+        }
+
+        .guest-impressum-footer a {
+            pointer-events: auto;
+            font-size: 0.76rem;
+            color: rgba(15, 23, 42, 0.72);
+            text-decoration: none;
+            border-bottom: 1px solid rgba(15, 23, 42, 0.28);
+        }
+
+        .guest-impressum-footer a:hover {
+            color: rgba(15, 23, 42, 0.92);
+            border-bottom-color: rgba(15, 23, 42, 0.52);
+        }
+
         .notification-toast.show {
             display: block;
         }

Web/templates/library.html

@@ -10,24 +10,6 @@
             <h1>📚 Bibliothek</h1>
             <p class="subtitle">Bücher, CDs und weitere Medien</p>
         </div>
-        
-        <div class="header-controls">
-            <!-- Favorites Toggle -->
-            <div class="view-switch">
-                <button id="favoriteToggle" class="toggle-btn" aria-label="Favoriten anzeigen/verbergen">
-                    <span class="toggle-icon">⭐</span>
-                    <span class="toggle-label">Favoriten</span>
-                </button>
-            </div>
-
-            <!-- View Mode Toggle -->
-            <div class="view-switch">
-                <button id="viewModeToggle" class="toggle-btn" aria-label="Ansichtsmodus wechseln">
-                    <span class="toggle-icon">ㄷ</span>
-                    <span class="toggle-label">Tabelle</span>
-                </button>
-            </div>
-        </div>
     </div>
 
     <!-- Search & Filter Section -->
@@ -205,8 +187,7 @@
         </form>
     </div>
 </div>
-
-<script src="https://cdn.jsdelivr.net/npm/html5-qrcode/minified/html5-qrcode.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/@ericblade/quagga2/dist/quagga.js"></script>
 <script>
 // View mode persistence
 const LIBRARY_VIEW_MODE_KEY = 'inventarLibraryViewMode';
@@ -625,50 +606,80 @@ document.getElementById('clearFiltersBtn').addEventListener('click', function()
     closeAllFilters();
 });
 
-// Favorites toggle
-document.getElementById('favoriteToggle').addEventListener('click', function() {
-    this.classList.toggle('open');
-    // TODO: Implement favorites filtering
-});
-
 // Scanner toggle
-let scanner = null;
+// Scanner state tracking
+let isScanning = false; 
+
 document.getElementById('scannerBtn').addEventListener('click', function(e) {
     e.stopPropagation();
     const container = document.getElementById('qrContainer');
     const isOpen = container.style.display !== 'none';
+    const btn = this;
     
     if (isOpen) {
+        // Close the scanner
         container.style.display = 'none';
-        if (scanner) scanner.clear();
-        this.classList.remove('open');
-        this.setAttribute('aria-expanded', 'false');
-    } else {
-        container.style.display = 'block';
-        this.classList.add('open');
-        this.setAttribute('aria-expanded', 'true');
+        Quagga.stop();
+        isScanning = false;
         
-        if (!scanner) {
-            scanner = new Html5Qrcode('qr-reader');
-            scanner.start(
-                { facingMode: "environment" },
-                { fps: 10, qrbox: 250 },
-                onScanSuccess,
-                onScanError
-            );
-        }
+        btn.classList.remove('open');
+        btn.setAttribute('aria-expanded', 'false');
+    } else {
+        // Open the scanner
+        container.style.display = 'block';
+        btn.classList.add('open');
+        btn.setAttribute('aria-expanded', 'true');
+        
+        Quagga.init({
+            inputStream: {
+                name: "Live",
+                type: "LiveStream",
+                // Targets the element where the video stream will inject
+                target: document.querySelector('#qr-reader'), 
+                constraints: {
+                    width: 640,
+                    height: 480,
+                    facingMode: "environment" // Forces back camera
+                },
+            },
+            decoder: {
+                // Optimized for 1D barcodes (e.g., student IDs, member cards)
+                readers: ["code_128_reader", "ean_reader", "code_39_reader", "upc_reader"]
+            } 
+        }, function(err) {
+            if (err) {
+                console.error("Initialization error:", err);
+                alert("Kamera konnte nicht gestartet werden.");
+                return;
+            }
+            Quagga.start();
+            isScanning = true;
+        });
     }
 });
 
-function onScanSuccess(decodedText, decodedResult) {
-    const studentId = decodedText.trim();
+// Single Quagga event listener for successful scans
+Quagga.onDetected(function(data) {
+    const decodedText = data.codeResult.code;
+    const studentId = String(decodedText || '').trim();
+    
+    // Stop scanning immediately to prevent multiple triggers
+    Quagga.stop();
+    isScanning = false;
+    
+    // Reset UI states to closed
+    const container = document.getElementById('qrContainer');
+    const btn = document.getElementById('scannerBtn');
+    if (container) container.style.display = 'none';
+    if (btn) {
+        btn.classList.remove('open');
+        btn.setAttribute('aria-expanded', 'false');
+    }
+    
+    // Route the scanned data to your input
     document.getElementById('studentIdInput').value = studentId;
     alert('Ausweis gescannt: ' + studentId);
-}
-
-function onScanError(error) {
-    // Silently ignore scan errors
-}
+});
 </script>
 
 <style>

Web/templates/license.html

@@ -28,11 +28,10 @@
             <li class="nav-item" role="presentation">
                 <button class="nav-link" id="tab-legal" data-bs-toggle="tab" data-bs-target="#pane-legal"
                     type="button" role="tab">Rechtsgrundlage</button>
-            </li>
         </ul>
 
         <!-- ── NOTICE ────────────────────────────────────────────────────── -->
-        <div class="tab-pane fade" id="pane-notice" role="tabpanel">
+        <div class="tab-pane" id="pane-notice" role="tabpanel">
         <div class="license-content">
             <h2>NOTICE – Urheberrechtliche Hinweise</h2>
             <p><strong>Invario Modul Suite</strong><br>Copyright © 2026 Invario UG</p>
@@ -59,14 +58,14 @@
 
             <h4>Frontend / Laufzeit-Assets</h4>
             <ul>
-                <li>html5-qrcode (MIT) © 2020-2025 Manoj Brahmbhatt (mebjas)</li>
+                <li>quagga2 (MIT) © 2014 Christoph Oberhofer, © 2019 Eric Blade and contributors</li>
             </ul>
             <hr>
         </div>
         </div><!-- /#pane-notice -->
 
         <!-- ── DATENSCHUTZ ───────────────────────────────────────────────── -->
-        <div class="tab-pane fade" id="pane-privacy" role="tabpanel">
+        <div class="tab-pane" id="pane-privacy" role="tabpanel">
         <div class="license-content">
             <h2>Datenschutzerklärung (Privacy Policy)</h2>
 
@@ -108,7 +107,7 @@
         </div><!-- /#pane-privacy -->
 
         <!-- ── SICHERHEIT ────────────────────────────────────────────────── -->
-        <div class="tab-pane fade" id="pane-security" role="tabpanel">
+        <div class="tab-pane" id="pane-security" role="tabpanel">
         <div class="license-content">
             <h2>Sicherheitsrichtlinie (Security Policy)</h2>
 
@@ -129,7 +128,7 @@
         </div><!-- /#pane-security -->
 
         <!-- ── DATENVERARBEITUNG ─────────────────────────────────────────── -->
-        <div class="tab-pane fade" id="pane-data" role="tabpanel">
+        <div class="tab-pane" id="pane-data" role="tabpanel">
         <div class="license-content">
             <h2>Dokumentation der Datenverarbeitung (VVT)</h2>
 
@@ -157,7 +156,7 @@
         </div><!-- /#pane-data -->
 
         <!-- ── RECHTSGRUNDLAGE ───────────────────────────────────────────── -->
-        <div class="tab-pane fade" id="pane-legal" role="tabpanel">
+        <div class="tab-pane" id="pane-legal" role="tabpanel">
         <div class="license-content">
             <h2>Rechtsgrundlage der Nutzung</h2>
             <p>Um das Inventarsystem DSGVO-konform zu betreiben, muss der Betreiber eine der folgenden Grundlagen festlegen:</p>
@@ -170,9 +169,6 @@
                     Einwilligung vorliegen (Art. 6 Abs. 1 lit. a DSGVO).</li>
             </ol>
         </div>
-        </div><!-- /#pane-legal -->
-
-        </div><!-- /.tab-content -->
     </div>
 </div>
 

Web/templates/main.html

@@ -269,23 +269,6 @@
         line-height: 1;
     }
 
-    /* Compact appointment badge on cards */
-    .appointment-badge {
-        margin-top: 10px;
-        padding: 10px 12px;
-        background-color: #e1f5fe;
-        border-left: 4px solid #03a9f4;
-        border-radius: 4px;
-        font-size: 0.9rem;
-        line-height: 1.3;
-    }
-    .appointment-badge .appointment-time {
-        display: inline-block;
-        margin-top: 4px;
-        color: #01579b;
-        font-weight: 600;
-    }
-
     /* Search styles */
     .search-container {
         display: flex;
@@ -390,7 +373,7 @@
             
             <div class="filter-group">
                 <div class="filter-header">
-                    <label>Thema:</label>
+                    <label>Schlagwort:</label>
                     <button type="button" class="filter-toggle" onclick="toggleFilterDropdown('filter3-dropdown')">▼</button>
                     <button type="button" class="clear-filter" onclick="clearFilter(3)">Clear</button>
                 </div>
@@ -437,7 +420,7 @@
             <span>Ort</span>
             <span>Unterrichtsfach</span>
             <span>Jahrgangsstufe</span>
-            <span>Thema</span>
+            <span>Schlagwort</span>
             <span>Barcode</span>
         </div>
         <div id="items-container" class="items-container">
@@ -542,8 +525,7 @@
     
     window.isDebug = false; // Set to true only for development environment
 </script>
-
-<script src="https://unpkg.com/html5-qrcode@2.0.9/dist/html5-qrcode.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/@ericblade/quagga2/dist/quagga.js"></script>
 <script>
     // Global state
     const highlightItemId = (window.serverVars && window.serverVars.highlightItemId && window.serverVars.highlightItemId !== 'null')
@@ -552,51 +534,114 @@
     let codeSearchTerm = '';
     let descSearchIds = null; // Set of matching IDs or null when disabled
 
-    // QR scanner toggle setup
-    document.addEventListener('DOMContentLoaded', function() {
-        const scanButton = document.getElementById('scanButton');
+    // Keep track of the scanner state globally/outer scope
+    let isScanning = false; 
+    let activeScannerCallback = null; // Tracks which function currently owns the scanner output
+
+    function startScanner(targetCallback) {
         const qrReader = document.getElementById('qr-reader');
-        let html5QrcodeScanner = null;
+        const statusText = document.getElementById('status');
 
-        if (!scanButton || !qrReader) return;
+        // Store the custom action that should happen when a barcode is found
+        activeScannerCallback = targetCallback;
 
-        const setScannerUi = (isOpen) => {
-            scanButton.classList.toggle('is-active', isOpen);
-            scanButton.setAttribute('aria-expanded', isOpen ? 'true' : 'false');
-            scanButton.textContent = isOpen ? 'Scanner schliessen' : 'Barcode scannen';
-        };
+        // Show the container
+        if (qrReader) qrReader.style.display = 'block';
+        if (statusText) statusText.innerText = "Initializing camera...";
 
-        scanButton.addEventListener('click', function() {
-            if (qrReader.style.display !== 'block') {
-                qrReader.style.display = 'block';
-                
-                html5QrcodeScanner = new Html5QrcodeScanner(
-                    'qr-reader', { fps: 10, qrbox: 250 }
-                );
-                
-                html5QrcodeScanner.render((decodedText) => {
-                    html5QrcodeScanner.clear();
-                    qrReader.style.display = 'none';
-                    
-                    // Put scanned code into the search box and trigger search
-                    const searchInput = document.getElementById('code-search');
-                    if (searchInput) {
-                        searchInput.value = decodedText;
-                        searchByCode();
-                    }
-
-                    setScannerUi(false);
-                });
-
-                setScannerUi(true);
-            } else {
-                if (html5QrcodeScanner) {
-                    html5QrcodeScanner.clear();
-                }
-                qrReader.style.display = 'none';
-                setScannerUi(false);
+        Quagga.init({
+            inputStream: {
+                name: "Live",
+                type: "LiveStream",
+                // Make sure this targets your correct HTML container element 
+                target: document.querySelector('#scanner-container'), 
+                constraints: {
+                    width: 640,
+                    height: 480,
+                    facingMode: "environment" // Force rear camera
+                },
+            },
+            decoder: {
+                // Your required formats mapped to Quagga2 reader strings
+                readers: ["code_128_reader", "ean_reader", "code_39_reader", "upc_reader"]
+            } 
+        }, function(err) {
+            if (err) {
+                console.error("Initialization error:", err);
+                if (statusText) statusText.innerText = "Camera Error";
+                return;
             }
+
+            Quagga.start();
+            isScanning = true;
+
+            // If we are using the main search button, manage its UI state
+            if (!targetCallback) {
+                setScannerUi(true);
+            }
+
+            if (statusText) statusText.innerText = "Scanning...";
         });
+    }
+
+    function stopScanner() {
+        Quagga.stop();
+        isScanning = false;
+        activeScannerCallback = null; // Reset the callback routing
+
+        const qrReader = document.getElementById('qr-reader');
+        if (qrReader) qrReader.style.display = 'none';
+
+        setScannerUi(false);
+    }
+
+    function setScannerUi(isOpen) {
+        const scanBtn = document.getElementById('scanButton');
+        if (!scanBtn) return;
+
+        scanBtn.classList.toggle('is-active', isOpen);
+        scanBtn.setAttribute('aria-expanded', isOpen ? 'true' : 'false');
+        scanBtn.textContent = isOpen ? 'Scanner schliessen' : 'Barcode scannen';
+    }
+
+    // Unified global reader callback
+    Quagga.onDetected(function(data) {
+        const barcode = String(data.codeResult.code || '').trim();
+        console.log("Barcode detected:", barcode);
+
+        // Keep a local reference to the active callback before shutting down the engine
+        const currentCallback = activeScannerCallback;
+
+        // Critical: Stop scanning immediately to prevent multiple triggers
+        stopScanner();
+
+        // Route data based on who opened the scanner
+        if (typeof currentCallback === "function") {
+            // Send data directly to the specific edit field's logic
+            currentCallback(barcode);
+        } else {
+            // Fallback Default: Main search box logic
+            const resultText = document.getElementById('barcode-result');
+            if (resultText) resultText.innerText = barcode;
+
+            const searchInput = document.getElementById('code-search');
+            if (searchInput) {
+                searchInput.value = barcode;
+                if (typeof searchByCode === "function") {
+                    searchByCode();
+                }
+            }
+        }
+    });
+
+    // Event Listener for the main standalone search button
+    document.getElementById('scanButton')?.addEventListener('click', function() {
+        if (!isScanning) {
+            // Pass null so it defaults to filling the standard search box
+            startScanner(null); 
+        } else {
+            stopScanner();
+        }
     });
 
     // Return preferred primary and fallback image URLs based on extension
@@ -1006,30 +1051,13 @@
                                 </div>`;
                         }
                         
-                        // Add appointment badge if item has upcoming appointments
-                        let appointmentBadge = '';
-                        if (item.appointments && Array.isArray(item.appointments) && item.appointments.length > 0) {
-                            const upcomingAppointment = getUpcomingAppointment(item.appointments);
-                            if (upcomingAppointment) {
-                                const formattedDate = formatAppointmentDate(upcomingAppointment.date);
-                                const startPeriod = formatAppointmentPeriod(upcomingAppointment.start_period);
-                                const endPeriod = formatAppointmentPeriod(upcomingAppointment.end_period);
-                                
-                                appointmentBadge = `
-                                    <div class="appointment-badge">
-                                        <strong>Geplant für:</strong> ${formattedDate}<br>
-                                        <span class="appointment-time">${startPeriod}${endPeriod && endPeriod !== startPeriod ? ' - ' + endPeriod : ''}</span>
-                                    </div>`;
-                            }
-                        }
-
                         card.innerHTML = `
                             <div class="card-content" data-item-id="${item._id}">
                                 <h3 class="item-col-name">${item.Name}</h3>
                                 <p class="item-col-location"><strong>Ort:</strong> ${item.Ort || '-'}</p>
                                 <p class="item-col-filter1"><strong>Unterrichtsfach:</strong> ${filter1Display}${filter1More}</p>
                                 <p class="item-col-filter2"><strong>Jahrgangsstufe:</strong> ${filter2Display}${filter2More}</p>
-                                <p class="item-col-filter3"><strong>Thema:</strong> ${filter3Display}${filter3More}</p>
+                                <p class="item-col-filter3"><strong>Schlagwort:</strong> ${filter3Display}${filter3More}</p>
                                 <p class="item-col-code"><strong>Barcode:</strong> ${item.Code_4 || '-'}</p>
                                 <p class="item-col-count"><strong>Anzahl:</strong> ${groupedCount}</p>
                                 ${isGroupedItem ? `<p class="item-col-count"><strong>Verfügbar:</strong> ${availableGroupedCount}</p>` : ''}
@@ -1037,7 +1065,6 @@
                                     ${imagesHtml}
                                 </div>
                                 ${borrowerBadge}
-                                ${appointmentBadge}
                             </div>
                             <div class="actions">
                                 ${isAvailableForBorrow && !item.BlockedNow ? 
@@ -1614,27 +1641,6 @@
             `;
         }
         
-        // Add appointment info panel if item has appointments
-        let appointmentInfoHtml = '';
-        if (item.appointments && Array.isArray(item.appointments) && item.appointments.length > 0) {
-            const upcomingAppointment = getUpcomingAppointment(item.appointments);
-            if (upcomingAppointment) {
-                const formattedDate = formatAppointmentDate(upcomingAppointment.date);
-                const startPeriod = formatAppointmentPeriod(upcomingAppointment.start_period);
-                const endPeriod = formatAppointmentPeriod(upcomingAppointment.end_period);
-                const timeDisplay = startPeriod + (endPeriod && endPeriod !== startPeriod ? ' - ' + endPeriod : '');
-                
-                appointmentInfoHtml = `
-                    <div class="appointment-info-panel">
-                        <h4>Geplanter Termin</h4>
-                        <p class="appointment-date">Datum: ${formattedDate}</p>
-                        <p class="appointment-time">Zeit: ${timeDisplay}</p>
-                        ${upcomingAppointment.notes ? `<p class="appointment-notes">Notizen: ${upcomingAppointment.notes}</p>` : ''}
-                    </div>
-                `;
-            }
-        }
-        
         // Build modal content HTML
         modalContent.innerHTML = `
             <h2>${item.Name}</h2>
@@ -1642,7 +1648,6 @@
                 <button type="button" class="bookmark-btn" id="modal-bookmark-btn" title="Merken">${(window.currentFavorites||new Set()).has(item._id) ? '★' : '☆'}</button>
             </div>
             ${borrowerInfoHtml}
-            ${appointmentInfoHtml}
             
             <div class="modal-image-container">
                 ${imagesHtml}
@@ -1677,7 +1682,7 @@
                 </div>
                 
                 <div class="detail-group">
-                    <div class="detail-label">Thema:</div>
+                    <div class="detail-label">Schlagwort:</div>
                     <div class="detail-value">${filter3Array.join(', ') || '-'}</div>
                 </div>
                 
@@ -2804,66 +2809,6 @@
         }
     }
 
-    // Helper functions for appointment display
-    function formatAppointmentDate(dateString) {
-        if (!dateString) return '';
-        try {
-                       const date = new Date(dateString);
-            return date.toLocaleDateString('de-DE', {
-                day: '2-digit',
-                month: '2-digit',
-                year: 'numeric'
-            });
-        } catch (e) {
-            return dateString;
-        }
-    }
-
-    function formatAppointmentPeriod(period) {
-        if (!period) return '';
-        const periodMap = {
-            '1': '1. Stunde',
-            '2': '2. Stunde',
-            '3': '3. Stunde',
-            '4': '4. Stunde',
-            '5': '5. Stunde',
-            '6': '6. Stunde',
-            '7': '7. Stunde',
-            '8': '8. Stunde',
-            '9': '9. Stunde',
-            '10': '10. Stunde',
-            'pause1': '1. Pause',
-            'pause2': '2. Pause',
-            'mittagspause': 'Mittagspause'
-        };
-        return periodMap[period] || period;
-    }
-
-    function getUpcomingAppointment(appointments) {
-        if (!appointments || !Array.isArray(appointments) || appointments.length === 0) {
-            return null;
-        }
-        
-        const now = new Date();
-        const today = now.toDateString();
-        
-        // Filter appointments that are today or in the future
-        const futureAppointments = appointments.filter(apt => {
-            try {
-                const aptDate = new Date(apt.date);
-                return aptDate.toDateString() === today || aptDate >= now.setHours(0, 0, 0, 0);
-            } catch (e) {
-                return false;
-            }
-        });
-        
-        if (futureAppointments.length === 0) return null;
-        
-        // Sort by date and return the earliest
-        futureAppointments.sort((a, b) => new Date(a.date) - new Date(b.date));
-        return futureAppointments[0];
-    }
-
     function formatDateForInput(dateString) {
         const options = { year: 'numeric', month: '2-digit', day: '2-digit' };
         const date = new Date(dateString);
@@ -3947,16 +3892,6 @@
     .borrower-info-panel h4 { color: #856404; margin: 0 0 10px 0; font-size: 1.1rem; }
     .borrower-name, .borrow-time { margin: 5px 0; color: #856404; font-weight: 500; }
 
