" % html.escape(notice) if notice else ""
- # Der Registrierungs-Link wird nur angezeigt, solange die Ersteinrichtung
- # noch nicht abgeschlossen ist -- danach ist /setup/new gesperrt, ein
- # Link dorthin waere ein toter Verweis (Nutzer-Vorgabe 2026-07-13).
- setup_link_html = ('
' % (html.escape(label), value)
-
-
-def _tickets_body(tenant_id, filter_status=None, filter_kategorie=None):
- tickets = db.list_tickets(tenant_id)
- kpis = _kpis(tickets)
- kpi_html = "".join(_kpi_tile(k, v) for k, v in kpis.items())
- shown = tickets
- if filter_kategorie:
- shown = [t for t in shown if t["kategorie"] == filter_kategorie]
- tabs = [("", "Alle"), ("Offen", "Offen"), ("In Bearbeitung", "In Bearbeitung"),
- ("Warten", "Warten"), ("Geloest", "Geloest"), ("Ueberfaellig", "Ueberfaellig")]
- base = "/probleme" if filter_kategorie == "Problem" else (
- "/aenderungen" if filter_kategorie == "Change" else (
- "/releases" if filter_kategorie == "Release" else "/tickets"))
- tabs_html = "".join(
- '%s' % (
- base, ("?status=" + s) if s else "", "active" if (s or "") == (filter_status or "") else "", label)
- for s, label in tabs)
- if filter_status == "Ueberfaellig":
- shown = [t for t in shown if _is_overdue(t)]
- elif filter_status:
- shown = [t for t in shown if t["status"] == filter_status]
- rows = "".join(_ticket_row(t) for t in shown) or '
Keine Tickets.
'
- services = db.list_services(tenant_id)
- svc_opts = "".join('' % (s["id"], html.escape(s["name"])) for s in services)
- new_form = """
Neues Ticket
-
""" % (
- "".join('' % (c, c) for c in CATEGORIES),
- "".join('' % (p, p) for p in PRIORITIES), svc_opts)
- return """
Tickets
-
%s
-%s
-
%s
-
-
Ticket-Nr
Titel (Service)
Status
Prioritaet
-
Kategorie
Zugewiesen an
Aktualisiert
Fortschritt
-
%s
-""" % (kpi_html, new_form, tabs_html, rows)
-
-
-@app.route("/tickets")
-def tickets_route():
- r = _require_login()
- if r:
- return r
- return _shell("/tickets", "Tickets", _tickets_body(session["tenant_id"], request.args.get("status")))
-
-
-@app.route("/probleme")
-def probleme_route():
- r = _require_login()
- if r:
- return r
- return _shell("/probleme", "Probleme", _tickets_body(session["tenant_id"], request.args.get("status"), "Problem"))
-
-
-@app.route("/aenderungen")
-def aenderungen_route():
- r = _require_login()
- if r:
- return r
- return _shell("/aenderungen", "Aenderungen", _tickets_body(session["tenant_id"], request.args.get("status"), "Change"))
-
-
-@app.route("/releases")
-def releases_route():
- r = _require_login()
- if r:
- return r
- return _shell("/releases", "Releases", _tickets_body(session["tenant_id"], request.args.get("status"), "Release"))
-
-
-@app.route("/tickets/new", methods=["POST"])
-def tickets_new_route():
- r = _require_login()
- if r:
- return r
- tenant_id = session["tenant_id"]
- service_id = request.form.get("service_id") or None
- tid, ticket_nr = db.create_ticket(
- tenant_id,
- request.form.get("titel", "").strip() or "(ohne Titel)",
- request.form.get("beschreibung", "").strip(),
- int(service_id) if service_id else None,
- request.form.get("prioritaet", "Mittel"),
- request.form.get("kategorie", "Task"),
- session.get("email"),
- session["user_id"],
- 480, 2880,
- session.get("email"),
- )
- db.log_audit(tenant_id, session["user_id"], "ticket_created", "ticket", ticket_nr, None, _client_ip())
- return redirect(url_for("tickets_route"))
-
-
-@app.route("/tickets//status", methods=["POST"])
-def ticket_status_route(ticket_id):
- r = _require_login()
- if r:
- return r
- tenant_id = session["tenant_id"]
- status = request.form.get("status", "Offen")
- db.update_ticket_status(tenant_id, ticket_id, status, session.get("email"))
- db.log_audit(tenant_id, session["user_id"], "ticket_status_changed", "ticket", str(ticket_id),
- {"status": status}, _client_ip())
- return jsonify({"ok": True})
-
-
-@app.route("/api/tickets/")
-def api_ticket(ticket_id):
- r = _require_login()
- if r:
- return r
- ticket = db.get_ticket(session["tenant_id"], ticket_id)
- if not ticket:
- abort(404)
- return jsonify(_jsonable(ticket))
-
-
-# ── Repo-Bearbeitung aus Tickets heraus (phase-008-itsm-repo-audit) ─────────────
-def _repo_edit_actor_label():
- """Einheitliches akteur-Label fuer ticket_timeline-Eintraege dieser
- Funktion -- gleiche Konvention wie an anderen Stellen (session.get("email"))."""
- return session.get("email") or "unbekannt"
-
-
-@app.route("/api/tickets//repo-file")
-def api_ticket_repo_file(ticket_id):
- """Laedt eine Datei aus einem Forge-Repo, um sie im Ticket editierbar
- anzuzeigen. Verlangt ein zum Ticket gehoeriges (also existierendes,
- mandanten-eigenes) Ticket, damit die Aktion ueberhaupt einen Ticket-Bezug
- hat -- das ist Voraussetzung fuer den Worklog-Eintrag beim Speichern,
- nicht nur beim Lesen."""
- r = _require_login()
- if r:
- return r
- ticket = db.get_ticket(session["tenant_id"], ticket_id)
- if not ticket:
- abort(404)
- repo = request.args.get("repo", "").strip()
- path = request.args.get("path", "").strip()
- branch = request.args.get("branch", "").strip() or "main"
- if not repo or not path:
- return jsonify({"ok": False, "error": "repo und path sind erforderlich"}), 400
- try:
- text, sha = forge_client.get_contents(repo, path, ref=branch)
- except forge_client.ForgeClientError as e:
- return jsonify({"ok": False, "error": str(e)}), 502
- return jsonify({"ok": True, "content": text, "sha": sha, "repo": repo, "path": path, "branch": branch})
-
-
-@app.route("/tickets//repo-edit", methods=["POST"])
-def ticket_repo_edit_route(ticket_id):
- """Schreibt eine Datei-Aenderung ueber die Forge-Contents-API und
- dokumentiert sie zwingend im Worklog (ticket_timeline) dieses Tickets.
- Harte Anforderung (siehe Modul-Docstring/project.yaml phase-008):
- schlaegt der Worklog-Schreibvorgang fehl, wird KEIN Erfolg gemeldet, auch
- wenn der Forge-Commit zu diesem Zeitpunkt bereits geschrieben wurde --
- ein bereits erfolgter Git-Commit kann nicht atomar mit dem DB-Insert
- zusammengefasst werden (zwei verschiedene Systeme), daher hier stattdessen
- die zweitbeste Garantie: der Nutzer wird nie faelschlich im Glauben
- gelassen, dass alles dokumentiert wurde. Der (dann undokumentierte)
- Forge-Commit bleibt fuer eine manuelle Nachbearbeitung im Server-Log
- sichtbar (siehe except-Zweig unten)."""
- r = _require_login()
- if r:
- return r
- tenant_id = session["tenant_id"]
- ticket = db.get_ticket(tenant_id, ticket_id)
- if not ticket:
- abort(404)
- repo = request.form.get("repo", "").strip()
- path = request.form.get("path", "").strip()
- branch = request.form.get("branch", "").strip() or "main"
- sha = request.form.get("sha", "").strip()
- content = request.form.get("content", "")
- message = request.form.get("message", "").strip()
- if not repo or not path or not sha or not message:
- return jsonify({"ok": False, "error": "repo, path, sha und message sind erforderlich"}), 400
-
- message_with_ticket = "%s (ITSM-Ticket %s)" % (message, ticket["ticket_nr"])
- actor = _repo_edit_actor_label()
- try:
- commit_sha = forge_client.update_contents(
- repo, path, content, sha, branch, message_with_ticket,
- author_name=actor, author_email=(session.get("email") or "itsm@forge.local"),
- )
- except forge_client.ForgeClientError as e:
- return jsonify({"ok": False, "error": str(e)}), 502
-
- try:
- db.log_repo_edit(tenant_id, ticket_id, actor, repo, path, branch, commit_sha)
- except Exception as e:
- # Forge-Commit ist bereits geschrieben (commit_sha oben), aber der
- # Worklog-Eintrag ist NICHT geglueckt -- gemaess phase-008-Vorgabe
- # darf dies nicht als Erfolg gemeldet werden. Der Commit-Sha wird
- # dennoch geloggt, damit eine manuelle Nachdokumentation moeglich
- # bleibt (Konsistenz-Luecke ist sichtbar, nicht verdeckt).
- app.logger.error(
- "phase-008: Forge-Commit %s (Repo %s, Ticket %s) erfolgreich, "
- "aber Worklog-Eintrag fehlgeschlagen: %s", commit_sha, repo, ticket_id, e,
- )
- return jsonify({
- "ok": False,
- "error": "Datei wurde in Forge committet (%s...), aber der Worklog-Eintrag "
- "konnte nicht gespeichert werden. Bitte Admin informieren." % commit_sha[:10],
- }), 500
-
- db.log_audit(tenant_id, session["user_id"], "repo_file_edited", "ticket", str(ticket_id),
- {"repo": repo, "path": path, "branch": branch, "commit": commit_sha}, _client_ip())
- return jsonify({"ok": True, "commit": commit_sha})
-
-
-# ── Service-Katalog ─────────────────────────────────────────────────────────────
-def _service_live_status(endpoint):
- """Prueft die Live-Erreichbarkeit eines gebuchten Service-Endpunkts (z.B. AES-Dashboard).
- Generisch fuer alle Services mit Endpoint, nicht nur AES. Timeout kurz gehalten,
- damit ein haengender/ausgefallener Service den Katalog nicht blockiert.
- Rueckgabe: True (erreichbar) / False (nicht erreichbar) / None (kein Endpoint hinterlegt)."""
- if not endpoint:
- return None
- try:
- req = urllib.request.Request(endpoint, method="GET")
- with urllib.request.urlopen(req, timeout=4) as resp:
- return 200 <= resp.status < 400
- except Exception:
- return False
-
-
-def _services_body(tenant_id):
- services = db.list_services(tenant_id)
- cards = []
- for s in services:
- if not s["gebucht"]:
- badge = 'nicht gebucht'
- elif s.get("endpoint"):
- live = _service_live_status(s["endpoint"])
- if live is True:
- badge = 'gebucht · erreichbar'
- elif live is False:
- badge = 'gebucht · nicht erreichbar'
- else:
- badge = 'gebucht'
- else:
- badge = 'gebucht'
- link = ('
' + "".join(cards) + add_form
-
-
-@app.route("/services")
-def services_route():
- r = _require_login()
- if r:
- return r
- return _shell("/services", "Service-Katalog", _services_body(session["tenant_id"]))
-
-
-@app.route("/services/new", methods=["POST"])
-def services_new_route():
- r = _require_login()
- if r:
- return r
- tenant_id = session["tenant_id"]
- sid = db.create_service(
- tenant_id, request.form.get("name", "").strip(), request.form.get("beschreibung", "").strip(),
- "Sonstiges", True, request.form.get("endpoint", "").strip(),
- )
- db.log_audit(tenant_id, session["user_id"], "service_created", "service", str(sid), None, _client_ip())
- return redirect(url_for("services_route"))
-
-
-# ── Administration: Einstellungen + Audit-Log ──────────────────────────────────
-@app.route("/admin", methods=["GET", "POST"])
-def admin_route():
- r = _require_admin()
- if r:
- return r
- tenant_id = session["tenant_id"]
- notice = ""
- if request.method == "POST":
- db.update_tenant_settings(
- tenant_id,
- request.form.get("dsb_name", "").strip() or None,
- request.form.get("dsb_email", "").strip() or None,
- int(request.form.get("retention_tickets_days") or 1095),
- int(request.form.get("retention_audit_days") or 1825),
- int(request.form.get("sla_antwort_minuten") or 480),
- int(request.form.get("sla_loesung_minuten") or 2880),
- )
- db.log_audit(tenant_id, session["user_id"], "tenant_settings_updated", "tenant", str(tenant_id), None, _client_ip())
- notice = "
Gespeichert.
"
- if request.args.get("cleanup"):
- notice += "
Bereinigung durchgefuehrt -- Details im Audit-Log.
"
- t = db.get_tenant(tenant_id)
- body = """
Einstellungen
-
%s
%s
-
-
-
Aufbewahrungsfrist-Bereinigung
-
Laeuft automatisch alle 24 Stunden im Hintergrund: geloeste/geschlossene Tickets und Audit-Log-Eintraege, die aelter als die oben hinterlegten Fristen sind, werden entfernt. Offene/laufende Tickets werden nie geloescht.
-
-
""" % (
- html.escape(t["name"]), notice, t["sla_antwort_minuten"], t["sla_loesung_minuten"],
- html.escape(t["dsb_name"] or ""), html.escape(t["dsb_email"] or ""),
- t["retention_tickets_days"], t["retention_audit_days"])
- return _shell("/admin", "Einstellungen", body)
-
-
-@app.route("/admin/retention/run", methods=["POST"])
-def admin_retention_run():
- r = _require_admin()
- if r:
- return r
- db.run_retention_cleanup()
- return redirect(url_for("admin_route", cleanup="1"))
-
-
-@app.route("/admin/audit")
-def admin_audit_route():
- r = _require_admin()
- if r:
- return r
- entries = db.list_audit(session["tenant_id"], limit=300)
- rows = "".join(
- "
%s
%s
%s
%s %s
" % (
- e["zeit"].strftime("%Y-%m-%d %H:%M:%S"), html.escape(e["user_email"] or "(unbekannt)"),
- html.escape(e["aktion"]), html.escape(e["entity_typ"] or ""), html.escape(e["entity_id"] or ""))
- for e in entries
- ) or "
Keine Eintraege.
"
- body = """
Audit-Log
-
Alle sicherheitsrelevanten Aktionen dieses Mandanten (Anmeldungen, Aenderungen). Aufbewahrung gemaess Einstellungen.
-
Zeitpunkt (UTC)
Benutzer
Aktion
Objekt
-%s
""" % rows
- return _shell("/admin/audit", "Audit-Log", body)
-
-
-# ── Administration: Benutzerverwaltung ─────────────────────────────────────────
-def _role_pill(role):
- return '%s' % (html.escape(role), html.escape(role))
-
-
-def _users_body(tenant_id, notice="", form_vals=None):
- # form_vals: bei einem fehlgeschlagenen POST die eingegebenen Werte (ausser
- # Passwoerter), damit das Formular nicht komplett geleert wird (Nutzer-
- # Vorgabe 2026-07-13, analog zum gleichen Fix bei /setup/new).
- fv = form_vals or {}
- users = db.list_users(tenant_id)
- rows = []
- for u in users:
- status_pill = ('aktiv'
- if u["active"] else
- 'gesperrt')
- toggle_label = "Sperren" if u["active"] else "Entsperren"
- role_opts = "".join(
- '' % (r, "selected" if r == u["role"] else "", r)
- for r in ("admin", "agent")
- )
- name = " ".join(x for x in (u["vorname"], u["nachname"]) if x) or "--"
- rows.append("""
' % (tabs, search_form, table))
-
-
-@app.route("/wissen")
-def wissen_route():
- r = _require_login()
- if r:
- return r
- return _shell("/wissen", "Wissensdatenbank", _kb_list_body(session["tenant_id"]))
-
-
-@app.route("/wissen/new", methods=["GET", "POST"])
-def wissen_new_route():
- r = _require_login()
- if r:
- return r
- tenant_id = session["tenant_id"]
- error = None
- titel, kategorie, inhalt, tags = "", "Allgemein", "", ""
- if request.method == "POST":
- titel = request.form.get("titel", "").strip()
- kategorie = request.form.get("kategorie", "Allgemein").strip()
- inhalt = request.form.get("inhalt", "").strip()
- tags = request.form.get("tags", "").strip()
- if not titel:
- error = "Titel ist erforderlich."
- elif not inhalt:
- error = "Inhalt darf nicht leer sein."
- else:
- aid = db.create_kb_article(tenant_id, titel, kategorie, inhalt, tags, session["user_id"])
- db.log_audit(tenant_id, session["user_id"], "kb_article_created", "kb_article", str(aid),
- {"titel": titel}, _client_ip())
- return redirect(url_for("wissen_detail_route", article_id=aid))
- kat_opts = "".join('' % (k, "selected" if k == kategorie else "", k)
- for k in KB_KATEGORIEN)
- err_html = "
%s
" % html.escape(error) if error else ""
- body = """
Neuer Wissensartikel
-
%s
""" % (err_html, html.escape(titel), kat_opts, html.escape(inhalt), html.escape(tags))
- return _shell("/wissen", "Neuer Wissensartikel", body)
-
-
-@app.route("/wissen/")
-def wissen_detail_route(article_id):
- r = _require_login()
- if r:
- return r
- a = db.get_kb_article(session["tenant_id"], article_id)
- if not a:
- abort(404)
- tag_pills = "".join('%s' % html.escape(t.strip())
- for t in (a["tags"] or "").split(",") if t.strip())
- body = """
%s
-
%s · %s · aktualisiert %s
-
%s
-
%s
-Bearbeiten
-Zurueck zur Uebersicht""" % (
- html.escape(a["titel"]), html.escape(a["kategorie"]), html.escape(a["autor_email"] or ""),
- a["updated_at"].strftime("%Y-%m-%d %H:%M"), html.escape(a["inhalt"]), tag_pills, a["id"])
- return _shell("/wissen", a["titel"], body)
-
-
-@app.route("/wissen//edit", methods=["GET", "POST"])
-def wissen_edit_route(article_id):
- r = _require_login()
- if r:
- return r
- tenant_id = session["tenant_id"]
- a = db.get_kb_article(tenant_id, article_id)
- if not a:
- abort(404)
- error = None
- if request.method == "POST":
- titel = request.form.get("titel", "").strip()
- kategorie = request.form.get("kategorie", "Allgemein").strip()
- inhalt = request.form.get("inhalt", "").strip()
- tags = request.form.get("tags", "").strip()
- if not titel or not inhalt:
- error = "Titel und Inhalt duerfen nicht leer sein."
- else:
- db.update_kb_article(tenant_id, article_id, titel, kategorie, inhalt, tags)
- db.log_audit(tenant_id, session["user_id"], "kb_article_updated", "kb_article", str(article_id),
- {"titel": titel}, _client_ip())
- return redirect(url_for("wissen_detail_route", article_id=article_id))
- a = dict(a)
- a.update({"titel": titel, "kategorie": kategorie, "inhalt": inhalt, "tags": tags})
- kat_opts = "".join('' % (k, "selected" if k == a["kategorie"] else "", k)
- for k in KB_KATEGORIEN)
- err_html = "
%s
" % html.escape(error) if error else ""
- body = """
Artikel bearbeiten
-
%s
-
""" % (err_html, html.escape(a["titel"]), kat_opts, html.escape(a["inhalt"]), html.escape(a["tags"] or ""), article_id)
- return _shell("/wissen", "Artikel bearbeiten", body)
-
-
-@app.route("/wissen//delete", methods=["POST"])
-def wissen_delete_route(article_id):
- r = _require_login()
- if r:
- return r
- tenant_id = session["tenant_id"]
- db.delete_kb_article(tenant_id, article_id)
- db.log_audit(tenant_id, session["user_id"], "kb_article_deleted", "kb_article", str(article_id), None, _client_ip())
- return redirect(url_for("wissen_route"))
-
-
-# ── CMDB (Configuration Management Database) ───────────────────────────────────
-def _ci_status_pill(status):
- cls = {"Aktiv": "geloest", "Inaktiv": "geschlossen", "Wartung": "bearbeitung", "Ausgemustert": "ueberfaellig"}.get(status, "offen")
- return '%s' % (cls, html.escape(status))
-
-
-def _cmdb_list_body(tenant_id):
- ci_typ = request.args.get("typ") or None
- cis = db.list_cis(tenant_id, ci_typ=ci_typ)
- tabs = 'Alle' % ("active" if not ci_typ else "")
- tabs += "".join('%s' % (t, "active" if ci_typ == t else "", t) for t in CI_TYPES)
- rows = []
- for c in cis:
- rows.append("""
' % (tabs, table))
-
-
-@app.route("/assets")
-def assets_route():
- r = _require_login()
- if r:
- return r
- return _shell("/assets", "CMDB", _cmdb_list_body(session["tenant_id"]))
-
-
-@app.route("/assets/new", methods=["GET", "POST"])
-def assets_new_route():
- r = _require_login()
- if r:
- return r
- tenant_id = session["tenant_id"]
- error = None
- name, ci_typ, status, beschreibung, attr_text = "", "Server", "Aktiv", "", ""
- if request.method == "POST":
- name = request.form.get("name", "").strip()
- ci_typ = request.form.get("ci_typ", "Sonstiges").strip()
- status = request.form.get("status", "Aktiv").strip()
- beschreibung = request.form.get("beschreibung", "").strip()
- attr_text = request.form.get("attribute", "")
- if not name:
- error = "Name ist erforderlich."
- else:
- cid = db.create_ci(tenant_id, name, ci_typ, status, beschreibung, _text_to_attrs(attr_text))
- db.log_audit(tenant_id, session["user_id"], "ci_created", "ci", str(cid),
- {"name": name, "ci_typ": ci_typ}, _client_ip())
- return redirect(url_for("assets_detail_route", ci_id=cid))
- typ_opts = "".join('' % (t, "selected" if t == ci_typ else "", t) for t in CI_TYPES)
- status_opts = "".join('' % (s, "selected" if s == status else "", s) for s in CI_STATUS)
- err_html = "
%s
" % html.escape(error) if error else ""
- body = """
Neues Configuration Item
-
%s
""" % (err_html, html.escape(name), typ_opts, status_opts, html.escape(beschreibung), html.escape(attr_text))
- return _shell("/assets", "Neues Configuration Item", body)
-
-
-@app.route("/assets/", methods=["GET", "POST"])
-def assets_detail_route(ci_id):
- r = _require_login()
- if r:
- return r
- tenant_id = session["tenant_id"]
- error = None
- if request.method == "POST":
- name = request.form.get("name", "").strip()
- ci_typ = request.form.get("ci_typ", "Sonstiges").strip()
- status = request.form.get("status", "Aktiv").strip()
- beschreibung = request.form.get("beschreibung", "").strip()
- attr_text = request.form.get("attribute", "")
- if not name:
- error = "Name ist erforderlich."
- else:
- db.update_ci(tenant_id, ci_id, name, ci_typ, status, beschreibung, _text_to_attrs(attr_text))
- db.log_audit(tenant_id, session["user_id"], "ci_updated", "ci", str(ci_id), {"name": name}, _client_ip())
- c = db.get_ci(tenant_id, ci_id)
- if not c:
- abort(404)
- typ_opts = "".join('' % (t, "selected" if t == c["ci_typ"] else "", t) for t in CI_TYPES)
- status_opts = "".join('' % (s, "selected" if s == c["status"] else "", s) for s in CI_STATUS)
- err_html = "
%s
" % html.escape(error) if error else ""
-
- other_cis = [x for x in db.list_cis(tenant_id) if x["id"] != ci_id]
- ci_opts = "".join('' % (x["id"], html.escape(x["name"]), x["ci_typ"]) for x in other_cis)
- rel_typ_opts = "".join('' % (t, t) for t in REL_TYPES)
- rel_out_rows = "".join(
- "
%s %s
" % (
- html.escape(r["beziehungs_typ"]), html.escape(r["to_name"]), ci_id, r["id"])
- for r in c["rel_out"]
- ) or "
Keine ausgehenden Beziehungen.
"
- rel_in_rows = "".join(
- "
%s %s(eingehend)
" % (
- html.escape(r["beziehungs_typ"]), html.escape(r["from_name"]))
- for r in c["rel_in"]
- ) or "
Keine eingehenden Beziehungen.
"
-
- body = """
%s
-
%s
-
Beziehungen
-
-
Ausgehend
%s
-
Eingehend
%s
-
Neue Beziehung
-
-
""" % (
- html.escape(c["name"]), err_html, html.escape(c["name"]), typ_opts, status_opts,
- html.escape(c["beschreibung"] or ""), _attrs_to_text(c["attribute"]),
- rel_out_rows, rel_in_rows, ci_id, rel_typ_opts, ci_opts,
- )
- return _shell("/assets", c["name"], body)
-
-
-@app.route("/assets//relationships", methods=["POST"])
-def assets_relationship_add_route(ci_id):
- r = _require_login()
- if r:
- return r
- tenant_id = session["tenant_id"]
- to_ci_id = request.form.get("to_ci_id", type=int)
- beziehungs_typ = request.form.get("beziehungs_typ", "haengt ab von").strip()
- if to_ci_id and to_ci_id != ci_id:
- rid = db.create_ci_relationship(tenant_id, ci_id, to_ci_id, beziehungs_typ)
- db.log_audit(tenant_id, session["user_id"], "ci_relationship_created", "ci_relationship", str(rid),
- {"from": ci_id, "to": to_ci_id, "typ": beziehungs_typ}, _client_ip())
- return redirect(url_for("assets_detail_route", ci_id=ci_id))
-
-
-@app.route("/assets//relationships//delete", methods=["POST"])
-def assets_relationship_delete_route(ci_id, rel_id):
- r = _require_login()
- if r:
- return r
- tenant_id = session["tenant_id"]
- db.delete_ci_relationship(tenant_id, rel_id)
- db.log_audit(tenant_id, session["user_id"], "ci_relationship_deleted", "ci_relationship", str(rel_id), None, _client_ip())
- return redirect(url_for("assets_detail_route", ci_id=ci_id))
-
-
-@app.route("/")
-def root_route():
- if not db.any_tenant_exists():
- return redirect(url_for("setup_new"))
- if session.get("user_id"):
- return redirect(url_for("tickets_route"))
- return redirect(url_for("login"))
-
-
-@app.route("/health")
-def health_route():
- try:
- with db.get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute("SELECT 1")
- return jsonify({"status": "ok", "db": "ok"})
- except Exception as e:
- return jsonify({"status": "error", "db": str(e)}), 500
-
-
-db.init_db()
-
-
-def _retention_loop():
- """Hintergrund-Thread: bereinigt abgelaufene Daten periodisch (siehe
- db.run_retention_cleanup). Laeuft einmal kurz nach dem Start und danach im
- festen Intervall. Der Postgres-Advisory-Lock in run_retention_cleanup()
- schuetzt davor, dass mehrere Worker/Prozesse gleichzeitig loeschen."""
