Changes from old deployment system to new dynamic one

.docker-build.env

@@ -1,11 +0,0 @@
-NUITKA_BUILD=0
-INVENTAR_HTTP_PORT=10000
-INVENTAR_HTTP_PORTS=10000
-INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:v0.7.42
-INVENTAR_APP_CPUS=1.0
-INVENTAR_APP_MEM_LIMIT=384m
-INVENTAR_APP_MEM_SWAP_LIMIT=768m
-INVENTAR_WORKERS=4
-INVENTAR_THREADS=2
-INVENTAR_WORKER_TIMEOUT=30
-INVENTAR_WORKER_CONNECTIONS=100

.docker-compose.runtime.override.yml

@@ -1,8 +0,0 @@
-services:
-  app:
-    working_dir: /app/Web
-    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "4", "--threads", "2", "--timeout", "30", "--graceful-timeout", "20", "--worker-connections", "100", "--max-requests", "1000", "--max-requests-jitter", "100", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
-    image: ghcr.io/aiirondev/legendary-octo-garbanzo:v0.7.42
-    build: null
-    ports:
-      - "10000:8000"

.github/workflows/release-docker.yml

@@ -1,4 +1,4 @@
-name: https://github.com/AIIrondev/legendary-octo-garbanzo
+name: Release Inventarsystem
 
 on:
   push:
@@ -35,17 +35,17 @@ jobs:
         id: meta
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          EVENT_NAME: ${{ github.event_name }}
-          REF_NAME: ${{ github.ref_name }}
-          BUMP_TYPE: ${{ github.event.inputs.bump || 'patch' }}
+          REPO: ${{ gitea.repository }}
+          EVENT_NAME: ${{ gitea.event_name }}
+          REF_NAME: ${{ gitea.ref_name }}
+          BUMP_TYPE: ${{ gitea.event.inputs.bump || 'patch' }}
+          DOCKER_API_VERSION: '1.44'
         run: |
           if [ "$EVENT_NAME" = "push" ] && [ -n "$REF_NAME" ]; then
             TAG="$REF_NAME"
           else
-            # Fetch latest release tag via GitHub API (fall back to v0.8.31)
             latest_tag="v0.8.31"
-            if meta_json=$(curl -fsSL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "https://api.github.com/repos/$REPO/releases/latest" 2>/dev/null); then
+            if meta_json=$(curl -fsSL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/json" "https://git.invario-software.eu/api/v1/repos/$REPO/releases/latest" 2>/dev/null); then
               tag_name=$(printf "%s" "$meta_json" | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
               if [ -n "$tag_name" ]; then
                 latest_tag="$tag_name"
@@ -60,7 +60,6 @@ jobs:
               major=0; minor=8; patch=31
             fi
 
-            # Bump strategy: major / minor / patch
             if [ "${BUMP_TYPE:-}" = "major" ]; then
               major=$((major + 1)); minor=0; patch=0
             elif [ "${BUMP_TYPE:-}" = "minor" ]; then
@@ -69,11 +68,9 @@ jobs:
               patch=$((patch + 1))
             fi
             
-            # Zusammenbau des Tags für den manuellen Run
             TAG="v${major}.${minor}.${patch}"
           fi
 
-          # Validierung des erzeugten oder übergebenen Tags
           if ! echo "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+(-dev(\.[0-9]+)?)?$'; then
             echo "Error: tag '$TAG' is not valid semver (vX.Y.Z)"
             exit 1
@@ -92,13 +89,11 @@ jobs:
             LATEST_MAJOR="0"
           fi
 
-          # If not explicitly bumping major, disallow changing major version
           if [ "${BUMP_TYPE:-}" != "major" ] && [ "$TAG_MAJOR" != "$LATEST_MAJOR" ]; then
             echo "Error: major version must stay v$LATEST_MAJOR.x.x (got $TAG)"
             exit 1
           fi
 
-          # Ensure tag uniqueness: if tag exists append numeric suffix
           if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
             i=1
             base="$TAG"
@@ -108,19 +103,49 @@ jobs:
             TAG="${base}.${i}"
           fi
 
-          IMAGE="ghcr.io/aiirondev/legendary-octo-garbanzo:${TAG}"
+          LOWER_REPO=$(echo "$REPO" | tr '[:upper:]' '[:lower:]')
+          IMAGE="git.invario-software.eu/${LOWER_REPO}:${TAG}"
+          
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "image=$IMAGE" >> "$GITHUB_OUTPUT"
+          echo "lower_repo=$LOWER_REPO" >> "$GITHUB_OUTPUT"
+
+      - name: Ensure Docker CLI is available and up to date
+        run: |
+          install_docker=true
+          if command -v docker >/dev/null 2>&1; then
+            DOCKER_MAJOR=$(docker --version | grep -oE '[0-9]+' | head -n1)
+            if [ -n "$DOCKER_MAJOR" ] && [ "$DOCKER_MAJOR" -ge 25 ]; then
+              install_docker=false
+            fi
+          fi
+
+          if [ "$install_docker" = true ]; then
+            echo "Veraltete oder fehlende Docker-Installation erkannt. Lade statische Docker CLI herunter..."
+            DOCKER_VERSION="26.1.4"
+            if command -v curl >/dev/null 2>&1; then
+              curl -fsSLO "https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}.tgz"
+            else
+              wget -q "https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}.tgz"
+            fi
+            tar -xzf docker-${DOCKER_VERSION}.tgz
+            mkdir -p "$HOME/.local/bin"
+            cp docker/docker "$HOME/.local/bin/"
+            echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+            export PATH="$HOME/.local/bin:$PATH"
+            rm -rf docker docker-${DOCKER_VERSION}.tgz
+          fi
+          docker --version
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Login to GHCR
+      - name: Login to Gitea Container Registry
         uses: docker/login-action@v3
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: git.invario-software.eu
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push release image
         uses: docker/build-push-action@v6
@@ -128,126 +153,105 @@ jobs:
           context: .
           file: ./Dockerfile
           push: true
-          load: true # Lädt das Image in den lokalen Docker-Daemon für den 'docker save' Schritt
           tags: |
             ${{ steps.meta.outputs.image }}
-            ghcr.io/aiirondev/legendary-octo-garbanzo:latest
-
-      - name: Build local image tar for offline deploy
-        run: |
-          set -euo pipefail
-          IMG="${{ steps.meta.outputs.image }}"
-          TAG="${{ steps.meta.outputs.tag }}"
-
-          if docker image inspect "$IMG" >/dev/null 2>&1; then
-            echo "Using local image $IMG"
-            docker save "$IMG" | gzip > "inventarsystem-image-${TAG}.tar.gz"
-            exit 0
-          fi
-
-          echo "Local image $IMG not found, trying to pull"
-          if docker pull "$IMG" >/dev/null 2>&1; then
-            docker save "$IMG" | gzip > "inventarsystem-image-${TAG}.tar.gz"
-            exit 0
-          fi
-
-          echo "Pull failed, attempting local docker build as fallback"
-          docker build -t "$IMG" .
-          docker save "$IMG" | gzip > "inventarsystem-image-${TAG}.tar.gz"
+            git.invario-software.eu/${{ steps.meta.outputs.lower_repo }}:latest
 
       - name: Create release-only docker bundle
         run: |
-          mkdir -p release-bundle
-          cat > release-bundle/docker-compose.yml <<EOF
-          services:
-            app:
-              image: \${INVENTAR_APP_IMAGE:-ghcr.io/aiirondev/legendary-octo-garbanzo:${{ steps.meta.outputs.tag }}}
-              container_name: inventarsystem-app
-              restart: unless-stopped
-              ports:
-                - "\${INVENTAR_HTTP_PORT:-10000}:8000"
-              depends_on:
-                - mongodb
-                - redis
-              environment:
-                INVENTAR_MONGODB_HOST: mongodb
-                INVENTAR_MONGODB_PORT: "27017"
-                INVENTAR_MONGODB_DB: Inventarsystem
-                INVENTAR_BACKUP_FOLDER: /data/backups
-                INVENTAR_LOGS_FOLDER: /data/logs
-              expose:
-                - "8000"
-              volumes:
-                - ./config.json:/app/config.json:ro
-                - app_uploads:/app/Web/uploads
-                - app_thumbnails:/app/Web/thumbnails
-                - app_previews:/app/Web/previews
-                - app_qrcodes:/app/Web/QRCodes
-                - app_backups:/data/backups
-                - app_logs:/data/logs
+            mkdir -p release-bundle
+            cat > release-bundle/docker-compose.yml <<EOF
+            services:
+              app:
+                image: \${INVENTAR_APP_IMAGE:-${{ steps.meta.outputs.image }}}
+                container_name: inventarsystem-app
+                restart: unless-stopped
+                ports:
+                  - "\${INVENTAR_HTTP_PORT:-10000}:8000"
+                depends_on:
+                  - mongodb
+                  - redis
+                environment:
+                  INVENTAR_MONGODB_HOST: mongodb
+                  INVENTAR_MONGODB_PORT: "27017"
+                  INVENTAR_MONGODB_DB: Inventarsystem
+                  INVENTAR_BACKUP_FOLDER: /data/backups
+                  INVENTAR_LOGS_FOLDER: /data/logs
+                  INVENTAR_SECRET_KEY: ${{secrets.INVENTAR_SECRET_KEY}}
+                  INVENTAR_DATA_ENCRYPTION_KEY: ${{secrets.INVENTAR_DATA_ENCRYPTION_KEY}}
+                  INVENTAR_MONGODB_PASSWORD: ${{secrets.INVENTAR_MONGODB_PASSWORD}}
+                  EMAIL_ENABLED: ${{secrets.EMAIL_ENABLED}}
+                  EMAIL_SMTP_HOST: ${{secrets.EMAIL_SMTP_HOST}}
+                  EMAIL_SMTP_PORT: ${{secrets.EMAIL_SMTP_PORT}}
+                  EMAIL_USERNAME: ${{secrets.EMAIL_USERNAME}}
+                  EMAIL_PASSWORD: ${{secrets.EMAIL_PASSWORD}}
+                expose:
+                  - "8000"
+                volumes:
+                  - ./config.json:/app/config.json:ro
+                  - app_uploads:/app/Web/uploads
+                  - app_thumbnails:/app/Web/thumbnails
+                  - app_previews:/app/Web/previews
+                  - app_qrcodes:/app/Web/QRCodes
+                  - app_backups:/data/backups
+                  - app_logs:/data/logs
+            
+              mongodb:
+                image: mongo:7.0
+                container_name: inventarsystem-mongodb
+                restart: unless-stopped
+                volumes:
+                  - mongodb_data:/data/db
+                healthcheck:
+                  test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
+                  interval: 10s
+                  timeout: 5s
+                  retries: 10
+            
+              redis:
+                image: redis:7-alpine
+                container_name: inventarsystem-redis
+                restart: unless-stopped
+                command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru
+                ports:
+                  - "6379:6379"
+                volumes:
+                  - redis_data:/data
+                healthcheck:
+                  test: ["CMD", "redis-cli", "ping"]
+                  interval: 10s
+                  timeout: 5s
+                  retries: 5
+            
+            volumes:
+              mongodb_data:
+              app_uploads:
+              app_thumbnails:
+              app_previews:
+              app_qrcodes:
+              app_backups:
+              app_logs:
+              redis_data:
+            EOF
+            
+            for f in start.sh stop.sh restart.sh backup.sh restore.sh config.json update.sh; do
+              if [ -f "$f" ]; then
+                cp "$f" "release-bundle/$(basename "$f")"
+              fi
+            done
+            
+            for f in docker-compose-multitenant.yml manage-tenant.sh run-tenant-cmd.sh MULTITENANT_DEPLOYMENT.md MULTITENANT_PYTHON_API.md; do
+              if [ -f "$f" ]; then
+                cp "$f" "release-bundle/$(basename "$f")"
+              fi
+            done
+            
+            find release-bundle -maxdepth 1 -type f -name '*.sh' -exec chmod +x {} \; || true
+            tar -czf inventarsystem-docker-bundle.tar.gz -C release-bundle .
 
-            mongodb:
-              image: mongo:7.0
-              container_name: inventarsystem-mongodb
-              restart: unless-stopped
-              volumes:
-                - mongodb_data:/data/db
-              healthcheck:
-                test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
-                interval: 10s
-                timeout: 5s
-                retries: 10
-
-            redis:
-              image: redis:7-alpine
-              container_name: inventarsystem-redis
-              restart: unless-stopped
-              command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru
-              ports:
-                - "6379:6379"
-              volumes:
-                - redis_data:/data
-              healthcheck:
-                test: ["CMD", "redis-cli", "ping"]
-                interval: 10s
-                timeout: 5s
-                retries: 5
-
-          volumes:
-            mongodb_data:
-            app_uploads:
-            app_thumbnails:
-            app_previews:
-            app_qrcodes:
-            app_backups:
-            app_logs:
-            redis_data:
-          EOF
-
-          # Copy runtime scripts and config if present
-          for f in start.sh stop.sh restart.sh backup.sh config.json update.sh; do
-            if [ -f "$f" ]; then
-              cp "$f" "release-bundle/$(basename "$f")"
-            fi
-          done
-
-          # Multitenant scripts & docs (optional)
-          for f in docker-compose-multitenant.yml manage-tenant.sh run-tenant-cmd.sh MULTITENANT_DEPLOYMENT.md MULTITENANT_PYTHON_API.md; do
-            if [ -f "$f" ]; then
-              cp "$f" "release-bundle/$(basename "$f")"
-            fi
-          done
-
-          # Make any shipped scripts executable
-          find release-bundle -maxdepth 1 -type f -name '*.sh' -exec chmod +x {} \; || true
-          tar -czf inventarsystem-docker-bundle.tar.gz -C release-bundle .
-
-      - name: Create or update GitHub Release
-        uses: softprops/action-gh-release@v2
+      - name: Create or update Gitea Release
+        uses: https://gitea.com/actions/gitea-release-action@v1
         with:
           tag_name: ${{ steps.meta.outputs.tag }}
           files: |
-            inventarsystem-docker-bundle.tar.gz
-            inventarsystem-image-${{ steps.meta.outputs.tag }}.tar.gz
-          fail_on_unmatched_files: false
-          generate_release_notes: true
+            inventarsystem-docker-bundle.tar.gz

.gitignore

@@ -3,6 +3,7 @@ logs
 certs
 build
 .venv
+.idea
 __pycache__
 .pycvapid.json
 Web/vapid.json

.release-version

@@ -1 +0,0 @@
-v0.8.31.1

CODE_OF_CONDUCT.md

@@ -1,128 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, religion, or sexual identity
-and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the
-  overall community
-
-Examples of unacceptable behavior include:
-
-* The use of sexualized language or imagery, and sexual attention or
-  advances of any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email
-  address, without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement at
-Iron.ai.dev@gmail.com.
-All complaints will be reviewed and investigated promptly and fairly.
-
-All community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series
-of actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or
-permanent ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior,  harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within
-the community.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.0, available at
-https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
-
-Community Impact Guidelines were inspired by [Mozilla's code of conduct
-enforcement ladder](https://github.com/mozilla/diversity).
-
-[homepage]: https://www.contributor-covenant.org
-
-For answers to common questions about this code of conduct, see the FAQ at
-https://www.contributor-covenant.org/faq. Translations are available at
-https://www.contributor-covenant.org/translations.

LICENSE.md

@@ -1,55 +0,0 @@
- # Endbenutzer-Lizenzvertrag (EULA) und Nutzungsbedingungen
-**Softwareprojekt:** Inventarsystem  
-**Urheberrechtshalter (Lizenzgeber):** Maximilian Gründinger
-**Gültigkeit:** Stand 2026
-
----
-
-### PRÄAMBEL
-Dieser Endbenutzer-Lizenzvertrag (im Folgenden „Vertrag“) stellt eine rechtsgültige Vereinbarung zwischen Ihnen (im Folgenden „Lizenznehmer“) und dem Urheber **AIIrondev** (im Folgenden „Lizenzgeber“) dar. Durch den Zugriff auf den Quellcode, die Installation, das Kopieren oder die sonstige Nutzung der Software „Inventarsystem“ (im Folgenden „Produkt“) erklärt sich der Lizenznehmer mit den nachfolgenden Bedingungen vollumfänglich einverstanden. 
-
-Sollte der Lizenznehmer den Bedingungen dieses Vertrags nicht zustimmen, ist jegliche Nutzung, Vervielfältigung oder Distribution des Produkts mit sofortiger Wirkung untersagt.
-
----
-
-### § 1 GEGENSTAND DER LIZENZ UND EIGENTUMSRECHTE
-1. Das Produkt wird dem Lizenznehmer unter Vorbehalt lizenziert, nicht verkauft. Sämtliche Eigentumsrechte, Urheberrechte und sonstigen geistigen Eigentumsrechte am Produkt sowie an allen Kopien davon verbleiben ausschließlich beim Lizenzgeber.
-2. Diese Lizenz gewährt lediglich ein eingeschränktes Nutzungsrecht unter den in diesem Vertrag explizit genannten Bedingungen.
-
-### § 2 ZULÄSSIGER NUTZUNGSKREIS (PRIVATNUTZUNG)
-1. Die unentgeltliche Nutzung des Produkts ist ausschließlich **natürlichen Personen für den rein privaten, häuslichen Gebrauch** gestattet.
-2. Die Nutzung umfasst die Verwaltung privater Bestände ohne jegliche Gewinnerzielungsabsicht.
-3. Jegliche Nutzung durch **Institutionelle Nutzer** (einschließlich, aber nicht beschränkt auf: Unternehmen, Einzelunternehmer, Freiberufler, Vereine, Bildungseinrichtungen, Behörden oder NGOs) ist ausdrücklich **untersagt** und bedarf einer gesonderten, schriftlichen Lizenzvereinbarung mit dem Lizenzgeber.
-
-### § 3 FUNKTIONALE EINSCHRÄNKUNGEN UND SUPPORT
-1. Dem Lizenznehmer wird das Produkt in der jeweils vorliegenden Fassung bereitgestellt („As-Is“). 
-2. Für die kostenlose Privatnutzung besteht **kein Anspruch** auf:
-    - Technischen Support oder Beratung.
-    - Bereitstellung von Sicherheits-Updates oder Patches.
-    - Gewährleistung der Kompatibilität mit spezifischen Hardware- oder Softwareumgebungen.
-3. Der Lizenzgeber behält sich das Recht vor, Funktionen in zukünftigen Versionen zu ändern, einzuschränken oder kostenpflichtig zu gestalten.
-
-### § 4 WAHRUNG DER URHEBERBEZEICHNUNG (BRANDING-KLAUSEL)
-1. Das Produkt verfügt über fest integrierte Urheberrechtshinweise, insbesondere die Kennzeichnung **„Powered by AIIrondev“** in der Benutzeroberfläche (Footer/Menü).
-2. Es ist dem Lizenznehmer untersagt, diese Hinweise zu entfernen, zu modifizieren, zu verdecken oder deren Sichtbarkeit durch technische Maßnahmen (z. B. Manipulation von CSS, JavaScript oder Metadaten) zu beeinträchtigen.
-3. Das Entfernen dieser Hinweise führt zum sofortigen und automatischen Erlöschen der Nutzungslizenz.
-
-### § 5 VERBOT DER KOMMERZIELLEN VERWERTUNG & SAAS
-1. Die Bereitstellung des Produkts als Dienstleistung für Dritte (Software-as-a-Service, SaaS), insbesondere gegen Entgelt oder zur Generierung von Werbeeinnahmen, ist strikt untersagt.
-2. Das Hosting auf öffentlichen Servern mit dem Ziel, Dritten ohne eigene Installation Zugriff auf die Funktionalität zu gewähren, ist nur mit ausdrücklicher schriftlicher Genehmigung des Lizenzgebers zulässig.
-
-### § 6 MODIFIKATIONEN UND CONTRIBUTIONS
-1. Der Lizenznehmer darf den Quellcode für den privaten Eigenbedarf modifizieren.
-2. Im Falle einer Veröffentlichung von Modifikationen oder der Einreichung von Verbesserungsvorschlägen (z. B. Pull Requests auf GitHub) räumt der Lizenznehmer dem Lizenzgeber ein unwiderrufliches, weltweites, zeitlich unbeschränktes und kostenfreies Nutzungs- und Verwertungsrecht an diesen Änderungen ein. Der Lizenzgeber ist berechtigt, diese Änderungen in das Hauptprodukt zu übernehmen und unter dieser oder einer anderen Lizenz zu vertreiben.
-
-### § 7 HAFTUNGSBESCHRÄNKUNG
-1. Die Haftung des Lizenzgebers für Schäden, die aus der Nutzung oder Unmöglichkeit der Nutzung des Produkts entstehen (einschließlich Datenverlust, Betriebsunterbrechung oder entgangener Gewinn), ist auf Vorsatz und grobe Fahrlässigkeit beschränkt.
-2. Der Lizenzgeber übernimmt keine Haftung für die Richtigkeit der mit dem Produkt verwalteten Daten.
-
-### § 8 RECHTSWAHL UND GERICHTSSTAND
-1. Es gilt ausschließlich das Recht der **Bundesrepublik Deutschland** unter Ausschluss des UN-Kaufrechts (CISG).
-2. Soweit gesetzlich zulässig, wird als Gerichtsstand für alle Streitigkeiten aus diesem Vertrag der Sitz des Lizenzgebers vereinbart.
-3. Sollten einzelne Bestimmungen dieses Vertrags unwirksam sein, bleibt die Wirksamkeit der übrigen Bestimmungen unberührt (Salvatorische Klausel).
-
----
-**ANFRAGEN FÜR AUSNAHMEGENEHMIGUNGEN (KOMMERZIELLE LIZENZEN):** Bitte kontaktieren Sie den Urheber direkt über das GitHub-Profil: [AIIrondev auf GitHub](https://github.com/AIIrondev)

README.md

@@ -120,19 +120,19 @@ Das Inventarsystem stellt folgende Wartungsskripte bereit:
 **Option 1**
 
 ```bash
-wget -O - https://raw.githubusercontent.com/AIIrondev/legendary-octo-garbanzo/main/install.sh | sudo bash
+wget -O - https://git.invario-software.eu/Invario/Inventarsystem/raw/branch/main/install.sh | sudo bash
 ```
 
 **Option 2**
 
 ```bash
-curl -s https://raw.githubusercontent.com/AIIrondev/legendary-octo-garbanzo/main/install.sh | sudo bash
+curl -s https://git.invario-software.eu/Invario/Inventarsystem/raw/branch/main/install.sh | sudo bash
 ```
 
 Legacy-MongoDB uebernehmen und altes Host-System aufraeumen:
 
 ```bash
-curl -s https://raw.githubusercontent.com/AIIrondev/legendary-octo-garbanzo/main/install.sh | \
+curl -s https://git.invario-software.eu/Invario/Inventarsystem/raw/branch/main/install.sh | \
   sudo bash -s -- --migrate-legacy-db --remove-legacy-system
 ```
 

RELEASE_OPTIONS.md

@@ -1,38 +0,0 @@
-Release-Optionen
-=================
-
-Diese Datei beschreibt die Eingabeoptionen des CI-Workflows `.github/workflows/release-docker.yml`.
-
-Inputs (workflow_dispatch)
-- `bump` (choice)
-  - `patch` (Standard): Erhöht nur die Patch-Version (vX.Y.Z -> vX.Y.Z+1).
-  - `minor`: Erhöht die Minor-Version und setzt Patch auf 0 (vX.Y.Z -> vX.Y+1.0).
-  - `major`: Erhöht die Major-Version und setzt Minor/Patch auf 0 (vX.Y.Z -> vX+1.0.0).
-  - `development`: Erzeugt einen Development-Release mit Suffix `-dev` (z. B. `v3.1.4-dev`).
-
-- `push_dev` (choice, optional)
-  - `false` (Standard): Bei `bump=development` wird das `:dev`-Image NICHT automatisch an GHCR gepusht.
-  - `true`: Bei `bump=development` wird zusätzlich das Image `ghcr.io/aiirondev/legendary-octo-garbanzo:dev` gepusht.
-
-Verhalten/Anmerkungen
-- Development releases werden als GitHub Release erzeugt und als `prerelease` markiert, damit sie nicht automatisch von normalen Update‑Flows genutzt werden.
-- Es gibt pro Release genau einen Release‑Eintrag (für Dev‑Releases mit `-dev` Suffix). Es wird kein separates `inventarsystem-image-dev.tar.gz` mehr erzeugt; das Update/Deployment erfolgt über den Release‑Tag / Image‑Tag.
-- `update.sh` unterstützt weiterhin `dev`/`development`-Modus und akzeptiert nun auch explizite Release‑Tags wie `v3.1.4-dev`.
-
-Beispiele
-- Patch-Release (manuell):
-  - GitHub UI: Run workflow → `bump=patch`
-  - CLI mit `gh`:
-    gh workflow run release-docker.yml --repo AIIrondev/legendary-octo-garbanzo --field bump=patch
-
-- Development prerelease (ohne Push des :dev Images):
-  - GitHub UI: Run workflow → `bump=development` (leave `push_dev=false`)
-  - Ergebnis: Release `vX.Y.Z-dev` als prerelease, Image wird nicht automatisch als `:dev` gepusht.
-
-- Development prerelease + push des :dev Images:
-  - GitHub UI: Run workflow → `bump=development`, `push_dev=true`
-  - CLI Beispiel:
-    gh workflow run release-docker.yml --repo AIIrondev/legendary-octo-garbanzo --field bump=development --field push_dev=true
-
-Empfehlung
-- Verwende `bump=development` für experimentelle/early releases; Nutzer müssen explizit `./update.sh vX.Y.Z-dev` ausführen, um auf diese Version zu upgraden.

SECURITY.md

@@ -1,25 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-The latest version will allways be supported the rest are old version that are not activly supported.
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 0.2.17  | ✅                 |
-| 3.2.x   | :white_check_mark: |
-| 3.1.x   | :x:                |
-| 3.0.x   | :x: |
-| 2.6.x   | :x:                |
-| 2.4.x   | :x:                |
-| 1.8.x   | :x:                |
-| 1.7.x   | :x:                |
-| 1.5.x   | :x:                |
-| 1.4.x   | :x:                |
-| 1.3.x   | :x:                |
-| 1.1.x   | :x:                |
-
-
-## Reporting a Vulnerability
-
-To report a vulnerability contact me via. my E-Mail Iron.ai.dev@gmail.com or in insevere cases over an Issue.

Web/modules/database/ausleihung.py

@@ -1235,5 +1235,5 @@ def reset_item_completely(item_id):
     except Exception as e:
         return {
             'success': False,
-            'message': f'Fehler beim Zurücksetzen: {str(e)}'
+            'message': f'Fehler beim Zurücksetzen.'
         }

Web/modules/database/items.py

@@ -24,7 +24,7 @@ import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
 
 
-LIBRARY_ITEM_TYPES = ('book', 'cd', 'dvd', 'media')
+LIBRARY_ITEM_TYPES = ('book', 'cd', 'dvd', 'other', 'schoolbook', 'Buch', 'Schulbuch', 'schulbuch')
 
 
 def _non_library_query(extra_query=None):
@@ -49,7 +49,7 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
              ansch_jahr=None, ansch_kost=None, code_4=None, reservierbar=True,
              series_group_id=None, series_count=1, series_position=1,
              is_grouped_sub_item=False, parent_item_id=None,
-             isbn=None, item_type='general'):
+             isbn=None, item_type='general', library_category=None, is_library=False):
     """
     Add a new item to the inventory.
     
@@ -70,6 +70,9 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
         series_position (int, optional): Position inside the batch (1-based)
         is_grouped_sub_item (bool, optional): Whether this item is hidden as sub-item
         parent_item_id (str, optional): Parent item id if this is a sub-item
+        isbn (str, optional): ISBN for books or media items
+        item_type (str, optional): Type of the item (e.g., 'general', 'book', 'cd')
+        library_category (str, optional): Library category for the item
         
     Returns:
         ObjectId: ID of the new item or None if failed
@@ -97,7 +100,9 @@ def add_item(name, ort, beschreibung, images=None, filter=None, filter2=None, fi
             'Anschaffungskosten': ansch_kost,
             'Code_4': code_4,
             'ISBN': isbn,
+            'library_category': library_category,
             'ItemType': item_type,
+            'is_library': is_library, 
             'SeriesGroupId': series_group_id,
             'SeriesCount': series_count,
             'SeriesPosition': series_position,
@@ -194,69 +199,61 @@ def get_group_item_ids(id):
         return []
 
 
-def update_item(id, name, ort, beschreibung, images=None, verfuegbar=True, 
-                filter=None, filter2=None, filter3=None, ansch_jahr=None, ansch_kost=None, code_4=None, reservierbar=True,
-                isbn=None, item_type='general'):
-    """
-    Update an existing inventory item.
-    
-    Args:
-        id (str): ID of the item to update
-        name (str): Name of the item
-        ort (str): Location of the item
-        beschreibung (str): Description of the item
-        images (list, optional): List of image filenames for the item
-        verfuegbar (bool, optional): Availability status of the item
-        filter (str, optional): Primary filter/category for the item
-        filter2 (str, optional): Secondary filter/category for the item
-        filter3 (str, optional): Tertiary filter/category for the item
-        ansch_jahr (int, optional): Year of acquisition
-        ansch_kost (float, optional): Cost of acquisition
-        code_4 (str, optional): 4-digit identification code
-        reservierbar (bool, optional): Whether the item can be reserved in advance
-        
-    Returns:
-        bool: True if successful, False otherwise
-    """
+def update_item(id, name, ort, beschreibung, images, verfuegbar, filter1, filter2, filter3, 
+                ansch_jahr, ansch_kost, code_4, reservierbar, isbn=None, item_type='general'):
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         items = db['items']
 
-        # Set default values for optional parameters
-        if images is None:
-            images = []
+        # 1. Altes Item laden, um SeriesGroupId zu bestimmen
+        old_item = items.find_one({'_id': ObjectId(id)})
+        if not old_item:
+            return False
+            
+        series_group_id = old_item.get('SeriesGroupId')
 
-        update_data = {
+        # 2. Shared Data: Daten, die für ALLE in der Gruppe gleich sind
+        shared_update = {
             'Name': name,
             'Ort': ort,
             'Beschreibung': beschreibung,
             'Images': images,
-            'Verfuegbar': verfuegbar,
-            'Reservierbar': reservierbar,
-            'Filter': filter,
+            'Filter': filter1,
             'Filter2': filter2,
             'Filter3': filter3,
             'Anschaffungsjahr': ansch_jahr,
             'Anschaffungskosten': ansch_kost,
-            'Code_4': code_4,
+            'Reservierbar': reservierbar,
             'ISBN': isbn,
             'ItemType': item_type,
+            'Verfuegbar': verfuegbar, # Wir behalten den Status bei
             'LastUpdated': datetime.datetime.now()
         }
 
-        result = items.update_one(
-            {'_id': ObjectId(id)},
-            {'$set': update_data}
-        )
+        # 3. Spezifische Daten: Was NICHT synchronisiert wird
+        specific_update = shared_update.copy()
+        specific_update['Code_4'] = code_4
+
+        # 4. Das aktuelle Item updaten
+        items.update_one({'_id': ObjectId(id)}, {'$set': specific_update})
+
+        # 5. Alle anderen Gruppen-Mitglieder synchronisieren
+        if series_group_id:
+            items.update_many(
+                {
+                    'SeriesGroupId': series_group_id,
+                    '_id': {'$ne': ObjectId(id)}
+                },
+                {'$set': shared_update}
+            )
 
         client.close()
-        return result.modified_count > 0
+        return True
     except Exception as e:
         print(f"Error updating item: {e}")
         return False
 
-
 def update_item_status(id, verfuegbar, user=None):
     """
     Update the availability status of an inventory item.

