1030 lines
35 KiB
Python
1030 lines
35 KiB
Python
import os
|
||
import re
|
||
import secrets
|
||
from datetime import datetime, timedelta, date
|
||
from typing import Optional, Dict, List
|
||
from decimal import Decimal
|
||
|
||
from fastapi import FastAPI, Request, Depends, HTTPException, Form, status
|
||
from fastapi.responses import HTMLResponse, RedirectResponse
|
||
from fastapi.staticfiles import StaticFiles
|
||
from fastapi.templating import Jinja2Templates
|
||
from starlette.middleware.sessions import SessionMiddleware
|
||
from sqlalchemy.orm import Session
|
||
|
||
from .database import get_db
|
||
from .models import Tenant, User, Product, Event, Order, OrderItem, Invitation
|
||
from .auth import hash_password, verify_password
|
||
|
||
app = FastAPI(title="Schmankerl – Das moderne Brotzeitportal")
|
||
|
||
# Session Middleware für sichere Login-Cookies
|
||
app.add_middleware(
|
||
SessionMiddleware,
|
||
secret_key=os.getenv("SECRET_KEY", "schmankerl-secret-key-waiswuaschd-2026!"),
|
||
session_cookie="schmankerl_session",
|
||
max_age=86400 * 30 # 30 Tage
|
||
)
|
||
|
||
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
|
||
app.mount("/static", StaticFiles(directory=os.path.join(BASE_DIR, "static")), name="static")
|
||
templates = Jinja2Templates(directory=os.path.join(BASE_DIR, "templates"))
|
||
|
||
|
||
def resolve_tenant(request: Request, db: Session) -> Optional[Tenant]:
|
||
"""Ermittelt den Mandanten anhand der Subdomain (Host-Header)."""
|
||
host = request.headers.get("host", "").split(":")[0].lower()
|
||
parts = host.split(".")
|
||
|
||
slug = "demo"
|
||
if len(parts) >= 4 and parts[-3:] == ["waiswuaschd", "de", ""]:
|
||
slug = parts[0]
|
||
elif len(parts) >= 3 and parts[1] == "dev" and parts[2] == "waiswuaschd":
|
||
slug = parts[0]
|
||
elif parts and parts[0] not in ["localhost", "127", "dev"]:
|
||
slug = parts[0]
|
||
|
||
tenant = db.query(Tenant).filter(Tenant.slug == slug, Tenant.is_active == True).first()
|
||
if not tenant:
|
||
tenant = db.query(Tenant).filter(Tenant.slug == "demo").first()
|
||
return tenant
|
||
|
||
|
||
def get_current_user(request: Request, db: Session) -> Optional[User]:
|
||
"""Liest den eingeloggten Benutzer aus der Session."""
|
||
user_id = request.session.get("user_id")
|
||
if not user_id:
|
||
return None
|
||
return db.query(User).filter(User.id == user_id, User.is_active == True).first()
|
||
|
||
|
||
def require_admin(request: Request, db: Session) -> User:
|
||
"""Stellt sicher, dass ein Administrator eingeloggt ist."""
|
||
current_user = get_current_user(request, db)
|
||
if not current_user:
|
||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Anmeldung erforderlich")
|
||
if current_user.role != "admin":
|
||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Nur für Administratoren zugänglich")
|
||
return current_user
|
||
|
||
|
||
def seed_demo_users_if_needed(tenant: Tenant, db: Session):
|
||
"""Stellt sicher, dass die Standard-Accounts für die Demo existieren."""
|
||
demo_user = db.query(User).filter(User.tenant_id == tenant.id, User.email == "maxi@waiswuaschd.de").first()
|
||
if not demo_user:
|
||
demo_user = User(
|
||
tenant_id=tenant.id,
|
||
email="maxi@waiswuaschd.de",
|
||
username="maxi",
|
||
first_name="Maxi",
|
||
last_name="Mustermann",
|
||
password_hash=hash_password("demo123"),
|
||
role="user"
|
||
)
|
||
db.add(demo_user)
|
||
|
||
admin_user = db.query(User).filter(User.tenant_id == tenant.id, User.email == "admin@waiswuaschd.de").first()
|
||
if not admin_user:
|
||
admin_user = User(
|
||
tenant_id=tenant.id,
|
||
email="admin@waiswuaschd.de",
|
||
username="admin",
|
||
first_name="Franz",
|
||
last_name="Xaver",
|
||
password_hash=hash_password("admin123"),
|
||
role="admin"
|
||
)
|
||
db.add(admin_user)
|
||
db.commit()
|
||
|
||
|
||
@app.get("/", response_class=HTMLResponse)
|
||
def index(request: Request, event_id: Optional[int] = None, db: Session = Depends(get_db)):
|
||
tenant = resolve_tenant(request, db)
|
||
if not tenant:
|
||
return templates.TemplateResponse(request, "not_found_tenant.html", context={})
|
||
|
||
current_user = get_current_user(request, db)
|
||
now = datetime.now()
|
||
|
||
# Alle offenen Events laden
|
||
open_events = db.query(Event).filter(
|
||
Event.tenant_id == tenant.id,
|
||
Event.status == "open"
|
||
).order_by(Event.event_date.asc(), Event.deadline.asc()).all()
|
||
|
||
# Gewünschtes Event wählen
|
||
event = None
|
||
if event_id:
|
||
event = db.query(Event).filter(Event.id == event_id, Event.tenant_id == tenant.id).first()
|
||
if not event and open_events:
|
||
event = open_events[0]
|
||
if not event:
|
||
# Neuestes Event überhaupt anzeigen
|
||
event = db.query(Event).filter(Event.tenant_id == tenant.id).order_by(Event.id.desc()).first()
|
||
|
||
# Gast-Modus
|
||
is_guest_mode = (request.query_params.get("guest") == "1")
|
||
|
||
# Wenn nicht eingeloggt und Event erlaubt keine Gäste -> Redirect zu Login
|
