"""
ITSM-Plattform -- eigenstaendiges Produkt (nicht Teil von AES), mandantenfaehig.

Betrieb gemaess ISO 27001 / DSGVO / NIS 2 (Nutzer-Vorgabe, 2026-07-13):
  - Persistenz in PostgreSQL statt Dateien (Zugriffskontrolle, Backup/Recovery,
    Verschluesselung im Ruhezustand ueber die DB moeglich).
  - Audit-Log fuer alle sicherheitsrelevanten/aendernden Aktionen (ISO 27001
    A.12.4, DSGVO Art. 30 Rechenschaftspflicht).
  - Ersteinrichtungs-Assistent (/setup/new): legt pro Kunde einen eigenen
    Mandanten (Tenant) mit eigenem Admin-Konto, SLA-Standardwerten und
    DSGVO-Angaben (Datenschutzbeauftragter, Aufbewahrungsfristen) an.
    Mandantenfaehig: mehrere Organisationen auf einer Instanz, Daten strikt
    per tenant_id getrennt (kein Datenzugriff ueber Mandantengrenzen).
  - Automatische Aufbewahrungsfrist-Bereinigung (Hintergrund-Thread, siehe
    db.run_retention_cleanup) -- loescht abgeschlossene Tickets/Audit-Log-
    Eintraege, die aelter als die hinterlegte Frist sind (DSGVO Speicher-
    begrenzung).

AES bleibt ein buchbarer Service im Katalog, integriert per HTTP (kein Code-
Import) -- siehe _aes_live_status().

ENV:
  DATABASE_URL        postgresql://user:pass@host:5432/dbname
  ITSM_SECRET_KEY     Flask-Session-Secret
  AES_DASHBOARD_URL   Basis-URL des AES-Dashboards fuer die Service-Integration
  RETENTION_INTERVAL_SECONDS  Intervall fuer die Retention-Bereinigung (Default 24h)
"""
import os
import html
import time
import secrets
import threading
import datetime as _dt
import urllib.request
import urllib.error

from flask import Flask, request, redirect, url_for, session, jsonify, abort
from werkzeug.security import generate_password_hash, check_password_hash

import db

AES_DASHBOARD_URL = os.getenv("AES_DASHBOARD_URL", "").rstrip("/")
RETENTION_INTERVAL_SECONDS = int(os.getenv("RETENTION_INTERVAL_SECONDS", str(24 * 60 * 60)))

app = Flask(__name__)
app.secret_key = os.getenv("ITSM_SECRET_KEY") or secrets.token_hex(32)

CATEGORIES = ["Incident", "Problem", "Task", "Change", "Release"]
PRIORITIES = ["Niedrig", "Mittel", "Hoch", "Kritisch"]


def _client_ip():
    return request.headers.get("X-Forwarded-For", request.remote_addr or "")


def _now():
    return _dt.datetime.utcnow().replace(microsecond=0).isoformat() + "Z"


def _jsonable(v):
    if isinstance(v, (_dt.datetime, _dt.date)):
        return v.isoformat()
    if isinstance(v, dict):
        return {k: _jsonable(x) for k, x in v.items()}
    if isinstance(v, list):
        return [_jsonable(x) for x in v]
    return v


# ── Auth / Session-Helfer ──────────────────────────────────────────────────────
def _current_user():
    if not session.get("user_id"):
        return None
    return {
        "id": session["user_id"],
        "email": session.get("email"),
        "tenant_id": session.get("tenant_id"),
        "tenant_name": session.get("tenant_name"),
        "role": session.get("role"),
    }


def _require_login():
    if not session.get("user_id"):
        return redirect(url_for("login", next=request.path))
    return None


def _require_admin():
    r = _require_login()
    if r:
        return r
    if session.get("role") != "admin":
        return ("<div class='panel'><p class='sz'>Zugriff verweigert -- nur fuer Administratoren.</p></div>", 403)
    return None