Web/modules/database/settings.py

@@ -220,15 +220,15 @@ SSL_CERT = _get(_conf, ['ssl', 'cert'], DEFAULTS['ssl']['cert'])
 SSL_KEY = _get(_conf, ['ssl', 'key'], DEFAULTS['ssl']['key'])
 
 # Email settings
-EMAIL_ENABLED = _get(_conf, ['email', 'enabled'], False)
-EMAIL_SMTP_HOST = _get(_conf, ['email', 'smtp_host'], 'smtp.gmail.com')
-EMAIL_SMTP_PORT = int(_get(_conf, ['email', 'smtp_port'], 587))
-EMAIL_USE_TLS = bool(_get(_conf, ['email', 'use_tls'], True))
-EMAIL_USERNAME = _get(_conf, ['email', 'username'], '')
-EMAIL_PASSWORD = _get(_conf, ['email', 'password'], '')
+EMAIL_ENABLED = bool(os.getenv('EMAIL_ENABLED', False))
+EMAIL_SMTP_HOST = str(os.getenv('EMAIL_SMTP_HOST', False))
+EMAIL_SMTP_PORT = int(os.getenv('EMAIL_SMTP_PORT', 587))
+EMAIL_USE_TLS = True
+EMAIL_USERNAME = str(os.getenv('EMAIL_USERNAME', False))
+EMAIL_PASSWORD = str(os.getenv('EMAIL_PASSWORD', False))
 EMAIL_FROM_ADDRESS = _get(_conf, ['email', 'from_address'], EMAIL_USERNAME)
-EMAIL_DEFAULT_SENDER_NAME = _get(_conf, ['email', 'default_sender_name'], 'Inventarsystem')
-EMAIL_TIMEOUT_SECONDS = int(_get(_conf, ['email', 'timeout_seconds'], 30))
+EMAIL_DEFAULT_SENDER_NAME = "Invario Inventarsystem Sender"
+EMAIL_TIMEOUT_SECONDS = 20
 
 # School periods
 SCHOOL_PERIODS = _get(_conf, ['schoolPeriods'], DEFAULTS['schoolPeriods'])
@@ -278,6 +278,7 @@ INVENTORY_MODULE_ENABLED = _TenantAwareBool('inventory', _get(_conf, ['modules',
 TERMINPLAN_MODULE_ENABLED = _TenantAwareBool('terminplan', _get(_conf, ['modules', 'terminplan', 'enabled'], DEFAULTS['modules']['terminplan']['enabled']))
 LIBRARY_MODULE_ENABLED = _TenantAwareBool('library', _get(_conf, ['modules', 'library', 'enabled'], DEFAULTS['modules']['library']['enabled']))
 STUDENT_CARDS_MODULE_ENABLED = _TenantAwareBool('student_cards', _get(_conf, ['modules', 'student_cards', 'enabled'], DEFAULTS['modules']['student_cards']['enabled']))
+MAIL_ADD_ON_ENABLED = _TenantAwareBool('mail', _get(_conf, ['email', 'enabled'], False))
 
 def _match_inventory(path):
     if not path: return False
@@ -297,11 +298,16 @@ def _match_student_cards(path):
     if not path: return False
     return path.startswith(('/student_cards'))
 
+def _match_mail(path):
+    if not path: return False
+    return path.startswith(('/'))
+
 # Register core modules into the pipeline
 MODULES.register('inventory', INVENTORY_MODULE_ENABLED, _match_inventory)
 MODULES.register('terminplan', TERMINPLAN_MODULE_ENABLED, _match_terminplan)
 MODULES.register('library', LIBRARY_MODULE_ENABLED, _match_library)
 MODULES.register('student_cards', STUDENT_CARDS_MODULE_ENABLED, _match_student_cards)
+MODULES.register('mail', MAIL_ADD_ON_ENABLED, _match_mail)
 
 STUDENT_DEFAULT_BORROW_DAYS = int(_get(_conf, ['modules', 'student_cards', 'default_borrow_days'], DEFAULTS['modules']['student_cards']['default_borrow_days']))
 STUDENT_MAX_BORROW_DAYS = int(_get(_conf, ["modules", "student_cards", "max_borrow_days"], DEFAULTS["modules"]["student_cards"]["max_borrow_days"]))

Web/modules/database/termine.py

@@ -18,9 +18,11 @@ Collection Structure:
   - Status fields: slots_used_by
 """
 import Web.modules.database.settings as cfg
+import Web.modules.inventarsystem.data_protection as dp
 from Web.modules.database.settings import MongoClient
 from bson.objectid import ObjectId
 import datetime 
+import ast
 
 
 def _get_tenant_db(client):
@@ -37,8 +39,47 @@ def _active_record_query(extra_query=None):
         base_query.update(extra_query)
     return base_query
 
+def _decrypt_appointment(item):
+    """Helper function to safely decrypt appointment fields back to their original types."""
+    if not item:
+        return item
+    
+    try:
+        if 'user' in item and item['user']:
+            item['user'] = dp.decrypt_text(item['user'])
+        
+        if 'note' in item and item['note']:
+            item['note'] = dp.decrypt_text(item['note'])
+            
+        if 'title' in item and item['title']:
+            item['title'] = dp.decrypt_text(item['title'])
+            
+        if 'mail' in item and item['mail']:
+            decrypted_mail = dp.decrypt_text(item['mail'])
+            try:
+                item['mail'] = ast.literal_eval(decrypted_mail)
+            except Exception:
+                item['mail'] = decrypted_mail
 
-def add(date_start: str, date_end: str, time_span: list, slots: int, slot_lenght: int, user: str, mail: list=[], note:str="", calendar_enabled: bool=False, title: str=""):
+        if 'custom_fields' in item and item['custom_fields']:
+            item['custom_fields'] = [dp.decrypt_text(field) for field in item['custom_fields']]
+
+        if 'slots_booked' in item and item['slots_booked']:
+            # If it's a string, it was encrypted during an update execution
+            if isinstance(item['slots_booked'], str):
+                decrypted_slots = dp.decrypt_text(item['slots_booked'])
+                try:
+                    item['slots_booked'] = ast.literal_eval(decrypted_slots)
+                except Exception:
+                    item['slots_booked'] = decrypted_slots
+    except Exception as e:
+        print(f"Error during decryption: {e}")
+        
+    return item
+
+
+def add(date_start: str, date_end: str, time_span: list, slots: int, slot_lenght: int, user: str, mail: list=[], note:str="", calendar_enabled: bool=False, title: str="", custom_fields: list = (), clients_p_slot: int=1):
+    client = None
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
@@ -50,60 +91,53 @@ def add(date_start: str, date_end: str, time_span: list, slots: int, slot_lenght
             'time_span': time_span,
             'slots': slots,
             'slot_lenght': slot_lenght,
-            'user': user,
-            'mail': mail,
-            'note': note,
-            'title': title,
+            'user': dp.encrypt_text(user.strip()),
+            'mail': dp.encrypt_text(str(mail)),
+            'note': dp.encrypt_text(note),
+            'title': dp.encrypt_text(title),
+            'custom_fields': [dp.encrypt_text(str(field)) for field in custom_fields],
             'calendar_enabled': bool(calendar_enabled),
-            'slots_booked': [], # -> [(start_time, name), ...]the list gets there indexes as the slot 1-defined so is can be counted without an extra variable
+            'clients_per_slot': clients_p_slot,
+            'slots_booked': [],  # -> [(start_time, (names),(custom1, custom2,...)), ...]the list gets there indexes as the slot 1-defined so is can be counted without an extra variable
             'Created': datetime.datetime.now(),
             'LastUpdated': datetime.datetime.now()
         }
         result = items.insert_one(item)
         return result.inserted_id
     except Exception as e:
-        print(f"Exception accured: {e}")
-
+        print(f"Exception occurred in add: {e}")
+        return None
+    finally:
+        if client:
+            client.close()
 
 def get_item(id):
-    """
-    Retrieve a specific appointment by its ID.
-    
-    Args:
-        id (str): ID of the appointsment to retrieve
-        
-    Returns:
-        dict: The appointment document or None if not found
-    """
+    """Retrieve a specific appointment by its ID and decrypt it."""
+    client = None
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         items = db['appointments']
         item = items.find_one(_active_record_query({'_id': ObjectId(id)}))
-        client.close()
-        return item
+        
+        return _decrypt_appointment(item)
     except Exception as e:
         print(f"Error retrieving item: {e}")
         return None
+    finally:
+        if client:
+            client.close()
 
-def update(id,slots_used: list):
-    """
-    Update an existing appointment.
-    
-    Args:
-        id (str): ID of the item to update
-        
-        
-    Returns:
-        bool: True if successful, False otherwise
-    """
+def update(id, slots_used: list):
+    """Update an existing appointment's booked slots securely."""
+    client = None
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         items = db['appointments']
 
         update_data = {
-            'slots_booked': slots_used,
+            'slots_booked': dp.encrypt_text(str(slots_used)),
             'LastUpdated': datetime.datetime.now()
         }
 
@@ -112,53 +146,81 @@ def update(id,slots_used: list):
             {'$set': update_data}
         )
 
-        client.close()
         return result.modified_count > 0
     except Exception as e:
         print(f"Error updating item: {e}")
         return False
-
+    finally:
+        if client:
+            client.close()
 
 def remove_slot(id, date_start_time, name):
     """
-    Remove a booked slot from an appointment's `slots_booked`.
-
-    Args:
-        id (str): Appointment ID
-        date_start_time: The start time value used when booking
-        name (str): Name associated with the booking
-
-    Returns:
-        bool: True if a slot was removed, False otherwise
+    Remove a booked slot from an appointment's encrypted `slots_booked` list.
+    
+    Because the array is stored as an encrypted string blob, we must decrypt, 
+    modify it in Python, and re-encrypt it.
     """
+    client = None
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         items = db['appointments']
 
-        # Attempt to pull the exact element (stored as an array/tuple)
+        item = items.find_one({'_id': ObjectId(id)})
+        if not item or 'slots_booked' not in item or not item['slots_booked']:
+            return False
+
+        try:
+            decrypted_slots = dp.decrypt_text(item['slots_booked'])
+            slots_list = ast.literal_eval(decrypted_slots)
+        except Exception as e:
+            print(f"Failed to decrypt or parse slots: {e}")
+            return False
+
+        # Structure format note: [(start_time, (names), (custom1, custom2...)), ...]
+        updated_slots = []
+        removed_any = False
+        
+        for slot in slots_list:
+            slot_start = slot[0]
+            slot_names = slot[1]
+            
+
+            if slot_start == date_start_time and (slot_names == name or name in slot_names):
+                removed_any = True
+                continue 
+            updated_slots.append(slot)
+
+        if not removed_any:
+            return False 
+
         result = items.update_one(
             {'_id': ObjectId(id)},
-            {'$pull': {'slots_booked': [date_start_time, name]}}
+            {
+                '$set': {
+                    'slots_booked': dp.encrypt_text(str(updated_slots)),
+                    'LastUpdated': datetime.datetime.now()
+                }
+            }
         )
 
-        client.close()
         return result.modified_count > 0
     except Exception as e:
         print(f"Error removing slot: {e}")
         return False
+    finally:
+        if client:
+            client.close()
 
 
 def remove(id):
     """
-    Soft-delete an appointment by setting its `Deleted` flag.
-
-    Args:
-        id (str): Appointment ID
-
-    Returns:
-        bool: True if the appointment was marked deleted, False otherwise
+    Hard-delete an appointment plan by its ID.
+    (Note: If your docstring mentions a soft-delete 'Deleted' flag, 
+    change items.delete_one to items.update_one with {'$set': {'Deleted': True}})
     """
+    client = None
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
@@ -166,70 +228,87 @@ def remove(id):
 
         result = items.delete_one({'_id': ObjectId(id)})
 
-        client.close()
         return result.deleted_count > 0
     except Exception as e:
         print(f"Error removing appointment: {e}")
         return False
+    finally:
+        if client:
+            client.close()
+
 
 def remove_done():
-    """removose already finisched appointments"""
+    """Remove all expired appointments whose end date is prior to today in a single call."""
+    client = None
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         items = db['appointments']
 
         today = datetime.date.today().strftime('%Y-%m-%d')
-        removed_count = 0
 
-        cursor = items.find(
+        result = items.delete_many(
             _active_record_query(
                 {
                     'date_end': {'$lt': today},
                 }
             )
-        ).sort('date_start', 1)
+        )
 
-        for item in cursor:
-            item['_id'] = str(item.get('_id'))
-            result = items.delete_one({'_id': ObjectId(item['_id'])})
-            removed_count += result.deleted_count
-        
-        client.close()
-        return removed_count > 0
+        return result.deleted_count > 0
     except Exception as e:
-        print(f"Error removing appointment: {e}")
+        print(f"Error cleaning up finished appointments: {e}")
         return False
+    finally:
+        if client:
+            client.close()
+
 
 def get_upcoming_for_user(user: str, limit: int = 25):
-    """Return upcoming appointment plans for a user ordered by start date."""
-    remove_done()
+    """
+    Return upcoming appointment plans for a user, handling encrypted database records.
+    """
+    try:
+        if hasattr(globals(), 'remove_done'):
+            remove_done()
+    except Exception:
+        pass
+
+    client = None
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = _get_tenant_db(client)
         items = db['appointments']
 
         today = datetime.date.today().strftime('%Y-%m-%d')
+        target_user = str(user or '').strip()
+
         cursor = items.find(
-            _active_record_query(
-                {
-                    'user': str(user or '').strip(),
-                    'date_end': {'$gte': today},
-                }
-            )
+            _active_record_query({
+                'date_end': {'$gte': today},
+            })
         ).sort('date_start', 1)
 
         results = []
         for item in cursor:
-            item['_id'] = str(item.get('_id'))
-            results.append(item)
+            decrypted_item = _decrypt_appointment(item)
+            if not decrypted_item:
+                continue
+
+            if decrypted_item.get('user', '').strip() != target_user:
+                continue
+
+            decrypted_item['_id'] = str(decrypted_item.get('_id'))
+            results.append(decrypted_item)
+            
             if len(results) >= max(1, int(limit)):
                 break
 
-        client.close()
         return results
     except Exception as e:
         print(f"Error retrieving upcoming appointments: {e}")
         return []
+    finally:
+        if client:
+            client.close()
 
- 

Web/modules/database/user.py

@@ -97,18 +97,18 @@ def build_name_synonym(first_name, last_name=''):
     last = _clean_name_fragment(last_name)
 
     if first and last:
-        return (first[:2] + last[:2]).title()
+        return (first[:3] + last[:3]).title()
 
     combined = (first + last)
     if not combined:
         return 'User'
-    return combined[:4].title()
+    return combined[:6].title()
 
 
 def build_username_from_name(first_name, last_name=''):
     """
     Build a deterministic username abbreviation from first and last name.
-    Uses 2 letters from each name and stores it lowercase.
+    Uses 3 letters from each name and stores it lowercase.
     
     Args:
         first_name (str): First name
@@ -123,12 +123,12 @@ def build_username_from_name(first_name, last_name=''):
 
 def build_unique_username_from_name(first_name, last_name=''):
     """
-    Build a unique username from the first 2 letters of the first name and
-    the first 2 letters of the last name.
+    Build a unique username from the first 3 letters of the first name and
+    the first 3 letters of the last name.
     """
     first = _clean_name_fragment(first_name)
     last = _clean_name_fragment(last_name)
-    base_username = (first[:2] + last[:2]).lower()
+    base_username = (first[:3] + last[:3]).lower()
 
     if not base_username:
         base_username = 'user'
@@ -323,7 +323,8 @@ def get_effective_permissions(username):
     if bool(user.get('Admin', False)):
         return build_default_permission_payload('full_access')
 
-    preset_key = user.get('PermissionPreset') or 'standard_user'
+    preset_key = user.get('PermissionPreset')
+    print(preset_key)
     payload = build_default_permission_payload(preset_key)
     payload['actions'] = _normalize_bool_map(user.get('ActionPermissions', {}), payload['actions'])
     payload['pages'] = _normalize_bool_map(user.get('PagePermissions', {}), payload['pages'])
@@ -552,10 +553,15 @@ def add_user(
             for key, value in page_permissions.items():
                 permission_defaults['pages'][str(key)] = bool(value)
 
+        if permission_preset == "full_access":
+            can_admin_preset_based = True 
+        else:
+            can_admin_preset_based = False
+        
         user_doc = {
             'Username': username,
             'Password': hashing(password),
-            'Admin': False,
+            'Admin': can_admin_preset_based,
             'active_ausleihung': None,
             'name': name.strip() if name else '',
             'last_name': last_name.strip() if last_name else '',
@@ -588,8 +594,8 @@ def student_card_exists(student_card_id):
         return False
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
-    users = db['users']
-    exists = users.find_one({'StudentCardId': normalized}) is not None
+    users = db['student_cards']
+    exists = users.find_one({'SchülerName': normalized}) is not None
     client.close()
     return exists
 
@@ -601,8 +607,8 @@ def get_user_by_student_card(student_card_id):
         return None
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
-    users = db['users']
-    found_user = users.find_one({'StudentCardId': normalized})
+    users = db['student_cards']
+    found_user = users.find_one({'SchülerName': normalized})
     client.close()
     return found_user
 

Web/modules/emailservice/email.py

@@ -1,51 +1,98 @@
-from email.mime.text import MIMEText
 from email.mime.multipart import MIMEMultipart
-from modules.module_registry import ModuleRegistry as mr
+from email.mime.text import MIMEText
 import smtplib
+import time
 
 import Web.modules.database.settings as cfg
 
 
 def _build_smtp_client():
-    smtp = smtplib.SMTP(cfg.EMAIL_SMTP_HOST, cfg.EMAIL_SMTP_PORT, timeout=cfg.EMAIL_TIMEOUT_SECONDS)
+    smtp = smtplib.SMTP(
+        cfg.EMAIL_SMTP_HOST,
+        cfg.EMAIL_SMTP_PORT,
+        timeout=cfg.EMAIL_TIMEOUT_SECONDS,
+    )
     smtp.ehlo()
     if cfg.EMAIL_USE_TLS:
         smtp.starttls()
         smtp.ehlo()
     if cfg.EMAIL_USERNAME:
-        smtp.login(cfg.EMAIL_USERNAME, cfg.EMAIL_PASSWORD or '')
+        smtp.login(cfg.EMAIL_USERNAME, cfg.EMAIL_PASSWORD or "")
     return smtp
 
-def send(email: list, subject: str, note: str, sender: str) -> bool:
-  """
-  Sends the email with the link to the Clients
 
-  Input:
-  - email: Email list of all the addresses to send the link to ["","",""]
-  - subject: Subject of the email
-  - note: Note that is send with the Emails
+def send(email: list | str, subject: str, note: str, sender: str) -> bool:
+    """Sends the email with the link to the Clients."""
+    if not cfg.MODULES.is_enabled("mail"):
+        print("Debug: Module not enabled")
+        return False
+
+    if isinstance(email, str):
+        email = [email]
+
+    body_message = note
+
+    HTML_SIGNATURE = f"""
+    <table cellpadding="0" cellspacing="0" border="0" style="font-family: Arial, Helvetica, sans-serif; font-size: 13px; color: #333333; line-height: 1.5;">
+        <tr>
+            <td>
+                <p style="margin:0 0 12px 0;">Mit freundlichen Grüßen</p>
+                <p style="margin:0;"><strong style="font-size:16px;">Automatisierter Email Verteiler für die Schule: {cfg.get_school_info().get("name")}</strong><br></p>
+                <p style="margin:12px 0 0 0;"><strong>Invario UG</strong><br>Am Sportplatz 10<br>83052 Bruckmühl</p>
+            </td>
+        </tr>
+    </table>
+    """
+
+    text_content = f"{body_message}\n\nMit freundlichen Grüßen\n{sender}\nInvario UG"
+
+    html_content = f"""
+    <html>
+      <body>
+        <p>{body_message}</p>
+        <br>
+        {HTML_SIGNATURE}
+      </body>
+    </html>
+    """
+
+    mails_per_second = 10
+    interval = 1.0 / mails_per_second
 
-  Output:
-  - bool: true if the sending worked and false if it didnt
-  """
-  if not mr.registry.is_enabled('mail'):
-    return False
-  else:
-    msg = MIMEMultipart()
-    msg['Subject'] = subject
-    msg['From'] = sender or cfg.EMAIL_FROM_ADDRESS or cfg.EMAIL_USERNAME
-    msg['To'] = ', '.join(email) if isinstance(email, (list, tuple)) else str(email)
-    msg.attach(MIMEText(note))
     smtp = None
     try:
-      smtp = _build_smtp_client()
-      smtp.sendmail(from_addr=msg['From'], to_addrs=email, msg=msg.as_string())
-      return True
-    except Exception:
-      return False
+        smtp = _build_smtp_client()
+
+        for i, recipient in enumerate(email):
+            start_time = time.time()
+
+            msg = MIMEMultipart("alternative")
+            msg["Subject"] = str(subject)
+            msg["From"] = f"{sender} <{cfg.EMAIL_USERNAME}>"
+            msg["To"] = str(recipient)
+
+            msg.attach(MIMEText(text_content, "plain"))
+            msg.attach(MIMEText(html_content, "html"))
+
+            smtp.sendmail(
+                from_addr=cfg.EMAIL_USERNAME,
+                to_addrs=[recipient],
+                msg=msg.as_string()
+            )
+
+            elapsed_time = time.time() - start_time
+            sleep_time = interval - elapsed_time
+
+            if sleep_time > 0 and i < len(email) - 1:
+                time.sleep(sleep_time)
+
+        return True
+    except Exception as e:
+        print(f"Debug: Fehler beim Senden der E-Mail: {e}")
+        return False
     finally:
-      try:
         if smtp:
-          smtp.quit()
-      except Exception:
-        pass
+            try:
+                smtp.quit()
+            except Exception:
+                pass

Web/modules/inventarsystem/excel_export.py

@@ -37,20 +37,23 @@ def generate_library_excel(items):
             item.get("ReturnDate", ""),
             item.get("Anschaffungskosten", "")
         ]
-        ws.append(row)
         
-    for col in ws.columns:
-        max_length = 0
-        column = col[0].column_letter 
-        for cell in col:
-            try:
-                if len(str(cell.value)) > max_length:
-                    max_length = len(str(cell.value))
-            except:
-                pass
-        ws.column_dimensions[column].width = min(max_length + 2, 50)
+        # FIX: Clean the row data INSIDE the loop for every single item
+        clean_row = []
+        for value in row:
+            if isinstance(value, list):
+                # Converts ['A', 'B'] to "A, B" and an empty list [] to an empty string ""
+                clean_row.append(", ".join(map(str, value)) if value else "")
+            elif isinstance(value, dict):
+                # Just in case there is an embedded MongoDB sub-document
+                clean_row.append(str(value))
+            else:
+                clean_row.append(value)
+        
+        # Append the safe, flattened row to the worksheet
+        ws.append(clean_row)
 
     excel_buffer = io.BytesIO()
     wb.save(excel_buffer)
     excel_buffer.seek(0)
-    return excel_buffer
+    return excel_buffer

Web/modules/log/audit_log.py

@@ -10,6 +10,7 @@ import hashlib
 import json
 import random
 import time
+from Web.modules.inventarsystem.data_protection import encrypt_document_fields, decrypt_document_fields
 
 from pymongo.errors import DuplicateKeyError
 
@@ -24,21 +25,34 @@ def _entry_hash(prev_hash, payload):
     base = f"{prev_hash}|{_stable_json(payload)}"
     return hashlib.sha256(base.encode("utf-8")).hexdigest()
 
-
-def append_audit_event(db, event_type, actor, payload, request_ip=None, source="web", max_retries=5):
+def get_decrypted_audit_logs(db, query=None, decrypt_fields=None):
     """
-    Append an audit event to a tamper-evident chain.
-
+    Retrieve and decrypt audit logs for analysis.
+    
     Args:
-        db: MongoDB database handle.
-        event_type (str): Event category.
-        actor (str): User/system who performed the action.
-        payload (dict): Event details.
-        request_ip (str, optional): Request origin.
-        source (str): Source subsystem.
+        query (dict): MongoDB query filter.
+        decrypt_fields (list): Fields within the 'payload' that should be decrypted.
+    """
+    logs = db["audit_log"]
+    cursor = logs.find(query or {}).sort("chain_index", 1)
+    
+    results = []
+    for entry in cursor:
+        # Decrypt specific fields if provided
+        if decrypt_fields:
+            decrypt_document_fields(entry.get("payload", {}), decrypt_fields)
+        results.append(entry)
+        
+    return results
 
-    Returns:
-        dict: Inserted audit entry.
+
+def append_audit_event(db, event_type, actor, payload, request_ip=None, source="web", max_retries=5, encrypt_fields=None):
+    """
+    Append an audit event, optionally encrypting specific payload fields.
+    
+    Args:
+        ...
+        encrypt_fields (list, optional): List of keys in 'payload' to encrypt.
     """
     logs = db["audit_log"]
     attempts = 0
@@ -49,15 +63,24 @@ def append_audit_event(db, event_type, actor, payload, request_ip=None, source="
         chain_index = int(previous.get("chain_index", 0)) + 1 if previous else 1
 
         timestamp = datetime.datetime.utcnow()
+        
+        # 1. Create the payload dictionary
+        event_payload = payload or {}
+        
+        # 2. Encrypt sensitive fields in-place if requested
+        if encrypt_fields:
+            encrypt_document_fields(event_payload, encrypt_fields)
+
         entry_payload = {
             "event_type": event_type,
             "actor": actor or "system",
             "source": source,
             "ip": request_ip or "",
-            "payload": payload or {},
+            "payload": event_payload,
             "timestamp": timestamp.isoformat() + "Z",
         }
 
+        # 3. Hash the payload (which now contains encrypted values)
         entry_hash = _entry_hash(prev_hash, entry_payload)
 
         entry = {

Web/modules/log/ausleihung_log.py

@@ -21,7 +21,7 @@ def log_status_change(ausleihung_id, old_status, new_status, user=None):
         ausleihung_id: Die ID der Ausleihung
         old_status: Der alte Status
         new_status: Der neue Status
-        user: Der Benutzer, der die Änderung vorgenommen hat (optional)
+
     """
     try:
         # Erstelle Log-Verzeichnis, falls es nicht existiert
@@ -34,10 +34,9 @@ def log_status_change(ausleihung_id, old_status, new_status, user=None):
         
         # Protokolliere die Änderung
         timestamp = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
-        user_info = f" by {user}" if user else ""
         
         with open(log_file, 'a', encoding='utf-8') as f:
-            f.write(f"{timestamp}: Ausleihung {ausleihung_id} - Status changed from '{old_status}' to '{new_status}'{user_info}\n")
+            f.write(f"{timestamp}: Ausleihung {ausleihung_id} - Status changed from '{old_status}' to '{new_status}'\n")
             
         return True
     except Exception as e:

Web/modules/terminplaner/backend_server.py

@@ -8,6 +8,7 @@ import Web.modules.emailservice.email as mail_service
 import Web.modules.database.termine as termin
 import Web.modules.database.settings as cfg
 from Web.tenant import get_tenant_context
+import Web.modules.inventarsystem.data_protection as dp
 
 
 def _resolve_public_base_url() -> str:
@@ -21,7 +22,7 @@ def _resolve_public_base_url() -> str:
     subdomain = ''
     if tenant_context:
         subdomain = getattr(tenant_context, 'subdomain', '') or getattr(tenant_context, 'tenant_id', '') or ''
-    return f"https://{subdomain}.invario.eu" if subdomain else "https://invario.eu"
+    return (f"https://{subdomain}.invario-software.de") if subdomain else "https://invario-software.de"
 
 
 def _current_tenant_id() -> str:
@@ -99,8 +100,11 @@ def build_calendar_ics(appointment_id: str) -> str | None:
         return None
 
     uid = f"terminplaner-{appointment_id}@invario.eu"
-    created_at = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ')
-    summary = f"Terminplan für {creator}"
+    
+    created_at = datetime.datetime.now(datetime.timezone.utc).strftime('%Y%m%dT%H%M%SZ')
+    
+    summary = titel if titel else f"Terminplan für {creator}"
+    
     description_lines = [
         f"Buchungslink: {link}",
         f"Zeitraum: {date_start} bis {date_end}",
@@ -109,7 +113,7 @@ def build_calendar_ics(appointment_id: str) -> str | None:
         description_lines.append('Zeitfenster: ' + '; '.join(str(entry) for entry in time_span))
     if note:
         description_lines.append('Notiz: ' + str(note))
-    if titel:
+    if titel and not summary == titel: 
         description_lines.append('Titel: ' + str(titel))
 
     ics_lines = [
@@ -125,8 +129,7 @@ def build_calendar_ics(appointment_id: str) -> str | None:
         f'DESCRIPTION:{_escape_ics_text(chr(10).join(description_lines))}',
         f'URL:{_escape_ics_text(link)}',
         f'DTSTART;VALUE=DATE:{_format_ics_date(start_date)}',
-        f'DTEND;VALUE=DATE:{_format_ics_date(end_date + timedelta(days=1))}',
-        f'Titel:{_escape_ics_text(titel)}',
+        f'DTEND;VALUE=DATE:{_format_ics_date(end_date + datetime.timedelta(days=1))}',
         'END:VEVENT',
         'END:VCALENDAR',
         '',
@@ -172,7 +175,7 @@ def build_client_slot_ics(appointment_id: str, slot_start: str, client_name: str
     ]
 
     uid = f"terminplaner-slot-{appointment_id}-{start_dt.strftime('%Y%m%d%H%M')}@invario.eu"
-    created_at = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ')
+    created_at = datetime.datetime.now(datetime.timezone.utc).strftime('%Y%m%dT%H%M%SZ')
     dt_start = start_dt.strftime('%Y%m%dT%H%M%S')
     dt_end = end_dt.strftime('%Y%m%dT%H%M%S')
 
@@ -198,7 +201,7 @@ def build_client_slot_ics(appointment_id: str, slot_start: str, client_name: str
     return '\r\n'.join(ics_lines)
 
 
-def new(date_start: str, date_end: str, time_span: list, slots, slot_length, user: str, mail: list=None, note:str="", calendar_enabled: bool=False, title: str="") -> dict:
+def new(date_start: str, date_end: str, time_span: list, slots, slot_length, user: str, mail: list=None, note:str="", calendar_enabled: bool=False, title: str="", custom_fields: list = (), clients_per_slot: int=1) -> dict:
     """
     Generates a link for the executive to send to his clients to book a time Slot
     """
@@ -207,6 +210,11 @@ def new(date_start: str, date_end: str, time_span: list, slots, slot_length, use
     except (ValueError, TypeError):
         slots_int = 0
         
+    try:
+        custom_fields.pop(-1)
+    except :
+        pass
+
     try:
         slot_length_int = int(slot_length)
     except (ValueError, TypeError):
@@ -215,7 +223,7 @@ def new(date_start: str, date_end: str, time_span: list, slots, slot_length, use
     normalized_time_span = _normalize_time_span(time_span)
     normalized_mail = _normalize_mail_list(mail or [])
     
-    id = termin.add(date_start, date_end, normalized_time_span, slots_int, slot_length_int, user, normalized_mail, note, calendar_enabled=calendar_enabled, title=title)
+    id = termin.add(date_start, date_end, normalized_time_span, slots_int, slot_length_int, user, normalized_mail, note, calendar_enabled=calendar_enabled, title=title, custom_fields=custom_fields, clients_p_slot=clients_per_slot)
     id_str = str(id)
     tenant_id = _current_tenant_id()
 
@@ -254,7 +262,7 @@ def new(date_start: str, date_end: str, time_span: list, slots, slot_length, use
     }
     
         
-def book_slot(id, date_start_time, name):
+def book_slot(id, date_start_time, name, custom: tuple = ()):
     try:
         item = termin.get_item(id)
         if not item:
@@ -264,18 +272,32 @@ def book_slot(id, date_start_time, name):
         if not isinstance(slots, list):
             slots = []
 
+        # 1. Check overall total booking capacity 
         capacity = int(item.get('slots', 0) or 0)
         if capacity and len(slots) >= capacity:
             return False
 