||
if not current_user:
|
||
if not event or not event.allow_guests:
|
||
return RedirectResponse(url="/login", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
# Fristprüfung & Countdown
|
||
is_closed = True
|
||
seconds_remaining = 0
|
||
if event:
|
||
is_closed = (event.status != "open") or (event.deadline < now)
|
||
if not is_closed:
|
||
seconds_remaining = max(0, int((event.deadline - now).total_seconds()))
|
||
|
||
# Alle aktiven Produkte des Mandanten
|
||
products = db.query(Product).filter(
|
||
Product.tenant_id == tenant.id,
|
||
Product.is_active == True
|
||
).order_by(Product.sort_order.asc(), Product.id.asc()).all()
|
||
|
||
# Bestehende Bestellung des Users in diesem Event
|
||
existing_order = None
|
||
user_items: Dict[int, int] = {}
|
||
if event and current_user:
|
||
existing_order = db.query(Order).filter(
|
||
Order.tenant_id == tenant.id,
|
||
Order.event_id == event.id,
|
||
Order.user_id == current_user.id
|
||
).first()
|
||
if existing_order:
|
||
for it in existing_order.items:
|
||
user_items[it.product_id] = it.quantity
|
||
|
||
# Bestellungen insgesamt zählen
|
||
order_count = 0
|
||
if event:
|
||
order_count = db.query(Order).filter(Order.event_id == event.id).count()
|
||
|
||
return templates.TemplateResponse(request, "index.html", context={
|
||
"tenant": tenant,
|
||
"current_user": current_user,
|
||
"event": event,
|
||
"open_events": open_events,
|
||
"is_guest_mode": is_guest_mode,
|
||
"is_closed": is_closed,
|
||
"seconds_remaining": seconds_remaining,
|
||
"products": products,
|
||
"existing_order": existing_order,
|
||
"user_items": user_items,
|
||
"order_count": order_count,
|
||
"now": now
|
||
})
|
||
|
||
|
||
@app.get("/login", response_class=HTMLResponse)
|
||
def login_page(request: Request, db: Session = Depends(get_db), error: Optional[str] = None, success: Optional[str] = None):
|
||
tenant = resolve_tenant(request, db)
|
||
if tenant and tenant.slug == "demo":
|
||
seed_demo_users_if_needed(tenant, db)
|
||
|
||
current_user = get_current_user(request, db)
|
||
if current_user:
|
||
return RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
active_event = db.query(Event).filter(
|
||
Event.tenant_id == tenant.id,
|
||
Event.status == "open",
|
||
Event.deadline > datetime.now()
|
||
).first()
|
||
allow_guests = (active_event.allow_guests if active_event else False)
|
||
|
||
return templates.TemplateResponse(request, "login.html", context={
|
||
"tenant": tenant,
|
||
"error": error,
|
||
"success": success,
|
||
"allow_guests": allow_guests,
|
||
"active_event": active_event,
|
||
"current_user": None
|
||
})
|
||
|
||
|
||
@app.post("/login")
|
||
def login(
|
||
request: Request,
|
||
email: str = Form(...),
|
||
password: str = Form(...),
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
clean_email = email.strip().lower()
|
||
|
||
user = db.query(User).filter(User.tenant_id == tenant.id, User.email == clean_email).first()
|
||
if not user or not verify_password(password, user.password_hash):
|
||
return templates.TemplateResponse(request, "login.html", context={
|
||
"tenant": tenant,
|
||
"error": "Ungültige E-Mail-Adresse oder falsches Passwort.",
|
||
"current_user": None,
|
||
"allow_guests": False
|
||
}, status_code=400)
|
||
|
||
request.session["user_id"] = user.id
|
||
return RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.post("/login/quick")
|
||
def quick_demo_login(
|
||
request: Request,
|
||
role: str = Form(...),
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
if not tenant:
|
||
raise HTTPException(status_code=404, detail="Mandant nicht gefunden")
|
||
|
||
seed_demo_users_if_needed(tenant, db)
|
||
|
||
target_email = "admin@waiswuaschd.de" if role == "admin" else "maxi@waiswuaschd.de"
|
||
user = db.query(User).filter(User.tenant_id == tenant.id, User.email == target_email).first()
|
||
if not user:
|
||
raise HTTPException(status_code=500, detail="Demo-Benutzer konnte nicht geladen werden")
|
||
|
||
request.session["user_id"] = user.id
|
||
if role == "admin":
|
||
return RedirectResponse(url="/admin", status_code=status.HTTP_303_SEE_OTHER)
|
||
return RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.get("/logout")
|
||
def logout(request: Request):
|
||
request.session.clear()
|
||
return RedirectResponse(url="/login", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
# --- EINLADUNGS- & BEITRITTS-FLOW (/join) ---
|
||
|
||
@app.get("/join", response_class=HTMLResponse)
|
||
def join_page(request: Request, token: str, db: Session = Depends(get_db)):
|
||
tenant = resolve_tenant(request, db)
|
||
if not tenant:
|
||
raise HTTPException(status_code=404, detail="Mandant nicht gefunden")
|
||
|
||
invitation = db.query(Invitation).filter(
|
||
Invitation.token == token,
|
||
Invitation.tenant_id == tenant.id
|
||
).first()
|
||
|
||
error = None
|
||
if not invitation:
|
||
error = "Dieser Einladungslink ist ungültig oder gehört zu einem anderen Team."