- time.sleep(30)
- while True:
- try:
- db.run_retention_cleanup()
- except Exception as e:
- print("[retention] Fehler bei der Bereinigung:", e, flush=True)
- time.sleep(RETENTION_INTERVAL_SECONDS)
-
-
-threading.Thread(target=_retention_loop, daemon=True).start()
-
-
-if __name__ == "__main__":
- app.run(host="0.0.0.0", port=8090)
diff --git a/db.py b/db.py
deleted file mode 100644
index 857bbf8..0000000
--- a/db.py
+++ /dev/null
@@ -1,547 +0,0 @@
-"""
-Datenzugriffsschicht fuer die ITSM-Plattform (PostgreSQL, mandantenfaehig).
-
-Ersetzt die fruehere JSON-Datei-Ablage. Grund: Betrieb unter ISO 27001, DSGVO
-und NIS 2 verlangt belastbare Zugriffskontrolle, Nachvollziehbarkeit (Audit-Log)
-und geordnete Backup-/Wiederherstellungsfaehigkeit -- das leistet eine Datei-
-Ablage nicht.
-
-ENV:
- DATABASE_URL postgresql://user:pass@host:5432/dbname
-"""
-import os
-import json
-import datetime as _dt
-from contextlib import contextmanager
-
-import psycopg2
-import psycopg2.extras
-import psycopg2.pool
-
-DATABASE_URL = os.getenv("DATABASE_URL", "")
-
-_pool = None
-
-
-def _get_pool():
- global _pool
- if _pool is None:
- _pool = psycopg2.pool.SimpleConnectionPool(1, 10, dsn=DATABASE_URL)
- return _pool
-
-
-@contextmanager
-def get_conn():
- pool = _get_pool()
- conn = pool.getconn()
- try:
- yield conn
- conn.commit()
- except Exception:
- conn.rollback()
- raise
- finally:
- pool.putconn(conn)
-
-
-def _dict_cursor(conn):
- return conn.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
-
-
-def init_db():
- """Legt das Schema an (idempotent). Wird beim App-Start aufgerufen."""
- here = os.path.dirname(os.path.abspath(__file__))
- schema_path = os.path.join(here, "schema.sql")
- with open(schema_path, "r", encoding="utf-8") as f:
- ddl = f.read()
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute(ddl)
-
-
-def any_tenant_exists():
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute("SELECT 1 FROM tenants LIMIT 1")
- return cur.fetchone() is not None
-
-
-# ── Tenants / Ersteinrichtung ──────────────────────────────────────────────────
-def create_tenant(name, dsb_name, dsb_email, retention_tickets_days,
- retention_audit_days, sla_antwort_minuten, sla_loesung_minuten):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- """INSERT INTO tenants
- (name, dsb_name, dsb_email, retention_tickets_days,
- retention_audit_days, sla_antwort_minuten, sla_loesung_minuten)
- VALUES (%s,%s,%s,%s,%s,%s,%s) RETURNING id""",
- (name, dsb_name, dsb_email, retention_tickets_days,
- retention_audit_days, sla_antwort_minuten, sla_loesung_minuten),
- )
- return cur.fetchone()["id"]
-
-
-def get_tenant(tenant_id):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute("SELECT * FROM tenants WHERE id=%s", (tenant_id,))
- return cur.fetchone()
-
-
-def update_tenant_settings(tenant_id, dsb_name, dsb_email, retention_tickets_days,
- retention_audit_days, sla_antwort_minuten, sla_loesung_minuten):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute(
- """UPDATE tenants SET dsb_name=%s, dsb_email=%s,
- retention_tickets_days=%s, retention_audit_days=%s,
- sla_antwort_minuten=%s, sla_loesung_minuten=%s
- WHERE id=%s""",
- (dsb_name, dsb_email, retention_tickets_days, retention_audit_days,
- sla_antwort_minuten, sla_loesung_minuten, tenant_id),
- )
-
-
-# ── Users ───────────────────────────────────────────────────────────────────────
-def create_user(tenant_id, email, password_hash, role="admin",
- vorname=None, nachname=None, telefon=None, abteilung=None, adresse=None):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- """INSERT INTO users (tenant_id, email, password_hash, role,
- vorname, nachname, telefon, abteilung, adresse)
- VALUES (%s,%s,%s,%s,%s,%s,%s,%s,%s) RETURNING id""",
- (tenant_id, email, password_hash, role, vorname, nachname, telefon, abteilung, adresse),
- )
- return cur.fetchone()["id"]
-
-
-def get_user_by_email(email):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute("SELECT * FROM users WHERE email=%s AND active=TRUE", (email,))
- return cur.fetchone()
-
-
-def touch_last_login(user_id):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute("UPDATE users SET last_login_at=now() WHERE id=%s", (user_id,))
-
-
-def email_exists(email):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute("SELECT 1 FROM users WHERE email=%s", (email,))
- return cur.fetchone() is not None
-
-
-def email_exists_excluding(email, exclude_user_id):
- """Wie email_exists, aber ignoriert den eigenen Datensatz -- fuer die
- Eindeutigkeitspruefung beim Aendern der E-Mail eines bestehenden Nutzers."""
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute("SELECT 1 FROM users WHERE email=%s AND id<>%s", (email, exclude_user_id))
- return cur.fetchone() is not None
-
-
-_USER_COLUMNS = ("id, email, role, active, auth_source, created_at, last_login_at, "
- "vorname, nachname, telefon, abteilung, adresse")
-
-
-def list_users(tenant_id):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- "SELECT %s FROM users WHERE tenant_id=%%s ORDER BY email" % _USER_COLUMNS, (tenant_id,))
- return cur.fetchall()
-
-
-def get_user(tenant_id, user_id):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- "SELECT %s FROM users WHERE tenant_id=%%s AND id=%%s" % _USER_COLUMNS, (tenant_id, user_id))
- return cur.fetchone()
-
-
-def update_user_profile(tenant_id, user_id, vorname, nachname, telefon, abteilung, adresse):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute(
- """UPDATE users SET vorname=%s, nachname=%s, telefon=%s, abteilung=%s, adresse=%s
- WHERE tenant_id=%s AND id=%s""",
- (vorname, nachname, telefon, abteilung, adresse, tenant_id, user_id),
- )
-
-
-def update_user_email(tenant_id, user_id, email):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute("UPDATE users SET email=%s WHERE tenant_id=%s AND id=%s", (email, tenant_id, user_id))
-
-
-def set_user_role(tenant_id, user_id, role):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute("UPDATE users SET role=%s WHERE tenant_id=%s AND id=%s", (role, tenant_id, user_id))
-
-
-def set_user_active(tenant_id, user_id, active):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute("UPDATE users SET active=%s WHERE tenant_id=%s AND id=%s", (active, tenant_id, user_id))
-
-
-# ── Audit-Log ───────────────────────────────────────────────────────────────────
-def log_audit(tenant_id, user_id, aktion, entity_typ=None, entity_id=None, details=None, ip=None):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute(
- """INSERT INTO audit_log (tenant_id, user_id, aktion, entity_typ, entity_id, details, ip)
- VALUES (%s,%s,%s,%s,%s,%s,%s)""",
- (tenant_id, user_id, aktion, entity_typ, entity_id,
- json.dumps(details) if details is not None else None, ip),
- )
-
-
-def list_audit(tenant_id, limit=200):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- """SELECT a.*, u.email AS user_email FROM audit_log a
- LEFT JOIN users u ON u.id = a.user_id
- WHERE a.tenant_id=%s ORDER BY a.zeit DESC LIMIT %s""",
- (tenant_id, limit),
- )
- return cur.fetchall()
-
-
-# ── Services ────────────────────────────────────────────────────────────────────
-def create_service(tenant_id, name, beschreibung, kategorie, gebucht, endpoint):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- """INSERT INTO services (tenant_id, name, beschreibung, kategorie, gebucht, endpoint)
- VALUES (%s,%s,%s,%s,%s,%s) RETURNING id""",
- (tenant_id, name, beschreibung, kategorie, gebucht, endpoint),
- )
- return cur.fetchone()["id"]
-
-
-def list_services(tenant_id):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute("SELECT * FROM services WHERE tenant_id=%s ORDER BY id", (tenant_id,))
- return cur.fetchall()
-
-
-# ── Tickets ─────────────────────────────────────────────────────────────────────
-def _next_ticket_nr(tenant_id):
- year = _dt.datetime.utcnow().year
- prefix = "TKT-%d-" % year
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute(
- """SELECT ticket_nr FROM tickets
- WHERE tenant_id=%s AND ticket_nr LIKE %s
- ORDER BY ticket_nr DESC LIMIT 1""",
- (tenant_id, prefix + "%"),
- )
- row = cur.fetchone()
- seq = 1
- if row:
- try:
- seq = int(row[0].split("-")[-1]) + 1
- except Exception:
- seq = 1
- return "%s%06d" % (prefix, seq)
-
-
-def create_ticket(tenant_id, titel, beschreibung, service_id, prioritaet, kategorie,
- zugewiesen_an, ersteller_id, sla_antwort_minuten, sla_loesung_minuten,
- actor_label):
- ticket_nr = _next_ticket_nr(tenant_id)
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- """INSERT INTO tickets
- (tenant_id, ticket_nr, titel, beschreibung, service_id, prioritaet,
- kategorie, zugewiesen_an, ersteller_id, sla_antwort_minuten, sla_loesung_minuten)
- VALUES (%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s) RETURNING id""",
- (tenant_id, ticket_nr, titel, beschreibung, service_id, prioritaet,
- kategorie, zugewiesen_an, ersteller_id, sla_antwort_minuten, sla_loesung_minuten),
- )
- tid = cur.fetchone()["id"]
- cur.execute(
- """INSERT INTO ticket_timeline (ticket_id, tenant_id, akteur, text)
- VALUES (%s,%s,%s,%s)""",
- (tid, tenant_id, actor_label, "Ticket angelegt."),
- )
- return tid, ticket_nr
-
-
-def list_tickets(tenant_id):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- """SELECT t.*, s.name AS service_name FROM tickets t
- LEFT JOIN services s ON s.id = t.service_id
- WHERE t.tenant_id=%s ORDER BY t.updated_at DESC""",
- (tenant_id,),
- )
- return cur.fetchall()
-
-
-def get_ticket(tenant_id, ticket_id):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- """SELECT t.*, s.name AS service_name FROM tickets t
- LEFT JOIN services s ON s.id = t.service_id
- WHERE t.tenant_id=%s AND t.id=%s""",
- (tenant_id, ticket_id),
- )
- ticket = cur.fetchone()
- if not ticket:
- return None
- cur.execute(
- "SELECT * FROM ticket_timeline WHERE ticket_id=%s ORDER BY zeit DESC",
- (ticket_id,),
- )
- ticket = dict(ticket)
- ticket["timeline"] = cur.fetchall()
- return ticket
-
-
-def log_repo_edit(tenant_id, ticket_id, actor_label, repo, path, branch, commit_sha):
- """Schreibt einen Worklog-Eintrag fuer eine ueber ITSM vorgenommene
- Forge-Repo-Aenderung (phase-008-itsm-repo-audit, Nutzer-Vorgabe
- 2026-07-14: JEDE Repo-Aenderung ueber ITSM muss im Worklog des
- zugehoerigen Projekttickets dokumentiert werden). Nutzt die bestehende
- ticket_timeline-Tabelle -- kein neues Datenmodell noetig, gleiches
- Insert-Muster wie update_ticket_status/create_ticket. Wirft bei einem
- DB-Fehler regulaer weiter (Aufrufer in app.py MUSS das als Fehlschlag
- behandeln und darf den Repo-Commit dann nicht als erfolgreich melden --
- siehe project.yaml phase-008)."""
- text = "Repo-Datei bearbeitet: %s@%s (%s) -- Commit %s" % (repo, branch, path, commit_sha[:10])
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute(
- """INSERT INTO ticket_timeline (ticket_id, tenant_id, akteur, text)
- VALUES (%s,%s,%s,%s)""",
- (ticket_id, tenant_id, actor_label, text),
- )
-
-
-def update_ticket_status(tenant_id, ticket_id, status, actor_label):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute(
- """UPDATE tickets SET status=%s, updated_at=now(),
- fortschritt = CASE WHEN %s IN ('Geloest','Geschlossen') THEN 100 ELSE fortschritt END
- WHERE tenant_id=%s AND id=%s""",
- (status, status, tenant_id, ticket_id),
- )
- cur.execute(
- """INSERT INTO ticket_timeline (ticket_id, tenant_id, akteur, text)
- VALUES (%s,%s,%s,%s)""",
- (ticket_id, tenant_id, actor_label, "Status geaendert auf '%s'." % status),
- )
-
-
-# ── Aufbewahrungsfrist-Bereinigung (DSGVO Speicherbegrenzung) ─────────────────
-_RETENTION_LOCK_KEY = 727271 # feste Postgres-Advisory-Lock-ID fuer diesen Job
-
-
-def run_retention_cleanup():
- """Loescht abgeschlossene Tickets und Audit-Log-Eintraege, die aelter sind
- als die pro Mandant hinterlegte Aufbewahrungsfrist (retention_tickets_days /
- retention_audit_days). Offene/laufende Tickets werden NIE geloescht, nur
- solche im Status 'Geloest'/'Geschlossen'.
-
- Nutzt einen Postgres-Advisory-Lock: laeuft der Job bereits (z. B. durch
- einen anderen Worker-Prozess), wird dieser Aufruf uebersprungen statt
- parallel zu loeschen.
- """
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute("SELECT pg_try_advisory_lock(%s)", (_RETENTION_LOCK_KEY,))
- got_lock = cur.fetchone()[0]
- if not got_lock:
- return {"skipped": "lock_not_acquired"}
- try:
- with _dict_cursor(conn) as cur:
- cur.execute("SELECT id, name, retention_tickets_days, retention_audit_days FROM tenants")
- tenants = cur.fetchall()
- summary = []
- for t in tenants:
- tid = t["id"]
- with conn.cursor() as cur:
- cur.execute(
- """DELETE FROM tickets WHERE tenant_id=%s AND status IN ('Geloest','Geschlossen')
- AND updated_at < now() - (%s || ' days')::interval""",
- (tid, t["retention_tickets_days"]),
- )
- tickets_deleted = cur.rowcount
- cur.execute(
- """DELETE FROM audit_log WHERE tenant_id=%s AND aktion <> 'retention_cleanup'
- AND zeit < now() - (%s || ' days')::interval""",
- (tid, t["retention_audit_days"]),
- )
- audit_deleted = cur.rowcount
- if tickets_deleted or audit_deleted:
- log_audit(tid, None, "retention_cleanup", "tenant", str(tid),
- {"tickets_deleted": tickets_deleted, "audit_log_deleted": audit_deleted})
- summary.append({"tenant_id": tid, "tenant": t["name"],
- "tickets_deleted": tickets_deleted, "audit_log_deleted": audit_deleted})
- return {"summary": summary}
- finally:
- with conn.cursor() as cur:
- cur.execute("SELECT pg_advisory_unlock(%s)", (_RETENTION_LOCK_KEY,))
-
-
-
-# ── CMDB (Configuration Management Database) ─────────────────────────────────
-def create_ci(tenant_id, name, ci_typ, status, beschreibung, attribute):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- """INSERT INTO configuration_items
- (tenant_id, name, ci_typ, status, beschreibung, attribute)
- VALUES (%s,%s,%s,%s,%s,%s) RETURNING id""",
- (tenant_id, name, ci_typ, status, beschreibung, json.dumps(attribute or {})),
- )
- return cur.fetchone()["id"]
-
-
-def list_cis(tenant_id, ci_typ=None):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- if ci_typ:
- cur.execute(
- "SELECT * FROM configuration_items WHERE tenant_id=%s AND ci_typ=%s ORDER BY name",
- (tenant_id, ci_typ))
- else:
- cur.execute(
- "SELECT * FROM configuration_items WHERE tenant_id=%s ORDER BY ci_typ, name",
- (tenant_id,))
- return cur.fetchall()
-
-
-def get_ci(tenant_id, ci_id):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- "SELECT * FROM configuration_items WHERE tenant_id=%s AND id=%s",
- (tenant_id, ci_id))
- ci = cur.fetchone()
- if not ci:
- return None
- ci = dict(ci)
- cur.execute(
- """SELECT r.*, c.name AS to_name FROM ci_relationships r
- JOIN configuration_items c ON c.id = r.to_ci_id
- WHERE r.tenant_id=%s AND r.from_ci_id=%s ORDER BY r.id""",
- (tenant_id, ci_id))
- ci["rel_out"] = cur.fetchall()
- cur.execute(
- """SELECT r.*, c.name AS from_name FROM ci_relationships r
- JOIN configuration_items c ON c.id = r.from_ci_id
- WHERE r.tenant_id=%s AND r.to_ci_id=%s ORDER BY r.id""",
- (tenant_id, ci_id))
- ci["rel_in"] = cur.fetchall()
- return ci
-
-
-def update_ci(tenant_id, ci_id, name, ci_typ, status, beschreibung, attribute):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute(
- """UPDATE configuration_items SET name=%s, ci_typ=%s, status=%s,
- beschreibung=%s, attribute=%s, updated_at=now()
- WHERE tenant_id=%s AND id=%s""",
- (name, ci_typ, status, beschreibung, json.dumps(attribute or {}), tenant_id, ci_id),
- )
-
-
-def delete_ci(tenant_id, ci_id):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute("DELETE FROM configuration_items WHERE tenant_id=%s AND id=%s", (tenant_id, ci_id))
-
-
-def create_ci_relationship(tenant_id, from_ci_id, to_ci_id, beziehungs_typ):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- """INSERT INTO ci_relationships (tenant_id, from_ci_id, to_ci_id, beziehungs_typ)
- VALUES (%s,%s,%s,%s) RETURNING id""",
- (tenant_id, from_ci_id, to_ci_id, beziehungs_typ),
- )
- return cur.fetchone()["id"]
-
-
-def delete_ci_relationship(tenant_id, rel_id):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute("DELETE FROM ci_relationships WHERE tenant_id=%s AND id=%s", (tenant_id, rel_id))
-
-
-# ── Wissensdatenbank ──────────────────────────────────────────────────────────
-def create_kb_article(tenant_id, titel, kategorie, inhalt, tags, autor_user_id):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- """INSERT INTO kb_articles (tenant_id, titel, kategorie, inhalt, tags, autor_user_id)
- VALUES (%s,%s,%s,%s,%s,%s) RETURNING id""",
- (tenant_id, titel, kategorie, inhalt, tags, autor_user_id),
- )
- return cur.fetchone()["id"]
-
-
-def list_kb_articles(tenant_id, kategorie=None, q=None):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- sql = """SELECT k.*, u.email AS autor_email FROM kb_articles k
- LEFT JOIN users u ON u.id = k.autor_user_id
- WHERE k.tenant_id=%s"""
- params = [tenant_id]
- if kategorie:
- sql += " AND k.kategorie=%s"
- params.append(kategorie)
- if q:
- sql += " AND (k.titel ILIKE %s OR k.inhalt ILIKE %s OR k.tags ILIKE %s)"
- like = "%%%s%%" % q
- params += [like, like, like]
- sql += " ORDER BY k.updated_at DESC"
- cur.execute(sql, params)
- return cur.fetchall()
-
-
-def get_kb_article(tenant_id, article_id):
- with get_conn() as conn:
- with _dict_cursor(conn) as cur:
- cur.execute(
- """SELECT k.*, u.email AS autor_email FROM kb_articles k
- LEFT JOIN users u ON u.id = k.autor_user_id
- WHERE k.tenant_id=%s AND k.id=%s""",
- (tenant_id, article_id))
- return cur.fetchone()
-
-
-def update_kb_article(tenant_id, article_id, titel, kategorie, inhalt, tags):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute(
- """UPDATE kb_articles SET titel=%s, kategorie=%s, inhalt=%s, tags=%s, updated_at=now()
- WHERE tenant_id=%s AND id=%s""",
- (titel, kategorie, inhalt, tags, tenant_id, article_id),
- )
-
-
-def delete_kb_article(tenant_id, article_id):
- with get_conn() as conn:
- with conn.cursor() as cur:
- cur.execute("DELETE FROM kb_articles WHERE tenant_id=%s AND id=%s", (tenant_id, article_id))
diff --git a/deploy/backup.sh b/deploy/backup.sh
old mode 100644
new mode 100755
diff --git a/deploy/bootstrap.sh b/deploy/bootstrap.sh
deleted file mode 100644
index 28d776b..0000000
--- a/deploy/bootstrap.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/bin/sh
-set -e
-export DEBIAN_FRONTEND=noninteractive
-echo "[bootstrap-itsm] Installiere OS-Abhaengigkeiten..."
-apt-get update -qq && apt-get install -y -qq --no-install-recommends git ca-certificates >/dev/null
-
-echo "[bootstrap-itsm] Hole ITSM-Quellcode von Gitea (git clone)..."
-rm -rf /opt/itsm-src
-git clone --depth 1 https://git1.mrmoe.de/mscadm/ITSM.git /opt/itsm-src >/dev/null 2>&1
-
-echo "[bootstrap-itsm] Installiere Python-Abhaengigkeiten..."
-pip install --quiet --root-user-action=ignore -r /opt/itsm-src/requirements.txt
-
-echo "[bootstrap-itsm] Bereite App vor..."
-mkdir -p /app
-cp /opt/itsm-src/app.py /app/app.py
-cp /opt/itsm-src/db.py /app/db.py
-cp /opt/itsm-src/schema.sql /app/schema.sql
-
-echo "[bootstrap-itsm] Sync abgeschlossen, starte gunicorn."
-cd /app
-exec gunicorn -b 0.0.0.0:8090 --worker-class gthread -w 1 --threads 4 --timeout 120 app:app
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
old mode 100644
new mode 100755
index e565bbf..13eef35
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -1,12 +1,25 @@
+# ITSM-Deployment (Rust-Version).
+#
+# Aufsetzen:
+# 1. Repo nach /docker/itsm/src klonen (oder Build-Kontext anpassen)
+# 2. .env mit POSTGRES_PASSWORD anlegen
+# 3. docker compose up -d --build
+#
+# Update: git pull im Quell-Checkout, dann docker compose up -d --build.
+# Anders als frueher wird beim Container-NEUSTART kein Code mehr aus dem
+# Git gezogen -- ein Neustart startet exakt das gebaute Image (reproduzierbar,
+# kein ungetesteter main-Stand in Prod).
services:
postgres:
+ # Bewusst bei postgres:16 bleiben: das bestehende pgdata-Verzeichnis ist
+ # mit 16 initialisiert; ein Major-Upgrade braucht pg_upgrade/dump+restore.
image: postgres:16-alpine
container_name: itsm_postgres
restart: unless-stopped
environment:
POSTGRES_DB: itsm
POSTGRES_USER: itsm
- POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-}
+ POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD muss gesetzt sein}
volumes:
- ./pgdata:/var/lib/postgresql/data
healthcheck:
@@ -16,9 +29,10 @@ services:
retries: 10
itsm:
- image: python:3.12-slim
+ build:
+ context: ../
+ dockerfile: Dockerfile
container_name: itsm_app
- command: ["sh", "/bootstrap.sh"]
restart: unless-stopped
depends_on:
postgres:
@@ -26,10 +40,15 @@ services:
ports:
- "8090:8090"
environment:
- DATABASE_URL: postgresql://itsm:${POSTGRES_PASSWORD:-}@postgres:5432/itsm
- ITSM_SECRET_KEY: ${ITSM_SECRET_KEY:-}
+ DATABASE_URL: postgresql://itsm:${POSTGRES_PASSWORD}@postgres:5432/itsm
AES_DASHBOARD_URL: ${AES_DASHBOARD_URL:-http://host.docker.internal:8080}
- volumes:
- - ./bootstrap.sh:/bootstrap.sh:ro
+ FORGE_BASE_URL: ${FORGE_BASE_URL:-}
+ FORGE_SERVICE_TOKEN: ${FORGE_SERVICE_TOKEN:-}
+ # Hinter TLS-Terminierung (Reverse Proxy) setzen:
+ # ITSM_HTTPS: "1"
+ # ITSM_TRUSTED_PROXY_COUNT: "1"
+ ITSM_HTTPS: ${ITSM_HTTPS:-0}
+ ITSM_TRUSTED_PROXY_COUNT: ${ITSM_TRUSTED_PROXY_COUNT:-0}
+ RUST_LOG: ${RUST_LOG:-info}
extra_hosts:
- "host.docker.internal:host-gateway"
diff --git a/forge_client.py b/forge_client.py
deleted file mode 100644
index 53a261a..0000000
--- a/forge_client.py
+++ /dev/null
@@ -1,91 +0,0 @@
-"""
-Kleiner HTTP-Client fuer die Forge-Contents-API (phase-008-itsm-repo-audit).