+        # 2. Prevent the exact same user from double-booking the exact same slot
         for existing in slots:
             if isinstance(existing, (list, tuple)) and len(existing) >= 2:
                 if existing[0] == date_start_time and existing[1] == name:
                     return False
 
-        slots.append((date_start_time, name))
+        # 3. Check concurrent capacity for this specific time slot
+        clients_per_slot = int(item.get('clients_per_slot', 1) or 1)
+        bookings_at_time = sum(
+            1 for existing in slots 
+            if isinstance(existing, (list, tuple)) and len(existing) > 0 and existing[0] == date_start_time
+        )
+        
+        if bookings_at_time >= clients_per_slot:
+            return False
+
+        # Append the new booking successfully
+        slots.append((date_start_time, name, custom))
         success = termin.update(id, slots)
         return bool(success)
+        
     except Exception as e:
         print(f"Error booking slot: {e}")
         return False
@@ -326,32 +348,46 @@ def get_available(id):
         date_end = termin_range.get('date_end')
         time_span = termin_range.get('time_span', [])
         
+        # Safe integer parsing without heavy try-except blocks
         try:
             total_slots = int(termin_range.get('slots', 0) or 0)
-        except Exception:
+        except (ValueError, TypeError):
             total_slots = 0
 
+        # Support both spellings gracefully
+        raw_length = termin_range.get('slot_length') or termin_range.get('slot_lenght') or 0
         try:
-            slot_length = int(termin_range.get('slot_length') or termin_range.get('slot_lenght') or 0)
-        except Exception:
-            slot_length = termin_range.get('slot_length') or termin_range.get('slot_lenght')
+            slot_length = int(raw_length)
+        except (ValueError, TypeError):
+            slot_length = raw_length
 
+        clients_per_slot = int(termin_range.get('clients_per_slot', 1) or 1)
         booked = termin_range.get('slots_booked', []) or []
 
+        # Normalize the bookings list safely
         normalized = []
+        bookings_by_time = {}  # Tracks how many people are in each specific time slot
+        
         for s in booked:
             if isinstance(s, (list, tuple)) and len(s) >= 2:
-                normalized.append({'start': s[0], 'name': s[1]})
+                slot_time = s[0]
+                item = {'start': slot_time, 'name': s[1]}
             elif isinstance(s, dict):
-                normalized.append(s)
+                slot_time = s.get('start')
+                item = s
             else:
-                normalized.append({'value': s})
+                slot_time = str(s)
+                item = {'value': s}
+                
+            normalized.append(item)
+            
+            # Count concurrent bookings per timestamp
+            if slot_time:
+                bookings_by_time[slot_time] = bookings_by_time.get(slot_time, 0) + 1
 
+        # Calculate remaining total capacity safely
         slots_used = len(normalized)
-        try:
-            slots_left = max(0, int(total_slots) - slots_used)
-        except Exception:
-            slots_left = max(0, slots_used - slots_used)
+        slots_left = max(0, total_slots - slots_used)
 
         return {
             'date_start': date_start,
@@ -360,8 +396,10 @@ def get_available(id):
             'slot_length': slot_length,
             'slot_lenght': slot_length,
             'slots_total': total_slots,
+            'clients_per_slot': clients_per_slot,
             'slots_booked': normalized,
             'slots_left': slots_left,
+            'bookings_by_time': bookings_by_time
         }
     except Exception as e:
         print(f"Error getting available slots: {e}")
@@ -370,7 +408,6 @@ def get_available(id):
 def get_available_user(id):
     return get_available(id)
 
-
 def get_user_upcoming_events(user: str, limit: int = 25) -> list[dict]:
     user_name = str(user or '').strip()
     if not user_name:
@@ -418,6 +455,7 @@ def get_user_upcoming_events(user: str, limit: int = 25) -> list[dict]:
                 'link': link,
                 'calendar_link': calendar_link if item.get('calendar_enabled') else None,
                 'title': str(item.get('title') or ''),
+                'custom_fields': list(item.get('custom_fields')),
             }
         )
 

Web/modules/terminplaner/blueprint.py

@@ -1,14 +1,57 @@
-from flask import Blueprint, render_template, request, session, url_for, redirect, flash
-from flask import Response
+from flask import Blueprint, render_template, request, session, url_for, redirect, flash, make_response, Response, send_file
 import Web.modules.terminplaner.backend_server as appointment_service
 import Web.modules.database.settings as cfg
 import Web.modules.database.termine as termin
 import Web.modules.database.user as us
+from Web.modules.terminplaner.backend_server import _resolve_public_base_url
+import csv
+import io
+import qrcode
+import os
+import tempfile
+from reportlab.lib.pagesizes import A4
+from reportlab.lib.styles import getSampleStyleSheet, ParagraphStyle
+from reportlab.lib.units import cm
+from reportlab.lib.colors import grey, HexColor
+from reportlab.platypus import SimpleDocTemplate, Paragraph, Spacer, Image
+
 
 # Create a blueprint instance
 appoint_bp = Blueprint('terminplaner', __name__)
 
 
+def _get_school_info_for_export():
+    """
+    Get school information for PDF exports from configuration or database.
+    Returns default info if not configured.
+    """
+    try:
+        if hasattr(cfg, 'get_school_info'):
+            return cfg.get_school_info()
+
+        school_info = {
+            'name': 'Schulname',
+            'address': 'Schuladresse',
+            'postal_code': 'PLZ',
+            'city': 'Stadt',
+            'school_number': '000000',
+            'it_admin': 'IT-Beauftragter/in',
+            'logo_path': '',
+        }
+        return school_info
+    except Exception:
+        # Return defaults if anything fails
+        return {
+            'name': 'Schulname',
+            'address': 'Schuladresse', 
+            'postal_code': 'PLZ',
+            'city': 'Stadt',
+            'school_number': '000000',
+            'it_admin': 'IT-Beauftragter/in',
+            'logo_path': '',
+        }
+
+
 def _require_module_enabled():
     if not cfg.MODULES.is_enabled('terminplan'):
         flash('Der Terminplaner ist deaktiviert.', 'info')
@@ -34,10 +77,70 @@ def _current_tenant_id():
         pass
     return str(session.get('tenant_id', '') or '').strip()
 
+@appoint_bp.route('/client/<appointment_id>/export_csv')
+def export_csv(appointment_id):
+    """
+    Generiert einen CSV-Export aller Buchungen für den Ersteller.
+    """
+    # 1. Berechtigungsprüfung (analog zur Client-Route)
+    current_user = str(session.get('username', '') or '').strip()
+    appointment_item = termin.get_item(appointment_id) or {}
+    appointment_owner = str(appointment_item.get('user', '') or '').strip()
+    
+    can_view = False
+    if current_user:
+        try:
+            can_view = bool(us.check_admin(current_user) or current_user == appointment_owner)
+        except Exception:
+            can_view = bool(current_user == appointment_owner)
+            
+    if not can_view:
+        flash('Nicht autorisiert für diesen Export.', 'error')
+        return redirect(url_for('terminplaner.client', appointment_id=appointment_id))
+
+    custom_fields = appointment_item.get('custom_fields', [])
+    bookings = appointment_item.get('slots_booked', []) or []
+
+    # 2. CSV im Speicher erstellen
+    si = io.StringIO()
+    # Wir nutzen ein Semikolon als Trennzeichen – das öffnet Excel im deutschsprachigen Raum direkt fehlerfrei
+    cw = csv.writer(si, delimiter=';', quoting=csv.QUOTE_MINIMAL)
+    
+    # Tabellenkopf schreiben
+    headers = ['Zeitpunkt', 'Name'] + list(custom_fields)
+    cw.writerow(headers)
+    
+    # Datenzeilen schreiben
+    for booking in bookings:
+        if isinstance(booking, (list, tuple)):
+            row = [booking[0], booking[1]]
+            
+            # Antworten holen und sicherstellen, dass Lücken (falls vorhanden) mit Leerstrings gefüllt werden
+            answers = booking[2] if len(booking) > 2 else []
+            for i in range(len(custom_fields)):
+                if i < len(answers):
+                    row.append(answers[i])
+                else:
+                    row.append('')
+            cw.writerow(row)
+
+    # 3. Response vorbereiten und UTF-8-BOM für Excel mitsenden
+    response_content = si.getvalue()
+    output = make_response(response_content)
+    
+    output.data = b'\xef\xbb\xbf' + output.data
+    
+    # Dateiname generieren
+    title_slug = appointment_item.get('title', 'export').replace(' ', '_')
+    output.headers["Content-Disposition"] = f"attachment; filename=buchungen_{title_slug}.csv"
+    output.headers["Content-Type"] = "text/csv; charset=utf-8"
+    
+    return output
+
 @appoint_bp.route('/client/<appointment_id>', methods=['POST', 'GET'])
 def client(appointment_id):
     """
-    The Route for the terminplaner to work with the client
+    The Route for the terminplaner to work with the client and allow owners to manage it.
     """
     guard = _require_module_enabled()
     if guard:
@@ -50,6 +153,10 @@ def client(appointment_id):
     current_user = str(session.get('username', '') or '').strip()
     appointment_item = termin.get_item(appointment_id) or {}
     appointment_owner = str(appointment_item.get('user', '') or '').strip()
+    
+    custom_fields = appointment_item.get('custom_fields', [])
+
+    # Permissions check
     can_view_booking_names = False
     if current_user:
         try:
@@ -57,6 +164,7 @@ def client(appointment_id):
         except Exception:
             can_view_booking_names = bool(current_user == appointment_owner)
 
+    # Sanitize data for public/client view
     available_for_view = dict(available)
     if not can_view_booking_names:
         sanitized_bookings = []
@@ -70,31 +178,59 @@ def client(appointment_id):
         available_for_view['slots_booked'] = sanitized_bookings
 
     if request.method == 'POST':
-        start_daytime = request.form.get('start_day_time')
-        username = request.form.get('client_name')
-        if not start_daytime or not username:
-            flash('Bitte Name und gewünschte Uhrzeit angeben.', 'error')
-            return render_template(
-                'termin_client.html',
-                appointment_id=appointment_id,
-                available=available_for_view,
-                current_user=session.get('username', ''),
-                tenant_id=_current_tenant_id(),
-                can_view_booking_names=can_view_booking_names,
-            )
+        action = request.form.get('action', 'book')
 
-        if appointment_service.book_slot(appointment_id, start_daytime, username):
-            return redirect(
-                url_for(
-                    'terminplaner.client_success',
+        # Case 1: Admin/Owner cancels a booking
+        if action == 'delete' and can_view_booking_names:
+            slot_time = request.form.get('slot_time')
+            client_name = request.form.get('target_client_name')
+            
+            current_slots = appointment_item.get('slots_booked', []) or []
+            
+            # Keep everything EXCEPT the item targeted for deletion
+            updated_slots = [
+                slot for slot in current_slots 
+                if not (isinstance(slot, (list, tuple)) and slot[0] == slot_time and slot[1] == client_name)
+            ]
+            
+            if termin.update(appointment_id, updated_slots):
+                flash('Buchung wurde erfolgreich gelöscht.', 'success')
+            else:
+                flash('Fehler beim Löschen der Buchung.', 'error')
+                
+            return redirect(url_for('terminplaner.client', appointment_id=appointment_id, tenant=_current_tenant_id() or None))
+
+        # Case 2: Client books a slot
+        elif action == 'book':
+            start_daytime = request.form.get('start_day_time')
+            username = request.form.get('client_name')
+            custom_answers = tuple(request.form.getlist('custom_answers'))  # Cast to tuple for DB safety
+
+            if not start_daytime or not username:
+                flash('Bitte Name und gewünschte Uhrzeit angeben.', 'error')
+                return render_template(
+                    'termin_client.html',
                     appointment_id=appointment_id,
-                    tenant=_current_tenant_id() or None,
-                    start=start_daytime,
-                    name=username,
+                    available=available_for_view,
+                    current_user=session.get('username', ''),
+                    tenant_id=_current_tenant_id(),
+                    can_view_booking_names=can_view_booking_names,
+                    custom_fields=custom_fields,
+                    appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
                 )
-            )
 
-        flash('Der Termin konnte nicht gespeichert werden.', 'error')
+            if appointment_service.book_slot(appointment_id, start_daytime, username, custom=custom_answers):
+                return redirect(
+                    url_for(
+                        'terminplaner.client_success',
+                        appointment_id=appointment_id,
+                        tenant=_current_tenant_id() or None,
+                        start=start_daytime,
+                        name=username,
+                    )
+                )
+
+            flash('Der Termin konnte nicht gespeichert werden. Eventuell ist der Slot bereits voll.', 'error')
 
     return render_template(
         'termin_client.html',
@@ -103,6 +239,9 @@ def client(appointment_id):
         current_user=session.get('username', ''),
         tenant_id=_current_tenant_id(),
         can_view_booking_names=can_view_booking_names,
+        custom_fields=custom_fields,
+        appointment_item=appointment_item,
+        appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
     )
 
 
@@ -154,7 +293,7 @@ def delete_appointment(appointment_id):
 @appoint_bp.route('/configure', methods=['GET', 'POST'])
 def configure():
     """
-    Route for authenticated persons to configure a new appointment for them
+    Route for authenticated persons to configure a new appointment schedule
     """
     guard = _require_module_enabled()
     if guard:
@@ -169,13 +308,18 @@ def configure():
         end = request.form.get('end_date')
         time = request.form.get('time_frame')
         slots_amount = request.form.get('slots_amounts')
-        slot_length = request.form.get('slot_length') # Korrigiert: slot_length
+        slot_length = request.form.get('slot_length') 
         mail = request.form.get('mail', '')
         note = request.form.get('note', '')
         add_to_calendar = request.form.get('add_to_calendar') == 'on'
-        title = request.form.get('title', '').strip() # Korrigiert: title statt titel
+        title = request.form.get('title', '').strip()
+        custom = request.form.getlist('custom_fields')
+        
+        try:
+            clients_p_slot = int(request.form.get('clients_per_slot', 1))
+        except (ValueError, TypeError):
+            clients_p_slot = 1
 
-        # Abfrage ebenfalls auf title und slot_length angepasst
         if not start or not end or not time or not slots_amount or not slot_length or not title:
             flash('Bitte alle Pflichtfelder ausfüllen.', 'error')
             return render_template(
@@ -185,28 +329,48 @@ def configure():
                 email_service_enabled=cfg.EMAIL_ENABLED,
             )
 
-        # Variablen im Funktionsaufruf aktualisiert
-        result = appointment_service.new(start, end, time, slots_amount, slot_length, session["username"], mail, note, calendar_enabled=add_to_calendar, title=title)
+        # Call the database service function (standardized to match your underlying code)
+        inserted_id = appointment_service.new(
+            date_start=start, 
+            date_end=end, 
+            time_span=time, 
+            slots=slots_amount, 
+            slot_length=slot_length, 
+            user=session["username"], 
+            mail=mail, 
+            note=note, 
+            calendar_enabled=add_to_calendar, 
+            title=title, 
+            custom_fields=custom,
+            clients_per_slot=clients_p_slot
+        )
+
+        if not inserted_id:
+            flash('Fehler beim Erstellen des Terminplans.', 'error')
+            return redirect(url_for('terminplaner.configure'))
+
         flash('Der Terminplan wurde angelegt.', 'success')
         return render_template(
             'termin_configure.html',
             school_periods=cfg.SCHOOL_PERIODS,
-            generated_link=result['link'],
-            calendar_link=result.get('calendar_link'),
+            generated_link=inserted_id['link'],
+            calendar_link=None, 
             add_to_calendar=add_to_calendar,
             email_service_enabled=cfg.EMAIL_ENABLED,
             title=title,
+            appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
         )
-    elif request.method == "GET":
-        return render_template(
-            'termin_configure.html',
-            school_periods=cfg.SCHOOL_PERIODS,
-            generated_link=None,
-            calendar_link=None,
-            add_to_calendar=False,
-            email_service_enabled=cfg.EMAIL_ENABLED,
-            title=None,
-        )
+
+    return render_template(
+        'termin_configure.html',
+        school_periods=cfg.SCHOOL_PERIODS,
+        generated_link=None,
+        calendar_link=None,
+        add_to_calendar=False,
+        email_service_enabled=cfg.EMAIL_ENABLED,
+        title=None,
+        appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
+    )
 
 
 @appoint_bp.route('/calendar/<appointment_id>.ics', methods=['GET'])
@@ -244,6 +408,138 @@ def client_slot_calendar_export(appointment_id):
     response.headers['Content-Disposition'] = f'attachment; filename=termin-{title}-{appointment_id}-{slot_start.replace(" ", "_").replace(":", "")}.ics'
     return response
 
+
+@appoint_bp.route('/export_pdf_brief/<plan_id>', methods=['GET'])
+def export_pdf_brief(plan_id):
+    # 1. Daten holen (Hier als Beispiel, passe dies auf deine Datenbank an)
+    # terminplan = Terminplan.query.get(plan_id)
+
+    school_info = _get_school_info_for_export()
+
+    school_name = school_info.get('name', 'Schulname')
+    address = school_info.get('address', 'Adresse')
+    postal_code = school_info.get('postal_code', 'PLZ')
+    city = school_info.get('city', 'Stadt')
+    school_number = school_info.get('school_number', '000000')
+    it_admin = school_info.get('it_admin', 'IT-Beauftragter/in')
+    tenant_id = _current_tenant_id()
+
+    try:
+        link = url_for('terminplaner.client', appointment_id=plan_id, tenant=tenant_id or None, _external=True)
+    except Exception:
+        host = _resolve_public_base_url()
+        link = host + "/terminplaner/client/" + plan_id
+        if tenant_id:
+            link += f"?tenant={tenant_id}"
+
+    schul_daten = {
+        "schulname": school_name,
+        "strasse": address,
+        "plz_ort": f"{postal_code} {city}",
+        "schulnummer": school_number,
+        "it_admin": it_admin
+    }
+    
+    plan_daten = {
+        "titel": termin.get_item(plan_id).get('title', 'Terminplan'), # terminplan.title
+        "link": link, # terminplan.link
+        "notizen": termin.get_item(plan_id).get('note', '') # terminplan.note
+    }
+
+    # 2. QR-Code Bild im temporären Ordner erstellen
+    qr = qrcode.QRCode(version=1, box_size=10, border=0)
+    qr.add_data(plan_daten["link"])
+    qr.make(fit=True)
+    img = qr.make_image(fill_color="black", back_color="white")
+    
+    fd, qr_path = tempfile.mkstemp(suffix=".png")
+    os.close(fd)
+    img.save(qr_path)
+
+    # 3. PDF im Speicher aufbauen (BytesIO)
+    pdf_buffer = io.BytesIO()
+    doc = SimpleDocTemplate(
+        pdf_buffer,
+        pagesize=A4,
+        rightMargin=2*cm,
+        leftMargin=2.5*cm,
+        topMargin=2.5*cm,
+        bottomMargin=2*cm
+    )
+    
+    styles = getSampleStyleSheet()
+    styles.add(ParagraphStyle(name='Sender', fontSize=8, textColor=grey))
+    styles.add(ParagraphStyle(name='Address', fontSize=10, leading=14))
+    styles.add(ParagraphStyle(name='Date', fontSize=10, alignment=2))
+    styles.add(ParagraphStyle(name='Subject', fontSize=14, fontName='Helvetica-Bold', spaceAfter=16, textColor=HexColor('#0f4c5c')))
+    styles.add(ParagraphStyle(name='Body', fontSize=11, leading=16, spaceAfter=12))
+    styles.add(ParagraphStyle(name='Notes', fontSize=10, leading=14, textColor=HexColor("#444444")))
+    
+    elements = []
+    
+    # Absenderzeile
+    sender_text = f"<u>{schul_daten['schulname']} • {schul_daten['strasse']} • {schul_daten['plz_ort']}</u>"
+    elements.append(Paragraph(sender_text, styles['Sender']))
+    elements.append(Spacer(1, 1.5*cm))
+    
+    # Sichtfenster-Adresse (Generisch)
+    elements.append(Paragraph("An die<br/>Teilnehmerinnen und Teilnehmer<br/>des Termins", styles['Address']))
+    elements.append(Spacer(1, 2*cm))
+    
+    # Datum (Hier statisch zum Test, ggf. dynamisch per datetime)
+    import datetime
+    heute = datetime.datetime.now().strftime("%d.%m.%Y")
+    elements.append(Paragraph(f"{schul_daten['plz_ort']}, den {heute}", styles['Date']))
+    elements.append(Spacer(1, 1*cm))
+    
+    # Betreff
+    elements.append(Paragraph(f"Einladung zur Terminbuchung: {plan_daten['titel']}", styles['Subject']))
+    
+    # Text
+    elements.append(Paragraph("Sehr geehrte Damen und Herren,", styles['Body']))
+    elements.append(Paragraph("hiermit möchten wir Sie herzlich einladen, einen Termin für unsere anstehende Veranstaltung zu buchen. Um den Prozess für alle Beteiligten so einfach und effizient wie möglich zu gestalten, nutzen wir unser Online-Buchungssystem.", styles['Body']))
+    elements.append(Spacer(1, 0.5*cm))
+    
+    # Link
+    elements.append(Paragraph("<b>Ihr persönlicher Buchungslink:</b>", styles['Body']))
+    link_html = f'<a href="{plan_daten["link"]}?" color="#16697a">{plan_daten["link"]}</a>'
+    elements.append(Paragraph(link_html, styles['Body']))
+    
+    # Das vorhin erstellte QR-Code Bild einfügen
+    elements.append(Spacer(1, 0.2*cm))
+    elements.append(Image(qr_path, width=3*cm, height=3*cm, hAlign='LEFT'))
+    elements.append(Spacer(1, 0.5*cm))
+    
+    # Notizen (falls vorhanden)
+    if plan_daten.get('notizen'):
+        elements.append(Paragraph("<b>Zusätzliche Informationen zum Termin:</b>", styles['Body']))
+        elements.append(Paragraph(plan_daten['notizen'], styles['Notes']))
+        
+    elements.append(Spacer(1, 1.5*cm))
+    
+    # Grußformel
+    elements.append(Paragraph("Mit freundlichen Grüßen,", styles['Body']))
+    elements.append(Spacer(1, 1.5*cm))
+    elements.append(Paragraph(f"<b>{schul_daten['schulname']}</b>", styles['Body']))
+    
+    # PDF fertigstellen
+    doc.build(elements)
+    
+    # Temporäres Bild löschen
+    if os.path.exists(qr_path):
+        os.remove(qr_path)
+    
+    # Buffer auf Anfang zurücksetzen
+    pdf_buffer.seek(0)
+    
+    # An Nutzer ausliefern
+    return send_file(
+        pdf_buffer,
+        mimetype='application/pdf',
+        as_attachment=True,
+        download_name=f"Einladung_{plan_daten['titel'].replace(' ', '_')}.pdf"
+    )
+
 @appoint_bp.route('/')
 def main():
     guard = _require_module_enabled()
@@ -254,10 +550,12 @@ def main():
     upcoming_events = appointment_service.get_user_upcoming_events(current_user) if current_user else []
     tenant_id = _current_tenant_id()
 
+
     return render_template(
         'terminplaner.html',
         school_periods=cfg.SCHOOL_PERIODS,
         current_user=current_user,
         upcoming_events=upcoming_events,
         tenant_id=tenant_id,
+        appointment_module_enabled=cfg.MODULES.is_enabled('terminplan')
     )

Web/push_notifications.py

@@ -13,6 +13,7 @@ import logging
 
 import Web.modules.database.settings as cfg
 from Web.modules.database.settings import MongoClient
+from Web.modules.inventarsystem.data_protection import encrypt_text, decrypt_text
 
 logger = logging.getLogger(__name__)
 
@@ -44,16 +45,22 @@ if not VAPID_PUBLIC_KEY or not VAPID_PRIVATE_KEY:
             serialization.PublicFormat.UncompressedPoint
         )
         
-        VAPID_PUBLIC_KEY = b64urlencode(raw_pub)
+        VAPID_PUBLIC_KEY = b64urlencode(raw_pub).decode('utf-8')
         VAPID_PRIVATE_KEY = VAPID_PRIVATE_PEM
     except Exception as e:
         logger.error(f'Could not load or generate VAPID keys: {e}')
 
 # Push service endpoint (typically Firebase or Web Push Service)
-PUSH_SERVICE_URL = 'https://fcm.googleapis.com/fcm/send'  # Firebase Cloud Messaging
 FCM_API_KEY = os.getenv('FCM_API_KEY', '')  # Firebase API key
 
 
+def _get_username_hash(username):
+    """Generates a deterministic hash for database lookups."""
+    if not username:
+        return None
+    return hashlib.sha256(username.encode('utf-8')).hexdigest()
+
+
 def get_push_subscriptions_collection(db=None):
     """Get MongoDB push subscriptions collection"""
     if db is None:
@@ -64,71 +71,68 @@ def get_push_subscriptions_collection(db=None):
 
 def get_user_subscriptions(username):
     """
-    Get all active push subscriptions for a user
-    
-    Args:
-        username (str): Username
-        
-    Returns:
-        list: List of subscription documents
+    Get all active push subscriptions for a user, decrypting data on the fly.
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         subs_col = get_push_subscriptions_collection(db)
         
-        subscriptions = list(subs_col.find({
-            'Username': username,
+        # Query using the deterministic hash, NOT the encrypted text directly
+        user_hash = _get_username_hash(username)
+        
+        encrypted_subscriptions = list(subs_col.find({
+            'UsernameHash': user_hash,
             'IsActive': True
         }))
         
         client.close()
-        return subscriptions
+        
+        # Decrypt endpoints and keys before returning
+        decrypted_subs = []
+        for sub in encrypted_subscriptions:
+            try:
+                sub['Endpoint'] = decrypt_text(sub.get('Endpoint'))
+                
+                # Keys are stored as encrypted JSON strings
+                decrypted_keys_str = decrypt_text(sub.get('Keys'))
+                sub['Keys'] = json.loads(decrypted_keys_str) if decrypted_keys_str else {}
+                
+                decrypted_subs.append(sub)
+            except Exception as e:
+                logger.error(f"Failed to decrypt subscription payload for hash {user_hash}: {e}")
+                
+        return decrypted_subs
     except Exception as e:
-        logger.error(f'Error getting push subscriptions for {username}: {e}')
+        logger.error(f'Error getting push subscriptions for user: {e}')
         return []
 
 
 def save_push_subscription(username, subscription_obj):
     """
-    Save a new push subscription for a user
-    
-    Args:
-        username (str): Username
-        subscription_obj (dict): Subscription object from Service Worker
-        {
-            'endpoint': 'https://...',
-            'keys': {
-                'p256dh': '...',
-                'auth': '...'
-            }
-        }
-        
-    Returns:
-        bool: Success status
+    Save a new push subscription for a user with field-level encryption.
     """
     try:
-        if not subscription_obj.get('endpoint'):
-            logger.warning(f'Invalid subscription object for {username}')
+        endpoint = subscription_obj.get('endpoint')
+        if not endpoint:
+            logger.warning('Invalid subscription object: missing endpoint')
             return False
         
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         subs_col = get_push_subscriptions_collection(db)
         
-        # Create unique hash of subscription to avoid duplicates
-        sub_hash = hashlib.md5(
-            f"{username}:{subscription_obj['endpoint']}".encode()
+        # Create unique hash of subscription using plaintext data to avoid duplicates
+        sub_hash = hashlib.shake_256(
+            f"{username}:{endpoint}".encode('utf-8')
         ).hexdigest()
         
-        # Check if subscription already exists
+        # Check if subscription already exists by Hash
         existing = subs_col.find_one({
-            'Username': username,
             'SubscriptionHash': sub_hash
         })
         
         if existing:
-            # Update last used time
             subs_col.update_one(
                 {'_id': existing['_id']},
                 {'$set': {
@@ -136,15 +140,19 @@ def save_push_subscription(username, subscription_obj):
                     'IsActive': True
                 }}
             )
-            logger.info(f'Updated existing subscription for {username}')
+            logger.info('Updated existing push subscription')
             client.close()
             return True
         
-        # Save new subscription
+        # Format keys as JSON string for your encrypt_text module
+        keys_str = json.dumps(subscription_obj.get('keys', {}))
+        
+        # Save new subscription, encrypting sensitive fields
         subscription_doc = {
-            'Username': username,
-            'Endpoint': subscription_obj['endpoint'],
-            'Keys': subscription_obj.get('keys', {}),
+            'UsernameHash': _get_username_hash(username),
+            'Username': encrypt_text(username),
+            'Endpoint': encrypt_text(endpoint),
+            'Keys': encrypt_text(keys_str),
             'SubscriptionHash': sub_hash,
             'IsActive': True,
             'CreatedAt': datetime.datetime.now(),
@@ -153,36 +161,31 @@ def save_push_subscription(username, subscription_obj):
         }
         
         subs_col.insert_one(subscription_doc)
-        logger.info(f'Saved new push subscription for {username}')
+        logger.info('Saved new encrypted push subscription')
         client.close()
         return True
         
     except Exception as e:
-        logger.error(f'Error saving push subscription for {username}: {e}')
+        logger.error(f'Error saving push subscription: {e}')
         return False
 
 
 def remove_push_subscription(username, endpoint):
     """
-    Remove a push subscription
-    
-    Args:
-        username (str): Username
-        endpoint (str): Subscription endpoint URL
-        
-    Returns:
-        bool: Success status
+    Remove a push subscription by making it inactive.
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         subs_col = get_push_subscriptions_collection(db)
         
+        # Recreate the deterministic hash to find the specific subscription
+        sub_hash = hashlib.shake_256(
+            f"{username}:{endpoint}".encode('utf-8')
+        ).hexdigest()
+        
         result = subs_col.update_one(
-            {
-                'Username': username,
-                'Endpoint': endpoint
-            },
+            {'SubscriptionHash': sub_hash},
             {'$set': {'IsActive': False}}
         )
         
@@ -190,31 +193,19 @@ def remove_push_subscription(username, endpoint):
         return result.modified_count > 0
         
     except Exception as e:
-        logger.error(f'Error removing push subscription for {username}: {e}')
+        logger.error(f'Error removing push subscription: {e}')
         return False
 
 
 def send_push_notification(username, title, body, icon=None, url='/', reference=None, tag='notification'):
     """
-    Send a push notification to all user's subscriptions
-    
-    Args:
-        username (str): Target username
-        title (str): Notification title
-        body (str): Notification body
-        icon (str, optional): Icon URL
-        url (str, optional): URL to open on click
-        reference (dict, optional): Reference data (item_id, etc)
-        tag (str, optional): Notification tag for grouping
-        
-    Returns:
-        int: Number of successfully sent notifications
+    Send a push notification to all user's subscriptions.
     """
     try:
         subscriptions = get_user_subscriptions(username)
         
         if not subscriptions:
-            logger.debug(f'No active push subscriptions for {username}')
+            logger.debug('No active push subscriptions for user')
             return 0
         
         sent_count = 0
@@ -232,19 +223,18 @@ def send_push_notification(username, title, body, icon=None, url='/', reference=
             if success:
                 sent_count += 1
             else:
-                # Mark subscription as inactive if send fails
                 _mark_subscription_inactive(subscription['_id'])
         
-        logger.info(f'Sent push notification to {username}: {sent_count}/{len(subscriptions)} subscriptions')
+        logger.info(f'Sent push notification: {sent_count}/{len(subscriptions)} subscriptions')
         return sent_count
         
     except Exception as e:
-        logger.error(f'Error sending push notification to {username}: {e}')
+        logger.error(f'Error sending push notification: {e}')
         return 0
 
 
 def _send_to_subscription(subscription, title, body, icon, url, reference, tag):
-    """Send push notification to a specific subscription"""
+    """Send push notification to a specific decrypted subscription"""
     try:
         payload = {
             'title': title,
@@ -256,20 +246,17 @@ def _send_to_subscription(subscription, title, body, icon, url, reference, tag):
             'reference': reference or {},
         }
         
