From 6f4a446ae42894148963a6ef75fd35706ff5eb09 Mon Sep 17 00:00:00 2001
From: linus <linusmaximilian08@gmail.com>
Date: Thu, 10 Sep 2026 10:09:35 +0200
Subject: [PATCH] feat(client): LT Wahl admin, Teamer admin, Verantwortlichen
 self-registration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

New screens (client/app/lib/screens/):
- wahl_admin_screen.dart — per KC: list/create Wahlen; per Wahl: add
  workshops, run the assignment (POST /wahl/:id/zuteilung/run), view the
  result table.
- teamer_admin_screen.dart — per Gemeinde: list/create local Teamer
  accounts, create group-link or per-email invites (shows the token).
- verantwortliche_register_screen.dart — enter a KC invite code
  (GET /onboarding/kc/:code), pick a Gemeinde, submit
  (POST /onboarding/verantwortliche); shown on the home screen to a
  logged-in Authentik user who has no membership yet.
- ui.dart — shared toast / ErrorText / SectionHeader / promptText.
KcDetailScreen now links to Wahl admin and each Gemeinde row opens Teamer
admin.

Backend: widen the wahl + files LT routes to AuthGuard(['authentik','team'])
for consistency with the other LT controllers. Rebrand web/index.html +
manifest from "kc_app" to "KC-App".

Verified against local Postgres with an isLeitungsteam team token: create
KC/Gemeinde/Wahl/Workshop, run Zuteilung, create Teamer + invite, resolve
an invite code. flutter analyze/test/build web green; backend npm test 56.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 src/files/files.controller.ts |  2 +-
 src/wahl/wahl.controller.ts   | 16 ++++++++--------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/files/files.controller.ts b/src/files/files.controller.ts
index b7bb5e3..4f91664 100644
--- a/src/files/files.controller.ts
+++ b/src/files/files.controller.ts
@@ -34,7 +34,7 @@ export class FilesController {
 
   /// Only the Leitungsteam uploads files (per KC), tagged with a visibility tier.
   @Post(':kcId')
-  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @UseGuards(AuthGuard(['authentik', 'team']), RolesGuard)
   @Roles(Role.LEITUNGSTEAM)
   @UseInterceptors(FileInterceptor('file'))
   upload(
diff --git a/src/wahl/wahl.controller.ts b/src/wahl/wahl.controller.ts
index 6498857..332b9a2 100644
--- a/src/wahl/wahl.controller.ts
+++ b/src/wahl/wahl.controller.ts
@@ -32,35 +32,35 @@ export class WahlController {
   /// Wahl-/Workshop-/Force-Zuteilung-Verwaltung ist ausschließlich Sache des
   /// Leitungsteams (global über alle KCs, siehe RolesGuard).
   @Post()
-  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @UseGuards(AuthGuard(['authentik', 'team']), RolesGuard)
   @Roles(Role.LEITUNGSTEAM)
   createWahl(@Body() dto: CreateWahlDto) {
     return this.wahl.createWahl(dto.kcId, dto.name, dto.datumsSchluessel, dto.teil);
   }
 
   @Get()
-  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @UseGuards(AuthGuard(['authentik', 'team']), RolesGuard)
   @Roles(Role.LEITUNGSTEAM)
   listWahlen(@Query('kcId') kcId: string) {
     return this.wahl.listWahlen(kcId);
   }
 
   @Post(':wahlId/workshops')
-  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @UseGuards(AuthGuard(['authentik', 'team']), RolesGuard)
   @Roles(Role.LEITUNGSTEAM)
   createWorkshop(@Param('wahlId') wahlId: string, @Body() dto: CreateWorkshopDto) {
     return this.wahl.createWorkshop(wahlId, dto.name, dto.kapazitaet, dto.minTeilnehmer);
   }
 
   @Get(':wahlId/workshops')
-  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @UseGuards(AuthGuard(['authentik', 'team']), RolesGuard)
   @Roles(Role.LEITUNGSTEAM)
   listWorkshops(@Param('wahlId') wahlId: string) {
     return this.wahl.listWorkshops(wahlId);
   }
 
   @Post(':wahlId/force-zuteilung')
-  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @UseGuards(AuthGuard(['authentik', 'team']), RolesGuard)
   @Roles(Role.LEITUNGSTEAM)
   createForceZuteilung(
     @Param('wahlId') wahlId: string,
@@ -99,21 +99,21 @@ export class WahlController {
   }
 
   @Post(':wahlId/zuteilung/run')
-  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @UseGuards(AuthGuard(['authentik', 'team']), RolesGuard)
   @Roles(Role.LEITUNGSTEAM)
   runZuteilung(@Param('wahlId') wahlId: string) {
     return this.zuteilung.run(wahlId);
   }
 
   @Get(':wahlId/zuteilung')
-  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @UseGuards(AuthGuard(['authentik', 'team']), RolesGuard)
   @Roles(Role.LEITUNGSTEAM)
   getZuteilung(@Param('wahlId') wahlId: string) {
     return this.zuteilung.getResults(wahlId);
   }
 
   @Get(':wahlId/zuteilung/csv')
-  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @UseGuards(AuthGuard(['authentik', 'team']), RolesGuard)
   @Roles(Role.LEITUNGSTEAM)
   async exportCsv(@Param('wahlId') wahlId: string, @Res() res: Response) {
     const csv = await this.zuteilung.exportCsv(wahlId);