v1.2.2: Fix Nominatim CSP, Tenant Admin kann eigene Symbole hochladen

hotfix: fetchData erst nach user.role laden (Mandanten verschwunden)
v1.2.1: Fix Ctrl+Z/Y vertauscht, 401-Fehler TENANT_ADMIN, Symbole groesser, Spenden-Tab verbessert
2026-02-24 22:43:05 +01:00 · 2026-02-24 22:17:12 +01:00 · 2026-02-24 21:51:23 +01:00
6 changed files with 114 additions and 76 deletions
--- a/next.config.js
+++ b/next.config.js
@@ -51,7 +51,7 @@ const nextConfig = {
              "style-src 'self' 'unsafe-inline'",
              "img-src 'self' data: blob: https://*.tile.openstreetmap.org https://api.maptiler.com https://server.arcgisonline.com https://*.geo.admin.ch http://localhost:9000 http://minio:9000",
              "font-src 'self' data:",
-              "connect-src 'self' ws: wss: https://api.maptiler.com https://*.tile.openstreetmap.org https://api.open-meteo.com https://server.arcgisonline.com https://*.geo.admin.ch",
+              "connect-src 'self' ws: wss: https://api.maptiler.com https://*.tile.openstreetmap.org https://nominatim.openstreetmap.org https://api.open-meteo.com https://server.arcgisonline.com https://*.geo.admin.ch",
              "frame-ancestors 'self'",
              "base-uri 'self'",
              "form-action 'self'",
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "lageplan",
-  "version": "1.2.0",
+  "version": "1.2.2",
  "description": "Feuerwehr Lageplan - Krokier-App für Einsatzdokumentation",
  "private": true,
  "scripts": {
--- a/src/app/admin/page.tsx
+++ b/src/app/admin/page.tsx
@@ -250,8 +250,8 @@ export default function AdminPage() {
  }, [authLoading, user, router])

  useEffect(() => {
-    fetchData()
-  }, [])
+    if (user?.role) fetchData()
+  }, [user?.role])

  // Load journal suggestions when tenant is available
  useEffect(() => {
@@ -330,23 +330,39 @@ export default function AdminPage() {
  const fetchData = async () => {
    setIsLoading(true)
    try {
-      const [catRes, iconRes, userRes, tenantRes, projRes] = await Promise.all([
+      const isServerAdmin = user?.role === 'SERVER_ADMIN'
+
+      // Common fetches for all admins
+      const fetches: Promise<Response>[] = [
        fetch('/api/admin/categories'),
-        fetch('/api/admin/icons'),
        fetch('/api/admin/users'),
-        fetch('/api/admin/tenants'),
        fetch('/api/projects'),
-      ])
+      ]
+      // SERVER_ADMIN-only fetches
+      if (isServerAdmin) {
+        fetches.push(fetch('/api/admin/icons'))
+        fetches.push(fetch('/api/admin/tenants'))
+      }
+
+      const results = await Promise.all(fetches)
+      const [catRes, userRes, projRes] = results
+
      if (catRes.ok) setCategories((await catRes.json()).categories || [])
-      if (iconRes.ok) setIcons((await iconRes.json()).icons || [])
      if (userRes.ok) setUsers((await userRes.json()).users || [])
-      if (tenantRes.ok) setTenants((await tenantRes.json()).tenants || [])
      if (projRes.ok) {
        const projData = await projRes.json()
        setAllProjects((projData.projects || []).map((p: any) => ({ id: p.id, title: p.title, location: p.location })))
      }