-    .appointment-info-panel {
-        background-color: #e1f5fe;
-        border: 1px solid #81d4fa;
-        border-radius: 5px;
-        padding: 15px;
-        margin-bottom: 20px;
-    }
-    .appointment-info-panel h4 { color: #0277bd; margin: 0 0 10px 0; font-size: 1.1rem; }
-    .appointment-date, .appointment-time, .appointment-user { margin: 5px 0; color: #0277bd; font-weight: 500; }
-
     /* Modal Details Styling (text formatting) */
     .modal-details { margin: 20px 0; }
     .detail-group { display: flex; margin-bottom: 10px; align-items: flex-start; }

Web/templates/main_admin.html

@@ -2395,7 +2395,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
             
             <div class="filter-group">
                 <div class="filter-header">
-                    <label>Thema:</label>
+                    <label>Schlagwort:</label>
                     <button type="button" class="filter-toggle" onclick="toggleFilterDropdown('filter3-dropdown')">▼</button>
                     <button type="button" class="clear-filter" onclick="clearFilter(3)">Clear</button>
                 </div>
@@ -2435,7 +2435,10 @@ document.addEventListener('DOMContentLoaded', ()=>{
         </div>
         <div class="qr-container">
             <button id="scanButton" class="scan-button" aria-controls="qr-reader" aria-expanded="false">Barcode scannen</button>
-            <div id="qr-reader"></div>
+            <div id="qr-reader" style="display: none;">
+                <h3>Status: <span id="status">Bereit</span></h3>
+                <div id="scanner-container"></div>
+            </div>
         </div>
 
         <div id="table-view-header" class="table-view-header" aria-hidden="true">
@@ -2443,7 +2446,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
             <span>Ort</span>
             <span>Unterrichtsfach</span>
             <span>Jahrgangsstufe</span>
-            <span>Thema</span>
+            <span>Schlagwort</span>
             <span>Barcode</span>
             <span>Anzahl</span>
         </div>
@@ -2564,7 +2567,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                         </div>
                     </div>
                     
-                    <h3>Thema:</h3>
+                    <h3>Schlagwort:</h3>
                     <div class="multi-filter">
                         <div class="form-group">
                             <label for="edit-filter3-1">Wert 1:</label>
@@ -2729,7 +2732,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
     
     window.isDebug = false; // Set to true only for development environment
 </script>
-<script src="https://unpkg.com/html5-qrcode@2.0.9/dist/html5-qrcode.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/@ericblade/quagga2/dist/quagga.js"></script>
 <script>
     // Function to check if a file is a video
     function isVideoFile(filename) {
@@ -2739,7 +2742,6 @@ document.addEventListener('DOMContentLoaded', ()=>{
     }
 
     // Initialize QR Code scanner and global variables
-    let html5QrcodeScanner = null;
     let codeSearchTerm = '';
     let descSearchIds = null; // Set of matching IDs or null when disabled
     let currentUsername = '';
@@ -2768,51 +2770,114 @@ document.addEventListener('DOMContentLoaded', ()=>{
         // No-op in production
         return;
     }
-    
-    document.getElementById('scanButton').addEventListener('click', function() {
-        const qrReader = document.getElementById('qr-reader');
-        const scanBtn = document.getElementById('scanButton');
 
-        const setScannerUi = (isOpen) => {
-            if (!scanBtn) return;
-            scanBtn.classList.toggle('is-active', isOpen);
-            scanBtn.setAttribute('aria-expanded', isOpen ? 'true' : 'false');
-            scanBtn.textContent = isOpen ? 'Scanner schliessen' : 'Barcode scannen';
-        };
-        
-        if (qrReader.style.display === 'none') {
-            qrReader.style.display = 'block';
-            
-            html5QrcodeScanner = new Html5QrcodeScanner(
-                "qr-reader", { 
-                    fps: 10, 
-                    qrbox: 250,
-                    rememberLastUsedCamera: true
-                }
-            );
-            
-            html5QrcodeScanner.render((decodedText) => {
-                html5QrcodeScanner.clear();
-                qrReader.style.display = 'none';
-                
-                // Instead of navigating to the URL, put the scanned code in the search box
-                const searchInput = document.getElementById('code-search');
-                if (searchInput) {
-                    searchInput.value = decodedText;
-                    // Trigger search automatically
+    // Keep track of the scanner state globally/outer scope
+    let isScanning = false; 
+    let activeScannerCallback = null; // Tracks which function currently owns the scanner output
+
+    function startScanner(targetCallback) {
+        const qrReader = document.getElementById('qr-reader');
+        const statusText = document.getElementById('status');
+
+        // Store the custom action that should happen when a barcode is found
+        activeScannerCallback = targetCallback;
+
+        // Show the container
+        if (qrReader) qrReader.style.display = 'block';
+        if (statusText) statusText.innerText = "Initializing camera...";
+
+        Quagga.init({
+            inputStream: {
+                name: "Live",
+                type: "LiveStream",
+                // Make sure this targets your correct HTML container element 
+                target: document.querySelector('#scanner-container'), 
+                constraints: {
+                    width: 640,
+                    height: 480,
+                    facingMode: "environment" // Force rear camera
+                },
+            },
+            decoder: {
+                // Your required formats mapped to Quagga2 reader strings
+                readers: ["code_128_reader", "ean_reader", "code_39_reader", "upc_reader"]
+            } 
+        }, function(err) {
+            if (err) {
+                console.error("Initialization error:", err);
+                if (statusText) statusText.innerText = "Camera Error";
+                return;
+            }
+
+            Quagga.start();
+            isScanning = true;
+
+            // If we are using the main search button, manage its UI state
+            if (!targetCallback) {
+                setScannerUi(true);
+            }
+
+            if (statusText) statusText.innerText = "Scanning...";
+        });
+    }
+
+    function stopScanner() {
+        Quagga.stop();
+        isScanning = false;
+        activeScannerCallback = null; // Reset the callback routing
+
+        const qrReader = document.getElementById('qr-reader');
+        if (qrReader) qrReader.style.display = 'none';
+
+        setScannerUi(false);
+    }
+
+    function setScannerUi(isOpen) {
+        const scanBtn = document.getElementById('scanButton');
+        if (!scanBtn) return;
+
+        scanBtn.classList.toggle('is-active', isOpen);
+        scanBtn.setAttribute('aria-expanded', isOpen ? 'true' : 'false');
+        scanBtn.textContent = isOpen ? 'Scanner schliessen' : 'Barcode scannen';
+    }
+
+    // Unified global reader callback
+    Quagga.onDetected(function(data) {
+        const barcode = String(data.codeResult.code || '').trim();
+        console.log("Barcode detected:", barcode);
+
+        // Keep a local reference to the active callback before shutting down the engine
+        const currentCallback = activeScannerCallback;
+
+        // Critical: Stop scanning immediately to prevent multiple triggers
+        stopScanner();
+
+        // Route data based on who opened the scanner
+        if (typeof currentCallback === "function") {
+            // Send data directly to the specific edit field's logic
+            currentCallback(barcode);
+        } else {
+            // Fallback Default: Main search box logic
+            const resultText = document.getElementById('barcode-result');
+            if (resultText) resultText.innerText = barcode;
+
+            const searchInput = document.getElementById('code-search');
+            if (searchInput) {
+                searchInput.value = barcode;
+                if (typeof searchByCode === "function") {
                     searchByCode();
                 }
-
-                setScannerUi(false);
-            });
-
-            setScannerUi(true);
-        } else {
-            if (html5QrcodeScanner) {
-                html5QrcodeScanner.clear();
             }
-            qrReader.style.display = 'none';
-            setScannerUi(false);
+        }
+    });
+
+    // Event Listener for the main standalone search button
+    document.getElementById('scanButton')?.addEventListener('click', function() {
+        if (!isScanning) {
+            // Pass null so it defaults to filling the standard search box
+            startScanner(null); 
+        } else {
+            stopScanner();
         }
     });
 
@@ -2824,26 +2889,18 @@ document.addEventListener('DOMContentLoaded', ()=>{
             return;
         }
 
-        if (qrReader.style.display !== 'none') {
-            if (html5QrcodeScanner) {
-                html5QrcodeScanner.clear();
-            }
-            qrReader.style.display = 'none';
+        // Toggle close if it's already running
+        if (isScanning && qrReader.style.display !== 'none') {
+            stopScanner();
             scanEditBtn.textContent = 'Barcode scannen';
             return;
         }
 
-        qrReader.style.display = 'block';
         scanEditBtn.textContent = 'Scanner schließen';
-        html5QrcodeScanner = new Html5QrcodeScanner('qr-reader', { 
-            fps: 10, 
-            qrbox: 250,
-            rememberLastUsedCamera: true
-        });
-        html5QrcodeScanner.render((decodedText) => {
-            html5QrcodeScanner.clear();
-            qrReader.style.display = 'none';
-            editCodeInput.value = String(decodedText || '').trim();
+
+        // Start scanner with custom logic mapping to the Code input field
+        startScanner(function(decodedText) {
+            editCodeInput.value = decodedText;
             validateCodeField(editCodeInput, document.getElementById('edit-item-id')?.value || null);
             scanEditBtn.textContent = 'Barcode scannen';
         });
@@ -2857,26 +2914,18 @@ document.addEventListener('DOMContentLoaded', ()=>{
             return;
         }
 
-        if (qrReader.style.display !== 'none') {
-            if (html5QrcodeScanner) {
-                html5QrcodeScanner.clear();
-            }
-            qrReader.style.display = 'none';
+        // Toggle close if it's already running
+        if (isScanning && qrReader.style.display !== 'none') {
+            stopScanner();
             scanIsbnBtn.textContent = 'ISBN scannen';
             return;
         }
 
-        qrReader.style.display = 'block';
         scanIsbnBtn.textContent = 'Scanner schließen';
-        html5QrcodeScanner = new Html5QrcodeScanner('qr-reader', {
-            fps: 10,
-            qrbox: 250,
-            rememberLastUsedCamera: true
-        });
-        html5QrcodeScanner.render((decodedText) => {
-            html5QrcodeScanner.clear();
-            qrReader.style.display = 'none';
-            editIsbnInput.value = String(decodedText || '').trim();
+
+        // Start scanner with custom logic mapping to the ISBN input field
+        startScanner(function(decodedText) {
+            editIsbnInput.value = decodedText;
             scanIsbnBtn.textContent = 'ISBN scannen';
             if (typeof fetchBookInfo === 'function') {
                 fetchBookInfo('edit');
@@ -3637,7 +3686,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                                 <p class="item-col-location"><strong>Ort:</strong> ${item.Ort || '-'}</p>
                                 <p class="item-col-filter1"><strong>Unterrichtsfach:</strong> ${filter1Display}${filter1More}</p>
                                 <p class="item-col-filter2"><strong>Jahrgangsstufe:</strong> ${filter2Display}${filter2More}</p>
-                                <p class="item-col-filter3"><strong>Thema:</strong> ${filter3Display}${filter3More}</p>
+                                <p class="item-col-filter3"><strong>Schlagwort:</strong> ${filter3Display}${filter3More}</p>
                                 <p class="item-col-code"><strong>Barcode:</strong> ${item.Code_4 || '-'}</p>
                                 <p class="item-col-count"><strong>Anzahl:</strong> ${groupedCount}</p>
                                 ${hasDamage ? `<div class="damage-badge">${damageCount > 0 ? `Schäden gemeldet: ${damageCount}` : 'Schäden gemeldet'}</div>` : ''}
@@ -4180,7 +4229,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                 document.getElementById('edit-filter2-3').value = filter2Array[2] || '';
                 document.getElementById('edit-filter2-4').value = filter2Array[3] || '';
 
-                // Fill in filter 3 (Thema)
+                // Fill in filter 3 (Schlagwort)
                 const filter3Array = Array.isArray(item.Filter3) ? item.Filter3 : (item.Filter3 ? [item.Filter3] : []);
                 document.getElementById('edit-filter3-1').value = filter3Array[0] || '';
                 document.getElementById('edit-filter3-2').value = filter3Array[1] || '';
@@ -4494,7 +4543,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                 </div>
                 
                 <div class="detail-group">
-                    <div class="detail-label">Thema:</div>
+                    <div class="detail-label">Schlagwort:</div>
                     <div class="detail-value">${filter3Array.join(', ') || '-'}</div>
                 </div>
                 

Web/templates/maintenance.html

@@ -0,0 +1,28 @@
+{% extends "base.html" %}
+
+{% block title %}Wartungsarbeiten - Inventarsystem{% endblock %}
+
+{% block content %}
+<div class="container py-5">
+    <div class="row justify-content-center">
+        <div class="col-12 col-lg-8 col-xl-7">
+            <div class="card border-0 shadow-lg rounded-4 overflow-hidden">
+                <div class="card-header text-white" style="background: linear-gradient(135deg, #0f4c5c, #16697a);">
+                    <p class="text-uppercase small fw-semibold mb-1 opacity-75">Systemstatus</p>
+                    <h1 class="h3 mb-0 fw-bold">Wartungsarbeiten</h1>
+                </div>
+                <div class="card-body p-4 p-md-5 bg-white text-center">
+                    <div class="display-3 fw-bold text-warning mb-3">500</div>
+                    <p class="lead mb-2">Das System führt gerade Wartungsarbeiten durch.</p>
+                    <p class="text-muted mb-4">Bitte versuchen Sie es in wenigen Minuten erneut. Falls das Problem bestehen bleibt, informieren Sie bitte die Administration.</p>
+
+                    <div class="d-flex flex-column flex-sm-row justify-content-center gap-2">
+                        <a href="{{ url_for('login') }}" class="btn btn-primary btn-lg">Zum Login</a>
+                        <a href="javascript:history.back()" class="btn btn-outline-secondary btn-lg">Zurück</a>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+{% endblock %}