|
||
elif not invitation.is_reusable and invitation.used_at is not None:
|
||
error = "Dieser Einladungslink wurde bereits eingelöst. Bitte melde dich mit deinem Konto an."
|
||
elif invitation.expires_at and invitation.expires_at < datetime.now():
|
||
error = "Dieser Einladungslink ist leider abgelaufen. Bitte frage deinen Admin nach einem neuen Link."
|
||
|
||
return templates.TemplateResponse(request, "join.html", context={
|
||
"tenant": tenant,
|
||
"invitation": invitation,
|
||
"token": token,
|
||
"error": error,
|
||
"current_user": None
|
||
})
|
||
|
||
|
||
@app.post("/join")
|
||
def process_join(
|
||
request: Request,
|
||
token: str = Form(...),
|
||
first_name: str = Form(...),
|
||
last_name: str = Form(...),
|
||
email: str = Form(...),
|
||
password: str = Form(...),
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
invitation = db.query(Invitation).filter(
|
||
Invitation.token == token,
|
||
Invitation.tenant_id == tenant.id
|
||
).first()
|
||
|
||
if not invitation:
|
||
raise HTTPException(status_code=400, detail="Ungültiger Einladungslink")
|
||
|
||
if not invitation.is_reusable and invitation.used_at is not None:
|
||
raise HTTPException(status_code=400, detail="Einladungslink wurde bereits verwendet")
|
||
|
||
if invitation.expires_at and invitation.expires_at < datetime.now():
|
||
raise HTTPException(status_code=400, detail="Einladungslink ist abgelaufen")
|
||
|
||
clean_email = email.strip().lower()
|
||
existing_user = db.query(User).filter(
|
||
User.tenant_id == tenant.id,
|
||
User.email == clean_email
|
||
).first()
|
||
|
||
if existing_user:
|
||
return templates.TemplateResponse(request, "join.html", context={
|
||
"tenant": tenant,
|
||
"invitation": invitation,
|
||
"token": token,
|
||
"error": "Diese E-Mail-Adresse ist bereits im Team registriert. Bitte melde dich an.",
|
||
"current_user": None
|
||
}, status_code=400)
|
||
|
||
username = clean_email.split("@")[0]
|
||
new_user = User(
|
||
tenant_id=tenant.id,
|
||
email=clean_email,
|
||
username=username,
|
||
first_name=first_name.strip(),
|
||
last_name=last_name.strip(),
|
||
password_hash=hash_password(password),
|
||
role=invitation.role
|
||
)
|
||
db.add(new_user)
|
||
|
||
if not invitation.is_reusable:
|
||
invitation.used_at = datetime.now()
|
||
|
||
db.commit()
|
||
db.refresh(new_user)
|
||
|
||
request.session["user_id"] = new_user.id
|
||
return RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
# --- BESTELLUNGEN (/order) ---
|
||
|
||
@app.post("/order")
|
||
async def place_order(
|
||
request: Request,
|
||
event_id: int = Form(...),
|
||
guest_first_name: Optional[str] = Form(None),
|
||
guest_last_name: Optional[str] = Form(None),
|
||
guest_email: Optional[str] = Form(None),
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
current_user = get_current_user(request, db)
|
||
|
||
event = db.query(Event).filter(Event.id == event_id, Event.tenant_id == tenant.id).first()
|
||
if not event or event.status != "open":
|
||
raise HTTPException(status_code=400, detail="Diese Bestellrunde ist geschlossen.")
|
||
|
||
if event.deadline < datetime.now():
|
||
raise HTTPException(status_code=400, detail="Die Bestellfrist für diese Runde ist leider abgelaufen!")
|
||
|
||
guest_name_str = None
|
||
if not current_user:
|
||
if not event.allow_guests:
|
||
return RedirectResponse(url="/login", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
if not guest_first_name or not guest_first_name.strip():
|
||
raise HTTPException(status_code=400, detail="Bitte gib als Gast deinen Namen an!")