-      // Load SMTP settings
+      if (isServerAdmin) {
+        const iconRes = results[3]
+        const tenantRes = results[4]
+        if (iconRes.ok) setIcons((await iconRes.json()).icons || [])
+        if (tenantRes.ok) setTenants((await tenantRes.json()).tenants || [])
+      }
+
+      // Load settings (SERVER_ADMIN only)
+      if (isServerAdmin) {
        try {
          const smtpRes = await fetch('/api/admin/settings')
          if (smtpRes.ok) {
@@ -371,6 +387,7 @@ export default function AdminPage() {
            }
          }
        } catch {}
+      }
    } catch (error) {
      console.error('Error fetching data:', error)
    } finally {
@@ -535,7 +552,8 @@ export default function AdminPage() {
      setUploadFiles(null)
      setUploadCategory('')
      setUploadIconName('')
-      fetchData()
+      if (user?.role === 'TENANT_ADMIN') fetchTenantSymbols()
+      else fetchData()
    } catch (error) {
      toast({ title: 'Upload-Fehler', description: error instanceof Error ? error.message : 'Fehler', variant: 'destructive' })
    } finally { setIsUploading(false) }
@@ -879,7 +897,7 @@ export default function AdminPage() {
                      placeholder="Symbole suchen..."
                      value={symbolSearch}
                      onChange={e => setSymbolSearch(e.target.value)}
-                      className="w-48"
+                      className="w-full sm:w-64"
                    />
                    <Select value={symbolCatFilter} onValueChange={setSymbolCatFilter}>
                      <SelectTrigger className="w-[180px]">
@@ -892,9 +910,13 @@ export default function AdminPage() {
                        ))}
                      </SelectContent>
                    </Select>
-                    <span className="text-sm text-muted-foreground ml-auto">
+                    <span className="text-sm text-muted-foreground mr-auto">
                      {tenantSymbols.filter(s => s.isActive).length} aktiv / {tenantSymbols.length} gesamt
                    </span>
+                    <Button onClick={() => setIsUploadDialogOpen(true)}>
+                      <Upload className="w-4 h-4 mr-2" />
+                      Eigene Symbole hochladen
+                    </Button>
                  </div>

