Analyse: Einwilligungs-Historie, Nachweis beim Einschalten, Sperre ohne Verantwortlichen-Angaben, Textform für Mitarbeiter

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/routes/admin/analyse.js

@@ -1,9 +1,9 @@
-// Admin-API (WOMS): Website-Analyse je Projekt ein-/ausschalten. AVV wird mündlich bestätigt.
+// Admin-API (WOMS): Website-Analyse je Projekt ein-/ausschalten. Einschalten nur mit Zustimmung des Kunden in Textform (Datum + Weg).
 import { Router } from 'express'
 import { config } from '../../config.js'
 import { getDocument } from '../../services/appwriteAdmin.js'
 import { requireAppwriteStaff } from '../../middleware/appwriteStaff.js'
-import { activateAnalyse, analyseEligibility, deactivateAnalyse, ELIGIBILITY_MESSAGES } from '../../services/analyse.js'
+import { activateAnalyse, analyseEligibility, controllerView, deactivateAnalyse, ELIGIBILITY_MESSAGES, validateTextform } from '../../services/analyse.js'
 import { getFeatureDoc } from '../../services/siteFeatures.js'
 
 const router = Router()
@@ -26,9 +26,10 @@ router.get('/:projectId', async (req, res) => {
       throw err
     }
     const customerId = project.customerId || ''
-    const [doc, eligibility] = await Promise.all([
+    const [doc, eligibility, controller] = await Promise.all([
       customerId ? getFeatureDoc(customerId, project.$id, 'analyse') : null,
       analyseEligibility(customerId, project.$id),
+      controllerView(customerId),
     ])
     res.json({
       enabled: config.analyse.enabled,
@@ -37,6 +38,9 @@ router.get('/:projectId', async (req, res) => {
       avvVersion: config.analyse.avvVersion,
       avvAcceptedAt: doc?.avvAcceptedAt || null,
       avvAcceptedBy: doc?.avvAcceptedBy || null,
+      avvConsentDate: doc?.avvConsentDate || null,
+      avvConsentChannel: doc?.avvConsentChannel || null,
+      privacy: { ok: controller.ok, missing: controller.missing },
       activatedAt: doc?.activatedAt || null,
       offSince: doc?.offSince || null,
       eligible: eligibility.ok,
@@ -50,10 +54,15 @@ router.get('/:projectId', async (req, res) => {
 router.post('/:projectId', async (req, res) => {
   try {
     if (!config.analyse.enabled) return res.status(409).json({ error: 'Website-Analyse ist noch nicht freigeschaltet' })
-    const { on, avvConfirmedVerbally } = req.body || {}
+    const { on, textformDate, textformChannel, audienceConfirmed, avvConfirmedVerbally } = req.body || {}
     if (typeof on !== 'boolean') return res.status(400).json({ error: 'on muss true oder false sein' })
-    if (on && avvConfirmedVerbally !== true) {
-      return res.status(400).json({ error: 'Bitte bestätigen, dass der Kunde den AVV bestätigt hat' })
+    let textform
+    if (on) {
+      if (avvConfirmedVerbally !== undefined) return res.status(400).json({ error: 'Zustimmung in Textform nötig' })
+      if (audienceConfirmed !== true) {
+        return res.status(400).json({ error: 'Bitte bestätigen, dass die Website sich nicht gezielt an Kinder unter 16 Jahren richtet' })
+      }
+      textform = validateTextform({ date: textformDate, channel: textformChannel })
     }
     let project
     try {
@@ -71,6 +80,7 @@ router.post('/:projectId', async (req, res) => {
           projectId: project.$id,
           consent: { accepted: true, avvVersion: config.analyse.avvVersion },
           by,
+          textform,
         })
       : await deactivateAnalyse({ customerId, projectId: project.$id, by })
     res.json({ ok: true, state: doc?.state || 'off' })

server/routes/funktionen.js

@@ -21,6 +21,7 @@ import {
   analyseHosts,
   isDevPreview,
   analyseEligibility,
+  controllerView,
   deactivateAnalyse,
 } from '../services/analyse.js'
 
@@ -41,7 +42,11 @@ const ANALYSE_ERROR = 'Die Website-Analyse konnte gerade nicht geändert werden.
 
 async function analyseView(customerId, projectId) {
   if (!config.analyse.enabled) return { comingSoon: true }
-  const [doc, eligibility] = await Promise.all([getFeatureDoc(customerId, projectId, 'analyse'), analyseEligibility(customerId, projectId)])
+  const [doc, eligibility, controller] = await Promise.all([
+    getFeatureDoc(customerId, projectId, 'analyse'),
+    analyseEligibility(customerId, projectId),
+    controllerView(customerId),
+  ])
   let devMode = false
   if (doc?.state === 'active') {
     const project = eligibility.project || (await getDocument(config.collections.websiteProjects, projectId).catch(() => null))
@@ -55,6 +60,7 @@ async function analyseView(customerId, projectId) {
     reason: eligibility.reason || null,
     reasonText: eligibility.reason ? ELIGIBILITY_MESSAGES[eligibility.reason] : null,
     avvVersion: config.analyse.avvVersion,
+    controller,
   }
 }
 
@@ -177,6 +183,7 @@ router.post('/analyse/activate', analyseGuard, async (req, res) => {
       accentColor,
       consent,
       by: 'customer',
+      actor: { name: req.session.name, email: req.session.email },
     })
     res.json({ ok: true, state: doc.state })
   } catch (err) {
@@ -193,6 +200,7 @@ router.post('/analyse/deactivate', analyseGuard, async (req, res) => {
       customerId: getSessionCustomerId(req),
       projectId: analyseProjectId(req.body?.projectId),
       by: 'customer',
+      actor: { name: req.session.name, email: req.session.email },
     })
     res.json({ ok: true, state: doc?.state || 'off' })
   } catch (err) {