-        # If using Firebase Cloud Messaging
         if FCM_API_KEY and subscription.get('Endpoint', '').startswith('https://fcm.'):
             return _send_fcm_notification(subscription, payload)
         
-        # Otherwise use standard Web Push Protocol
         return _send_web_push_notification(subscription, payload)
         
     except Exception as e:
-        logger.error(f'Error sending to subscription {subscription.get("_id")}: {e}')
+        logger.error(f'Error sending to subscription: {e}')
         return False
 
 
 def _send_fcm_notification(subscription, payload):
-    """Send notification via Firebase Cloud Messaging"""
     try:
         if not FCM_API_KEY:
             logger.warning('FCM_API_KEY not configured')
@@ -311,9 +298,7 @@ def _send_fcm_notification(subscription, payload):
 
 
 def _send_web_push_notification(subscription, payload):
-    """Send notification using standard Web Push Protocol"""
     try:
-        # This requires pywebpush library
         from pywebpush import webpush
         
         webpush(
@@ -325,13 +310,13 @@ def _send_web_push_notification(subscription, payload):
             vapid_private_key=VAPID_PRIVATE_KEY,
             vapid_claims={'sub': VAPID_SUBJECT},
             timeout=10,
-            ttl=3600  # Notification expires after 1 hour if device is offline
+            ttl=3600 
         )
         
         return True
         
     except ImportError:
-        logger.warning('pywebpush not installed, install with: pip install pywebpush')
+        logger.warning('pywebpush not installed. pip install pywebpush')
         return False
     except Exception as e:
         logger.error(f'Web push error: {e}')
@@ -339,7 +324,6 @@ def _send_web_push_notification(subscription, payload):
 
 
 def _mark_subscription_inactive(subscription_id):
-    """Mark a subscription as inactive (e.g., after failed send)"""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
@@ -349,37 +333,21 @@ def _mark_subscription_inactive(subscription_id):
             {'_id': ObjectId(subscription_id)},
             {'$set': {'IsActive': False}}
         )
-        
         client.close()
     except Exception as e:
         logger.error(f'Error marking subscription inactive: {e}')
 
 
 def send_push_to_all_admins(title, body, icon=None, url='/', reference=None):
-    """
-    Send a push notification to all admin users
-    
-    Args:
-        title (str): Notification title
-        body (str): Notification body
-        icon (str, optional): Icon URL
-        url (str, optional): URL to open on click
-        reference (dict, optional): Reference data
-        
-    Returns:
-        int: Total notifications sent
-    """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         users_col = db['users']
         
-        # Get all admin users
         admin_users = list(users_col.find(
             {'Admin': True},
             {'Username': 1}
         ))
-        
         client.close()
         
         total_sent = 0
@@ -404,10 +372,6 @@ def send_push_to_all_admins(title, body, icon=None, url='/', reference=None):
 
 
 def cleanup_inactive_subscriptions():
-    """
-    Remove inactive subscriptions older than 30 days
-    Run this periodically as a maintenance task
-    """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
@@ -429,22 +393,19 @@ def cleanup_inactive_subscriptions():
         return 0
 
 
-# Database collection schema
 def ensure_push_subscriptions_collection():
-    """Ensure the push_subscriptions collection exists with proper indexes"""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
         db = client[cfg.MONGODB_DB]
         subs_col = get_push_subscriptions_collection(db)
         
-        # Create indexes
-        subs_col.create_index('Username')
-        subs_col.create_index([('Username', 1), ('IsActive', 1)])
-        subs_col.create_index([('CreatedAt', 1)])  # TTL-like usage
+        subs_col.create_index('UsernameHash')
+        subs_col.create_index([('UsernameHash', 1), ('IsActive', 1)])
+        subs_col.create_index([('CreatedAt', 1)]) 
         subs_col.create_index('SubscriptionHash', unique=True)
         
         logger.info('Push subscriptions collection indexes created')
         client.close()
         
     except Exception as e:
-        logger.error(f'Error ensuring push subscriptions collection: {e}')
+        logger.error(f'Error ensuring push subscriptions collection: {e}')

Web/requirements.txt

@@ -1,4 +1,5 @@
 flask
+flask-wtf
 werkzeug
 gunicorn
 pymongo

Web/templates/base.html

@@ -1130,7 +1130,7 @@
                         <li class="nav-item" data-nav-fixed="true">
                             <a class="nav-link {% if current_path == url_for('terminplan') %}nav-active{% endif %}" href="{{ url_for('terminplan') }}" data-tutorial-tip="Hier sehen Sie den Kalender mit den bestehenden Terminen.">Kalender</a>
                         </li>
-                        {% if current_permissions.pages.get('terminplan', True) and current_permissions.actions.get('can_insert', True) %}
+                        {% if current_permissions.pages.get('terminplan', False) and current_permissions.actions.get('can_insert', False) %}
                         <li class="nav-item">
                             <a class="nav-link quick-link-pill {% if current_path == url_for('terminplaner.configure') %}nav-active{% endif %}" href="{{ url_for('terminplaner.configure') }}" data-tutorial-tip="Neuen Terminplan erstellen und an Ihr Team versenden.">Neue Planung</a>
                         </li>
@@ -1144,10 +1144,23 @@
                         <li class="nav-item dropdown ms-lg-auto">
                             <a class="nav-link dropdown-toggle" href="#" id="termMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false" title="Weitere Optionen">Mehr Optionen</a>
                             <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="termMoreDropdown">
-                                {% if current_permissions.pages.get('home', True) %}
+                                {% if 'username' in session %}
+                                {% if current_permissions.pages.get('tutorial_page', False) %}
+                                <li><a class="dropdown-item" href="{{ url_for('tutorial_page') }}">Tutorial</a></li>
+                                {% endif %}
+                                {% if current_permissions.pages.get('admin_school_settings', False) %}
+                                <li><a class="dropdown-item" href="{{ url_for('admin_school_settings') }}">Schulstammdaten</a></li>
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_view_logs', False) or current_permissions.pages.get('admin_audit_dashboard', False) %}
+                                <li><a class="dropdown-item" href="{{ url_for('admin_audit_dashboard') }}">Audit Dashboard</a></li>
+                                {% endif %}
+                                <li><hr class="dropdown-divider"></li>
+                                {% endif %}
+                                
+                                {% if current_permissions.pages.get('home', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('home') }}">Inventarsystem</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('library_view', True) and library_module_enabled %}
+                                {% if current_permissions.pages.get('library_view', False) and library_module_enabled %}
                                 <li><a class="dropdown-item" href="{{ url_for('library_view') }}">Bibliothek</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
@@ -1155,6 +1168,42 @@
                             </ul>
                         </li>
                     </ul>
+                    <div class="d-flex">
+                        {% if 'username' in session %}
+                            <div class="function-search-wrap">
+                                <form class="function-search-form" data-function-search="true">
+                                    <input
+                                        class="function-search-input"
+                                        type="search"
+                                        name="function_search"
+                                        placeholder="Funktion suchen..."
+                                        list="function-search-options"
+                                        autocomplete="off"
+                                    >
+                                    <button class="function-search-btn" type="submit">Los</button>
+                                </form>
+                            </div>
+                            {% if current_tenant_db %}
+                            <span class="navbar-text tenant-badge" title="Aktive Tenant-Datenbank">{{ current_tenant_db }}</span>
+                        {% endif %}
+                        <span class="navbar-text text-light me-3">{{ session['username'] }}</span>
+                            <div class="dropdown me-2 user-menu-wrap">
+                                <button class="btn btn-secondary dropdown-toggle user-menu-btn" type="button" id="invUserMenuDropdown" data-bs-toggle="dropdown" aria-expanded="false" data-notification-button="true">
+                                    👤
+                                    <span class="user-notification-dot {% if unread_notification_count and unread_notification_count > 0 %}visible{% endif %}" aria-hidden="true"></span>
+                                </button>
+                                <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invUserMenuDropdown">
+                                    {% if current_permissions.pages.get('notifications_view', False) %}
+                                    <li><a class="dropdown-item" href="{{ url_for('notifications_view') }}">Benachrichtigungen</a></li>
+                                    {% endif %}
+                                    <li><hr class="dropdown-divider"></li>
+                                    <li><a class="dropdown-item" href="{{ url_for('change_password') }}">Passwort ändern</a></li>
+                                    <li><hr class="dropdown-divider"></li>
+                                    <li><a class="dropdown-item" href="{{ url_for('logout') }}">Logout</a></li>
+                                </ul>
+                            </div>
+                        {% endif %}
+                    </div>
                 </div>
             </div>
         </nav>
@@ -1167,13 +1216,13 @@
                 </button>
                 <div class="collapse navbar-collapse" id="inventoryNavContent">
                     <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="inventoryNavList">
-                        {% if current_permissions.pages.get('home', True) %}
+                        {% if current_permissions.pages.get('home', False) %}
                         <li class="nav-item" data-nav-fixed="true">
                             <a class="nav-link {% if current_path == url_for('home') %}nav-active{% endif %}" href="{{ url_for('home') }}" data-tutorial-tip="Starten Sie hier mit dem Materialbestand und suchen Sie nach Artikeln.">Artikel</a>
                         </li>
                         {% endif %}
                         {% if 'username' in session %}
-                        {% if current_permissions.pages.get('my_borrowed_items', True) %}
+                        {% if current_permissions.pages.get('my_borrowed_items', False) %}
                         <li class="nav-item">
                             <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}" data-tutorial-tip="Ihre aktuellen Ausleihen und Rückgaben finden Sie hier.">Meine Ausleihen</a>
                         </li>
@@ -1192,42 +1241,44 @@
                             </a>
                             <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invMoreDropdown">
                                 {% if 'username' in session %}
-                                {% if current_permissions.pages.get('tutorial_page', True) %}
+                                {% if current_permissions.pages.get('tutorial_page', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('tutorial_page') }}">Tutorial</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('upload_admin', True) and current_permissions.actions.get('can_insert', True) %}
+                                {% if current_permissions.pages.get('upload_admin', False) and current_permissions.actions.get('can_insert', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('upload_admin') }}">➕ Hochladen</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
                                 {% endif %}
-                                {% if 'username' in session and (session.get('admin', False) or is_admin) and current_permissions.actions.get('can_manage_settings', True) %}
+                                {% if 'username' in session and current_permissions.actions.get('can_manage_settings', False) %}
                                 <li><h6 class="dropdown-header">Verwaltung</h6></li>
-                                {% if current_permissions.pages.get('manage_filters', True) %}
+                                {% if current_permissions.pages.get('manage_filters', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('manage_filters') }}">Filter verwalten</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('manage_locations', True) %}
+                                {% if current_permissions.pages.get('manage_locations', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('manage_locations') }}">Orte verwalten</a></li>
                                 {% endif %}
+                                {% if current_permissions.pages.get('admin_school_settings', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_school_settings') }}">Schulstammdaten</a></li>
-                                {% if current_permissions.pages.get('admin_borrowings', True) %}
+                                {% endif %}
+                                {% if current_permissions.pages.get('admin_borrowings', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_borrowings') }}">Ausleihen</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('admin_damaged_items', True) %}
+                                {% if current_permissions.pages.get('admin_damaged_items', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_damaged_items') }}">Defekte Items</a></li>
                                 {% endif %}
-                                {% if current_permissions.actions.get('can_view_logs', True) and current_permissions.pages.get('admin_audit_dashboard', True) %}
+                                {% if current_permissions.actions.get('can_view_logs', False) and current_permissions.pages.get('admin_audit_dashboard', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_audit_dashboard') }}">Audit Dashboard</a></li>
                                 {% endif %}
-                                {% if current_permissions.actions.get('can_view_logs', True) and current_permissions.pages.get('logs', True) %}
+                                {% if current_permissions.actions.get('can_view_logs', False) and current_permissions.pages.get('logs', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('logs') }}">Logs</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
-                                {% if current_permissions.actions.get('can_manage_users', True) %}
+                                {% if current_permissions.actions.get('can_manage_users', False) %}
                                 <li><h6 class="dropdown-header">System</h6></li>
-                                {% if current_permissions.pages.get('user_del', True) %}
+                                {% if current_permissions.pages.get('user_del', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('user_del') }}">Benutzer verwalten</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('register', True) %}
+                                {% if current_permissions.pages.get('register', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('register') }}">Neuer Benutzer</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
@@ -1264,7 +1315,7 @@
                                     <span class="user-notification-dot {% if unread_notification_count and unread_notification_count > 0 %}visible{% endif %}" aria-hidden="true"></span>
                                 </button>
                                 <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invUserMenuDropdown">
-                                    {% if current_permissions.pages.get('notifications_view', True) %}
+                                    {% if current_permissions.pages.get('notifications_view', False) %}
                                     <li><a class="dropdown-item" href="{{ url_for('notifications_view') }}">Benachrichtigungen</a></li>
                                     {% endif %}
                                     <li><hr class="dropdown-divider"></li>
@@ -1289,19 +1340,19 @@
                 </button>
                 <div class="collapse navbar-collapse" id="libraryNavContent">
                     <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="libraryNavList">
-                        {% if current_permissions.pages.get('library_view', True) %}
+                        {% if current_permissions.pages.get('library_view', False) %}
                         <li class="nav-item" data-nav-fixed="true">
                             <a class="nav-link {% if current_path == url_for('library_view') %}nav-active{% endif %}" href="{{ url_for('library_view') }}" data-tutorial-tip="Die Bibliothek zeigt Ihnen alle Medien und verfügbaren Bücher.">Medien</a>
                         </li>
                         {% endif %}
                         {% if 'username' in session %}
-                        {% if current_permissions.pages.get('tutorial_page', True) %}
+                        {% if current_permissions.pages.get('tutorial_page', False) %}
                         <li class="nav-item">
                             <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}" data-tutorial-tip="Nutzen Sie das Tutorial, um die Bibliotheksfunktionen kennenzulernen.">Tutorial</a>
                         </li>
                         {% endif %}
                         {% endif %}
-                        {% if 'username' in session and current_permissions.actions.get('can_insert', True) and current_permissions.pages.get('library_admin', True) %}
+                        {% if 'username' in session and current_permissions.actions.get('can_insert', False) and current_permissions.pages.get('library_admin', False) %}
                         <li class="nav-item">
                             <a class="nav-link nav-priority-link {% if current_path == url_for('library_admin') %}nav-active{% endif %}" href="{{ url_for('library_admin') }}" data-tutorial-tip="Neue Bibliotheksmedien können hier aufgenommen werden.">📖 Hochladen</a>
                         </li>
@@ -1318,22 +1369,26 @@
                                 Mehr Optionen
                             </a>
                             <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="libMoreDropdown">
-                                {% if 'username' in session and (session.get('admin', False) or is_admin) and current_permissions.actions.get('can_manage_settings', True) %}
+                                {% if 'username' in session and current_permissions.actions.get('can_manage_settings', False) %}
                                 <li><h6 class="dropdown-header">Bibliotheks-Verwaltung</h6></li>
-                                {% if current_permissions.pages.get('library_loans_admin', True) %}
+                                {% if current_permissions.pages.get('library_loans_admin', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('library_loans_admin') }}">Ausleihen / Defekte Items</a></li>
                                 {% endif %}
                                 {% if student_cards_module_enabled %}
+                                {% if current_permissions.actions.get('can_manage_users', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('student_cards_admin') }}">Bibliotheksausweis</a></li>
                                 {% endif %}
+                                {% endif %}
+                                {% if current_permissions.pages.get('admin_school_settings', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_school_settings') }}">Schulstammdaten</a></li>
+                                {% endif %}
                                 <li><hr class="dropdown-divider"></li>
-                                {% if current_permissions.actions.get('can_manage_users', True) %}
+                                {% if current_permissions.actions.get('can_manage_users', False) %}
                                 <li><h6 class="dropdown-header">System</h6></li>
-                                {% if current_permissions.pages.get('user_del', True) %}
+                                {% if current_permissions.pages.get('user_del', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('user_del') }}">Benutzer verwalten</a></li>
                                 {% endif %}
-                                {% if current_permissions.pages.get('register', True) %}
+                                {% if current_permissions.pages.get('register', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('register') }}">Neuer Benutzer</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
@@ -1367,7 +1422,7 @@
                                     <span class="user-notification-dot {% if unread_notification_count and unread_notification_count > 0 %}visible{% endif %}" aria-hidden="true"></span>
                                 </button>
                                 <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="libUserMenuDropdown">
-                                    {% if current_permissions.pages.get('notifications_view', True) %}
+                                    {% if current_permissions.pages.get('notifications_view', False) %}
                                     <li><a class="dropdown-item" href="{{ url_for('notifications_view') }}">Benachrichtigungen</a></li>
                                     {% endif %}
                                     <li><hr class="dropdown-divider"></li>
@@ -1566,11 +1621,10 @@
     <div id="cookie-banner" role="dialog" aria-live="polite" aria-label="Cookie-Hinweis">
         <div class="cb-inner">
             <div class="cb-text">
-                Wir verwenden technisch notwendige Cookies, um Ihre Sitzung zu verwalten und die Anwendung bereitzustellen. Bitte akzeptieren Sie Cookies, um fortzufahren.
+                Wir verwenden ausschließlich technisch notwendige Cookies, um Ihre Sitzung zu verwalten und die Anwendung bereitzustellen. Bitte bestätigen Sie dies, um fortzufahren.
             </div>
             <div class="cb-actions">
-                <button class="btn-decline" id="cookie-decline">Ablehnen</button>
-                <button class="btn-accept" id="cookie-accept">Akzeptieren</button>
+                <button class="btn-accept" id="cookie-accept">Notwendige Cookies akzeptieren</button>
             </div>
         </div>
     </div>
@@ -1595,30 +1649,79 @@
     </div>
 
     <datalist id="function-search-options">
+        {% if current_permissions.pages.get('home', False) %}
         <option value="Artikel"></option>
-        <option value="Meine Ausleihen"></option>
-        <option value="Benachrichtigungen"></option>
-        <option value="Tutorial"></option>
+        {% endif %}
+
+        {% if 'username' in session %}
+            {% if current_permissions.pages.get('my_borrowed_items', False) %}
+            <option value="Meine Ausleihen"></option>
+            {% endif %}
+            {% if current_permissions.pages.get('notifications_view', False) %}
+            <option value="Benachrichtigungen"></option>
+            {% endif %}
+            {% if current_permissions.pages.get('tutorial_page', False) %}
+            <option value="Tutorial"></option>
+            {% endif %}
+        {% endif %}
+
         <option value="Impressum"></option>
         <option value="Lizenz"></option>
+
         {% if library_module_enabled %}
-        <option value="Bibliothek"></option>
-        <option value="Meine Medien"></option>
-        {% endif %}
-        {% if 'username' in session and (session.get('admin', False) or is_admin) %}
-        <option value="Hochladen"></option>
-        <option value="Ausleihen Verwaltung"></option>
-        <option value="Defekte Items"></option>
-        <option value="Filter verwalten"></option>
-        <option value="Orte verwalten"></option>
-        <option value="Schulstammdaten"></option>
-        <option value="Audit Dashboard"></option>
-        <option value="Logs"></option>
-        <option value="Benutzer verwalten"></option>
-        <option value="Neuer Benutzer"></option>
-        {% if student_cards_module_enabled %}
-        <option value="Bibliotheksausweis"></option>
+            {% if current_permissions.pages.get('library_view', False) %}
+            <option value="Bibliothek"></option>
+            {% endif %}
+            {% if 'username' in session and current_permissions.pages.get('my_borrowed_items', False) %}
+            <option value="Meine Medien"></option>
+            {% endif %}
         {% endif %}
+
+        {% if 'username' in session %}
+            {% if current_permissions.pages.get('upload_admin', False) and current_permissions.actions.get('can_insert', False) %}
+            <option value="Hochladen"></option>
+            {% endif %}
+
+            {% if current_permissions.pages.get('admin_borrowings', False) or current_permissions.pages.get('library_loans_admin', False) %}
+            <option value="Ausleihen Verwaltung"></option>
+            {% endif %}
+
+            {% if current_permissions.pages.get('admin_damaged_items', False) or current_permissions.pages.get('library_loans_admin', False) %}
+            <option value="Defekte Items"></option>
+            {% endif %}
+
+            {% if current_permissions.pages.get('manage_filters', False) %}
+            <option value="Filter verwalten"></option>
+            {% endif %}
+
+            {% if current_permissions.pages.get('manage_locations', False) %}
+            <option value="Orte verwalten"></option>
+            {% endif %}
+
+            {% if current_permissions.pages.get('admin_school_settings', False) %}
+            <option value="Schulstammdaten"></option>
+            {% endif %}
+
+            {% if current_permissions.actions.get('can_view_logs', False) and current_permissions.pages.get('admin_audit_dashboard', False) %}
+            <option value="Audit Dashboard"></option>
+            {% endif %}
+
+            {% if current_permissions.actions.get('can_view_logs', False) and current_permissions.pages.get('logs', False) %}
+            <option value="Logs"></option>
+            {% endif %}
+
+            {% if current_permissions.actions.get('can_manage_users', False) %}
+                {% if current_permissions.pages.get('user_del', False) %}
+                <option value="Benutzer verwalten"></option>
+                {% endif %}
+                {% if current_permissions.pages.get('register', False) %}
+                <option value="Neuer Benutzer"></option>
+                {% endif %}
+            {% endif %}
+
+            {% if student_cards_module_enabled and current_permissions.pages.get('student_cards_admin', False) %}
+            <option value="Bibliotheksausweis"></option>
+            {% endif %}
         {% endif %}
     </datalist>
 
@@ -1626,31 +1729,39 @@
         (function(){
             function getCookie(name){
                 const v = document.cookie.split(';').map(s=>s.trim());
-                for(const c of v){ if(c.startsWith(name+'=')) return decodeURIComponent(c.split('=')[1]); }
+                for(const c of v){ 
+                    if(c.startsWith(name+'=')) return decodeURIComponent(c.split('=')[1]); 
+                }
                 return null;
             }
+
             function setCookie(name, value, days){
-                const d = new Date(); d.setTime(d.getTime() + (days*24*60*60*1000));
+                const d = new Date(); 
+                d.setTime(d.getTime() + (days*24*60*60*1000));
                 document.cookie = name + '=' + encodeURIComponent(value) + ';expires=' + d.toUTCString() + ';path=/;SameSite=Lax';
             }
-            function showBanner(){ var el = document.getElementById('cookie-banner'); if(el) el.style.display = 'block'; }
-            function hideBanner(){ var el = document.getElementById('cookie-banner'); if(el) el.style.display = 'none'; }
 
-            // If not decided yet, show banner and block app until decision
+            function showBanner(){ 
+                var el = document.getElementById('cookie-banner'); 
+                if(el) el.style.display = 'block'; 
+            }
+
+            function hideBanner(){ 
+                var el = document.getElementById('cookie-banner'); 
+                if(el) el.style.display = 'none'; 
+            }
+
+            // Prüfen, ob der Nutzer bereits zugestimmt hat
             const consent = getCookie('cookie_consent');
             if(!consent){
                 showBanner();
-                // Optionally blur content until consent
-                document.body.style.filter = 'none';
             }
+
+            // Nur noch der Akzeptieren-Button für vitale Cookies ist vorhanden
             document.getElementById('cookie-accept')?.addEventListener('click', function(){
-                setCookie('cookie_consent','accepted',365);
+                setCookie('cookie_consent', 'vital_accepted', 365);
                 hideBanner();
             });
-            document.getElementById('cookie-decline')?.addEventListener('click', function(){
-                setCookie('cookie_consent','declined',365);
-                window.location.href = 'https://www.ecosia.org/';
-            });
 
             const username = {{ (session['username'] if 'username' in session else '')|tojson }};
             const isTutorialPage = window.location.pathname === {{ url_for('tutorial_page')|tojson }};
@@ -1666,32 +1777,80 @@
             const loginHintKey = username ? ('inventarsystem_notification_login_hint_v1_' + username) : null;
 
             const functionSearchEntries = [
+                {% if current_permissions.pages.get('home', False) %}
                 { label: 'Artikel', keywords: ['artikel', 'inventar', 'home'], url: {{ url_for('home')|tojson }} },
-                { label: 'Meine Ausleihen', keywords: ['meine ausleihen', 'ausleihen', 'borrowed'], url: {{ url_for('my_borrowed_items')|tojson }} },
-                { label: 'Benachrichtigungen', keywords: ['benachrichtigungen', 'nachrichten', 'notifications'], url: {{ url_for('notifications_view')|tojson }} },
-                { label: 'Tutorial', keywords: ['tutorial', 'hilfe', 'anleitung'], url: {{ url_for('tutorial_page')|tojson }} },
+                {% endif %}
+                    
+                {% if 'username' in session %}
+                    {% if current_permissions.pages.get('my_borrowed_items', False) %}
+                    { label: 'Meine Ausleihen', keywords: ['meine ausleihen', 'ausleihen', 'borrowed'], url: {{ url_for('my_borrowed_items')|tojson }} },
+                    {% endif %}
+                    {% if current_permissions.pages.get('notifications_view', False) %}
+                    { label: 'Benachrichtigungen', keywords: ['benachrichtigungen', 'nachrichten', 'notifications'], url: {{ url_for('notifications_view')|tojson }} },
+                    {% endif %}
+                    {% if current_permissions.pages.get('tutorial_page', False) %}
+                    { label: 'Tutorial', keywords: ['tutorial', 'hilfe', 'anleitung'], url: {{ url_for('tutorial_page')|tojson }} },
+                    {% endif %}
+                {% endif %}
+                    
                 { label: 'Impressum', keywords: ['impressum'], url: {{ url_for('impressum')|tojson }} },
                 { label: 'Lizenz', keywords: ['lizenz', 'license'], url: {{ url_for('license')|tojson }} },
+                    
                 {% if library_module_enabled %}
-                { label: 'Bibliothek', keywords: ['bibliothek', 'medien'], url: {{ url_for('library_view')|tojson }} },
-                {% endif %}
-                {% if 'username' in session and (session.get('admin', False) or is_admin) %}
-                { label: 'Hochladen', keywords: ['hochladen', 'upload'], url: {{ url_for('upload_admin')|tojson }} },
-                { label: 'Ausleihen Verwaltung', keywords: ['ausleihen verwaltung', 'admin borrowings'], url: {{ url_for('admin_borrowings')|tojson }} },
-                { label: 'Defekte Items', keywords: ['defekte items', 'defekt', 'schaden'], url: {{ url_for('admin_damaged_items')|tojson }} },
-                { label: 'Filter verwalten', keywords: ['filter verwalten', 'filter'], url: {{ url_for('manage_filters')|tojson }} },
-                { label: 'Orte verwalten', keywords: ['orte verwalten', 'orte', 'location'], url: {{ url_for('manage_locations')|tojson }} },
-                { label: 'Schulstammdaten', keywords: ['schule', 'settings', 'stammdaten', 'school settings'], url: {{ url_for('admin_school_settings')|tojson }} },
-                { label: 'Audit Dashboard', keywords: ['audit', 'audit dashboard'], url: {{ url_for('admin_audit_dashboard')|tojson }} },
-                { label: 'Logs', keywords: ['logs', 'protokoll'], url: {{ url_for('logs')|tojson }} },
-                { label: 'Benutzer verwalten', keywords: ['benutzer verwalten', 'user'], url: {{ url_for('user_del')|tojson }} },
-                { label: 'Neuer Benutzer', keywords: ['neuer benutzer', 'register'], url: {{ url_for('register')|tojson }} },
-                {% if library_module_enabled %}
-                { label: 'Bibliotheks-Ausleihen', keywords: ['bibliotheks ausleihen', 'library loans'], url: {{ url_for('library_loans_admin')|tojson }} },
-                {% endif %}
-                {% if student_cards_module_enabled %}
-                { label: 'Bibliotheksausweis', keywords: ['bibliotheksausweis', 'student card'], url: {{ url_for('student_cards_admin')|tojson }} },
+                    {% if current_permissions.pages.get('library_view', False) %}
+                    { label: 'Bibliothek', keywords: ['bibliothek', 'medien'], url: {{ url_for('library_view')|tojson }} },
+                    {% endif %}
                 {% endif %}
+                    
+                {% if 'username' in session %}
+                    {% if current_permissions.pages.get('upload_admin', False) and current_permissions.actions.get('can_insert', False) %}
+                    { label: 'Hochladen', keywords: ['hochladen', 'upload'], url: {{ url_for('upload_admin')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.pages.get('admin_borrowings', False) %}
+                    { label: 'Ausleihen Verwaltung', keywords: ['ausleihen verwaltung', 'admin borrowings'], url: {{ url_for('admin_borrowings')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.pages.get('admin_damaged_items', False) %}
+                    { label: 'Defekte Items', keywords: ['defekte items', 'defekt', 'schaden'], url: {{ url_for('admin_damaged_items')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.pages.get('manage_filters', False) %}
+                    { label: 'Filter verwalten', keywords: ['filter verwalten', 'filter'], url: {{ url_for('manage_filters')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.pages.get('manage_locations', False) %}
+                    { label: 'Orte verwalten', keywords: ['orte verwalten', 'orte', 'location'], url: {{ url_for('manage_locations')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.pages.get('admin_school_settings', False) %}
+                    { label: 'Schulstammdaten', keywords: ['schule', 'settings', 'stammdaten', 'school settings'], url: {{ url_for('admin_school_settings')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.actions.get('can_view_logs', False) and current_permissions.pages.get('admin_audit_dashboard', False) %}
+                    { label: 'Audit Dashboard', keywords: ['audit', 'audit dashboard'], url: {{ url_for('admin_audit_dashboard')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.actions.get('can_view_logs', False) and current_permissions.pages.get('logs', False) %}
+                    { label: 'Logs', keywords: ['logs', 'protokoll'], url: {{ url_for('logs')|tojson }} },
+                    {% endif %}
+                    
+                    {% if current_permissions.actions.get('can_manage_users', False) %}
+                        {% if current_permissions.pages.get('user_del', False) %}
+                        { label: 'Benutzer verwalten', keywords: ['benutzer verwalten', 'user'], url: {{ url_for('user_del')|tojson }} },
+                        {% endif %}
+                        {% if current_permissions.pages.get('register', False) %}
+                        { label: 'Neuer Benutzer', keywords: ['neuer benutzer', 'register'], url: {{ url_for('register')|tojson }} },
+                        {% endif %}
+                    {% endif %}
+                    
+                    {% if library_module_enabled and current_permissions.pages.get('library_loans_admin', False) %}
+                    { label: 'Bibliotheks-Ausleihen', keywords: ['bibliotheks ausleihen', 'library loans'], url: {{ url_for('library_loans_admin')|tojson }} },
+                    {% endif %}
+                    
+                    {% if student_cards_module_enabled and current_permissions.pages.get('student_cards_admin', False) %}
+                    { label: 'Bibliotheksausweis', keywords: ['bibliotheksausweis', 'student card'], url: {{ url_for('student_cards_admin')|tojson }} },
+                    {% endif %}
                 {% endif %}
             ];
 

Web/templates/impressum.html

@@ -22,7 +22,7 @@
                 <p><strong>Name:</strong> Invario UG</p>
                 <p><strong>Adresse:</strong> Am Sportplatz 10<br>83052 Bruckmühl<br>Deutschland</p>
             </address>
-            <p><strong>E-Mail:</strong> <a href="mailto:info@invario.eu">info@invario.eu</a></p>
+            <p><strong>E-Mail:</strong> <a href="mailto:info@invario-software.de">info@invario-software.de</a></p>
         </div>
 
         <div class="impressum-section mb-4">

Web/templates/library_borrowings_admin.html

@@ -520,7 +520,16 @@
   window.openDamageReportPrompt = openDamageReportPrompt;
 
   function openDamageInvoiceModal(row, description) {
-    if (!damageInvoiceModal || !damageInvoiceForm) {
+    const modal = document.getElementById('damage-invoice-modal');
+    const form = document.getElementById('damage-invoice-form');
+    const inputItem = document.getElementById('damage-invoice-item');
+    const inputBorrower = document.getElementById('damage-invoice-borrower');
+    const inputCode = document.getElementById('damage-invoice-code');
+    const inputAmount = document.getElementById('damage-invoice-amount');
+    const inputReason = document.getElementById('damage-invoice-reason');
+
+    if (!modal || !form) {
+      console.error("Modal oder Formular nicht gefunden.");
       return;
     }
 