|
||
|
||
fname = guest_first_name.strip()
|
||
lname = guest_last_name.strip() if guest_last_name else "(Gast)"
|
||
guest_name_str = f"{fname} {lname}"
|
||
clean_email = (guest_email.strip().lower() if guest_email and guest_email.strip() else f"gast_{secrets.token_hex(4)}@{tenant.slug}.local")
|
||
|
||
guest_user = User(
|
||
tenant_id=tenant.id,
|
||
email=clean_email,
|
||
username=f"gast_{secrets.token_hex(4)}",
|
||
first_name=fname,
|
||
last_name=lname,
|
||
role="guest",
|
||
password_hash=""
|
||
)
|
||
db.add(guest_user)
|
||
db.commit()
|
||
db.refresh(guest_user)
|
||
current_user = guest_user
|
||
request.session["user_id"] = guest_user.id
|
||
else:
|
||
guest_name_str = f"{current_user.first_name} {current_user.last_name}"
|
||
|
||
form_data = await request.form()
|
||
order_items = []
|
||
total_price = Decimal("0.00")
|
||
|
||
products = db.query(Product).filter(Product.tenant_id == tenant.id, Product.is_active == True).all()
|
||
for prod in products:
|
||
qty_str = form_data.get(f"qty_{prod.id}", "0")
|
||
try:
|
||
qty = int(qty_str)
|
||
except ValueError:
|
||
qty = 0
|
||
|
||
if qty > 0:
|
||
item_total = prod.price * qty
|
||
total_price += item_total
|
||
order_items.append(OrderItem(
|
||
product_id=prod.id,
|
||
quantity=qty,
|
||
unit_price=prod.price
|
||
))
|
||
|
||
if not order_items:
|
||
raise HTTPException(status_code=400, detail="Bitte wähle mindestens einen Artikel aus!")
|
||
|
||
existing_order = db.query(Order).filter(
|
||
Order.tenant_id == tenant.id,
|
||
Order.event_id == event.id,
|
||
Order.user_id == current_user.id
|
||
).first()
|
||
|
||
if existing_order:
|
||
db.query(OrderItem).filter(OrderItem.order_id == existing_order.id).delete()
|
||
existing_order.total_price = total_price
|
||
existing_order.guest_display_name = guest_name_str
|
||
for item in order_items:
|
||
item.order_id = existing_order.id
|
||
db.add(item)
|
||
db.commit()
|
||
order_id = existing_order.id
|
||
else:
|
||
new_order = Order(
|
||
tenant_id=tenant.id,
|
||
event_id=event.id,
|
||
user_id=current_user.id,
|
||
guest_display_name=guest_name_str,
|
||
total_price=total_price,
|
||
is_paid=False
|
||
)
|
||
db.add(new_order)
|
||
db.flush()
|
||
for item in order_items:
|
||
item.order_id = new_order.id
|
||
db.add(item)
|
||
db.commit()
|
||
order_id = new_order.id
|
||
|
||
return RedirectResponse(url=f"/order/{order_id}/success", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.get("/order/{order_id}/success", response_class=HTMLResponse)
|
||
def order_success(order_id: int, request: Request, db: Session = Depends(get_db)):
|
||
tenant = resolve_tenant(request, db)
|
||
current_user = get_current_user(request, db)
|
||
if not current_user:
|
||
return RedirectResponse(url="/login", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
order = db.query(Order).filter(Order.id == order_id, Order.tenant_id == tenant.id).first()
|
||
if not order:
|
||
raise HTTPException(status_code=404, detail="Bestellung nicht gefunden")
|
||
|
||
return templates.TemplateResponse(request, "order_success.html", context={
|
||
"tenant": tenant,
|
||
"current_user": current_user,
|
||
"order": order
|
||
})
|
||
|
||
|
||
# --- ADMIN COCKPIT (/admin) ---
|
||
|
||
@app.get("/admin", response_class=HTMLResponse)
|
||
def admin_dashboard(
|
||
request: Request,
|
||
event_id: Optional[int] = None,
|
||
tab: str = "orders",
|
||
warn_active_id: Optional[int] = None,
|
||
success: Optional[str] = None,
|
||
bulk_count: Optional[int] = None,
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
if not tenant:
|
||
return templates.TemplateResponse(request, "not_found_tenant.html", context={})
|
||
|
||
current_user = get_current_user(request, db)
|
||
if not current_user:
|
||
return RedirectResponse(url="/login", status_code=status.HTTP_303_SEE_OTHER)
|
||
if current_user.role != "admin":
|
||
raise HTTPException(status_code=403, detail="Zugriff nur für Administratoren")
|
||
|
||
# Alle Events des Mandanten
|
||
all_events = db.query(Event).filter(Event.tenant_id == tenant.id).order_by(Event.event_date.desc(), Event.id.desc()).all()