-
-Analog zum bestehenden Muster in app.py (urllib.request statt einer externen
-HTTP-Bibliothek -- keine zusaetzliche Abhaengigkeit fuer nur zwei Aufrufe).
-Spricht ausschliesslich die Forge-REST-API (siehe mscadm/forge
-forge-web/src/api.rs), die bewusst Gitea-API-kompatibel gehalten ist.
-
-ENV (siehe auch app.py-Docstring):
- FORGE_BASE_URL Basis-URL des Forge-Servers, z.B. http://127.0.0.1:8095
- FORGE_SERVICE_TOKEN API-Token eines Forge-Nutzers mit role=admin (siehe
- Forge /api/v1/admin/users) -- dient hier NICHT der
- Admin-API, sondern normalen Contents-Schreibzugriffen;
- admin ist ausreichend, da Forge (noch) kein feineres
- Repo-Schreibrecht kennt.
-
-Bewusster Scope-Schnitt: nur get_contents/update_contents (was diese Phase
-tatsaechlich braucht), keine generische Forge-API-Client-Klasse mit allen
-Endpunkten -- analog zur Begruendung in forge-web/src/api.rs ("nicht 100%
-Paritaet ab Tag 1").
-"""
-import base64
-import json
-import os
-import urllib.error
-import urllib.parse
-import urllib.request
-
-FORGE_BASE_URL = os.getenv("FORGE_BASE_URL", "").rstrip("/")
-FORGE_SERVICE_TOKEN = os.getenv("FORGE_SERVICE_TOKEN", "")
-
-
-class ForgeClientError(Exception):
- """Fehler beim Sprechen mit der Forge-API -- Aufrufer soll dies dem
- Nutzer als Fehlermeldung zeigen, nicht stillschweigend schlucken."""
-
-
-def _request(method, path, body=None):
- if not FORGE_BASE_URL:
- raise ForgeClientError("FORGE_BASE_URL ist nicht konfiguriert")
- url = FORGE_BASE_URL + path
- headers = {"Authorization": "token " + FORGE_SERVICE_TOKEN}
- data = None
- if body is not None:
- data = json.dumps(body).encode("utf-8")
- headers["Content-Type"] = "application/json"
- req = urllib.request.Request(url, data=data, headers=headers, method=method)
- try:
- with urllib.request.urlopen(req, timeout=10) as resp:
- return json.loads(resp.read().decode("utf-8"))
- except urllib.error.HTTPError as e:
- detail = ""
- try:
- detail = e.read().decode("utf-8")
- except Exception:
- pass
- raise ForgeClientError("Forge-API-Fehler (%s): %s" % (e.code, detail or e.reason))
- except urllib.error.URLError as e:
- raise ForgeClientError("Forge nicht erreichbar: %s" % e.reason)
-
-
-def get_contents(repo, path, ref=None):
- """Liest eine Datei aus einem Forge-Repo. Rueckgabe: (text, sha).
- `text` ist bereits UTF-8-dekodiert (Repo-Dateien fuer diese Funktion sind
- Text-Dateien wie Doku/Config -- Binaerdateien werden bewusst nicht
- unterstuetzt, siehe project.yaml phase-008 Scope)."""
- q = "?ref=" + urllib.parse.quote(ref, safe="") if ref else ""
- result = _request("GET", "/api/v1/repos/x/%s/contents/%s%s" % (repo, path, q))
- if result.get("type") != "file":
- raise ForgeClientError("Pfad ist keine Datei: %s" % path)
- raw = base64.b64decode(result["content"])
- try:
- text = raw.decode("utf-8")
- except UnicodeDecodeError:
- raise ForgeClientError("Datei ist keine UTF-8-Textdatei -- ueber ITSM nicht editierbar")
- return text, result["sha"]
-
-
-def update_contents(repo, path, content_text, sha, branch, message, author_name, author_email):
- """Schreibt eine Datei in ein Forge-Repo (optimistisches Sha-Locking wie
- von Forges Contents-API verlangt). Rueckgabe: commit_sha (str)."""
- encoded = base64.b64encode(content_text.encode("utf-8")).decode("ascii")
- body = {
- "content": encoded,
- "sha": sha,
- "branch": branch,
- "message": message,
- "author": {"name": author_name, "email": author_email},
- }
- result = _request("PUT", "/api/v1/repos/x/%s/contents/%s" % (repo, path), body)
- return result["commit"]["sha"]
diff --git a/requirements.txt b/requirements.txt
deleted file mode 100644
index cb04ebd..0000000
--- a/requirements.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-flask
-gunicorn
-psycopg2-binary
diff --git a/schema.sql b/schema.sql
old mode 100644
new mode 100755
index a8a4db8..f7cdb53
--- a/schema.sql
+++ b/schema.sql
@@ -139,3 +139,76 @@ CREATE INDEX IF NOT EXISTS idx_cirel_tenant ON ci_relationships (tenant_id);
CREATE INDEX IF NOT EXISTS idx_cirel_from ON ci_relationships (from_ci_id);
CREATE INDEX IF NOT EXISTS idx_cirel_to ON ci_relationships (to_ci_id);
+
+-- ═══════════════════════════════════════════════════════════════════════════════
+-- Migration 2026-07-15: ITIL-v3/v4-Ausrichtung + Sicherheits-Haertung (Rust-Rewrite)
+-- Alle Aenderungen idempotent, damit init beim App-Start gefahrlos wiederholt laeuft.
+-- ═══════════════════════════════════════════════════════════════════════════════
+
+-- ── Rollen (ITIL-orientiert) ──────────────────────────────────────────────────
+-- 'admin' (Service Owner), 'change_manager' (Change Enablement/CAB),
+-- 'agent' (Service Desk), 'user' (Requester/Self-Service).
+-- users.role existiert bereits als TEXT; erlaubte Werte prueft die App.
+
+-- ── Tickets: Impact/Urgency-Prioritaetsmatrix (ITIL v3, SO 4.2.5.4) ──────────
+ALTER TABLE tickets ADD COLUMN IF NOT EXISTS impact TEXT NOT NULL DEFAULT 'Mittel';
+ALTER TABLE tickets ADD COLUMN IF NOT EXISTS urgency TEXT NOT NULL DEFAULT 'Mittel';
+
+-- ── Tickets: Change Enablement (v4) / Change Management (v3) ──────────────────
+ALTER TABLE tickets ADD COLUMN IF NOT EXISTS change_typ TEXT;
+ALTER TABLE tickets ADD COLUMN IF NOT EXISTS approval_status TEXT;
+ALTER TABLE tickets ADD COLUMN IF NOT EXISTS approved_by INTEGER REFERENCES users(id) ON DELETE SET NULL;
+ALTER TABLE tickets ADD COLUMN IF NOT EXISTS approved_at TIMESTAMPTZ;
+
+-- ── Tickets: Problem Management (v3 SO 4.4 / v4 Practice) ─────────────────────
+ALTER TABLE tickets ADD COLUMN IF NOT EXISTS problem_id INTEGER REFERENCES tickets(id) ON DELETE SET NULL;
+ALTER TABLE tickets ADD COLUMN IF NOT EXISTS known_error BOOLEAN NOT NULL DEFAULT FALSE;
+CREATE INDEX IF NOT EXISTS idx_tickets_problem ON tickets (problem_id);
+
+-- ── Tickets: SLA-Zeitstempel (Service Level Management) ───────────────────────
+ALTER TABLE tickets ADD COLUMN IF NOT EXISTS first_response_at TIMESTAMPTZ;
+ALTER TABLE tickets ADD COLUMN IF NOT EXISTS resolved_at TIMESTAMPTZ;
+ALTER TABLE tickets ADD COLUMN IF NOT EXISTS closed_at TIMESTAMPTZ;
+
+-- ── Ticket-CI-Verknuepfung (SACM v3 / Service Configuration Management v4) ────
+CREATE TABLE IF NOT EXISTS ticket_ci_links (
+ id SERIAL PRIMARY KEY,
+ tenant_id INTEGER NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+ ticket_id INTEGER NOT NULL REFERENCES tickets(id) ON DELETE CASCADE,
+ ci_id INTEGER NOT NULL REFERENCES configuration_items(id) ON DELETE CASCADE,
+ created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+ UNIQUE (ticket_id, ci_id)
+);
+CREATE INDEX IF NOT EXISTS idx_tcl_ticket ON ticket_ci_links (ticket_id);
+CREATE INDEX IF NOT EXISTS idx_tcl_ci ON ticket_ci_links (ci_id);
+
+-- ── Wissensdatenbank: Freigabe-Workflow (Knowledge Management) ────────────────
+-- Bestehende Artikel werden einmalig 'Freigegeben'; neue starten als 'Entwurf'.
+ALTER TABLE kb_articles ADD COLUMN IF NOT EXISTS status TEXT;
+UPDATE kb_articles SET status='Freigegeben' WHERE status IS NULL;
+ALTER TABLE kb_articles ALTER COLUMN status SET DEFAULT 'Entwurf';
+ALTER TABLE kb_articles ALTER COLUMN status SET NOT NULL;
+
+-- ── Login-Rate-Limiting (Brute-Force-Schutz, DB-basiert => multi-worker-fest) ──
+CREATE TABLE IF NOT EXISTS login_attempts (
+ id SERIAL PRIMARY KEY,
+ email TEXT NOT NULL,
+ ip TEXT,
+ zeit TIMESTAMPTZ NOT NULL DEFAULT now(),
+ success BOOLEAN NOT NULL DEFAULT FALSE
+);
+CREATE INDEX IF NOT EXISTS idx_login_attempts_email_zeit ON login_attempts (email, zeit DESC);
+CREATE INDEX IF NOT EXISTS idx_login_attempts_ip_zeit ON login_attempts (ip, zeit DESC);
+
+-- ── Server-seitige Sessions (Rust-Rewrite 2026-07-15) ─────────────────────────
+-- In der DB liegt nur der SHA-256-Hash des Cookie-Tokens: ein DB-Leak
+-- kompromittiert keine laufenden Sessions; Sessions sind widerrufbar.
+CREATE TABLE IF NOT EXISTS sessions (
+ token_hash TEXT PRIMARY KEY,
+ user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ csrf_token TEXT NOT NULL,
+ created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+ expires_at TIMESTAMPTZ NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions (user_id);
+CREATE INDEX IF NOT EXISTS idx_sessions_expires ON sessions (expires_at);
diff --git a/src/admin.rs b/src/admin.rs
new file mode 100755
index 0000000..f831bf1
--- /dev/null
+++ b/src/admin.rs
@@ -0,0 +1,408 @@
+//! Administration: Mandanten-Einstellungen (SLA, DSGVO-Retention), Audit-Log,
+//! Benutzerverwaltung mit ITIL-Rollenmodell. Alles admin-only.
+
+use askama::Template;
+use axum::extract::{Extension, Path, State};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Redirect};
+use axum::Form;
+use serde::Deserialize;
+
+use crate::web::{need_admin, need_auth, page_ctx, AppState, PageCtx, ReqCtx, WebResult};
+use crate::{itil, security};
+
+// ── Einstellungen ──────────────────────────────────────────────────────────────
+#[derive(Template)]
+#[template(path = "admin_settings.html")]
+pub struct SettingsTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub notice: String,
+ pub tenant_name: String,
+ pub sla_antwort: i32,
+ pub sla_loesung: i32,
+ pub dsb_name: String,
+ pub dsb_email: String,
+ pub retention_tickets: i32,
+ pub retention_audit: i32,
+}
+
+async fn settings_template(app: &AppState, auth: &crate::db::AuthUser, notice: String)
+ -> anyhow::Result {
+ let t = app.db.get_tenant(auth.tenant_id).await?
+ .ok_or_else(|| anyhow::anyhow!("Mandant nicht gefunden"))?;
+ Ok(SettingsTemplate {
+ title: "Einstellungen".into(),
+ ctx: page_ctx(auth, "/admin"),
+ notice,
+ tenant_name: t.name,
+ sla_antwort: t.sla_antwort_minuten,
+ sla_loesung: t.sla_loesung_minuten,
+ dsb_name: t.dsb_name.unwrap_or_default(),
+ dsb_email: t.dsb_email.unwrap_or_default(),
+ retention_tickets: t.retention_tickets_days,
+ retention_audit: t.retention_audit_days,
+ })
+}
+
+pub async fn settings_get(State(app): State, Extension(ctx): Extension) -> WebResult {
+ let auth = match need_auth(&ctx, "/admin") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_admin(&auth) { return Ok(r); }
+ Ok(settings_template(&app, &auth, String::new()).await?.into_response())
+}
+
+#[derive(Deserialize)]
+pub struct SettingsForm {
+ #[serde(default)]
+ pub dsb_name: String,
+ #[serde(default)]
+ pub dsb_email: String,
+ #[serde(default)]
+ pub retention_tickets_days: String,
+ #[serde(default)]
+ pub retention_audit_days: String,
+ #[serde(default)]
+ pub sla_antwort_minuten: String,
+ #[serde(default)]
+ pub sla_loesung_minuten: String,
+}
+
+pub async fn settings_post(State(app): State, Extension(ctx): Extension,
+ Form(f): Form) -> WebResult {
+ let auth = match need_auth(&ctx, "/admin") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_admin(&auth) { return Ok(r); }
+ let parse = |s: &str, d: i32| s.trim().parse::().unwrap_or(d).max(1);
+ let dsb_name = f.dsb_name.trim();
+ let dsb_email = f.dsb_email.trim();
+ app.db.update_tenant_settings(
+ auth.tenant_id,
+ if dsb_name.is_empty() { None } else { Some(dsb_name) },
+ if dsb_email.is_empty() { None } else { Some(dsb_email) },
+ parse(&f.retention_tickets_days, 1095),
+ parse(&f.retention_audit_days, 1825),
+ parse(&f.sla_antwort_minuten, 480),
+ parse(&f.sla_loesung_minuten, 2880)).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "tenant_settings_updated",
+ Some("tenant"), Some(&auth.tenant_id.to_string()), None,
+ ctx.ip.as_deref()).await?;
+ Ok(settings_template(&app, &auth, "Gespeichert.".into()).await?.into_response())
+}
+
+pub async fn retention_run(State(app): State, Extension(ctx): Extension) -> WebResult {
+ let auth = match need_auth(&ctx, "/admin") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_admin(&auth) { return Ok(r); }
+ app.db.run_retention_cleanup().await?;
+ Ok(settings_template(&app, &auth, "Bereinigung durchgefuehrt -- Details im Audit-Log.".into())
+ .await?.into_response())
+}
+
+// ── Audit-Log ──────────────────────────────────────────────────────────────────
+pub struct AuditRow {
+ pub zeit: String,
+ pub user: String,
+ pub aktion: String,
+ pub objekt: String,
+}
+
+#[derive(Template)]
+#[template(path = "admin_audit.html")]
+pub struct AuditTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub rows: Vec,
+}
+
+pub async fn audit_page(State(app): State, Extension(ctx): Extension) -> WebResult {
+ let auth = match need_auth(&ctx, "/admin/audit") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_admin(&auth) { return Ok(r); }
+ let entries = app.db.list_audit(auth.tenant_id, 300).await?;
+ let rows = entries.iter().map(|e| AuditRow {
+ zeit: e.zeit.format("%Y-%m-%d %H:%M:%S").to_string(),
+ user: e.user_email.clone().unwrap_or_else(|| "(unbekannt)".into()),
+ aktion: e.aktion.clone(),
+ objekt: format!("{} {}",
+ e.entity_typ.clone().unwrap_or_default(),
+ e.entity_id.clone().unwrap_or_default()).trim().to_string(),
+ }).collect();
+ let tpl = AuditTemplate {
+ title: "Audit-Log".into(),
+ ctx: page_ctx(&auth, "/admin/audit"),
+ rows,
+ };
+ Ok(tpl.into_response())
+}
+
+// ── Benutzerverwaltung ─────────────────────────────────────────────────────────
+pub struct UserRow {
+ pub id: i32,
+ pub email: String,
+ pub name: String,
+ pub role: String,
+ pub role_label: String,
+ pub active: bool,
+ pub telefon: String,
+ pub auth_source: String,
+ pub last_login: String,
+ pub is_self: bool,
+ pub role_opts: Vec<(String, String, bool)>,
+}
+
+#[derive(Template)]
+#[template(path = "admin_users.html")]
+pub struct UsersTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub notice: String,
+ pub error: String,
+ pub rows: Vec,
+ pub form_open: bool,
+ pub fv_email: String,
+ pub fv_role: String,
+ pub fv_vorname: String,
+ pub fv_nachname: String,
+ pub fv_telefon: String,
+ pub fv_abteilung: String,
+ pub fv_adresse: String,
+ pub role_opts: Vec<(String, String)>,
+ pub password_min_length: usize,
+}
+
+async fn users_template(app: &AppState, auth: &crate::db::AuthUser, notice: String, error: String,
+ fv: Option<&NewUserForm>) -> anyhow::Result {
+ let users = app.db.list_users(auth.tenant_id).await?;
+ let rows = users.iter().map(|u| UserRow {
+ id: u.id,
+ email: u.email.clone(),
+ name: {
+ let n = format!("{} {}",
+ u.vorname.clone().unwrap_or_default(),
+ u.nachname.clone().unwrap_or_default());
+ let n = n.trim().to_string();
+ if n.is_empty() { "--".into() } else { n }
+ },
+ role: u.role.clone(),
+ role_label: itil::role_label(&u.role).to_string(),
+ active: u.active,
+ telefon: u.telefon.clone().unwrap_or_default(),
+ auth_source: u.auth_source.clone(),
+ last_login: u.last_login_at.map(|d| d.format("%Y-%m-%d %H:%M").to_string())
+ .unwrap_or_else(|| "nie".into()),
+ is_self: u.id == auth.user_id,
+ role_opts: itil::ROLES.iter().map(|r| {
+ (r.to_string(), itil::role_label(r).to_string(), *r == u.role)
+ }).collect(),
+ }).collect();
+ Ok(UsersTemplate {
+ title: "Benutzerverwaltung".into(),
+ ctx: page_ctx(auth, "/admin/users"),
+ notice,
+ error,
+ rows,
+ form_open: fv.is_some(),
+ fv_email: fv.map(|f| f.email.clone()).unwrap_or_default(),
+ fv_role: fv.map(|f| f.role.clone()).unwrap_or_else(|| "agent".into()),
+ fv_vorname: fv.map(|f| f.vorname.clone()).unwrap_or_default(),
+ fv_nachname: fv.map(|f| f.nachname.clone()).unwrap_or_default(),
+ fv_telefon: fv.map(|f| f.telefon.clone()).unwrap_or_default(),
+ fv_abteilung: fv.map(|f| f.abteilung.clone()).unwrap_or_default(),
+ fv_adresse: fv.map(|f| f.adresse.clone()).unwrap_or_default(),
+ role_opts: itil::ROLES.iter().map(|r| (r.to_string(), itil::role_label(r).to_string())).collect(),
+ password_min_length: app.cfg.password_min_length,
+ })
+}
+
+pub async fn users_get(State(app): State, Extension(ctx): Extension) -> WebResult {
+ let auth = match need_auth(&ctx, "/admin/users") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_admin(&auth) { return Ok(r); }
+ Ok(users_template(&app, &auth, String::new(), String::new(), None).await?.into_response())
+}
+
+#[derive(Deserialize)]
+pub struct NewUserForm {
+ pub email: String,
+ #[serde(default)]
+ pub role: String,
+ pub password: String,
+ pub password2: String,
+ #[serde(default)]
+ pub vorname: String,
+ #[serde(default)]
+ pub nachname: String,
+ #[serde(default)]
+ pub telefon: String,
+ #[serde(default)]
+ pub abteilung: String,
+ #[serde(default)]
+ pub adresse: String,
+}
+
+pub async fn users_post(State(app): State, Extension(ctx): Extension,
+ Form(f): Form) -> WebResult {
+ let auth = match need_auth(&ctx, "/admin/users") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_admin(&auth) { return Ok(r); }
+ let email = f.email.trim().to_lowercase();
+ let role = if itil::ROLES.contains(&f.role.as_str()) { f.role.clone() } else { "agent".into() };
+
+ let error = if email.is_empty() || !email.contains('@') {
+ Some("Bitte eine gueltige E-Mail-Adresse angeben.".to_string())
+ } else if let Some(p) = security::password_problem(&f.password, app.cfg.password_min_length) {
+ Some(p)
+ } else if f.password != f.password2 {
+ Some("Die Passwoerter stimmen nicht ueberein.".to_string())
+ } else if app.db.email_exists(&email, None).await? {
+ Some("Diese E-Mail-Adresse ist bereits registriert.".to_string())
+ } else {
+ None
+ };
+
+ if let Some(e) = error {
+ return Ok(users_template(&app, &auth, String::new(), e, Some(&f)).await?.into_response());
+ }
+
+ let hash = security::hash_password(&f.password).map_err(anyhow::Error::from)?;
+ let opt = |s: &str| { let s = s.trim(); if s.is_empty() { None } else { Some(s.to_string()) } };
+ let uid = app.db.create_user(auth.tenant_id, &email, &hash, &role,
+ opt(&f.vorname).as_deref(), opt(&f.nachname).as_deref(),
+ opt(&f.telefon).as_deref(), opt(&f.abteilung).as_deref(),
+ opt(&f.adresse).as_deref()).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "user_created", Some("user"),
+ Some(&uid.to_string()),
+ Some(serde_json::json!({"email": email, "role": role, "auth_source": "local"})),
+ ctx.ip.as_deref()).await?;
+ Ok(users_template(&app, &auth, "Benutzer angelegt.".into(), String::new(), None).await?.into_response())
+}
+
+// ── Benutzerdetails ────────────────────────────────────────────────────────────
+#[derive(Template)]
+#[template(path = "admin_user_edit.html")]
+pub struct UserEditTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub error: String,
+ pub notice: String,
+ pub user_id: i32,
+ pub email: String,
+ pub vorname: String,
+ pub nachname: String,
+ pub telefon: String,
+ pub abteilung: String,
+ pub adresse: String,
+}
+
+fn user_edit_template(auth: &crate::db::AuthUser, u: &crate::db::UserDetails,
+ error: String, notice: String) -> UserEditTemplate {
+ UserEditTemplate {
+ title: "Benutzerdetails".into(),
+ ctx: page_ctx(auth, "/admin/users"),
+ error,
+ notice,
+ user_id: u.id,
+ email: u.email.clone(),
+ vorname: u.vorname.clone().unwrap_or_default(),
+ nachname: u.nachname.clone().unwrap_or_default(),
+ telefon: u.telefon.clone().unwrap_or_default(),
+ abteilung: u.abteilung.clone().unwrap_or_default(),
+ adresse: u.adresse.clone().unwrap_or_default(),
+ }
+}
+
+pub async fn user_edit_get(State(app): State, Extension(ctx): Extension,
+ Path(user_id): Path) -> WebResult {
+ let auth = match need_auth(&ctx, "/admin/users") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_admin(&auth) { return Ok(r); }
+ let Some(u) = app.db.get_user_details(auth.tenant_id, user_id).await? else {
+ return Ok(StatusCode::NOT_FOUND.into_response());
+ };
+ Ok(user_edit_template(&auth, &u, String::new(), String::new()).into_response())
+}
+
+#[derive(Deserialize)]
+pub struct UserEditForm {
+ pub email: String,
+ #[serde(default)]
+ pub vorname: String,
+ #[serde(default)]
+ pub nachname: String,
+ #[serde(default)]
+ pub telefon: String,
+ #[serde(default)]
+ pub abteilung: String,
+ #[serde(default)]
+ pub adresse: String,
+}
+
+pub async fn user_edit_post(State(app): State, Extension(ctx): Extension,
+ Path(user_id): Path, Form(f): Form) -> WebResult {
+ let auth = match need_auth(&ctx, "/admin/users") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_admin(&auth) { return Ok(r); }
+ let Some(u) = app.db.get_user_details(auth.tenant_id, user_id).await? else {
+ return Ok(StatusCode::NOT_FOUND.into_response());
+ };
+ let email = f.email.trim().to_lowercase();
+ if email.is_empty() || !email.contains('@') {
+ return Ok(user_edit_template(&auth, &u, "Bitte eine gueltige E-Mail-Adresse angeben.".into(),
+ String::new()).into_response());
+ }
+ if app.db.email_exists(&email, Some(user_id)).await? {
+ return Ok(user_edit_template(&auth, &u,
+ "Diese E-Mail-Adresse wird bereits von einem anderen Benutzer verwendet.".into(),
+ String::new()).into_response());
+ }
+ if email != u.email {
+ app.db.update_user_email(auth.tenant_id, user_id, &email).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "user_email_changed", Some("user"),
+ Some(&user_id.to_string()),
+ Some(serde_json::json!({"alt": u.email, "neu": email})),
+ ctx.ip.as_deref()).await?;
+ }
+ let opt = |s: &str| { let s = s.trim(); if s.is_empty() { None } else { Some(s.to_string()) } };
+ app.db.update_user_profile(auth.tenant_id, user_id,
+ opt(&f.vorname).as_deref(), opt(&f.nachname).as_deref(),
+ opt(&f.telefon).as_deref(), opt(&f.abteilung).as_deref(),
+ opt(&f.adresse).as_deref()).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "user_profile_updated", Some("user"),
+ Some(&user_id.to_string()), None, ctx.ip.as_deref()).await?;
+ let updated = app.db.get_user_details(auth.tenant_id, user_id).await?.unwrap_or(u);
+ Ok(user_edit_template(&auth, &updated, String::new(), "Gespeichert.".into()).into_response())
+}
+
+#[derive(Deserialize)]
+pub struct RoleForm {
+ pub role: String,
+}
+
+pub async fn user_role_post(State(app): State, Extension(ctx): Extension,
+ Path(user_id): Path, Form(f): Form) -> WebResult {
+ let auth = match need_auth(&ctx, "/admin/users") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_admin(&auth) { return Ok(r); }
+ if !itil::ROLES.contains(&f.role.as_str()) {
+ return Ok(Redirect::to("/admin/users").into_response());
+ }
+ // Sich selbst nicht die Admin-Rolle entziehen (Aussperr-Schutz).