# ── CSS (an AES-Farbschema angelehnt) ──────────────────────────────────────────
_CSS = """
:root{--bg:#161d2b;--panel:#1e2738;--panel2:#232e42;--border:#324259;--text:#e6edf5;
--sub:#93a3b8;--accent:#4c9eba;--accent2:#5db3d0;--ok:#3ecf8e;--warn:#e0a83e;
--bad:#e5534b;--crit:#c9364a;}
*{box-sizing:border-box}
body{margin:0;background:var(--bg);color:var(--text);font-family:-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;font-size:14px}
a{color:var(--accent2);text-decoration:none}
a:hover{text-decoration:underline}
.login-wrap{min-height:100vh;display:flex;align-items:center;justify-content:center}
.login-box{background:var(--panel);border:1px solid var(--border);border-radius:10px;padding:28px;width:340px}
.login-box.wide{width:560px}
.login-box h1{margin:0 0 4px;font-size:22px}
.login-box input,.login-box select,.login-box textarea{width:100%;padding:9px 10px;margin-bottom:10px;background:var(--bg);
  border:1px solid var(--border);border-radius:6px;color:var(--text);font-size:14px}
.btn{background:var(--accent);border:none;color:#0c1420;font-weight:600;padding:9px 14px;
  border-radius:6px;cursor:pointer;font-size:13px}
.btn:hover{background:var(--accent2)}
.btn.ghost{background:transparent;border:1px solid var(--border);color:var(--text)}
.sz{color:var(--sub);font-size:12px}
.shell{display:flex;min-height:100vh}
.sidebar{width:220px;flex:0 0 220px;background:var(--panel);border-right:1px solid var(--border);padding:16px 0;overflow-y:auto}
.brand{padding:0 16px 16px;font-weight:700;font-size:16px}
.brand .sz{font-weight:400}
.navgroup{margin-top:14px}
.navgroup h4{font-size:11px;text-transform:uppercase;letter-spacing:.04em;color:var(--sub);
  padding:0 16px;margin:0 0 4px}
.navgroup a{display:block;padding:6px 16px;color:var(--text);font-size:13px}
.navgroup a:hover{background:var(--panel2);text-decoration:none}
.navgroup a.active{background:var(--panel2);border-left:2px solid var(--accent);color:var(--accent2)}
.main{flex:1;min-width:0}
.topbar{display:flex;align-items:center;justify-content:space-between;padding:12px 24px;
  border-bottom:1px solid var(--border);background:var(--panel)}
.topbar .search{flex:1;max-width:420px;background:var(--bg);border:1px solid var(--border);
  border-radius:6px;padding:7px 12px;color:var(--sub);font-size:13px}
.content{padding:24px}
h1.page-title{font-size:22px;margin:0 0 18px}
h2.section-title{font-size:15px;margin:22px 0 10px;color:var(--sub);text-transform:uppercase;letter-spacing:.04em}
.kpi-row{display:grid;grid-template-columns:repeat(auto-fit,minmax(140px,1fr));gap:12px;margin-bottom:18px}
.kpi{background:var(--panel);border:1px solid var(--border);border-radius:8px;padding:14px 16px}
.kpi .lbl{color:var(--sub);font-size:12px;margin-bottom:6px}
.kpi .val{font-size:26px;font-weight:700}
.tabs{display:flex;gap:4px;margin-bottom:14px;flex-wrap:wrap}
.tabs a{padding:6px 12px;border-radius:6px;font-size:13px;color:var(--sub);border:1px solid transparent}
.tabs a.active{background:var(--panel2);color:var(--text);border-color:var(--border)}
table.tickets,table.audit{width:100%;border-collapse:collapse;background:var(--panel);border:1px solid var(--border);border-radius:8px;overflow:hidden}
table.tickets th,table.audit th{text-align:left;font-size:11px;text-transform:uppercase;color:var(--sub);
  padding:10px 12px;border-bottom:1px solid var(--border);background:var(--panel2)}
table.tickets td,table.audit td{padding:10px 12px;border-bottom:1px solid var(--border);vertical-align:top;font-size:13px}
table.tickets tr:last-child td,table.audit tr:last-child td{border-bottom:none}
table.tickets tr.row{cursor:pointer}
table.tickets tr.row:hover{background:var(--panel2)}
.pill{display:inline-block;padding:2px 9px;border-radius:99px;font-size:11px;font-weight:600}
.pill.offen{background:#2e3a52;color:#9fb3ce}
.pill.bearbeitung,.pill.inbearbeitung{background:#4a3a1a;color:var(--warn)}
.pill.warten{background:#3a2f52;color:#b79ee0}
.pill.geloest{background:#1a4a35;color:var(--ok)}
.pill.geschlossen{background:#2a2a2a;color:#888}
.pill.ueberfaellig{background:#4a1e22;color:var(--bad)}
.pill.krit{color:var(--crit)} .pill.hoch{color:var(--bad)} .pill.mittel{color:var(--warn)} .pill.niedrig{color:var(--sub)}
.pill.admin{background:#1a4a35;color:var(--ok)} .pill.agent{background:#2e3a52;color:#9fb3ce}
.bar-track{background:#2a3446;border-radius:99px;height:6px;width:90px;display:inline-block;vertical-align:middle}
.bar-fill{background:var(--accent);height:6px;border-radius:99px}
.panel{background:var(--panel);border:1px solid var(--border);border-radius:8px;padding:18px;margin-bottom:16px}
.card{background:var(--panel);border:1px solid var(--border);border-radius:8px;padding:16px;margin-bottom:12px}
.grid-2{display:grid;grid-template-columns:1fr 1fr;gap:16px}
.svc-card{display:flex;justify-content:space-between;align-items:flex-start}
.svc-card .badge{padding:2px 9px;border-radius:99px;font-size:11px;background:#1a4a35;color:var(--ok)}
input[type=text],input[type=email],input[type=password],input[type=number],textarea,select{
  background:var(--bg);border:1px solid var(--border);border-radius:6px;
  color:var(--text);padding:8px 10px;font-size:13px;width:100%}
textarea{min-height:70px;font-family:inherit}
.formrow{margin-bottom:10px}
.formrow label{display:block;font-size:12px;color:var(--sub);margin-bottom:4px}
#detail-overlay{position:fixed;inset:0;background:rgba(0,0,0,.4);display:none;z-index:40}
#detail-panel{position:fixed;right:0;top:0;bottom:0;width:420px;background:var(--panel);
  border-left:1px solid var(--border);z-index:41;transform:translateX(100%);
  transition:transform .18s ease;overflow-y:auto;padding:20px}
#detail-panel.open{transform:translateX(0)}
#detail-overlay.open{display:block}
.dt-tabs{display:flex;gap:14px;border-bottom:1px solid var(--border);margin:14px 0}
.dt-tabs span{padding-bottom:8px;color:var(--sub);font-size:13px;cursor:pointer}
.dt-tabs span.active{color:var(--accent2);border-bottom:2px solid var(--accent2)}
.tl-item{border-left:2px solid var(--border);padding-left:12px;margin-bottom:12px;position:relative}
.tl-item::before{content:'';position:absolute;left:-5px;top:2px;width:8px;height:8px;border-radius:50%;background:var(--accent)}
.err{color:#E5534B;font-size:13px;margin:0 0 10px}
.hint{color:var(--sub);font-size:11px;margin:-6px 0 10px}
"""
_CSS_TAG = "<style>" + _CSS + "</style>"

