feat(backend): implement phases 0-6 (auth, kc, wahl, files, chat, sync)

Full NestJS backend for the KC-App platform: - auth: Authentik OIDC resource-server strategy + guest invite-code JWT login, plus TokenVerificationService for the WS handshake path - kc: Leitungsteam-only KC (event) creation/listing - wahl: Wahl/Workshop admin, Force-Zuteilung overrides, ZuteilungService (port of the WP plugin's kc_run_zuteilung), CSV export - files: LT-only upload with visibility tiers; list/download filtered by caller tier; StorageProvider abstraction (WebDAV/Nextcloud default, S3) - chat: Gemeinde group / DM / LT-wide / broadcast channels; REST + raw ws gateway sharing ChatService access rules - sync: append-only SyncLogEntry replication log + local<->cloud push/pull scheduler, shared-secret guarded - common: Role enum, @Roles decorator, KC-scoped RolesGuard (LT global) - serves client/web/ interim static web client under / (API under /api) Typecheck, nest build and boot test pass; needs real Postgres/Authentik/ Nextcloud to run end to end. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-09 16:23:45 +02:00
parent e49eed871c
commit 7aba87368d
47 changed files with 3003 additions and 115 deletions
@@ -0,0 +1,107 @@
+import {
+  Body,
+  Controller,
+  Get,
+  Param,
+  Post,
+  Query,
+  Req,
+  Res,
+  UseGuards,
+} from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+import { Response } from 'express';
+import { WahlService } from './wahl.service';
+import { ZuteilungService } from './zuteilung.service';
+import { CreateWahlDto } from './dto/create-wahl.dto';
+import { CreateWorkshopDto } from './dto/create-workshop.dto';
+import { SubmitTeilnehmerDto } from './dto/submit-teilnehmer.dto';
+import { CreateForceZuteilungDto } from './dto/create-force-zuteilung.dto';
+import { Roles } from '../common/roles.decorator';
+import { RolesGuard } from '../common/roles.guard';
+import { Role } from '../common/role.enum';
+import { GuestAuthenticatedRequest } from '../auth/authenticated-request';
+
+@Controller('wahl')
+export class WahlController {
+  constructor(
+    private readonly wahl: WahlService,
+    private readonly zuteilung: ZuteilungService,
+  ) {}
+
+  /// Wahl-/Workshop-/Force-Zuteilung-Verwaltung ist ausschließlich Sache des
+  /// Leitungsteams (global über alle KCs, siehe RolesGuard).
+  @Post()
+  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @Roles(Role.LEITUNGSTEAM)
+  createWahl(@Body() dto: CreateWahlDto) {
+    return this.wahl.createWahl(dto.kcId, dto.name, dto.datumsSchluessel, dto.teil);
+  }
+
+  @Get()
+  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @Roles(Role.LEITUNGSTEAM)
+  listWahlen(@Query('kcId') kcId: string) {
+    return this.wahl.listWahlen(kcId);
+  }
+
+  @Post(':wahlId/workshops')
+  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @Roles(Role.LEITUNGSTEAM)
+  createWorkshop(@Param('wahlId') wahlId: string, @Body() dto: CreateWorkshopDto) {
+    return this.wahl.createWorkshop(wahlId, dto.name, dto.kapazitaet, dto.minTeilnehmer);
+  }
+
+  @Get(':wahlId/workshops')
+  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @Roles(Role.LEITUNGSTEAM)
+  listWorkshops(@Param('wahlId') wahlId: string) {
+    return this.wahl.listWorkshops(wahlId);
+  }
+
+  @Post(':wahlId/force-zuteilung')
+  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @Roles(Role.LEITUNGSTEAM)
+  createForceZuteilung(
+    @Param('wahlId') wahlId: string,
+    @Body() dto: CreateForceZuteilungDto,
+  ) {
+    return this.wahl.createForceZuteilung(wahlId, dto.teilnehmerId, dto.workshopId);
+  }
+
+  /// Guests submit their own workshop preferences (guest JWT, not Authentik).
+  @Post(':wahlId/teilnehmer')
+  @UseGuards(AuthGuard('guest'))
+  submitTeilnehmer(
+    @Param('wahlId') wahlId: string,
+    @Body() dto: SubmitTeilnehmerDto,
+    @Req() req: GuestAuthenticatedRequest,
+  ) {
+    const guest = req.user!;
+    return this.wahl.submitTeilnehmer(wahlId, guest.guestId, guest.kcId, dto.prioritaeten);
+  }
+
+  @Post(':wahlId/zuteilung/run')
+  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @Roles(Role.LEITUNGSTEAM)
+  runZuteilung(@Param('wahlId') wahlId: string) {
+    return this.zuteilung.run(wahlId);
+  }
+
+  @Get(':wahlId/zuteilung')
+  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @Roles(Role.LEITUNGSTEAM)
+  getZuteilung(@Param('wahlId') wahlId: string) {
+    return this.zuteilung.getResults(wahlId);
+  }
+
+  @Get(':wahlId/zuteilung/csv')
+  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @Roles(Role.LEITUNGSTEAM)
+  async exportCsv(@Param('wahlId') wahlId: string, @Res() res: Response) {
+    const csv = await this.zuteilung.exportCsv(wahlId);
+    res.setHeader('Content-Type', 'text/csv; charset=utf-8');
+    res.setHeader('Content-Disposition', `attachment; filename="zuteilung-${wahlId}.csv"`);
+    res.send(csv);
+  }
+}