+ if user_id == auth.user_id && f.role != "admin" {
+ return Ok(Redirect::to("/admin/users").into_response());
+ }
+ app.db.set_user_role(auth.tenant_id, user_id, &f.role).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "user_role_changed", Some("user"),
+ Some(&user_id.to_string()), Some(serde_json::json!({"role": f.role})),
+ ctx.ip.as_deref()).await?;
+ Ok(Redirect::to("/admin/users").into_response())
+}
+
+pub async fn user_active_post(State(app): State, Extension(ctx): Extension,
+ Path(user_id): Path) -> WebResult {
+ let auth = match need_auth(&ctx, "/admin/users") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_admin(&auth) { return Ok(r); }
+ let Some(u) = app.db.get_user_details(auth.tenant_id, user_id).await? else {
+ return Ok(Redirect::to("/admin/users").into_response());
+ };
+ let new_active = !u.active;
+ if user_id == auth.user_id && !new_active {
+ return Ok(Redirect::to("/admin/users").into_response()); // eigenes Konto nicht sperren
+ }
+ app.db.set_user_active(auth.tenant_id, user_id, new_active).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id),
+ if new_active { "user_activated" } else { "user_deactivated" },
+ Some("user"), Some(&user_id.to_string()), None, ctx.ip.as_deref()).await?;
+ Ok(Redirect::to("/admin/users").into_response())
+}
diff --git a/src/auth.rs b/src/auth.rs
new file mode 100755
index 0000000..4d9cb5d
--- /dev/null
+++ b/src/auth.rs
@@ -0,0 +1,292 @@
+//! Anmeldung, Abmeldung, Ersteinrichtung.
+//!
+//! Sicherheitsmerkmale gegenueber der frueheren Version:
+//! - Login-Rate-Limit (DB-gestuetzt, pro E-Mail und pro IP)
+//! - Argon2id-Hashes; alte Werkzeug-PBKDF2-Hashes werden beim ersten
+//! erfolgreichen Login transparent auf Argon2 migriert
+//! - serverseitige Sessions (widerrufbar), HttpOnly/SameSite=Lax-Cookie
+//! - "next"-Redirect nur auf lokale Pfade (kein Open Redirect)
+
+use askama::Template;
+use axum::extract::{Extension, Query, State};
+use axum::response::{IntoResponse, Redirect};
+use axum::Form;
+use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
+use serde::Deserialize;
+
+use crate::web::{AppState, ReqCtx, WebResult, SESSION_COOKIE};
+use crate::security;
+
+#[derive(Template)]
+#[template(path = "login.html")]
+pub struct LoginTemplate {
+ pub error: String,
+ pub notice: String,
+ pub show_setup_link: bool,
+ pub next: String,
+}
+
+#[derive(Deserialize)]
+pub struct LoginQuery {
+ pub registered: Option,
+ pub already_setup: Option,
+ pub next: Option,
+}
+
+#[derive(Deserialize)]
+pub struct LoginForm {
+ pub email: String,
+ pub password: String,
+ #[serde(default)]
+ pub next: String,
+}
+
+fn notice_from_query(q: &LoginQuery) -> String {
+ if q.registered.is_some() {
+ "Organisation angelegt. Bitte melde dich mit deinem Admin-Konto an.".into()
+ } else if q.already_setup.is_some() {
+ "Die Ersteinrichtung wurde bereits abgeschlossen. Bitte melde dich mit deinem bestehenden Konto an.".into()
+ } else {
+ String::new()
+ }
+}
+
+/// Nur lokale Pfade als Redirect-Ziel zulassen (kein Open Redirect).
+fn safe_next(next: &str) -> &str {
+ if next.starts_with('/') && !next.starts_with("//") {
+ next
+ } else {
+ "/"
+ }
+}
+
+pub async fn login_get(State(app): State, Query(q): Query) -> WebResult {
+ let tpl = LoginTemplate {
+ error: String::new(),
+ notice: notice_from_query(&q),
+ show_setup_link: !app.db.any_tenant_exists().await?,
+ next: q.next.unwrap_or_default(),
+ };
+ Ok(tpl.into_response())
+}
+
+pub async fn login_post(State(app): State,
+ Extension(ctx): Extension,
+ jar: CookieJar,
+ Form(form): Form) -> WebResult {
+ let email = form.email.trim().to_lowercase();
+ let ip = ctx.ip.as_deref();
+
+ // Rate-Limit VOR der Passwortpruefung (Brute-Force-Schutz).
+ let failed = app.db.count_recent_failed_logins(&email, ip, app.cfg.login_window_minutes).await?;
+ if failed >= app.cfg.login_max_attempts {
+ app.db.log_audit(None, None, "login_rate_limited", Some("user"), Some(&email), None, ip).await?;
+ let tpl = LoginTemplate {
+ error: format!("Zu viele Fehlversuche. Bitte in {} Minuten erneut versuchen.",
+ app.cfg.login_window_minutes),
+ notice: String::new(),
+ show_setup_link: false,
+ next: form.next.clone(),
+ };
+ return Ok((axum::http::StatusCode::TOO_MANY_REQUESTS, tpl).into_response());
+ }
+
+ let user = app.db.get_user_by_email(&email).await?;
+ let ok = match &user {
+ Some(u) => {
+ let (valid, needs_rehash) = security::verify_password(&u.password_hash, &form.password);
+ if valid && needs_rehash {
+ // Schleichende Migration Werkzeug-PBKDF2 -> Argon2id.
+ if let Ok(new_hash) = security::hash_password(&form.password) {
+ app.db.update_password_hash(u.id, &new_hash).await.ok();
+ }
+ }
+ valid
+ }
+ None => {
+ // Dummy-Verifikation gegen Timing-basiertes User-Enumeration.
+ let _ = security::verify_password(
+ "$argon2id$v=19$m=19456,t=2,p=1$YWJjZGVmZ2hpamts$m9Xtvd5RXQ3PXSyRt5S+dCLouLZzeSGf16y1SnGJgLs",
+ &form.password);
+ false
+ }
+ };
+
+ app.db.record_login_attempt(&email, ip, ok).await?;
+
+ if let (true, Some(u)) = (ok, user) {
+ let token = security::random_token();
+ let csrf = security::random_token();
+ app.db.create_session(&security::hash_token(&token), u.id, &csrf, app.cfg.session_hours).await?;
+ app.db.touch_last_login(u.id).await?;
+ app.db.log_audit(Some(u.tenant_id), Some(u.id), "login_success", Some("user"),
+ Some(&u.id.to_string()), None, ip).await?;
+ let cookie = Cookie::build((SESSION_COOKIE, token))
+ .path("/")
+ .http_only(true)
+ .same_site(SameSite::Lax)
+ .secure(app.cfg.https)
+ .max_age(time::Duration::hours(app.cfg.session_hours))
+ .build();
+ return Ok((jar.add(cookie), Redirect::to(safe_next(&form.next))).into_response());
+ }
+
+ app.db.log_audit(None, None, "login_failed", Some("user"), Some(&email), None, ip).await?;
+ let tpl = LoginTemplate {
+ error: "E-Mail oder Passwort falsch.".into(),
+ notice: String::new(),
+ show_setup_link: !app.db.any_tenant_exists().await?,
+ next: form.next,
+ };
+ Ok(tpl.into_response())
+}
+
+pub async fn logout(State(app): State,
+ Extension(ctx): Extension,
+ jar: CookieJar) -> WebResult {
+ if let Some(a) = &ctx.auth {
+ app.db.log_audit(Some(a.tenant_id), Some(a.user_id), "logout", Some("user"),
+ Some(&a.user_id.to_string()), None, ctx.ip.as_deref()).await?;
+ }
+ if let Some(c) = jar.get(SESSION_COOKIE) {
+ app.db.delete_session(&security::hash_token(c.value())).await?;
+ }
+ let jar = jar.remove(Cookie::from(SESSION_COOKIE));
+ Ok((jar, Redirect::to("/login")).into_response())
+}
+
+// ── Ersteinrichtung ────────────────────────────────────────────────────────────
+#[derive(Template)]
+#[template(path = "setup.html")]
+pub struct SetupTemplate {
+ pub error: String,
+ pub firma: String,
+ pub email: String,
+ pub dsb_name: String,
+ pub dsb_email: String,
+ pub retention_tickets: String,
+ pub retention_audit: String,
+ pub sla_antwort: String,
+ pub sla_loesung: String,
+ pub password_min_length: usize,
+}
+
+impl SetupTemplate {
+ fn empty(min_len: usize) -> SetupTemplate {
+ SetupTemplate {
+ error: String::new(),
+ firma: String::new(),
+ email: String::new(),
+ dsb_name: String::new(),
+ dsb_email: String::new(),
+ retention_tickets: "1095".into(),
+ retention_audit: "1825".into(),
+ sla_antwort: "480".into(),
+ sla_loesung: "2880".into(),
+ password_min_length: min_len,
+ }
+ }
+}
+
+#[derive(Deserialize)]
+pub struct SetupForm {
+ pub firma: String,
+ pub email: String,
+ pub password: String,
+ pub password2: String,
+ #[serde(default)]
+ pub dsb_name: String,
+ #[serde(default)]
+ pub dsb_email: String,
+ #[serde(default)]
+ pub retention_tickets_days: String,
+ #[serde(default)]
+ pub retention_audit_days: String,
+ #[serde(default)]
+ pub sla_antwort_minuten: String,
+ #[serde(default)]
+ pub sla_loesung_minuten: String,
+}
+
+pub async fn setup_get(State(app): State) -> WebResult {
+ // Einmaliger Vorgang: sobald ein Mandant existiert, ist die Route gesperrt.
+ if app.db.any_tenant_exists().await? {
+ return Ok(Redirect::to("/login?already_setup=1").into_response());
+ }
+ Ok(SetupTemplate::empty(app.cfg.password_min_length).into_response())
+}
+
+pub async fn setup_post(State(app): State,
+ Extension(ctx): Extension,
+ Form(f): Form) -> WebResult {
+ if app.db.any_tenant_exists().await? {
+ return Ok(Redirect::to("/login?already_setup=1").into_response());
+ }
+ let email = f.email.trim().to_lowercase();
+ let firma = f.firma.trim().to_string();
+
+ let mut tpl = SetupTemplate {
+ error: String::new(),
+ firma: firma.clone(),
+ email: email.clone(),
+ dsb_name: f.dsb_name.trim().to_string(),
+ dsb_email: f.dsb_email.trim().to_string(),
+ retention_tickets: f.retention_tickets_days.trim().to_string(),
+ retention_audit: f.retention_audit_days.trim().to_string(),
+ sla_antwort: f.sla_antwort_minuten.trim().to_string(),
+ sla_loesung: f.sla_loesung_minuten.trim().to_string(),
+ password_min_length: app.cfg.password_min_length,
+ };
+
+ if firma.is_empty() {
+ tpl.error = "Firmenname ist erforderlich.".into();
+ } else if email.is_empty() || !email.contains('@') {
+ tpl.error = "Bitte eine gueltige E-Mail-Adresse angeben.".into();
+ } else if let Some(p) = security::password_problem(&f.password, app.cfg.password_min_length) {
+ tpl.error = p;
+ } else if f.password != f.password2 {
+ tpl.error = "Die Passwoerter stimmen nicht ueberein.".into();
+ } else if app.db.email_exists(&email, None).await? {
+ tpl.error = "Diese E-Mail-Adresse ist bereits registriert.".into();
+ } else {
+ let parse = |s: &str, d: i32| s.parse::().unwrap_or(d).max(1);
+ let tenant_id = app.db.create_tenant(
+ &firma,
+ if tpl.dsb_name.is_empty() { None } else { Some(&tpl.dsb_name) },
+ if tpl.dsb_email.is_empty() { None } else { Some(&tpl.dsb_email) },
+ parse(&tpl.retention_tickets, 1095),
+ parse(&tpl.retention_audit, 1825),
+ parse(&tpl.sla_antwort, 480),
+ parse(&tpl.sla_loesung, 2880)).await?;
+ let hash = security::hash_password(&f.password).map_err(anyhow::Error::from)?;
+ let user_id = app.db.create_user(tenant_id, &email, &hash, "admin",
+ None, None, None, None, None).await?;
+ if !app.cfg.aes_dashboard_url.is_empty() {
+ app.db.create_service(
+ tenant_id, "AES -- Autonomous Engineering System",
+ "Automatisierte Software-Entwicklung: Projekte, Phasen, LLM-gestuetzte Agenten, \
+ Auto-Fix und Release-Pipeline.",
+ "Entwicklung", true, Some(&app.cfg.aes_dashboard_url)).await?;
+ }
+ let ip = ctx.ip.as_deref();
+ app.db.log_audit(Some(tenant_id), Some(user_id), "tenant_created", Some("tenant"),
+ Some(&tenant_id.to_string()),
+ Some(serde_json::json!({"firma": firma})), ip).await?;
+ app.db.log_audit(Some(tenant_id), Some(user_id), "user_created", Some("user"),
+ Some(&user_id.to_string()),
+ Some(serde_json::json!({"email": email, "role": "admin"})), ip).await?;
+ return Ok(Redirect::to("/login?registered=1").into_response());
+ }
+ Ok(tpl.into_response())
+}
+
+/// Root: Setup -> Login -> Dashboard.
+pub async fn root(State(app): State, Extension(ctx): Extension) -> WebResult {
+ if !app.db.any_tenant_exists().await? {
+ return Ok(Redirect::to("/setup/new").into_response());
+ }
+ if ctx.auth.is_some() {
+ return Ok(Redirect::to("/dashboard").into_response());
+ }
+ Ok(Redirect::to("/login").into_response())
+}
diff --git a/src/cmdb.rs b/src/cmdb.rs
new file mode 100755
index 0000000..130a51f
--- /dev/null
+++ b/src/cmdb.rs
@@ -0,0 +1,319 @@
+//! CMDB (ITIL v3: SACM / v4: Service Configuration Management).
+//! Zugriff nur fuer operative Rollen (admin/change_manager/agent).
+
+use askama::Template;
+use axum::extract::{Extension, Path, Query, State};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Redirect};
+use axum::Form;
+use serde::Deserialize;
+
+use crate::web::{need_auth, need_operative, page_ctx, AppState, PageCtx, ReqCtx, WebResult};
+
+pub const CI_TYPES: [&str; 6] = ["Server", "Software", "Lizenz", "Vertrag", "Netzwerkgeraet", "Sonstiges"];
+pub const CI_STATUS: [&str; 4] = ["Aktiv", "Inaktiv", "Wartung", "Ausgemustert"];
+pub const REL_TYPES: [&str; 4] = ["haengt ab von", "beinhaltet", "verbunden mit", "ersetzt"];
+
+fn ci_status_class(status: &str) -> &'static str {
+ match status {
+ "Aktiv" => "geloest",
+ "Inaktiv" => "geschlossen",
+ "Wartung" => "inbearbeitung",
+ "Ausgemustert" => "ueberfaellig",
+ _ => "offen",
+ }
+}
+
+/// dict -> "Schluessel: Wert" je Zeile (Formular-Textarea).
+fn attrs_to_text(attrs: &serde_json::Value) -> String {
+ attrs.as_object().map(|m| {
+ m.iter().map(|(k, v)| {
+ let val = v.as_str().map(str::to_string).unwrap_or_else(|| v.to_string());
+ format!("{}: {}", k, val)
+ }).collect::>().join("\n")
+ }).unwrap_or_default()
+}
+
+/// "Schluessel: Wert" je Zeile -> JSON-Objekt (fehlerhafte Zeilen ignoriert).
+fn text_to_attrs(text: &str) -> serde_json::Value {
+ let mut map = serde_json::Map::new();
+ for line in text.lines() {
+ let line = line.trim();
+ if let Some((k, v)) = line.split_once(':') {
+ let k = k.trim();
+ if !k.is_empty() {
+ map.insert(k.to_string(), serde_json::Value::String(v.trim().to_string()));
+ }
+ }
+ }
+ serde_json::Value::Object(map)
+}
+
+// ── Liste ──────────────────────────────────────────────────────────────────────
+pub struct CiRow {
+ pub id: i32,
+ pub name: String,
+ pub typ: String,
+ pub status: String,
+ pub status_class: String,
+ pub beschreibung: String,
+}
+
+pub struct CiTab {
+ pub href: String,
+ pub label: String,
+ pub active: bool,
+}
+
+#[derive(Template)]
+#[template(path = "cmdb_list.html")]
+pub struct CmdbListTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub tabs: Vec,
+ pub rows: Vec,
+}
+
+#[derive(Deserialize)]
+pub struct CmdbQuery {
+ pub typ: Option,
+}
+
+pub async fn cmdb_list(State(app): State, Extension(ctx): Extension,
+ Query(q): Query) -> WebResult {
+ let auth = match need_auth(&ctx, "/assets") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_operative(&auth) { return Ok(r); }
+ let typ = q.typ.as_deref().filter(|t| CI_TYPES.contains(t));
+ let cis = app.db.list_cis(auth.tenant_id, typ).await?;
+ let mut tabs = vec![CiTab { href: "/assets".into(), label: "Alle".into(), active: typ.is_none() }];
+ tabs.extend(CI_TYPES.iter().map(|t| CiTab {
+ href: format!("/assets?typ={}", t),
+ label: t.to_string(),
+ active: typ == Some(t),
+ }));
+ let rows = cis.iter().map(|c| CiRow {
+ id: c.id,
+ name: c.name.clone(),
+ typ: c.ci_typ.clone(),
+ status: c.status.clone(),
+ status_class: ci_status_class(&c.status).into(),
+ beschreibung: c.beschreibung.clone().unwrap_or_default(),
+ }).collect();
+ let tpl = CmdbListTemplate {
+ title: "CMDB".into(),
+ ctx: page_ctx(&auth, "/assets"),
+ tabs,
+ rows,
+ };
+ Ok(tpl.into_response())
+}
+
+// ── Neu / Detail ───────────────────────────────────────────────────────────────
+#[derive(Deserialize)]
+pub struct CiForm {
+ pub name: String,
+ #[serde(default)]
+ pub ci_typ: String,
+ #[serde(default)]
+ pub status: String,
+ #[serde(default)]
+ pub beschreibung: String,
+ #[serde(default)]
+ pub attribute: String,
+}
+
+pub struct SelectOpt {
+ pub value: String,
+ pub label: String,
+ pub selected: bool,
+}
+
+fn opts(values: &[&str], selected: &str) -> Vec {
+ values.iter().map(|v| SelectOpt {
+ value: v.to_string(),
+ label: v.to_string(),
+ selected: *v == selected,
+ }).collect()
+}
+
+#[derive(Template)]
+#[template(path = "cmdb_form.html")]
+pub struct CmdbFormTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub error: String,
+ pub name: String,
+ pub beschreibung: String,
+ pub attribute: String,
+ pub typ_opts: Vec,
+ pub status_opts: Vec,
+}
+
+pub async fn ci_new_get(Extension(ctx): Extension) -> WebResult {
+ let auth = match need_auth(&ctx, "/assets/new") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_operative(&auth) { return Ok(r); }
+ let tpl = CmdbFormTemplate {
+ title: "Neues Configuration Item".into(),
+ ctx: page_ctx(&auth, "/assets"),
+ error: String::new(),
+ name: String::new(),
+ beschreibung: String::new(),
+ attribute: String::new(),
+ typ_opts: opts(&CI_TYPES, "Server"),
+ status_opts: opts(&CI_STATUS, "Aktiv"),
+ };
+ Ok(tpl.into_response())
+}
+
+pub async fn ci_new_post(State(app): State, Extension(ctx): Extension,
+ Form(f): Form) -> WebResult {
+ let auth = match need_auth(&ctx, "/assets/new") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_operative(&auth) { return Ok(r); }
+ let name = f.name.trim();
+ if name.is_empty() {
+ let tpl = CmdbFormTemplate {
+ title: "Neues Configuration Item".into(),
+ ctx: page_ctx(&auth, "/assets"),
+ error: "Name ist erforderlich.".into(),
+ name: String::new(),
+ beschreibung: f.beschreibung.trim().to_string(),
+ attribute: f.attribute.clone(),
+ typ_opts: opts(&CI_TYPES, &f.ci_typ),
+ status_opts: opts(&CI_STATUS, &f.status),
+ };
+ return Ok(tpl.into_response());
+ }
+ let ci_typ = if CI_TYPES.contains(&f.ci_typ.as_str()) { f.ci_typ.as_str() } else { "Sonstiges" };
+ let status = if CI_STATUS.contains(&f.status.as_str()) { f.status.as_str() } else { "Aktiv" };
+ let cid = app.db.create_ci(auth.tenant_id, name, ci_typ, status,
+ f.beschreibung.trim(), text_to_attrs(&f.attribute)).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "ci_created", Some("ci"),
+ Some(&cid.to_string()),
+ Some(serde_json::json!({"name": name, "ci_typ": ci_typ})),
+ ctx.ip.as_deref()).await?;
+ Ok(Redirect::to(&format!("/assets/{}", cid)).into_response())
+}
+
+pub struct RelRow {
+ pub id: i32,
+ pub typ: String,
+ pub name: String,
+}
+
+#[derive(Template)]
+#[template(path = "cmdb_detail.html")]
+pub struct CmdbDetailTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub error: String,
+ pub id: i32,
+ pub name: String,
+ pub beschreibung: String,
+ pub attribute: String,
+ pub typ_opts: Vec,
+ pub status_opts: Vec,
+ pub rel_out: Vec,
+ pub rel_in: Vec,
+ pub rel_typ_opts: Vec,
+ pub other_cis: Vec,
+}
+
+async fn detail_template(app: &AppState, auth: &crate::db::AuthUser, ci_id: i32,
+ error: String) -> anyhow::Result> {
+ let Some((ci, rel_out, rel_in)) = app.db.get_ci(auth.tenant_id, ci_id).await? else {
+ return Ok(None);
+ };
+ let other_cis = app.db.list_cis(auth.tenant_id, None).await?
+ .into_iter().filter(|c| c.id != ci_id)
+ .map(|c| SelectOpt {
+ value: c.id.to_string(),
+ label: format!("{} ({})", c.name, c.ci_typ),
+ selected: false,
+ }).collect();
+ let map_rel = |r: &crate::db::CiRel| RelRow {
+ id: r.id,
+ typ: r.beziehungs_typ.clone(),
+ name: r.other_name.clone(),
+ };
+ Ok(Some(CmdbDetailTemplate {
+ title: ci.name.clone(),
+ ctx: page_ctx(auth, "/assets"),
+ error,
+ id: ci.id,
+ name: ci.name.clone(),
+ beschreibung: ci.beschreibung.clone().unwrap_or_default(),
+ attribute: attrs_to_text(&ci.attribute),
+ typ_opts: opts(&CI_TYPES, &ci.ci_typ),
+ status_opts: opts(&CI_STATUS, &ci.status),
+ rel_out: rel_out.iter().map(map_rel).collect(),
+ rel_in: rel_in.iter().map(map_rel).collect(),
+ rel_typ_opts: opts(&REL_TYPES, REL_TYPES[0]),
+ other_cis,
+ }))
+}
+
+pub async fn ci_detail_get(State(app): State, Extension(ctx): Extension,
+ Path(ci_id): Path) -> WebResult {
+ let auth = match need_auth(&ctx, "/assets") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_operative(&auth) { return Ok(r); }
+ match detail_template(&app, &auth, ci_id, String::new()).await? {
+ Some(tpl) => Ok(tpl.into_response()),
+ None => Ok(StatusCode::NOT_FOUND.into_response()),
+ }
+}
+
+pub async fn ci_detail_post(State(app): State, Extension(ctx): Extension,
+ Path(ci_id): Path, Form(f): Form) -> WebResult {
+ let auth = match need_auth(&ctx, "/assets") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_operative(&auth) { return Ok(r); }
+ let name = f.name.trim();
+ if name.is_empty() {
+ match detail_template(&app, &auth, ci_id, "Name ist erforderlich.".into()).await? {
+ Some(tpl) => return Ok(tpl.into_response()),
+ None => return Ok(StatusCode::NOT_FOUND.into_response()),
+ }
+ }
+ let ci_typ = if CI_TYPES.contains(&f.ci_typ.as_str()) { f.ci_typ.as_str() } else { "Sonstiges" };
+ let status = if CI_STATUS.contains(&f.status.as_str()) { f.status.as_str() } else { "Aktiv" };
+ app.db.update_ci(auth.tenant_id, ci_id, name, ci_typ, status,
+ f.beschreibung.trim(), text_to_attrs(&f.attribute)).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "ci_updated", Some("ci"),
+ Some(&ci_id.to_string()), Some(serde_json::json!({"name": name})),
+ ctx.ip.as_deref()).await?;
+ Ok(Redirect::to(&format!("/assets/{}", ci_id)).into_response())
+}
+
+#[derive(Deserialize)]
+pub struct RelForm {
+ pub to_ci_id: String,
+ #[serde(default)]
+ pub beziehungs_typ: String,
+}
+
+pub async fn ci_rel_add(State(app): State, Extension(ctx): Extension,
+ Path(ci_id): Path, Form(f): Form) -> WebResult {
+ let auth = match need_auth(&ctx, "/assets") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_operative(&auth) { return Ok(r); }
+ let typ = if REL_TYPES.contains(&f.beziehungs_typ.as_str()) { f.beziehungs_typ.as_str() } else { REL_TYPES[0] };
+ if let Ok(to_ci) = f.to_ci_id.parse::() {
+ if to_ci != ci_id && app.db.get_ci(auth.tenant_id, to_ci).await?.is_some() {
+ let rid = app.db.create_ci_relationship(auth.tenant_id, ci_id, to_ci, typ).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "ci_relationship_created",
+ Some("ci_relationship"), Some(&rid.to_string()),
+ Some(serde_json::json!({"from": ci_id, "to": to_ci, "typ": typ})),
+ ctx.ip.as_deref()).await?;
+ }
+ }
+ Ok(Redirect::to(&format!("/assets/{}", ci_id)).into_response())
+}
+
+pub async fn ci_rel_delete(State(app): State, Extension(ctx): Extension,
+ Path((ci_id, rel_id)): Path<(i32, i32)>) -> WebResult {
+ let auth = match need_auth(&ctx, "/assets") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_operative(&auth) { return Ok(r); }
+ app.db.delete_ci_relationship(auth.tenant_id, rel_id).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "ci_relationship_deleted",
+ Some("ci_relationship"), Some(&rel_id.to_string()), None,
+ ctx.ip.as_deref()).await?;
+ Ok(Redirect::to(&format!("/assets/{}", ci_id)).into_response())
+}
diff --git a/src/config.rs b/src/config.rs
new file mode 100755
index 0000000..cecfc89
--- /dev/null
+++ b/src/config.rs
@@ -0,0 +1,66 @@
+//! Zentrale Konfiguration (ENV) -- harte Startpruefung: lieber sofort
+//! scheitern als unsicher laufen.