@@ -530,23 +539,29 @@
     const itemCode = row.dataset.itemCode || '';
     const itemCost = row.dataset.itemCost || '';
 
-    damageInvoiceForm.action = "{{ url_for('admin_create_invoice', borrow_id='__BORROW_ID__') }}".replace('__BORROW_ID__', borrowId);
-    damageInvoiceItem.value = itemName;
-    damageInvoiceBorrower.value = borrower;
-    damageInvoiceCode.value = itemCode;
-    damageInvoiceAmount.value = String(itemCost).replace(' EUR', '').trim();
-    damageInvoiceReason.value = description || `Schaden gemeldet für ${itemName}`;
-    damageInvoiceModal.style.display = 'block';
-    damageInvoiceAmount.focus();
+    form.action = "{{ url_for('admin_create_invoice', borrow_id='__BORROW_ID__') }}".replace('__BORROW_ID__', borrowId);
+
+    inputItem.value = itemName;
+    inputBorrower.value = borrower;
+    inputCode.value = itemCode;
+
+    inputAmount.value = String(itemCost).replace(' EUR', '').trim();
+
+    inputReason.value = description || `Schaden gemeldet für ${itemName}`;
+
+    modal.style.display = 'block';
+    inputAmount.focus();
+  }
+
+  function closeDamageInvoiceModal() {
+    const modal = document.getElementById('damage-invoice-modal');
+    if (modal) {
+      modal.style.display = 'none';
+    }
   }
 
   window.openDamageInvoiceModal = openDamageInvoiceModal;
-
-  function closeDamageInvoiceModal() {
-    if (damageInvoiceModal) {
-      damageInvoiceModal.style.display = 'none';
-    }
-  }
+  window.closeDamageInvoiceModal = closeDamageInvoiceModal;
 
   if (damageInvoiceModal) {
     damageInvoiceModal.addEventListener('click', function(event) {

Web/templates/library_table.html

@@ -4,6 +4,57 @@
 
 {% block content %}
 <style>
+    /* The Dark Background Overlay */
+    .modal {
+        position: fixed;
+        top: 0;
+        left: 0;
+        width: 100vw;
+        height: 100vh;
+        background-color: rgba(0, 0, 0, 0.6);
+        /* Display is managed by JS (none/flex) */
+        align-items: center; 
+        justify-content: center;
+        z-index: 1000;
+    }
+
+    /* The White Modal Box */
+    .modal-content {
+        background-color: #fff;
+        padding: 20px;
+        width: 80%;
+        max-width: 600px;
+        border-radius: 8px;
+        box-shadow: 0 4px 15px rgba(0, 0, 0, 0.2);
+
+        /* Flexbox allows the header to stay fixed while the body scrolls */
+        display: flex;
+        flex-direction: column;
+        max-height: 85vh;
+    }
+
+    /* The Close Button */
+    .close {
+        align-self: flex-end;
+        color: #aaa;
+        font-size: 28px;
+        font-weight: bold;
+        cursor: pointer;
+        line-height: 1;
+        margin-bottom: 10px;
+    }
+
+    .close:hover,
+    .close:focus {
+        color: #000;
+        text-decoration: none;
+    }
+
+    /* The Scrollable Content Area */
+    #detailContent {
+        overflow-y: auto; /* Adds scrollbar only if needed */
+        padding-right: 10px; /* Prevents text from rubbing against the scrollbar */
+    }
     /* Library table-only view styles */
     .library-table-container {
         max-width: 1400px;
@@ -418,7 +469,7 @@
     }
 </style>
 
-<div class="library-table-container" id="libraryTableContainer" data-can-edit="{{ 1 if is_admin else 0 }}">
+<div class="library-table-container" id="libraryTableContainer" data-can-edit="{{ 1 if current_permissions.actions.get('can_edit', False) else 0 }}">
     <!-- Header -->
     <div class="library-header">
         <h1>📚 Bibliothek</h1>
@@ -475,7 +526,7 @@
                 <select id="filterType">
                     <option value="">-- Alle Typen --</option>
                     <option value="book">Buch</option>
-                    <option value="schulbuch">Schulbuch</option>
+                    <option value="schoolbook">Schulbuch</option>
                     <option value="cd">CD</option>
                     <option value="dvd">DVD</option>
                     <option value="other">Sonstige</option>
@@ -503,6 +554,10 @@
                 <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"></path><polyline points="14 2 14 8 20 8"></polyline><line x1="8" y1="13" x2="16" y2="13"></line><line x1="8" y1="17" x2="16" y2="17"></line><polyline points="10 9 9 9 8 9"></polyline></svg>
                 Alle ausgeliehen Excel
             </button>
+            <button class="button" style="background: #10b981; color: white; display: flex; align-items: center; gap: 0.5rem;" onclick="window.location.href='/library/export/all_books'">
+                <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"></path><polyline points="14 2 14 8 20 8"></polyline><line x1="8" y1="13" x2="16" y2="13"></line><line x1="8" y1="17" x2="16" y2="17"></line><polyline points="10 9 9 9 8 9"></polyline></svg>
+                Alle Bücher Excel
+            </button>
         </div>
     </div>
 
@@ -536,15 +591,14 @@
     </div>
 </div>
 
-<!-- Detail Modal -->
+<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.0.6/purify.min.js"></script>
+
 <div id="detailModal" class="modal" style="display: none;">
     <div class="modal-content">
         <span class="close" onclick="closeDetailModal()">&times;</span>
         <div id="detailContent"></div>
     </div>
 </div>
-
-<script src="https://cdn.jsdelivr.net/npm/@ericblade/quagga2/dist/quagga.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@ericblade/quagga2/dist/quagga.js"></script>
 <script>
     // =========================================================================
@@ -1033,7 +1087,7 @@
     }
 
     function getItemTypeLabel(type) {
-        const labels = { 'book': 'Buch', 'cd': 'CD', 'dvd': 'DVD', 'other': 'Sonstige' };
+        const labels = { 'book': 'Buch', 'cd': 'CD', 'dvd': 'DVD', 'other': 'Sonstige', 'schoolbook': 'Schulbuch' };
         return labels[type] || type;
     }
 
@@ -1043,21 +1097,48 @@
         return div.innerHTML;
     }
 
+    // Opens the modal and fetches the data
     function showItemDetail(itemId) {
+        const detailContent = document.getElementById('detailContent');
+        const detailModal = document.getElementById('detailModal');
+
+        // 1. Show the loading state immediately
+        detailContent.innerHTML = '<p>Loading details...</p>';
+        detailModal.style.display = 'flex';
+
+        // 2. Fetch the data
         fetch(`/api/item_detail/${itemId}`)
-            .then(r => r.text())
-            .then(html => {
-                document.getElementById('detailContent').innerHTML = html;
-                document.getElementById('detailModal').style.display = 'flex';
+            .then(response => {
+                if (!response.ok) {
+                    throw new Error(`HTTP error! status: ${response.status}`);
+                }
+                return response.text();
             })
-            .catch(err => console.error('Error loading detail:', err));
+            .then(html => {
+                // 3. Clean the HTML and display it
+                detailContent.innerHTML = DOMPurify.sanitize(html);
+            })
+            .catch(err => {
+                console.error('Error loading detail:', err);
+                detailContent.innerHTML = '<p>Sorry, we could not load the item details. Please try again later.</p>';
+            });
     }
 
+    // Closes the modal via the 'x' button
     function closeDetailModal() {
         document.getElementById('detailModal').style.display = 'none';
     }
 
-// =========================================================================
+    // Closes the modal if the user clicks the dark background overlay
+    window.onclick = function(event) {
+        const modal = document.getElementById('detailModal');
+        // If the click happened directly on the dark overlay (not the white box)
+        if (event.target === modal) {
+            closeDetailModal();
+        }
+    };
+
+    // =========================================================================
     // 5. EVENT LISTENERS INITIALIZATION & ON-LOAD INITIALIZER
     // =========================================================================
     function wireScannerUi() {
@@ -1192,75 +1273,195 @@
         }
     });
 
-    // Modal Control Functions (accessible globally from table buttons)
-    function openEditLibraryItem(itemId) {
+    window.openEditLibraryItem = function(itemId) {
         const item = libraryItems.find(i => i._id === itemId);
-        
-        if (!item) {
-            alert('Fehler: Das Medium konnte nicht gefunden werden.');
-            return;
+        if (!item) return;
+
+        // 1. Felder befüllen
+        document.getElementById('editLibraryItemId').value = item._id;
+        document.getElementById('editLibraryName').value = item.Name;
+        document.getElementById('editLibraryType').value = item.ItemType;
+        document.getElementById('editLibraryIsbn').value = item.ISBN || '';
+        document.getElementById('editLibraryCode4').value = item.Code_4 || '';
+        document.getElementById('editLibraryLocation').value = item.Ort;
+        document.getElementById('editLibraryDescription').value = item.Beschreibung;
+
+        // 2. Gruppen-Logik
+        const warningDiv = document.getElementById('editLibraryGroupWarning');
+        const codesContainer = document.getElementById('editLibraryAllCodes');
+
+        if (item.SeriesGroupId) {
+            // Filtern aus dem aktuell geladenen Array
+            let groupMembers = libraryItems.filter(i => i.SeriesGroupId === item.SeriesGroupId);
+
+            // SCHLÜSSEL: Wenn die Anzahl der gefundenen Elemente nicht mit SeriesCount übereinstimmt,
+            // haben wir die Gruppe noch nicht vollständig geladen.
+            if (groupMembers.length < (item.SeriesCount || 0)) {
+                console.warn("Gruppe noch nicht vollständig geladen. Anzeige ggf. unvollständig.");
+                // Optional: Zeige einen Ladehinweis im Modal
+                codesContainer.textContent = "Lade restliche Gruppenmitglieder...";
+            } else {
+                // Daten sind vollständig -> Anzeigen
+                const codeList = groupMembers
+                    .sort((a, b) => (a.SeriesPosition || 0) - (b.SeriesPosition || 0))
+                    .map(m => m.Code_4 || "---")
+                    .join(', ');
+
+                codesContainer.textContent = codeList;
+            }
+
+            document.getElementById('editLibraryGroupCount').textContent = groupMembers.length + " / " + (item.SeriesCount || "?");
+            warningDiv.style.display = 'block';
+        } else {
+            warningDiv.style.display = 'none';
         }
 
-        // Populate the form fields - Using correct German properties from MongoDB fields
-        document.getElementById('editLibraryItemId').value = item._id || '';
-        document.getElementById('editLibraryName').value = item.Name || '';
-        document.getElementById('editLibraryType').value = item.ItemType || 'book';
-        document.getElementById('editLibraryIsbn').value = item.ISBN || '';
-        document.getElementById('editLibraryCode4').value = item.Code_4 || item.Code4 || '';
-        document.getElementById('editLibraryLocation').value = item.Ort || ''; 
-        document.getElementById('editLibraryDescription').value = item.Beschreibung || '';
-
-        document.getElementById('editLibraryModal').style.display = 'flex'; 
-    }
+        document.getElementById('editLibraryModal').style.display = 'flex';
+    };
 
     function closeEditLibraryModal() {
         document.getElementById('editLibraryModal').style.display = 'none';
     }
+
+    /**
+     * Event-Listener für das Formular (Initialisierung)
+     */
+    document.addEventListener('DOMContentLoaded', function() {
+        const editForm = document.getElementById('editLibraryForm');
+        if (editForm) {
+            editForm.addEventListener('submit', async function(e) {
+                e.preventDefault();
+
+                const itemId = document.getElementById('editLibraryItemId').value;
+                const currentItem = libraryItems.find(i => i._id === itemId);
+
+                if (!currentItem) return;
+
+                // 1. Alle Mitglieder der Gruppe finden, um die Code-Liste aufzubauen
+                const groupMembers = libraryItems.filter(i => i.SeriesGroupId === currentItem.SeriesGroupId);
+                const individualUpdates = groupMembers.map(member => ({
+                    id: member._id,
+                    // Wenn dies das bearbeitete Item ist, nimm den neuen Code, sonst den alten
+                    code_4: (member._id === itemId) ? document.getElementById('editLibraryCode4').value : member.Code_4
+                }));
+
+                // 2. Payload für das Backend bauen
+                const payload = {
+                    series_group_id: currentItem.SeriesGroupId,
+                    name: document.getElementById('editLibraryName').value,
+                    ort: document.getElementById('editLibraryLocation').value,
+                    beschreibung: document.getElementById('editLibraryDescription').value,
+                    isbn: document.getElementById('editLibraryIsbn').value,
+                    item_type: document.getElementById('editLibraryType').value,
+                    items: individualUpdates
+                };
+
+                // 3. Request an die Gruppen-Update Route
+                try {
+                    const response = await fetch('/update_group', {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify(payload)
+                    });
+
+                    const result = await response.json();
+                    if (result.success) {
+                        alert('Gruppe erfolgreich synchronisiert!');
+                        closeEditLibraryModal();
+                        await loadLibraryItems(); // Daten neu laden
+                        // renderTable(); // Ggf. Tabelle neu rendern
+                    } else {
+                        closeEditLibraryModal();
+                        await loadLibraryItems();
+                    }
+                } catch (error) {
+                    console.error('Update failed:', error);
+                    alert('Netzwerkfehler.');
+                }
+            });
+
+        }
+    });
 </script>
 
 <div id="editLibraryModal" class="modal" style="display:none;">
-    <div class="modal-content" style="max-width: 760px;">
-        <span class="close" onclick="closeEditLibraryModal()">&times;</span>
+    <div class="modal-content" style="max-width: 760px; padding: 25px; border-radius: 8px;">
+        <span class="close" onclick="closeEditLibraryModal()" style="cursor: pointer; float: right; font-size: 24px;">&times;</span>
         <h3 style="margin-top:0;">Bibliotheksmedium bearbeiten</h3>
+        
+        <!-- Bereich für Gruppen-Informationen (Hier konsolidiert!) -->
+        <div id="editLibraryGroupWarning" style="display:none; background-color: #fff; padding: 15px; border-radius: 6px; margin-bottom: 20px; border: 1px solid #0ea5e9;">
+            <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 10px; border-bottom: 1px solid #eee; padding-bottom: 10px;">
+                <strong style="color: #0ea5e9;">Gruppen-Range (Total: <span id="editLibraryGroupCount"></span>)</strong>
+            </div>
+            
+            <p style="margin: 5px 0; font-size: 12px; color: #555;">
+                Alle aufgeführten Codes gehören zu diesem Datensatz:
+            </p>
+            
+            <!-- Hier werden die Codes per JS eingefügt -->
+            <div id="editLibraryAllCodes" style="display: flex; flex-wrap: wrap; gap: 5px; margin-top: 10px;"></div>
+            
+            <div style="margin-top: 15px; font-size: 11px; background: #e0f2fe; padding: 8px; border-radius: 4px;">
+                <strong>Hinweis:</strong> Änderungen an Titel/Ort/Beschreibung werden auf <strong>alle</strong> Exemplare der Range übertragen.
+            </div>
+        </div>
+
         <form id="editLibraryForm">
             <input type="hidden" id="editLibraryItemId">
             <div class="edit-grid">
                 <div class="full">
                     <label for="editLibraryName">Titel</label>
-                    <input id="editLibraryName" required>
+                    <input id="editLibraryName" required style="width: 100%;">
                 </div>
                 <div>
                     <label for="editLibraryType">Medientyp</label>
-                    <select id="editLibraryType">
-                        <option value="book">Buch</option>
-                        <option value="schulbuch">Schulbuch</option>
+                    <select id="editLibraryType" style="width: 100%;">
+                        <option value="Buch">Buch</option>
+                        <option value="Schulbuch">Schulbuch</option>
                         <option value="cd">CD</option>
                         <option value="dvd">DVD</option>
-                        <option value="media">Sonstige Medien</option>
+                        <option value="other">Sonstige Medien</option>
                     </select>
                 </div>
                 <div>
                     <label for="editLibraryIsbn">ISBN</label>
-                    <input id="editLibraryIsbn" placeholder="optional ISBN-10/13">
+                    <input id="editLibraryIsbn" placeholder="optional ISBN-10/13" style="width: 100%;">
                 </div>
                 <div>
                     <label for="editLibraryCode4">Code</label>
-                    <input id="editLibraryCode4" placeholder="optional Mediencode">
+                    <input id="editLibraryCode4" placeholder="optional Mediencode" style="width: 100%;">
                 </div>
                 <div class="full">
                     <label for="editLibraryLocation">Ort</label>
-                    <input id="editLibraryLocation" required>
+                    <input id="editLibraryLocation" required style="width: 100%;">
                 </div>
                 <div class="full">
                     <label for="editLibraryDescription">Beschreibung</label>
-                    <textarea id="editLibraryDescription" rows="4" required></textarea>
+                    <textarea id="editLibraryDescription" rows="4" required style="width: 100%;"></textarea>
                 </div>
             </div>
-            <div class="edit-actions">
-                <button type="submit" class="button" style="background:#0ea5e9;color:#fff;">Speichern</button>
+            <div class="edit-actions" style="margin-top:20px;">
+                <button type="submit" class="button" style="background:#0ea5e9;color:#fff;">Speichern & Synchronisieren</button>
                 <button type="button" class="button" onclick="closeEditLibraryModal()">Abbrechen</button>
             </div>
         </form>
     </div>
 </div>
+<div id="editLibraryGroupWarning" style="display:none; background-color: #fff; padding: 15px; border-radius: 6px; margin-bottom: 20px; border: 1px solid #0ea5e9;">
+    <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 10px; border-bottom: 1px solid #eee; padding-bottom: 10px;">
+        <strong style="color: #0ea5e9;">Gruppen-Range (Total: <span id="editLibraryGroupCount"></span>)</strong>
+    </div>
+
+    <p style="margin: 5px 0; font-size: 12px; color: #555;">
+        Alle Codes in dieser Gruppe:
+    </p>
+
+    <!-- Hier wird die Liste als Komma-Text eingefügt -->
+    <div id="editLibraryAllCodes" style="font-family: monospace; font-size: 14px; font-weight: bold; color: #333; margin-top: 5px;"></div>
+
+    <div style="margin-top: 15px; font-size: 11px; background: #e0f2fe; padding: 8px; border-radius: 4px;">
+        <strong>Hinweis:</strong> Änderungen an Titel/Ort/Beschreibung werden auf <strong>alle</strong> Exemplare der Range übertragen.
+    </div>
+</div>
 {% endblock %}

Web/templates/license.html

@@ -122,7 +122,7 @@
             <h3>Meldung von Sicherheitslücken</h3>
             <div class="license-exception-notice">
                 <h3>⚠️ Responsible Disclosure</h3>
-                <p>Falls Sie eine Sicherheitslücke entdecken, wenden sie sich umgehend an die Email: info@invario.eu .
+                <p>Falls Sie eine Sicherheitslücke entdecken, wenden sie sich umgehend an die Email: info@invario-software.de .
             </div>
         </div>
         </div><!-- /#pane-security -->

Web/templates/main_admin.html

@@ -2309,6 +2309,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
 </script>
 
 <div class="admin-content-container">
+    {% if current_permissions.actions.get('can_edit', False) %}
     <!-- Admin conflict warning banner (populated by JS) -->
     <div id="conflict-banner" style="display:none; background:#fff3cd; border:1px solid #ffc107; border-left:4px solid #fd7e14; color:#856404; padding:12px 16px; border-radius:4px; margin-bottom:16px; position:relative;">
         <strong>⚠ Buchungskonflikte erkannt:</strong>
@@ -2335,6 +2336,8 @@ document.addEventListener('DOMContentLoaded', ()=>{
             .catch(() => {});
     });
     </script>
+    {% endif %}
+
     <div class="content">
         <h1 style="position:relative;">Inventar Objekte
             <div class="view-switch-group">
@@ -2344,14 +2347,17 @@ document.addEventListener('DOMContentLoaded', ()=>{
                 <button id="toggle-favorites-view" class="view-toggle-btn" title="Nur Merkliste anzeigen">
                     <span id="favorites-view-icon">🔖</span>
                 </button>
+                {% if current_permissions.actions.get('can_delete', False) %}
                 <div class="bulk-delete-inline-wrap">
                     <button type="button" id="bulk-delete-drawer-toggle" class="view-toggle-btn bulk-delete-drawer-toggle" aria-expanded="false" title="Massenlöschung" onclick="toggleBulkDeleteDrawer()">
                         <span class="drawer-icon">⚙</span>
                     </button>
                 </div>
+                {% endif %}
             </div>
         </h1>
         <div id="items-indicator" class="items-indicator">Objekte im System: 0</div>
+        {% if current_permissions.actions.get('can_delete', False) %}
         <div id="bulk-delete-drawer" class="bulk-delete-drawer" aria-hidden="true">
             <div class="bulk-delete-content">
                 <strong>Massenlöschung nach Kriterien</strong>
@@ -2364,6 +2370,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                 <button type="button" id="bulk-delete-button" class="danger" onclick="deleteSelectedItems()" disabled>Auswahl löschen</button>
             </div>
         </div>
+        {% endif %}
         <div class="filter-container">
             <div class="filter-group">
                 <div class="filter-header">
@@ -2469,6 +2476,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
     </div>
 
     <!-- Add the edit modal form -->
+    {% if current_permissions.actions.get('can_edit', False) %}
     <div id="edit-modal" class="item-modal">
         <div class="modal-content">
             <span class="close-modal" onclick="closeEditModal()">&times;</span>
@@ -2646,6 +2654,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
             </form>
         </div>
     </div>
+    {% endif %}
 </div>
 
 <!-- Schedule Appointment Modal -->
@@ -2724,7 +2733,6 @@ document.addEventListener('DOMContentLoaded', ()=>{
     </div>
 </div>
 
-<!-- Initialize template variables before any JavaScript code -->
 <script>
     // Create a global object to hold server-side template values
     window.serverVars = {};
@@ -3239,7 +3247,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
             return;
         }
 
-        fetch('{{ url_for('bulk_delete_items') }}', {
+        fetch("{{ url_for('bulk_delete_items') }}", {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
@@ -3703,6 +3711,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                                         Für Löschung markieren
                                     </label>
                                 </div>
+                                {% if current_permissions.actions.get('can_borrow', False) %}
                                 ${isAvailableForBorrow && !item.BlockedNow ? 
                                     `<form method="POST" action="{{ url_for('ausleihen', id='') }}${item._id}">
                                         ${isGroupedItem ? `
@@ -3724,12 +3733,21 @@ document.addEventListener('DOMContentLoaded', ()=>{
                                 :
                                     `<button class="ausleihen disabled-button" disabled>${item.BlockedNow ? 'Reserviert' : 'Ausgeliehen'}</button>`
                                 }
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_delete', False) %}
                                 <form method="POST" action="{{ url_for('delete_item', id='') }}${item._id}" style="display:inline;" onsubmit="return confirm('Sind Sie sicher, dass Sie dieses Objekt löschen möchten?')">
                                     <button class="delete-button" type="submit">Löschen</button>
                                 </form>
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_edit', False) %}
                                 <button class="edit-button" onclick="openEditModalForSelectedUnit('${item._id}', 'specific-item-card-${item._id}')">Bearbeiten</button>
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_insert', False) %}
                                 <button class="duplicate-button" onclick="duplicateItem('${item._id}')">Duplizieren</button>
+                                {% endif %}
+                                {% if current_permissions.pages.get('admin_school_settings', False) %}
                                 ${canScheduleItem ? `<button class="schedule-button" onclick="openScheduleModal('${item._id}')">Reservieren</button>` : ''}
+                                {% endif %}
                             </div>
                         `;
                         itemsContainer.appendChild(card);
@@ -4506,10 +4524,10 @@ document.addEventListener('DOMContentLoaded', ()=>{
             : '<div style="font-size:0.92rem;color:#64748b;">Keine Beschädigungs-Historie vorhanden.</div>';
         
         modalContent.innerHTML = `
-            <h2>${item.Name}</h2>
+            <h2>${escapeHtml(item.Name || '')}</h2>
             ${borrowerInfoHtml}
             ${appointmentInfoHtml}
-            
+                
             <div class="modal-image-container">
                 ${imagesHtml}
                 ${item.Images && item.Images.length > 1 ? `
@@ -4518,66 +4536,67 @@ document.addEventListener('DOMContentLoaded', ()=>{
                     <div class="image-counter">1/${item.Images.length}</div>
                 ` : ''}
             </div>
-            
+
             <div class="modal-details">
                 <div class="detail-group">
                     <div class="detail-label">Ort:</div>
-                    <div class="detail-value">${item.Ort || '-'}</div>
+                    <div class="detail-value">${escapeHtml(item.Ort || '-')}</div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Status:</div>
                     <div class="detail-value ${isBorrowed ? 'status-borrowed' : ''}">
                         ${isBorrowed ? 'Ausgeliehen' : 'Verfügbar'}
                     </div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Unterrichtsfach:</div>
-                    <div class="detail-value">${filter1Array.join(', ') || '-'}</div>
+                    <div class="detail-value">${escapeHtml(filter1Array.join(', ') || '-')}</div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Jahrgangsstufe:</div>
-                    <div class="detail-value">${filter2Array.join(', ') || '-'}</div>
+                    <div class="detail-value">${escapeHtml(filter2Array.join(', ') || '-')}</div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Schlagwort:</div>
-                    <div class="detail-value">${filter3Array.join(', ') || '-'}</div>
+                    <div class="detail-value">${escapeHtml(filter3Array.join(', ') || '-')}</div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Code:</div>
-                    <div class="detail-value">${item.Code_4 || '-'}</div>
+                    <div class="detail-value">${escapeHtml(item.Code_4 || '-')}</div>
                 </div>
-
+            
                 <div class="detail-group">
                     <div class="detail-label">Anzahl:</div>
-                    <div class="detail-value">${item.GroupedDisplayCount || 1}</div>
+                    <div class="detail-value">${escapeHtml(String(item.GroupedDisplayCount || 1))}</div>
                 </div>
-
+            
                 ${isGroupedItem ? `
                 <div class="detail-group">
                     <div class="detail-label">Verfügbar:</div>
-                    <div class="detail-value">${availableGroupedCount}</div>
+                    <div class="detail-value">${escapeHtml(String(availableGroupedCount))}</div>
                 </div>` : ''}
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Anschaffungsjahr:</div>
-                    <div class="detail-value">${item.Anschaffungsjahr || '-'}</div>
-                </div>
-                
-                <div class="detail-group">
-                    <div class="detail-label">Anschaffungskosten:</div>
-                    <div class="detail-value">${item.Anschaffungskosten ? item.Anschaffungskosten + ' €' : '-'}</div>
-                </div>
-                
-                <div class="detail-group full-width">
-                    <div class="detail-label">Beschreibung:</div>
-                    <div class="detail-value">${item.Beschreibung || '-'}</div>
+                    <div class="detail-value">${escapeHtml(String(item.Anschaffungsjahr || '-'))}</div>
                 </div>
 
+                <div class="detail-group">
+                    <div class="detail-label">Anschaffungskosten:</div>
+                    <div class="detail-value">${item.Anschaffungskosten ? escapeHtml(String(item.Anschaffungskosten)) + ' €' : '-'}</div>
+                </div>
+
+                <div class="detail-group full-width">
+                    <div class="detail-label">Beschreibung:</div>
+                    <div class="detail-value">${escapeHtml(item.Beschreibung || '-')}</div>
+                </div>
+            
+                {% if current_permissions.actions.get('can_view_logs', False) %}
                 <div class="detail-group full-width" style="margin-top:12px;">
                     <div class="detail-label" style="font-weight:600; color:#374151;">Beschädigungs-Historie</div>
                     <div class="detail-value">
@@ -4590,7 +4609,8 @@ document.addEventListener('DOMContentLoaded', ()=>{
                         </div>
                     </div>
                 </div>
-
+                {% endif %}
+            
                 <div class="detail-group full-width" style="margin-top:12px; padding:10px; border:1px solid #e3e3e3; border-radius:8px;">
                     <div class="detail-label">Verfügbarkeit prüfen:</div>
                     <div class="detail-value">
@@ -4611,7 +4631,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                     </div>
                 </div>
             </div>
-
+        
             <div class="detail-group full-width" style="margin-top:15px;">
                 <div class="detail-label">Geplante Ausleihen:</div>
                 <div class="detail-value">
@@ -4635,9 +4655,10 @@ document.addEventListener('DOMContentLoaded', ()=>{
                     </div>
                 </div>
             </div>
-            
+
             <div class="modal-actions">
                 ${!isBorrowed ? 
+                    {% if current_permissions.actions.get('can_borrow', False) %}
                     `<form method="POST" action="/ausleihen/${item._id}">
                         ${isGroupedItem ? `
                         <div style="display:flex; gap:8px; flex-wrap:wrap; margin-bottom:8px; align-items:center;">
@@ -4651,6 +4672,9 @@ document.addEventListener('DOMContentLoaded', ()=>{
                         </div>` : ''}
                         <button class="ausleihen" type="submit">Ausleihen</button>
                     </form>` 
+                    {% else %}
+                    `<button class="ausleihen disabled-button" disabled title="Keine Berechtigung">Ausleihen nicht möglich</button>`
+                    {% endif %}
                     : (!isGroupedItem && item.User === currentUsername) ?
                     `<form method="POST" action="/zurueckgeben/${item._id}">
                         <button class="ausleihen" type="submit">Zurückgeben</button>
@@ -4659,7 +4683,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                 }
                 <button class="edit-button" onclick="openEditModalForSelectedUnit('${item._id}', 'specific-item-modal-${item._id}')">Bearbeiten</button>
                 <button class="duplicate-button" onclick="duplicateItem('${item._id}')">Duplizieren</button>
-                ${damageReports.length > 0 ? `<button class="damage-button" onclick="markDamageAsRepaired('${item._id}')">Repariert</button>` : `<button class="damage-button" onclick="registerDamage('${item._id}')">Schaden melden</button>`}
+                ${damageReports && damageReports.length > 0 ? `<button class="damage-button" onclick="markDamageAsRepaired('${item._id}')">Repariert</button>` : `<button class="damage-button" onclick="registerDamage('${item._id}')">Schaden melden</button>`}
                 ${canScheduleItem ? `<button class="schedule-button" onclick="openScheduleModal('${item._id}')">Reservieren</button>` : ''}
                 <form method="POST" action="/delete_item/${item._id}" style="display:inline;" onsubmit="return confirm('Sind Sie sicher?')">
                     <button class="delete-button" type="submit">Löschen</button>

Web/templates/register.html

@@ -1,11 +1,3 @@
-<!--
-   Copyright 2025-2026 AIIrondev
-
-   Licensed under the Inventarsystem EULA (Endbenutzer-Lizenzvertrag).
-   See Legal/LICENSE for the full license text.
-   Unauthorized commercial use, SaaS hosting, or removal of branding is prohibited.
-   For commercial licensing inquiries: https://github.com/AIIrondev
--->
 {% extends "base.html" %}
 