Web/templates/termin_client.html

@@ -0,0 +1,678 @@
+{% extends "base.html" %}
+
+{% block title %}Termin buchen - Inventarsystem{% endblock %}
+
+{% block head %}
+{{ super() }}
+<link href="https://cdn.jsdelivr.net/npm/fullcalendar@6.1.15/index.global.min.css" rel="stylesheet">
+<style>
+    #client-slot-calendar {
+        min-height: 520px;
+    }
+    .fc .fc-timegrid-slot-label-cushion,
+    .fc .fc-timegrid-axis-cushion,
+    .fc .fc-col-header-cell-cushion {
+        font-weight: 600;
+    }
+    .slot-selected-chip {
+        display: inline-flex;
+        align-items: center;
+        gap: .4rem;
+        border-radius: 999px;
+        background: rgba(13, 110, 253, 0.1);
+        color: #0d6efd;
+        padding: .35rem .75rem;
+        font-size: .9rem;
+        font-weight: 700;
+    }
+    .day-slider-wrap {
+        background: #f8f9fa;
+        border: 1px solid #e9ecef;
+        border-radius: .9rem;
+        padding: .8rem 1rem;
+    }
+</style>
+{% endblock %}
+
+{% block content %}
+<div class="container py-4">
+    <div class="row justify-content-center">
+        <div class="col-12 col-xxl-11">
+            <div class="row g-4">
+                
+                <div class="col-12 col-lg-4">
+                    <div class="card border-0 shadow-lg rounded-4 h-100">
+                        <div class="card-body p-4 p-md-5">
+                            <p class="text-uppercase text-muted fw-semibold mb-2">Terminplaner</p>
+                            {% if can_view_booking_names %}
+                                <h1 class="h3 fw-bold mb-3">Termin Übersicht - {{ available.title }}</h1>
+                                <p class="text-muted mb-4">Hier können Sie alle Buchungen, die bereits eingegangen sind, einsehen und verwalten.</p>
+                            {% else %}
+                                <h1 class="h3 fw-bold mb-3">Termin buchen - {{ available.title }}</h1>
+                                <p class="text-muted mb-4">Wählen Sie im Kalender einen freien Slot aus. Den gewählten Termin können Sie danach direkt wie in einem Kalender-Block verschieben.</p>
+                            {% endif %}
+                            
+                            <div class="p-3 rounded-3 bg-light mb-3">
+                                <div class="fw-semibold">Zeitraum</div>
+                                <div>{{ available.date_start }} bis {{ available.date_end }}</div>
+                            </div>
+                            <div class="p-3 rounded-3 bg-light mb-3">
+                                <div class="fw-semibold">Verfügbare Slots</div>
+                                <div>{{ available.slots_left }} von {{ available.slots_total }} frei</div>
+                            </div>
+                            <div class="p-3 rounded-3 bg-light mb-3">
+                                <div class="fw-semibold">Slot-Länge</div>
+                                <div>{{ available.slot_lenght }} Minuten</div>
+                            </div>
+                            
+                            {% if not can_view_booking_names %}
+                            <div class="p-3 rounded-3 bg-light mb-3">
+                                <div class="fw-semibold mb-2">Gewählter Termin</div>
+                                <div id="selected-slot-badge" class="text-muted small">Noch kein Slot ausgewählt.</div>
+                            </div>
+                            {% endif %}
+
+                            {% if available.slots_booked %}
+                            <div class="p-3 rounded-3 bg-light">
+                                <div class="fw-semibold mb-2">Bereits gebucht</div>
+                                <ul class="mb-0 small text-muted">
+                                    {% for booking in available.slots_booked %}
+                                    <li>
+                                        {% if booking is mapping %}
+                                            {{ booking.get('start', '') }} - Belegt
+                                        {% else %}
+                                            {{ booking[0] }} - {% if can_view_booking_names %}<span class="fw-semibold text-dark">{{ booking[1] }}</span>{% else %}Belegt{% endif %}
+                                        {% endif %}
+                                    </li>
+                                    {% endfor %}
+                                </ul>
+                            </div>
+                            {% endif %}
+                        </div>
+                    </div>
+                </div>
+
+                <div class="col-12 col-lg-8">
+                    <div class="card border-0 shadow-lg rounded-4 h-100">
+                        <div class="card-body p-4 p-md-5 bg-white">
+                            
+                            {% if can_view_booking_names %}
+                                <!-- ADMIN / AUTOREN ANSICHT -->
+                                <div class="d-flex flex-column flex-md-row justify-content-between align-items-md-center gap-3 mb-4">
+                                    <div>
+                                        <h2 class="h4 fw-bold mb-0">Eingegangene Buchungen</h2>
+                                        <div class="text-muted small">Verwalten Sie die Termine Ihrer Klienten</div>
+                                    </div>
+                                    <div class="d-flex gap-2 align-self-start align-self-md-center">
+                                        <!-- Neuer CSV Export Button -->
+                                        <a href="{{ url_for('terminplaner.export_csv', appointment_id=appointment_id) }}" class="btn btn-outline-success rounded-3 d-inline-flex align-items-center gap-2">
+                                            <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="bi bi-download" viewBox="0 0 16 16">
+                                                <path d="M.5 9.9a.5.5 0 0 1 .5.5v2.5a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1v2.5a.5.5 0 0 1 1 0v2.5a2 2 0 0 1-2 2H2a2 2 0 0 1-2-2v2.5a.5.5 0 0 1 .5-.5"/>
+                                                <path d="M7.646 11.854a.5.5 0 0 0 .708 0l3-3a.5.5 0 0 0-.708-.708L8.5 10.293V1.5a.5.5 0 0 0-1 0v8.793L5.354 8.146a.5.5 0 1 0-.708.708z"/>
+                                            </svg>
+                                            Excel / CSV Export
+                                        </a>
+                                        <span class="badge bg-primary rounded-pill fs-6 px-3 d-flex align-items-center">
+                                            {{ available.slots_total - available.slots_left }} von {{ available.slots_total }} belegt
+                                        </span>
+                                    </div>
+                                </div>
+                                <div class="bg-light p-3 rounded-3 mb-4">
+                                    <div class="row g-2 align-items-center">
+                                        <div class="col-12 col-md-8">
+                                            <label for="table-search" class="form-label small fw-semibold text-muted mb-1">Live-Filter (Name, Uhrzeit, Zusatzfelder...)</label>
+                                            <input type="text" id="table-search" class="form-control form-control-lg bg-white border" placeholder="Suchbegriff eingeben...">
+                                        </div>
+                                        <div class="col-12 col-md-4 d-flex align-items-end h-100 mt-md-4">
+                                            <button type="button" id="clear-filter-btn" class="btn btn-outline-secondary w-100 btn-lg">Filter zurücksetzen</button>
+                                        </div>
+                                    </div>
+                                </div>
+
+                                {% if available.slots_booked %}
+                                <div class="table-responsive">
+                                    <table class="table table-hover align-middle border-top" id="admin-booking-table">
+                                        <thead class="table-light">
+                                            <tr>
+                                                <th scope="col" class="py-3">Zeitpunkt</th>
+                                                <th scope="col" class="py-3">Name</th>
+                                                <!-- Spaltenüberschriften für Custom Fields -->
+                                                {% for field_label in custom_fields %}
+                                                <th scope="col" class="py-3">{{ field_label }}</th>
+                                                {% endfor %}
+                                                <th scope="col" class="py-3 text-end">Aktion</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="booking-table-body">
+                                            {# Wir loopen jetzt über die rohen DB-Daten statt über die beschnittene Service-Funktion #}
+                                            {% for booking in appointment_item.get('slots_booked', []) %}
+                                            <tr>
+                                                <!-- 1. ZEITPUNKT -->
+                                                <td class="fw-semibold text-primary py-3 text-nowrap">
+                                                    {{ booking[0] }}
+                                                </td>
+                                            
+                                                <!-- 2. CLIENT NAME -->
+                                                <td>
+                                                    <span class="fw-bold text-dark">{{ booking[1] }}</span>
+                                                </td>
+
+                                                <!-- 3. CUSTOM FIELDS (Präziser Index-Abgleich gegen Spaltenkopf) -->
+                                                {% for field in custom_fields %}
+                                                    <td>
+                                                        {# Prüft ob für dieses Feld eine Antwort am exakt gleichen Index existiert #}
+                                                        {% if booking|length > 2 and booking[2] and booking[2]|length > loop.index0 %}
+                                                            {% set answer = booking[2][loop.index0] %}
+                                                            {{ answer if answer else '<span class="text-muted small">-</span>'|safe }}
+                                                        {% else %}
+                                                            <span class="text-muted small">-</span>
+                                                        {% endif %}
+                                                    </td>
+                                                {% endfor %}
+                                                
+                                                <!-- 4. AKTION (LÖSCHEN) -->
+                                                <td class="text-end">
+                                                    <form method="post" action="{{ url_for('terminplaner.client', appointment_id=appointment_id, tenant=tenant_id) }}" onsubmit="return confirm('Möchten Sie diesen Termin wirklich löschen?');" class="d-inline">
+                                                        <input type="hidden" name="action" value="delete">
+                                                        <input type="hidden" name="slot_time" value="{{ booking[0] }}">
+                                                        <input type="hidden" name="target_client_name" value="{{ booking[1] }}">
+
+                                                        <button type="submit" class="btn btn-sm btn-outline-danger px-3 rounded-3">
+                                                            Löschen
+                                                        </button>
+                                                    </form>
+                                                </td>
+                                            </tr>
+                                            {% endfor %}
+                                        </tbody>
+                                    </table>
+                                </div>
+                                
+                                <div id="no-results-msg" class="text-center py-4 text-muted d-none">
+                                    Keine Buchungen entsprechen Ihrem Filter.
+                                </div>
+                                {% else %}
+                                <div class="text-center py-5 text-muted">
+                                    <p class="mb-0">Bisher sind noch keine Buchungen für diesen Terminplaner eingegangen.</p>
+                                </div>
+                                {% endif %}
+                                
+                                <div class="pt-4 border-top mt-4">
+                                    <a class="btn btn-outline-secondary btn-lg" href="{{ url_for('terminplaner.main', tenant=tenant_id) }}">Zur Übersicht</a>
+                                </div>
+
+                            {% else %}
+                                <h2 class="h4 fw-bold mb-3">Termin im Kalender auswählen</h2>
+
+                                <div class="day-slider-wrap mb-3">
+                                    <div class="d-flex justify-content-between align-items-center gap-2 mb-2">
+                                        <span class="small text-muted">Tag wählen</span>
+                                        <strong id="day-slider-label" class="small"></strong>
+                                    </div>
+                                    <input id="day-slider" type="range" class="form-range m-0" min="0" max="0" value="0">
+                                </div>
+
+                                <div id="client-slot-calendar" class="mb-4"></div>
+
+                                <form id="client-booking-form" method="post" action="{{ url_for('terminplaner.client', appointment_id=appointment_id, tenant=tenant_id) }}" class="vstack gap-3">
+                                    <div>
+                                        <label for="start_day_time" class="form-label fw-semibold">Gewünschter Zeitpunkt</label>
+                                        <input type="text" id="start_day_time" name="start_day_time" class="form-control form-control-lg" placeholder="Bitte im Kalender auswählen" readonly required>
+                                        <div class="form-text">Klicken Sie auf einen freien Slot oder verschieben Sie den gewählten Block.</div>
+                                    </div>
+                                    <div>
+                                        <label for="client_name" class="form-label fw-semibold">Ihr Name</label>
+                                        <input type="text" id="client_name" name="client_name" class="form-control form-control-lg" placeholder="Vor- und Nachname" required>
+                                    </div>
+                                
+                                    {% if custom_fields %}
+                                        {% for field_label in custom_fields %}
+                                        <div>
+                                            <label class="form-label fw-semibold">{{ field_label }}</label>
+                                            <input type="text" name="custom_answers" class="form-control form-control-lg" placeholder="{{ field_label }} eingeben" required>
+                                        </div>
+                                        {% endfor %}
+                                    {% endif %}
+                                    
+                                    <div class="d-flex flex-column flex-sm-row gap-2 pt-2">
+                                        <input type="hidden" name="action" value="book">
+                                        <button type="submit" class="btn btn-primary btn-lg">Termin buchen</button>
+                                        <a class="btn btn-outline-secondary btn-lg" href="{{ url_for('terminplaner.main', tenant=tenant_id) }}">Zur Übersicht</a>
+                                    </div>
+                                </form>
+                            {% endif %}
+
+                        </div>
+                    </div>
+                </div>
+                
+            </div>
+        </div>
+    </div>
+</div>
+
+<div class="modal fade" id="calendarDownloadModal" tabindex="-1" aria-hidden="true">
+    <div class="modal-dialog modal-dialog-centered">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h5 class="modal-title">Termin zum Kalender hinzufügen?</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Schließen"></button>
+            </div>
+            <div class="modal-body">
+                <p class="mb-2">Sie haben einen Termin ausgewählt.</p>
+                <p class="mb-0 small text-muted">Mit einem Klick auf ".ics herunterladen" können Sie den Termin in Apple/Google/Outlook-Kalender importieren.</p>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Abbrechen</button>
+                <button id="confirm-booking-only" type="button" class="btn btn-primary">Jetzt buchen</button>
+                <button id="confirm-booking-with-ics" type="button" class="btn btn-success">Buchen + .ics</button>
+            </div>
+        </div>
+    </div>
+</div>
+
+<script>
+document.addEventListener('DOMContentLoaded', function () {
+    const searchInput = document.getElementById('table-search');
+    const clearBtn = document.getElementById('clear-filter-btn');
+    const tableBody = document.getElementById('booking-table-body');
+    const noResultsMsg = document.getElementById('no-results-msg');
+
+    if (searchInput && tableBody) {
+        const rows = tableBody.querySelectorAll('tr');
+
+        searchInput.addEventListener('input', function () {
+            const query = this.value.toLowerCase().trim();
+            let visibleRowsCount = 0;
+
+            rows.forEach(row => {
+                // Liest den Textinhalt aller Spalten der Zeile aus
+                const rowText = row.textContent.toLowerCase();
+                
+                if (rowText.includes(query)) {
+                    row.classList.remove('d-none');
+                    visibleRowsCount++;
+                } else {
+                    row.classList.add('d-none');
+                }
+            });
+
+            // Falls kein Filterergebnis gefunden wurde, Nachricht einblenden
+            if (visibleRowsCount === 0 && query !== '') {
+                noResultsMsg.classList.remove('d-none');
+            } else {
+                noResultsMsg.classList.add('d-none');
+            }
+        });
+
+        // Filter zurücksetzen Button
+        if (clearBtn) {
+            clearBtn.addEventListener('click', function () {
+                searchInput.value = '';
+                rows.forEach(row => row.classList.remove('d-none'));
+                noResultsMsg.classList.add('d-none');
+                searchInput.focus();
+            });
+        }
+    }
+});
+</script>
+<script src="https://cdn.jsdelivr.net/npm/fullcalendar@6.1.15/index.global.min.js"></script>
+<script>
+    (function () {
+        const available = {{ available|tojson }};
+        const appointmentId = {{ appointment_id|tojson }};
+        const canViewBookingNames = {{ can_view_booking_names|tojson }}; // Injected from Flask
+        const slider = document.getElementById('day-slider');
+        const sliderLabel = document.getElementById('day-slider-label');
+        const sliderWrap = slider ? slider.closest('.day-slider-wrap') : null;
+        const selectedSlotInput = document.getElementById('start_day_time');
+        const selectedSlotBadge = document.getElementById('selected-slot-badge');
+        const clientNameInput = document.getElementById('client_name');
+        const form = document.getElementById('client-booking-form');
+        const calendarEl = document.getElementById('client-slot-calendar');
+        const modalEl = document.getElementById('calendarDownloadModal');
+        const confirmBookingOnlyBtn = document.getElementById('confirm-booking-only');
+        const confirmBookingWithIcsBtn = document.getElementById('confirm-booking-with-ics');
+        const modal = modalEl ? new bootstrap.Modal(modalEl) : null;
+
+        // Fallback for both spellings of slot length
+        const slotLength = Number.parseInt(available.slot_length || available.slot_lenght, 10) || 45;
+        const clientsPerSlot = Number.parseInt(available.clients_per_slot, 10) || 1;
+        const bookingsByTime = available.bookings_by_time || {};
+
+        function formatDateForInput(dateObj) {
+            const y = dateObj.getFullYear();
+            const m = String(dateObj.getMonth() + 1).padStart(2, '0');
+            const d = String(dateObj.getDate()).padStart(2, '0');
+            const hh = String(dateObj.getHours()).padStart(2, '0');
+            const mm = String(dateObj.getMinutes()).padStart(2, '0');
+            return y + '-' + m + '-' + d + ' ' + hh + ':' + mm;
+        }
+
+        function formatDateReadable(value) {
+            if (!value) return 'Noch kein Slot ausgewählt.';
+            return 'Ausgewählt: ' + value;
+        }
+
+        function dateRangeInclusive(startStr, endStr) {
+            const days = [];
+            const start = new Date(startStr + 'T00:00:00');
+            const end = new Date(endStr + 'T00:00:00');
+            if (Number.isNaN(start.getTime()) || Number.isNaN(end.getTime())) {
+                return days;
+            }
+            const cursor = new Date(start);
+            while (cursor <= end) {
+                const y = cursor.getFullYear();
+                const m = String(cursor.getMonth() + 1).padStart(2, '0');
+                const d = String(cursor.getDate()).padStart(2, '0');
+                days.push(y + '-' + m + '-' + d);
+                cursor.setDate(cursor.getDate() + 1);
+            }
+            return days;
+        }
+
+        function addMinutes(dateObj, minutes) {
+            return new Date(dateObj.getTime() + minutes * 60000);
+        }
+
+        function formatTimeForCalendar(dateObj) {
+            return String(dateObj.getHours()).padStart(2, '0') + ':' + String(dateObj.getMinutes()).padStart(2, '0') + ':00';
+        }
+
+        function addDays(dateStr, days) {
+            const d = new Date(dateStr + 'T00:00:00');
+            d.setDate(d.getDate() + days);
+            const y = d.getFullYear();
+            const m = String(d.getMonth() + 1).padStart(2, '0');
+            const day = String(d.getDate()).padStart(2, '0');
+            return y + '-' + m + '-' + day;
+        }
+
+        function parseTimeSpanEntry(entry) {
+            const value = String(entry || '').trim();
+            let m = value.match(/^(\d{4}-\d{2}-\d{2})\s+(\d{2}:\d{2})-(\d{2}:\d{2})$/);
+            if (m) {
+                return { date: m[1], from: m[2], to: m[3] };
+            }
+            m = value.match(/^(\d{2}:\d{2})-(\d{2}:\d{2})$/);
+            if (m) {
+                return { date: null, from: m[1], to: m[2] };
+            }
+            return null;
+        }
+
+        const fullyBookedSlots = [];
+
+        function buildCandidateSlots() {
+            const slots = [];
+            const allowedDates = dateRangeInclusive(String(available.date_start || ''), String(available.date_end || ''));
+            const spans = Array.isArray(available.time_span) ? available.time_span : [];
+
+            spans.forEach(function (entry) {
+                const parsed = parseTimeSpanEntry(entry);
+                if (!parsed) return;
+
+                const targetDates = parsed.date ? [parsed.date] : allowedDates;
+                targetDates.forEach(function (date) {
+                    const from = new Date(date + 'T' + parsed.from + ':00');
+                    const to = new Date(date + 'T' + parsed.to + ':00');
+                    if (Number.isNaN(from.getTime()) || Number.isNaN(to.getTime()) || from >= to) {
+                        return;
+                    }
+
+                    let cursor = new Date(from);
+                    while (addMinutes(cursor, slotLength) <= to) {
+                        const slotStart = formatDateForInput(cursor);
+                        const currentBookingsCount = bookingsByTime[slotStart] || 0;
+                        
+                        // Check if the current individual timestamp still has capacity left
+                        if (currentBookingsCount < clientsPerSlot) {
+                            slots.push({
+                                start: slotStart,
+                                end: formatDateForInput(addMinutes(cursor, slotLength)),
+                                bookingsCount: currentBookingsCount
+                            });
+                        } else {
+                            fullyBookedSlots.push({
+                                start: slotStart,
+                                end: formatDateForInput(addMinutes(cursor, slotLength))
+                            });
+                        }
+                        cursor = addMinutes(cursor, slotLength);
+                    }
+                });
+            });
+
+            return slots;
+        }
+
+        const candidateSlots = buildCandidateSlots();
+        const slotStartSet = new Set(candidateSlots.map(function (slot) { return slot.start; }));
+        const allDays = dateRangeInclusive(String(available.date_start || ''), String(available.date_end || ''));
+
+        let slotMinTime = '08:00:00';
+        let slotMaxTime = '20:00:00';
+
+        const visibleStart = allDays[0] || String(available.date_start || '');
+        const visibleEndExclusive = allDays.length > 0
+            ? addDays(allDays[allDays.length - 1], 1)
+            : addDays(String(available.date_end || available.date_start || ''), 1);
+
+        const multiDayDuration = Math.max(1, allDays.length || 1);
+        const initialViewName = multiDayDuration === 1 ? 'timeGridDay' : 'timeGridRange';
+        let selectedSlot = '';
+        let selectedEvent = null;
+        let allowImmediateSubmit = false;
+
+        const calendar = new FullCalendar.Calendar(calendarEl, {
+            initialView: initialViewName,
+            views: {
+                timeGridRange: {
+                    type: 'timeGrid',
+                    duration: { days: multiDayDuration },
+                    buttonText: 'Zeitraum'
+                }
+            },
+            locale: 'de',
+            firstDay: 1,
+            height: 'auto',
+            allDaySlot: false,
+            editable: true,
+            eventStartEditable: true,
+            eventDurationEditable: false,
+            selectable: false,
+            slotDuration: '00:15:00',
+            snapDuration: '00:15:00',
+            slotMinTime: slotMinTime,
+            slotMaxTime: slotMaxTime,
+            nowIndicator: true,
+            validRange: { start: visibleStart, end: visibleEndExclusive },
+            visibleRange: { start: visibleStart, end: visibleEndExclusive },
+            headerToolbar: {
+                left: '',
+                center: 'title',
+                right: multiDayDuration === 1 ? '' : 'timeGridDay,timeGridRange'
+            },
+            events: [],
+            eventDrop: function (info) {
+                if (info.event.id !== 'selected-slot') return;
+                const droppedStart = formatDateForInput(info.event.start);
+                if (!slotStartSet.has(droppedStart)) {
+                    info.revert();
+                    window.alert('Dieser Zeitpunkt ist ausgebucht oder nicht verfügbar.');
+                    return;
+                }
+                applySelectedSlot(droppedStart);
+            },
+            eventClick: function (info) {
+                const slotType = info.event.extendedProps ? info.event.extendedProps.slotType : '';
+                if (slotType !== 'free') return;
+                applySelectedSlot(info.event.extendedProps.slotStart || '');
+            }
+        });
+
+        function updateSliderLabel() {
+            const dateList = dateRangeInclusive(String(available.date_start || ''), String(available.date_end || ''));
+            const idx = Number.parseInt(slider.value, 10) || 0;
+            sliderLabel.textContent = dateList[idx] || '';
+        }
+
+        function applySelectedSlot(value) {
+            selectedSlot = String(value || '').trim();
+            selectedSlotInput.value = selectedSlot;
+            selectedSlotBadge.innerHTML = selectedSlot
+                ? '<span class="slot-selected-chip">' + selectedSlot + '</span>'
+                : 'Noch kein Slot ausgewählt.';
+
+            if (selectedEvent) {
+                selectedEvent.remove();
+                selectedEvent = null;
+            }
+
+            if (!selectedSlot) return;
+
+            const start = new Date(selectedSlot.replace(' ', 'T') + ':00');
+            const end = addMinutes(start, slotLength);
+            selectedEvent = calendar.addEvent({
+                id: 'selected-slot',
+                title: 'Ihr ausgewählter Termin',
+                start: start,
+                end: end,
+                color: '#0d6efd',
+                editable: true,
+            });
+
+            refreshIcsLink();
+        }
+
+        function getIcsDownloadUrl() {
+            const base = {{ url_for('terminplaner.client_slot_calendar_export', appointment_id=appointment_id, tenant=tenant_id)|tojson }};
+            const url = new URL(base, window.location.origin);
+            if (selectedSlot) url.searchParams.set('start', selectedSlot);
+            const name = String(clientNameInput.value || '').trim();
+            if (name) url.searchParams.set('name', name);
+            return url.toString();
+        }
+
+        function refreshIcsLink() {
+            const icsUrl = getIcsDownloadUrl();
+            if (confirmBookingWithIcsBtn) {
+                confirmBookingWithIcsBtn.setAttribute('data-ics-url', icsUrl);
+            }
+        }
+
+        // Render Active/Available Slots with Live Seat Counts
+        candidateSlots.forEach(function (slot) {
+            const start = new Date(slot.start.replace(' ', 'T') + ':00');
+            const end = new Date(slot.end.replace(' ', 'T') + ':00');
+            
+            let displayTitle = 'Freier Slot';
+            if (clientsPerSlot > 1) {
+                const remainingSeats = clientsPerSlot - slot.bookingsCount;
+                displayTitle += ' (' + remainingSeats + '/' + clientsPerSlot + ' frei)';
+            }
+
+            calendar.addEvent({
+                title: displayTitle,
+                start: start,
+                end: end,
+                color: '#0d6efd',
+                textColor: '#ffffff',
+                editable: false,
+                extendedProps: {
+                    slotStart: slot.start,
+                    slotType: 'free',
+                }
+            });
+        });
+
+        // Client View Optimization: Render solid red events ONLY if a slot is 100% full
+        fullyBookedSlots.forEach(function (slot) {
+            const start = new Date(slot.start.replace(' ', 'T') + ':00');
+            const end = new Date(slot.end.replace(' ', 'T') + ':00');
+            calendar.addEvent({
+                title: 'Ausgebucht',
+                start: start,
+                end: end,
+                color: '#dc3545',
+                editable: false,
+                display: 'block'
+            });
+        });
+
+        // Admin Management View: Render detailed name blocks exclusively for management interaction
+        if (canViewBookingNames) {
+            (available.slots_booked || []).forEach(function (booking) {
+                const startStr = String(booking.start || '').trim();
+                if (!startStr) return;
+                const start = new Date(startStr.replace(' ', 'T') + ':00');
+                const end = addMinutes(start, slotLength);
+                calendar.addEvent({
+                    title: 'Belegt: ' + (booking.name || 'Anonym'),
+                    start: start,
+                    end: end,
+                    color: '#9e9e9e',
+                    editable: false,
+                    display: 'block',
+                });
+            });
+        }
+
+        // Event Listeners and Setup
+        form.addEventListener('submit', function (ev) {
+            if (!selectedSlotInput.value) {
+                ev.preventDefault();
+                window.alert('Bitte zuerst im Kalender einen freien Slot auswählen.');
+                return;
+            }
+            if (allowImmediateSubmit) return;
+            ev.preventDefault();
+            if (modal) modal.show();
+        });
+
+        if (confirmBookingOnlyBtn) {
+            confirmBookingOnlyBtn.addEventListener('click', function () {
+                allowImmediateSubmit = true;
+                if (modal) modal.hide();
+                form.submit();
+            });
+        }
+
+        if (confirmBookingWithIcsBtn) {
+            confirmBookingWithIcsBtn.addEventListener('click', function () {
+                const icsUrl = confirmBookingWithIcsBtn.getAttribute('data-ics-url') || getIcsDownloadUrl();
+                if (icsUrl) window.open(icsUrl, '_blank');
+                allowImmediateSubmit = true;
+                if (modal) modal.hide();
+                form.submit();
+            });
+        }
+
+        clientNameInput.addEventListener('input', refreshIcsLink);
+
+        if (sliderWrap) {
+            sliderWrap.style.display = multiDayDuration > 1 ? '' : 'none';
+        }
+
+        slider.max = String(Math.max(0, allDays.length - 1));
+        slider.value = '0';
+        updateSliderLabel();
+        if (allDays.length > 0) {
+            calendar.gotoDate(allDays[0]);
+        }
+
+        slider.addEventListener('input', function () {
+            const idx = Number.parseInt(slider.value, 10) || 0;
+            updateSliderLabel();
+            if (allDays[idx] && calendar.view.type === 'timeGridDay') {
+                calendar.gotoDate(allDays[idx]);
+            }
+        });
+
+        calendar.render();
+        refreshIcsLink();
+    })();
+</script>
+{% endblock %}