+//!
+//! ENV:
+//! DATABASE_URL postgresql://user:pass@host:5432/dbname (Pflicht)
+//! ITSM_HTTPS "1" = Secure-Flag fuer Session-Cookies (hinter TLS)
+//! ITSM_TRUSTED_PROXY_COUNT Anzahl vertrauenswuerdiger Reverse-Proxies. Nur
+//! dann wird X-Forwarded-For ausgewertet -- sonst
+//! zaehlt die TCP-Peer-Adresse (kein IP-Spoofing
+//! im Audit-Log durch selbstgesetzte Header).
+//! ITSM_SESSION_HOURS Session-Lebensdauer (Default 8)
+//! ITSM_BIND Bind-Adresse (Default 0.0.0.0:8090)
+//! AES_DASHBOARD_URL Basis-URL des AES-Dashboards (Service-Katalog)
+//! RETENTION_INTERVAL_SECONDS Intervall Retention-Bereinigung (Default 24h)
+//! FORGE_BASE_URL Basis-URL des Forge-Git-Servers (optional)
+//! FORGE_SERVICE_TOKEN API-Token fuer Forge-Contents-Zugriffe (optional)
+//!
+//! Hinweis: anders als die fruehere Flask-Version braucht der Rust-Server
+//! kein ITSM_SECRET_KEY mehr -- Sessions liegen serverseitig in PostgreSQL
+//! (Tabelle sessions), im Cookie steckt nur ein Zufallstoken.
+
+pub struct Config {
+ pub database_url: String,
+ pub https: bool,
+ pub trusted_proxy_count: usize,
+ pub session_hours: i64,
+ pub bind: String,
+ pub aes_dashboard_url: String,
+ pub retention_interval_seconds: u64,
+ pub forge_base_url: String,
+ pub forge_service_token: String,
+ pub login_max_attempts: i64,
+ pub login_window_minutes: i64,
+ pub password_min_length: usize,
+}
+
+fn env(name: &str) -> String {
+ std::env::var(name).unwrap_or_default()
+}
+
+fn env_num(name: &str, default: T) -> T {
+ std::env::var(name).ok().and_then(|v| v.parse().ok()).unwrap_or(default)
+}
+
+impl Config {
+ pub fn from_env() -> anyhow::Result {
+ let cfg = Config {
+ database_url: env("DATABASE_URL"),
+ https: env("ITSM_HTTPS") == "1",
+ trusted_proxy_count: env_num("ITSM_TRUSTED_PROXY_COUNT", 0usize),
+ session_hours: env_num("ITSM_SESSION_HOURS", 8i64),
+ bind: std::env::var("ITSM_BIND").unwrap_or_else(|_| "0.0.0.0:8090".into()),
+ aes_dashboard_url: env("AES_DASHBOARD_URL").trim_end_matches('/').to_string(),
+ retention_interval_seconds: env_num("RETENTION_INTERVAL_SECONDS", 24 * 60 * 60u64),
+ forge_base_url: env("FORGE_BASE_URL").trim_end_matches('/').to_string(),
+ forge_service_token: env("FORGE_SERVICE_TOKEN"),
+ login_max_attempts: env_num("ITSM_LOGIN_MAX_ATTEMPTS", 5i64),
+ login_window_minutes: env_num("ITSM_LOGIN_WINDOW_MINUTES", 15i64),
+ password_min_length: env_num("ITSM_PASSWORD_MIN_LENGTH", 12usize),
+ };
+ if cfg.database_url.is_empty() {
+ anyhow::bail!("DATABASE_URL ist nicht gesetzt.");
+ }
+ Ok(cfg)
+ }
+}
diff --git a/src/dashboard.rs b/src/dashboard.rs
new file mode 100755
index 0000000..121dcf2
--- /dev/null
+++ b/src/dashboard.rs
@@ -0,0 +1,101 @@
+//! KPI-Dashboard (ITIL v4: Continual Improvement / v3: CSI).
+//! Kennzahlen: offene Tickets, SLA-Erfuellung, MTTR, Verteilung nach
+//! Kategorie und Prioritaet -- Basis fuer Service-Reviews.
+
+use askama::Template;
+use axum::extract::{Extension, State};
+use axum::response::IntoResponse;
+use chrono::{Duration, Utc};
+
+use crate::tickets::{is_overdue, resolve_due};
+use crate::web::{need_auth, page_ctx, AppState, PageCtx, ReqCtx, WebResult};
+use crate::itil;
+
+pub struct CountRow {
+ pub label: String,
+ pub count: usize,
+ pub pct: i32,
+}
+
+#[derive(Template)]
+#[template(path = "dashboard.html")]
+pub struct DashboardTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub kpis: Vec<(String, String)>,
+ pub by_category: Vec,
+ pub by_priority: Vec,
+}
+
+pub async fn dashboard(State(app): State, Extension(ctx): Extension) -> WebResult {
+ let auth = match need_auth(&ctx, "/dashboard") { Ok(a) => a, Err(r) => return Ok(r) };
+ let ersteller = if itil::is_operative(&auth.role) { None } else { Some(auth.user_id) };
+ let tickets = app.db.list_tickets(auth.tenant_id, ersteller).await?;
+ let now = Utc::now();
+
+ let open = tickets.iter().filter(|t| t.status != "Geloest" && t.status != "Geschlossen").count();
+ let overdue = tickets.iter().filter(|t| is_overdue(t, now)).count();
+
+ // SLA-Erfuellung: Anteil geloester Tickets, die innerhalb der Loesungsfrist
+ // geloest wurden (letzte 30 Tage).
+ let recent_resolved: Vec<_> = tickets.iter()
+ .filter(|t| t.resolved_at.map(|r| now - r <= Duration::days(30)).unwrap_or(false))
+ .collect();
+ let sla_met = recent_resolved.iter()
+ .filter(|t| match (t.resolved_at, resolve_due(t)) {
+ (Some(r), Some(due)) => r <= due,
+ _ => true,
+ }).count();
+ let sla_pct = if recent_resolved.is_empty() {
+ "--".to_string()
+ } else {
+ format!("{}%", (sla_met * 100) / recent_resolved.len())
+ };
+
+ // MTTR (Mean Time To Resolve) ueber die letzten 30 Tage.
+ let mttr = if recent_resolved.is_empty() {
+ "--".to_string()
+ } else {
+ let total_min: i64 = recent_resolved.iter()
+ .filter_map(|t| t.resolved_at.map(|r| (r - t.created_at).num_minutes()))
+ .sum();
+ let avg = total_min / recent_resolved.len() as i64;
+ if avg >= 60 * 24 {
+ format!("{:.1} Tage", avg as f64 / (60.0 * 24.0))
+ } else if avg >= 60 {
+ format!("{:.1} Std", avg as f64 / 60.0)
+ } else {
+ format!("{} Min", avg)
+ }
+ };
+
+ let kpis = vec![
+ ("Tickets gesamt".to_string(), tickets.len().to_string()),
+ ("Offen / laufend".to_string(), open.to_string()),
+ ("Ueberfaellig (SLA)".to_string(), overdue.to_string()),
+ ("SLA-Erfuellung (30 T)".to_string(), sla_pct),
+ ("MTTR (30 T)".to_string(), mttr),
+ ("Geloest (30 T)".to_string(), recent_resolved.len().to_string()),
+ ];
+
+ let dist = |values: Vec<&str>, get: &dyn Fn(&crate::db::Ticket) -> String| -> Vec {
+ let total = tickets.len().max(1);
+ values.iter().map(|v| {
+ let count = tickets.iter().filter(|t| get(t) == *v).count();
+ CountRow {
+ label: v.to_string(),
+ count,
+ pct: ((count * 100) / total) as i32,
+ }
+ }).collect()
+ };
+
+ let tpl = DashboardTemplate {
+ title: "Dashboard".into(),
+ ctx: page_ctx(&auth, "/dashboard"),
+ kpis,
+ by_category: dist(itil::CATEGORIES.to_vec(), &|t| t.kategorie.clone()),
+ by_priority: dist(itil::PRIORITIES.to_vec(), &|t| t.prioritaet.clone()),
+ };
+ Ok(tpl.into_response())
+}
diff --git a/src/db.rs b/src/db.rs
new file mode 100755
index 0000000..9b0a6c5
--- /dev/null
+++ b/src/db.rs
@@ -0,0 +1,910 @@
+//! Datenzugriffsschicht (PostgreSQL via deadpool/tokio-postgres, mandantenfaehig).
+//!
+//! Persistenz in PostgreSQL gemaess ISO 27001 / DSGVO / NIS 2 (Zugriffskontrolle,
+//! Audit-Log, Backup/Recovery). Alle Queries parametrisiert; Mandantentrennung
+//! strikt ueber tenant_id in jeder Abfrage.
+
+use chrono::{DateTime, Utc};
+use deadpool_postgres::{Manager, ManagerConfig, Pool, RecyclingMethod};
+use tokio_postgres::types::ToSql;
+use tokio_postgres::NoTls;
+
+pub type DbResult = anyhow::Result;
+
+#[derive(Clone)]
+pub struct Db {
+ pool: Pool,
+}
+
+// ── Datenstrukturen ────────────────────────────────────────────────────────────
+#[derive(Debug, Clone)]
+#[allow(dead_code)] // vollstaendiges Abbild der DB-Zeile
+pub struct Tenant {
+ pub id: i32,
+ pub name: String,
+ pub dsb_name: Option,
+ pub dsb_email: Option,
+ pub retention_tickets_days: i32,
+ pub retention_audit_days: i32,
+ pub sla_antwort_minuten: i32,
+ pub sla_loesung_minuten: i32,
+}
+
+#[derive(Debug, Clone)]
+#[allow(dead_code)]
+pub struct User {
+ pub id: i32,
+ pub tenant_id: i32,
+ pub email: String,
+ pub password_hash: String,
+ pub role: String,
+ pub active: bool,
+}
+
+#[derive(Debug, Clone)]
+pub struct UserDetails {
+ pub id: i32,
+ pub email: String,
+ pub role: String,
+ pub active: bool,
+ pub auth_source: String,
+ pub last_login_at: Option>,
+ pub vorname: Option,
+ pub nachname: Option,
+ pub telefon: Option,
+ pub abteilung: Option,
+ pub adresse: Option,
+}
+
+/// Angemeldeter Nutzer inkl. Session-Kontext (aus Session-Middleware).
+#[derive(Debug, Clone)]
+pub struct AuthUser {
+ pub user_id: i32,
+ pub tenant_id: i32,
+ pub email: String,
+ pub role: String,
+ pub tenant_name: String,
+ pub csrf_token: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct Service {
+ pub id: i32,
+ pub name: String,
+ pub beschreibung: Option,
+ pub gebucht: bool,
+ pub endpoint: Option,
+}
+
+#[derive(Debug, Clone)]
+#[allow(dead_code)]
+pub struct Ticket {
+ pub id: i32,
+ pub ticket_nr: String,
+ pub titel: String,
+ pub beschreibung: Option,
+ pub service_id: Option,
+ pub service_name: Option,
+ pub status: String,
+ pub prioritaet: String,
+ pub kategorie: String,
+ pub impact: String,
+ pub urgency: String,
+ pub change_typ: Option,
+ pub approval_status: Option,
+ pub problem_id: Option,
+ pub problem_nr: Option,
+ pub known_error: bool,
+ pub zugewiesen_an: Option,
+ pub ersteller_id: Option,
+ pub fortschritt: i32,
+ pub sla_antwort_minuten: Option,
+ pub sla_loesung_minuten: Option,
+ pub first_response_at: Option>,
+ pub resolved_at: Option>,
+ pub created_at: DateTime,
+ pub updated_at: DateTime,
+}
+
+#[derive(Debug, Clone)]
+pub struct TimelineItem {
+ pub zeit: DateTime,
+ pub akteur: Option,
+ pub text: Option,
+}
+
+#[derive(Debug, Clone)]
+pub struct TicketCi {
+ pub id: i32,
+ pub name: String,
+ pub ci_typ: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct ProblemRef {
+ pub id: i32,
+ pub ticket_nr: String,
+ pub titel: String,
+ pub known_error: bool,
+}
+
+#[derive(Debug, Clone)]
+pub struct AuditEntry {
+ pub zeit: DateTime,
+ pub user_email: Option,
+ pub aktion: String,
+ pub entity_typ: Option,
+ pub entity_id: Option,
+}
+
+#[derive(Debug, Clone)]
+pub struct KbArticle {
+ pub id: i32,
+ pub titel: String,
+ pub kategorie: String,
+ pub inhalt: String,
+ pub tags: Option,
+ pub status: String,
+ pub autor_email: Option,
+ pub updated_at: DateTime,
+}
+
+#[derive(Debug, Clone)]
+pub struct Ci {
+ pub id: i32,
+ pub name: String,
+ pub ci_typ: String,
+ pub status: String,
+ pub beschreibung: Option,
+ pub attribute: serde_json::Value,
+}
+
+#[derive(Debug, Clone)]
+pub struct CiRel {
+ pub id: i32,
+ pub beziehungs_typ: String,
+ pub other_name: String,
+}
+
+fn ticket_from_row(r: &tokio_postgres::Row) -> Ticket {
+ Ticket {
+ id: r.get("id"),
+ ticket_nr: r.get("ticket_nr"),
+ titel: r.get("titel"),
+ beschreibung: r.get("beschreibung"),
+ service_id: r.get("service_id"),
+ service_name: r.get("service_name"),
+ status: r.get("status"),
+ prioritaet: r.get("prioritaet"),
+ kategorie: r.get("kategorie"),
+ impact: r.get("impact"),
+ urgency: r.get("urgency"),
+ change_typ: r.get("change_typ"),
+ approval_status: r.get("approval_status"),
+ problem_id: r.get("problem_id"),
+ problem_nr: r.get("problem_nr"),
+ known_error: r.get("known_error"),
+ zugewiesen_an: r.get("zugewiesen_an"),
+ ersteller_id: r.get("ersteller_id"),
+ fortschritt: r.get("fortschritt"),
+ sla_antwort_minuten: r.get("sla_antwort_minuten"),
+ sla_loesung_minuten: r.get("sla_loesung_minuten"),
+ first_response_at: r.get("first_response_at"),
+ resolved_at: r.get("resolved_at"),
+ created_at: r.get("created_at"),
+ updated_at: r.get("updated_at"),
+ }
+}
+
+const TICKET_SELECT: &str = "SELECT t.*, s.name AS service_name, p.ticket_nr AS problem_nr
+ FROM tickets t
+ LEFT JOIN services s ON s.id = t.service_id
+ LEFT JOIN tickets p ON p.id = t.problem_id";
+
+impl Db {
+ pub fn connect(database_url: &str) -> DbResult {
+ let pg_config: tokio_postgres::Config = database_url.parse()?;
+ let mgr = Manager::from_config(
+ pg_config,
+ NoTls,
+ ManagerConfig { recycling_method: RecyclingMethod::Fast },
+ );
+ let pool = Pool::builder(mgr).max_size(10).build()?;
+ Ok(Db { pool })
+ }
+
+ async fn conn(&self) -> DbResult {
+ Ok(self.pool.get().await?)
+ }
+
+ /// Legt das Schema an (idempotent, siehe schema.sql). Beim App-Start.
+ pub async fn init_schema(&self) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.batch_execute(include_str!("../schema.sql")).await?;
+ Ok(())
+ }
+
+ pub async fn health(&self) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.query_one("SELECT 1", &[]).await?;
+ Ok(())
+ }
+
+ // ── Tenants / Ersteinrichtung ──────────────────────────────────────────────
+ pub async fn any_tenant_exists(&self) -> DbResult {
+ let c = self.conn().await?;
+ Ok(c.query_opt("SELECT 1 FROM tenants LIMIT 1", &[]).await?.is_some())
+ }
+
+ #[allow(clippy::too_many_arguments)]
+ pub async fn create_tenant(&self, name: &str, dsb_name: Option<&str>, dsb_email: Option<&str>,
+ retention_tickets_days: i32, retention_audit_days: i32,
+ sla_antwort: i32, sla_loesung: i32) -> DbResult {
+ let c = self.conn().await?;
+ let row = c.query_one(
+ "INSERT INTO tenants (name, dsb_name, dsb_email, retention_tickets_days,
+ retention_audit_days, sla_antwort_minuten, sla_loesung_minuten)
+ VALUES ($1,$2,$3,$4,$5,$6,$7) RETURNING id",
+ &[&name, &dsb_name, &dsb_email, &retention_tickets_days, &retention_audit_days,
+ &sla_antwort, &sla_loesung]).await?;
+ Ok(row.get(0))
+ }
+
+ pub async fn get_tenant(&self, tenant_id: i32) -> DbResult> {
+ let c = self.conn().await?;
+ Ok(c.query_opt("SELECT * FROM tenants WHERE id=$1", &[&tenant_id]).await?.map(|r| Tenant {
+ id: r.get("id"),
+ name: r.get("name"),
+ dsb_name: r.get("dsb_name"),
+ dsb_email: r.get("dsb_email"),
+ retention_tickets_days: r.get("retention_tickets_days"),
+ retention_audit_days: r.get("retention_audit_days"),
+ sla_antwort_minuten: r.get("sla_antwort_minuten"),
+ sla_loesung_minuten: r.get("sla_loesung_minuten"),
+ }))
+ }
+
+ #[allow(clippy::too_many_arguments)]
+ pub async fn update_tenant_settings(&self, tenant_id: i32, dsb_name: Option<&str>, dsb_email: Option<&str>,
+ retention_tickets_days: i32, retention_audit_days: i32,
+ sla_antwort: i32, sla_loesung: i32) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute(
+ "UPDATE tenants SET dsb_name=$1, dsb_email=$2, retention_tickets_days=$3,
+ retention_audit_days=$4, sla_antwort_minuten=$5, sla_loesung_minuten=$6 WHERE id=$7",
+ &[&dsb_name, &dsb_email, &retention_tickets_days, &retention_audit_days,
+ &sla_antwort, &sla_loesung, &tenant_id]).await?;
+ Ok(())
+ }
+
+ // ── Users ──────────────────────────────────────────────────────────────────
+ #[allow(clippy::too_many_arguments)]
+ pub async fn create_user(&self, tenant_id: i32, email: &str, password_hash: &str, role: &str,
+ vorname: Option<&str>, nachname: Option<&str>, telefon: Option<&str>,
+ abteilung: Option<&str>, adresse: Option<&str>) -> DbResult {
+ let c = self.conn().await?;
+ let row = c.query_one(
+ "INSERT INTO users (tenant_id, email, password_hash, role, vorname, nachname, telefon, abteilung, adresse)
+ VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9) RETURNING id",
+ &[&tenant_id, &email, &password_hash, &role, &vorname, &nachname, &telefon, &abteilung, &adresse]).await?;
+ Ok(row.get(0))
+ }
+
+ pub async fn get_user_by_email(&self, email: &str) -> DbResult> {
+ let c = self.conn().await?;
+ Ok(c.query_opt("SELECT id, tenant_id, email, password_hash, role, active FROM users WHERE email=$1 AND active=TRUE",
+ &[&email]).await?.map(|r| User {
+ id: r.get("id"),
+ tenant_id: r.get("tenant_id"),
+ email: r.get("email"),
+ password_hash: r.get("password_hash"),
+ role: r.get("role"),
+ active: r.get("active"),
+ }))
+ }
+
+ pub async fn touch_last_login(&self, user_id: i32) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("UPDATE users SET last_login_at=now() WHERE id=$1", &[&user_id]).await?;
+ Ok(())
+ }
+
+ pub async fn update_password_hash(&self, user_id: i32, hash: &str) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("UPDATE users SET password_hash=$1 WHERE id=$2", &[&hash, &user_id]).await?;
+ Ok(())
+ }
+
+ pub async fn email_exists(&self, email: &str, exclude_user_id: Option) -> DbResult {
+ let c = self.conn().await?;
+ let found = match exclude_user_id {
+ Some(uid) => c.query_opt("SELECT 1 FROM users WHERE email=$1 AND id<>$2", &[&email, &uid]).await?,
+ None => c.query_opt("SELECT 1 FROM users WHERE email=$1", &[&email]).await?,
+ };
+ Ok(found.is_some())
+ }
+
+ pub async fn list_users(&self, tenant_id: i32) -> DbResult> {
+ let c = self.conn().await?;
+ let rows = c.query(
+ "SELECT id, email, role, active, auth_source, last_login_at, vorname, nachname,
+ telefon, abteilung, adresse FROM users WHERE tenant_id=$1 ORDER BY email",
+ &[&tenant_id]).await?;
+ Ok(rows.iter().map(user_details_from_row).collect())
+ }
+
+ pub async fn get_user_details(&self, tenant_id: i32, user_id: i32) -> DbResult> {
+ let c = self.conn().await?;
+ Ok(c.query_opt(
+ "SELECT id, email, role, active, auth_source, last_login_at, vorname, nachname,
+ telefon, abteilung, adresse FROM users WHERE tenant_id=$1 AND id=$2",
+ &[&tenant_id, &user_id]).await?.map(|r| user_details_from_row(&r)))
+ }
+
+ #[allow(clippy::too_many_arguments)]
+ pub async fn update_user_profile(&self, tenant_id: i32, user_id: i32, vorname: Option<&str>,
+ nachname: Option<&str>, telefon: Option<&str>,
+ abteilung: Option<&str>, adresse: Option<&str>) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("UPDATE users SET vorname=$1, nachname=$2, telefon=$3, abteilung=$4, adresse=$5
+ WHERE tenant_id=$6 AND id=$7",
+ &[&vorname, &nachname, &telefon, &abteilung, &adresse, &tenant_id, &user_id]).await?;
+ Ok(())
+ }
+
+ pub async fn update_user_email(&self, tenant_id: i32, user_id: i32, email: &str) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("UPDATE users SET email=$1 WHERE tenant_id=$2 AND id=$3", &[&email, &tenant_id, &user_id]).await?;
+ Ok(())
+ }
+
+ pub async fn set_user_role(&self, tenant_id: i32, user_id: i32, role: &str) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("UPDATE users SET role=$1 WHERE tenant_id=$2 AND id=$3", &[&role, &tenant_id, &user_id]).await?;
+ Ok(())
+ }
+
+ pub async fn set_user_active(&self, tenant_id: i32, user_id: i32, active: bool) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("UPDATE users SET active=$1 WHERE tenant_id=$2 AND id=$3", &[&active, &tenant_id, &user_id]).await?;
+ if !active {
+ // Kontosperrung widerruft alle laufenden Sessions sofort.
+ c.execute("DELETE FROM sessions WHERE user_id=$1", &[&user_id]).await?;
+ }
+ Ok(())
+ }
+
+ // ── Sessions (serverseitig, widerrufbar) ───────────────────────────────────
+ pub async fn create_session(&self, token_hash: &str, user_id: i32, csrf_token: &str, hours: i64) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute(
+ "INSERT INTO sessions (token_hash, user_id, csrf_token, expires_at)
+ VALUES ($1,$2,$3, now() + ($4 || ' hours')::interval)",
+ &[&token_hash, &user_id, &csrf_token, &hours.to_string()]).await?;
+ Ok(())
+ }
+
+ pub async fn get_session_user(&self, token_hash: &str) -> DbResult> {
+ let c = self.conn().await?;
+ Ok(c.query_opt(
+ "SELECT u.id AS user_id, u.tenant_id, u.email, u.role, t.name AS tenant_name, s.csrf_token
+ FROM sessions s
+ JOIN users u ON u.id = s.user_id AND u.active=TRUE
+ JOIN tenants t ON t.id = u.tenant_id
+ WHERE s.token_hash=$1 AND s.expires_at > now()",
+ &[&token_hash]).await?.map(|r| AuthUser {
+ user_id: r.get("user_id"),
+ tenant_id: r.get("tenant_id"),
+ email: r.get("email"),
+ role: r.get("role"),
+ tenant_name: r.get("tenant_name"),
+ csrf_token: r.get("csrf_token"),
+ }))
+ }
+
+ pub async fn delete_session(&self, token_hash: &str) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("DELETE FROM sessions WHERE token_hash=$1", &[&token_hash]).await?;
+ Ok(())
+ }
+
+ // ── Login-Rate-Limiting ────────────────────────────────────────────────────
+ pub async fn record_login_attempt(&self, email: &str, ip: Option<&str>, success: bool) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("INSERT INTO login_attempts (email, ip, success) VALUES ($1,$2,$3)",
+ &[&email, &ip, &success]).await?;
+ Ok(())
+ }
+
+ /// Fehlversuche im Zeitfenster; der hoehere Wert von E-Mail- und IP-Zaehlung
+ /// zaehlt (gezieltes Bruteforcing UND breites Passwort-Spraying abdecken).