 {% block title %}Register{% endblock %}
@@ -33,6 +25,7 @@
     <div class="content">
         <div class="form-card">
             <form method="POST" action="{{ url_for('register') }}">
+
                 <div class="form-group">
                     <label for="name">Vorname</label>
                     <div class="input-container">
@@ -44,7 +37,7 @@
                         <span class="input-icon">👤</span>
                         <input type="text" id="last-name" name="last-name" placeholder="Geben Sie den Nachnamen ein" required onchange="generateUsername()" oninput="generateUsername()">
                     </div>
-                    <label for="username">Benutzername <span style="color: #9ca3af;">(wird automatisch generiert)</span></label>
+                    <label for="username">Benutzername <span style="color: #9ca3af;">(Vorschau - wird serverseitig finalisiert)</span></label>
                     <div class="input-container">
                         <span class="input-icon">👤</span>
                         <input type="text" id="username" name="username" placeholder="Automatisch aus Name und Nachname" readonly style="background-color: #f3f4f6; cursor: not-allowed;">
@@ -64,9 +57,21 @@
                             <li id="pw-rule-symbol" class="pw-rule">Mindestens ein Sonderzeichen</li>
                         </ul>
                     </div>
-                    <div class="input-container">
-                        <span class="input-icon">🔒</span>
-                        <input type="password" id="password" name="password" placeholder="Geben Sie ein sicheres Passwort ein" required>
+                    
+                    <div class="input-wrapper">
+                        <div class="input-container">
+                            <span class="input-icon">🔒</span>
+                            <!-- HTML5 Pattern blockiert unsichere Passwörter vor dem Absenden -->
+                            <input 
+                                   id="password" 
+                                   name="password" 
+                                   placeholder="Geben Sie ein sicheres Passwort ein" 
+                                   required
+                                   pattern="(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[^a-zA-Z0-9]).{12,}">
+                        </div>
+                    </div>
+                    <div class="pw-actions">
+                        <button type="button" class="btn-secondary" onclick="generateSecurePassword()">Passwort generieren</button>
                     </div>
                 </div>
 
@@ -258,31 +263,6 @@ input::placeholder {
     background-color: #27ae60;
 }
 
-.navigation-buttons {
-    text-align: center;
-    margin: 1.5rem 0;
-}
-
-.back-button {
-    display: inline-flex;
-    align-items: center;
-    color: var(--primary-color);
-    text-decoration: none;
-    font-weight: 500;
-    transition: var(--transition);
-    padding: 0.5rem 1rem;
-    border-radius: var(--border-radius);
-}
-
-.back-button:hover {
-    background-color: rgba(52, 152, 219, 0.1);
-}
-
-.back-icon {
-    margin-right: 0.5rem;
-    font-size: 1.2rem;
-}
-
 .flash-container {
     margin-bottom: 1.5rem;
 }
@@ -422,49 +402,147 @@ input::placeholder {
     margin: 4px 0;
     color: #1f2937;
 }
+
+/* Neue Styles für die Passwort-Erweiterungen */
+.pw-actions {
+    display: flex;
+    gap: 8px;
+    margin-top: 8px;
+}
+
+.btn-secondary {
+    padding: 8px 12px;
+    border: 1px solid #d1d5db;
+    background-color: #f3f4f6;
+    border-radius: 4px;
+    cursor: pointer;
+    font-size: 0.9em;
+    transition: background-color 0.2s;
+}
+
+.btn-secondary:hover {
+    background-color: #e5e7eb;
+}
+
+.input-wrapper {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    width: 100%;
+}
+
+.input-wrapper .input-container {
+    flex-grow: 1;
+    margin: 0;
+}
 </style>
 
 <script>
-// Function to generate username from first and last name (helper function)
+// Hilfsfunktion: Umlaute auflösen und Sonderzeichen entfernen
 function cleanNameForUsername(text) {
     if (!text) return '';
-    // Remove special characters, convert umlauts, lowercase
-    let cleaned = text
-        .replace(/[^a-zA-Zäöüß\s-]/g, '')
-        .trim()
-        .toLowerCase();
-    
-    // Convert German umlauts to ASCII
-    cleaned = cleaned
+    let cleaned = text.trim().toLowerCase()
         .replace(/ä/g, 'ae')
         .replace(/ö/g, 'oe')
         .replace(/ü/g, 'ue')
-        .replace(/ß/g, 'ss');
-    
+        .replace(/ß/g, 'ss')
+        .replace(/[^a-z]/g, '');
     return cleaned;
 }
 
-// Generate username from name and last_name fields
+// Hilfsfunktion: Erster Buchstabe groß
+function formatPart(str, len) {
+    if (!str) return '';
+    const part = str.slice(0, len);
+    return part.charAt(0).toUpperCase() + part.slice(1);
+}
+
+// Generiert die Vorschau des Benutzernamens (z.B. SimFri)
 function generateUsername() {
-    const firstName = cleanNameForUsername(document.getElementById('name').value || '');
-    const lastName = cleanNameForUsername(document.getElementById('last-name').value || '');
+    const firstName = cleanNameForUsername(document.getElementById('name').value);
+    const lastName = cleanNameForUsername(document.getElementById('last-name').value);
     let username = '';
     
     if (firstName && lastName) {
-        username = (firstName.slice(0, 3) + lastName.slice(0, 3));
+        username = formatPart(firstName, 3) + formatPart(lastName, 3);
     } else if (firstName) {
-        username = firstName.slice(0, 6);
+        username = formatPart(firstName, 6);
     } else if (lastName) {
-        username = lastName.slice(0, 6);
+        username = formatPart(lastName, 6);
     }
     
-    // Set the username field
     const usernameField = document.getElementById('username');
     if (usernameField) {
         usernameField.value = username || '';
     }
 }
 
+// PASSWORT GENERATOR
+function generateSecurePassword() {
+    const length = 16;
+    const charsetLower = "abcdefghijklmnopqrstuvwxyz";
+    const charsetUpper = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+    const charsetNum = "0123456789";
+    const charsetSym = "!@#$%^&*()_+~|}{[]:;?><,.-=";
+
+    let password = "";
+    // Garantiert mindestens 1 Zeichen aus jeder Kategorie
+    password += charsetLower[Math.floor(Math.random() * charsetLower.length)];
+    password += charsetUpper[Math.floor(Math.random() * charsetUpper.length)];
+    password += charsetNum[Math.floor(Math.random() * charsetNum.length)];
+    password += charsetSym[Math.floor(Math.random() * charsetSym.length)];
+
+    const allChars = charsetLower + charsetUpper + charsetNum + charsetSym;
+    // Restliche Zeichen auffüllen
+    for (let i = 4; i < length; i++) {
+        password += allChars[Math.floor(Math.random() * allChars.length)];
+    }
+
+    // Passwort durchmischen
+    password = password.split('').sort(() => 0.5 - Math.random()).join('');
+
+    const pwField = document.getElementById('password');
+    pwField.value = password;
+    
+    // Automatisch sichtbar machen, damit der User es kopieren kann
+    pwField.type = 'text';
+    document.getElementById('toggle-pw-btn').textContent = '🙈';
+    
+    updatePasswordRules();
+}
+
+// PASSWORT SICHTBARKEIT UMSCHALTEN
+function togglePasswordVisibility() {
+    const pwField = document.getElementById('password');
+    const toggleBtn = document.getElementById('toggle-pw-btn');
+    if (pwField.type === "password") {
+        pwField.type = "text";
+        toggleBtn.textContent = '🙈';
+    } else {
+        pwField.type = "password";
+        toggleBtn.textContent = '👁️';
+    }
+}
+
+// Globale Funktion für Passwort-Update
+function updatePasswordRules() {
+    const passwordInput = document.getElementById('password');
+    if (!passwordInput) return;
+
+    const value = String(passwordInput.value || '');
+    
+    const setRuleState = (id, ok) => {
+        const node = document.getElementById(id);
+        if (node) node.classList.toggle('ok', !!ok);
+    };
+
+    setRuleState('pw-rule-length', value.length >= 12);
+    setRuleState('pw-rule-lower', /[a-z]/.test(value));
+    setRuleState('pw-rule-upper', /[A-Z]/.test(value));
+    setRuleState('pw-rule-digit', /[0-9]/.test(value));
+    setRuleState('pw-rule-symbol', /[^A-Za-z0-9]/.test(value));
+}
+
 document.addEventListener('DOMContentLoaded', function () {
     const permissionPresets = {{ permission_presets | tojson }};
     const presetSelect = document.getElementById('permission-preset');
@@ -507,34 +585,6 @@ document.addEventListener('DOMContentLoaded', function () {
     }
 
     const passwordInput = document.getElementById('password');
-    const passwordRules = {
-        length: document.getElementById('pw-rule-length'),
-        lower: document.getElementById('pw-rule-lower'),
-        upper: document.getElementById('pw-rule-upper'),
-        digit: document.getElementById('pw-rule-digit'),
-        symbol: document.getElementById('pw-rule-symbol')
-    };
-
-    function setRuleState(node, ok) {
-        if (!node) {
-            return;
-        }
-        node.classList.toggle('ok', !!ok);
-    }
-
-    function updatePasswordRules() {
-        if (!passwordInput) {
-            return;
-        }
-
-        const value = String(passwordInput.value || '');
-        setRuleState(passwordRules.length, value.length >= 12);
-        setRuleState(passwordRules.lower, /[a-z]/.test(value));
-        setRuleState(passwordRules.upper, /[A-Z]/.test(value));
-        setRuleState(passwordRules.digit, /[0-9]/.test(value));
-        setRuleState(passwordRules.symbol, /[^A-Za-z0-9]/.test(value));
-    }
-
     if (passwordInput) {
         passwordInput.addEventListener('input', updatePasswordRules);
         passwordInput.addEventListener('blur', updatePasswordRules);

Web/templates/termin_client.html

@@ -39,13 +39,19 @@
     <div class="row justify-content-center">
         <div class="col-12 col-xxl-11">
             <div class="row g-4">
+                
                 <div class="col-12 col-lg-4">
                     <div class="card border-0 shadow-lg rounded-4 h-100">
                         <div class="card-body p-4 p-md-5">
                             <p class="text-uppercase text-muted fw-semibold mb-2">Terminplaner</p>
-                            <h1 class="h3 fw-bold mb-3">Termin buchen - {{ available.title }}</h1>
-                            <p class="text-muted mb-4">Wählen Sie im Kalender einen freien Slot aus. Den gewählten Termin können Sie danach direkt wie in einem Kalender-Block verschieben.</p>
-
+                            {% if can_view_booking_names %}
+                                <h1 class="h3 fw-bold mb-3">Termin Übersicht - {{ available.title }}</h1>
+                                <p class="text-muted mb-4">Hier können Sie alle Buchungen, die bereits eingegangen sind, einsehen und verwalten.</p>
+                            {% else %}
+                                <h1 class="h3 fw-bold mb-3">Termin buchen - {{ available.title }}</h1>
+                                <p class="text-muted mb-4">Wählen Sie im Kalender einen freien Slot aus. Den gewählten Termin können Sie danach direkt wie in einem Kalender-Block verschieben.</p>
+                            {% endif %}
+                            
                             <div class="p-3 rounded-3 bg-light mb-3">
                                 <div class="fw-semibold">Zeitraum</div>
                                 <div>{{ available.date_start }} bis {{ available.date_end }}</div>
@@ -58,23 +64,24 @@
                                 <div class="fw-semibold">Slot-Länge</div>
                                 <div>{{ available.slot_lenght }} Minuten</div>
                             </div>
-
+                            
+                            {% if not can_view_booking_names %}
                             <div class="p-3 rounded-3 bg-light mb-3">
                                 <div class="fw-semibold mb-2">Gewählter Termin</div>
                                 <div id="selected-slot-badge" class="text-muted small">Noch kein Slot ausgewählt.</div>
                             </div>
+                            {% endif %}
 
                             {% if available.slots_booked %}
                             <div class="p-3 rounded-3 bg-light">
                                 <div class="fw-semibold mb-2">Bereits gebucht</div>
-                                <ul class="mb-0 small">
+                                <ul class="mb-0 small text-muted">
                                     {% for booking in available.slots_booked %}
                                     <li>
-                                        {{ booking.start }}
-                                        {% if can_view_booking_names and booking.name %}
-                                        - {{ booking.name }}
+                                        {% if booking is mapping %}
+                                            {{ booking.get('start', '') }} - Belegt
                                         {% else %}
-                                        - Belegt
+                                            {{ booking[0] }} - {% if can_view_booking_names %}<span class="fw-semibold text-dark">{{ booking[1] }}</span>{% else %}Belegt{% endif %}
                                         {% endif %}
                                     </li>
                                     {% endfor %}
@@ -84,39 +91,161 @@
                         </div>
                     </div>
                 </div>
+
                 <div class="col-12 col-lg-8">
                     <div class="card border-0 shadow-lg rounded-4 h-100">
                         <div class="card-body p-4 p-md-5 bg-white">
-                            <h2 class="h4 fw-bold mb-3">Termin im Kalender auswählen</h2>
-
-                            <div class="day-slider-wrap mb-3">
-                                <div class="d-flex justify-content-between align-items-center gap-2 mb-2">
-                                    <span class="small text-muted">Tag wählen</span>
-                                    <strong id="day-slider-label" class="small"></strong>
+                            
+                            {% if can_view_booking_names %}
+                                <!-- ADMIN / AUTOREN ANSICHT -->
+                                <div class="d-flex flex-column flex-md-row justify-content-between align-items-md-center gap-3 mb-4">
+                                    <div>
+                                        <h2 class="h4 fw-bold mb-0">Eingegangene Buchungen</h2>
+                                        <div class="text-muted small">Verwalten Sie die Termine Ihrer Klienten</div>
+                                    </div>
+                                    <div class="d-flex gap-2 align-self-start align-self-md-center">
+                                        <!-- Neuer CSV Export Button -->
+                                        <a href="{{ url_for('terminplaner.export_csv', appointment_id=appointment_id) }}" class="btn btn-outline-success rounded-3 d-inline-flex align-items-center gap-2">
+                                            <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="bi bi-download" viewBox="0 0 16 16">
+                                                <path d="M.5 9.9a.5.5 0 0 1 .5.5v2.5a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1v2.5a.5.5 0 0 1 1 0v2.5a2 2 0 0 1-2 2H2a2 2 0 0 1-2-2v2.5a.5.5 0 0 1 .5-.5"/>
+                                                <path d="M7.646 11.854a.5.5 0 0 0 .708 0l3-3a.5.5 0 0 0-.708-.708L8.5 10.293V1.5a.5.5 0 0 0-1 0v8.793L5.354 8.146a.5.5 0 1 0-.708.708z"/>
+                                            </svg>
+                                            Excel / CSV Export
+                                        </a>
+                                        <span class="badge bg-primary rounded-pill fs-6 px-3 d-flex align-items-center">
+                                            {{ available.slots_total - available.slots_left }} von {{ available.slots_total }} belegt
+                                        </span>
+                                    </div>
                                 </div>
-                                <input id="day-slider" type="range" class="form-range m-0" min="0" max="0" value="0">
-                            </div>
-
-                            <div id="client-slot-calendar" class="mb-4"></div>
-
-                            <form id="client-booking-form" method="post" action="{{ url_for('terminplaner.client', appointment_id=appointment_id, tenant=tenant_id) }}" class="vstack gap-3">
-                                <div>
-                                    <label for="start_day_time" class="form-label fw-semibold">Gewünschter Zeitpunkt</label>
-                                    <input type="text" id="start_day_time" name="start_day_time" class="form-control form-control-lg" placeholder="Bitte im Kalender auswählen" readonly required>
-                                    <div class="form-text">Klicken Sie auf einen freien Slot oder verschieben Sie den gewählten Block.</div>
+                                <div class="bg-light p-3 rounded-3 mb-4">
+                                    <div class="row g-2 align-items-center">
+                                        <div class="col-12 col-md-8">
+                                            <label for="table-search" class="form-label small fw-semibold text-muted mb-1">Live-Filter (Name, Uhrzeit, Zusatzfelder...)</label>
+                                            <input type="text" id="table-search" class="form-control form-control-lg bg-white border" placeholder="Suchbegriff eingeben...">
+                                        </div>
+                                        <div class="col-12 col-md-4 d-flex align-items-end h-100 mt-md-4">
+                                            <button type="button" id="clear-filter-btn" class="btn btn-outline-secondary w-100 btn-lg">Filter zurücksetzen</button>
+                                        </div>
+                                    </div>
                                 </div>
-                                <div>
-                                    <label for="client_name" class="form-label fw-semibold">Ihr Name</label>
-                                    <input type="text" id="client_name" name="client_name" class="form-control form-control-lg" placeholder="Vor- und Nachname" required>
+
+                                {% if available.slots_booked %}
+                                <div class="table-responsive">
+                                    <table class="table table-hover align-middle border-top" id="admin-booking-table">
+                                        <thead class="table-light">
+                                            <tr>
+                                                <th scope="col" class="py-3">Zeitpunkt</th>
+                                                <th scope="col" class="py-3">Name</th>
+                                                <!-- Spaltenüberschriften für Custom Fields -->
+                                                {% for field_label in custom_fields %}
+                                                <th scope="col" class="py-3">{{ field_label }}</th>
+                                                {% endfor %}
+                                                <th scope="col" class="py-3 text-end">Aktion</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="booking-table-body">
+                                            {# Wir loopen jetzt über die rohen DB-Daten statt über die beschnittene Service-Funktion #}
+                                            {% for booking in appointment_item.get('slots_booked', []) %}
+                                            <tr>
+                                                <!-- 1. ZEITPUNKT -->
+                                                <td class="fw-semibold text-primary py-3 text-nowrap">
+                                                    {{ booking[0] }}
+                                                </td>
+                                            
+                                                <!-- 2. CLIENT NAME -->
+                                                <td>
+                                                    <span class="fw-bold text-dark">{{ booking[1] }}</span>
+                                                </td>
+
+                                                <!-- 3. CUSTOM FIELDS (Präziser Index-Abgleich gegen Spaltenkopf) -->
+                                                {% for field in custom_fields %}
+                                                    <td>
+                                                        {# Prüft ob für dieses Feld eine Antwort am exakt gleichen Index existiert #}
+                                                        {% if booking|length > 2 and booking[2] and booking[2]|length > loop.index0 %}
+                                                            {% set answer = booking[2][loop.index0] %}
+                                                            {{ answer if answer else '<span class="text-muted small">-</span>'|safe }}
+                                                        {% else %}
+                                                            <span class="text-muted small">-</span>
+                                                        {% endif %}
+                                                    </td>
+                                                {% endfor %}
+                                                
+                                                <!-- 4. AKTION (LÖSCHEN) -->
+                                                <td class="text-end">
+                                                    <form method="post" action="{{ url_for('terminplaner.client', appointment_id=appointment_id, tenant=tenant_id) }}" onsubmit="return confirm('Möchten Sie diesen Termin wirklich löschen?');" class="d-inline">
+                                                        <input type="hidden" name="action" value="delete">
+                                                        <input type="hidden" name="slot_time" value="{{ booking[0] }}">
+                                                        <input type="hidden" name="target_client_name" value="{{ booking[1] }}">
+
+                                                        <button type="submit" class="btn btn-sm btn-outline-danger px-3 rounded-3">
+                                                            Löschen
+                                                        </button>
+                                                    </form>
+                                                </td>
+                                            </tr>
+                                            {% endfor %}
+                                        </tbody>
+                                    </table>
                                 </div>
-                                <div class="d-flex flex-column flex-sm-row gap-2 pt-2">
-                                    <button type="submit" class="btn btn-primary btn-lg">Termin buchen</button>
+                                
+                                <div id="no-results-msg" class="text-center py-4 text-muted d-none">
+                                    Keine Buchungen entsprechen Ihrem Filter.
+                                </div>
+                                {% else %}
+                                <div class="text-center py-5 text-muted">
+                                    <p class="mb-0">Bisher sind noch keine Buchungen für diesen Terminplaner eingegangen.</p>
+                                </div>
+                                {% endif %}
+                                
+                                <div class="pt-4 border-top mt-4">
                                     <a class="btn btn-outline-secondary btn-lg" href="{{ url_for('terminplaner.main', tenant=tenant_id) }}">Zur Übersicht</a>
                                 </div>
-                            </form>
+
+                            {% else %}
+                                <h2 class="h4 fw-bold mb-3">Termin im Kalender auswählen</h2>
+
+                                <div class="day-slider-wrap mb-3">
+                                    <div class="d-flex justify-content-between align-items-center gap-2 mb-2">
+                                        <span class="small text-muted">Tag wählen</span>
+                                        <strong id="day-slider-label" class="small"></strong>
+                                    </div>
+                                    <input id="day-slider" type="range" class="form-range m-0" min="0" max="0" value="0">
+                                </div>
+
+                                <div id="client-slot-calendar" class="mb-4"></div>
+
+                                <form id="client-booking-form" method="post" action="{{ url_for('terminplaner.client', appointment_id=appointment_id, tenant=tenant_id) }}" class="vstack gap-3">
+                                    <div>
+                                        <label for="start_day_time" class="form-label fw-semibold">Gewünschter Zeitpunkt</label>
+                                        <input type="text" id="start_day_time" name="start_day_time" class="form-control form-control-lg" placeholder="Bitte im Kalender auswählen" readonly required>
+                                        <div class="form-text">Klicken Sie auf einen freien Slot oder verschieben Sie den gewählten Block.</div>
+                                    </div>
+                                    <div>
+                                        <label for="client_name" class="form-label fw-semibold">Ihr Name</label>
+                                        <input type="text" id="client_name" name="client_name" class="form-control form-control-lg" placeholder="Vor- und Nachname" required>
+                                    </div>
+                                
+                                    {% if custom_fields %}
+                                        {% for field_label in custom_fields %}
+                                        <div>
+                                            <label class="form-label fw-semibold">{{ field_label }}</label>
+                                            <input type="text" name="custom_answers" class="form-control form-control-lg" placeholder="{{ field_label }} eingeben" required>
+                                        </div>
+                                        {% endfor %}
+                                    {% endif %}
+                                    
+                                    <div class="d-flex flex-column flex-sm-row gap-2 pt-2">
+                                        <input type="hidden" name="action" value="book">
+                                        <button type="submit" class="btn btn-primary btn-lg">Termin buchen</button>
+                                        <a class="btn btn-outline-secondary btn-lg" href="{{ url_for('terminplaner.main', tenant=tenant_id) }}">Zur Übersicht</a>
+                                    </div>
+                                </form>
+                            {% endif %}
+
                         </div>
                     </div>
                 </div>
+                
             </div>
         </div>
     </div>
@@ -142,11 +271,58 @@
     </div>
 </div>
 
+<script>
+document.addEventListener('DOMContentLoaded', function () {
+    const searchInput = document.getElementById('table-search');
+    const clearBtn = document.getElementById('clear-filter-btn');
+    const tableBody = document.getElementById('booking-table-body');
+    const noResultsMsg = document.getElementById('no-results-msg');
+
+    if (searchInput && tableBody) {
+        const rows = tableBody.querySelectorAll('tr');
+
+        searchInput.addEventListener('input', function () {
+            const query = this.value.toLowerCase().trim();
+            let visibleRowsCount = 0;
+
+            rows.forEach(row => {
+                // Liest den Textinhalt aller Spalten der Zeile aus
+                const rowText = row.textContent.toLowerCase();
+                
+                if (rowText.includes(query)) {
+                    row.classList.remove('d-none');
+                    visibleRowsCount++;
+                } else {
+                    row.classList.add('d-none');
+                }
+            });
+
+            // Falls kein Filterergebnis gefunden wurde, Nachricht einblenden
+            if (visibleRowsCount === 0 && query !== '') {
+                noResultsMsg.classList.remove('d-none');
+            } else {
+                noResultsMsg.classList.add('d-none');
+            }
+        });
+
+        // Filter zurücksetzen Button
+        if (clearBtn) {
+            clearBtn.addEventListener('click', function () {
+                searchInput.value = '';
+                rows.forEach(row => row.classList.remove('d-none'));
+                noResultsMsg.classList.add('d-none');
+                searchInput.focus();
+            });
+        }
+    }
+});
+</script>
 <script src="https://cdn.jsdelivr.net/npm/fullcalendar@6.1.15/index.global.min.js"></script>
 <script>
     (function () {
         const available = {{ available|tojson }};
         const appointmentId = {{ appointment_id|tojson }};
+        const canViewBookingNames = {{ can_view_booking_names|tojson }}; // Injected from Flask
         const slider = document.getElementById('day-slider');
         const sliderLabel = document.getElementById('day-slider-label');
         const sliderWrap = slider ? slider.closest('.day-slider-wrap') : null;
@@ -160,10 +336,10 @@
         const confirmBookingWithIcsBtn = document.getElementById('confirm-booking-with-ics');
         const modal = modalEl ? new bootstrap.Modal(modalEl) : null;
 
-        const slotLength = Number.parseInt(available.slot_lenght, 10) || 45;
-        const bookedStarts = new Set((available.slots_booked || []).map(function (entry) {
-            return String(entry.start || '').trim();
-        }).filter(Boolean));
+        // Fallback for both spellings of slot length
+        const slotLength = Number.parseInt(available.slot_length || available.slot_lenght, 10) || 45;
+        const clientsPerSlot = Number.parseInt(available.clients_per_slot, 10) || 1;
+        const bookingsByTime = available.bookings_by_time || {};
 
         function formatDateForInput(dateObj) {
             const y = dateObj.getFullYear();
@@ -227,6 +403,8 @@
             return null;
         }
 
+        const fullyBookedSlots = [];
+
         function buildCandidateSlots() {
             const slots = [];
             const allowedDates = dateRangeInclusive(String(available.date_start || ''), String(available.date_end || ''));
@@ -234,9 +412,7 @@
 
             spans.forEach(function (entry) {
                 const parsed = parseTimeSpanEntry(entry);
-                if (!parsed) {
-                    return;
-                }
+                if (!parsed) return;
 
                 const targetDates = parsed.date ? [parsed.date] : allowedDates;
                 targetDates.forEach(function (date) {
@@ -249,10 +425,19 @@
                     let cursor = new Date(from);
                     while (addMinutes(cursor, slotLength) <= to) {
                         const slotStart = formatDateForInput(cursor);
-                        if (!bookedStarts.has(slotStart)) {
+                        const currentBookingsCount = bookingsByTime[slotStart] || 0;
+                        
+                        // Check if the current individual timestamp still has capacity left
+                        if (currentBookingsCount < clientsPerSlot) {
                             slots.push({
                                 start: slotStart,
                                 end: formatDateForInput(addMinutes(cursor, slotLength)),
+                                bookingsCount: currentBookingsCount
+                            });
+                        } else {
+                            fullyBookedSlots.push({
+                                start: slotStart,
+                                end: formatDateForInput(addMinutes(cursor, slotLength))
                             });
                         }
                         cursor = addMinutes(cursor, slotLength);
@@ -267,27 +452,8 @@
         const slotStartSet = new Set(candidateSlots.map(function (slot) { return slot.start; }));
         const allDays = dateRangeInclusive(String(available.date_start || ''), String(available.date_end || ''));
 
-        // Show the requested UI time window from 08:15 to 20:00 and highlight available slots
-        let slotMinTime = '08:15:00';
+        let slotMinTime = '08:00:00';
         let slotMaxTime = '20:00:00';
-        if (candidateSlots.length > 0) {
-            const starts = candidateSlots.map(function (slot) {
-                return new Date(slot.start.replace(' ', 'T') + ':00');
-            }).filter(function (d) { return !Number.isNaN(d.getTime()); });
-            const ends = candidateSlots.map(function (slot) {
-                return new Date(slot.end.replace(' ', 'T') + ':00');
-            }).filter(function (d) { return !Number.isNaN(d.getTime()); });
-
-            // Keep the computed min/max for gap calculations below
-            var computedMinStart = null;
-            var computedMaxEnd = null;
-            if (starts.length > 0 && ends.length > 0) {
-                computedMinStart = starts[0];
-                computedMaxEnd = ends[0];
-                starts.forEach(function (d) { if (d < computedMinStart) computedMinStart = d; });
-                ends.forEach(function (d) { if (d > computedMaxEnd) computedMaxEnd = d; });
-            }
-        }
 
         const visibleStart = allDays[0] || String(available.date_start || '');
         const visibleEndExclusive = allDays.length > 0
@@ -322,14 +488,8 @@
             slotMinTime: slotMinTime,
             slotMaxTime: slotMaxTime,
             nowIndicator: true,
-            validRange: {
-                start: visibleStart,
-                end: visibleEndExclusive,
-            },
-            visibleRange: {
-                start: visibleStart,
-                end: visibleEndExclusive,
-            },
+            validRange: { start: visibleStart, end: visibleEndExclusive },
+            visibleRange: { start: visibleStart, end: visibleEndExclusive },
             headerToolbar: {
                 left: '',
                 center: 'title',
@@ -337,28 +497,22 @@
             },
             events: [],
             eventDrop: function (info) {
-                if (info.event.id !== 'selected-slot') {
-                    return;
-                }
+                if (info.event.id !== 'selected-slot') return;
                 const droppedStart = formatDateForInput(info.event.start);
                 if (!slotStartSet.has(droppedStart)) {
                     info.revert();
-                    window.alert('Dieser Zeitpunkt ist nicht als freier Slot verfügbar.');
+                    window.alert('Dieser Zeitpunkt ist ausgebucht oder nicht verfügbar.');
                     return;
                 }
                 applySelectedSlot(droppedStart);
             },
             eventClick: function (info) {
                 const slotType = info.event.extendedProps ? info.event.extendedProps.slotType : '';
-                if (slotType !== 'free') {
-                    return;
-                }
+                if (slotType !== 'free') return;
                 applySelectedSlot(info.event.extendedProps.slotStart || '');
             }
         });
 
-        // No background greying: show full calendar skeleton and only mark possible slots
-
         function updateSliderLabel() {
             const dateList = dateRangeInclusive(String(available.date_start || ''), String(available.date_end || ''));
             const idx = Number.parseInt(slider.value, 10) || 0;
@@ -377,9 +531,7 @@
                 selectedEvent = null;
             }
 
-            if (!selectedSlot) {
-                return;
-            }
+            if (!selectedSlot) return;
 
             const start = new Date(selectedSlot.replace(' ', 'T') + ':00');
             const end = addMinutes(start, slotLength);
@@ -398,13 +550,9 @@
         function getIcsDownloadUrl() {
             const base = {{ url_for('terminplaner.client_slot_calendar_export', appointment_id=appointment_id, tenant=tenant_id)|tojson }};
             const url = new URL(base, window.location.origin);
-            if (selectedSlot) {
-                url.searchParams.set('start', selectedSlot);
-            }
+            if (selectedSlot) url.searchParams.set('start', selectedSlot);
             const name = String(clientNameInput.value || '').trim();
-            if (name) {
-                url.searchParams.set('name', name);
-            }
+            if (name) url.searchParams.set('name', name);
             return url.toString();
         }
 
@@ -415,14 +563,19 @@
             }
         }
 
-        // No background gaps: keep full skeleton/grid visible
-
-        // Add candidate free slots (blue)
+        // Render Active/Available Slots with Live Seat Counts
         candidateSlots.forEach(function (slot) {
             const start = new Date(slot.start.replace(' ', 'T') + ':00');
             const end = new Date(slot.end.replace(' ', 'T') + ':00');
+            
+            let displayTitle = 'Freier Slot';
+            if (clientsPerSlot > 1) {
+                const remainingSeats = clientsPerSlot - slot.bookingsCount;
+                displayTitle += ' (' + remainingSeats + '/' + clientsPerSlot + ' frei)';
+            }
+
             calendar.addEvent({
-                title: 'Freier Slot',
+                title: displayTitle,
                 start: start,
                 end: end,
                 color: '#0d6efd',
@@ -435,46 +588,54 @@
             });
         });
 
-        (available.slots_booked || []).forEach(function (booking) {
-            const startStr = String(booking.start || '').trim();
-            if (!startStr) {
-                return;
-            }
-            const start = new Date(startStr.replace(' ', 'T') + ':00');
-            const end = addMinutes(start, slotLength);
+        // Client View Optimization: Render solid red events ONLY if a slot is 100% full
+        fullyBookedSlots.forEach(function (slot) {
+            const start = new Date(slot.start.replace(' ', 'T') + ':00');
+            const end = new Date(slot.end.replace(' ', 'T') + ':00');
             calendar.addEvent({
-                title: 'Gebucht' + (booking.name ? ' - ' + booking.name : ''),
+                title: 'Ausgebucht',
                 start: start,
                 end: end,
                 color: '#dc3545',
                 editable: false,
-                display: 'block',
+                display: 'block'
             });
         });
 
