Wechsel Ticketsystem → Projekt-Admin per Einmal-Link, Rückweg-Button

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/index.js

@@ -22,6 +22,7 @@ import adminCustomersRoutes from './routes/admin/customers.js'
 import adminEmployeesRoutes from './routes/admin/employees.js'
 import adminInvoiceClientsRoutes from './routes/admin/invoiceClients.js'
 import adminPreviewOpenRoutes from './routes/admin/previewOpen.js'
+import adminSwitchLinkRoutes from './routes/admin/switchLink.js'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const publicDir = path.join(__dirname, '..', 'public')
@@ -65,6 +66,7 @@ app.use('/api/admin/customers', adminCustomersRoutes)
 app.use('/api/admin/employees', adminEmployeesRoutes)
 app.use('/api/admin/invoice-clients', adminInvoiceClientsRoutes)
 app.use('/api/admin/preview-open', adminPreviewOpenRoutes)
+app.use('/api/admin/switch-link', adminSwitchLinkRoutes)
 app.use('/webhook', giteaWebhookRoutes)
 
 app.get('/api/health', async (_req, res) => {

server/routes/admin/switchLink.js

@@ -0,0 +1,50 @@
+import { Router } from 'express'
+import { config } from '../../config.js'
+import { createStaffPreviewToken } from '../../services/staffPreviewTokens.js'
+import { resolveStaffAccount } from '../../services/staffAccount.js'
+
+const router = Router()
+
+/**
+ * Wechsel Ticketsystem -> Projekt-Admin ohne zweiten Login. Wie requireAppwriteStaff wird das JWT
+ * ueber /account geprueft (eine Sitzung ohne zweiten Faktor bekommt dort 401), aber ohne Label-Pflicht:
+ * jeder Mitarbeiter darf rueber, wie beim normalen Portal-Login.
+ */
+async function appwriteAccountFromJwt(req) {
+  const match = (req.get('Authorization') || '').match(/^Bearer\s+(.+)$/i)
+  if (!match) return null
+  const response = await fetch(`${config.appwrite.endpoint}/account`, {
+    headers: {
+      'Content-Type': 'application/json',
+      'X-Appwrite-Project': config.appwrite.projectId,
+      'X-Appwrite-JWT': match[1],
+    },
+  })
+  if (!response.ok) return null
+  return response.json()
+}
+
+router.post('/', async (req, res) => {
+  try {
+    const user = await appwriteAccountFromJwt(req)
+    if (!user?.$id) return res.status(401).json({ error: 'Bitte im Ticketsystem neu anmelden.' })
+
+    const staff = await resolveStaffAccount(user.$id, user.email || '', user)
+    if (!staff) return res.status(403).json({ error: 'Kein Mitarbeiterkonto.' })
+
+    const token = createStaffPreviewToken({
+      purpose: 'switch',
+      userId: user.$id,
+      email: staff.email,
+      name: staff.name,
+      isAdmin: staff.isAdmin,
+    })
+    return res.json({
+      openUrl: `https://${config.preview.baseHost}/api/auth/staff-switch?token=${encodeURIComponent(token)}`,
+    })
+  } catch (err) {
+    return res.status(500).json({ error: err.message || 'Wechsel fehlgeschlagen' })
+  }
+})
+
+export default router

server/routes/auth.js

@@ -335,6 +335,19 @@ router.get('/staff-preview', async (req, res) => {
   return res.redirect(previewUrl)
 })
 
+// Wechsel aus dem Ticketsystem (POST /api/admin/switch-link): Einmal-Link -> Admin-Sitzung
+router.get('/staff-switch', async (req, res) => {
+  const tokenData = consumeStaffPreviewToken(String(req.query.token || ''), 'switch')
+  if (!tokenData) {
+    return res.redirect(`/login.html?error=${encodeURIComponent('Link abgelaufen, bitte anmelden')}`)
+  }
+  await startStaffPortalSession(res, {
+    userId: tokenData.userId,
+    staff: { isAdmin: Boolean(tokenData.isAdmin), name: tokenData.name, email: tokenData.email },
+  })
+  return res.redirect('/admin.html')
+})
+
 // Selbstheilung: Portal-Session lebt oft laenger als das preview_session-Cookie
 // (bzw. das Cookie fehlt nach WebView-/Browser-Datenverlust). Ohne gueltiges
 // Preview-Cookie laufen die *.project.webklar.com-Hosts in eine 302-Schleife.

server/services/staffPreviewTokens.js

@@ -20,11 +20,16 @@ export function createStaffPreviewToken(payload) {
   return token
 }
 
-export function consumeStaffPreviewToken(token) {
+/**
+ * Einmal einloesen. purpose trennt Preview-Links ('preview', Standard) vom Wechsel ins Projekt-Admin
+ * ('switch'); ein Token fuer den falschen Zweck ist trotzdem verbraucht.
+ */
+export function consumeStaffPreviewToken(token, purpose = 'preview') {
   purgeExpired()
   const entry = tokens.get(token)
   if (!entry) return null
   tokens.delete(token)
   if (entry.expiresAt <= Date.now()) return null
+  if ((entry.purpose || 'preview') !== purpose) return null
   return entry
 }