+ pub async fn count_recent_failed_logins(&self, email: &str, ip: Option<&str>, window_minutes: i64) -> DbResult {
+ let c = self.conn().await?;
+ let row = c.query_one(
+ "SELECT
+ (SELECT count(*) FROM login_attempts WHERE email=$1 AND success=FALSE
+ AND zeit > now() - ($2 || ' minutes')::interval),
+ (SELECT count(*) FROM login_attempts WHERE ip=$3 AND $3 IS NOT NULL AND success=FALSE
+ AND zeit > now() - ($2 || ' minutes')::interval)",
+ &[&email, &window_minutes.to_string(), &ip]).await?;
+ let by_email: i64 = row.get(0);
+ let by_ip: i64 = row.get(1);
+ Ok(by_email.max(by_ip))
+ }
+
+ // ── Audit-Log ──────────────────────────────────────────────────────────────
+ pub async fn log_audit(&self, tenant_id: Option, user_id: Option, aktion: &str,
+ entity_typ: Option<&str>, entity_id: Option<&str>,
+ details: Option, ip: Option<&str>) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute(
+ "INSERT INTO audit_log (tenant_id, user_id, aktion, entity_typ, entity_id, details, ip)
+ VALUES ($1,$2,$3,$4,$5,$6,$7)",
+ &[&tenant_id, &user_id, &aktion, &entity_typ, &entity_id, &details, &ip]).await?;
+ Ok(())
+ }
+
+ pub async fn list_audit(&self, tenant_id: i32, limit: i64) -> DbResult> {
+ let c = self.conn().await?;
+ let rows = c.query(
+ "SELECT a.zeit, a.aktion, a.entity_typ, a.entity_id, u.email AS user_email
+ FROM audit_log a LEFT JOIN users u ON u.id = a.user_id
+ WHERE a.tenant_id=$1 ORDER BY a.zeit DESC LIMIT $2",
+ &[&tenant_id, &limit]).await?;
+ Ok(rows.iter().map(|r| AuditEntry {
+ zeit: r.get("zeit"),
+ user_email: r.get("user_email"),
+ aktion: r.get("aktion"),
+ entity_typ: r.get("entity_typ"),
+ entity_id: r.get("entity_id"),
+ }).collect())
+ }
+
+ // ── Services ───────────────────────────────────────────────────────────────
+ pub async fn create_service(&self, tenant_id: i32, name: &str, beschreibung: &str,
+ kategorie: &str, gebucht: bool, endpoint: Option<&str>) -> DbResult {
+ let c = self.conn().await?;
+ let row = c.query_one(
+ "INSERT INTO services (tenant_id, name, beschreibung, kategorie, gebucht, endpoint)
+ VALUES ($1,$2,$3,$4,$5,$6) RETURNING id",
+ &[&tenant_id, &name, &beschreibung, &kategorie, &gebucht, &endpoint]).await?;
+ Ok(row.get(0))
+ }
+
+ pub async fn list_services(&self, tenant_id: i32) -> DbResult> {
+ let c = self.conn().await?;
+ let rows = c.query("SELECT id, name, beschreibung, gebucht, endpoint FROM services
+ WHERE tenant_id=$1 ORDER BY id", &[&tenant_id]).await?;
+ Ok(rows.iter().map(|r| Service {
+ id: r.get("id"),
+ name: r.get("name"),
+ beschreibung: r.get("beschreibung"),
+ gebucht: r.get("gebucht"),
+ endpoint: r.get("endpoint"),
+ }).collect())
+ }
+
+ // ── Tickets ────────────────────────────────────────────────────────────────
+ async fn next_ticket_nr(&self, tenant_id: i32) -> DbResult {
+ let year = Utc::now().format("%Y").to_string();
+ let prefix = format!("TKT-{}-", year);
+ let like = format!("{}%", prefix);
+ let c = self.conn().await?;
+ let row = c.query_opt(
+ "SELECT ticket_nr FROM tickets WHERE tenant_id=$1 AND ticket_nr LIKE $2
+ ORDER BY ticket_nr DESC LIMIT 1",
+ &[&tenant_id, &like]).await?;
+ let seq = row
+ .and_then(|r| r.get::<_, String>(0).rsplit('-').next().and_then(|s| s.parse::().ok()))
+ .map(|n| n + 1)
+ .unwrap_or(1);
+ Ok(format!("{}{:06}", prefix, seq))
+ }
+
+ #[allow(clippy::too_many_arguments)]
+ pub async fn create_ticket(&self, tenant_id: i32, titel: &str, beschreibung: &str,
+ service_id: Option, prioritaet: &str, kategorie: &str,
+ zugewiesen_an: Option<&str>, ersteller_id: i32,
+ sla_antwort: i32, sla_loesung: i32, actor: &str,
+ impact: &str, urgency: &str,
+ change_typ: Option<&str>, approval_status: Option<&str>) -> DbResult<(i32, String)> {
+ let ticket_nr = self.next_ticket_nr(tenant_id).await?;
+ let mut c = self.conn().await?;
+ let tx = c.transaction().await?;
+ let row = tx.query_one(
+ "INSERT INTO tickets (tenant_id, ticket_nr, titel, beschreibung, service_id, prioritaet,
+ kategorie, zugewiesen_an, ersteller_id, sla_antwort_minuten, sla_loesung_minuten,
+ impact, urgency, change_typ, approval_status)
+ VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15) RETURNING id",
+ &[&tenant_id, &ticket_nr, &titel, &beschreibung, &service_id, &prioritaet, &kategorie,
+ &zugewiesen_an, &ersteller_id, &sla_antwort, &sla_loesung, &impact, &urgency,
+ &change_typ, &approval_status]).await?;
+ let tid: i32 = row.get(0);
+ tx.execute("INSERT INTO ticket_timeline (ticket_id, tenant_id, akteur, text) VALUES ($1,$2,$3,$4)",
+ &[&tid, &tenant_id, &actor, &"Ticket angelegt."]).await?;
+ tx.commit().await?;
+ Ok((tid, ticket_nr))
+ }
+
+ pub async fn list_tickets(&self, tenant_id: i32, ersteller_id: Option) -> DbResult> {
+ let c = self.conn().await?;
+ let mut sql = format!("{} WHERE t.tenant_id=$1", TICKET_SELECT);
+ let mut params: Vec<&(dyn ToSql + Sync)> = vec![&tenant_id];
+ if let Some(ref eid) = ersteller_id {
+ sql.push_str(" AND t.ersteller_id=$2");
+ params.push(eid);
+ }
+ sql.push_str(" ORDER BY t.updated_at DESC");
+ let rows = c.query(&sql, ¶ms).await?;
+ Ok(rows.iter().map(ticket_from_row).collect())
+ }
+
+ pub async fn get_ticket(&self, tenant_id: i32, ticket_id: i32) -> DbResult> {
+ let c = self.conn().await?;
+ let sql = format!("{} WHERE t.tenant_id=$1 AND t.id=$2", TICKET_SELECT);
+ Ok(c.query_opt(&sql, &[&tenant_id, &ticket_id]).await?.map(|r| ticket_from_row(&r)))
+ }
+
+ pub async fn get_ticket_timeline(&self, tenant_id: i32, ticket_id: i32) -> DbResult> {
+ let c = self.conn().await?;
+ let rows = c.query(
+ "SELECT zeit, akteur, text FROM ticket_timeline WHERE tenant_id=$1 AND ticket_id=$2 ORDER BY zeit DESC",
+ &[&tenant_id, &ticket_id]).await?;
+ Ok(rows.iter().map(|r| TimelineItem {
+ zeit: r.get("zeit"),
+ akteur: r.get("akteur"),
+ text: r.get("text"),
+ }).collect())
+ }
+
+ pub async fn get_ticket_cis(&self, tenant_id: i32, ticket_id: i32) -> DbResult> {
+ let c = self.conn().await?;
+ let rows = c.query(
+ "SELECT c.id, c.name, c.ci_typ FROM ticket_ci_links l
+ JOIN configuration_items c ON c.id = l.ci_id
+ WHERE l.tenant_id=$1 AND l.ticket_id=$2 ORDER BY c.name",
+ &[&tenant_id, &ticket_id]).await?;
+ Ok(rows.iter().map(|r| TicketCi { id: r.get("id"), name: r.get("name"), ci_typ: r.get("ci_typ") }).collect())
+ }
+
+ /// Setzt den Status und pflegt SLA-Zeitstempel (erste Reaktion, Loesung,
+ /// Schliessung). Reopen setzt resolved_at zurueck. Die Gueltigkeit des
+ /// Uebergangs prueft der Aufrufer via itil::is_valid_transition.
+ pub async fn update_ticket_status(&self, tenant_id: i32, ticket_id: i32, status: &str, actor: &str) -> DbResult<()> {
+ let mut c = self.conn().await?;
+ let tx = c.transaction().await?;
+ tx.execute(
+ "UPDATE tickets SET status=$1, updated_at=now(),
+ fortschritt = CASE WHEN $1 IN ('Geloest','Geschlossen') THEN 100 ELSE fortschritt END,
+ first_response_at = CASE WHEN $1 = 'In Bearbeitung' AND first_response_at IS NULL
+ THEN now() ELSE first_response_at END,
+ resolved_at = CASE WHEN $1 = 'Geloest' THEN now()
+ WHEN $1 = 'Offen' THEN NULL ELSE resolved_at END,
+ closed_at = CASE WHEN $1 = 'Geschlossen' THEN now() ELSE closed_at END
+ WHERE tenant_id=$2 AND id=$3",
+ &[&status, &tenant_id, &ticket_id]).await?;
+ let text = format!("Status geaendert auf '{}'.", status);
+ tx.execute("INSERT INTO ticket_timeline (ticket_id, tenant_id, akteur, text) VALUES ($1,$2,$3,$4)",
+ &[&ticket_id, &tenant_id, &actor, &text]).await?;
+ tx.commit().await?;
+ Ok(())
+ }
+
+ /// Change Enablement: Freigabe/Ablehnung eines Change-Tickets.
+ pub async fn set_ticket_approval(&self, tenant_id: i32, ticket_id: i32, approval_status: &str,
+ approver_user_id: i32, actor: &str) -> DbResult<()> {
+ let mut c = self.conn().await?;
+ let tx = c.transaction().await?;
+ tx.execute(
+ "UPDATE tickets SET approval_status=$1, approved_by=$2, approved_at=now(), updated_at=now()
+ WHERE tenant_id=$3 AND id=$4 AND kategorie='Change'",
+ &[&approval_status, &approver_user_id, &tenant_id, &ticket_id]).await?;
+ let text = format!("Change-Freigabe: {}.", approval_status);
+ tx.execute("INSERT INTO ticket_timeline (ticket_id, tenant_id, akteur, text) VALUES ($1,$2,$3,$4)",
+ &[&ticket_id, &tenant_id, &actor, &text]).await?;
+ tx.commit().await?;
+ Ok(())
+ }
+
+ /// Problem Management: Incident <-> Problem verknuepfen/loesen.
+ pub async fn set_ticket_problem_link(&self, tenant_id: i32, ticket_id: i32,
+ problem_id: Option, actor: &str) -> DbResult<()> {
+ let mut c = self.conn().await?;
+ let tx = c.transaction().await?;
+ tx.execute("UPDATE tickets SET problem_id=$1, updated_at=now() WHERE tenant_id=$2 AND id=$3",
+ &[&problem_id, &tenant_id, &ticket_id]).await?;
+ let text = match problem_id {
+ Some(pid) => format!("Mit Problem #{} verknuepft.", pid),
+ None => "Problem-Verknuepfung entfernt.".to_string(),
+ };
+ tx.execute("INSERT INTO ticket_timeline (ticket_id, tenant_id, akteur, text) VALUES ($1,$2,$3,$4)",
+ &[&ticket_id, &tenant_id, &actor, &text]).await?;
+ tx.commit().await?;
+ Ok(())
+ }
+
+ pub async fn set_known_error(&self, tenant_id: i32, ticket_id: i32, known_error: bool, actor: &str) -> DbResult<()> {
+ let mut c = self.conn().await?;
+ let tx = c.transaction().await?;
+ tx.execute(
+ "UPDATE tickets SET known_error=$1, updated_at=now() WHERE tenant_id=$2 AND id=$3 AND kategorie='Problem'",
+ &[&known_error, &tenant_id, &ticket_id]).await?;
+ let text = if known_error { "Als Known Error markiert." } else { "Known-Error-Markierung entfernt." };
+ tx.execute("INSERT INTO ticket_timeline (ticket_id, tenant_id, akteur, text) VALUES ($1,$2,$3,$4)",
+ &[&ticket_id, &tenant_id, &actor, &text]).await?;
+ tx.commit().await?;
+ Ok(())
+ }
+
+ pub async fn add_ticket_comment(&self, tenant_id: i32, ticket_id: i32, actor: &str, text: &str) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("INSERT INTO ticket_timeline (ticket_id, tenant_id, akteur, text) VALUES ($1,$2,$3,$4)",
+ &[&ticket_id, &tenant_id, &actor, &text]).await?;
+ Ok(())
+ }
+
+ /// Worklog-Eintrag fuer eine ueber ITSM vorgenommene Forge-Repo-Aenderung
+ /// (phase-008: JEDE Repo-Aenderung MUSS im Worklog dokumentiert werden;
+ /// Fehler hier => Aufrufer darf keinen Erfolg melden).
+ pub async fn log_repo_edit(&self, tenant_id: i32, ticket_id: i32, actor: &str, repo: &str,
+ path: &str, branch: &str, commit_sha: &str) -> DbResult<()> {
+ let short = &commit_sha[..commit_sha.len().min(10)];
+ let text = format!("Repo-Datei bearbeitet: {}@{} ({}) -- Commit {}", repo, branch, path, short);
+ self.add_ticket_comment(tenant_id, ticket_id, actor, &text).await
+ }
+
+ pub async fn list_problems(&self, tenant_id: i32) -> DbResult> {
+ let c = self.conn().await?;
+ let rows = c.query(
+ "SELECT id, ticket_nr, titel, known_error FROM tickets
+ WHERE tenant_id=$1 AND kategorie='Problem' AND status <> 'Geschlossen' ORDER BY id DESC",
+ &[&tenant_id]).await?;
+ Ok(rows.iter().map(|r| ProblemRef {
+ id: r.get("id"),
+ ticket_nr: r.get("ticket_nr"),
+ titel: r.get("titel"),
+ known_error: r.get("known_error"),
+ }).collect())
+ }
+
+ pub async fn link_ticket_ci(&self, tenant_id: i32, ticket_id: i32, ci_id: i32) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("INSERT INTO ticket_ci_links (tenant_id, ticket_id, ci_id) VALUES ($1,$2,$3)
+ ON CONFLICT (ticket_id, ci_id) DO NOTHING",
+ &[&tenant_id, &ticket_id, &ci_id]).await?;
+ Ok(())
+ }
+
+ pub async fn unlink_ticket_ci(&self, tenant_id: i32, ticket_id: i32, ci_id: i32) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("DELETE FROM ticket_ci_links WHERE tenant_id=$1 AND ticket_id=$2 AND ci_id=$3",
+ &[&tenant_id, &ticket_id, &ci_id]).await?;
+ Ok(())
+ }
+
+ // ── Wissensdatenbank ───────────────────────────────────────────────────────
+ pub async fn create_kb_article(&self, tenant_id: i32, titel: &str, kategorie: &str, inhalt: &str,
+ tags: &str, autor_user_id: i32) -> DbResult {
+ let c = self.conn().await?;
+ let row = c.query_one(
+ "INSERT INTO kb_articles (tenant_id, titel, kategorie, inhalt, tags, autor_user_id, status)
+ VALUES ($1,$2,$3,$4,$5,$6,'Entwurf') RETURNING id",
+ &[&tenant_id, &titel, &kategorie, &inhalt, &tags, &autor_user_id]).await?;
+ Ok(row.get(0))
+ }
+
+ pub async fn list_kb_articles(&self, tenant_id: i32, kategorie: Option<&str>, q: Option<&str>,
+ only_released: bool) -> DbResult> {
+ let c = self.conn().await?;
+ let mut sql = String::from(
+ "SELECT k.id, k.titel, k.kategorie, k.inhalt, k.tags, k.status, k.updated_at,
+ u.email AS autor_email FROM kb_articles k
+ LEFT JOIN users u ON u.id = k.autor_user_id WHERE k.tenant_id=$1");
+ let like;
+ let mut params: Vec<&(dyn ToSql + Sync)> = vec![&tenant_id];
+ if only_released {
+ sql.push_str(" AND k.status='Freigegeben'");
+ }
+ if let Some(ref kat) = kategorie {
+ params.push(kat);
+ sql.push_str(&format!(" AND k.kategorie=${}", params.len()));
+ }
+ if let Some(qs) = q {
+ like = format!("%{}%", qs);
+ params.push(&like);
+ let n = params.len();
+ sql.push_str(&format!(" AND (k.titel ILIKE ${n} OR k.inhalt ILIKE ${n} OR k.tags ILIKE ${n})"));
+ }
+ sql.push_str(" ORDER BY k.updated_at DESC");
+ let rows = c.query(&sql, ¶ms).await?;
+ Ok(rows.iter().map(kb_from_row).collect())
+ }
+
+ pub async fn get_kb_article(&self, tenant_id: i32, article_id: i32) -> DbResult> {
+ let c = self.conn().await?;
+ Ok(c.query_opt(
+ "SELECT k.id, k.titel, k.kategorie, k.inhalt, k.tags, k.status, k.updated_at,
+ u.email AS autor_email FROM kb_articles k
+ LEFT JOIN users u ON u.id = k.autor_user_id WHERE k.tenant_id=$1 AND k.id=$2",
+ &[&tenant_id, &article_id]).await?.map(|r| kb_from_row(&r)))
+ }
+
+ pub async fn update_kb_article(&self, tenant_id: i32, article_id: i32, titel: &str,
+ kategorie: &str, inhalt: &str, tags: &str) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("UPDATE kb_articles SET titel=$1, kategorie=$2, inhalt=$3, tags=$4, updated_at=now()
+ WHERE tenant_id=$5 AND id=$6",
+ &[&titel, &kategorie, &inhalt, &tags, &tenant_id, &article_id]).await?;
+ Ok(())
+ }
+
+ pub async fn set_kb_status(&self, tenant_id: i32, article_id: i32, status: &str) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("UPDATE kb_articles SET status=$1, updated_at=now() WHERE tenant_id=$2 AND id=$3",
+ &[&status, &tenant_id, &article_id]).await?;
+ Ok(())
+ }
+
+ pub async fn delete_kb_article(&self, tenant_id: i32, article_id: i32) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("DELETE FROM kb_articles WHERE tenant_id=$1 AND id=$2", &[&tenant_id, &article_id]).await?;
+ Ok(())
+ }
+
+ // ── CMDB ───────────────────────────────────────────────────────────────────
+ pub async fn create_ci(&self, tenant_id: i32, name: &str, ci_typ: &str, status: &str,
+ beschreibung: &str, attribute: serde_json::Value) -> DbResult {
+ let c = self.conn().await?;
+ let row = c.query_one(
+ "INSERT INTO configuration_items (tenant_id, name, ci_typ, status, beschreibung, attribute)
+ VALUES ($1,$2,$3,$4,$5,$6) RETURNING id",
+ &[&tenant_id, &name, &ci_typ, &status, &beschreibung, &attribute]).await?;
+ Ok(row.get(0))
+ }
+
+ pub async fn list_cis(&self, tenant_id: i32, ci_typ: Option<&str>) -> DbResult> {
+ let c = self.conn().await?;
+ let rows = match ci_typ {
+ Some(t) => c.query("SELECT id, name, ci_typ, status, beschreibung, attribute FROM configuration_items
+ WHERE tenant_id=$1 AND ci_typ=$2 ORDER BY name", &[&tenant_id, &t]).await?,
+ None => c.query("SELECT id, name, ci_typ, status, beschreibung, attribute FROM configuration_items
+ WHERE tenant_id=$1 ORDER BY ci_typ, name", &[&tenant_id]).await?,
+ };
+ Ok(rows.iter().map(ci_from_row).collect())
+ }
+
+ pub async fn get_ci(&self, tenant_id: i32, ci_id: i32) -> DbResult, Vec)>> {
+ let c = self.conn().await?;
+ let Some(row) = c.query_opt(
+ "SELECT id, name, ci_typ, status, beschreibung, attribute FROM configuration_items
+ WHERE tenant_id=$1 AND id=$2", &[&tenant_id, &ci_id]).await? else {
+ return Ok(None);
+ };
+ let ci = ci_from_row(&row);
+ let rel_out = c.query(
+ "SELECT r.id, r.beziehungs_typ, c.name AS other_name FROM ci_relationships r
+ JOIN configuration_items c ON c.id = r.to_ci_id
+ WHERE r.tenant_id=$1 AND r.from_ci_id=$2 ORDER BY r.id", &[&tenant_id, &ci_id]).await?;
+ let rel_in = c.query(
+ "SELECT r.id, r.beziehungs_typ, c.name AS other_name FROM ci_relationships r
+ JOIN configuration_items c ON c.id = r.from_ci_id
+ WHERE r.tenant_id=$1 AND r.to_ci_id=$2 ORDER BY r.id", &[&tenant_id, &ci_id]).await?;
+ let map = |r: &tokio_postgres::Row| CiRel {
+ id: r.get("id"),
+ beziehungs_typ: r.get("beziehungs_typ"),
+ other_name: r.get("other_name"),
+ };
+ Ok(Some((ci, rel_out.iter().map(map).collect(), rel_in.iter().map(map).collect())))
+ }
+
+ #[allow(clippy::too_many_arguments)]
+ pub async fn update_ci(&self, tenant_id: i32, ci_id: i32, name: &str, ci_typ: &str, status: &str,
+ beschreibung: &str, attribute: serde_json::Value) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("UPDATE configuration_items SET name=$1, ci_typ=$2, status=$3, beschreibung=$4,
+ attribute=$5, updated_at=now() WHERE tenant_id=$6 AND id=$7",
+ &[&name, &ci_typ, &status, &beschreibung, &attribute, &tenant_id, &ci_id]).await?;
+ Ok(())
+ }
+
+ pub async fn create_ci_relationship(&self, tenant_id: i32, from_ci: i32, to_ci: i32, typ: &str) -> DbResult {
+ let c = self.conn().await?;
+ let row = c.query_one(
+ "INSERT INTO ci_relationships (tenant_id, from_ci_id, to_ci_id, beziehungs_typ)
+ VALUES ($1,$2,$3,$4) RETURNING id",
+ &[&tenant_id, &from_ci, &to_ci, &typ]).await?;
+ Ok(row.get(0))
+ }
+
+ pub async fn delete_ci_relationship(&self, tenant_id: i32, rel_id: i32) -> DbResult<()> {
+ let c = self.conn().await?;
+ c.execute("DELETE FROM ci_relationships WHERE tenant_id=$1 AND id=$2", &[&tenant_id, &rel_id]).await?;
+ Ok(())
+ }
+
+ // ── Aufbewahrungsfrist-Bereinigung (DSGVO Speicherbegrenzung) ──────────────
+ /// Loescht abgeschlossene Tickets / alte Audit-Eintraege gemaess den pro
+ /// Mandant hinterlegten Fristen. Postgres-Advisory-Lock verhindert
+ /// parallele Laeufe. Abgelaufene Sessions und alte Login-Versuche werden
+ /// mit bereinigt (Datenminimierung).
+ pub async fn run_retention_cleanup(&self) -> DbResult<()> {
+ const LOCK_KEY: i64 = 727271;
+ let c = self.conn().await?;
+ let got: bool = c.query_one("SELECT pg_try_advisory_lock($1)", &[&LOCK_KEY]).await?.get(0);
+ if !got {
+ return Ok(());
+ }
+ let result = async {
+ let tenants = c.query(
+ "SELECT id, retention_tickets_days, retention_audit_days FROM tenants", &[]).await?;
+ for t in &tenants {
+ let tid: i32 = t.get("id");
+ let rt: i32 = t.get("retention_tickets_days");
+ let ra: i32 = t.get("retention_audit_days");
+ let tickets_deleted = c.execute(
+ "DELETE FROM tickets WHERE tenant_id=$1 AND status IN ('Geloest','Geschlossen')
+ AND updated_at < now() - ($2 || ' days')::interval",
+ &[&tid, &rt.to_string()]).await?;
+ let audit_deleted = c.execute(
+ "DELETE FROM audit_log WHERE tenant_id=$1 AND aktion <> 'retention_cleanup'
+ AND zeit < now() - ($2 || ' days')::interval",
+ &[&tid, &ra.to_string()]).await?;
+ if tickets_deleted > 0 || audit_deleted > 0 {
+ let details = serde_json::json!({
+ "tickets_deleted": tickets_deleted,
+ "audit_log_deleted": audit_deleted,
+ });
+ c.execute(
+ "INSERT INTO audit_log (tenant_id, aktion, entity_typ, entity_id, details)
+ VALUES ($1,'retention_cleanup','tenant',$2,$3)",
+ &[&tid, &tid.to_string(), &details]).await?;
+ }
+ }
+ c.execute("DELETE FROM login_attempts WHERE zeit < now() - interval '7 days'", &[]).await?;
+ c.execute("DELETE FROM sessions WHERE expires_at < now()", &[]).await?;
+ Ok::<(), anyhow::Error>(())
+ }.await;
+ c.execute("SELECT pg_advisory_unlock($1)", &[&LOCK_KEY]).await.ok();
+ result
+ }
+}
+
+fn user_details_from_row(r: &tokio_postgres::Row) -> UserDetails {
+ UserDetails {
+ id: r.get("id"),
+ email: r.get("email"),
+ role: r.get("role"),
+ active: r.get("active"),
+ auth_source: r.get("auth_source"),
+ last_login_at: r.get("last_login_at"),
+ vorname: r.get("vorname"),
+ nachname: r.get("nachname"),
+ telefon: r.get("telefon"),
+ abteilung: r.get("abteilung"),
+ adresse: r.get("adresse"),
+ }
+}
+
+fn kb_from_row(r: &tokio_postgres::Row) -> KbArticle {
+ KbArticle {
+ id: r.get("id"),
+ titel: r.get("titel"),
+ kategorie: r.get("kategorie"),
+ inhalt: r.get("inhalt"),
+ tags: r.get("tags"),
+ status: r.get("status"),
+ autor_email: r.get("autor_email"),
+ updated_at: r.get("updated_at"),
+ }
+}
+
+fn ci_from_row(r: &tokio_postgres::Row) -> Ci {
+ Ci {
+ id: r.get("id"),
+ name: r.get("name"),
+ ci_typ: r.get("ci_typ"),
+ status: r.get("status"),
+ beschreibung: r.get("beschreibung"),
+ attribute: r.get("attribute"),
+ }
+}
diff --git a/src/forge.rs b/src/forge.rs
new file mode 100755
index 0000000..f94c67e
--- /dev/null
+++ b/src/forge.rs
@@ -0,0 +1,123 @@
+//! HTTP-Client fuer die Forge-Contents-API (phase-008-itsm-repo-audit).