+        // Admin Management View: Render detailed name blocks exclusively for management interaction
+        if (canViewBookingNames) {
+            (available.slots_booked || []).forEach(function (booking) {
+                const startStr = String(booking.start || '').trim();
+                if (!startStr) return;
+                const start = new Date(startStr.replace(' ', 'T') + ':00');
+                const end = addMinutes(start, slotLength);
+                calendar.addEvent({
+                    title: 'Belegt: ' + (booking.name || 'Anonym'),
+                    start: start,
+                    end: end,
+                    color: '#9e9e9e',
+                    editable: false,
+                    display: 'block',
+                });
+            });
+        }
+
+        // Event Listeners and Setup
         form.addEventListener('submit', function (ev) {
             if (!selectedSlotInput.value) {
                 ev.preventDefault();
                 window.alert('Bitte zuerst im Kalender einen freien Slot auswählen.');
                 return;
             }
-
-            if (allowImmediateSubmit) {
-                return;
-            }
-
+            if (allowImmediateSubmit) return;
             ev.preventDefault();
-            if (modal) {
-                modal.show();
-            }
+            if (modal) modal.show();
         });
 
         if (confirmBookingOnlyBtn) {
             confirmBookingOnlyBtn.addEventListener('click', function () {
                 allowImmediateSubmit = true;
-                if (modal) {
-                    modal.hide();
-                }
+                if (modal) modal.hide();
                 form.submit();
             });
         }
@@ -482,13 +643,9 @@
         if (confirmBookingWithIcsBtn) {
             confirmBookingWithIcsBtn.addEventListener('click', function () {
                 const icsUrl = confirmBookingWithIcsBtn.getAttribute('data-ics-url') || getIcsDownloadUrl();
-                if (icsUrl) {
-                    window.open(icsUrl, '_blank');
-                }
+                if (icsUrl) window.open(icsUrl, '_blank');
                 allowImmediateSubmit = true;
-                if (modal) {
-                    modal.hide();
-                }
+                if (modal) modal.hide();
                 form.submit();
             });
         }
@@ -509,10 +666,8 @@
         slider.addEventListener('input', function () {
             const idx = Number.parseInt(slider.value, 10) || 0;
             updateSliderLabel();
-            if (allDays[idx]) {
-                if (calendar.view.type === 'timeGridDay') {
-                    calendar.gotoDate(allDays[idx]);
-                }
+            if (allDays[idx] && calendar.view.type === 'timeGridDay') {
+                calendar.gotoDate(allDays[idx]);
             }
         });
 

Web/templates/termin_configure.html

@@ -70,6 +70,10 @@
                                 <label for="slot_length" class="form-label fw-semibold">Slot-Länge in Minuten</label>
                                 <input type="number" id="slot_length" name="slot_length" class="form-control form-control-lg" min="1" value="45">
                             </div>
+                            <div>
+                                <label class="form-label fw-semibold text-primary">Nutzer pro Slot</label>
+                                <input type="number" id="clients_per_slot" name="clients_per_slot" value="1">
+                            </div>
                             <div class="col-12 col-md-6">
                                 <label class="form-label fw-semibold text-primary">Automatisch berechnete Slots</label>
                                 <div id="slots_amounts_display" class="form-control form-control-lg bg-primary-subtle text-primary fw-bold d-flex align-items-center">0</div>
@@ -77,6 +81,16 @@
                                 <div class="form-text">Wird aus der gebuchten Zeit (abzüglich Pausen) und der Slot-Länge berechnet.</div>
                             </div>
                         </div>
+                        <div id="custom-fields-container" class="mt-4">
+                            <h3 class="mb-3">Benutzerdefinierte Felder</h3>
+
+                            <div class="mb-3 custom-field-row">
+                                <input type="text" 
+                                       name="custom_fields" 
+                                       class="form-control form-control-lg custom-dynamic-input" 
+                                       placeholder="Zusatzfeld hinzufügen (z.B. Firma, Kundennummer...)">
+                            </div>
+                        </div>
 
                         {% if mail_service_enabled %}
                             <div>
@@ -139,8 +153,9 @@
     const defaultPauseEndInput = document.getElementById('default_pause_end');
     
     const slotLengthInput = document.getElementById('slot_length');
+    const clientsperslot = document.getElementById('clients_per_slot')
     const slotsAmountsInput = document.getElementById('slots_amounts');
-    const slotsAmountsDisplay = document.getElementById('slots_amounts_display'); // Neu: Anzeige-Element
+    const slotsAmountsDisplay = document.getElementById('slots_amounts_display'); 
 
     if (!startDateInput || !endDateInput || !buildButton || !daysContainer || !timeFrameTextarea) {
         return;
@@ -188,16 +203,31 @@
         if (slotsAmountsDisplay) slotsAmountsDisplay.innerText = totalSlots + " Slots gesamt";
     }
 
+    // Helper utility in case your timeToMinutes handler doesn't catch empty strings safely
+    function safeTimeToMinutes(timeString) {
+        if (!timeString || typeof timeString !== 'string' || !timeString.includes(':')) {
+            return 0; // Return 0 instead of NaN for empty or missing values
+        }
+        const parts = timeString.split(':');
+        const hours = parseInt(parts[0], 10);
+        const minutes = parseInt(parts[1], 10);
+        if (isNaN(hours) || isNaN(minutes)) return 0;
+        return (hours * 60) + minutes;
+    }
+
     // Berechnet die Slots basierend auf den konfigurierten Zeiten & Pausen
     function calculateSlots() {
-        if (!slotLengthInput || !slotsAmountsInput) return;
-        
+        if (!slotLengthInput || !slotsAmountsInput || !clientsperslot) return;
+
         const slotLength = parseInt(slotLengthInput.value, 10);
         if (isNaN(slotLength) || slotLength <= 0) {
             updateSlotsDisplay(0);
             return;
         }
 
+        // FIX 1: Make sure we parse the input VALUE, defaulting to 1 if empty or invalid
+        const multiplier = parseInt(clientsperslot.value, 10) || 1;
+
         let totalSlots = 0;
         const rows = Array.from(daysContainer.querySelectorAll('[data-day-row]'));
 
@@ -209,19 +239,20 @@
 
             if (!startTime || !endTime) return;
 
-            const startMins = timeToMinutes(startTime);
-            const endMins = timeToMinutes(endTime);
-            const pauseStartMins = timeToMinutes(pauseStart);
-            const pauseEndMins = timeToMinutes(pauseEnd);
+            // Using safety parsing to prevent missing values from generating NaN
+            const startMins = safeTimeToMinutes(startTime);
+            const endMins = safeTimeToMinutes(endTime);
+            const pauseStartMins = safeTimeToMinutes(pauseStart);
+            const pauseEndMins = safeTimeToMinutes(pauseEnd);
 
-            if (endMins <= startMins) return; // Ungültige Zeit
+            if (isNaN(startMins) || isNaN(endMins) || endMins <= startMins) return;
 
             // Wenn eine gültige Pause innerhalb der Start/Endzeit existiert
             if (pauseStartMins > 0 && pauseEndMins > 0 && pauseStartMins < pauseEndMins && pauseStartMins > startMins && pauseStartMins < endMins) {
                 // Segment 1 (Vor der Pause)
                 const segment1 = pauseStartMins - startMins;
                 totalSlots += Math.floor(segment1 / slotLength);
-                
+
                 // Segment 2 (Nach der Pause)
                 const effectivePauseEnd = Math.min(pauseEndMins, endMins);
                 const segment2 = endMins - effectivePauseEnd;
@@ -234,7 +265,11 @@
             }
         });
 
-        updateSlotsDisplay(totalSlots);
+        // FIX 2: Multiply by our safely parsed input value scalar
+        const totalSlotscomplete = totalSlots * multiplier;
+
+        // Safety check: if anything went wrong anyway, fallback to 0 instead of displaying NaN
+        updateSlotsDisplay(isNaN(totalSlotscomplete) ? 0 : totalSlotscomplete);
     }
 
     // Synchronisiert das Textfeld und fügt den Break-Cut hinzu
@@ -351,6 +386,39 @@
         syncTextarea();
     }
 
+    document.addEventListener('DOMContentLoaded', function () {
+        const container = document.getElementById('custom-fields-container');
+
+        // Monitor inputs inside the container using event delegation
+        container.addEventListener('input', function (event) {
+            // Only trigger if the user is typing inside our dynamic inputs
+            if (event.target.classList.contains('custom-dynamic-input')) {
+                const allInputs = container.querySelectorAll('.custom-dynamic-input');
+                const lastInput = allInputs[allInputs.length - 1];
+
+                // If the user typed something into the absolute last input field, spawn a new one
+                if (lastInput.value.trim() !== '') {
+                    createNewFieldRow(container);
+                }
+            }
+        });
+
+        // Helper function to generate and append a clean new input row
+        function createNewFieldRow(targetContainer) {
+            const rowDiv = document.createElement('div');
+            rowDiv.className = 'mb-3 custom-field-row';
+
+            rowDiv.innerHTML = `
+                <input type="text" 
+                       name="custom_fields" 
+                       class="form-control form-control-lg custom-dynamic-input" 
+                       placeholder="Nächstes Zusatzfeld...">
+            `;
+
+            targetContainer.appendChild(rowDiv);
+        }
+    });
+
     // Event Listeners Registration
     buildButton.addEventListener('click', renderRows);
     startDateInput.addEventListener('change', renderRows);
@@ -366,10 +434,27 @@
         slotLengthInput.addEventListener('input', calculateSlots);
         slotLengthInput.addEventListener('change', calculateSlots);
     }
+    if (clientsperslot) {
+        clientsperslot.addEventListener('input', calculateSlots);
+        clientsperslot.addEventListener('change', calculateSlots);
+    }
 
     if (startDateInput.value && endDateInput.value) {
         renderRows();
     }
+
+
+    const configForm = document.querySelector('form');
+    if (configForm) {
+        configForm.addEventListener('keydown', function(event) {
+            if (event.key === 'Enter') {
+                if (event.target.tagName === 'TEXTAREA') return;
+                if (event.target.tagName === 'BUTTON' && event.target.type === 'submit') return;
+                event.preventDefault();
+            }
+        });
+    }
+
 })();
 </script>
 {% endblock %}

Web/templates/terminplaner.html

@@ -6,6 +6,8 @@
 <div class="container py-4">
     <div class="row justify-content-center">
         <div class="col-12 col-lg-11 col-xl-10">
+            
+            <!-- Hero Sektion -->
             <section class="p-4 p-md-5 rounded-4 shadow-lg" style="background: linear-gradient(135deg, rgba(15,76,92,0.96), rgba(22,105,122,0.92)); color: #fff;">
                 <div class="d-flex flex-column flex-lg-row justify-content-between gap-4 align-items-start align-items-lg-end">
                     <div>
@@ -20,6 +22,39 @@
                 </div>
             </section>
 
+            <!-- NEU EINGEBAUT: Erfolgsmeldung für gerade erstellte Buchungslinks -->
+            {% if generated_link %}
+            <div class="alert alert-success mt-4 shadow-sm rounded-4">
+                <div class="fw-bold mb-1">Buchungslink erstellt</div>
+                <div class="mb-2">
+                    {% if mail_service_enabled %}
+                        Teilen Sie diesen Link mit den Teilnehmenden oder versenden Sie ihn direkt per E-Mail.
+                    {% else %}
+                        Der E-Mail-Service ist deaktiviert. Teilen Sie diesen Link manuell mit den Teilnehmenden.
+                    {% endif %}
+                </div>
+                <a href="{{ generated_link }}" class="d-inline-block text-break mb-3">{{ generated_link }}</a>
+                
+                <!-- PDF Export per ReportLab -->
+                <div class="pt-3 border-top border-success-subtle">
+                    <div class="fw-semibold mb-1">Einladungsbrief (inkl. QR-Code)</div>
+                    <p class="small text-muted mb-2">Laden Sie einen automatisch generierten Brief herunter, der den Buchungslink und einen passenden QR-Code enthält.</p>
+                    <a href="{{ url_for('terminplaner.export_pdf_brief', plan_id=plan_id) }}" class="btn btn-outline-success btn-sm">
+                        📄 Brief als PDF herunterladen
+                    </a>
+                </div>
+
+                {% if calendar_link %}
+                <div class="mt-3 pt-3 border-top border-success-subtle">
+                    <div class="fw-semibold mb-1">Kalendereintrag</div>
+                    <a href="{{ calendar_link }}" class="btn btn-outline-primary btn-sm">.ics herunterladen</a>
+                </div>
+                {% endif %}
+            </div>
+            {% endif %}
+            <!-- ENDE NEUER BLOCK -->
+
+            <!-- Info-Karten -->
             <div class="row g-4 mt-1">
                 <div class="col-12 col-md-4">
                     <div class="card h-100 shadow-sm border-0 rounded-4">
@@ -59,6 +94,7 @@
                 <p class="mb-0 text-muted">Sie können Termine anlegen, den Kalender prüfen und Buchungslinks verteilen.</p>
             </div>
 
+            <!-- "Tabelle" (Liste) der kommenden Termine -->
             <div class="mt-4 p-4 rounded-4 bg-white shadow-sm">
                 <div class="d-flex flex-column flex-md-row justify-content-between align-items-md-center gap-2 mb-3">
                     <h2 class="h5 fw-bold mb-0">Kommende Termine</h2>
@@ -84,10 +120,18 @@
                             <div class="text-lg-end">
                                 <div class="small mb-2">Gebucht: <strong>{{ event.slots_booked }}</strong> / {{ event.slots_total }} | Frei: <strong>{{ event.slots_left }}</strong></div>
                                 <div class="d-flex flex-wrap gap-2 justify-content-lg-end">
-                                    <a class="btn btn-sm btn-primary" href="{{ event.link }}" target="_blank" rel="noopener">Client-Link öffnen</a>
+                                    
+                                    <!-- Hinzugefügt: Direkter PDF-Export auch bei bestehenden Plänen -->
+                                    <a class="btn btn-sm btn-outline-success" href="{{ url_for('terminplaner.export_pdf_brief', plan_id=event.appointment_id) }}" title="Brief herunterladen">
+                                        📄 PDF
+                                    </a>
+
+                                    <a class="btn btn-sm btn-primary" href="{{ event.link }}" target="_blank" rel="noopener">Client-Link</a>
+                                    
                                     {% if event.calendar_link %}
                                     <a class="btn btn-sm btn-outline-primary" href="{{ event.calendar_link }}">.ics</a>
                                     {% endif %}
+                                    
                                     <form method="post" action="{{ url_for('terminplaner.delete_appointment', appointment_id=event.appointment_id, tenant=tenant_id) }}" class="d-inline" onsubmit="return confirm('Diesen Terminplan wirklich löschen?');">
                                         <button type="submit" class="btn btn-sm btn-outline-danger">Entfernen</button>
                                     </form>
@@ -105,4 +149,4 @@
         </div>
     </div>
 </div>
-{% endblock %}
+{% endblock %}

backup.sh

@@ -3,7 +3,12 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 COMPOSE_FILE="docker-compose-multitenant.yml"
+
+# Directories
 INVOICE_ARCHIVE_DIR="${INVOICE_ARCHIVE_DIR:-/var/backups/invoice-archive}"
+FULL_BACKUP_DIR="${FULL_BACKUP_DIR:-/var/backups/inventarsystem}"
+LOG_DIR="$SCRIPT_DIR/logs"
+
 KEEP_DAYS="${INVOICE_KEEP_DAYS:-3650}"
 MODE="auto"
 BASE_NAME=""
@@ -14,9 +19,7 @@ Usage: $0 [options]
 
 Options:
   --invoice-archive-dir DIR   Directory for invoice archive files
-                              (default: $INVOICE_ARCHIVE_DIR)
-  --invoice-keep-days N       Remove archived invoice files older than N days
-                              (default: $KEEP_DAYS)
+  --invoice-keep-days N       Remove archived files older than N days
   --mode auto|docker|host     Backup mode (default: auto)
   --base-name NAME            Base filename prefix for archive files
   -h, --help                  Show this help message
@@ -26,127 +29,78 @@ EOF
 parse_args() {
     while [[ $# -gt 0 ]]; do
         case "$1" in
-            --invoice-archive-dir)
-                INVOICE_ARCHIVE_DIR="$2"
-                shift 2
-                ;;
-            --invoice-keep-days)
-                KEEP_DAYS="$2"
-                shift 2
-                ;;
-            --mode)
-                MODE="$2"
-                shift 2
-                ;;
-            --base-name)
-                BASE_NAME="$2"
-                shift 2
-                ;;
-            -h|--help)
-                usage
-                exit 0
-                ;;
-            *)
-                echo "Error: unknown option '$1'" >&2
-                usage
-                exit 2
-                ;;
+            --invoice-archive-dir) INVOICE_ARCHIVE_DIR="$2"; shift 2 ;;
+            --invoice-keep-days) KEEP_DAYS="$2"; shift 2 ;;
+            --mode) MODE="$2"; shift 2 ;;
+            --base-name) BASE_NAME="$2"; shift 2 ;;
+            -h|--help) usage; exit 0 ;;
+            *) echo "Error: unknown option '$1'" >&2; usage; exit 2 ;;
         esac
     done
 }
 
 ensure_directory() {
     mkdir -p "$INVOICE_ARCHIVE_DIR"
+    mkdir -p "$FULL_BACKUP_DIR"
 }
 
 cleanup_old_archives() {
     if [[ -n "$KEEP_DAYS" ]]; then
-        find "$INVOICE_ARCHIVE_DIR" -maxdepth 1 -type f \( -name 'invoices-*.jsonl' -o -name 'invoices-*.csv' -o -name 'invoices-*.meta.json' \) -mtime +"$KEEP_DAYS" -print -delete || true
+        find "$INVOICE_ARCHIVE_DIR" -maxdepth 1 -type f -mtime +"$KEEP_DAYS" -print -delete 2>/dev/null || true
     fi
-}
-
-host_backup() {
-    if ! command -v python3 >/dev/null 2>&1; then
-        return 1
-    fi
-    if ! python3 -c 'import pymongo' >/dev/null 2>&1; then
-        return 1
-    fi
-
-    python3 "$SCRIPT_DIR/Web/backup_invoices.py" \
-        --archive-dir "$INVOICE_ARCHIVE_DIR" \
-        --base-name "$BASE_NAME"
+    # Cleanup old bundled backups (older than 30 days)
+    find "$FULL_BACKUP_DIR" -maxdepth 1 -type f -name "full_backup_*.tar.gz" -mtime +30 -print -delete 2>/dev/null || true
 }
 
 docker_backup() {
-    if ! command -v docker >/dev/null 2>&1; then
-        return 1
-    fi
-    if ! docker compose -f "$COMPOSE_FILE" ps -q app >/dev/null 2>&1; then
-        return 1
+    if ! command -v docker >/dev/null 2>&1; then return 1; fi
+    
+    local timestamp="$(date +'%Y-%m-%d_%H-%M-%S')"
+    local staging_dir="/tmp/backup_stage_$timestamp"
+    
+    echo "[$(date +'%T')] Starting unified system backup..."
+    mkdir -p "$staging_dir"
+
+    # 1. MongoDB Dump (into staging)
+    if docker compose -f "$COMPOSE_FILE" ps -q mongodb >/dev/null 2>&1; then
+        echo "[$(date +'%T')] Dumping Database..."
+        docker compose -f "$COMPOSE_FILE" exec -T mongodb mongodump --archive --gzip > "$staging_dir/db.archive.gz"
     fi
 
-    local app_container
-    app_container="$(docker compose -f "$COMPOSE_FILE" ps -q app | tr -d '[:space:]')"
-    if [[ -z "$app_container" ]]; then
-        return 1
+    # 2. Archive Assets (into staging)
+    if [ -d "./Web/uploads" ]; then
+        echo "[$(date +'%T')] Archiving assets..."
+        tar -czf "$staging_dir/assets.tar.gz" -C . Web/uploads Web/thumbnails Web/previews 2>/dev/null || true
     fi
 
-    local timestamp
-    timestamp="$(date +'%Y-%m-%d_%H-%M-%S')"
-    local output_dir
-    local remote_base
+    # 3. Archive Logs (into staging)
+    if [ -d "$LOG_DIR" ]; then
+        echo "[$(date +'%T')] Archiving logs..."
+        tar -czf "$staging_dir/logs.tar.gz" -C "$(dirname "$LOG_DIR")" "$(basename "$LOG_DIR")"
+    fi
 
-    output_dir="/tmp/invoice_archive_${timestamp}"
-    remote_base="${output_dir}/${BASE_NAME}"
-
-    docker compose -f "$COMPOSE_FILE" exec -T app mkdir -p "$output_dir"
-    docker compose -f "$COMPOSE_FILE" exec -T app python3 /app/Web/backup_invoices.py \
-        --archive-dir "$output_dir" \
-        --base-name "$BASE_NAME"
-
-    mkdir -p "$INVOICE_ARCHIVE_DIR"
-    docker cp "$app_container":"${remote_base}.jsonl" "$INVOICE_ARCHIVE_DIR/"
-    docker cp "$app_container":"${remote_base}.csv" "$INVOICE_ARCHIVE_DIR/"
-    docker cp "$app_container":"${remote_base}.meta.json" "$INVOICE_ARCHIVE_DIR/"
-
-    docker compose -f "$COMPOSE_FILE" exec -T app rm -rf "$output_dir"
+    # 4. Bundle everything into one file
+    echo "[$(date +'%T')] Bundling archive..."
+    tar -czf "$FULL_BACKUP_DIR/full_backup_$timestamp.tar.gz" -C "$staging_dir" .
+    
+    # 5. Cleanup staging
+    rm -rf "$staging_dir"
+    
+    echo "[$(date +'%T')] Backup complete: $FULL_BACKUP_DIR/full_backup_$timestamp.tar.gz"
+    return 0
 }
 
 main() {
-    if [[ -z "$BASE_NAME" ]]; then
-        BASE_NAME="invoices-$(date +'%Y-%m-%d_%H-%M-%S')"
-    fi
-
+    parse_args "$@"
     ensure_directory
 
     case "$MODE" in
-        auto)
+        auto|docker)
             if docker_backup; then
                 cleanup_old_archives
                 return 0
             fi
-            if host_backup; then
-                cleanup_old_archives
-                return 0
-            fi
-            echo "Error: could not perform invoice backup in auto mode. Docker or host Python with pymongo is required." >&2
-            return 1
-            ;;
-        docker)
-            if docker_backup; then
-                cleanup_old_archives
-                return 0
-            fi
-            echo "Error: docker backup failed or app container is unavailable." >&2
-            return 1
-            ;;
-        host)
-            if host_backup; then
-                cleanup_old_archives
-                return 0
-            fi
-            echo "Error: host backup failed. Ensure python3 and pymongo are installed." >&2
+            echo "Error: Docker backup failed." >&2
             return 1
             ;;
         *)
@@ -157,5 +111,4 @@ main() {
     esac
 }
 
-parse_args "$@"
-main
+main "$@"

config.json

@@ -20,14 +20,14 @@
         "key": "Web/certs/key.pem"
     },
     "email": {
-        "enabled": false,
-        "smtp_host": "smtp.gmail.com",
+        "enabled": true,
+        "smtp_host": "",
         "smtp_port": 587,
         "use_tls": true,
         "username": "",
         "password": "",
         "from_address": "",
-        "default_sender_name": "Invario Inventurprogramm",
+        "default_sender_name": "Invario Email Service",
         "timeout_seconds": 30
     },
     "images": {

install.sh

@@ -8,8 +8,8 @@ else
     INSTALLER_DIR="$(pwd)"
 fi
 PROJECT_DIR="/opt/Inventarsystem"
-REPO_SLUG="AIIrondev/legendary-octo-garbanzo"
-API_URL="https://api.github.com/repos/$REPO_SLUG/releases/latest"
+REPO_SLUG="Invario/Inventarsystem"
+API_URL="https://git.invario-software.eu/api/v1/repos/$REPO_SLUG/releases/latest"
 BUNDLE_ASSET="inventarsystem-docker-bundle.tar.gz"
 APP_IMAGE_ASSET_PREFIX="inventarsystem-image-"
 LEGACY_DB_NAME="Inventarsystem"
@@ -39,7 +39,7 @@ need_cmd() {
 
 refresh_start_script_from_main() {
     local start_url
-    start_url="https://raw.githubusercontent.com/$REPO_SLUG/main/start.sh"
+    start_url="https://git.invario-software.eu/$REPO_SLUG/raw/branch/main/start.sh"
 
     if curl -fsSL "$start_url" -o "$TMP_DIR/start.sh"; then
         sudo install -m 755 "$TMP_DIR/start.sh" "$PROJECT_DIR/start.sh"
@@ -62,7 +62,7 @@ import re
 import sys
 
 compose_file, tag = sys.argv[1], sys.argv[2]
-target_image = f"ghcr.io/aiirondev/legendary-octo-garbanzo:{tag}"
+target_image = f"git.invario-software.eu/invario/inventarsystem:{tag}"
 
 with open(compose_file, "r", encoding="utf-8") as f:
     lines = f.readlines()
@@ -82,7 +82,6 @@ while i < len(lines):
     stripped = line.lstrip(" ")
     indent = leading_spaces(line)
 
-    # Check if we're starting the app service
     if not in_app_service and re.match(r"^\s*app:\s*$", line):
         in_app_service = True
         app_indent = indent
@@ -92,9 +91,7 @@ while i < len(lines):
         i += 1
         continue
 
-    # Check if we've exited the app service (found another top-level service)
     if in_app_service and indent <= app_indent and re.match(r"^[A-Za-z0-9_-]+:\s*$", stripped):
-        # We've left the app service - insert image if we haven't already
         if build_found and app_service_indent is not None:
             out.append(f"{' ' * app_service_indent}image: {target_image}\n")
         in_app_service = False
@@ -102,24 +99,20 @@ while i < len(lines):
         i += 1
         continue
 
-    # Process lines within the app service
     if in_app_service:
         if app_service_indent is None and indent > app_indent:
             app_service_indent = indent
 
-        # Check for image key (already has an image, don't add)
         if re.match(rf"^\s+image:\s*", line):
             in_app_service = False
             out.append(line)
             i += 1
             continue
 
-        # Check for build block
         if re.match(rf"^\s+build:\s*$", line):
             build_found = True
             out.append(line)
             i += 1
-            # Skip all lines that are part of the build block (indented more than app_service_indent)
             while i < len(lines):
                 next_line = lines[i]
                 next_indent = leading_spaces(next_line)
@@ -130,12 +123,10 @@ while i < len(lines):
                     break
             continue
 
-        # Insert image after build block before first property
         if build_found and app_service_indent is not None and indent == app_service_indent:
-            # Check if this is a property line (not build)
             if not re.match(rf"^\s+build:", line):
                 out.append(f"{' ' * app_service_indent}image: {target_image}\n")
-                build_found = False  # Mark that we've inserted the image
+                build_found = False
 
         out.append(line)
         i += 1
@@ -144,7 +135,6 @@ while i < len(lines):
     out.append(line)
     i += 1
 
-# If we ended while still in the app service, append image at the end
 if in_app_service and build_found and app_service_indent is not None:
     out.append(f"{' ' * app_service_indent}image: {target_image}\n")
 
@@ -173,9 +163,9 @@ Usage: $0 [options]
 Options:
   --migrate-legacy-db           Back up host MongoDB and import into Docker MongoDB
   --remove-legacy-system        Remove old host MongoDB/system after successful import
-    --skip-cleanup-old            Do not run cleanup-old.sh after install
-    --cleanup-old-remove-cron     Also remove matching cron entries during old-system cleanup
-    --multitenant                Use docker-compose-multitenant.yml (default)
+  --skip-cleanup-old            Do not run cleanup-old.sh after install
+  --cleanup-old-remove-cron     Also remove matching cron entries during old-system cleanup
+  --multitenant                Use docker-compose-multitenant.yml (default)
   --legacy-db-name <name>       Legacy database name (default: $LEGACY_DB_NAME)
   --legacy-mongo-uri <uri>      Legacy Mongo URI (default: $LEGACY_MONGO_URI)
   --legacy-system-dir <path>    Optional old system directory to remove after migration
@@ -377,18 +367,12 @@ with open(meta_file, 'r', encoding='utf-8') as f:
     data = json.load(f)
 tag = data.get('tag_name', '').strip()
 url = ''
-image_url = ''
 for asset in data.get('assets', []):
     if asset.get('name') == asset_name:
         url = asset.get('browser_download_url', '').strip()
         break
-for asset in data.get('assets', []):
-    if asset.get('name') == f'inventarsystem-image-{tag}.tar.gz':
-        image_url = asset.get('browser_download_url', '').strip()
-        break
 print(tag)
 print(url)
-print(image_url)
 PY
 }
 
@@ -401,7 +385,7 @@ main() {
     need_cmd python3
     need_cmd curl
 
-    local meta_file tag bundle_url image_url
+    local meta_file tag bundle_url
     TMP_DIR="$(mktemp -d)"
     meta_file="$TMP_DIR/release.json"
     trap cleanup_tmp_dir EXIT
@@ -409,7 +393,6 @@ main() {
     mapfile -t release_info < <(latest_tag_and_bundle_url "$meta_file")
     tag="${release_info[0]:-}"
     bundle_url="${release_info[1]:-}"
-    image_url="${release_info[2]:-}"
 
     if [ -z "$tag" ] || [ -z "$bundle_url" ]; then
         echo "Error: latest release metadata is incomplete."
@@ -425,16 +408,6 @@ main() {
 
     pin_compose_app_image "$tag"
 
-    if [ -z "$image_url" ]; then
-        echo "Error: release image asset is missing"
-        exit 1
-    fi
-
-    curl -fL "$image_url" -o "$TMP_DIR/inventarsystem-image-$tag.tar.gz"
-    sudo docker load -i "$TMP_DIR/inventarsystem-image-$tag.tar.gz" >/dev/null
-    # Compatibility alias: some legacy compose bundles may still reference :latest.
-    sudo docker tag "ghcr.io/aiirondev/legendary-octo-garbanzo:$tag" "ghcr.io/aiirondev/legendary-octo-garbanzo:latest" >/dev/null 2>&1 || true
-
     if [ ! -f "$PROJECT_DIR/start.sh" ]; then
         echo "Error: release bundle is missing start.sh"
         exit 1
@@ -470,19 +443,19 @@ EOF
 NUITKA_BUILD=0
 INVENTAR_HTTP_PORT=10000
 INVENTAR_HTTPS_PORT=10001
-INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:$tag
+INVENTAR_APP_IMAGE=git.invario-software.eu/invario/inventarsystem:$tag
 EOF
         sudo install -m 644 "$TMP_DIR/.docker-build.env" "$PROJECT_DIR/.docker-build.env"
     elif sudo grep -q '^INVENTAR_APP_IMAGE=' "$PROJECT_DIR/.docker-build.env"; then
-        sudo sed -i "s|^INVENTAR_APP_IMAGE=.*|INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:$tag|" "$PROJECT_DIR/.docker-build.env"
+        sudo sed -i "s|^INVENTAR_APP_IMAGE=.*|INVENTAR_APP_IMAGE=git.invario-software.eu/invario/inventarsystem:$tag|" "$PROJECT_DIR/.docker-build.env"
     else
-        echo "INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:$tag" | sudo tee -a "$PROJECT_DIR/.docker-build.env" >/dev/null
+        echo "INVENTAR_APP_IMAGE=git.invario-software.eu/invario/inventarsystem:$tag" | sudo tee -a "$PROJECT_DIR/.docker-build.env" >/dev/null
     fi
 
     backup_legacy_database
 
     echo "Starting stack..."
-    sudo env INVENTAR_APP_IMAGE="ghcr.io/aiirondev/legendary-octo-garbanzo:$tag" bash "$PROJECT_DIR/start.sh"
+    sudo env INVENTAR_APP_IMAGE="git.invario-software.eu/invario/inventarsystem:$tag" bash "$PROJECT_DIR/start.sh"
 
     restore_legacy_backup_into_docker
     cleanup_old_services
@@ -492,4 +465,4 @@ EOF
     echo "Open: https://localhost"
 }
 