                  {/* Bulk category action */}
@@ -947,22 +969,22 @@ export default function AdminPage() {
                          {catName}
                          <span className="text-xs text-muted-foreground font-normal">({syms.length})</span>
                        </h4>
-                        <div className="grid grid-cols-3 sm:grid-cols-4 md:grid-cols-6 lg:grid-cols-8 xl:grid-cols-10 gap-2 mb-4">
+                        <div className="grid grid-cols-2 sm:grid-cols-3 md:grid-cols-4 lg:grid-cols-6 xl:grid-cols-8 gap-3 mb-4">
                          {syms.map(sym => {
                            const selected = selectedSymbolIds.has(sym.id)
                            return (
                              <div
                                key={sym.id}
                                onClick={() => toggleSelect(sym.id)}
-                                className={`relative cursor-pointer border-2 rounded-lg p-2 transition-all hover:shadow-sm ${
+                                className={`relative cursor-pointer border-2 rounded-lg p-3 transition-all hover:shadow-sm ${
                                  selected ? 'border-blue-500 bg-blue-50 dark:bg-blue-950/30' :
                                  sym.isActive ? 'border-transparent hover:border-border' : 'border-transparent opacity-40'
                                }`}
                              >
-                                <div className="aspect-square flex items-center justify-center mb-1 bg-muted/50 rounded">
-                                  <img src={`/api/icons/${sym.id}/image`} alt={sym.name} className="w-10 h-10 object-contain" />
+                                <div className="aspect-square flex items-center justify-center mb-1.5 bg-muted/50 rounded">
+                                  <img src={`/api/icons/${sym.id}/image`} alt={sym.name} className="w-16 h-16 object-contain" />
                                </div>
-                                <p className="text-[10px] text-center truncate" title={sym.name}>{sym.name}</p>
+                                <p className="text-xs text-center truncate" title={sym.name}>{sym.name}</p>
                                {/* Status dot */}
                                <div className={`absolute top-1.5 right-1.5 w-2 h-2 rounded-full ${sym.isActive ? 'bg-green-500' : 'bg-gray-300'}`} />
                              </div>
@@ -1819,24 +1841,41 @@ export default function AdminPage() {
          {user?.role === 'TENANT_ADMIN' && tenant && (
          <TabsContent value="donate" className="space-y-6">
            <div className="border rounded-lg p-6">
-              <h3 className="font-semibold text-lg mb-4">Lageplan unterstützen</h3>
-              <p className="text-muted-foreground mb-4">
-                Lageplan ist ein kostenloses Herzensprojekt. Wenn du die Weiterentwicklung unterstützen möchtest,
-                kannst du auf unserer Spendenseite einen freiwilligen Beitrag leisten.
+              <div className="flex items-start gap-4 mb-6">
+                <div className="w-12 h-12 rounded-full bg-gradient-to-br from-red-500 to-red-700 flex items-center justify-center shrink-0">
+                  <Heart className="w-6 h-6 text-white" />
+                </div>
+                <div>
+                  <h3 className="font-semibold text-lg">Lageplan unterstützen</h3>
+                  <p className="text-sm text-muted-foreground mt-1">
+                    Lageplan ist ein kostenloses Open-Source-Projekt — entwickelt von einem aktiven Feuerwehrmann
+                    in seiner Freizeit. Ohne Firma, ohne Investoren. Deine Spende hilft, den Betrieb und die
+                    Weiterentwicklung zu finanzieren.
                  </p>
+                </div>
+              </div>
+
+              <div className="bg-muted/50 rounded-lg p-4 mb-6">
+                <p className="text-sm font-medium mb-2">Wohin fliesst deine Spende?</p>
+                <ul className="text-sm text-muted-foreground space-y-1">
+                  <li className="flex items-center gap-2"><Shield className="w-3.5 h-3.5 text-primary shrink-0" /> Server-Hosting in der Schweiz (monatliche Kosten)</li>
+                  <li className="flex items-center gap-2"><Settings className="w-3.5 h-3.5 text-primary shrink-0" /> Entwicklung neuer Features und Bugfixes</li>
+                  <li className="flex items-center gap-2"><ShieldCheck className="w-3.5 h-3.5 text-primary shrink-0" /> Domain, SSL-Zertifikate und Infrastruktur</li>
+                </ul>
+              </div>
+
+              <div className="flex flex-wrap gap-3">
                <Button asChild>
                  <a href="/spenden" target="_blank" rel="noopener noreferrer">
                    <Heart className="w-4 h-4 mr-2" />
-                  Zur Spendenseite
+                    Jetzt spenden
                  </a>
                </Button>
-              <div className="mt-6 pt-4 border-t">
-                <p className="text-sm text-muted-foreground">
-                  mit ♥ von Pepe —{' '}
-                  <a href="/" target="_blank" rel="noopener noreferrer" className="text-primary hover:underline">
-                    Über mich & Lageplan
+                <Button variant="outline" asChild>
+                  <a href="/" target="_blank" rel="noopener noreferrer">
+                    Mehr über Lageplan erfahren
                  </a>
-                </p>
+                </Button>
              </div>
            </div>
            <div className="border rounded-lg p-6">
--- a/src/app/api/admin/icons/upload/route.ts
+++ b/src/app/api/admin/icons/upload/route.ts
@@ -10,7 +10,7 @@ const MAX_SIZE = 5 * 1024 * 1024 // 5MB
 export async function POST(req: NextRequest) {
  try {
    const user = await getSession()
-    if (!user || !isAdmin(user.role)) {
+    if (!user || (user.role !== 'SERVER_ADMIN' && user.role !== 'TENANT_ADMIN')) {
      return NextResponse.json({ error: 'Nicht autorisiert' }, { status: 403 })
    }