Web/templates/termin_client_success.html

@@ -0,0 +1,121 @@
+<!DOCTYPE html>
+<html lang="de">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Buchung erfolgreich</title>
+    <style>
+        :root {
+            color-scheme: light;
+            --bg-a: #0f4c5c;
+            --bg-b: #16697a;
+            --ok: #22c55e;
+            --text: #0f172a;
+            --muted: #475569;
+            --card: #ffffff;
+        }
+        * {
+            box-sizing: border-box;
+        }
+        body {
+            margin: 0;
+            min-height: 100vh;
+            font-family: "Manrope", "Segoe UI", sans-serif;
+            background: radial-gradient(circle at 20% 20%, rgba(255,255,255,0.14), transparent 45%), linear-gradient(135deg, var(--bg-a), var(--bg-b));
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            padding: 2rem;
+        }
+        .success-window {
+            width: min(900px, 100%);
+            background: var(--card);
+            border-radius: 1.25rem;
+            box-shadow: 0 28px 70px rgba(2, 6, 23, 0.32);
+            padding: clamp(1.5rem, 4vw, 3rem);
+            text-align: center;
+        }
+        .badge {
+            width: 84px;
+            height: 84px;
+            margin: 0 auto 1.25rem auto;
+            border-radius: 50%;
+            display: grid;
+            place-items: center;
+            background: rgba(34, 197, 94, 0.12);
+            color: var(--ok);
+            font-size: 2rem;
+            font-weight: 800;
+        }
+        h1 {
+            margin: 0 0 0.9rem 0;
+            font-size: clamp(1.8rem, 5vw, 3rem);
+            color: var(--text);
+            line-height: 1.1;
+        }
+        p {
+            margin: 0;
+            font-size: 1.1rem;
+            color: var(--muted);
+        }
+        .meta {
+            margin-top: 1.4rem;
+            padding: 1rem;
+            border-radius: 0.9rem;
+            background: #f8fafc;
+            color: #0f172a;
+            font-weight: 600;
+        }
+        .actions {
+            margin-top: 1.8rem;
+            display: flex;
+            justify-content: center;
+            gap: .75rem;
+            flex-wrap: wrap;
+        }
+        .btn {
+            border: 0;
+            border-radius: 0.8rem;
+            padding: .85rem 1.25rem;
+            font-size: 1rem;
+            font-weight: 700;
+            cursor: pointer;
+            text-decoration: none;
+            display: inline-flex;
+            align-items: center;
+            justify-content: center;
+        }
+        .btn-close {
+            background: #0f4c5c;
+            color: #fff;
+        }
+        .btn-link {
+            background: #e2e8f0;
+            color: #0f172a;
+        }
+    </style>
+</head>
+<body>
+    <main class="success-window" role="main" aria-live="polite">
+        <div class="badge">✓</div>
+        <h1>Buchung erfolgreich</h1>
+        <p>Sie können das Fenster jetzt schließen.</p>
+
+        {% if client_name or slot_start %}
+        <div class="meta">
+            {% if client_name %}
+            <div>Name: {{ client_name }}</div>
+            {% endif %}
+            {% if slot_start %}
+            <div>Termin: {{ slot_start }}</div>
+            {% endif %}
+        </div>
+        {% endif %}
+
+        <div class="actions">
+            <button class="btn btn-close" type="button" onclick="window.close()">Fenster schließen</button>
+            <a class="btn btn-link" href="{{ url_for('terminplaner.client', appointment_id=appointment_id, tenant=tenant_id) }}">Zurück zur Buchungsseite</a>
+        </div>
+    </main>
+</body>
+</html>

Web/templates/termin_configure.html

@@ -0,0 +1,460 @@
+{% extends "base.html" %}
+
+{% block title %}Terminplan konfigurieren - Inventarsystem{% endblock %}
+
+{% block content %}
+<div class="container py-4">
+    <div class="row justify-content-center">
+        <div class="col-12 col-lg-10 col-xl-8">
+            <div class="card border-0 shadow-lg rounded-4 overflow-hidden">
+                <div class="card-header text-white" style="background: linear-gradient(135deg, #0f4c5c, #16697a);">
+                    <h1 class="h3 mb-1 fw-bold">Terminplan konfigurieren</h1>
+                    <p class="mb-0 opacity-75">Erstellen Sie einen neuen Plan und verschicken Sie anschließend den Buchungslink.</p>
+                </div>
+                <div class="card-body p-4 p-md-5 bg-white">
+                    <form method="post" action="{{ url_for('terminplaner.configure') }}" class="vstack gap-3">
+                        <div class="row g-3">
+                            <div class="col-12">
+                                <label for="title" class="form-label fw-semibold">Titel des Terminplans</label>
+                                <input type="text" id="title" name="title" class="form-control form-control-lg" placeholder="z.B. Elternsprechtag Klasse 10a" value="{{ title or '' }}">
+                            </div>
+                            <div class="col-12 col-md-6">
+                                <label for="start_date" class="form-label fw-semibold">Startdatum</label>
+                                <input type="date" id="start_date" name="start_date" class="form-control form-control-lg">
+                            </div>
+                            <div class="col-12 col-md-6">
+                                <label for="end_date" class="form-label fw-semibold">Enddatum</label>
+                                <input type="date" id="end_date" name="end_date" class="form-control form-control-lg">
+                            </div>
+                        </div>
+
+                        <div class="border rounded-4 p-3 p-md-4 bg-light-subtle">
+                            <div class="d-flex flex-column flex-md-row justify-content-between align-items-md-center gap-2 mb-2">
+                                <div>
+                                    <label class="form-label fw-semibold mb-0">Zeitfenster pro Tag</label>
+                                    <div class="form-text mb-0">Die Start-, End- und Pausenzeiten werden auf alle erzeugten Tage angewandt.</div>
+                                </div>
+                                <button type="button" class="btn btn-outline-primary btn-sm" id="build_time_frame">Tage aus Zeitraum erzeugen</button>
+                            </div>
+
+                            <div class="row g-3 mb-3">
+                                <div class="col-12 col-sm-6 col-lg-3">
+                                    <label for="default_day_start" class="form-label fw-semibold">Standard-Start</label>
+                                    <input type="time" id="default_day_start" class="form-control" value="08:00">
+                                </div>
+                                <div class="col-12 col-sm-6 col-lg-3">
+                                    <label for="default_day_end" class="form-label fw-semibold">Standard-Ende</label>
+                                    <input type="time" id="default_day_end" class="form-control" value="16:00">
+                                </div>
+                                <div class="col-12 col-sm-6 col-lg-3">
+                                    <label for="default_pause_start" class="form-label fw-semibold text-danger">Pause von</label>
+                                    <input type="time" id="default_pause_start" class="form-control border-danger-subtle" value="12:00">
+                                </div>
+                                <div class="col-12 col-sm-6 col-lg-3">
+                                    <label for="default_pause_end" class="form-label fw-semibold text-danger">Pause bis</label>
+                                    <input type="time" id="default_pause_end" class="form-control border-danger-subtle" value="12:45">
+                                </div>
+                            </div>
+
+                            <div id="time_frame_days" class="vstack gap-2"></div>
+
+                            <div class="mt-3">
+                                <label for="time_frame" class="form-label fw-semibold">Gespeichertes Zeitfenster (Übertragung ans Backend)</label>
+                                <textarea id="time_frame" name="time_frame" class="form-control font-monospace" rows="5" placeholder="Wird automatisch aus den Tagen erzeugt" readonly></textarea>
+                                <div class="form-text">Pausen teilen den Tag automatisch in zwei buchbare Blöcke, sodass die Pause sicher blockiert ist.</div>
+                            </div>
+                        </div>
+
+                        <div class="row g-3">
+                            <div class="col-12 col-md-6">
+                                <label for="slot_length" class="form-label fw-semibold">Slot-Länge in Minuten</label>
+                                <input type="number" id="slot_length" name="slot_length" class="form-control form-control-lg" min="1" value="45">
+                            </div>
+                            <div>
+                                <label class="form-label fw-semibold text-primary">Nutzer pro Slot</label>
+                                <input type="number" id="clients_per_slot" name="clients_per_slot" value="1">
+                            </div>
+                            <div class="col-12 col-md-6">
+                                <label class="form-label fw-semibold text-primary">Automatisch berechnete Slots</label>
+                                <div id="slots_amounts_display" class="form-control form-control-lg bg-primary-subtle text-primary fw-bold d-flex align-items-center">0</div>
+                                <input type="hidden" id="slots_amounts" name="slots_amounts" value="0">
+                                <div class="form-text">Wird aus der gebuchten Zeit (abzüglich Pausen) und der Slot-Länge berechnet.</div>
+                            </div>
+                        </div>
+                        <div id="custom-fields-container" class="mt-4">
+                            <h3 class="mb-3">Benutzerdefinierte Felder</h3>
+
+                            <div class="mb-3 custom-field-row">
+                                <input type="text" 
+                                       name="custom_fields" 
+                                       class="form-control form-control-lg custom-dynamic-input" 
+                                       placeholder="Zusatzfeld hinzufügen (z.B. Firma, Kundennummer...)">
+                            </div>
+                        </div>
+
+                        {% if mail_service_enabled %}
+                            <div>
+                                <label for="mail" class="form-label fw-semibold">Empfänger-Mails</label>
+                                <input type="text" id="mail" name="mail" class="form-control" placeholder="adresse1@schule.de, adresse2@schule.de">
+                            </div>
+
+                            <div>
+                                <label for="note" class="form-label fw-semibold">Notiz</label>
+                                <textarea id="note" name="note" class="form-control" rows="4" placeholder="Optionaler Einführungstext für die Mail"></textarea>
+                            </div>
+                        {% endif %}
+                        <div class="form-check">
+                            <input class="form-check-input" type="checkbox" id="add_to_calendar" name="add_to_calendar" {% if add_to_calendar %}checked{% endif %}>
+                            <label class="form-check-label fw-semibold" for="add_to_calendar">Kalendereintrag für den Nutzer erzeugen</label>
+                            <div class="form-text">Erzeugt zusätzlich eine .ics-Datei, die in gängige Kalender importiert werden kann.</div>
+                        </div>
+
+                        <div class="d-flex flex-column flex-sm-row gap-2 pt-2">
+                            <button type="submit" class="btn btn-primary btn-lg">Terminplan erzeugen</button>
+                            <a class="btn btn-outline-secondary btn-lg" href="{{ url_for('terminplaner.main') }}">Zur Übersicht</a>
+                        </div>
+                    </form>
+                </div>
+            </div>
+
+            {% if generated_link %}
+            <div class="alert alert-success mt-4 shadow-sm rounded-4">
+                <div class="fw-bold mb-1">Buchungslink erstellt</div>
+                <div class="mb-2">
+                    {% if mail_service_enabled %}
+                        Teilen Sie diesen Link mit den Teilnehmenden oder versenden Sie ihn direkt per E-Mail.
+                    {% else %}
+                        Der E-Mail-Service ist deaktiviert. Teilen Sie diesen Link manuell mit den Teilnehmenden.
+                    {% endif %}
+                </div>
+                <a href="{{ generated_link }}" class="d-inline-block text-break">{{ generated_link }}</a>
+                {% if calendar_link %}
+                <div class="mt-3">
+                    <div class="fw-semibold mb-1">Kalendereintrag</div>
+                    <a href="{{ calendar_link }}" class="btn btn-outline-primary btn-sm">.ics herunterladen</a>
+                </div>
+                {% endif %}
+            </div>
+            {% endif %}
+        </div>
+    </div>
+</div>
+<script>
+(function () {
+    const startDateInput = document.getElementById('start_date');
+    const endDateInput = document.getElementById('end_date');
+    const buildButton = document.getElementById('build_time_frame');
+    const daysContainer = document.getElementById('time_frame_days');
+    const timeFrameTextarea = document.getElementById('time_frame');
+    
+    const defaultStartInput = document.getElementById('default_day_start');
+    const defaultEndInput = document.getElementById('default_day_end');
+    const defaultPauseStartInput = document.getElementById('default_pause_start');
+    const defaultPauseEndInput = document.getElementById('default_pause_end');
+    
+    const slotLengthInput = document.getElementById('slot_length');
+    const clientsperslot = document.getElementById('clients_per_slot')
+    const slotsAmountsInput = document.getElementById('slots_amounts');
+    const slotsAmountsDisplay = document.getElementById('slots_amounts_display'); 
+
+    if (!startDateInput || !endDateInput || !buildButton || !daysContainer || !timeFrameTextarea) {
+        return;
+    }
+
+    const weekdayFormatter = new Intl.DateTimeFormat('de-DE', {
+        weekday: 'short',
+        day: '2-digit',
+        month: '2-digit',
+        year: 'numeric',
+    });
+
+    function parseDate(value) {
+        if (!value) return null;
+        const parts = value.split('-').map(Number);
+        if (parts.length !== 3 || parts.some(Number.isNaN)) return null;
+        return new Date(parts[0], parts[1] - 1, parts[2]);
+    }
+
+    function formatDateForRow(date) {
+        return weekdayFormatter.format(date);
+    }
+
+    function formatDateForValue(date) {
+        const year = date.getFullYear();
+        const month = String(date.getMonth() + 1).padStart(2, '0');
+        const day = String(date.getDate()).padStart(2, '0');
+        return `${year}-${month}-${day}`;
+    }
+
+    function addDays(date, days) {
+        const copy = new Date(date);
+        copy.setDate(copy.getDate() + days);
+        return copy;
+    }
+
+    function timeToMinutes(timeStr) {
+        if (!timeStr) return 0;
+        const parts = timeStr.split(':').map(Number);
+        return parts[0] * 60 + parts[1];
+    }
+
+    function updateSlotsDisplay(totalSlots) {
+        if (slotsAmountsInput) slotsAmountsInput.value = totalSlots;
+        if (slotsAmountsDisplay) slotsAmountsDisplay.innerText = totalSlots + " Slots gesamt";
+    }
+
+    // Helper utility in case your timeToMinutes handler doesn't catch empty strings safely
+    function safeTimeToMinutes(timeString) {
+        if (!timeString || typeof timeString !== 'string' || !timeString.includes(':')) {
+            return 0; // Return 0 instead of NaN for empty or missing values
+        }
+        const parts = timeString.split(':');
+        const hours = parseInt(parts[0], 10);
+        const minutes = parseInt(parts[1], 10);
+        if (isNaN(hours) || isNaN(minutes)) return 0;
+        return (hours * 60) + minutes;
+    }
+
+    // Berechnet die Slots basierend auf den konfigurierten Zeiten & Pausen
+    function calculateSlots() {
+        if (!slotLengthInput || !slotsAmountsInput || !clientsperslot) return;
+
+        const slotLength = parseInt(slotLengthInput.value, 10);
+        if (isNaN(slotLength) || slotLength <= 0) {
+            updateSlotsDisplay(0);
+            return;
+        }
+
+        // FIX 1: Make sure we parse the input VALUE, defaulting to 1 if empty or invalid
+        const multiplier = parseInt(clientsperslot.value, 10) || 1;
+
+        let totalSlots = 0;
+        const rows = Array.from(daysContainer.querySelectorAll('[data-day-row]'));
+
+        rows.forEach(row => {
+            const startTime = row.querySelector('[data-time-start]')?.value;
+            const endTime = row.querySelector('[data-time-end]')?.value;
+            const pauseStart = row.querySelector('[data-time-pause-start]')?.value;
+            const pauseEnd = row.querySelector('[data-time-pause-end]')?.value;
+
+            if (!startTime || !endTime) return;
+
+            // Using safety parsing to prevent missing values from generating NaN
+            const startMins = safeTimeToMinutes(startTime);
+            const endMins = safeTimeToMinutes(endTime);
+            const pauseStartMins = safeTimeToMinutes(pauseStart);
+            const pauseEndMins = safeTimeToMinutes(pauseEnd);
+
+            if (isNaN(startMins) || isNaN(endMins) || endMins <= startMins) return;
+
+            // Wenn eine gültige Pause innerhalb der Start/Endzeit existiert
+            if (pauseStartMins > 0 && pauseEndMins > 0 && pauseStartMins < pauseEndMins && pauseStartMins > startMins && pauseStartMins < endMins) {
+                // Segment 1 (Vor der Pause)
+                const segment1 = pauseStartMins - startMins;
+                totalSlots += Math.floor(segment1 / slotLength);
+
+                // Segment 2 (Nach der Pause)
+                const effectivePauseEnd = Math.min(pauseEndMins, endMins);
+                const segment2 = endMins - effectivePauseEnd;
+                if (segment2 > 0) {
+                    totalSlots += Math.floor(segment2 / slotLength);
+                }
+            } else {
+                // Ohne Pause oder ungültige Pause -> Komplett durchrechnen
+                totalSlots += Math.floor((endMins - startMins) / slotLength);
+            }
+        });
+
+        // FIX 2: Multiply by our safely parsed input value scalar
+        const totalSlotscomplete = totalSlots * multiplier;
+
+        // Safety check: if anything went wrong anyway, fallback to 0 instead of displaying NaN
+        updateSlotsDisplay(isNaN(totalSlotscomplete) ? 0 : totalSlotscomplete);
+    }
+
+    // Synchronisiert das Textfeld und fügt den Break-Cut hinzu
+    function syncTextarea() {
+        const rows = Array.from(daysContainer.querySelectorAll('[data-day-row]'));
+        const lines = [];
+        
+        rows.forEach(function (row) {
+            const dayValue = row.getAttribute('data-day-value') || '';
+            const startTime = row.querySelector('[data-time-start]')?.value || '';
+            const endTime = row.querySelector('[data-time-end]')?.value || '';
+            const pauseStart = row.querySelector('[data-time-pause-start]')?.value || '';
+            const pauseEnd = row.querySelector('[data-time-pause-end]')?.value || '';
+            
+            if (!dayValue || !startTime || !endTime) return;
+
+            // Hat der Nutzer eine Pause eingetragen, die innerhalb des Tagesfensters liegt?
+            if (pauseStart && pauseEnd && pauseStart < pauseEnd && pauseStart > startTime && pauseStart < endTime) {
+                // Zeile am Pausenbeginn aufsplitten -> 2 Blöcke = automatische Pause
+                lines.push(`${dayValue} ${startTime}-${pauseStart}`);
+                lines.push(`${dayValue} ${pauseEnd}-${endTime}`);
+            } else {
+                lines.push(`${dayValue} ${startTime}-${endTime}`);
+            }
+        });
+
+        timeFrameTextarea.value = lines.join('\n');
+        calculateSlots(); // Nach jedem Update neu berechnen
+    }
+
+    function renderRows() {
+        const startDate = parseDate(startDateInput.value);
+        const endDate = parseDate(endDateInput.value);
+
+        if (!startDate || !endDate) {
+            daysContainer.innerHTML = '<div class="text-muted small">Bitte Start- und Enddatum auswählen, damit die Tageszeilen erzeugt werden.</div>';
+            timeFrameTextarea.value = '';
+            endDateInput.setCustomValidity('');
+            return;
+        }
+
+        if (endDate < startDate) {
+            daysContainer.innerHTML = '<div class="text-danger small">Das Enddatum muss nach dem Startdatum liegen.</div>';
+            timeFrameTextarea.value = '';
+            endDateInput.setCustomValidity('Das Enddatum muss nach dem Startdatum liegen.');
+            return;
+        }
+
+        endDateInput.setCustomValidity('');
+
+        // Bisherige Werte sichern
+        const existingValues = new Map();
+        Array.from(daysContainer.querySelectorAll('[data-day-row]')).forEach(function (row) {
+            const dayValue = row.getAttribute('data-day-value');
+            const startTime = row.querySelector('[data-time-start]')?.value || '';
+            const endTime = row.querySelector('[data-time-end]')?.value || '';
+            const pauseStart = row.querySelector('[data-time-pause-start]')?.value || '';
+            const pauseEnd = row.querySelector('[data-time-pause-end]')?.value || '';
+            
+            if (dayValue) {
+                existingValues.set(dayValue, { startTime, endTime, pauseStart, pauseEnd });
+            }
+        });
+
+        const defaultStart = defaultStartInput.value || '08:00';
+        const defaultEnd = defaultEndInput.value || '16:00';
+        const defaultPauseStart = defaultPauseStartInput.value || '';
+        const defaultPauseEnd = defaultPauseEndInput.value || '';
+        const rows = [];
+
+        for (let current = startDate; current <= endDate; current = addDays(current, 1)) {
+            const dayValue = formatDateForValue(current);
+            const preserved = existingValues.get(dayValue) || {};
+            
+            const rowStart = preserved.startTime !== undefined ? preserved.startTime : defaultStart;
+            const rowEnd = preserved.endTime !== undefined ? preserved.endTime : defaultEnd;
+            const rowPauseStart = preserved.pauseStart !== undefined ? preserved.pauseStart : defaultPauseStart;
+            const rowPauseEnd = preserved.pauseEnd !== undefined ? preserved.pauseEnd : defaultPauseEnd;
+
+            rows.push(`
+                <div class="border rounded-3 bg-white p-3" data-day-row data-day-value="${dayValue}">
+                    <div class="row g-2 align-items-end">
+                        <div class="col-12 col-lg-4">
+                            <label class="form-label fw-semibold mb-1">${formatDateForRow(current)}</label>
+                            <div class="text-muted small">${dayValue}</div>
+                        </div>
+                        <div class="col-6 col-lg-2">
+                            <label class="form-label mb-1 text-muted small">Von</label>
+                            <input type="time" class="form-control form-control-sm" value="${rowStart}" data-time-start>
+                        </div>
+                        <div class="col-6 col-lg-2">
+                            <label class="form-label mb-1 text-muted small">Bis</label>
+                            <input type="time" class="form-control form-control-sm" value="${rowEnd}" data-time-end>
+                        </div>
+                        <div class="col-6 col-lg-2">
+                            <label class="form-label mb-1 text-danger small">Pause ab</label>
+                            <input type="time" class="form-control form-control-sm border-danger-subtle" value="${rowPauseStart}" data-time-pause-start>
+                        </div>
+                        <div class="col-6 col-lg-2">
+                            <label class="form-label mb-1 text-danger small">Pause bis</label>
+                            <input type="time" class="form-control form-control-sm border-danger-subtle" value="${rowPauseEnd}" data-time-pause-end>
+                        </div>
+                    </div>
+                </div>
+            `);
+        }
+
+        daysContainer.innerHTML = rows.join('');
+        daysContainer.querySelectorAll('input[type="time"]').forEach(function (input) {
+            input.addEventListener('input', syncTextarea);
+            input.addEventListener('change', syncTextarea);
+        });
+
+        syncTextarea();
+    }
+
+    document.addEventListener('DOMContentLoaded', function () {
+        const container = document.getElementById('custom-fields-container');
+
+        // Monitor inputs inside the container using event delegation
+        container.addEventListener('input', function (event) {
+            // Only trigger if the user is typing inside our dynamic inputs
+            if (event.target.classList.contains('custom-dynamic-input')) {
+                const allInputs = container.querySelectorAll('.custom-dynamic-input');
+                const lastInput = allInputs[allInputs.length - 1];
+
+                // If the user typed something into the absolute last input field, spawn a new one
+                if (lastInput.value.trim() !== '') {
+                    createNewFieldRow(container);
+                }
+            }
+        });
+
+        // Helper function to generate and append a clean new input row
+        function createNewFieldRow(targetContainer) {
+            const rowDiv = document.createElement('div');
+            rowDiv.className = 'mb-3 custom-field-row';
+
+            rowDiv.innerHTML = `
+                <input type="text" 
+                       name="custom_fields" 
+                       class="form-control form-control-lg custom-dynamic-input" 
+                       placeholder="Nächstes Zusatzfeld...">
+            `;
+
+            targetContainer.appendChild(rowDiv);
+        }
+    });
+
+    // Event Listeners Registration
+    buildButton.addEventListener('click', renderRows);
+    startDateInput.addEventListener('change', renderRows);
+    endDateInput.addEventListener('change', renderRows);
+    
+    defaultStartInput.addEventListener('change', renderRows);
+    defaultEndInput.addEventListener('change', renderRows);
+    defaultPauseStartInput.addEventListener('change', renderRows);
+    defaultPauseEndInput.addEventListener('change', renderRows);
+    
+    // Slot Berechnung auf Ändeurng der Länge antriggern
+    if(slotLengthInput) {
+        slotLengthInput.addEventListener('input', calculateSlots);
+        slotLengthInput.addEventListener('change', calculateSlots);
+    }
+    if (clientsperslot) {
+        clientsperslot.addEventListener('input', calculateSlots);
+        clientsperslot.addEventListener('change', calculateSlots);
+    }
+
+    if (startDateInput.value && endDateInput.value) {
+        renderRows();
+    }
+
+
+    const configForm = document.querySelector('form');
+    if (configForm) {
+        configForm.addEventListener('keydown', function(event) {
+            if (event.key === 'Enter') {
+                if (event.target.tagName === 'TEXTAREA') return;
+                if (event.target.tagName === 'BUTTON' && event.target.type === 'submit') return;
+                event.preventDefault();
+            }
+        });
+    }
+
+})();
+</script>
+{% endblock %}