-main "$@"
+main "$@"

manage-tenant.sh

@@ -880,6 +880,193 @@ PY
         fi
         ;;
 
+    backup)
+        TENANT_ID="${2:-}"
+        if [ -z "$TENANT_ID" ]; then
+            echo "Error: Please provide a tenant_id."
+            exit 1
+        fi
+        
+        OUTPUT_FILE="${3:-backup_${TENANT_ID}_$(date +%Y%m%d_%H%M%S).zip}"
+        
+        APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
+        if [ -z "$APP_CONTAINER" ]; then
+            echo "Error: Application container not running."
+            exit 1
+        fi
+        
+        echo "Creating complete backup (.zip) for tenant '$TENANT_ID'..."
+        
+        # We generate the zip temporarily inside the container
+        CONTAINER_TMP_ZIP="/tmp/backup_${TENANT_ID}_$(date +%s).zip"
+        
+        docker exec "$APP_CONTAINER" python3 - "$TENANT_ID" "$CONTAINER_TMP_ZIP" <<'PY'
+import sys, os, zipfile
+from bson import json_util
+sys.path.insert(0, '/app')
+sys.path.insert(0, '/app/Web')
+from Web.modules.database import settings
+from pymongo import MongoClient
+
+tenant_id = sys.argv[1]
+zip_path = sys.argv[2]
+
+# CHANGE THIS if your app stores files in a different directory
+UPLOADS_BASE = f"/app/uploads/{tenant_id}"
+
+sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
+db_name = f"inventar_{sanitized}"
+
+try:
+    client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
+    db = client[db_name]
+
+    dump = {}
+    for coll_name in db.list_collection_names():
+        if coll_name.startswith('system.'): 
+            continue
+        dump[coll_name] = list(db[coll_name].find())
+
+    db_json = json_util.dumps(dump)
+
+    with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:
+        # 1. Write the database dump
+        zf.writestr('database.json', db_json)
+        
+        # 2. Add uploaded photos/invoices if the directory exists
+        if os.path.isdir(UPLOADS_BASE):
+            for root, dirs, files in os.walk(UPLOADS_BASE):
+                for file in files:
+                    file_path = os.path.join(root, file)
+                    # Create a relative path for the zip internal structure
+                    arcname = os.path.relpath(file_path, start=UPLOADS_BASE)
+                    zf.write(file_path, arcname=f"uploads/{arcname}")
+                    
+except Exception as e:
+    print(f"Error creating backup: {e}", file=sys.stderr)
+    sys.exit(1)
+PY
+        
+        if [ $? -eq 0 ]; then
+            # Copy the zip out of the container to the host
+            docker cp "$APP_CONTAINER:$CONTAINER_TMP_ZIP" "$OUTPUT_FILE"
+            # Cleanup inside the container
+            docker exec "$APP_CONTAINER" rm -f "$CONTAINER_TMP_ZIP"
+            echo "Backup successfully created: $OUTPUT_FILE"
+        else
+            echo "Error: Backup failed."
+            docker exec "$APP_CONTAINER" rm -f "$CONTAINER_TMP_ZIP"
+            exit 1
+        fi
+        ;;
+
+    restore)
+        TENANT_ID="${2:-}"
+        INPUT_FILE="${3:-}"
+        
+        if [ -z "$TENANT_ID" ] || [ -z "$INPUT_FILE" ]; then
+            echo "Error: Usage: $0 restore <tenant_id> <backup_file.zip>"
+            exit 1
+        fi
+        
+        if [ ! -f "$INPUT_FILE" ]; then
+            echo "Error: Backup file '$INPUT_FILE' not found."
+            exit 1
+        fi
+        
+        echo -n "WARNING: This will DROP the existing database and completely overwrite data AND files for tenant '$TENANT_ID'. Are you sure? (y/N) "
+        read confirm
+        if [ "$confirm" != "y" ] && [ "$confirm" != "Y" ]; then
+            echo "Restore canceled."
+            exit 0
+        fi
+        
+        APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
+        if [ -z "$APP_CONTAINER" ]; then
+            echo "Error: Application container not running."
+            exit 1
+        fi
+        
+        echo "Uploading backup archive to container..."
+        CONTAINER_TMP_ZIP="/tmp/restore_${TENANT_ID}_$(date +%s).zip"
+        docker cp "$INPUT_FILE" "$APP_CONTAINER:$CONTAINER_TMP_ZIP"
+        
+        echo "Restoring database and files for tenant '$TENANT_ID'..."
+        
+        docker exec "$APP_CONTAINER" python3 - "$TENANT_ID" "$CONTAINER_TMP_ZIP" <<'PY'
+import sys, os, zipfile, shutil
+from bson import json_util
+sys.path.insert(0, '/app')
+sys.path.insert(0, '/app/Web')
+from Web.modules.database import settings
+from pymongo import MongoClient
+
+tenant_id = sys.argv[1]
+zip_path = sys.argv[2]
+
+# CHANGE THIS if your app stores files in a different directory
+UPLOADS_BASE = f"/app/uploads/{tenant_id}"
+
+sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
+db_name = f"inventar_{sanitized}"
+
+try:
+    with zipfile.ZipFile(zip_path, 'r') as zf:
+        # 1. Restore Database
+        db_json = zf.read('database.json').decode('utf-8')
+        data = json_util.loads(db_json)
+        
+        client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
+        client.drop_database(db_name)
+        db = client[db_name]
+        
+        restored_count = 0
+        for coll_name, docs in data.items():
+            if docs:
+                db[coll_name].insert_many(docs)
+                restored_count += len(docs)
+        
+        # 2. Restore Files
+        # Wipe existing uploads to ensure an exact replica of the backup
+        if os.path.exists(UPLOADS_BASE):
+            shutil.rmtree(UPLOADS_BASE)
+            
+        for item in zf.namelist():
+            # Extract only file items that were saved under 'uploads/'
+            if item.startswith('uploads/') and not item.endswith('/'):
+                rel_path = item[len('uploads/'):]
+                target_path = os.path.join(UPLOADS_BASE, rel_path)
+                
+                os.makedirs(os.path.dirname(target_path), exist_ok=True)
+                with open(target_path, 'wb') as f:
+                    f.write(zf.read(item))
+
+    print(f"Successfully restored {restored_count} database documents and tenant files.")
+except Exception as e:
+    print(f"Error restoring backup: {e}", file=sys.stderr)
+    sys.exit(1)
+PY
+
+        if [ $? -eq 0 ]; then
+            # Clean up tmp zip inside container
+            docker exec "$APP_CONTAINER" rm -f "$CONTAINER_TMP_ZIP"
+            echo "Restore completed successfully."
+            
+            echo "Clearing session cache..."
+            docker exec "$APP_CONTAINER" python3 -c "
+import sys; sys.path.insert(0, '/app'); sys.path.insert(0, '/app/Web'); from Web.modules.database import settings; from pymongo import MongoClient
+client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
+db = client[f'inventar_{"".join(c for c in sys.argv[1] if c.isalnum() or c == "_")}']
+db.sessions.drop()
+" "$TENANT_ID"
+            
+        else
+            echo "Error: Restore failed."
+            docker exec "$APP_CONTAINER" rm -f "$CONTAINER_TMP_ZIP"
+            exit 1
+        fi
+        ;;
+
     *)
         echo "Unknown command: $COMMAND"
         show_help

requirements.txt

@@ -1,4 +1,5 @@
 flask
+flask-wtf
 werkzeug
 gunicorn
 pymongo==4.6.3

restart.sh

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+sudo find /tmp -maxdepth 1 -name "tmp.*" -exec rm -rf {} +
+echo "Cleaning up old temporary files in /tmp..."
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
 cd "$SCRIPT_DIR"
 

restore.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BACKUP_DIR="/var/backups/inventarsystem"
+COMPOSE_FILE="docker-compose-multitenant.yml"
+
+# 1. Find the latest backup bundle
+LATEST_BACKUP=$(ls -t "$BACKUP_DIR"/full_backup_*.tar.gz | head -n1 2>/dev/null || true)
+
+if [[ -z "$LATEST_BACKUP" ]]; then
+    echo "Error: No backup bundle found in $BACKUP_DIR"
+    exit 1
+fi
+
+echo "--- RESTORE PROCEDURE ---"
+echo "Found latest bundle: $(basename "$LATEST_BACKUP")"
+read -p "WARNING: This will OVERWRITE your current database and assets! Continue? (y/N) " confirm
+[[ "$confirm" != "y" ]] && exit 1
+
+# 2. Extract the bundle to a temporary location
+RESTORE_TMP="/tmp/restore_$(date +%s)"
+mkdir -p "$RESTORE_TMP"
+echo "Extracting bundle..."
+tar -xzf "$LATEST_BACKUP" -C "$RESTORE_TMP"
+
+# 3. Stop application
+echo "Stopping application..."
+docker compose -f "$COMPOSE_FILE" stop app
+
+# 4. Restore Database
+if [ -f "$RESTORE_TMP/db.archive.gz" ]; then
+    echo "Restoring MongoDB..."
+    zcat "$RESTORE_TMP/db.archive.gz" | docker compose -f "$COMPOSE_FILE" exec -T mongodb mongorestore --archive --gzip --drop
+else
+    echo "Warning: Database archive not found in bundle."
+fi
+
+# 5. Restore Assets
+if [ -f "$RESTORE_TMP/assets.tar.gz" ]; then
+    echo "Restoring Assets (Uploads/Thumbnails/Previews)..."
+    tar -xzf "$RESTORE_TMP/assets.tar.gz" -C .
+else
+    echo "Warning: Asset archive not found in bundle."
+fi
+
+# 6. Restore Logs (Optional)
+if [ -f "$RESTORE_TMP/logs.tar.gz" ]; then
+    echo "Restoring Logs..."
+    tar -xzf "$RESTORE_TMP/logs.tar.gz" -C .
+fi
+
+# 7. Start application
+echo "Restarting application..."
+docker compose -f "$COMPOSE_FILE" start app
+
+# 8. Cleanup
+rm -rf "$RESTORE_TMP"
+echo "Restore complete!"

start.sh

@@ -5,8 +5,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$SCRIPT_DIR"
 
 ENV_FILE="$SCRIPT_DIR/.docker-build.env"
-APP_IMAGE_REPO="ghcr.io/aiirondev/legendary-octo-garbanzo"
-DIST_DIR="$SCRIPT_DIR/dist"
+APP_IMAGE_REPO="git.invario-software.eu/invario/inventarsystem"
 RUNTIME_COMPOSE_OVERRIDE_FILE="$SCRIPT_DIR/.docker-compose.runtime.override.yml"
 
 SUDO=""
@@ -279,52 +278,19 @@ EOF
         fi
 }
 
-ensure_app_image_loaded() {
+ensure_app_image_ready() {
     if docker image inspect "$APP_IMAGE_VALUE" >/dev/null 2>&1; then
         return 0
     fi
 
-    local image_archive
-    image_archive="$(find_local_dist_image_archive || true)"
-    if [ -n "$image_archive" ]; then
-        echo "Loading app image from local dist artifact: $image_archive"
-        if docker load -i "$image_archive" >/dev/null 2>&1 && docker image inspect "$APP_IMAGE_VALUE" >/dev/null 2>&1; then
-            return 0
-        fi
-        echo "Warning: failed to load expected app image from $image_archive"
-    fi
-
-    echo "Error: local app image not found: $APP_IMAGE_VALUE"
-    echo "Run ./update.sh so the nightly updater loads the release image first."
-    exit 1
-}
-
-find_local_dist_image_archive() {
-    local tag archive
-
-    if [ ! -d "$DIST_DIR" ]; then
-        return 1
-    fi
-
-    tag="${APP_IMAGE_VALUE##*:}"
-    for archive in \
-        "$DIST_DIR/inventarsystem-image-$tag.tar.gz" \
-        "$DIST_DIR/inventarsystem-image-$tag.tar" \
-        "$DIST_DIR/inventarsystem-image.tar.gz" \
-        "$DIST_DIR/inventarsystem-image.tar"; do
-        if [ -f "$archive" ]; then
-            echo "$archive"
-            return 0
-        fi
-    done
-
-    archive="$(find "$DIST_DIR" -maxdepth 1 -type f \( -name 'inventarsystem-image-*.tar.gz' -o -name 'inventarsystem-image-*.tar' \) | sort | tail -n1)"
-    if [ -n "$archive" ]; then
-        echo "$archive"
+    echo "Attempting to pull registry image: $APP_IMAGE_VALUE"
+    if docker pull "$APP_IMAGE_VALUE" >/dev/null 2>&1; then
         return 0
     fi
 
-    return 1
+    echo "Error: app image not found locally and pull failed: $APP_IMAGE_VALUE"
+    echo "Run ./update.sh to pull the latest release image from the registry."
+    exit 1
 }
 
 configure_nuitka_mode() {
@@ -605,7 +571,6 @@ verify_stack_health() {
     fi
     compose_args+=(--env-file "$ENV_FILE")
 
-    # Try health check with optional restart on first failure
     while [[ $retry_count -lt 2 ]]; do
         echo "Waiting for containers to become healthy... (attempt $((retry_count + 1))/2)"
         for _ in $(seq 1 60); do
@@ -623,7 +588,6 @@ verify_stack_health() {
             sleep 2
         done
 
-        # First failure: attempt recovery by restarting containers
         if [[ $retry_count -eq 0 ]]; then
             echo "Health check failed. Attempting to restart containers..."
             docker compose "${compose_args[@]}" ps || true
@@ -636,7 +600,6 @@ verify_stack_health() {
         fi
     done
 
-    # Final failure
     echo "Error: stack health check failed after restart attempt."
     docker compose "${compose_args[@]}" ps || true
     docker compose "${compose_args[@]}" logs --tail=120 app redis mongodb || true
@@ -654,7 +617,7 @@ resolve_app_image
 configure_host_ports
 ensure_min_docker_disk_space
 detect_server_capacity
-ensure_app_image_loaded
+ensure_app_image_ready
 write_env_file
 write_runtime_compose_override
 
@@ -676,4 +639,4 @@ fi
 verify_stack_health
 
 echo "Stack started."
-echo "Open: http://<server-ip>:$HTTP_PORT_VALUE"
+echo "Open: http://<server-ip>:$HTTP_PORT_VALUE"

update.sh

@@ -2,22 +2,19 @@
 set -euo pipefail
 
 # Release-only updater for Docker deployment.
-# Updates are pulled exclusively from GitHub Releases assets.
+# Updates pull the deployment bundle from Gitea and the Docker Image via 'docker pull'.
 
 PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 LOG_DIR="$PROJECT_DIR/logs"
 LOG_FILE="$LOG_DIR/update.log"
 STATE_FILE="$PROJECT_DIR/.release-version"
-REPO_SLUG="AIIrondev/legendary-octo-garbanzo"
-API_URL="https://api.github.com/repos/$REPO_SLUG/releases/latest"
+REPO_SLUG="Invario/Inventarsystem"
+API_URL="https://git.invario-software.eu/api/v1/repos/$REPO_SLUG/releases/latest"
 BUNDLE_ASSET="inventarsystem-docker-bundle.tar.gz"
-APP_IMAGE_ASSET_PREFIX="inventarsystem-image-"
 ENV_FILE="$PROJECT_DIR/.docker-build.env"
-APP_IMAGE_REPO="ghcr.io/aiirondev/legendary-octo-garbanzo"
-DIST_DIR="$PROJECT_DIR/dist"
+APP_IMAGE_REPO="git.invario-software.eu/invario/inventarsystem"
 COMPOSE_FILE="docker-compose-multitenant.yml"
 MIN_ROOT_FREE_MB="${INVENTAR_MIN_ROOT_FREE_MB:-2048}"
-DIST_KEEP_COUNT="${INVENTAR_DIST_KEEP_COUNT:-2}"
 MODE="release"
 
 mkdir -p "$LOG_DIR"
@@ -109,36 +106,6 @@ ensure_min_root_disk_space() {
     fi
 }
 
-cleanup_old_dist_artifacts() {
-    local keep_count
-    keep_count="$DIST_KEEP_COUNT"
-
-    if [ ! -d "$DIST_DIR" ]; then
-        return 0
-    fi
-
-    if ! [[ "$keep_count" =~ ^[0-9]+$ ]]; then
-        keep_count=2
-    fi
-
-    mapfile -t archives < <(find "$DIST_DIR" -maxdepth 1 -type f \( -name 'inventarsystem-image-*.tar.gz' -o -name 'inventarsystem-image-*.tar' \) -printf '%T@ %p\n' | sort -nr | awk '{print $2}')
-    if [ "${#archives[@]}" -le "$keep_count" ]; then
-        return 0
-    fi
-
-    local index old_archive deleted=0
-    for (( index=keep_count; index<${#archives[@]}; index++ )); do
-        old_archive="${archives[$index]}"
-        if rm -f "$old_archive"; then
-            deleted=$((deleted + 1))
-        fi
-    done
-
-    if [ "$deleted" -gt 0 ]; then
-        log_message "Cleaned up $deleted old dist image archive(s)"
-    fi
-}
-
 cleanup_docker_dangling_images() {
     if docker image prune -f >> "$LOG_FILE" 2>&1; then
         log_message "Cleaned up dangling Docker images"
@@ -153,7 +120,6 @@ Usage: $0 [options]
 
 Options:
   --multitenant      Use docker-compose-multitenant.yml (default)
-    development        Install development build from GHCR or local dist
   -h, --help         Show this help message
 EOF
 }
@@ -165,10 +131,6 @@ parse_args() {
                 COMPOSE_FILE="docker-compose-multitenant.yml"
                 shift
                 ;;
-            development|dev)
-                MODE="development"
-                shift
-                ;;
             -h|--help)
                 usage
                 exit 0
@@ -204,26 +166,24 @@ create_backup() {
         fi
     fi
 
-    if [ -x "$PROJECT_DIR/run-backup.sh" ]; then
-        if "$PROJECT_DIR/run-backup.sh" >> "$LOG_FILE" 2>&1; then
+    if [ -x "$PROJECT_DIR/backup.sh" ]; then
+        if "$PROJECT_DIR/backup.sh" --mode auto >> "$LOG_FILE" 2>&1; then
             log_message "Backup completed"
         else
             log_message "WARNING: Backup failed; continuing with release update"
         fi
     else
-        log_message "WARNING: run-backup.sh not found; skipping backup"
+        log_message "WARNING: backup.sh not found; skipping backup"
     fi
 }
 
 fetch_release_metadata() {
-    local meta_file
-    meta_file="$1"
+    local meta_file="$1"
     curl -fsSL "$API_URL" -o "$meta_file"
 }
 
 parse_latest_tag() {
-    local meta_file
-    meta_file="$1"
+    local meta_file="$1"
     python3 - <<'PY' "$meta_file"
 import json, sys
 with open(sys.argv[1], 'r', encoding='utf-8') as f:
@@ -233,9 +193,8 @@ PY
 }
 
 parse_asset_url() {
-    local meta_file asset_name
-    meta_file="$1"
-    asset_name="$2"
+    local meta_file="$1"
+    local asset_name="$2"
     python3 - <<'PY' "$meta_file" "$asset_name"
 import json, sys
 meta_file, asset_name = sys.argv[1], sys.argv[2]
@@ -248,98 +207,25 @@ for asset in data.get('assets', []):
 PY
 }
 
-load_release_image() {
-    local meta_file tag image_asset image_url tmp_dir archive
-
-    meta_file="$1"
-    tag="$2"
-    image_asset="${APP_IMAGE_ASSET_PREFIX}${tag}.tar.gz"
-    image_url="$(parse_asset_url "$meta_file" "$image_asset")"
-
-    if [ -z "$image_url" ]; then
-        log_message "ERROR: Release image asset not found: $image_asset"
-        return 1
-    fi
-
-    tmp_dir="$(mktemp -d)"
-    archive="$tmp_dir/$image_asset"
-    trap 'rm -rf "${tmp_dir:-}"' RETURN
-
-    log_message "Loading app image from release asset $image_asset"
-    curl -fL "$image_url" -o "$archive"
-    docker load -i "$archive" >> "$LOG_FILE" 2>&1
-    docker tag "$APP_IMAGE_REPO:$tag" "$APP_IMAGE_REPO:latest" >> "$LOG_FILE" 2>&1 || true
-
-    trap - RETURN
-}
-
 refresh_runtime_scripts_from_main() {
     local start_url stop_url restart_url update_url
-    start_url="https://raw.githubusercontent.com/$REPO_SLUG/main/start.sh"
-    stop_url="https://raw.githubusercontent.com/$REPO_SLUG/main/stop.sh"
-    restart_url="https://raw.githubusercontent.com/$REPO_SLUG/main/restart.sh"
-    update_url="https://raw.githubusercontent.com/$REPO_SLUG/main/update.sh"
+    start_url="https://git.invario-software.eu/$REPO_SLUG/raw/branch/main/start.sh"
+    stop_url="https://git.invario-software.eu/$REPO_SLUG/raw/branch/main/stop.sh"
+    restart_url="https://git.invario-software.eu/$REPO_SLUG/raw/branch/main/restart.sh"
+    update_url="https://git.invario-software.eu/$REPO_SLUG/raw/branch/main/update.sh"
 
     curl -fsSL "$start_url" -o "$PROJECT_DIR/start.sh" || log_message "WARNING: Could not refresh start.sh from main"
     curl -fsSL "$stop_url" -o "$PROJECT_DIR/stop.sh" || log_message "WARNING: Could not refresh stop.sh from main"
     curl -fsSL "$restart_url" -o "$PROJECT_DIR/restart.sh" || log_message "WARNING: Could not refresh restart.sh from main"
     curl -fsSL "$update_url" -o "$PROJECT_DIR/update.sh" || log_message "WARNING: Could not refresh update.sh from main"
 
-    chmod +x "$PROJECT_DIR/start.sh" "$PROJECT_DIR/stop.sh" "$PROJECT_DIR/restart.sh" "$PROJECT_DIR/update.sh"
-}
-
-find_local_dist_image_archive() {
-    local tag="$1"
-    local archive
-
-    if [ ! -d "$DIST_DIR" ]; then
-        return 1
-    fi
-
-    for archive in \
-        "$DIST_DIR/inventarsystem-image-$tag.tar.gz" \
-        "$DIST_DIR/inventarsystem-image-$tag.tar" \
-        "$DIST_DIR/inventarsystem-image.tar.gz" \
-        "$DIST_DIR/inventarsystem-image.tar"; do
-        if [ -f "$archive" ]; then
-            echo "$archive"
-            return 0
-        fi
-    done
-
-    archive="$(find "$DIST_DIR" -maxdepth 1 -type f \( -name 'inventarsystem-image-*.tar.gz' -o -name 'inventarsystem-image-*.tar' \) | sort | tail -n1)"
-    if [ -n "$archive" ]; then
-        echo "$archive"
-        return 0
-    fi
-
-    return 1
-}
-
-load_local_dist_image() {
-    local tag="$1"
-    local archive
-
-    archive="$(find_local_dist_image_archive "$tag" || true)"
-    if [ -z "$archive" ]; then
-        return 1
-    fi
-
-    log_message "Loading app image from local dist artifact: $archive"
-    if docker load -i "$archive" >> "$LOG_FILE" 2>&1; then
-        docker tag "$APP_IMAGE_REPO:$tag" "$APP_IMAGE_REPO:latest" >> "$LOG_FILE" 2>&1 || true
-        return 0
-    fi
-
-    log_message "WARNING: Failed to load local dist artifact: $archive"
-    return 1
+    chmod +x "$PROJECT_DIR/start.sh" "$PROJECT_DIR/stop.sh" "$PROJECT_DIR/restart.sh" "$PROJECT_DIR/update.sh" 2>/dev/null || true
 }
 
 download_and_extract_bundle() {
-    local url tmp_dir archive
-    url="$1"
-    tmp_dir="$2"
-    archive="$tmp_dir/$BUNDLE_ASSET"
+    local url="$1"
+    local tmp_dir="$2"
+    local archive="$tmp_dir/$BUNDLE_ASSET"
 
     curl -fL "$url" -o "$archive"
     tar -xzf "$archive" -C "$tmp_dir"
@@ -357,7 +243,7 @@ download_and_extract_bundle() {
         cp -f "$tmp_dir/update.sh" "$PROJECT_DIR/update.sh"
     fi
 
-    # Neu: Multi-Tenant Ressourcen kopieren, falls vorhanden
+    # Multi-Tenant Ressourcen kopieren, falls vorhanden
     if [ -f "$tmp_dir/docker-compose-multitenant.yml" ]; then
         cp -f "$tmp_dir/docker-compose-multitenant.yml" "$PROJECT_DIR/docker-compose-multitenant.yml"
     fi
@@ -374,20 +260,16 @@ download_and_extract_bundle() {
     done
 
     # Ensure executable permissions on all copied scripts
-    chmod +x "$PROJECT_DIR/start.sh" "$PROJECT_DIR/stop.sh" "$PROJECT_DIR/restart.sh" "$PROJECT_DIR/update.sh" "$PROJECT_DIR/backup.sh" "$PROJECT_DIR/manage-tenant.sh" "$PROJECT_DIR/run-tenant-cmd.sh" 2>/dev/null || true 2>/dev/null || true
-    chmod +x "$PROJECT_DIR"/manage-tenant.sh "$PROJECT_DIR"/run-tenant-cmd.sh 2>/dev/null || true
+    chmod +x "$PROJECT_DIR/start.sh" "$PROJECT_DIR/stop.sh" "$PROJECT_DIR/restart.sh" "$PROJECT_DIR/update.sh" "$PROJECT_DIR/backup.sh" "$PROJECT_DIR/manage-tenant.sh" "$PROJECT_DIR/run-tenant-cmd.sh" 2>/dev/null || true
 
     if [ ! -f "$PROJECT_DIR/config.json" ] && [ -f "$tmp_dir/config.json" ]; then
         cp -f "$tmp_dir/config.json" "$PROJECT_DIR/config.json"
         log_message "Installed default config.json from release bundle"
     fi
-
-    chmod +x "$PROJECT_DIR/start.sh" "$PROJECT_DIR/stop.sh" "$PROJECT_DIR/restart.sh" "$PROJECT_DIR/update.sh" "$PROJECT_DIR/backup.sh" "$PROJECT_DIR/manage-tenant.sh" "$PROJECT_DIR/run-tenant-cmd.sh" 2>/dev/null || true
 }
 
 deploy() {
     local tag="$1"
-    local meta_file="$2"
     local app_image="${APP_IMAGE_REPO}:${tag}"
     local compose_path
 
@@ -410,17 +292,14 @@ EOF
         printf '\nINVENTAR_APP_IMAGE=%s\n' "$app_image" >> "$ENV_FILE"
     fi
 
-    if ! load_local_dist_image "$tag"; then
-        if ! load_release_image "$meta_file" "$tag"; then
-            log_message "Falling back to tagged GHCR image $app_image"
-            if ! docker pull "$app_image" >> "$LOG_FILE" 2>&1; then
-                log_message "Falling back to local Docker build for $app_image"
-                docker build -t "$app_image" "$PROJECT_DIR" >> "$LOG_FILE" 2>&1
-            fi
-        fi
+    log_message "Pulling Gitea Registry image $app_image"
+    if ! docker pull "$app_image" >> "$LOG_FILE" 2>&1; then
+        log_message "Falling back to local Docker build for $app_image"
+        docker build -t "$app_image" "$PROJECT_DIR" >> "$LOG_FILE" 2>&1
     fi
 
-    docker compose -f "$compose_path" --env-file "$ENV_FILE" pull app mongodb >> "$LOG_FILE" 2>&1
+    # Image wurde oben gepullt, Stack hochfahren
+    docker compose -f "$compose_path" --env-file "$ENV_FILE" pull mongodb redis >> "$LOG_FILE" 2>&1 || true
     docker compose -f "$compose_path" --env-file "$ENV_FILE" up -d --remove-orphans >> "$LOG_FILE" 2>&1
     docker tag "$app_image" "$APP_IMAGE_REPO:latest" >> "$LOG_FILE" 2>&1 || true
 }
@@ -460,9 +339,12 @@ cleanup_server_space() {
     else
         log_message "WARNING: Docker system prune failed"
     fi
-    # Clean up old dist artifacts
-    cleanup_old_dist_artifacts
-    # Clean up log files older than 7 days
+    # Delete legacy dist folder if it exists
+    if [ -d "$PROJECT_DIR/dist" ]; then
+        rm -rf "$PROJECT_DIR/dist" || true
+        log_message "Legacy dist folder removed"
+    fi
+    # Clean up old log files older than 7 days
     if find "$LOG_DIR" -type f -name '*.log' -mtime +7 -exec rm -f {} +; then
         log_message "Old log files (older than 7 days) cleaned up"
     else
@@ -511,17 +393,14 @@ EOF
             printf '\nINVENTAR_APP_IMAGE=%s\n' "$app_image" >> "$ENV_FILE"
         fi
 
-        # Try local dist first, then pull from GHCR
-        if ! load_local_dist_image "$tag"; then
-            log_message "Attempting to pull development image $app_image"
-            if ! docker pull "$app_image" >> "$LOG_FILE" 2>&1; then
-                log_message "ERROR: Could not obtain development image $app_image"
-                exit 1
-            fi
+        log_message "Attempting to pull development image $app_image"
+        if ! docker pull "$app_image" >> "$LOG_FILE" 2>&1; then
+            log_message "ERROR: Could not obtain development image $app_image"
+            exit 1
         fi
 
         # Bring up stack
-        docker compose -f "$compose_path" --env-file "$ENV_FILE" pull app mongodb >> "$LOG_FILE" 2>&1 || true
+        docker compose -f "$compose_path" --env-file "$ENV_FILE" pull mongodb redis >> "$LOG_FILE" 2>&1 || true
         docker compose -f "$compose_path" --env-file "$ENV_FILE" up -d --remove-orphans >> "$LOG_FILE" 2>&1
 
         if ! verify_stack_health; then
@@ -540,7 +419,7 @@ EOF
 
     trap 'rm -rf "${tmp_dir:-}"' EXIT
 
-    log_message "Checking latest GitHub release for $REPO_SLUG..."
+    log_message "Checking latest Gitea release for $REPO_SLUG..."
     if ! fetch_release_metadata "$meta_file"; then
         log_message "WARNING: Could not fetch release metadata. Falling back to self-healing start path."
         if INVENTAR_SETUP_CRON=0 bash "$PROJECT_DIR/start.sh" >> "$LOG_FILE" 2>&1; then
@@ -581,7 +460,7 @@ EOF
 
     if [ "$current_tag" = "$latest_tag" ]; then
         log_message "Already on latest release ($latest_tag). Refreshing containers from prebuilt image."
-        deploy "$latest_tag" "$meta_file"
+        deploy "$latest_tag"
         if verify_stack_health; then
             log_message "Container refresh completed"
         else
@@ -611,16 +490,20 @@ EOF
     log_message "Updating from release $latest_tag"
     download_and_extract_bundle "$bundle_url" "$tmp_dir"
     refresh_runtime_scripts_from_main
-    deploy "$latest_tag" "$meta_file"
+    deploy "$latest_tag"
     if ! verify_stack_health; then
         log_message "ERROR: Updated stack failed health check"
         exit 1
     fi
 
     echo "$latest_tag" > "$STATE_FILE"
-    cleanup_old_dist_artifacts
     cleanup_docker_dangling_images
     log_message "Update completed successfully to release $latest_tag"
+
+    if [ -x "./opt/Inventarsystem/restart.sh" ]; then
+        sudo ./opt/Inventarsystem/restart.sh
+    fi
+    echo "Restart of the Server Completed"
 }
 
-main "$@"
+main "$@"