+//!
+//! Spricht ausschliesslich die Forge-REST-API (siehe mscadm/forge,
+//! forge-web/src/api.rs), die bewusst Gitea-API-kompatibel gehalten ist.
+//! Bewusster Scope-Schnitt: nur get_contents/update_contents.
+
+use base64::Engine;
+use serde::Deserialize;
+
+pub struct ForgeClient {
+ base_url: String,
+ token: String,
+ http: reqwest::Client,
+}
+
+#[derive(Debug)]
+pub struct ForgeError(pub String);
+
+impl std::fmt::Display for ForgeError {
+ fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+ write!(f, "{}", self.0)
+ }
+}
+impl std::error::Error for ForgeError {}
+
+#[derive(Deserialize)]
+struct ContentsResponse {
+ #[serde(rename = "type")]
+ typ: Option,
+ content: Option,
+ sha: Option,
+}
+
+#[derive(Deserialize)]
+struct CommitInfo {
+ sha: String,
+}
+
+#[derive(Deserialize)]
+struct UpdateResponse {
+ commit: CommitInfo,
+}
+
+impl ForgeClient {
+ /// None, wenn FORGE_BASE_URL nicht konfiguriert ist -- die Repo-Bearbeitung
+ /// aus Tickets heraus ist dann deaktiviert.
+ pub fn from_config(base_url: &str, token: &str) -> Option {
+ if base_url.is_empty() {
+ return None;
+ }
+ let http = reqwest::Client::builder()
+ .timeout(std::time::Duration::from_secs(10))
+ .build()
+ .ok()?;
+ Some(ForgeClient {
+ base_url: base_url.trim_end_matches('/').to_string(),
+ token: token.to_string(),
+ http,
+ })
+ }
+
+ /// Liest eine UTF-8-Textdatei aus einem Forge-Repo. Rueckgabe: (text, sha).
+ pub async fn get_contents(&self, repo: &str, path: &str, r#ref: &str) -> Result<(String, String), ForgeError> {
+ let url = format!("{}/api/v1/repos/x/{}/contents/{}?ref={}",
+ self.base_url, repo, path, urlencode(r#ref));
+ let resp = self.http.get(&url)
+ .header("Authorization", format!("token {}", self.token))
+ .send().await
+ .map_err(|e| ForgeError(format!("Forge nicht erreichbar: {e}")))?;
+ let status = resp.status();
+ let body = resp.text().await.unwrap_or_default();
+ if !status.is_success() {
+ return Err(ForgeError(format!("Forge-API-Fehler ({}): {}", status.as_u16(), body)));
+ }
+ let parsed: ContentsResponse = serde_json::from_str(&body)
+ .map_err(|e| ForgeError(format!("Forge-Antwort nicht parsebar: {e}")))?;
+ if parsed.typ.as_deref() != Some("file") {
+ return Err(ForgeError(format!("Pfad ist keine Datei: {path}")));
+ }
+ let raw = base64::engine::general_purpose::STANDARD
+ .decode(parsed.content.unwrap_or_default().replace('\n', ""))
+ .map_err(|e| ForgeError(format!("Base64-Fehler: {e}")))?;
+ let text = String::from_utf8(raw)
+ .map_err(|_| ForgeError("Datei ist keine UTF-8-Textdatei -- ueber ITSM nicht editierbar".into()))?;
+ Ok((text, parsed.sha.unwrap_or_default()))
+ }
+
+ /// Schreibt eine Datei (optimistisches Sha-Locking der Contents-API).
+ /// Rueckgabe: commit_sha.
+ #[allow(clippy::too_many_arguments)]
+ pub async fn update_contents(&self, repo: &str, path: &str, content_text: &str, sha: &str,
+ branch: &str, message: &str, author_name: &str,
+ author_email: &str) -> Result {
+ let url = format!("{}/api/v1/repos/x/{}/contents/{}", self.base_url, repo, path);
+ let body = serde_json::json!({
+ "content": base64::engine::general_purpose::STANDARD.encode(content_text.as_bytes()),
+ "sha": sha,
+ "branch": branch,
+ "message": message,
+ "author": {"name": author_name, "email": author_email},
+ });
+ let resp = self.http.put(&url)
+ .header("Authorization", format!("token {}", self.token))
+ .json(&body)
+ .send().await
+ .map_err(|e| ForgeError(format!("Forge nicht erreichbar: {e}")))?;
+ let status = resp.status();
+ let text = resp.text().await.unwrap_or_default();
+ if !status.is_success() {
+ return Err(ForgeError(format!("Forge-API-Fehler ({}): {}", status.as_u16(), text)));
+ }
+ let parsed: UpdateResponse = serde_json::from_str(&text)
+ .map_err(|e| ForgeError(format!("Forge-Antwort nicht parsebar: {e}")))?;
+ Ok(parsed.commit.sha)
+ }
+}
+
+fn urlencode(s: &str) -> String {
+ s.bytes().map(|b| match b {
+ b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => (b as char).to_string(),
+ _ => format!("%{:02X}", b),
+ }).collect()
+}
diff --git a/src/itil.rs b/src/itil.rs
new file mode 100755
index 0000000..b6648bb
--- /dev/null
+++ b/src/itil.rs
@@ -0,0 +1,136 @@
+//! ITIL-Prozesslogik (v3-Prozesse / v4-Practices), zentral gebuendelt.
+//!
+//! Abgedeckt:
+//! - Rollenmodell (RBAC) angelehnt an ITIL-Rollen
+//! - Incident-/Ticket-Statusmodell mit erlaubten Uebergaengen (v3 SO 4.2)
+//! - Prioritaetsmatrix Impact x Urgency (v3 SO 4.2.5.4)
+//! - Change Enablement (v4) / Change Management (v3): Typen + Freigabe
+//!
+//! Bewusst reine Funktionen/Konstanten ohne Web- oder DB-Abhaengigkeit,
+//! damit die Logik isoliert testbar bleibt (siehe #[cfg(test)] unten).
+
+/// Rollen (ITIL-orientiert):
+/// - admin IT-Leitung / Service Owner: Vollzugriff
+/// - change_manager genehmigt Changes (CAB), darf Repo-Aenderungen aus Changes
+/// - agent Service Desk: Tickets, KB-Entwuerfe, CMDB
+/// - user Requester/Self-Service: eigene Tickets, freigegebene KB
+pub const ROLES: [&str; 4] = ["admin", "change_manager", "agent", "user"];
+
+pub fn role_label(role: &str) -> &'static str {
+ match role {
+ "admin" => "Administrator",
+ "change_manager" => "Change Manager",
+ "agent" => "Service-Desk-Agent",
+ "user" => "Anwender",
+ _ => "Unbekannt",
+ }
+}
+
+/// Operative Rollen sehen alle Tickets, CMDB und KB-Entwuerfe.
+pub fn is_operative(role: &str) -> bool {
+ matches!(role, "admin" | "change_manager" | "agent")
+}
+
+/// Change-Freigabe + Repo-Aenderungen aus Changes heraus.
+pub fn is_change_approver(role: &str) -> bool {
+ matches!(role, "admin" | "change_manager")
+}
+
+/// Kategorien (v4-Practices: Incident, Service Request, Problem, Change, ...).
+pub const CATEGORIES: [&str; 6] = ["Incident", "Service Request", "Problem", "Task", "Change", "Release"];
+/// Kategorien, die die Rolle 'user' im Self-Service anlegen darf.
+pub const USER_CATEGORIES: [&str; 2] = ["Incident", "Service Request"];
+
+pub const PRIORITIES: [&str; 4] = ["Niedrig", "Mittel", "Hoch", "Kritisch"];
+pub const IMPACT_URGENCY_LEVELS: [&str; 3] = ["Niedrig", "Mittel", "Hoch"];
+
+// ── Statusmodell (v3 Incident Lifecycle) ──────────────────────────────────────
+#[allow(dead_code)] // dokumentiert das Statusmodell, Logik nutzt allowed_next_statuses
+pub const STATUSES: [&str; 5] = ["Offen", "In Bearbeitung", "Warten", "Geloest", "Geschlossen"];
+
+/// Erlaubte Uebergaenge; "Geloest" -> "Offen" ist das Reopen, "Geschlossen" final.
+pub fn allowed_next_statuses(current: &str) -> &'static [&'static str] {
+ match current {
+ "Offen" => &["In Bearbeitung", "Geloest"],
+ "In Bearbeitung" => &["Warten", "Geloest", "Offen"],
+ "Warten" => &["In Bearbeitung", "Geloest"],
+ "Geloest" => &["Geschlossen", "Offen"],
+ _ => &[],
+ }
+}
+
+pub fn is_valid_transition(current: &str, new: &str) -> bool {
+ allowed_next_statuses(current).contains(&new)
+}
+
+/// Prioritaetsmatrix Impact x Urgency (ITIL v3 SO 4.2.5.4, 3x3).
+pub fn priority_from_matrix(impact: &str, urgency: &str) -> &'static str {
+ match (impact, urgency) {
+ ("Hoch", "Hoch") => "Kritisch",
+ ("Hoch", "Mittel") | ("Mittel", "Hoch") => "Hoch",
+ ("Hoch", "Niedrig") | ("Niedrig", "Hoch") | ("Mittel", "Mittel") => "Mittel",
+ _ => "Niedrig",
+ }
+}
+
+// ── Change Enablement (v4) / Change Management (v3) ───────────────────────────
+pub const CHANGE_TYPES: [&str; 3] = ["Standard", "Normal", "Emergency"];
+pub const APPROVAL_NOT_REQUIRED: &str = "Nicht erforderlich";
+pub const APPROVAL_PENDING: &str = "Ausstehend";
+pub const APPROVAL_APPROVED: &str = "Genehmigt";
+pub const APPROVAL_REJECTED: &str = "Abgelehnt";
+
+/// Standard-Changes sind vorautorisiert (v4: "pre-authorized"); Normal- und
+/// Emergency-Changes brauchen eine (bei Emergency nachtraegliche ECAB-)Freigabe.
+pub fn initial_approval_status(change_typ: &str) -> &'static str {
+ if change_typ == "Standard" { APPROVAL_NOT_REQUIRED } else { APPROVAL_PENDING }
+}
+
+/// Darf an diesem Change implementiert werden (Repo-Aenderung, Umsetzung)?
+/// Standard: vorautorisiert. Emergency: sofort, Freigabe nachtraeglich (ECAB),
+/// solange nicht abgelehnt. Normal: erst nach Genehmigung.
+pub fn change_may_be_implemented(kategorie: &str, change_typ: Option<&str>, approval_status: Option<&str>) -> bool {
+ if kategorie != "Change" {
+ return false;
+ }
+ let typ = change_typ.unwrap_or("Normal");
+ let status = approval_status.unwrap_or(APPROVAL_PENDING);
+ if status == APPROVAL_REJECTED {
+ return false;
+ }
+ match typ {
+ "Standard" | "Emergency" => true,
+ _ => status == APPROVAL_APPROVED,
+ }
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn matrix() {
+ assert_eq!(priority_from_matrix("Hoch", "Hoch"), "Kritisch");
+ assert_eq!(priority_from_matrix("Hoch", "Mittel"), "Hoch");
+ assert_eq!(priority_from_matrix("Mittel", "Mittel"), "Mittel");
+ assert_eq!(priority_from_matrix("Niedrig", "Niedrig"), "Niedrig");
+ }
+
+ #[test]
+ fn transitions() {
+ assert!(is_valid_transition("Offen", "In Bearbeitung"));
+ assert!(is_valid_transition("Geloest", "Offen")); // Reopen
+ assert!(!is_valid_transition("Geschlossen", "Offen")); // final
+ assert!(!is_valid_transition("Offen", "Warten"));
+ }
+
+ #[test]
+ fn change_gate() {
+ assert!(change_may_be_implemented("Change", Some("Standard"), Some(APPROVAL_NOT_REQUIRED)));
+ assert!(change_may_be_implemented("Change", Some("Emergency"), Some(APPROVAL_PENDING)));
+ assert!(!change_may_be_implemented("Change", Some("Normal"), Some(APPROVAL_PENDING)));
+ assert!(change_may_be_implemented("Change", Some("Normal"), Some(APPROVAL_APPROVED)));
+ assert!(!change_may_be_implemented("Change", Some("Emergency"), Some(APPROVAL_REJECTED)));
+ assert!(!change_may_be_implemented("Incident", None, None));
+ }
+}
diff --git a/src/kb.rs b/src/kb.rs
new file mode 100755
index 0000000..9d8b567
--- /dev/null
+++ b/src/kb.rs
@@ -0,0 +1,283 @@
+//! Wissensdatenbank (ITIL v4: Knowledge Management) mit Freigabe-Workflow:
+//! Artikel starten als 'Entwurf' (sichtbar fuers Service-Team), werden durch
+//! admin/change_manager 'Freigegeben' und sind erst dann fuer die Rolle
+//! 'user' (Self-Service) sichtbar.
+
+use askama::Template;
+use axum::extract::{Extension, Path, Query, State};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Redirect};
+use axum::Form;
+use serde::Deserialize;
+
+use crate::web::{need_auth, need_change_approver, need_operative, page_ctx, AppState, PageCtx, ReqCtx, WebResult};
+use crate::itil;
+
+pub const KB_KATEGORIEN: [&str; 5] = ["Allgemein", "Anleitung", "Stoerung", "Konfiguration", "FAQ"];
+
+pub struct KbRow {
+ pub id: i32,
+ pub titel: String,
+ pub kategorie: String,
+ pub tags: Vec,
+ pub status: String,
+ pub status_class: String,
+ pub autor: String,
+ pub updated: String,
+}
+
+pub struct KbTab {
+ pub href: String,
+ pub label: String,
+ pub active: bool,
+}
+
+#[derive(Template)]
+#[template(path = "kb_list.html")]
+pub struct KbListTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub tabs: Vec,
+ pub rows: Vec,
+ pub q: String,
+}
+
+#[derive(Deserialize)]
+pub struct KbQuery {
+ pub kategorie: Option,
+ pub q: Option,
+}
+
+fn split_tags(tags: &Option) -> Vec {
+ tags.as_deref().unwrap_or("").split(',')
+ .map(str::trim).filter(|s| !s.is_empty()).map(str::to_string).collect()
+}
+
+fn status_class(status: &str) -> &'static str {
+ if status == "Freigegeben" { "geloest" } else { "warten" }
+}
+
+pub async fn kb_list(State(app): State, Extension(ctx): Extension,
+ Query(q): Query) -> WebResult {
+ let auth = match need_auth(&ctx, "/wissen") { Ok(a) => a, Err(r) => return Ok(r) };
+ let only_released = !itil::is_operative(&auth.role);
+ let kategorie = q.kategorie.as_deref().filter(|k| KB_KATEGORIEN.contains(k));
+ let articles = app.db.list_kb_articles(auth.tenant_id, kategorie,
+ q.q.as_deref().filter(|s| !s.is_empty()),
+ only_released).await?;
+ let mut tabs = vec![KbTab {
+ href: "/wissen".into(),
+ label: "Alle".into(),
+ active: kategorie.is_none(),
+ }];
+ tabs.extend(KB_KATEGORIEN.iter().map(|k| KbTab {
+ href: format!("/wissen?kategorie={}", k),
+ label: k.to_string(),
+ active: kategorie == Some(k),
+ }));
+ let rows = articles.iter().map(|a| KbRow {
+ id: a.id,
+ titel: a.titel.clone(),
+ kategorie: a.kategorie.clone(),
+ tags: split_tags(&a.tags),
+ status: a.status.clone(),
+ status_class: status_class(&a.status).into(),
+ autor: a.autor_email.clone().unwrap_or_default(),
+ updated: a.updated_at.format("%Y-%m-%d %H:%M").to_string(),
+ }).collect();
+ let tpl = KbListTemplate {
+ title: "Wissensdatenbank".into(),
+ ctx: page_ctx(&auth, "/wissen"),
+ tabs,
+ rows,
+ q: q.q.unwrap_or_default(),
+ };
+ Ok(tpl.into_response())
+}
+
+#[derive(Template)]
+#[template(path = "kb_form.html")]
+pub struct KbFormTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub error: String,
+ pub action: String,
+ pub titel: String,
+ pub kategorie: String,
+ pub inhalt: String,
+ pub tags: String,
+ pub kategorien: Vec,
+ pub delete_action: String,
+}
+
+#[derive(Deserialize)]
+pub struct KbForm {
+ pub titel: String,
+ #[serde(default)]
+ pub kategorie: String,
+ #[serde(default)]
+ pub inhalt: String,
+ #[serde(default)]
+ pub tags: String,
+}
+
+fn form_template(auth: &crate::db::AuthUser, title: &str, action: &str, delete_action: &str) -> KbFormTemplate {
+ KbFormTemplate {
+ title: title.to_string(),
+ ctx: page_ctx(auth, "/wissen"),
+ error: String::new(),
+ action: action.to_string(),
+ titel: String::new(),
+ kategorie: "Allgemein".into(),
+ inhalt: String::new(),
+ tags: String::new(),
+ kategorien: KB_KATEGORIEN.iter().map(|s| s.to_string()).collect(),
+ delete_action: delete_action.to_string(),
+ }
+}
+
+pub async fn kb_new_get(State(_app): State, Extension(ctx): Extension) -> WebResult {
+ let auth = match need_auth(&ctx, "/wissen/new") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_operative(&auth) { return Ok(r); }
+ Ok(form_template(&auth, "Neuer Wissensartikel", "/wissen/new", "").into_response())
+}
+
+pub async fn kb_new_post(State(app): State, Extension(ctx): Extension,
+ Form(f): Form) -> WebResult {
+ let auth = match need_auth(&ctx, "/wissen/new") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_operative(&auth) { return Ok(r); }
+ let titel = f.titel.trim();
+ let inhalt = f.inhalt.trim();
+ let kategorie = if KB_KATEGORIEN.contains(&f.kategorie.as_str()) { f.kategorie.as_str() } else { "Allgemein" };
+ if titel.is_empty() || inhalt.is_empty() {
+ let mut tpl = form_template(&auth, "Neuer Wissensartikel", "/wissen/new", "");
+ tpl.error = "Titel und Inhalt duerfen nicht leer sein.".into();
+ tpl.titel = titel.to_string();
+ tpl.kategorie = kategorie.to_string();
+ tpl.inhalt = inhalt.to_string();
+ tpl.tags = f.tags.trim().to_string();
+ return Ok(tpl.into_response());
+ }
+ let aid = app.db.create_kb_article(auth.tenant_id, titel, kategorie, inhalt,
+ f.tags.trim(), auth.user_id).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "kb_article_created", Some("kb_article"),
+ Some(&aid.to_string()), Some(serde_json::json!({"titel": titel})),
+ ctx.ip.as_deref()).await?;
+ Ok(Redirect::to(&format!("/wissen/{}", aid)).into_response())
+}
+
+#[derive(Template)]
+#[template(path = "kb_detail.html")]
+pub struct KbDetailTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub id: i32,
+ pub titel: String,
+ pub kategorie: String,
+ pub inhalt: String,
+ pub tags: Vec,
+ pub status: String,
+ pub status_class: String,
+ pub autor: String,
+ pub updated: String,
+ pub can_release: bool,
+}
+
+pub async fn kb_detail(State(app): State, Extension(ctx): Extension,
+ Path(article_id): Path) -> WebResult {
+ let auth = match need_auth(&ctx, "/wissen") { Ok(a) => a, Err(r) => return Ok(r) };
+ let Some(a) = app.db.get_kb_article(auth.tenant_id, article_id).await? else {
+ return Ok(StatusCode::NOT_FOUND.into_response());
+ };
+ // Self-Service sieht nur freigegebene Artikel.
+ if !itil::is_operative(&auth.role) && a.status != "Freigegeben" {
+ return Ok(StatusCode::NOT_FOUND.into_response());
+ }
+ let tpl = KbDetailTemplate {
+ title: a.titel.clone(),
+ ctx: page_ctx(&auth, "/wissen"),
+ id: a.id,
+ titel: a.titel.clone(),
+ kategorie: a.kategorie.clone(),
+ inhalt: a.inhalt.clone(),
+ tags: split_tags(&a.tags),
+ status: a.status.clone(),
+ status_class: status_class(&a.status).into(),
+ autor: a.autor_email.clone().unwrap_or_default(),
+ updated: a.updated_at.format("%Y-%m-%d %H:%M").to_string(),
+ can_release: itil::is_change_approver(&auth.role),
+ };
+ Ok(tpl.into_response())
+}
+
+pub async fn kb_edit_get(State(app): State, Extension(ctx): Extension,
+ Path(article_id): Path) -> WebResult {
+ let auth = match need_auth(&ctx, "/wissen") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_operative(&auth) { return Ok(r); }
+ let Some(a) = app.db.get_kb_article(auth.tenant_id, article_id).await? else {
+ return Ok(StatusCode::NOT_FOUND.into_response());
+ };
+ let mut tpl = form_template(&auth, "Artikel bearbeiten",
+ &format!("/wissen/{}/edit", article_id),
+ &format!("/wissen/{}/delete", article_id));
+ tpl.titel = a.titel;
+ tpl.kategorie = a.kategorie;
+ tpl.inhalt = a.inhalt;
+ tpl.tags = a.tags.unwrap_or_default();
+ Ok(tpl.into_response())
+}
+
+pub async fn kb_edit_post(State(app): State, Extension(ctx): Extension,
+ Path(article_id): Path, Form(f): Form) -> WebResult {
+ let auth = match need_auth(&ctx, "/wissen") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_operative(&auth) { return Ok(r); }
+ let Some(_) = app.db.get_kb_article(auth.tenant_id, article_id).await? else {
+ return Ok(StatusCode::NOT_FOUND.into_response());
+ };
+ let titel = f.titel.trim();
+ let inhalt = f.inhalt.trim();
+ let kategorie = if KB_KATEGORIEN.contains(&f.kategorie.as_str()) { f.kategorie.as_str() } else { "Allgemein" };
+ if titel.is_empty() || inhalt.is_empty() {
+ let mut tpl = form_template(&auth, "Artikel bearbeiten",
+ &format!("/wissen/{}/edit", article_id),
+ &format!("/wissen/{}/delete", article_id));
+ tpl.error = "Titel und Inhalt duerfen nicht leer sein.".into();
+ return Ok(tpl.into_response());
+ }
+ app.db.update_kb_article(auth.tenant_id, article_id, titel, kategorie, inhalt, f.tags.trim()).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "kb_article_updated", Some("kb_article"),
+ Some(&article_id.to_string()), Some(serde_json::json!({"titel": titel})),
+ ctx.ip.as_deref()).await?;
+ Ok(Redirect::to(&format!("/wissen/{}", article_id)).into_response())
+}
+
+#[derive(Deserialize)]
+pub struct KbStatusForm {
+ pub status: String,
+}
+
+/// Freigabe-Workflow: nur admin/change_manager (Knowledge-Governance).
+pub async fn kb_status_post(State(app): State, Extension(ctx): Extension,
+ Path(article_id): Path, Form(f): Form) -> WebResult {
+ let auth = match need_auth(&ctx, "/wissen") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_change_approver(&auth) { return Ok(r); }
+ let status = match f.status.as_str() {
+ "Freigegeben" => "Freigegeben",
+ _ => "Entwurf",
+ };
+ app.db.set_kb_status(auth.tenant_id, article_id, status).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "kb_article_status_changed",
+ Some("kb_article"), Some(&article_id.to_string()),
+ Some(serde_json::json!({"status": status})), ctx.ip.as_deref()).await?;
+ Ok(Redirect::to(&format!("/wissen/{}", article_id)).into_response())
+}
+
+pub async fn kb_delete(State(app): State, Extension(ctx): Extension,
+ Path(article_id): Path) -> WebResult {
+ let auth = match need_auth(&ctx, "/wissen") { Ok(a) => a, Err(r) => return Ok(r) };
+ if let Err(r) = need_operative(&auth) { return Ok(r); }
+ app.db.delete_kb_article(auth.tenant_id, article_id).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "kb_article_deleted", Some("kb_article"),
+ Some(&article_id.to_string()), None, ctx.ip.as_deref()).await?;
+ Ok(Redirect::to("/wissen").into_response())
+}
diff --git a/src/main.rs b/src/main.rs
new file mode 100755
index 0000000..d15201e
--- /dev/null
+++ b/src/main.rs
@@ -0,0 +1,152 @@
+//! ITSM-Plattform -- eigenstaendiges Produkt (nicht Teil von AES), mandantenfaehig.