Web/templates/terminplaner.html

@@ -0,0 +1,152 @@
+{% extends "base.html" %}
+
+{% block title %}Terminplaner - Inventarsystem{% endblock %}
+
+{% block content %}
+<div class="container py-4">
+    <div class="row justify-content-center">
+        <div class="col-12 col-lg-11 col-xl-10">
+            
+            <!-- Hero Sektion -->
+            <section class="p-4 p-md-5 rounded-4 shadow-lg" style="background: linear-gradient(135deg, rgba(15,76,92,0.96), rgba(22,105,122,0.92)); color: #fff;">
+                <div class="d-flex flex-column flex-lg-row justify-content-between gap-4 align-items-start align-items-lg-end">
+                    <div>
+                        <p class="text-uppercase fw-semibold mb-2" style="letter-spacing: .12em; opacity: .8;">Terminplaner</p>
+                        <h1 class="display-6 fw-bold mb-3">Reservierungen und Termine übersichtlich verwalten</h1>
+                        <p class="lead mb-0" style="max-width: 60ch; opacity: .95;">Erstellen Sie neue Terminreihen, teilen Sie Buchungslinks und öffnen Sie den Kalender für bestehende Reservierungen.</p>
+                    </div>
+                    <div class="d-flex flex-wrap gap-2">
+                        <a class="btn btn-light btn-lg fw-semibold" href="{{ url_for('terminplaner.configure', tenant=tenant_id) }}">Neue Planung</a>
+                        <a class="btn btn-outline-light btn-lg fw-semibold" href="{{ url_for('terminplan', tenant=tenant_id) }}">Kalender öffnen</a>
+                    </div>
+                </div>
+            </section>
+
+            <!-- NEU EINGEBAUT: Erfolgsmeldung für gerade erstellte Buchungslinks -->
+            {% if generated_link %}
+            <div class="alert alert-success mt-4 shadow-sm rounded-4">
+                <div class="fw-bold mb-1">Buchungslink erstellt</div>
+                <div class="mb-2">
+                    {% if mail_service_enabled %}
+                        Teilen Sie diesen Link mit den Teilnehmenden oder versenden Sie ihn direkt per E-Mail.
+                    {% else %}
+                        Der E-Mail-Service ist deaktiviert. Teilen Sie diesen Link manuell mit den Teilnehmenden.
+                    {% endif %}
+                </div>
+                <a href="{{ generated_link }}" class="d-inline-block text-break mb-3">{{ generated_link }}</a>
+                
+                <!-- PDF Export per ReportLab -->
+                <div class="pt-3 border-top border-success-subtle">
+                    <div class="fw-semibold mb-1">Einladungsbrief (inkl. QR-Code)</div>
+                    <p class="small text-muted mb-2">Laden Sie einen automatisch generierten Brief herunter, der den Buchungslink und einen passenden QR-Code enthält.</p>
+                    <a href="{{ url_for('terminplaner.export_pdf_brief', plan_id=plan_id) }}" class="btn btn-outline-success btn-sm">
+                        📄 Brief als PDF herunterladen
+                    </a>
+                </div>
+
+                {% if calendar_link %}
+                <div class="mt-3 pt-3 border-top border-success-subtle">
+                    <div class="fw-semibold mb-1">Kalendereintrag</div>
+                    <a href="{{ calendar_link }}" class="btn btn-outline-primary btn-sm">.ics herunterladen</a>
+                </div>
+                {% endif %}
+            </div>
+            {% endif %}
+            <!-- ENDE NEUER BLOCK -->
+
+            <!-- Info-Karten -->
+            <div class="row g-4 mt-1">
+                <div class="col-12 col-md-4">
+                    <div class="card h-100 shadow-sm border-0 rounded-4">
+                        <div class="card-body p-4">
+                            <div class="display-6 mb-3">🗓️</div>
+                            <h2 class="h4 fw-bold">Kalender</h2>
+                            <p class="mb-4 text-muted">Sehen Sie vorhandene Termine, ihre Auslastung und die aktuellen Reservierungen im Kalender.</p>
+                            <a class="btn btn-primary w-100" href="{{ url_for('terminplan', tenant=tenant_id) }}">Zum Kalender</a>
+                        </div>
+                    </div>
+                </div>
+                <div class="col-12 col-md-4">
+                    <div class="card h-100 shadow-sm border-0 rounded-4">
+                        <div class="card-body p-4">
+                            <div class="display-6 mb-3">✍️</div>
+                            <h2 class="h4 fw-bold">Neue Planung</h2>
+                            <p class="mb-4 text-muted">Erstellen Sie einen neuen Terminplan und verschicken Sie den Buchungslink an Ihre Zielgruppe.</p>
+                            <a class="btn btn-outline-primary w-100" href="{{ url_for('terminplaner.configure', tenant=tenant_id) }}">Konfiguration öffnen</a>
+                        </div>
+                    </div>
+                </div>
+                <div class="col-12 col-md-4">
+                    <div class="card h-100 shadow-sm border-0 rounded-4">
+                        <div class="card-body p-4">
+                            <div class="display-6 mb-3">🔗</div>
+                            <h2 class="h4 fw-bold">Buchungslink</h2>
+                            <p class="mb-4 text-muted">Die öffentliche Buchungsseite liegt unter dem jeweiligen Terminlink und kann direkt an Teilnehmende weitergegeben werden.</p>
+                            <div class="small text-muted">Die Buchungsseite wird aus dem Terminplan automatisch erzeugt.</div>
+                        </div>
+                    </div>
+                </div>
+            </div>
+
+            {% if current_user %}
+            <div class="mt-4 p-4 rounded-4 bg-white shadow-sm">
+                <h2 class="h5 fw-bold mb-2">Angemeldet als {{ current_user }}</h2>
+                <p class="mb-0 text-muted">Sie können Termine anlegen, den Kalender prüfen und Buchungslinks verteilen.</p>
+            </div>
+
+            <!-- "Tabelle" (Liste) der kommenden Termine -->
+            <div class="mt-4 p-4 rounded-4 bg-white shadow-sm">
+                <div class="d-flex flex-column flex-md-row justify-content-between align-items-md-center gap-2 mb-3">
+                    <h2 class="h5 fw-bold mb-0">Kommende Termine</h2>
+                    <span class="text-muted small">Alle offenen Terminpläne dieses Nutzers</span>
+                </div>
+
+                {% if upcoming_events %}
+                <div class="vstack gap-3">
+                    {% for event in upcoming_events %}
+                    <div class="border rounded-3 p-3">
+                        <div class="d-flex flex-column flex-lg-row justify-content-between gap-3">
+                            <div>
+                                <h3 class="h6 fw-bold mb-1">{{ event.title or "Terminplan" }}</h3>
+                                <div class="fw-semibold">{{ event.date_start }} bis {{ event.date_end }}</div>
+                                <div class="text-muted small">ID: {{ event.appointment_id }}</div>
+                                {% if event.time_span %}
+                                <div class="small mt-1">Zeitfenster: {{ event.time_span|join(' | ') }}</div>
+                                {% endif %}
+                                {% if event.note %}
+                                <div class="small mt-1 text-muted">Notiz: {{ event.note }}</div>
+                                {% endif %}
+                            </div>
+                            <div class="text-lg-end">
+                                <div class="small mb-2">Gebucht: <strong>{{ event.slots_booked }}</strong> / {{ event.slots_total }} | Frei: <strong>{{ event.slots_left }}</strong></div>
+                                <div class="d-flex flex-wrap gap-2 justify-content-lg-end">
+                                    
+                                    <!-- Hinzugefügt: Direkter PDF-Export auch bei bestehenden Plänen -->
+                                    <a class="btn btn-sm btn-outline-success" href="{{ url_for('terminplaner.export_pdf_brief', plan_id=event.appointment_id) }}" title="Brief herunterladen">
+                                        📄 PDF
+                                    </a>
+
+                                    <a class="btn btn-sm btn-primary" href="{{ event.link }}" target="_blank" rel="noopener">Client-Link</a>
+                                    
+                                    {% if event.calendar_link %}
+                                    <a class="btn btn-sm btn-outline-primary" href="{{ event.calendar_link }}">.ics</a>
+                                    {% endif %}
+                                    
+                                    <form method="post" action="{{ url_for('terminplaner.delete_appointment', appointment_id=event.appointment_id, tenant=tenant_id) }}" class="d-inline" onsubmit="return confirm('Diesen Terminplan wirklich löschen?');">
+                                        <button type="submit" class="btn btn-sm btn-outline-danger">Entfernen</button>
+                                    </form>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                    {% endfor %}
+                </div>
+                {% else %}
+                <div class="text-muted">Keine kommenden Termine gefunden.</div>
+                {% endif %}
+            </div>
+            {% endif %}
+        </div>
+    </div>
+</div>
+{% endblock %}

Web/templates/terminplaner_not_found.html

@@ -0,0 +1,28 @@
+{% extends "base.html" %}
+
+{% block title %}Termin nicht gefunden - Inventarsystem{% endblock %}
+
+{% block content %}
+<div class="container py-5">
+    <div class="row justify-content-center">
+        <div class="col-12 col-lg-8 col-xl-7">
+            <div class="card border-0 shadow-lg rounded-4 overflow-hidden">
+                <div class="card-header text-white" style="background: linear-gradient(135deg, #0f4c5c, #16697a);">
+                    <p class="text-uppercase small fw-semibold mb-1 opacity-75">Terminplaner</p>
+                    <h1 class="h3 mb-0 fw-bold">Termin nicht gefunden</h1>
+                </div>
+                <div class="card-body p-4 p-md-5 bg-white text-center">
+                    <div class="display-3 fw-bold text-danger mb-3">404</div>
+                    <p class="lead mb-2">Der angeforderte Termin existiert nicht mehr oder der Link ist ungültig.</p>
+                    <p class="text-muted mb-4">Bitte prüfen Sie den Link erneut oder öffnen Sie den Terminplaner von der Startseite aus.</p>
+
+                    <div class="d-flex flex-column flex-sm-row justify-content-center gap-2">
+                        <a href="{{ url_for('home') }}" class="btn btn-primary btn-lg">Zur Startseite</a>
+                        <a href="javascript:history.back()" class="btn btn-outline-secondary btn-lg">Zurück</a>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+{% endblock %}

Web/templates/upload_admin.html

@@ -155,6 +155,27 @@
         background-color: #1e7e34;
     }
 
+    /* Quagga Scanner Video Styles */
+    #code4-scanner video, #code4-scanner canvas,
+    #isbn-scanner video, #isbn-scanner canvas {
+        width: 100%;
+        max-width: 640px;
+        height: auto;
+        border-radius: 5px;
+        box-shadow: 0 2px 8px rgba(0,0,0,0.1);
+    }
+    
+    #code4-scanner canvas, #isbn-scanner canvas {
+        position: absolute;
+        top: 0;
+        left: 0;
+    }
+    
+    #code4-scanner, #isbn-scanner {
+        position: relative;
+        overflow: hidden;
+    }
+
     /* ISBN input group styling */
     .isbn-input-group {
         display: flex;
@@ -767,7 +788,19 @@
             {% if show_library_features %}
             <!-- Library Mode: Single Customizable Filter -->
             <div class="filter-inputs">
-                <h3>Kategorie/Typ (customisierbar):</h3>
+                <h3>Medientyp</h3>
+                <div class="form-group">
+                    <select name="item_type_input" id="item_type_input">
+                        <option value="" disabled selected>Medientyp auswählen...</option>
+                        <option value="Buch">Buch</option>
+                        <option value="Schulbuch">Schulbuch</option>
+                        <option value="CD">CD</option>
+                        <option value="DVD">DVD</option>
+                        <option value="Sonstiges">Sonstiges</option>
+                    </select>
+                    <small style="display:block; color:#666;">Wählen Sie einen Medientyp aus zur Klassifizierung.</small>
+                </div>
+                <h3>Kategorie/Typ:</h3>
                 <div class="form-group">
                     <input type="text" name="library_category" id="library_category" placeholder="z.B. Belletristik, Sachbücher, Nachschlagewerke, etc.">
                     <small style="display:block; color:#666;">Geben Sie hier eine beliebige Kategorie ein zur freien Klassifizierung.</small>
@@ -831,7 +864,7 @@
                             <!-- Options will be loaded by JavaScript -->
                         </select>
                     </div>
-                    <div class="form-group">
+                    <div class="formupload_admin-group">
                         <label for="filter2-4">Wert 4:</label>
                         <select id="filter2-4" name="filter2" class="filter-dropdown-select">
                             <option value="">-- Optional --</option>
@@ -840,7 +873,7 @@
                     </div>
                 </div>
                 
-                <h3>Thema:</h3>
+                <h3>Schlagwort:</h3>
                 <div class="multi-filter">
                     <div class="form-group">
                         <label for="filter3-1">Wert 1:</label>
@@ -869,25 +902,41 @@
                 <label for="anschaffungskosten">Anschaffungskosten (€)</label>
                 <input id="anschaffungskosten" name="anschaffungskosten">
             </div>
-            <div class="form-group">
-                <label for="code_4">Code</label>
-                <div style="display:flex; gap:8px; flex-wrap:wrap; align-items:center;">
-                    <input id="code_4" name="code_4">
-                    <button type="button" id="scan-code4-btn" class="fetch-isbn-button">Barcode scannen</button>
+           <div class="form-group">
+                <label for="scan_mode">Erfassungs-Modus:</label>
+                <select id="scan_mode" name="scan_mode" class="form-control" onchange="toggleScanMode()">
+                    <option value="single">Einzel-Code (Scanner stoppt nach 1 Scan)</option>
+                    <option value="continuous">Fortlaufend scannen (Mehrere Codes nacheinander)</option>
+                    <option value="range">Code-Bereich generieren (z.B. ABC-001 bis ABC-010)</option>
+                </select>
+            </div>
+
+            <div id="range_generator_group" class="form-group" style="display:none; background: #f9f9f9; padding: 15px; border-radius: 5px; border: 1px solid #ddd; margin-bottom: 15px;">
+                <label style="font-weight: bold;">Code-Bereich automatisch generieren:</label>
+                <div style="display: flex; gap: 10px; margin-bottom: 10px; align-items: center;">
+                    <input type="text" id="range_prefix" placeholder="Präfix (z.B. IT-)" class="form-control" style="flex: 2;">
+                    <input type="number" id="range_start" placeholder="Start (z.B. 1)" class="form-control" style="flex: 1;">
+                    <span style="font-weight: bold;">bis</span>
+                    <input type="text" id="range_end" placeholder="Ende (z.B. 020)" class="form-control" style="flex: 1;">
                 </div>
-                <small style="display:block; color:#666;">Einzelcode manuell setzen oder per Scanner erfassen.</small>
-                <div id="code4-scanner" style="width:100%; max-width:520px; display:none; margin-top:10px;"></div>
-                <small id="code4-scan-status" style="display:block; color:#666; margin-top:6px;"></small>
+                <small style="display:block; color:#666; margin-bottom: 10px;">Tipp: Die Anzahl der Ziffern im "Ende"-Feld bestimmt die führenden Nullen (z.B. Ende "050" macht aus Start "1" einen "001").</small>
+                <button type="button" class="btn btn-secondary" onclick="generateCodeRange()">Bereich generieren & einfügen</button>
             </div>
-            <div class="form-group">
-                <label for="item_count">Anzahl dieser Sorte</label>
-                <input type="number" id="item_count" name="item_count" min="1" max="100" value="1">
-                <small style="display:block; color:#666;">Es werden eigene Items erstellt, aber in der Übersicht als ein Artikel gebündelt angezeigt.</small>
+
+            <div class="form-group" id="primary_code_group">
+                <label for="code_4">Basis-Code</label>
+                <div style="display: flex; gap: 10px;">
+                    <input type="text" id="code_4" name="code_4" class="form-control" placeholder="Haupt-Barcode" required>
+                    <button type="button" id="scan-code4-btn" class="btn btn-primary">Barcode scannen</button>
+                </div>
+                <div id="code4-scanner" style="display:none; margin-top: 10px;"></div>
+                <small id="code4-scan-status" class="form-text text-muted"></small>
             </div>
-            <div class="form-group">
-                <label for="individual_codes">Einzelcodes (optional, je Zeile ein Code)</label>
-                <textarea id="individual_codes" name="individual_codes" rows="4" placeholder="z.B.\nABC-001\nABC-002"></textarea>
-                <small style="display:block; color:#666;">Bei Anzahl > 1 können hier individuelle Codes pro Item gesetzt werden. Der Scanner setzt immer zuerst den Basis-Code im Feld oben; weitere Einzelcodes können hier bei Bedarf manuell ergänzt werden.</small>
+
+            <div class="form-group" id="individual_codes_group">
+                <label for="individual_codes">Weitere Einzelcodes (je Zeile ein Code)</label>
+                <textarea id="individual_codes" name="individual_codes" rows="6" placeholder="z.B.&#10;ABC-001&#10;ABC-002" class="form-control"></textarea>
+                <small style="display:block; color:#666; margin-top: 5px;">Bei Anzahl > 1 können hier individuelle Codes pro Item gesetzt werden. Der Scanner setzt immer zuerst den Basis-Code im Feld oben; weitere Einzelcodes werden hier angehängt.</small>
             </div>
             <!-- Image upload (hidden for library mode) -->
             <div class="form-group" {% if show_library_features %}style="display:none;"{% endif %}>
@@ -905,7 +954,7 @@
                 <div class="isbn-input-group">
                     <input type="text" id="isbn" name="isbn" placeholder="ISBN oder Barcode eingeben..." required>
                     <button type="button" id="scan-isbn-btn" class="fetch-isbn-button">Barcode scannen</button>
-                    <button type="button" class="fetch-isbn-button" onclick="fetchBookInfo('upload')">Bild abrufen</button>
+                    <button type="button" class="fetch-isbn-button" onclick="fetchBookInfo('upload')">Informationen abrufen</button>
                 </div>
                 <div id="isbn-scanner" style="width:100%; max-width:520px; display:none; margin-top:10px;"></div>
                 <small id="isbn-scan-status" style="display:block; color:#666; margin-top:6px;">Scannen oder manuell eingeben. Gültige ISBNs helfen beim Abruf von Buchdaten, andere Codes werden trotzdem akzeptiert.</small>
@@ -970,8 +1019,7 @@
         document.getElementById('csv-help-modal').style.display = 'none';
     }
 </script>
-
-<script src="https://unpkg.com/html5-qrcode@2.0.9/dist/html5-qrcode.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/@ericblade/quagga2/dist/quagga.js"></script>
 <script>
     const libraryModuleEnabled = {{ 'true' if library_module_enabled else 'false' }};
 