_NAV = [
    ("Service Management", [
        ("/tickets", "Tickets"),
        ("/probleme", "Probleme"),
        ("/aenderungen", "Aenderungen"),
        ("/releases", "Releases"),
    ]),
    ("Services", [("/services", "Service-Katalog")]),
    ("Wissen", [("/wissen", "Wissensdatenbank")]),
    ("Assets", [("/assets", "Asset-Liste")]),
    ("Administration", [
        ("/admin", "Einstellungen"),
        ("/admin/audit", "Audit-Log"),
    ]),
]


def _shell(active_path, title, body_html, extra_head=""):
    u = _current_user()
    groups_html = []
    for group_name, items in _NAV:
        links = "".join(
            '<a href="%s" class="%s">%s</a>' % (href, "active" if href == active_path else "", html.escape(label))
            for href, label in items
        )
        groups_html.append('<div class="navgroup"><h4>%s</h4>%s</div>' % (html.escape(group_name), links))
    nav_html = "".join(groups_html)
    who = "%s &middot; %s" % (html.escape(u["email"] or ""), html.escape(u["tenant_name"] or "")) if u else ""
    return """<!doctype html><html lang="de"><head><meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>%s -- ITSM</title>%s%s</head><body>
<div class="shell">
<div class="sidebar"><div class="brand">ITSM<div class="sz">IT Service Management</div></div>%s</div>
<div class="main">
<div class="topbar">
  <input class="search" placeholder="Suche (Tickets, Services, Wissen ...)">
  <div class="sz">%s &middot; <a href="/logout">Abmelden</a></div>
</div>
<div class="content">%s</div>
</div>
</div>
<div id="detail-overlay" onclick="closeDetail()"></div>
<div id="detail-panel"></div>
</body></html>""" % (html.escape(title), _CSS_TAG, extra_head, nav_html, who, body_html)


# ── Ersteinrichtung (neuer Mandant) ────────────────────────────────────────────
@app.route("/setup/new", methods=["GET", "POST"])
def setup_new():
    # Die Ersteinrichtung ist ein einmaliger Vorgang: sobald irgendein
    # Mandant existiert, ist die Registrierung neuer Organisationen ueber
    # diese Route dauerhaft gesperrt (Nutzer-Vorgabe 2026-07-13: "/setup/new
    # darf nur einmal funktionieren"). Weitere Mandanten koennen danach nur
    # noch durch einen Administrator ueber die Datenbank/ein internes
    # Verfahren angelegt werden, nicht mehr per offenem Self-Service-Formular.
    if db.any_tenant_exists():
        return redirect(url_for("login", already_setup="1"))

    error = None
    # Vorbelegung: bei GET die Standardwerte, bei einem fehlgeschlagenen POST
    # die vom Nutzer eingegebenen Werte (ausser Passwoerter -- die bleiben aus
    # Sicherheitsgruenden leer und muessen erneut eingegeben werden).
    firma = ""
    email = ""
    dsb_name = ""
    dsb_email = ""
    retention_tickets = "1095"
    retention_audit = "1825"
    sla_antwort = "480"
    sla_loesung = "2880"

    if request.method == "POST":
        firma = request.form.get("firma", "").strip()
        email = request.form.get("email", "").strip().lower()
        pw = request.form.get("password", "")
        pw2 = request.form.get("password2", "")
        dsb_name = request.form.get("dsb_name", "").strip()
        dsb_email = request.form.get("dsb_email", "").strip()
        retention_tickets = request.form.get("retention_tickets_days", "1095").strip()
        retention_audit = request.form.get("retention_audit_days", "1825").strip()
        sla_antwort = request.form.get("sla_antwort_minuten", "480").strip()
        sla_loesung = request.form.get("sla_loesung_minuten", "2880").strip()

        if not firma:
            error = "Firmenname ist erforderlich."
        elif not email or "@" not in email:
            error = "Bitte eine gueltige E-Mail-Adresse angeben."
        elif len(pw) < 10:
            error = "Das Passwort muss mindestens 10 Zeichen lang sein."
        elif pw != pw2:
            error = "Die Passwoerter stimmen nicht ueberein."
        elif db.email_exists(email):
            error = "Diese E-Mail-Adresse ist bereits registriert."
        else:
            try:
                tenant_id = db.create_tenant(
                    firma, dsb_name or None, dsb_email or None,
                    int(retention_tickets or 1095), int(retention_audit or 1825),
                    int(sla_antwort or 480), int(sla_loesung or 2880),
                )
                user_id = db.create_user(tenant_id, email, generate_password_hash(pw), role="admin")
                db.create_service(
                    tenant_id, "AES -- Autonomous Engineering System",
                    "Automatisierte Software-Entwicklung: Projekte, Phasen, "
                    "LLM-gestuetzte Agenten, Auto-Fix und Release-Pipeline.",
                    "Entwicklung", True, AES_DASHBOARD_URL,
                )
                db.log_audit(tenant_id, user_id, "tenant_created", "tenant", str(tenant_id),
                              {"firma": firma}, _client_ip())
                db.log_audit(tenant_id, user_id, "user_created", "user", str(user_id),
                              {"email": email, "role": "admin"}, _client_ip())
                return redirect(url_for("login", registered="1"))
            except Exception as e:
                error = "Fehler bei der Einrichtung: %s" % html.escape(str(e))