|
||
|
||
# Ausgewähltes Event bestimmen: Wenn event_id übergeben, nehmen wir das, sonst das erste offene, sonst das neueste
|
||
selected_event = None
|
||
if event_id:
|
||
selected_event = db.query(Event).filter(Event.id == event_id, Event.tenant_id == tenant.id).first()
|
||
|
||
if not selected_event:
|
||
# Bevorzuge aktives offenes Event
|
||
for ev in all_events:
|
||
if ev.status == "open":
|
||
selected_event = ev
|
||
break
|
||
if not selected_event and all_events:
|
||
selected_event = all_events[0]
|
||
|
||
orders = []
|
||
item_sums = {}
|
||
total_revenue = Decimal("0.00")
|
||
total_paid = Decimal("0.00")
|
||
|
||
if selected_event:
|
||
orders = db.query(Order).filter(Order.event_id == selected_event.id).order_by(Order.created_at.asc()).all()
|
||
for ord_obj in orders:
|
||
total_revenue += ord_obj.total_price
|
||
if ord_obj.is_paid:
|
||
total_paid += ord_obj.total_price
|
||
|
||
for it in ord_obj.items:
|
||
pname = it.product.name if it.product else "Artikel"
|
||
unit = it.product.unit if it.product else "Stk"
|
||
if pname not in item_sums:
|
||
item_sums[pname] = {"quantity": 0, "unit": unit}
|
||
item_sums[pname]["quantity"] += it.quantity
|
||
|
||
# Teammitglieder laden (Gäste filtern oder am Ende aufführen)
|
||
team_members = db.query(User).filter(
|
||
User.tenant_id == tenant.id,
|
||
User.role != "guest"
|
||
).order_by(User.role.asc(), User.first_name.asc()).all()
|
||
|
||
# Aktive Gäste laden
|
||
active_guests = db.query(User).filter(
|
||
User.tenant_id == tenant.id,
|
||
User.role == "guest"
|
||
).all()
|
||
|
||
# Offene Einladungen
|
||
now = datetime.now()
|
||
pending_invitations = db.query(Invitation).filter(
|
||
Invitation.tenant_id == tenant.id,
|
||
(Invitation.expires_at == None) | (Invitation.expires_at > now)
|
||
).order_by(Invitation.created_at.desc()).all()
|
||
|
||
# Produkte laden
|
||
products = db.query(Product).filter(Product.tenant_id == tenant.id).order_by(Product.sort_order.asc(), Product.id.asc()).all()
|
||
|
||
# Warnung bei existierendem aktivem Event
|
||
active_warning_event = None
|
||
if warn_active_id:
|
||
active_warning_event = db.query(Event).filter(Event.id == warn_active_id, Event.tenant_id == tenant.id).first()
|
||
|
||
return templates.TemplateResponse(request, "admin.html", context={
|
||
"tenant": tenant,
|
||
"current_user": current_user,
|
||
"all_events": all_events,
|
||
"event": selected_event,
|
||
"orders": orders,
|
||
"item_sums": item_sums,
|
||
"total_revenue": total_revenue,
|
||
"total_paid": total_paid,
|
||
"team_members": team_members,
|
||
"active_guests": active_guests,
|
||
"pending_invitations": pending_invitations,
|
||
"products": products,
|
||
"active_tab": tab,
|
||
"warn_active_event": active_warning_event,
|
||
"success": success,
|
||
"bulk_count": bulk_count,
|
||
"now": now
|
||
})
|
||
|
||
|
||
# --- ADMIN USER MANAGEMENT ---
|
||
|
||
@app.post("/admin/users/{user_id}/reset-password")
|
||
def admin_reset_password(
|
||
user_id: int,
|
||
request: Request,
|
||
new_password: str = Form(...),
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
require_admin(request, db)
|
||
|
||
user = db.query(User).filter(User.id == user_id, User.tenant_id == tenant.id).first()
|
||
if not user:
|
||
raise HTTPException(status_code=404, detail="Benutzer nicht gefunden")
|
||
|
||
if not new_password or len(new_password.strip()) < 4:
|
||
raise HTTPException(status_code=400, detail="Passwort muss mindestens 4 Zeichen lang sein")
|
||
|
||
user.password_hash = hash_password(new_password.strip())
|
||
db.commit()
|
||
|
||
return RedirectResponse(url="/admin?tab=team", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.post("/admin/users/{user_id}/delete")
|
||
def admin_delete_user(
|
||
user_id: int,
|
||
request: Request,
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
admin = require_admin(request, db)
|
||
|
||
if admin.id == user_id:
|
||
raise HTTPException(status_code=400, detail="Du kannst dein eigenes Admin-Konto nicht löschen")
|
||
|
||
user = db.query(User).filter(User.id == user_id, User.tenant_id == tenant.id).first()