+//!
+//! Rust-Rewrite 2026-07-15 (zuvor Python/Flask). Betrieb gemaess
+//! ISO 27001 / DSGVO / NIS 2:
+//! - PostgreSQL-Persistenz, Audit-Log fuer alle aendernden Aktionen
+//! - serverseitige Sessions (widerrufbar), CSRF-Schutz, Login-Rate-Limit,
+//! Argon2id-Passwoerter (Werkzeug-Altbestand wird beim Login migriert)
+//! - automatische Aufbewahrungsfrist-Bereinigung (DSGVO Speicherbegrenzung)
+//! - ITIL-v3/v4-Prozesse: Statusmodell, Impact/Urgency-Matrix, Change
+//! Enablement mit Freigabe, Problem Management, SLA, Knowledge-Freigabe
+//!
+//! AES bleibt ein buchbarer Service im Katalog, integriert per HTTP.
+//! Repo-Bearbeitung aus Tickets (phase-008): nur admin/change_manager, nur aus
+//! freigegebenen Change-Tickets, jede Aenderung zwingend im Worklog.
+
+mod admin;
+mod auth;
+mod cmdb;
+mod config;
+mod dashboard;
+mod db;
+mod forge;
+mod itil;
+mod kb;
+mod security;
+mod services;
+mod tickets;
+mod web;
+
+use std::collections::HashMap;
+use std::net::SocketAddr;
+use std::sync::Arc;
+
+use axum::extract::State;
+use axum::response::IntoResponse;
+use axum::routing::{get, post};
+use axum::{Json, Router};
+use tokio::sync::Mutex;
+use tower_http::services::ServeDir;
+
+use web::AppState;
+
+async fn health(State(app): State) -> impl IntoResponse {
+ match app.db.health().await {
+ Ok(()) => Json(serde_json::json!({"status": "ok", "db": "ok"})).into_response(),
+ Err(e) => (axum::http::StatusCode::INTERNAL_SERVER_ERROR,
+ Json(serde_json::json!({"status": "error", "db": e.to_string()}))).into_response(),
+ }
+}
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+ tracing_subscriber::fmt().with_env_filter(
+ tracing_subscriber::EnvFilter::try_from_default_env()
+ .unwrap_or_else(|_| "info".into())).init();
+
+ let cfg = Arc::new(config::Config::from_env()?);
+ let db = db::Db::connect(&cfg.database_url)?;
+ db.init_schema().await?;
+ tracing::info!("Schema initialisiert.");
+
+ let forge = Arc::new(forge::ForgeClient::from_config(&cfg.forge_base_url, &cfg.forge_service_token));
+ if forge.is_none() {
+ tracing::info!("FORGE_BASE_URL nicht gesetzt -- Repo-Bearbeitung aus Tickets deaktiviert.");
+ }
+
+ let state = AppState {
+ cfg: cfg.clone(),
+ db: db.clone(),
+ forge,
+ http: reqwest::Client::builder()
+ .timeout(std::time::Duration::from_secs(5))
+ .build()?,
+ svc_status_cache: Arc::new(Mutex::new(HashMap::new())),
+ };
+
+ // Retention-Bereinigung im Hintergrund (Advisory-Lock in der DB verhindert
+ // parallele Laeufe mehrerer Instanzen).
+ {
+ let db = db.clone();
+ let interval = cfg.retention_interval_seconds;
+ tokio::spawn(async move {
+ tokio::time::sleep(std::time::Duration::from_secs(30)).await;
+ loop {
+ if let Err(e) = db.run_retention_cleanup().await {
+ tracing::error!("Retention-Bereinigung fehlgeschlagen: {:#}", e);
+ }
+ tokio::time::sleep(std::time::Duration::from_secs(interval)).await;
+ }
+ });
+ }
+
+ let app = Router::new()
+ .route("/", get(auth::root))
+ .route("/health", get(health))
+ .route("/login", get(auth::login_get).post(auth::login_post))
+ .route("/logout", post(auth::logout))
+ .route("/setup/new", get(auth::setup_get).post(auth::setup_post))
+ .route("/dashboard", get(dashboard::dashboard))
+ // Tickets + ITIL-Prozesse
+ .route("/tickets", get(tickets::tickets_list))
+ .route("/probleme", get(tickets::probleme_list))
+ .route("/aenderungen", get(tickets::aenderungen_list))
+ .route("/releases", get(tickets::releases_list))
+ .route("/tickets/new", post(tickets::ticket_new))
+ .route("/tickets/:id/status", post(tickets::ticket_status))
+ .route("/tickets/:id/comment", post(tickets::ticket_comment))
+ .route("/tickets/:id/approval", post(tickets::ticket_approval))
+ .route("/tickets/:id/problem-link", post(tickets::ticket_problem_link))
+ .route("/tickets/:id/known-error", post(tickets::ticket_known_error))
+ .route("/tickets/:id/ci-link", post(tickets::ticket_ci_link))
+ .route("/tickets/:id/ci-unlink", post(tickets::ticket_ci_unlink))
+ .route("/tickets/:id/repo-edit", post(tickets::ticket_repo_edit))
+ .route("/api/tickets/:id", get(tickets::api_ticket))
+ .route("/api/tickets/:id/repo-file", get(tickets::api_repo_file))
+ // Service-Katalog
+ .route("/services", get(services::services_page))
+ .route("/services/new", post(services::service_new))
+ // Wissensdatenbank
+ .route("/wissen", get(kb::kb_list))
+ .route("/wissen/new", get(kb::kb_new_get).post(kb::kb_new_post))
+ .route("/wissen/:id", get(kb::kb_detail))
+ .route("/wissen/:id/edit", get(kb::kb_edit_get).post(kb::kb_edit_post))
+ .route("/wissen/:id/status", post(kb::kb_status_post))
+ .route("/wissen/:id/delete", post(kb::kb_delete))
+ // CMDB
+ .route("/assets", get(cmdb::cmdb_list))
+ .route("/assets/new", get(cmdb::ci_new_get).post(cmdb::ci_new_post))
+ .route("/assets/:id", get(cmdb::ci_detail_get).post(cmdb::ci_detail_post))
+ .route("/assets/:id/relationships", post(cmdb::ci_rel_add))
+ .route("/assets/:id/relationships/:rel_id/delete", post(cmdb::ci_rel_delete))
+ // Administration
+ .route("/admin", get(admin::settings_get).post(admin::settings_post))
+ .route("/admin/retention/run", post(admin::retention_run))
+ .route("/admin/audit", get(admin::audit_page))
+ .route("/admin/users", get(admin::users_get).post(admin::users_post))
+ .route("/admin/users/:id/edit", get(admin::user_edit_get).post(admin::user_edit_post))
+ .route("/admin/users/:id/role", post(admin::user_role_post))
+ .route("/admin/users/:id/active", post(admin::user_active_post))
+ .nest_service("/static", ServeDir::new("static"))
+ .layer(axum::middleware::from_fn_with_state(state.clone(), web::ctx_middleware))
+ .with_state(state);
+
+ let listener = tokio::net::TcpListener::bind(&cfg.bind).await?;
+ tracing::info!("ITSM laeuft auf http://{}", cfg.bind);
+ axum::serve(listener, app.into_make_service_with_connect_info::())
+ .with_graceful_shutdown(async {
+ tokio::signal::ctrl_c().await.ok();
+ })
+ .await?;
+ Ok(())
+}
diff --git a/src/security.rs b/src/security.rs
new file mode 100755
index 0000000..a7c32a5
--- /dev/null
+++ b/src/security.rs
@@ -0,0 +1,186 @@
+//! Sicherheits-Layer: Passwort-Hashing (Argon2id, mit transparenter Migration
+//! alter Werkzeug-PBKDF2-Hashes), Session-/CSRF-Token, Passwort-Policy und
+//! SSRF-Schutz fuer Service-Endpoint-URLs.
+//!
+//! Hintergrund (Sicherheitsreview 2026-07-15): die fruehere Flask-Version
+//! hatte keinen CSRF-Schutz, kein Login-Rate-Limit, Client-Side-Sessions mit
+//! optionalem Secret und ungeprueften Endpoint-URLs.
+
+use argon2::password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString};
+use argon2::Argon2;
+use rand::RngCore;
+use sha2::{Digest, Sha256};
+use std::net::{IpAddr, ToSocketAddrs};
+
+// ── Passwort-Hashing ───────────────────────────────────────────────────────────
+pub fn hash_password(password: &str) -> anyhow::Result {
+ let salt = SaltString::generate(&mut argon2::password_hash::rand_core::OsRng);
+ Ok(Argon2::default()
+ .hash_password(password.as_bytes(), &salt)
+ .map_err(|e| anyhow::anyhow!("argon2: {e}"))?
+ .to_string())
+}
+
+/// Prueft ein Passwort gegen einen gespeicherten Hash. Unterstuetzt:
+/// - Argon2 (neue Hashes dieses Servers)
+/// - Werkzeug-PBKDF2 ("pbkdf2:sha256:$$") aus der frueheren
+/// Python-Version -- Bestandskonten bleiben so ohne Reset nutzbar.
+/// Rueckgabe: (gueltig, braucht_rehash) -- bei einem gueltigen Alt-Hash soll
+/// der Aufrufer auf Argon2 rehashen (schleichende Migration beim Login).
+pub fn verify_password(stored: &str, password: &str) -> (bool, bool) {
+ if let Some(rest) = stored.strip_prefix("pbkdf2:sha256") {
+ return (verify_werkzeug_pbkdf2(rest, password), true);
+ }
+ match PasswordHash::new(stored) {
+ Ok(parsed) => (
+ Argon2::default().verify_password(password.as_bytes(), &parsed).is_ok(),
+ false,
+ ),
+ Err(_) => (false, false),
+ }
+}
+
+/// rest = ":$$" oder "$$" (alte Defaults).
+fn verify_werkzeug_pbkdf2(rest: &str, password: &str) -> bool {
+ let (iterations, rest) = match rest.strip_prefix(':') {
+ Some(r) => {
+ let mut it = r.splitn(2, '$');
+ let n = it.next().and_then(|s| s.parse::().ok());
+ match (n, it.next()) {
+ (Some(n), Some(tail)) => (n, tail),
+ _ => return false,
+ }
+ }
+ // Sehr alte Werkzeug-Versionen: Default-Iterationen, Format "$salt$hex"
+ None => match rest.strip_prefix('$') {
+ Some(tail) => (260000, tail),
+ None => return false,
+ },
+ };
+ let mut parts = rest.splitn(2, '$');
+ let (Some(salt), Some(expected_hex)) = (parts.next(), parts.next()) else {
+ return false;
+ };
+ let Ok(expected) = hex::decode(expected_hex) else {
+ return false;
+ };
+ let mut out = vec![0u8; expected.len()];
+ pbkdf2::pbkdf2_hmac::(password.as_bytes(), salt.as_bytes(), iterations, &mut out);
+ use subtle::ConstantTimeEq;
+ out.ct_eq(&expected).into()
+}
+
+// ── Passwort-Policy ────────────────────────────────────────────────────────────
+/// None wenn ok, sonst deutsche Fehlermeldung. Laenge vor Komplexitaet
+/// (BSI ORP.4 / NIST SP 800-63B), nur reine Ziffernfolgen werden abgelehnt.
+pub fn password_problem(pw: &str, min_length: usize) -> Option {
+ if pw.chars().count() < min_length {
+ return Some(format!("Das Passwort muss mindestens {} Zeichen lang sein.", min_length));
+ }
+ if pw.chars().all(|c| c.is_ascii_digit()) {
+ return Some("Das Passwort darf nicht nur aus Ziffern bestehen.".to_string());
+ }
+ None
+}
+
+// ── Tokens ─────────────────────────────────────────────────────────────────────
+pub fn random_token() -> String {
+ let mut bytes = [0u8; 32];
+ rand::thread_rng().fill_bytes(&mut bytes);
+ hex::encode(bytes)
+}
+
+/// In der DB liegt nur der Hash des Session-Tokens (DB-Leak != Session-Leak).
+pub fn hash_token(token: &str) -> String {
+ hex::encode(Sha256::digest(token.as_bytes()))
+}
+
+pub fn csrf_ok(expected: &str, supplied: &str) -> bool {
+ use subtle::ConstantTimeEq;
+ !expected.is_empty() && expected.as_bytes().ct_eq(supplied.as_bytes()).into()
+}
+
+// ── SSRF-Schutz fuer Service-Endpoints ────────────────────────────────────────
+/// Der Service-Katalog prueft Endpoint-URLs serverseitig auf Erreichbarkeit.
+/// Damit darueber keine Link-Local-/Cloud-Metadaten-Adressen (169.254.0.0/16,
+/// insb. 169.254.169.254, fe80::/10) abgefragt werden koennen, werden diese
+/// blockiert. Private Adressen (10/8, 192.168/16, localhost) bleiben erlaubt,
+/// weil interne Dienste (AES-Dashboard, Forge) der Hauptzweck des Katalogs
+/// sind; das Anlegen von Services ist zusaetzlich admin-only.
+/// None = zulaessig, sonst Fehlertext.
+pub fn endpoint_url_problem(url: &str) -> Option {
+ if url.is_empty() {
+ return None;
+ }
+ let rest = if let Some(r) = url.strip_prefix("https://") {
+ r
+ } else if let Some(r) = url.strip_prefix("http://") {
+ r
+ } else {
+ return Some("Endpoint-URL muss mit http:// oder https:// beginnen.".into());
+ };
+ let authority = rest.split(['/', '?', '#']).next().unwrap_or("");
+ let hostport = authority.rsplit('@').next().unwrap_or(""); // userinfo abtrennen
+ if hostport.is_empty() {
+ return Some("Endpoint-URL enthaelt keinen Hostnamen.".into());
+ }
+ let host = if hostport.starts_with('[') {
+ hostport.trim_start_matches('[').split(']').next().unwrap_or("")
+ } else {
+ hostport.rsplit_once(':').map(|(h, p)| if p.parse::().is_ok() { h } else { hostport }).unwrap_or(hostport)
+ };
+ // Aufloesen; nicht aufloesbar ist kein Sicherheitsproblem (spaeter schlicht
+ // "nicht erreichbar"), aber aufgeloeste Link-Local-Adressen sind tabu.
+ if let Ok(addrs) = (host, 80u16).to_socket_addrs() {
+ for a in addrs {
+ match a.ip() {
+ IpAddr::V4(v4) if v4.is_link_local() => {
+ return Some("Endpoint-URL zeigt auf eine blockierte Link-Local-/Metadaten-Adresse.".into());
+ }
+ IpAddr::V6(v6) if (v6.segments()[0] & 0xffc0) == 0xfe80 => {
+ return Some("Endpoint-URL zeigt auf eine blockierte Link-Local-Adresse.".into());
+ }
+ _ => {}
+ }
+ }
+ }
+ None
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn argon2_roundtrip() {
+ let h = hash_password("korrekt-pferd-batterie").unwrap();
+ assert_eq!(verify_password(&h, "korrekt-pferd-batterie"), (true, false));
+ assert_eq!(verify_password(&h, "falsch").0, false);
+ }
+
+ #[test]
+ fn werkzeug_pbkdf2() {
+ // werkzeug.security.generate_password_hash("test-passwort-123", method="pbkdf2:sha256:1000", salt_length=8)
+ // reproduziert mit hashlib.pbkdf2_hmac('sha256', b'test-passwort-123', b'abcdefgh', 1000)
+ let h = "pbkdf2:sha256:1000$abcdefgh$161d2822224e216f7c39618c7ec8afd0d316d356d9252ead84472423b125c245";
+ let (ok, rehash) = verify_password(h, "test-passwort-123");
+ assert!(rehash);
+ assert!(ok, "werkzeug-pbkdf2-hash muss verifizierbar sein");
+ assert!(!verify_password(h, "falsch").0);
+ }
+
+ #[test]
+ fn ssrf_guard() {
+ assert!(endpoint_url_problem("").is_none());
+ assert!(endpoint_url_problem("http://10.0.0.5:8080/x").is_none());
+ assert!(endpoint_url_problem("ftp://x").is_some());
+ assert!(endpoint_url_problem("http://169.254.169.254/latest/meta-data").is_some());
+ }
+
+ #[test]
+ fn policy() {
+ assert!(password_problem("kurz", 12).is_some());
+ assert!(password_problem("123456789012345", 12).is_some());
+ assert!(password_problem("langes-gutes-passwort", 12).is_none());
+ }
+}
diff --git a/src/services.rs b/src/services.rs
new file mode 100755
index 0000000..b8ae560
--- /dev/null
+++ b/src/services.rs
@@ -0,0 +1,139 @@
+//! Service-Katalog (ITIL v4: Service Catalogue Management).
+//!
+//! Live-Erreichbarkeitspruefung gebuchter Services mit kurzem Timeout,
+//! parallelisiert und gecacht (30 s), damit der Katalog nicht blockiert.
+//! Anlegen von Services ist admin-only und Endpoint-URLs laufen durch den
+//! SSRF-Guard (security::endpoint_url_problem).
+
+use std::time::{Duration, Instant};
+
+use askama::Template;
+use axum::extract::{Extension, State};
+use axum::response::{IntoResponse, Redirect};
+use axum::Form;
+use serde::Deserialize;
+
+use crate::web::{need_admin, need_auth, page_ctx, AppState, PageCtx, ReqCtx, WebResult};
+
+pub struct ServiceCard {
+ pub name: String,
+ pub beschreibung: String,
+ pub endpoint: String,
+ pub badge_class: String,
+ pub badge_label: String,
+}
+
+#[derive(Template)]
+#[template(path = "services.html")]
+pub struct ServicesTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub cards: Vec,
+ pub error: String,
+}
+
+const STATUS_CACHE_TTL: Duration = Duration::from_secs(30);
+
+async fn live_status(app: &AppState, service_id: i32, endpoint: &str) -> Option {
+ {
+ let cache = app.svc_status_cache.lock().await;
+ if let Some((ts, result)) = cache.get(&service_id) {
+ if ts.elapsed() < STATUS_CACHE_TTL {
+ return *result;
+ }
+ }
+ }
+ let result = match app.http.get(endpoint).timeout(Duration::from_secs(3)).send().await {
+ Ok(resp) => Some(resp.status().is_success() || resp.status().is_redirection()),
+ Err(_) => Some(false),
+ };
+ app.svc_status_cache.lock().await.insert(service_id, (Instant::now(), result));
+ result
+}
+
+pub async fn services_page(State(app): State, Extension(ctx): Extension) -> WebResult {
+ let auth = match need_auth(&ctx, "/services") { Ok(a) => a, Err(r) => return Ok(r) };
+ let services = app.db.list_services(auth.tenant_id).await?;
+
+ // Erreichbarkeit parallel pruefen (frueher: sequenziell mit 4s-Timeout je
+ // Service -- das blockierte die Seite bei mehreren toten Endpoints).
+ let checks = services.iter().map(|s| {
+ let app = app.clone();
+ let endpoint = s.endpoint.clone().unwrap_or_default();
+ let id = s.id;
+ let gebucht = s.gebucht;
+ async move {
+ if !gebucht || endpoint.is_empty() {
+ None
+ } else {
+ live_status(&app, id, &endpoint).await
+ }
+ }
+ });
+ let states: Vec> = futures::future::join_all(checks).await;
+
+ let cards = services.iter().zip(states).map(|(s, live)| {
+ let (badge_class, badge_label) = if !s.gebucht {
+ ("unknown", "nicht gebucht")
+ } else {
+ match live {
+ Some(true) => ("ok", "gebucht · erreichbar"),
+ Some(false) => ("err", "gebucht · nicht erreichbar"),
+ None => ("unknown", "gebucht"),
+ }
+ };
+ ServiceCard {
+ name: s.name.clone(),
+ beschreibung: s.beschreibung.clone().unwrap_or_default(),
+ endpoint: s.endpoint.clone().unwrap_or_default(),
+ badge_class: badge_class.into(),
+ badge_label: badge_label.into(),
+ }
+ }).collect();
+
+ let tpl = ServicesTemplate {
+ title: "Service-Katalog".into(),
+ ctx: page_ctx(&auth, "/services"),
+ cards,
+ error: String::new(),
+ };
+ Ok(tpl.into_response())
+}
+
+#[derive(Deserialize)]
+pub struct NewServiceForm {
+ pub name: String,
+ #[serde(default)]
+ pub beschreibung: String,
+ #[serde(default)]
+ pub endpoint: String,
+}
+
+pub async fn service_new(State(app): State, Extension(ctx): Extension,
+ Form(f): Form) -> WebResult {
+ let auth = match need_auth(&ctx, "/services") { Ok(a) => a, Err(r) => return Ok(r) };
+ // Anlegen ist admin-only: Endpoint-URLs werden serverseitig abgefragt,
+ // das soll kein normaler Agent steuern koennen (SSRF-Flaeche minimieren).
+ if let Err(r) = need_admin(&auth) { return Ok(r); }
+
+ let name = f.name.trim();
+ let endpoint = f.endpoint.trim();
+ if name.is_empty() {
+ return Ok(Redirect::to("/services").into_response());
+ }
+ if let Some(problem) = crate::security::endpoint_url_problem(endpoint) {
+ let tpl = ServicesTemplate {
+ title: "Service-Katalog".into(),
+ ctx: page_ctx(&auth, "/services"),
+ cards: Vec::new(),
+ error: problem,
+ };
+ return Ok(tpl.into_response());
+ }
+ let sid = app.db.create_service(
+ auth.tenant_id, name, f.beschreibung.trim(), "Sonstiges", true,
+ if endpoint.is_empty() { None } else { Some(endpoint) }).await?;
+ app.db.log_audit(Some(auth.tenant_id), Some(auth.user_id), "service_created", Some("service"),
+ Some(&sid.to_string()), None, ctx.ip.as_deref()).await?;
+ Ok(Redirect::to("/services").into_response())
+}
diff --git a/src/tickets.rs b/src/tickets.rs
new file mode 100755
index 0000000..31e61fb
--- /dev/null
+++ b/src/tickets.rs
@@ -0,0 +1,667 @@
+//! Ticket-Management: Incident/Service Request/Problem/Task/Change/Release.
+//!
+//! ITIL-Prozesse:
+//! - Statusmodell mit erzwungenen Uebergaengen (itil::is_valid_transition)
+//! - Prioritaet aus Impact x Urgency (itil::priority_from_matrix)
+//! - Change Enablement: Standard/Normal/Emergency + Freigabe (CAB) durch
+//! change_manager/admin; Umsetzung erst nach Freigabe (Normal)
+//! - Problem Management: Incident->Problem-Verknuepfung, Known Error
+//! - SLA-Zeitstempel + Ueberfaelligkeits-Bewertung (itil::sla via db-Felder)
+//! - Repo-Bearbeitung aus Tickets (phase-008): nur admin/change_manager und
+//! nur aus einem umsetzbaren Change-Ticket heraus; jede Aenderung wird
+//! zwingend im Worklog dokumentiert (Fehler dabei => kein Erfolg gemeldet)
+
+use askama::Template;
+use axum::extract::{Extension, Path, Query, State};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Redirect};
+use axum::{Form, Json};
+use chrono::{DateTime, Duration, Utc};
+use serde::Deserialize;
+
+use crate::db::{AuthUser, Ticket};
+use crate::web::{forbidden, need_auth, page_ctx, AppState, PageCtx, ReqCtx, WebResult};
+use crate::itil;
+
+// ── SLA-Bewertung ──────────────────────────────────────────────────────────────
+pub fn resolve_due(t: &Ticket) -> Option> {
+ t.sla_loesung_minuten.map(|m| t.created_at + Duration::minutes(m as i64))
+}
+
+pub fn response_due(t: &Ticket) -> Option> {
+ t.sla_antwort_minuten.map(|m| t.created_at + Duration::minutes(m as i64))
+}
+
+pub fn is_overdue(t: &Ticket, now: DateTime) -> bool {
+ if t.status == "Geloest" || t.status == "Geschlossen" {
+ return false;
+ }
+ resolve_due(t).map(|due| now > due).unwrap_or(false)
+}
+
+fn status_class(s: &str) -> &'static str {
+ match s {
+ "In Bearbeitung" => "inbearbeitung",
+ "Warten" => "warten",
+ "Geloest" => "geloest",
+ "Geschlossen" => "geschlossen",
+ _ => "offen",
+ }
+}
+
+fn prio_class(p: &str) -> &'static str {
+ match p {
+ "Kritisch" => "krit",
+ "Hoch" => "hoch",
+ "Niedrig" => "niedrig",
+ _ => "mittel",
+ }
+}
+
+// ── Listenansicht ──────────────────────────────────────────────────────────────
+pub struct TicketRow {
+ pub id: i32,
+ pub nr: String,
+ pub titel: String,
+ pub service: String,
+ pub status_class: String,
+ pub status_label: String,
+ pub prio_class: String,
+ pub prio: String,
+ pub kategorie: String,
+ pub badge: String,
+ pub zugewiesen: String,
+ pub updated: String,
+ pub fortschritt: i32,
+}
+
+pub struct Tab {
+ pub href: String,
+ pub label: String,
+ pub active: bool,
+}
+
+#[derive(Template)]
+#[template(path = "tickets.html")]
+pub struct TicketsTemplate {
+ pub title: String,
+ pub ctx: PageCtx,
+ pub kpis: Vec<(String, String)>,
+ pub tabs: Vec,
+ pub rows: Vec,
+ pub services: Vec<(i32, String)>,
+ pub categories: Vec,
+ pub impact_levels: Vec,
+ pub change_types: Vec,
+}
+
+#[derive(Deserialize)]
+pub struct ListQuery {
+ pub status: Option,
+}
+
+fn kpis(tickets: &[Ticket], now: DateTime