    err_html = "<p class='err'>%s</p>" % error if error else ""
    return """<!doctype html><html lang="de"><head><meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Neue Organisation einrichten -- ITSM</title>%s</head><body>
<div class="login-wrap"><form class="login-box wide" method="post">
<h1>Neue Organisation einrichten</h1>
<div class="sz" style="margin-bottom:14px">Jede Organisation erhaelt einen eigenen, getrennten Mandanten. Diese Angaben lassen sich unter Einstellungen jederzeit anpassen.</div>
%s
<h2 class="section-title" style="margin-top:0">Firmenprofil</h2>
<div class="formrow"><label>Firmenname</label><input name="firma" value="%s" required></div>
<h2 class="section-title">Administrator-Konto</h2>
<div class="formrow"><label>E-Mail (Login)</label><input name="email" type="email" value="%s" required></div>
<div class="grid-2">
<div class="formrow"><label>Passwort</label><input name="password" type="password" required></div>
<div class="formrow"><label>Passwort wiederholen</label><input name="password2" type="password" required></div>
</div>
<div class="hint">Mindestens 10 Zeichen.</div>
<h2 class="section-title">SLA-Standardwerte</h2>
<div class="grid-2">
<div class="formrow"><label>Antwortzeit (Minuten)</label><input name="sla_antwort_minuten" type="number" value="%s"></div>
<div class="formrow"><label>Loesungszeit (Minuten)</label><input name="sla_loesung_minuten" type="number" value="%s"></div>
</div>
<h2 class="section-title">Datenschutz (DSGVO)</h2>
<div class="grid-2">
<div class="formrow"><label>Datenschutzbeauftragter/Kontakt</label><input name="dsb_name" value="%s"></div>
<div class="formrow"><label>Kontakt-E-Mail</label><input name="dsb_email" type="email" value="%s"></div>
</div>
<div class="grid-2">
<div class="formrow"><label>Aufbewahrung Tickets (Tage)</label><input name="retention_tickets_days" type="number" value="%s"></div>
<div class="formrow"><label>Aufbewahrung Audit-Log (Tage)</label><input name="retention_audit_days" type="number" value="%s"></div>
</div>
<div class="hint">Diese Werte legen fest, wie lange Tickets bzw. Audit-Eintraege vorgehalten werden (DSGVO Speicherbegrenzung). Ein Hintergrund-Job bereinigt automatisch alle 24 Stunden.</div>
<button class="btn" type="submit" style="margin-top:8px">Organisation anlegen</button>
<div class="sz" style="margin-top:12px">Bereits registriert? <a href="/login">Anmelden</a></div>
</form></div></body></html>""" % (
        _CSS_TAG, err_html,
        html.escape(firma), html.escape(email),
        html.escape(sla_antwort), html.escape(sla_loesung),
        html.escape(dsb_name), html.escape(dsb_email),
        html.escape(retention_tickets), html.escape(retention_audit),
    )


# ── Login/Logout ────────────────────────────────────────────────────────────────
@app.route("/login", methods=["GET", "POST"])
def login():
    error = None
    notice = None
    if request.args.get("registered"):
        notice = "Organisation angelegt. Bitte melde dich mit deinem Admin-Konto an."
    elif request.args.get("already_setup"):
        notice = "Die Ersteinrichtung wurde bereits abgeschlossen. Bitte melde dich mit deinem bestehenden Konto an."
    if request.method == "POST":
        email = request.form.get("email", "").strip().lower()
        pw = request.form.get("password", "")
        user = db.get_user_by_email(email)
        if user and check_password_hash(user["password_hash"], pw):
            tenant = db.get_tenant(user["tenant_id"])
            session["user_id"] = user["id"]
            session["email"] = user["email"]
            session["tenant_id"] = user["tenant_id"]
            session["tenant_name"] = tenant["name"] if tenant else ""
            session["role"] = user["role"]
            db.touch_last_login(user["id"])
            db.log_audit(user["tenant_id"], user["id"], "login_success", "user", str(user["id"]), None, _client_ip())
            return redirect(request.args.get("next") or url_for("tickets_route"))
        db.log_audit(user["tenant_id"] if user else None, user["id"] if user else None,
                      "login_failed", "user", email, None, _client_ip())
        error = "E-Mail oder Passwort falsch."
    err_html = "<p class='err'>%s</p>" % html.escape(error) if error else ""
    notice_html = "<p class='sz' style='color:var(--ok);margin:0 0 10px'>%s</p>" % html.escape(notice) if notice else ""
    # Der Registrierungs-Link wird nur angezeigt, solange die Ersteinrichtung
    # noch nicht abgeschlossen ist -- danach ist /setup/new gesperrt, ein
    # Link dorthin waere ein toter Verweis (Nutzer-Vorgabe 2026-07-13).
    setup_link_html = ('<div class="sz" style="margin-top:12px">Neue Organisation? '
                        '<a href="/setup/new">Jetzt einrichten</a></div>') if not db.any_tenant_exists() else ""
    return """<!doctype html><html lang="de"><head><meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Anmelden -- ITSM</title>%s</head><body>
<div class="login-wrap"><form class="login-box" method="post">
<h1>ITSM</h1><div class="sz" style="margin-bottom:14px">IT Service Management</div>
%s%s
<input name="email" type="email" placeholder="E-Mail" autofocus>
<input name="password" type="password" placeholder="Passwort">
<button class="btn" type="submit">Anmelden</button>
%s
</form></div></body></html>""" % (_CSS_TAG, err_html, notice_html, setup_link_html)