|
||
if user:
|
||
# Eventuelle Bestellungen von user_id entkoppeln, damit Beträge im Archiv nicht verloren gehen
|
||
orders = db.query(Order).filter(Order.user_id == user.id).all()
|
||
for ord_obj in orders:
|
||
ord_obj.guest_display_name = f"{user.first_name} {user.last_name}"
|
||
ord_obj.user_id = None
|
||
db.delete(user)
|
||
db.commit()
|
||
|
||
return RedirectResponse(url="/admin?tab=team", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
# --- ADMIN INVITATIONS (EINZELN & BULK) ---
|
||
|
||
@app.post("/admin/invitations/create")
|
||
def admin_create_invitation(
|
||
request: Request,
|
||
email: Optional[str] = Form(None),
|
||
role: str = Form("user"),
|
||
valid_days: str = Form("unlimited"),
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
admin = require_admin(request, db)
|
||
|
||
token = secrets.token_urlsafe(20)
|
||
clean_email = email.strip().lower() if email and email.strip() else None
|
||
|
||
if valid_days in ["0", "unlimited", "forever"]:
|
||
expires_at = None
|
||
is_reusable = True
|
||
else:
|
||
days = int(valid_days)
|
||
expires_at = datetime.now() + timedelta(days=days)
|
||
is_reusable = False
|
||
|
||
inv = Invitation(
|
||
tenant_id=tenant.id,
|
||
token=token,
|
||
email=clean_email,
|
||
role=role,
|
||
created_by=admin.id,
|
||
expires_at=expires_at,
|
||
is_reusable=is_reusable
|
||
)
|
||
db.add(inv)
|
||
db.commit()
|
||
|
||
return RedirectResponse(url="/admin?tab=team", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.post("/admin/invitations/bulk")
|
||
def admin_bulk_invitations(
|
||
request: Request,
|
||
emails_text: str = Form(...),
|
||
role: str = Form("user"),
|
||
valid_days: str = Form("14"),
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
admin = require_admin(request, db)
|
||
|
||
# E-Mails per Regex extrahieren (unterstützt Komma, Semikolon, Umbrüche etc.)
|
||
email_pattern = r'[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+'
|
||
found_emails = list(set([e.lower().strip() for e in re.findall(email_pattern, emails_text)]))
|
||
|
||
if not found_emails:
|
||
raise HTTPException(status_code=400, detail="Keine gültigen E-Mail-Adressen gefunden.")
|
||
|
||
expires_at = None
|
||
is_reusable = False
|
||
if valid_days in ["0", "unlimited", "forever"]:
|
||
is_reusable = True
|
||
else:
|
||
expires_at = datetime.now() + timedelta(days=int(valid_days))
|
||
|
||
count = 0
|
||
for em in found_emails:
|
||
token = secrets.token_urlsafe(20)
|
||
inv = Invitation(
|
||
tenant_id=tenant.id,
|
||
token=token,
|
||
email=em,
|
||
role=role,
|
||
created_by=admin.id,
|
||
expires_at=expires_at,
|
||
is_reusable=is_reusable
|
||
)
|
||
db.add(inv)
|
||
count += 1
|
||
|
||
db.commit()
|
||
return RedirectResponse(url=f"/admin?tab=team&bulk_count={count}", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.post("/admin/invitations/{inv_id}/revoke")
|
||
def admin_revoke_invitation(
|
||
inv_id: int,
|
||
request: Request,
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
require_admin(request, db)
|
||
|
||
inv = db.query(Invitation).filter(Invitation.id == inv_id, Invitation.tenant_id == tenant.id).first()
|
||
if inv:
|
||
db.delete(inv)
|
||
db.commit()
|
||
|
||
return RedirectResponse(url="/admin?tab=team", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
# --- ADMIN EVENT MANAGEMENT ---
|
||
|
||
@app.post("/admin/events/new")
|
||
def admin_create_event(
|
||
request: Request,
|
||
title: str = Form(...),
|
||
event_date: str = Form(...),
|
||
deadline_date: str = Form(...),
|
||
deadline_time: str = Form(...),
|
||
sponsor_name: Optional[str] = Form(None),
|
||
allow_guests: bool = Form(True),
|
||
force: bool = Form(False),
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
require_admin(request, db)
|
||
|
||
try:
|
||
ev_date = datetime.strptime(event_date.strip(), "%Y-%m-%d").date()
|
||
dl_str = f"{deadline_date.strip()} {deadline_time.strip()}"
|
||
deadline_dt = datetime.strptime(dl_str, "%Y-%m-%d %H:%M")
|
||
except ValueError as e:
|
||
raise HTTPException(status_code=400, detail=f"Ungültiges Datumsformat: {e}")