@@ -984,12 +1032,12 @@
 
     // Global variable to store fetched book data
     let currentBookData = null;
-    let code4ScannerInstance = null;
-    let code4ScannerRunning = false;
-    let code4LastScanned = '';
-    let code4LastScannedAt = 0;
-    let isbnScannerInstance = null;
-    let isbnScannerRunning = false;
+    
+    // Quagga2 engine state management properties
+    let scannerRunning = false;
+    let activeScannerCallback = null; // Dynamically handles routing data to the active caller field
+    var code4LastScanned = '';
+    var code4LastScannedAt = 0;
 
     function setCode4ScanStatus(message, isError = false) {
         const statusEl = document.getElementById('code4-scan-status');
@@ -1042,61 +1090,230 @@
         statusEl.style.color = '#b00020';
     }
 
+    // Centered Quagga2 Engine Initialization Pattern
+    function runEngineInitialization(targetSelector, activeCallback, completionMsg, errorStatusSetter) {
+        if (scannerRunning) {
+            Quagga.stop();
+            scannerRunning = false;
+        }
+
+        activeScannerCallback = activeCallback;
+
+        Quagga.init({
+            inputStream: {
+                name: "Live",
+                type: "LiveStream",
+                target: document.querySelector(targetSelector), 
+                constraints: {
+                    width: 640,
+                    height: 480,
+                    facingMode: "environment" // Force rear camera lenses
+                },
+            },
+            decoder: {
+                readers: ["code_128_reader", "ean_reader", "code_39_reader", "upc_reader"]
+            } 
+        }, function(err) {
+            if (err) {
+                console.error("Initialization error:", err);
+                errorStatusSetter("Kamera konnte nicht gestartet werden.", true);
+                return;
+            }
+
+            Quagga.start();
+            scannerRunning = true;
+            errorStatusSetter(completionMsg, false);
+        });
+    }
+
+    function killScannerHardware() {
+        if (!scannerRunning) return;
+        Quagga.stop();
+        scannerRunning = false;
+        activeScannerCallback = null;
+    }
+
+    // Unified tracking capture listener
+    Quagga.onDetected(function(data) {
+        if (!data || !data.codeResult || !data.codeResult.code) return;
+
+        const rawBarcode = String(data.codeResult.code || '').trim();
+        const currentTargetCallback = activeScannerCallback;
+
+        if (typeof currentTargetCallback === "function") {
+            currentTargetCallback(rawBarcode);
+        }
+    });
+
+    // Globale Variablen für den Scanner-Status
+    var code4LastScanned = '';
+    var code4LastScannedAt = 0;
+
+    /**
+     * Schaltet das UI basierend auf dem ausgewählten Modus um
+     */
+    function toggleScanMode() {
+        const mode = document.getElementById('scan_mode').value;
+        const rangeGroup = document.getElementById('range_generator_group');
+        const scanButton = document.getElementById('scan-code4-btn');
+        const scannerBox = document.getElementById('code4-scanner');
+        
+        if (scannerBox && scannerBox.style.display !== 'none') {
+            if (typeof killScannerHardware === 'function') killScannerHardware();
+            scannerBox.style.display = 'none';
+            if (scanButton) scanButton.textContent = 'Barcode scannen';
+        }
+    
+        if (mode === 'range') {
+            if(rangeGroup) rangeGroup.style.display = 'block';
+            if(scanButton) scanButton.style.display = 'none'; 
+        } else {
+            if(rangeGroup) rangeGroup.style.display = 'none'; // Hier wurde der Fehler korrigiert
+            if(scanButton) scanButton.style.display = 'inline-block';
+        }
+    }
+
+    /**
+     * Generiert eine Liste von Codes basierend auf den Eingaben
+     */
+    function generateCodeRange() {
+        const prefix = document.getElementById('range_prefix').value.trim();
+        const startStr = document.getElementById('range_start').value.trim();
+        const endStr = document.getElementById('range_end').value.trim();
+
+        const start = parseInt(startStr, 10);
+        const end = parseInt(endStr, 10);
+
+        const paddingLength = endStr.length; 
+
+        if (isNaN(start) || isNaN(end) || start > end) {
+            alert("Bitte gültige Zahlen für Start und Ende eingeben. Der Startwert darf nicht größer als der Endwert sein.");
+            return;
+        }
+
+        let generatedCodes = [];
+        for (let i = start; i <= end; i++) {
+            let numStr = i.toString().padStart(paddingLength, '0');
+            generatedCodes.push(`${prefix}${numStr}`);
+        }
+
+        const codeField = document.getElementById('code_4');
+        const individualCodesArea = document.getElementById('individual_codes');
+
+        if (generatedCodes.length > 0) {
+            if (!codeField.value || confirm("Soll der aktuelle Basis-Code überschrieben werden?")) {
+                codeField.value = generatedCodes[0];
+                if (typeof validateCodeField === 'function') validateCodeField(codeField);
+                generatedCodes.shift(); 
+            }
+
+            if (generatedCodes.length > 0) {
+                let existing = individualCodesArea.value.trim();
+                individualCodesArea.value = existing ? existing + '\n' + generatedCodes.join('\n') : generatedCodes.join('\n');
+            }
+
+            alert(`Bereich erfolgreich generiert! (${end - start + 1} Codes)`);
+        }
+    }
+
+    /**
+     * Scanner-Funktion (Single & Continuous Modus)
+     */
     function startCode4Scanner() {
         const scannerBox = document.getElementById('code4-scanner');
         const scanButton = document.getElementById('scan-code4-btn');
         const codeField = document.getElementById('code_4');
+        const individualCodesArea = document.getElementById('individual_codes');
+        const scanMode = document.getElementById('scan_mode').value;
+
         if (!scannerBox || !scanButton || !codeField) return;
 
-        // Stop ISBN scanner if currently running to avoid camera conflicts.
-        if (isbnScannerRunning && isbnScannerInstance) {
-            isbnScannerInstance.clear().catch(() => {});
-            const isbnScannerBox = document.getElementById('isbn-scanner');
+        // Beende evtl. laufenden ISBN Scanner
+        const isbnScannerBox = document.getElementById('isbn-scanner');
+        if (isbnScannerBox && isbnScannerBox.style.display !== 'none') {
+            killScannerHardware();
+            isbnScannerBox.style.display = 'none';
             const isbnScanButton = document.getElementById('scan-isbn-btn');
-            if (isbnScannerBox) isbnScannerBox.style.display = 'none';
-            if (isbnScanButton) isbnScanButton.textContent = 'ISBN scannen';
-            isbnScannerRunning = false;
+            if (isbnScanButton) isbnScanButton.textContent = 'Barcode scannen';
+            if (typeof setIsbnScanStatus === 'function') setIsbnScanStatus('Scanner gestoppt.');
         }
 
-        if (code4ScannerRunning && code4ScannerInstance) {
-            code4ScannerInstance.clear().catch(() => {});
+        // Scanner ausschalten, wenn er bereits läuft
+        if (scannerBox.style.display !== 'none') {
+            killScannerHardware();
             scannerBox.style.display = 'none';
             scanButton.textContent = 'Barcode scannen';
-            code4ScannerRunning = false;
-            setCode4ScanStatus('Scanner gestoppt.');
+            if (typeof setCode4ScanStatus === 'function') setCode4ScanStatus('Scanner gestoppt.');
             return;
         }
 
+        // Scanner starten
         scannerBox.style.display = 'block';
-        scanButton.textContent = 'Scanner stoppen';
-        code4ScannerInstance = new Html5QrcodeScanner('code4-scanner', { 
-            fps: 10, 
-            qrbox: 250,
-            rememberLastUsedCamera: true
-        });
-        code4ScannerRunning = true;
-        setCode4ScanStatus('Scanner läuft. Der Scan wird im Basis-Codefeld übernommen.');
+        scanButton.textContent = scanMode === 'continuous' ? 'Fortlaufenden Scan stoppen' : 'Scanner stoppen';
+        if (typeof setCode4ScanStatus === 'function') setCode4ScanStatus('Scanner initialisiert. Richte die Kamera auf den Barcode...');
 
-        code4ScannerInstance.render((decodedText) => {
-            const scannedCode = String(decodedText || '').trim();
-            if (!scannedCode) return;
+        if (typeof runEngineInitialization === 'function') {
+            runEngineInitialization(
+                '#code4-scanner', 
+                function(decodedText) {
+                    const now = Date.now();
+                    if (decodedText === code4LastScanned && (now - code4LastScannedAt) < 1500) {
+                        return;
+                    }
+                    code4LastScanned = decodedText;
+                    code4LastScannedAt = now;
+                
+                    if (scanMode === 'single') {
+                        killScannerHardware();
+                        scannerBox.style.display = 'none';
+                        scanButton.textContent = 'Barcode scannen';
+                    
+                        codeField.value = decodedText;
+                        if (typeof validateCodeField === 'function') validateCodeField(codeField);
+                        if (typeof setCode4ScanStatus === 'function') setCode4ScanStatus(`Code gesetzt: ${decodedText}`);
 
-            const now = Date.now();
-            if (scannedCode === code4LastScanned && (now - code4LastScannedAt) < 1500) {
-                return;
-            }
-            code4LastScanned = scannedCode;
-            code4LastScannedAt = now;
+                    } else if (scanMode === 'continuous') {
+                        let currentAreaCodes = individualCodesArea.value.split('\n').map(c => c.trim()).filter(c => c !== '');
 
-            codeField.value = scannedCode;
-            validateCodeField(codeField);
-            setCode4ScanStatus(`Code_4 gesetzt: ${scannedCode}`);
-        }, () => {});
+                        if (!codeField.value) {
+                            codeField.value = decodedText;
+                            if (typeof validateCodeField === 'function') validateCodeField(codeField);
+                            if (typeof setCode4ScanStatus === 'function') setCode4ScanStatus(`Basis-Code gesetzt: ${decodedText}`);
+                        } else if (!currentAreaCodes.includes(decodedText) && codeField.value !== decodedText) {
+                            individualCodesArea.value += (individualCodesArea.value ? '\n' : '') + decodedText;
+                            if (typeof setCode4ScanStatus === 'function') setCode4ScanStatus(`Zusatz-Code erfasst: ${decodedText}`);
+
+                            try {
+                                const audioCtx = new (window.AudioContext || window.webkitAudioContext)();
+                                const oscillator = audioCtx.createOscillator();
+                                const gainNode = audioCtx.createGain();
+                                oscillator.connect(gainNode);
+                                gainNode.connect(audioCtx.destination);
+                                oscillator.type = 'sine';
+                                oscillator.frequency.value = 800; 
+                                gainNode.gain.setValueAtTime(0.1, audioCtx.currentTime);
+                                oscillator.start();
+                                oscillator.stop(audioCtx.currentTime + 0.1);
+                            } catch (e) {
+                                console.log("Audio feedback not supported");
+                            }
+                        } else {
+                            if (typeof setCode4ScanStatus === 'function') setCode4ScanStatus(`Code ${decodedText} wurde bereits gescannt.`);
+                        }
+                    }
+                },
+                'Scanner läuft. Richte die Kamera auf den Barcode.',
+                setCode4ScanStatus
+            );
+        }
     }
 
+    /**
+     * ISBN Scanner-Funktion
+     */
     function startIsbnScanner() {
         if (!libraryModuleEnabled) {
-            setIsbnScanStatus('Bibliotheks-Modul ist deaktiviert.', true);
+            if (typeof setIsbnScanStatus === 'function') setIsbnScanStatus('Bibliotheks-Modul ist deaktiviert.', true);
             return;
         }
         const scannerBox = document.getElementById('isbn-scanner');
@@ -1104,61 +1321,75 @@
         const isbnField = document.getElementById('isbn');
         if (!scannerBox || !scanButton || !isbnField) return;
 
-        // Stop Code_4 scanner if currently running to avoid camera conflicts.
-        if (code4ScannerRunning && code4ScannerInstance) {
-            code4ScannerInstance.clear().catch(() => {});
-            const codeScannerBox = document.getElementById('code4-scanner');
-            const codeScanButton = document.getElementById('scan-code4-btn');
-            if (codeScannerBox) codeScannerBox.style.display = 'none';
-            if (codeScanButton) codeScanButton.textContent = 'Barcode scannen';
-            code4ScannerRunning = false;
-            setCode4ScanStatus('Scanner gestoppt.');
+        const codeScannerBox = document.getElementById('code4-scanner');
+        const codeScanButton = document.getElementById('scan-code4-btn');
+        if (codeScannerBox && codeScannerBox.style.display !== 'none') {
+            killScannerHardware();
+            codeScannerBox.style.display = 'none';
+            codeScanButton.textContent = 'Barcode scannen';
+            if (typeof setCode4ScanStatus === 'function') setCode4ScanStatus('Scanner gestoppt.');
         }
 
-        if (isbnScannerRunning && isbnScannerInstance) {
-            isbnScannerInstance.clear().catch(() => {});
+        if (scannerBox.style.display !== 'none') {
+            killScannerHardware();
             scannerBox.style.display = 'none';
-            scanButton.textContent = 'ISBN scannen';
-            isbnScannerRunning = false;
-            setIsbnScanStatus('Scanner gestoppt.');
+            scanButton.textContent = 'Barcode scannen';
+            if (typeof setIsbnScanStatus === 'function') setIsbnScanStatus('Scanner gestoppt.');
             return;
         }
 
         scannerBox.style.display = 'block';
         scanButton.textContent = 'Scanner stoppen';
-        isbnScannerInstance = new Html5QrcodeScanner('isbn-scanner', {
-            fps: 10,
-            qrbox: 250,
-            rememberLastUsedCamera: true
-        });
-        isbnScannerRunning = true;
-        setIsbnScanStatus('Scanner läuft. Bitte ISBN-Code erfassen.');
 
-        isbnScannerInstance.render((decodedText) => {
-            const scannedCode = String(decodedText || '').trim();
-            if (!scannedCode) return;
+        runEngineInitialization(
+            '#isbn-scanner',
+            function(decodedText) {
+                killScannerHardware();
+                scannerBox.style.display = 'none';
+                scanButton.textContent = 'Barcode scannen';
 
-            const normalizedIsbn = normalizeIsbnClient(scannedCode);
-            isbnField.value = normalizedIsbn || scannedCode;
-            updateIsbnLiveValidation();
-            if (normalizedIsbn) {
-                setIsbnScanStatus(`ISBN gesetzt: ${normalizedIsbn}`);
-            } else {
-                setIsbnScanStatus('Kein gültiges ISBN-Format erkannt, der gescannte Wert bleibt aber im Feld.', true);
-            }
+                const normalizedIsbn = typeof normalizeIsbnClient === 'function' ? normalizeIsbnClient(decodedText) : decodedText;
+                isbnField.value = normalizedIsbn || decodedText;
+                if (typeof updateIsbnLiveValidation === 'function') updateIsbnLiveValidation();
 
-            isbnScannerInstance.clear().catch(() => {});
-            scannerBox.style.display = 'none';
-            scanButton.textContent = 'ISBN scannen';
-            isbnScannerRunning = false;
-
-            if (normalizedIsbn) {
-                // Automatically load book metadata after a valid ISBN scan.
-                fetchBookInfo('upload');
-            }
-        }, () => {});
+                if (normalizedIsbn) {
+                    if (typeof setIsbnScanStatus === 'function') setIsbnScanStatus(`ISBN gesetzt: ${normalizedIsbn}`);
+                    if (typeof fetchBookInfo === 'function') fetchBookInfo('upload');
+                } else {
+                    if (typeof setIsbnScanStatus === 'function') setIsbnScanStatus('Kein gültiges ISBN-Format erkannt, der gescannte Wert bleibt aber im Feld.', true);
+                }
+            },
+            'Scanner läuft. Bitte ISBN-Code erfassen.',
+            setIsbnScanStatus
+        );
     }
 
+    // --- WICHTIG: Event Listener Binden sobald DOM geladen ist ---
+    document.addEventListener('DOMContentLoaded', function() {
+        // 1. Basis-Code Scanner Button aktivieren
+        const scanCode4Btn = document.getElementById('scan-code4-btn');
+        if (scanCode4Btn) {
+            scanCode4Btn.addEventListener('click', startCode4Scanner);
+        }
+
+        // 2. ISBN Scanner Button aktivieren
+        const scanIsbnBtn = document.getElementById('scan-isbn-btn');
+        if (scanIsbnBtn) {
+            scanIsbnBtn.addEventListener('click', startIsbnScanner);
+        }
+
+        // 3. Dropdown-Modus Wechsel überwachen
+        const scanModeSelect = document.getElementById('scan_mode');
+        if (scanModeSelect) {
+            scanModeSelect.addEventListener('change', toggleScanMode);
+        }
+
+        // 4. ISBN Live-Validierung
+        const isbnInput = document.getElementById('isbn');
+        if (isbnInput && typeof updateIsbnLiveValidation === 'function') {
+            isbnInput.addEventListener('input', updateIsbnLiveValidation);
+        }
+    });
     // Load predefined filter values for dropdowns
     function loadPredefinedFilterValues(filterNumber) {
         fetch(`/get_predefined_filter_values/${filterNumber}`)
@@ -1344,6 +1575,7 @@
         // Get form fields
         const nameField = document.getElementById('name');
         const descriptionField = document.getElementById('beschreibung');
+        const priceField = document.getElementById('anschaffungskosten'); // <-- NEU
         
         if (!nameField || !descriptionField) {
             alert('Fehler: Formularfelder nicht gefunden.');
@@ -1381,6 +1613,13 @@
         nameField.value = bookTitle;
         descriptionField.value = description;
         
+        // Preis in das Formularfeld eintragen
+        if (priceField && currentBookData.price !== null && currentBookData.price !== undefined) {
+            // Wandelt den Float (z.B. 12.25) in einen String mit Komma (12,25) um
+            let formattedPrice = currentBookData.price.toString().replace('.', ',');
+            priceField.value = formattedPrice;
+        }
+
         // Download and import book cover image if available
         if (currentBookData.thumbnail) {
             downloadBookCover(currentBookData.thumbnail);
@@ -1558,6 +1797,7 @@
         }, 10000);
     }
 
+    // Exported function for use within parent layout fields
     function validateCodeField(input, excludeId = null) {
         const code = input.value.trim();
         