@app.route("/logout")
def logout():
    u = _current_user()
    if u:
        db.log_audit(u["tenant_id"], u["id"], "logout", "user", str(u["id"]), None, _client_ip())
    session.clear()
    return redirect(url_for("login"))


# ── Tickets: Berechnung + Rendering ────────────────────────────────────────────
def _is_overdue(t):
    if t["status"] in ("Geloest", "Geschlossen"):
        return False
    created = t["created_at"]
    if created.tzinfo is None:
        created = created.replace(tzinfo=_dt.timezone.utc)
    age_min = (_dt.datetime.now(_dt.timezone.utc) - created).total_seconds() / 60
    return age_min > (t.get("sla_loesung_minuten") or 999999)


def _kpis(tickets):
    total = len(tickets)
    offen = sum(1 for t in tickets if t["status"] == "Offen")
    bearbeitung = sum(1 for t in tickets if t["status"] == "In Bearbeitung")
    warten = sum(1 for t in tickets if t["status"] == "Warten")
    ueberfaellig = sum(1 for t in tickets if _is_overdue(t))
    now = _dt.datetime.now(_dt.timezone.utc)
    geloest_7d = 0
    for t in tickets:
        if t["status"] in ("Geloest", "Geschlossen"):
            upd = t["updated_at"]
            if upd.tzinfo is None:
                upd = upd.replace(tzinfo=_dt.timezone.utc)
            if (now - upd).days <= 7:
                geloest_7d += 1
    return {"Gesamt": total, "Offen": offen, "In Bearbeitung": bearbeitung,
            "Warten auf Input": warten, "Ueberfaellig": ueberfaellig, "Geloest (7 Tage)": geloest_7d}


def _status_class(s):
    return {"Offen": "offen", "In Bearbeitung": "inbearbeitung", "Warten": "warten",
            "Geloest": "geloest", "Geschlossen": "geschlossen"}.get(s, "offen")


def _prio_class(p):
    return {"Kritisch": "krit", "Hoch": "hoch", "Mittel": "mittel", "Niedrig": "niedrig"}.get(p, "mittel")


def _ticket_row(t):
    status = "ueberfaellig" if _is_overdue(t) else _status_class(t["status"])
    status_label = "Ueberfaellig" if _is_overdue(t) else t["status"]
    return """<tr class="row" onclick="openDetail(%d)">
  <td><a href="#" onclick="event.stopPropagation();openDetail(%d);return false">%s</a></td>
  <td><b>%s</b><div class="sz">%s</div></td>
  <td><span class="pill %s">%s</span></td>
  <td><span class="pill %s">%s</span></td>
  <td>%s</td>
  <td>%s</td>
  <td class="sz">%s</td>
  <td><div class="bar-track"><div class="bar-fill" style="width:%s%%"></div></div> %s%%</td>
</tr>""" % (
        t["id"], t["id"], html.escape(t["ticket_nr"]), html.escape(t["titel"]),
        html.escape(t.get("service_name") or ""), status, status_label,
        _prio_class(t["prioritaet"]), t["prioritaet"], t["kategorie"],
        html.escape(t["zugewiesen_an"] or ""), t["updated_at"].strftime("%Y-%m-%d %H:%M"),
        t["fortschritt"], t["fortschritt"])


def _kpi_tile(label, value):
    return '<div class="kpi"><div class="lbl">%s</div><div class="val">%s</div></div>' % (html.escape(label), value)