|
||
|
||
# Prüfung: Gibt es bereits ein aktives offenes Event in der Zukunft?
|
||
if not force:
|
||
active_existing = db.query(Event).filter(
|
||
Event.tenant_id == tenant.id,
|
||
Event.status == "open",
|
||
Event.event_date >= date.today()
|
||
).first()
|
||
if active_existing:
|
||
# Weiterleitung mit Warn-Hinweis
|
||
return RedirectResponse(
|
||
url=f"/admin?tab=event&warn_active_id={active_existing.id}",
|
||
status_code=status.HTTP_303_SEE_OTHER
|
||
)
|
||
|
||
new_event = Event(
|
||
tenant_id=tenant.id,
|
||
title=title.strip(),
|
||
event_date=ev_date,
|
||
deadline=deadline_dt,
|
||
status="open",
|
||
sponsor_name=sponsor_name.strip() if sponsor_name and sponsor_name.strip() else None,
|
||
allow_guests=allow_guests
|
||
)
|
||
db.add(new_event)
|
||
db.commit()
|
||
db.refresh(new_event)
|
||
|
||
return RedirectResponse(url=f"/admin?event_id={new_event.id}&tab=orders", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.post("/admin/events/{event_id}/edit")
|
||
def admin_edit_event(
|
||
event_id: int,
|
||
request: Request,
|
||
title: str = Form(...),
|
||
event_date: str = Form(...),
|
||
deadline_date: str = Form(...),
|
||
deadline_time: str = Form(...),
|
||
status_val: str = Form(...),
|
||
sponsor_name: Optional[str] = Form(None),
|
||
allow_guests: bool = Form(False),
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
require_admin(request, db)
|
||
|
||
event = db.query(Event).filter(Event.id == event_id, Event.tenant_id == tenant.id).first()
|
||
if not event:
|
||
raise HTTPException(status_code=404, detail="Event nicht gefunden")
|
||
|
||
try:
|
||
ev_date = datetime.strptime(event_date.strip(), "%Y-%m-%d").date()
|
||
dl_str = f"{deadline_date.strip()} {deadline_time.strip()}"
|
||
deadline_dt = datetime.strptime(dl_str, "%Y-%m-%d %H:%M")
|
||
except ValueError as e:
|
||
raise HTTPException(status_code=400, detail=f"Ungültiges Datumsformat: {e}")
|
||
|
||
event.title = title.strip()
|
||
event.event_date = ev_date
|
||
event.deadline = deadline_dt
|
||
event.status = status_val
|
||
event.sponsor_name = sponsor_name.strip() if sponsor_name and sponsor_name.strip() else None
|
||
event.allow_guests = allow_guests
|
||
db.commit()
|
||
|
||
return RedirectResponse(url=f"/admin?event_id={event.id}&tab=event", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.post("/admin/events/{event_id}/complete-and-cleanup")
|
||
def admin_complete_event_and_cleanup_guests(
|
||
event_id: int,
|
||
request: Request,
|
||
db: Session = Depends(get_db)
|
||
):
|
||
"""Schließt das Event ab und bereinigt temporäre Gast-Konten."""
|
||
tenant = resolve_tenant(request, db)
|
||
require_admin(request, db)
|
||
|
||
event = db.query(Event).filter(Event.id == event_id, Event.tenant_id == tenant.id).first()
|
||
if not event:
|
||
raise HTTPException(status_code=404, detail="Event nicht gefunden")
|
||
|
||
event.status = "completed"
|
||
|
||
# Gast-Bestellungen sichern und Gast-Konten entfernen
|
||
orders = db.query(Order).filter(Order.event_id == event.id).all()
|
||
cleaned_count = 0
|
||
for ord_obj in orders:
|
||
if ord_obj.user and ord_obj.user.role == "guest":
|
||
ord_obj.guest_display_name = f"{ord_obj.user.first_name} {ord_obj.user.last_name}"
|
||
guest_user = ord_obj.user
|
||
ord_obj.user_id = None
|
||
db.delete(guest_user)
|
||
cleaned_count += 1
|
||
|
||
db.commit()
|
||
msg = f"Event erfolgreich abgeschlossen. {cleaned_count} Gastkonten bereinigt."
|
||
return RedirectResponse(url=f"/admin?event_id={event.id}&tab=orders&success={msg}", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.post("/admin/events/{event_id}/delete")
|
||
def admin_delete_event(
|
||
event_id: int,
|
||
request: Request,
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
require_admin(request, db)
|
||
|
||
event = db.query(Event).filter(Event.id == event_id, Event.tenant_id == tenant.id).first()
|
||
if event:
|
||
db.delete(event)
|
||
db.commit()
|
||
|
||
return RedirectResponse(url="/admin?tab=event", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
# --- ADMIN PRODUCT CATALOG MANAGEMENT ---
|
||
|
||
@app.post("/admin/products/new")
|
||
def admin_create_product(
|
||
request: Request,
|
||
name: str = Form(...),
|
||
description: str = Form(""),
|
||
price: str = Form(...),
|
||
unit: str = Form("Stück"),
|
||
sort_order: int = Form(0),
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
require_admin(request, db)
|
||
|
||
try:
|
||
clean_price = Decimal(price.strip().replace(",", "."))
|
||
except Exception:
|
||
raise HTTPException(status_code=400, detail="Ungültiger Preis")
|
||
|
||
product = Product(
|
||
tenant_id=tenant.id,
|
||
name=name.strip(),
|
||
description=description.strip(),
|
||
price=clean_price,
|
||
unit=unit.strip(),
|
||
sort_order=sort_order,
|
||
is_active=True
|
||
)
|
||
db.add(product)
|
||
db.commit()
|
||
|
||
return RedirectResponse(url="/admin?tab=products", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.post("/admin/products/{product_id}/edit")
|
||
def admin_edit_product(
|
||
product_id: int,
|
||
request: Request,
|
||
name: str = Form(...),
|
||
description: str = Form(""),
|
||
price: str = Form(...),
|
||
unit: str = Form("Stück"),
|
||
sort_order: int = Form(0),
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
require_admin(request, db)
|
||
|
||
prod = db.query(Product).filter(Product.id == product_id, Product.tenant_id == tenant.id).first()
|
||
if not prod:
|
||
raise HTTPException(status_code=404, detail="Produkt nicht gefunden")
|
||
|
||
try:
|
||
clean_price = Decimal(price.strip().replace(",", "."))