@@ -1683,16 +1923,6 @@
             });
         }
 
-        const scanCodeBtn = document.getElementById('scan-code4-btn');
-        if (scanCodeBtn) {
-            scanCodeBtn.addEventListener('click', startCode4Scanner);
-        }
-
-        const scanIsbnBtn = document.getElementById('scan-isbn-btn');
-        if (scanIsbnBtn) {
-            scanIsbnBtn.addEventListener('click', startIsbnScanner);
-        }
-
         const isbnField = document.getElementById('isbn');
         if (isbnField) {
             isbnField.addEventListener('input', updateIsbnLiveValidation);
@@ -1732,188 +1962,11 @@
             if (typeof duplicateData.images === 'string') {
                 try {
                     duplicateData.images = JSON.parse(duplicateData.images);
-                    console.log("Parsed images from string:", duplicateData.images);
                 } catch (e) {
-                    console.warn("Failed to parse images string, using as single item:", duplicateData.images);
-                    duplicateData.images = [duplicateData.images];
+                    console.error("Error parsing duplicate images array:", e);
                 }
             }
-            console.log(`Final duplicateData.images (${Array.isArray(duplicateData.images) ? 'array' : typeof duplicateData.images}):`, duplicateData.images);
-        }
-    }
-    
-    // Then check for sessionStorage data (takes priority)
-    const sessionData = sessionStorage.getItem('duplicateItemData');
-    if (sessionData) {
-        try {
-            duplicateData = JSON.parse(sessionData);
-            sessionStorage.removeItem('duplicateItemData'); // Clean up
-            console.log("Session storage duplicate data:", duplicateData);
-        } catch (e) {
-            console.error('Error parsing session duplicate data:', e);
-        }
-    }
-    
-    // Function to prefill form with duplicate data
-    function prefillFormWithDuplicateData() {
-        if (!duplicateData) return;
-        
-        // Fill basic fields
-        const nameField = document.getElementById('name');
-        if (nameField && duplicateData.name) nameField.value = duplicateData.name;
-        
-        const descField = document.getElementById('beschreibung');
-        if (descField && duplicateData.description) descField.value = duplicateData.description;
-        
-        const yearField = document.getElementById('anschaffungsjahr');
-        if (yearField && duplicateData.year) yearField.value = duplicateData.year;
-        
-        const costField = document.getElementById('anschaffungskosten');
-        if (costField && duplicateData.cost) costField.value = duplicateData.cost;
-        
-        // Fill location dropdown
-        const locationField = document.getElementById('ort');
-        if (locationField && duplicateData.location) {
-            // Wait for locations to load, then set value
-            setTimeout(() => {
-                locationField.value = duplicateData.location;
-            }, 100);
-        }
-        
-        // Fill filter arrays - handle up to 4 values per filter type
-        setTimeout(() => {
-            // Filter 1 (Unterrichtsfach)
-            if (duplicateData.filter1 && Array.isArray(duplicateData.filter1)) {
-                for (let j = 1; j <= Math.min(4, duplicateData.filter1.length); j++) {
-                    const filterField = document.getElementById(`filter1-${j}`);
-                    if (filterField && duplicateData.filter1[j-1]) {
-                        filterField.value = duplicateData.filter1[j-1];
-                    }
-                }
-            }
-            
-            // Filter 2 (Jahrgangsstufe)
-            if (duplicateData.filter2 && Array.isArray(duplicateData.filter2)) {
-                for (let j = 1; j <= Math.min(4, duplicateData.filter2.length); j++) {
-                    const filterField = document.getElementById(`filter2-${j}`);
-                    if (filterField && duplicateData.filter2[j-1]) {
-                        filterField.value = duplicateData.filter2[j-1];
-                    }
-                }
-            }
-            
-            // Filter 3 (Thema) - text inputs
-            if (duplicateData.filter3 && Array.isArray(duplicateData.filter3)) {
-                for (let j = 1; j <= Math.min(4, duplicateData.filter3.length); j++) {
-                    const filterField = document.getElementById(`filter3-${j}`);
-                    if (filterField && duplicateData.filter3[j-1]) {
-                        filterField.value = duplicateData.filter3[j-1];
-                    }
-                }
-            }
-        }, 200); // Wait for filter options to load
-        
-        // Handle images - add hidden inputs for duplicate images
-        if (duplicateData.images && duplicateData.images.length > 0) {
-            console.log("Duplicate images data:", duplicateData.images);
-            const form = document.querySelector('form[action*="upload_item"]');
-            if (form) {
-                // Add hidden field to indicate duplication
-                const isDuplicatingField = document.createElement('input');
-                isDuplicatingField.type = 'hidden';
-                isDuplicatingField.name = 'is_duplicating';
-                isDuplicatingField.value = 'true';
-                form.appendChild(isDuplicatingField);
-                
-                // Add each image as a duplicate image
-                const images = duplicateData.images || [];
-                console.log(`Adding ${images.length} images as hidden fields`);
-                
-                if (Array.isArray(images)) {
-                    images.forEach((imageName, index) => {
-                        if (imageName) {
-                            console.log(`Adding duplicate image ${index}: ${imageName}`);
-                            const imageField = document.createElement('input');
-                            imageField.type = 'hidden';
-                            imageField.name = 'duplicate_images';
-                            imageField.value = imageName;
-                            form.appendChild(imageField);
-                        }
-                    });
-                } else {
-                    console.warn("Images is not an array:", images);
-                    // Try to handle as single item if it's a string
-                    if (typeof images === 'string' && images) {
-                        console.log("Adding single image:", images);
-                        const imageField = document.createElement('input');
-                        imageField.type = 'hidden';
-                        imageField.name = 'duplicate_images';
-                        imageField.value = images;
-                        form.appendChild(imageField);
-                    }
-                }
-                
-                // Show image preview
-                showDuplicateImagePreview(duplicateData.images);
-            }
-        }
-    }
-    
-    // Function to show preview of duplicate images
-    function showDuplicateImagePreview(images) {
-        const previewContainer = document.getElementById('image-preview-container');
-        if (!previewContainer) return;
-        
-        console.log("showDuplicateImagePreview called with:", images);
-        
-        // Make sure images is treated as an array
-        if (!Array.isArray(images)) {
-            if (typeof images === 'string') {
-                // Try to parse if it's a JSON string
-                try {
-                    images = JSON.parse(images);
-                } catch (e) {
-                    // If parsing fails, wrap the single string in an array
-                    images = [images];
-                }
-            } else {
-                console.error("Invalid images data:", images);
-                return;
-            }
-        }
-        
-        previewContainer.innerHTML = '';
-        console.log(`Processing ${images.length} images for preview`);
-        
-        images.forEach((imageName, index) => {
-            console.log(`Processing image ${index}:`, imageName);
-            const preview = document.createElement('div');
-            preview.className = 'image-preview-item';
-            preview.innerHTML = `
-                <img src="/uploads/${imageName}" alt="Duplicate Image ${index + 1}" class="duplicate-image-preview">
-                <div class="image-controls">
-                    <span>Von Original übernommen</span>
-                    <button type="button" onclick="removeDuplicateImage('${imageName}', this)" class="remove-duplicate-image-button">Entfernen</button>
-                </div>
-            `;
-            previewContainer.appendChild(preview);
-        });
-    }
-    
-    // Function to remove a duplicate image
-    function removeDuplicateImage(imageName, button) {
-        // Remove the hidden input
-        const hiddenInputs = document.querySelectorAll('input[name="duplicate_images"]');
-        hiddenInputs.forEach(input => {
-            if (input.value === imageName) {
-                input.remove();
-            }
-        });
-        
-        // Remove the preview
-        const previewItem = button.closest('.image-preview-item');
-        if (previewItem) {
-            previewItem.remove();
+            console.log("Parsed duplicate images successfully.");
         }
     }
 </script>

Web/tenant.py

@@ -212,6 +212,7 @@ def _module_name_candidates(module_name):
     candidates = [normalized]
     alias_groups = {
         'inventory': {'inventory', 'inventar'},
+        'terminplan': {'terminplan', 'terminplaner', 'termin', 'appointments'},
         'library': {'library', 'bib', 'bibliothek'},
         'student_cards': {'student_cards', 'studentcards', 'schuelerausweise', 'schueler_ausweise'},
     }
@@ -472,6 +473,20 @@ class TenantContext:
         if not has_request_context():
             return None
 
+        # Query parameters are useful for public links that must open a specific tenant
+        # even when the host/subdomain cannot be mapped reliably.
+        tenant_from_query = (
+            request.args.get('tenant', '').strip()
+            or request.args.get('tenant_id', '').strip()
+            or request.args.get('tenantId', '').strip()
+        )
+        if tenant_from_query:
+            matched_tenant = _find_registered_tenant_id(tenant_from_query) or tenant_from_query
+            self.tenant_id = matched_tenant
+            self.config = get_tenant_config(matched_tenant)
+            session['tenant_id'] = matched_tenant
+            return self._get_db_name(matched_tenant)
+
         # Priority 1: X-Tenant-ID header (for testing/internal APIs)
         tenant_from_header = request.headers.get('X-Tenant-ID', '').strip()
         if tenant_from_header:
@@ -530,6 +545,10 @@ class TenantContext:
                     potential_subdomain = parts[0]
                     if potential_subdomain not in ('www', 'api', 'admin', 'app', 'mail'):
                         matched_tenant = _find_registered_tenant_id(potential_subdomain)
+                        if not matched_tenant and potential_subdomain.startswith('school'):
+                            matched_tenant = _find_registered_tenant_id('schule' + potential_subdomain[len('school'):])
+                        elif not matched_tenant and potential_subdomain.startswith('schule'):
+                            matched_tenant = _find_registered_tenant_id('school' + potential_subdomain[len('schule'):])
                         if matched_tenant:
                             self.subdomain = potential_subdomain
                             self.tenant_id = matched_tenant

config.json

@@ -19,6 +19,17 @@
         "cert": "Web/certs/cert.pem",
         "key": "Web/certs/key.pem"
     },
+    "email": {
+        "enabled": false,
+        "smtp_host": "smtp.gmail.com",
+        "smtp_port": 587,
+        "use_tls": true,
+        "username": "",
+        "password": "",
+        "from_address": "",
+        "default_sender_name": "Invario Inventurprogramm",
+        "timeout_seconds": 30
+    },
     "images": {
         "thumbnail_size": [
             150,
@@ -42,6 +53,9 @@
         "inventory": {
             "enabled": true
         },
+        "terminplan": {
+            "enabled": true
+        },
         "library": {
             "enabled": true
         },

docker-compose-multitenant.yml

@@ -55,6 +55,7 @@ services:
       interval: 10s
       timeout: 5s
       retries: 10
+      start_period: 30s
     environment:
       MONGO_INITDB_DATABASE: inventar_default
 
@@ -66,7 +67,7 @@ services:
         PYTHON_VERSION: "3.13"
         OPTIMIZATION_LEVEL: 2
     working_dir: /app/Web
-    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "30", "--graceful-timeout", "20", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
+    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "30", "--graceful-timeout", "20", "--max-requests", "1000", "--max-requests-jitter", "100", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
     restart: unless-stopped
     security_opt:
       - no-new-privileges:true

manage-tenant.sh

@@ -27,54 +27,14 @@ ensure_runtime_config_json() {
         cat > "$config_path" <<'EOF'
 {
     "ver": "2.6.5",
-    "dbg": false,
-    "host": "0.0.0.0",
-    "port": 8000,
-    "mongodb": {
-        "host": "mongodb",
-        "port": 27017,
-        "db": "Inventarsystem"
-    },
-    "modules": {
-        "library": {
-            "enabled": false
-        },
-        "student_cards": {
-            "enabled": false,
-            "default_borrow_days": 14,
-            "max_borrow_days": 365
-        }
-    }
+    "tenants": {}
 }
 EOF
-        echo "Created default runtime config at $config_path"
+        echo "Created default config.json"
     fi
 }
 
-show_help() {
-    echo "Usage: ./manage-tenant.sh [COMMAND] [OPTIONS]"
-    echo ""
-    echo "Commands:"
-    echo "  add <tenant_id> [port]       Add a new tenant (initializes database)"
-    echo "  trial <tenant_id> [port] [days] Create a 7-day demo tenant that auto-deletes after expiry"
-    echo "  remove <tenant_id>           Remove a tenant completely (deletes data!)"
-    echo "  restart-tenant <id>          'Restart' a single tenant (clears cache/sessions)"
-    echo "  restart-all                  Restart all application containers (zero-downtime reload)"
-    echo "  list                         List active tenants"
-    echo "  module <tenant_id> <module>=<on|off>... Enable/disable modules for a tenant"
-    echo "  -h, --help                   Show this help message"
-    echo ""
-    echo "Examples:"
-    echo "  ./manage-tenant.sh add school_a 10001"
-    echo "  ./manage-tenant.sh trial school_demo 10002 7"
-    echo "  ./manage-tenant.sh remove test_tenant"
-    echo "  ./manage-tenant.sh module school_a inventory=off library=on"
-    echo "  ./manage-tenant.sh restart-all"
-    echo "  ./manage-tenant.sh -h"
-    exit 1
-}
-
-tenant_aliases() {
+get_tenant_aliases() {
     local tenant_id="$1"
     local normalized alias
     normalized="$(printf '%s' "$tenant_id" | tr '[:upper:]' '[:lower:]')"
@@ -201,6 +161,8 @@ existing['modules'] = {
     'inventory': {'enabled': True},
     'library': {'enabled': True},
     'student_cards': {'enabled': True, 'default_borrow_days': 14, 'max_borrow_days': 365},
+    'terminplan': {'enabled': True},
+    'mail': {'enabled': True},
 }
 existing['trial'] = trial_config
 
@@ -232,8 +194,8 @@ initialize_tenant_database() {
         return 0
     fi
 
-    docker exec "$APP_CONTAINER" python3 -c '
-import sys, re, datetime, hashlib
+    docker exec -i "$APP_CONTAINER" python3 - "$tenant_id" "$mode" <<'PY'
+import sys, os, re, datetime, hashlib
 sys.path.insert(0, "/app")
 sys.path.insert(0, "/app/Web")
 from Web.modules.database import settings
@@ -245,7 +207,11 @@ sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
 db_name = f"inventar_{sanitized}"
 client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
 db = client[db_name]
-hashed_pw = hashlib.sha512("admin123".encode()).hexdigest()
+
+pw_bytes = "admin123".encode("utf-8")
+random_salt = os.urandom(16)
+hashed = hashlib.scrypt(pw_bytes, salt=random_salt, n=16384, r=8, p=1)
+hashed_pw_string = f"v1${random_salt.hex()}${hashed.hex()}"
 
 action_permissions = {
     "can_borrow": True,
@@ -281,7 +247,7 @@ page_permissions = {
 if db.users.count_documents({"Username": "admin"}) == 0:
     db.users.insert_one({
         "Username": "admin",
-        "Password": hashed_pw,
+        "Password": hashed_pw_string,
         "Admin": True,
         "active_ausleihung": None,
         "name": "Admin",
@@ -306,64 +272,66 @@ if mode == "trial":
     )
 
 print(f"Tenant {sys.argv[1]} database initialized. Default admin: admin / admin123")
-' "$tenant_id" "$mode"
+PY
 }
 
 update_runtime_ports() {
     local new_port="$1"
     local env_file="$PWD/.docker-build.env"
-    local current_ports=""
-    local port_list=()
-    local unique_ports=()
-    local first_port=""
-    if [ -n "$new_port" ]; then
-        if [ -f "$env_file" ]; then
-            current_ports="$(awk -F= '/^INVENTAR_HTTP_PORTS=/{print $2; exit}' "$env_file" | tr -d ' ' || true)"
-            if [ -z "$current_ports" ]; then
-                current_ports="$(awk -F= '/^INVENTAR_HTTP_PORT=/{print $2; exit}' "$env_file" | tr -d ' ' || true)"
-            fi
+    local current_ports port_list unique_ports first_port ports_csv
+
+    if [ -z "$new_port" ]; then
+        return 0
+    fi
+
+    current_ports=""
+    if [ -f "$env_file" ]; then
+        current_ports="$(awk -F= '/^INVENTAR_HTTP_PORTS=/{print $2; exit}' "$env_file" | tr -d ' ' || true)"
+        if [ -z "$current_ports" ]; then
+            current_ports="$(awk -F= '/^INVENTAR_HTTP_PORT=/{print $2; exit}' "$env_file" | tr -d ' ' || true)"
         fi
+    fi
 
-        if [ -n "$current_ports" ]; then
-            IFS=',' read -r -a port_list <<<"${current_ports// /,}"
+    port_list=()
+    unique_ports=()
+    if [ -n "$current_ports" ]; then
+        IFS=',' read -r -a port_list <<<"${current_ports// /,}"
+    fi
+    port_list+=("$new_port")
+
+    for port in "${port_list[@]}"; do
+        if [ -n "$port" ] && ! printf '%s\n' "${unique_ports[@]}" | grep -qx "$port"; then
+            unique_ports+=("$port")
         fi
-        port_list+=("$new_port")
+    done
 
-        for port in "${port_list[@]}"; do
-            if [ -n "$port" ] && ! printf '%s\n' "${unique_ports[@]}" | grep -qx "$port"; then
-                unique_ports+=("$port")
-            fi
-        done
+    if [ ${#unique_ports[@]} -eq 0 ]; then
+        unique_ports=("$new_port")
+    fi
 
-        if [ ${#unique_ports[@]} -eq 0 ]; then
-            unique_ports=("$new_port")
-        fi
+    first_port="${unique_ports[0]}"
+    ports_csv="$(IFS=,; echo "${unique_ports[*]}")"
 
-        first_port="${unique_ports[0]}"
-        local ports_csv
-        ports_csv="$(IFS=,; echo "${unique_ports[*]}")"
-
-        if [ ! -f "$env_file" ]; then
-            cat > "$env_file" <<EOF
+    if [ ! -f "$env_file" ]; then
+        cat > "$env_file" <<EOF
 NUITKA_BUILD=0
 INVENTAR_HTTP_PORT=$first_port
 INVENTAR_HTTP_PORTS=$ports_csv
 EOF
+    else
+        if grep -q '^INVENTAR_HTTP_PORTS=' "$env_file" 2>/dev/null; then
+            sed -i "s|^INVENTAR_HTTP_PORTS=.*|INVENTAR_HTTP_PORTS=$ports_csv|" "$env_file"
         else
-            if grep -q '^INVENTAR_HTTP_PORTS=' "$env_file" 2>/dev/null; then
-                sed -i "s|^INVENTAR_HTTP_PORTS=.*|INVENTAR_HTTP_PORTS=$ports_csv|" "$env_file"
-            else
-                printf '\nINVENTAR_HTTP_PORTS=%s\n' "$ports_csv" >> "$env_file"
-            fi
-            if grep -q '^INVENTAR_HTTP_PORT=' "$env_file" 2>/dev/null; then
-                sed -i "s|^INVENTAR_HTTP_PORT=.*|INVENTAR_HTTP_PORT=$first_port|" "$env_file"
-            else
-                printf '\nINVENTAR_HTTP_PORT=%s\n' "$first_port" >> "$env_file"
-            fi
+            printf '\nINVENTAR_HTTP_PORTS=%s\n' "$ports_csv" >> "$env_file"
+        fi
+        if grep -q '^INVENTAR_HTTP_PORT=' "$env_file" 2>/dev/null; then
+            sed -i "s|^INVENTAR_HTTP_PORT=.*|INVENTAR_HTTP_PORT=$first_port|" "$env_file"
+        else
+            printf '\nINVENTAR_HTTP_PORT=%s\n' "$first_port" >> "$env_file"
         fi
-
-        echo "Updated runtime env ports: $ports_csv"
     fi
+
+    echo "Updated runtime env ports: $ports_csv"
 }
 
 sync_tenant_port_map() {
@@ -420,7 +388,6 @@ restart_app_container() {
 
     ensure_runtime_config_json
     
-    # If HOST_WORKDIR is set (called from container), use absolute paths so docker daemon resolves them correctly
     if [ -n "${HOST_WORKDIR:-}" ]; then
         workdir="$HOST_WORKDIR"
         compose_args+=( -f "$(readlink -f "$HOST_WORKDIR/docker-compose-multitenant.yml")" )
@@ -431,7 +398,6 @@ restart_app_container() {
             compose_args+=( --env-file "$(readlink -f "$HOST_WORKDIR/.docker-build.env")" )
         fi
     else
-        # Normal case: called directly from host
         compose_args+=( -f "$workdir/docker-compose-multitenant.yml" )
         if [ -f "$workdir/.docker-compose.runtime.override.yml" ]; then
             compose_args+=( -f "$workdir/.docker-compose.runtime.override.yml" )
@@ -441,7 +407,6 @@ restart_app_container() {
         fi
     fi
     