def _tickets_body(tenant_id, filter_status=None, filter_kategorie=None):
    tickets = db.list_tickets(tenant_id)
    kpis = _kpis(tickets)
    kpi_html = "".join(_kpi_tile(k, v) for k, v in kpis.items())
    shown = tickets
    if filter_kategorie:
        shown = [t for t in shown if t["kategorie"] == filter_kategorie]
    tabs = [("", "Alle"), ("Offen", "Offen"), ("In Bearbeitung", "In Bearbeitung"),
            ("Warten", "Warten"), ("Geloest", "Geloest"), ("Ueberfaellig", "Ueberfaellig")]
    base = "/probleme" if filter_kategorie == "Problem" else (
        "/aenderungen" if filter_kategorie == "Change" else (
        "/releases" if filter_kategorie == "Release" else "/tickets"))
    tabs_html = "".join(
        '<a href="%s%s" class="%s">%s</a>' % (
            base, ("?status=" + s) if s else "", "active" if (s or "") == (filter_status or "") else "", label)
        for s, label in tabs)
    if filter_status == "Ueberfaellig":
        shown = [t for t in shown if _is_overdue(t)]
    elif filter_status:
        shown = [t for t in shown if t["status"] == filter_status]
    rows = "".join(_ticket_row(t) for t in shown) or '<tr><td colspan="8" class="sz">Keine Tickets.</td></tr>'
    services = db.list_services(tenant_id)
    svc_opts = "".join('<option value="%d">%s</option>' % (s["id"], html.escape(s["name"])) for s in services)
    new_form = """<div class="panel"><h3 style="margin-top:0">Neues Ticket</h3>
<form method="post" action="/tickets/new">
<div class="formrow"><input type="text" name="titel" placeholder="Titel" required></div>
<div class="formrow"><textarea name="beschreibung" placeholder="Beschreibung"></textarea></div>
<div class="grid-2">
<div class="formrow"><select name="kategorie">%s</select></div>
<div class="formrow"><select name="prioritaet">%s</select></div>
</div>
<div class="formrow"><select name="service_id"><option value="">(kein Service)</option>%s</select></div>
<button class="btn" type="submit">Anlegen</button>
</form></div>""" % (
        "".join('<option value="%s">%s</option>' % (c, c) for c in CATEGORIES),
        "".join('<option value="%s">%s</option>' % (p, p) for p in PRIORITIES), svc_opts)
    return """<h1 class="page-title">Tickets</h1>
<div class="kpi-row">%s</div>
%s
<div class="tabs">%s</div>
<table class="tickets"><thead><tr>
<th>Ticket-Nr</th><th>Titel (Service)</th><th>Status</th><th>Prioritaet</th>
<th>Kategorie</th><th>Zugewiesen an</th><th>Aktualisiert</th><th>Fortschritt</th>
</tr></thead><tbody>%s</tbody></table>
<script>
function openDetail(id){
  fetch('/api/tickets/' + id).then(r => r.json()).then(t => {
    document.getElementById('detail-panel').innerHTML = renderDetail(t);
    document.getElementById('detail-panel').classList.add('open');
    document.getElementById('detail-overlay').classList.add('open');
  });
}
function closeDetail(){
  document.getElementById('detail-panel').classList.remove('open');
  document.getElementById('detail-overlay').classList.remove('open');
}
function setStatus(id, status){
  fetch('/tickets/' + id + '/status', {method:'POST', headers:{'Content-Type':'application/x-www-form-urlencoded'}, body:'status=' + encodeURIComponent(status)})
    .then(() => openDetail(id));
}
function renderDetail(t){
  var tl = (t.timeline||[]).map(function(e){
    return '<div class="tl-item"><b>'+e.akteur+'</b><div class="sz">'+e.zeit.replace('T',' ').slice(0,16)+'</div><div>'+e.text+'</div></div>';
  }).join('') || '<div class="sz">Keine Ereignisse.</div>';
  var statusBtns = ['Offen','In Bearbeitung','Warten','Geloest','Geschlossen'].map(function(s){
    return '<button class="btn ghost" style="margin:2px" onclick="setStatus('+t.id+',\\''+s+'\\')">'+s+'</button>';
  }).join('');
  return '<h2 style="margin-top:0">'+t.ticket_nr+'</h2>'
    + '<div class="sz" style="margin-bottom:10px">'+t.titel+'</div>'
    + '<div><span class="pill">'+t.status+'</span> '
    + '<span class="pill">'+t.prioritaet+'</span> <span class="pill">'+t.kategorie+'</span></div>'
    + '<div class="dt-tabs"><span class="active">Details</span><span>Aktivitaeten</span><span>Anhaenge</span><span>Aufgaben</span></div>'
    + '<div class="sz" style="margin-bottom:6px">Beschreibung</div><div style="margin-bottom:14px">'+(t.beschreibung||'')+'</div>'
    + '<div class="sz" style="margin-bottom:6px">Service</div><div style="margin-bottom:14px">'+(t.service_name||'(kein Service)')+'</div>'
    + '<div class="sz" style="margin-bottom:6px">Status aendern</div><div style="margin-bottom:14px">'+statusBtns+'</div>'
    + '<div class="sz" style="margin-bottom:6px">Zeitleiste</div>'+tl
    + '<div style="margin-top:16px"><button class="btn ghost" onclick="closeDetail()">Schliessen</button></div>';
}
</script>""" % (kpi_html, new_form, tabs_html, rows)


@app.route("/tickets")
def tickets_route():
    r = _require_login()
    if r:
        return r
    return _shell("/tickets", "Tickets", _tickets_body(session["tenant_id"], request.args.get("status")))


@app.route("/probleme")
def probleme_route():
    r = _require_login()
    if r:
        return r
    return _shell("/probleme", "Probleme", _tickets_body(session["tenant_id"], request.args.get("status"), "Problem"))


@app.route("/aenderungen")
def aenderungen_route():
    r = _require_login()
    if r:
        return r
    return _shell("/aenderungen", "Aenderungen", _tickets_body(session["tenant_id"], request.args.get("status"), "Change"))


@app.route("/releases")
def releases_route():
    r = _require_login()
    if r:
        return r
    return _shell("/releases", "Releases", _tickets_body(session["tenant_id"], request.args.get("status"), "Release"))