@@ -55,27 +55,25 @@ export async function POST(req: NextRequest) {

    // Generate safe filename
    const ext = file.name.split('.').pop()?.toLowerCase() || 'png'
+    const isTenantAdmin = user.role === 'TENANT_ADMIN'
+    const prefix = isTenantAdmin ? `tenant-${user.tenantId}/icons` : 'icons'
    const safeFileName = `${uuidv4()}.${ext}`
-    const fileKey = `icons/${safeFileName}`
+    const fileKey = `${prefix}/${safeFileName}`

    // Upload to MinIO
    const buffer = Buffer.from(await file.arrayBuffer())
    await uploadFile(fileKey, buffer, file.type)

-    // TENANT_ADMIN: icons get tenantId. SERVER_ADMIN: global icons (tenantId=null)
-    const tenantId = user.role === 'SERVER_ADMIN' ? null : user.tenantId || null
-
-    // Create database entry
+    // Save to DB
    const icon = await (prisma as any).iconAsset.create({
      data: {
        name: name.trim(),
-        fileKey,
-        mimeType: file.type,
        categoryId,
        iconType: iconType as any,
-        isSystem: false,
-        isActive: true,
-        tenantId,
+        fileKey,
+        mimeType: file.type,
+        isSystem: !isTenantAdmin, // true für Server Admin, false für Tenant Admin
+        tenantId: isTenantAdmin ? user.tenantId : null,
        ownerId: user.id,
      },
      include: {
--- a/src/app/api/icons/route.ts
+++ b/src/app/api/icons/route.ts
@@ -32,7 +32,7 @@ export async function GET() {
        icons: {
          where: user?.tenantId
            ? { isActive: true, OR: [{ tenantId: null }, { tenantId: user.tenantId }] }
-            : { isActive: true },
+            : { isActive: true, tenantId: null },
          orderBy: { name: 'asc' },
        },
      },
--- a/src/app/app/page.tsx
+++ b/src/app/app/page.tsx
@@ -1087,10 +1087,11 @@ export default function AppPage() {
        return
      }

-      // Ctrl/Cmd shortcuts (CH keyboard: Z and Y are swapped)
+      // Ctrl/Cmd shortcuts
      if (e.ctrlKey || e.metaKey) {
-        if (e.key === 'z') { e.preventDefault(); handleRedo(); return }
-        if (e.key === 'y') { e.preventDefault(); handleUndo(); return }
+        if (e.key === 'z' && e.shiftKey) { e.preventDefault(); handleRedo(); return }
+        if (e.key === 'z') { e.preventDefault(); handleUndo(); return }
+        if (e.key === 'y') { e.preventDefault(); handleRedo(); return }
        if (e.key === 's') { e.preventDefault(); handleSaveProject(); return }
        return
      }
@@ -1707,7 +1708,7 @@ export default function AppPage() {
              ))}
              <div className="font-semibold text-muted-foreground col-span-2 mt-3 mb-0.5">Aktionen</div>
              {[
-                ['Ctrl+Y', 'Rückgängig'], ['Ctrl+Z', 'Wiederholen'],
+                ['Ctrl+Z', 'Rückgängig'], ['Ctrl+Y', 'Wiederholen'],
                ['Ctrl+S', 'Speichern'], ['Del', 'Auswahl löschen'],
                ['Esc', 'Abbrechen'], ['?', 'Diese Hilfe'],
              ].map(([key, label]) => (
Author	SHA1	Message	Date
Pepe Ziberi	8ddeb7b377	v1.2.2: Fix Nominatim CSP, Tenant Admin kann eigene Symbole hochladen	2026-02-24 22:43:05 +01:00
Pepe Ziberi	f480905bb9	hotfix: fetchData erst nach user.role laden (Mandanten verschwunden)	2026-02-24 22:17:12 +01:00
Pepe Ziberi	18398e559c	v1.2.1: Fix Ctrl+Z/Y vertauscht, 401-Fehler TENANT_ADMIN, Symbole groesser, Spenden-Tab verbessert	2026-02-24 21:51:23 +01:00