-    # Pass along COMPOSE_PROJECT_NAME if set so the internal docker-compose sees it
     if [ -n "${COMPOSE_PROJECT_NAME:-}" ]; then
         compose_args=( -p "$COMPOSE_PROJECT_NAME" "${compose_args[@]}" )
     fi
@@ -551,24 +516,83 @@ remove_runtime_port() {
     fi
 }
 
+show_help() {
+    local HEADER='\033[95m'
+    local BLUE='\033[94m'
+    local GREEN='\033[92m'
+    local YELLOW='\033[93m'
+    local RED='\033[91m'
+    local BOLD='\033[1m'
+    local RESET='\033[0m'
+
+    cat << EOF
+
+${HEADER}${BOLD}=== MULTI-TENANT INVENTAR MANAGER ===${RESET}
+${YELLOW}Nutzung:${RESET} $0 <befehl> [tenant_id] [optionen]
+
+${BLUE}${BOLD}VERFÜGBARE BEFEHLE:${RESET}
+  ${GREEN}add${RESET} <tenant_id> [port]
+    Legt einen neuen Tenant an, registriert den Port und initialisiert 
+    die MongoDB-Datenbank mit einem Standard-Admin (${YELLOW}admin / admin123${RESET}).
+
+  ${GREEN}trial${RESET} <tenant_id> [port] [tage]
+    Erstellt einen temporären Test-Tenant. Standardlaufzeit: 7 Tage.
+    Läuft automatisch ab und löscht sich selbst.
+
+  ${GREEN}remove${RESET} [-y|--yes] <tenant_id>
+    Löscht einen Tenant, seine Konfiguration, Ports und die Datenbank.
+    Nutze ${RED}-y${RESET}, um die Bestätigungsabfrage zu überspringen.
+
+  ${GREEN}restart-tenant${RESET} <tenant_id>
+    Startet einen spezifischen Tenant neu, indem alle aktiven Sessions 
+    und der Cache in der MongoDB geleert werden (Sitzungs-Reset).
+
+  ${GREEN}restart-all${RESET}
+    Führt einen Zero-Downtime Rolling-Restart für alle App-Container durch.
+
+  ${GREEN}list${RESET}
+    Listet alle registrierten Tenants aus der 'config.json' sowie alle 
+    aktiven Tenant-Datenbanken aus der MongoDB auf.
+
+  ${GREEN}module${RESET} <tenant_id> <modulname>=<on|off> ...
+    Aktiviert oder deaktiviert bestimmte Features/Module für einen Tenant.
+    Es können mehrere Module gleichzeitig übergeben werden.
+
+${BLUE}${BOLD}GLOBALE OPTIONEN:${RESET}
+  ${GREEN}-h, --help${RESET}
+    Zeigt diese Hilfe an.
+
+${YELLOW}Beispiele:${RESET}
+  $0 add schule_muenchen 8081
+  $0 trial test_user 8082 14
+  $0 module schule_muenchen barre_code=on leih_historie=off
+  $0 remove -y test_user
+
+-----------------------------------------------------------------
+EOF
+}
+
 if [ -z "${1:-}" ]; then
     show_help
+    exit 0
 fi
 
 COMMAND="$1"
-TENANT_ID="${2:-}"
+
+# === MAIN ROUTING BLOCK ===
 
 case "$COMMAND" in
     -h|--help)
         show_help
         ;;
     add)
+        TENANT_ID="${2:-}"
         if [ -z "$TENANT_ID" ]; then
             echo "Error: Please provide a tenant_id."
             exit 1
         fi
 
-        PORT_ARG="$3"
+        PORT_ARG="${3:-}"
         if [ -n "$PORT_ARG" ]; then
             if ! printf '%s\n' "$PORT_ARG" | grep -qE '^[0-9]+$'; then
                 echo "Error: Port must be a numeric value."
@@ -583,68 +607,13 @@ case "$COMMAND" in
         fi
 
         echo "Adding new tenant '$TENANT_ID'..."
-        # Initialize tenant database via Python inside container
         echo "Initializing database for $TENANT_ID..."
-        APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
-        if [ -n "$APP_CONTAINER" ]; then
-            docker exec $APP_CONTAINER python3 -c "
-import sys, re; sys.path.insert(0, '/app'); sys.path.insert(0, '/app/Web'); from Web.modules.database import settings; from pymongo import MongoClient; import hashlib
-tenant_id = sys.argv[1].lower()
-sanitized = ''.join(c for c in tenant_id if c.isalnum() or c == '_')
-db_name = f'inventar_{sanitized}'
-client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
-db = client[db_name]
-hashed_pw = hashlib.sha512('admin123'.encode()).hexdigest()
-if db.users.count_documents({'Username': 'admin'}) == 0:
-    db.users.insert_one({
-        'Username': 'admin',
-        'Password': hashed_pw,
-        'Admin': True,
-        'active_ausleihung': None,
-        'name': 'Admin',
-        'last_name': 'User',
-        'IsStudent': False,
-        'PermissionPreset': 'full_access',
-        'ActionPermissions': {
-            'can_borrow': True,
-            'can_insert': True,
-            'can_edit': True,
-            'can_delete': True,
-            'can_manage_users': True,
-            'can_manage_settings': True,
-            'can_view_logs': True,
-        },
-        'PagePermissions': {
-            'home': True,
-            'tutorial_page': True,
-            'my_borrowed_items': True,
-            'notifications_view': True,
-            'impressum': True,
-            'license': True,
-            'library_view': True,
-            'terminplan': True,
-            'home_admin': True,
-            'upload_admin': True,
-            'library_admin': True,
-            'admin_borrowings': True,
-            'library_loans_admin': True,
-            'admin_damaged_items': True,
-            'admin_audit_dashboard': True,
-            'logs': True,
-            'manage_filters': True,
-            'manage_locations': True,
-        },
-    })
-print(f'Tenant {sys.argv[1]} database initialized. Default admin: admin / admin123')
-" "$TENANT_ID"
-            echo "Tenant '$TENANT_ID' successfully added. Ready to use."
-        else
-            echo "Warning: Application container is not running. Please start the multi-tenant system first."
-            echo "Data will be initialized upon first access by the tenant."
-        fi
+        initialize_tenant_database "$TENANT_ID" "standard"
+        echo "Tenant '$TENANT_ID' successfully added. Ready to use."
         ;;
 
     trial)
+        TENANT_ID="${2:-}"
         if [ -z "$TENANT_ID" ]; then
             echo "Error: Please provide a tenant_id."
             exit 1
@@ -675,68 +644,105 @@ print(f'Tenant {sys.argv[1]} database initialized. Default admin: admin / admin1
         ;;
     
     remove)
+        FORCE_REMOVE=false
+        TENANT_ARG="${2:-}"
+        
+        if [ "$TENANT_ARG" = "--yes" ] || [ "$TENANT_ARG" = "-y" ]; then
+            FORCE_REMOVE=true
+            TENANT_ID="${3:-}"
+        else
+            TENANT_ID="$TENANT_ARG"
+        fi
+
         if [ -z "$TENANT_ID" ]; then
             echo "Error: Please provide a tenant_id to remove."
             exit 1
         fi
-        echo -n "WARNING: Are you sure you want to permanently delete all data for tenant '$TENANT_ID'? (y/N) "
-        read confirm
-        if [ "$confirm" = "y" ] || [ "$confirm" = "Y" ]; then
-            echo "Removing tenant '$TENANT_ID'..."
-            APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
-            if [ -n "$APP_CONTAINER" ]; then
-                docker exec $APP_CONTAINER python3 -c "
-import sys; sys.path.insert(0, '/app'); sys.path.insert(0, '/app/Web'); from tenant import TenantContext; from Web.modules.database import settings; from pymongo import MongoClient
-ctx = TenantContext()
-db_name = ctx._get_db_name(sys.argv[1])
-client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
-client.drop_database(db_name)
-print(f'Database for tenant {sys.argv[1]} dropped.')
-" "$TENANT_ID"
-                echo "Tenant '$TENANT_ID' database removed."
-            else
-                echo "Warning: Application container not running. Tenant database may still exist in MongoDB."
-            fi
 
-            port_to_remove=""
+        if [ "$FORCE_REMOVE" != true ]; then
+            echo -n "WARNING: Are you sure you want to permanently delete all data for tenant '$TENANT_ID'? (y/N) "
+            read confirm
+            if [ "$confirm" != "y" ] && [ "$confirm" != "Y" ]; then
+                echo "Removal canceled."
+                exit 0
+            fi
+        fi
+
+        echo "Removing tenant '$TENANT_ID'..."
+        APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
+        port_to_remove=""
+        
+        if [ -n "$APP_CONTAINER" ]; then
+            # Zuerst die Datenbank via PyMongo hart droppen (Erzwungenes Löschen)
+            port_to_remove="$(docker exec "$APP_CONTAINER" python3 - "$TENANT_ID" <<'PY'
+import sys, re
+sys.path.insert(0, '/app')
+sys.path.insert(0, '/app/Web')
+from tenant import delete_tenant, get_tenant_config
+from Web.modules.database import settings
+from pymongo import MongoClient
+
+tenant_id = sys.argv[1]
+tenant_cfg = get_tenant_config(tenant_id)
+port = tenant_cfg.get('port')
+
+# Datenbanknamen exakt rekonstruieren
+sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
+db_name = f"inventar_{sanitized}"
+
+try:
+    client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
+    client.drop_database(db_name)
+    print(f"MongoDB database '{db_name}' dropped successfully.", file=sys.stderr)
+except Exception as e:
+    print(f"Warning: Could not drop database '{db_name}': {e}", file=sys.stderr)
+
+if not delete_tenant(tenant_id):
+    print(f'Error: failed to delete tenant {tenant_id}', file=sys.stderr)
+    sys.exit(1)
+
+if port is not None:
+    print(port)
+PY
+            )"
+            echo "Tenant '$TENANT_ID' database and config removed."
+        else
+            echo "Warning: Application container not running. Tenant database may still exist in MongoDB."
             if port_to_remove="$(remove_tenant_port "$TENANT_ID" 2>/dev/null)"; then
-                if [ -n "$port_to_remove" ]; then
-                    remove_runtime_port "$port_to_remove"
-                    sync_tenant_port_map
-                    if [ -n "$(docker ps -qf 'name=app' | head -n 1)" ]; then
-                        restart_app_container
-                    fi
-                    echo "Removed tenant '$TENANT_ID' from config.json and cleaned runtime port $port_to_remove."
-                else
-                    sync_tenant_port_map
-                    if [ -n "$(docker ps -qf 'name=app' | head -n 1)" ]; then
-                        restart_app_container
-                    fi
-                    echo "Removed tenant '$TENANT_ID' from config.json. No port mapping was present."
-                fi
+                :
             else
                 echo "Warning: tenant '$TENANT_ID' was not configured in config.json or could not be removed."
             fi
+        fi
+
+        if [ -n "$port_to_remove" ]; then
+            remove_runtime_port "$port_to_remove"
+        fi
+        sync_tenant_port_map
+        if [ -n "$(docker ps -qf 'name=app' | head -n 1)" ]; then
+            restart_app_container
+        fi
+        if [ -n "$port_to_remove" ]; then
+            echo "Removed tenant '$TENANT_ID' and cleaned runtime port $port_to_remove."
         else
-            echo "Removal canceled."
+            echo "Removed tenant '$TENANT_ID'. No port mapping was present."
         fi
         ;;
 
     restart-tenant)
+        TENANT_ID="${2:-}"
         if [ -z "$TENANT_ID" ]; then
             echo "Error: Please provide a tenant_id."
             exit 1
         fi
         echo "Restarting tenant '$TENANT_ID' (clearing session/cache)..."
-        # To restart a single tenant without restarting the global python processes,
-        # we can invalidate their cache or drop their sessions collection to sign everyone out
         APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
         if [ -n "$APP_CONTAINER" ]; then
             docker exec $APP_CONTAINER python3 -c "
 import sys; sys.path.insert(0, '/app'); sys.path.insert(0, '/app/Web'); from Web.modules.database import settings; from pymongo import MongoClient
 client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
 db = client[f'{settings.MONGODB_DB}_{sys.argv[1]}']
-db.sessions.drop() # Force sign-out / session clear
+db.sessions.drop()
 print(f'Tenant {sys.argv[1]} session cache cleared. Tenant restarted.')
 " "$TENANT_ID"
             echo "Tenant '$TENANT_ID' has been refreshed without impacting others."
@@ -799,12 +805,12 @@ PY
         ;;
 
     module)
+        TENANT_ID="${2:-}"
         if [ -z "$TENANT_ID" ] || [ -z "${3:-}" ]; then
             echo "Error: Usage: manage-tenant.sh module <tenant_id> <module_name>=<on|off> [...]"
             exit 1
         fi
         
-        # Pass all remaining arguments to python script
         shift 2
         
         if python3 - "$CONFIG_FILE" "$TENANT_ID" "$@" <<'PY'
@@ -874,10 +880,197 @@ PY
         fi
         ;;
 
+    backup)
+        TENANT_ID="${2:-}"
+        if [ -z "$TENANT_ID" ]; then
+            echo "Error: Please provide a tenant_id."
+            exit 1
+        fi
+        
+        OUTPUT_FILE="${3:-backup_${TENANT_ID}_$(date +%Y%m%d_%H%M%S).zip}"
+        
+        APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
+        if [ -z "$APP_CONTAINER" ]; then
+            echo "Error: Application container not running."
+            exit 1
+        fi
+        
+        echo "Creating complete backup (.zip) for tenant '$TENANT_ID'..."
+        
+        # We generate the zip temporarily inside the container
+        CONTAINER_TMP_ZIP="/tmp/backup_${TENANT_ID}_$(date +%s).zip"
+        
+        docker exec "$APP_CONTAINER" python3 - "$TENANT_ID" "$CONTAINER_TMP_ZIP" <<'PY'
+import sys, os, zipfile
+from bson import json_util
+sys.path.insert(0, '/app')
+sys.path.insert(0, '/app/Web')
+from Web.modules.database import settings
+from pymongo import MongoClient
+
+tenant_id = sys.argv[1]
+zip_path = sys.argv[2]
+
+# CHANGE THIS if your app stores files in a different directory
+UPLOADS_BASE = f"/app/uploads/{tenant_id}"
+
+sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
+db_name = f"inventar_{sanitized}"
+
+try:
+    client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
+    db = client[db_name]
+
+    dump = {}
+    for coll_name in db.list_collection_names():
+        if coll_name.startswith('system.'): 
+            continue
+        dump[coll_name] = list(db[coll_name].find())
+
+    db_json = json_util.dumps(dump)
+
+    with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:
+        # 1. Write the database dump
+        zf.writestr('database.json', db_json)
+        
+        # 2. Add uploaded photos/invoices if the directory exists
+        if os.path.isdir(UPLOADS_BASE):
+            for root, dirs, files in os.walk(UPLOADS_BASE):
+                for file in files:
+                    file_path = os.path.join(root, file)
+                    # Create a relative path for the zip internal structure
+                    arcname = os.path.relpath(file_path, start=UPLOADS_BASE)
+                    zf.write(file_path, arcname=f"uploads/{arcname}")
+                    
+except Exception as e:
+    print(f"Error creating backup: {e}", file=sys.stderr)
+    sys.exit(1)
+PY
+        
+        if [ $? -eq 0 ]; then
+            # Copy the zip out of the container to the host
+            docker cp "$APP_CONTAINER:$CONTAINER_TMP_ZIP" "$OUTPUT_FILE"
+            # Cleanup inside the container
+            docker exec "$APP_CONTAINER" rm -f "$CONTAINER_TMP_ZIP"
+            echo "Backup successfully created: $OUTPUT_FILE"
+        else
+            echo "Error: Backup failed."
+            docker exec "$APP_CONTAINER" rm -f "$CONTAINER_TMP_ZIP"
+            exit 1
+        fi
+        ;;
+
+    restore)
+        TENANT_ID="${2:-}"
+        INPUT_FILE="${3:-}"
+        
+        if [ -z "$TENANT_ID" ] || [ -z "$INPUT_FILE" ]; then
+            echo "Error: Usage: $0 restore <tenant_id> <backup_file.zip>"
+            exit 1
+        fi
+        
+        if [ ! -f "$INPUT_FILE" ]; then
+            echo "Error: Backup file '$INPUT_FILE' not found."
+            exit 1
+        fi
+        
+        echo -n "WARNING: This will DROP the existing database and completely overwrite data AND files for tenant '$TENANT_ID'. Are you sure? (y/N) "
+        read confirm
+        if [ "$confirm" != "y" ] && [ "$confirm" != "Y" ]; then
+            echo "Restore canceled."
+            exit 0
+        fi
+        
+        APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
+        if [ -z "$APP_CONTAINER" ]; then
+            echo "Error: Application container not running."
+            exit 1
+        fi
+        
+        echo "Uploading backup archive to container..."
+        CONTAINER_TMP_ZIP="/tmp/restore_${TENANT_ID}_$(date +%s).zip"
+        docker cp "$INPUT_FILE" "$APP_CONTAINER:$CONTAINER_TMP_ZIP"
+        
+        echo "Restoring database and files for tenant '$TENANT_ID'..."
+        
+        docker exec "$APP_CONTAINER" python3 - "$TENANT_ID" "$CONTAINER_TMP_ZIP" <<'PY'
+import sys, os, zipfile, shutil
+from bson import json_util
+sys.path.insert(0, '/app')
+sys.path.insert(0, '/app/Web')
+from Web.modules.database import settings
+from pymongo import MongoClient
+
+tenant_id = sys.argv[1]
+zip_path = sys.argv[2]
+
+# CHANGE THIS if your app stores files in a different directory
+UPLOADS_BASE = f"/app/uploads/{tenant_id}"
+
+sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
+db_name = f"inventar_{sanitized}"
+
+try:
+    with zipfile.ZipFile(zip_path, 'r') as zf:
+        # 1. Restore Database
+        db_json = zf.read('database.json').decode('utf-8')
+        data = json_util.loads(db_json)
+        
+        client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
+        client.drop_database(db_name)
+        db = client[db_name]
+        
+        restored_count = 0
+        for coll_name, docs in data.items():
+            if docs:
+                db[coll_name].insert_many(docs)
+                restored_count += len(docs)
+        
+        # 2. Restore Files
+        # Wipe existing uploads to ensure an exact replica of the backup
+        if os.path.exists(UPLOADS_BASE):
+            shutil.rmtree(UPLOADS_BASE)
+            
+        for item in zf.namelist():
+            # Extract only file items that were saved under 'uploads/'
+            if item.startswith('uploads/') and not item.endswith('/'):
+                rel_path = item[len('uploads/'):]
+                target_path = os.path.join(UPLOADS_BASE, rel_path)
+                
+                os.makedirs(os.path.dirname(target_path), exist_ok=True)
+                with open(target_path, 'wb') as f:
+                    f.write(zf.read(item))
+
+    print(f"Successfully restored {restored_count} database documents and tenant files.")
+except Exception as e:
+    print(f"Error restoring backup: {e}", file=sys.stderr)
+    sys.exit(1)
+PY
+
+        if [ $? -eq 0 ]; then
+            # Clean up tmp zip inside container
+            docker exec "$APP_CONTAINER" rm -f "$CONTAINER_TMP_ZIP"
+            echo "Restore completed successfully."
+            
+            echo "Clearing session cache..."
+            docker exec "$APP_CONTAINER" python3 -c "
+import sys; sys.path.insert(0, '/app'); sys.path.insert(0, '/app/Web'); from Web.modules.database import settings; from pymongo import MongoClient
+client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
+db = client[f'inventar_{"".join(c for c in sys.argv[1] if c.isalnum() or c == "_")}']
+db.sessions.drop()
+" "$TENANT_ID"
+            
+        else
+            echo "Error: Restore failed."
+            docker exec "$APP_CONTAINER" rm -f "$CONTAINER_TMP_ZIP"
+            exit 1
+        fi
+        ;;
+
     *)
         echo "Unknown command: $COMMAND"
         show_help
         ;;
 esac
 
-exit 0
+exit 0

requirements.txt

@@ -15,3 +15,4 @@ openpyxl
 cryptography>=42.0.0
 pywebpush
 py-vapid>=1.9.0
+beautifulsoup4

start.sh

@@ -572,7 +572,7 @@ write_runtime_compose_override() {
 services:
   app:
     working_dir: /app/Web
-    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "${INVENTAR_WORKERS:-2}", "--threads", "${INVENTAR_THREADS:-2}", "--timeout", "${INVENTAR_WORKER_TIMEOUT:-30}", "--graceful-timeout", "20", "--worker-connections", "${INVENTAR_WORKER_CONNECTIONS:-100}", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
+    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "${INVENTAR_WORKERS:-2}", "--threads", "${INVENTAR_THREADS:-2}", "--timeout", "${INVENTAR_WORKER_TIMEOUT:-30}", "--graceful-timeout", "20", "--worker-connections", "${INVENTAR_WORKER_CONNECTIONS:-100}", "--max-requests", "1000", "--max-requests-jitter", "100", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
     image: ${APP_IMAGE_VALUE}
     build: null
 EOF