@app.route("/tickets/new", methods=["POST"])
def tickets_new_route():
    r = _require_login()
    if r:
        return r
    tenant_id = session["tenant_id"]
    service_id = request.form.get("service_id") or None
    tid, ticket_nr = db.create_ticket(
        tenant_id,
        request.form.get("titel", "").strip() or "(ohne Titel)",
        request.form.get("beschreibung", "").strip(),
        int(service_id) if service_id else None,
        request.form.get("prioritaet", "Mittel"),
        request.form.get("kategorie", "Task"),
        session.get("email"),
        session["user_id"],
        480, 2880,
        session.get("email"),
    )
    db.log_audit(tenant_id, session["user_id"], "ticket_created", "ticket", ticket_nr, None, _client_ip())
    return redirect(url_for("tickets_route"))


@app.route("/tickets/<int:ticket_id>/status", methods=["POST"])
def ticket_status_route(ticket_id):
    r = _require_login()
    if r:
        return r
    tenant_id = session["tenant_id"]
    status = request.form.get("status", "Offen")
    db.update_ticket_status(tenant_id, ticket_id, status, session.get("email"))
    db.log_audit(tenant_id, session["user_id"], "ticket_status_changed", "ticket", str(ticket_id),
                 {"status": status}, _client_ip())
    return jsonify({"ok": True})


@app.route("/api/tickets/<int:ticket_id>")
def api_ticket(ticket_id):
    r = _require_login()
    if r:
        return r
    ticket = db.get_ticket(session["tenant_id"], ticket_id)
    if not ticket:
        abort(404)
    return jsonify(_jsonable(ticket))


# ── Service-Katalog ─────────────────────────────────────────────────────────────
def _aes_live_status():
    if not AES_DASHBOARD_URL:
        return None
    try:
        req = urllib.request.Request(AES_DASHBOARD_URL + "/", method="GET")
        with urllib.request.urlopen(req, timeout=4) as resp:
            return 200 <= resp.status < 400
    except Exception:
        return None


def _services_body(tenant_id):
    services = db.list_services(tenant_id)
    cards = []
    for s in services:
        badge = '<span class="badge">gebucht</span>' if s["gebucht"] else '<span class="sz">nicht gebucht</span>'
        link = ('<div class="sz" style="margin-top:8px"><a href="%s" target="_blank">Zum Service &rarr;</a></div>'
                % html.escape(s["endpoint"])) if s.get("endpoint") else ""
        cards.append("""<div class="card"><div class="svc-card">
<div><b>%s</b><div class="sz" style="margin-top:4px">%s</div></div>%s</div>%s</div>""" % (
            html.escape(s["name"]), html.escape(s["beschreibung"] or ""), badge, link))
    add_form = """<div class="panel"><h3 style="margin-top:0">Service hinzufuegen</h3>
<form method="post" action="/services/new">
<div class="formrow"><input type="text" name="name" placeholder="Name" required></div>
<div class="formrow"><textarea name="beschreibung" placeholder="Beschreibung"></textarea></div>
<div class="formrow"><input type="text" name="endpoint" placeholder="Endpoint-URL (optional)"></div>
<button class="btn" type="submit">Hinzufuegen</button>
</form></div>"""
    return '<h1 class="page-title">Service-Katalog</h1>' + "".join(cards) + add_form


@app.route("/services")
def services_route():
    r = _require_login()
    if r:
        return r
    return _shell("/services", "Service-Katalog", _services_body(session["tenant_id"]))


@app.route("/services/new", methods=["POST"])
def services_new_route():
    r = _require_login()
    if r:
        return r
    tenant_id = session["tenant_id"]
    sid = db.create_service(
        tenant_id, request.form.get("name", "").strip(), request.form.get("beschreibung", "").strip(),
        "Sonstiges", True, request.form.get("endpoint", "").strip(),
    )
    db.log_audit(tenant_id, session["user_id"], "service_created", "service", str(sid), None, _client_ip())
    return redirect(url_for("services_route"))