|
||
except Exception:
|
||
raise HTTPException(status_code=400, detail="Ungültiger Preis")
|
||
|
||
prod.name = name.strip()
|
||
prod.description = description.strip()
|
||
prod.price = clean_price
|
||
prod.unit = unit.strip()
|
||
prod.sort_order = sort_order
|
||
db.commit()
|
||
|
||
return RedirectResponse(url="/admin?tab=products", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.post("/admin/products/{product_id}/toggle")
|
||
def admin_toggle_product(
|
||
product_id: int,
|
||
request: Request,
|
||
db: Session = Depends(get_db)
|
||
):
|
||
tenant = resolve_tenant(request, db)
|
||
require_admin(request, db)
|
||
|
||
prod = db.query(Product).filter(Product.id == product_id, Product.tenant_id == tenant.id).first()
|
||
if prod:
|
||
prod.is_active = not prod.is_active
|
||
db.commit()
|
||
|
||
return RedirectResponse(url="/admin?tab=products", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
# --- ONBOARDING / SETUP WIZARD (/setup) ---
|
||
|
||
@app.get("/setup", response_class=HTMLResponse)
|
||
def setup_page(request: Request, db: Session = Depends(get_db)):
|
||
tenant = resolve_tenant(request, db)
|
||
if not tenant:
|
||
raise HTTPException(status_code=404, detail="Mandant nicht gefunden")
|
||
|
||
current_user = get_current_user(request, db)
|
||
prod_count = db.query(Product).filter(Product.tenant_id == tenant.id).count()
|
||
user_count = db.query(User).filter(User.tenant_id == tenant.id).count()
|
||
|
||
return templates.TemplateResponse(request, "setup.html", context={
|
||
"tenant": tenant,
|
||
"current_user": current_user,
|
||
"prod_count": prod_count,
|
||
"user_count": user_count
|
||
})
|
||
|
||
|
||
@app.post("/setup/seed-products")
|
||
def seed_standard_products(request: Request, db: Session = Depends(get_db)):
|
||
tenant = resolve_tenant(request, db)
|
||
require_admin(request, db)
|
||
|
||
standard_items = [
|
||
{"name": "Original Münchner Weißwürste", "desc": "Frisch vom Metzger, traditionell hergestellt", "price": Decimal("1.40"), "unit": "Stück", "order": 1},
|
||
{"name": "Frische Laugenbreze", "desc": "Knusprig gebacken, ofenfrisch vom Bäcker", "price": Decimal("1.10"), "unit": "Stück", "order": 2},
|
||
{"name": "Händlmaier Hausmachersenf", "desc": "Original bayerischer süßer Hausmachersenf", "price": Decimal("0.40"), "unit": "Portion", "order": 3},
|
||
{"name": "Leberkassemmel (warm)", "desc": "Feiner bayerischer Leberkäse in der Kaisersemmel", "price": Decimal("2.80"), "unit": "Semmel", "order": 4},
|
||
{"name": "Wiener Würstchen", "desc": "Knackige Wiener Würstchen (Paar)", "price": Decimal("2.60"), "unit": "Paar", "order": 5},
|
||
{"name": "Alkoholfreies Weißbier (0,5l)", "desc": "Erfrischendes bayerisches Hefe-Weißbier alkoholfrei", "price": Decimal("1.80"), "unit": "Flasche", "order": 6},
|
||
]
|
||
|
||
for item in standard_items:
|
||
exists = db.query(Product).filter(Product.tenant_id == tenant.id, Product.name == item["name"]).first()
|
||
if not exists:
|
||
db.add(Product(
|
||
tenant_id=tenant.id,
|
||
name=item["name"],
|
||
description=item["desc"],
|
||
price=item["price"],
|
||
unit=item["unit"],
|
||
sort_order=item["order"],
|
||
is_active=True
|
||
))
|
||
db.commit()
|
||
|
||
return RedirectResponse(url="/admin?tab=products", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.post("/admin/toggle-paid/{order_id}")
|
||
def toggle_paid(order_id: int, request: Request, db: Session = Depends(get_db)):
|
||
current_user = get_current_user(request, db)
|
||
if not current_user:
|
||
return RedirectResponse(url="/login", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
order = db.query(Order).filter(Order.id == order_id).first()
|
||
if order:
|
||
order.is_paid = not order.is_paid
|
||
db.commit()
|
||
return RedirectResponse(url=f"/admin?event_id={order.event_id}", status_code=status.HTTP_303_SEE_OTHER)
|
||
|
||
|
||
@app.get("/health")
|
||
def health():
|
||
return {"status": "ok", "app": "Schmankerl"}
|