# ── Administration: Einstellungen + Audit-Log ──────────────────────────────────
@app.route("/admin", methods=["GET", "POST"])
def admin_route():
    r = _require_admin()
    if r:
        return r
    tenant_id = session["tenant_id"]
    notice = ""
    if request.method == "POST":
        db.update_tenant_settings(
            tenant_id,
            request.form.get("dsb_name", "").strip() or None,
            request.form.get("dsb_email", "").strip() or None,
            int(request.form.get("retention_tickets_days") or 1095),
            int(request.form.get("retention_audit_days") or 1825),
            int(request.form.get("sla_antwort_minuten") or 480),
            int(request.form.get("sla_loesung_minuten") or 2880),
        )
        db.log_audit(tenant_id, session["user_id"], "tenant_settings_updated", "tenant", str(tenant_id), None, _client_ip())
        notice = "<p class='sz' style='color:var(--ok)'>Gespeichert.</p>"
    if request.args.get("cleanup"):
        notice += "<p class='sz' style='color:var(--ok)'>Bereinigung durchgefuehrt -- Details im Audit-Log.</p>"
    t = db.get_tenant(tenant_id)
    body = """<h1 class="page-title">Einstellungen</h1>
<div class="panel"><h3 style="margin-top:0">%s</h3>%s
<form method="post">
<h2 class="section-title" style="margin-top:0">SLA-Standardwerte</h2>
<div class="grid-2">
<div class="formrow"><label>Antwortzeit (Minuten)</label><input type="number" name="sla_antwort_minuten" value="%s"></div>
<div class="formrow"><label>Loesungszeit (Minuten)</label><input type="number" name="sla_loesung_minuten" value="%s"></div>
</div>
<h2 class="section-title">Datenschutz (DSGVO)</h2>
<div class="grid-2">
<div class="formrow"><label>Datenschutzbeauftragter/Kontakt</label><input name="dsb_name" value="%s"></div>
<div class="formrow"><label>Kontakt-E-Mail</label><input name="dsb_email" value="%s"></div>
</div>
<div class="grid-2">
<div class="formrow"><label>Aufbewahrung Tickets (Tage)</label><input type="number" name="retention_tickets_days" value="%s"></div>
<div class="formrow"><label>Aufbewahrung Audit-Log (Tage)</label><input type="number" name="retention_audit_days" value="%s"></div>
</div>
<button class="btn" type="submit">Speichern</button>
</form></div>
<div class="panel">
<h3 style="margin-top:0">Aufbewahrungsfrist-Bereinigung</h3>
<p class="sz">Laeuft automatisch alle 24 Stunden im Hintergrund: geloeste/geschlossene Tickets und Audit-Log-Eintraege, die aelter als die oben hinterlegten Fristen sind, werden entfernt. Offene/laufende Tickets werden nie geloescht.</p>
<form method="post" action="/admin/retention/run">
<button class="btn ghost" type="submit">Jetzt manuell bereinigen</button>
</form>
</div>""" % (
        html.escape(t["name"]), notice, t["sla_antwort_minuten"], t["sla_loesung_minuten"],
        html.escape(t["dsb_name"] or ""), html.escape(t["dsb_email"] or ""),
        t["retention_tickets_days"], t["retention_audit_days"])
    return _shell("/admin", "Einstellungen", body)


@app.route("/admin/retention/run", methods=["POST"])
def admin_retention_run():
    r = _require_admin()
    if r:
        return r
    db.run_retention_cleanup()
    return redirect(url_for("admin_route", cleanup="1"))


@app.route("/admin/audit")
def admin_audit_route():
    r = _require_admin()
    if r:
        return r
    entries = db.list_audit(session["tenant_id"], limit=300)
    rows = "".join(
        "<tr><td class='sz'>%s</td><td>%s</td><td>%s</td><td class='sz'>%s %s</td></tr>" % (
            e["zeit"].strftime("%Y-%m-%d %H:%M:%S"), html.escape(e["user_email"] or "(unbekannt)"),
            html.escape(e["aktion"]), html.escape(e["entity_typ"] or ""), html.escape(e["entity_id"] or ""))
        for e in entries
    ) or "<tr><td colspan='4' class='sz'>Keine Eintraege.</td></tr>"
    body = """<h1 class="page-title">Audit-Log</h1>
<div class="sz" style="margin-bottom:12px">Alle sicherheitsrelevanten Aktionen dieses Mandanten (Anmeldungen, Aenderungen). Aufbewahrung gemaess Einstellungen.</div>
<table class="audit"><thead><tr><th>Zeitpunkt (UTC)</th><th>Benutzer</th><th>Aktion</th><th>Objekt</th></tr></thead>
<tbody>%s</tbody></table>""" % rows
    return _shell("/admin/audit", "Audit-Log", body)


# ── Platzhalterseiten ───────────────────────────────────────────────────────────
def _placeholder(title, note):
    return '<h1 class="page-title">%s</h1><div class="panel"><p class="sz">%s</p></div>' % (
        html.escape(title), html.escape(note))


@app.route("/wissen")
def wissen_route():
    r = _require_login()
    if r:
        return r
    return _shell("/wissen", "Wissensdatenbank",
                   _placeholder("Wissensdatenbank", "Noch nicht aufgebaut -- folgt in einer naechsten Ausbaustufe."))


@app.route("/assets")
def assets_route():
    r = _require_login()
    if r:
        return r
    return _shell("/assets", "Asset-Liste",
                   _placeholder("Asset-Liste", "Noch nicht aufgebaut -- folgt in einer naechsten Ausbaustufe."))


@app.route("/")
def root_route():
    if not db.any_tenant_exists():
        return redirect(url_for("setup_new"))
    if session.get("user_id"):
        return redirect(url_for("tickets_route"))
    return redirect(url_for("login"))


@app.route("/health")
def health_route():
    try:
        with db.get_conn() as conn:
            with conn.cursor() as cur:
                cur.execute("SELECT 1")
        return jsonify({"status": "ok", "db": "ok"})
    except Exception as e:
        return jsonify({"status": "error", "db": str(e)}), 500


db.init_db()


def _retention_loop():
    """Hintergrund-Thread: bereinigt abgelaufene Daten periodisch (siehe
    db.run_retention_cleanup). Laeuft einmal kurz nach dem Start und danach im
    festen Intervall. Der Postgres-Advisory-Lock in run_retention_cleanup()
    schuetzt davor, dass mehrere Worker/Prozesse gleichzeitig loeschen."""
    time.sleep(30)
    while True:
        try:
            db.run_retention_cleanup()
        except Exception as e:
            print("[retention] Fehler bei der Bereinigung:", e, flush=True)
        time.sleep(RETENTION_INTERVAL_SECONDS)


threading.Thread(target=_retention_loop, daemon=True).start()


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=8090)