Team-Eingang: /api/team mit Appwrite-JWT fuer alle Mitarbeiter, CORS-Header fuer Uploads

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/index.js

@@ -39,6 +39,8 @@ import adminAnalyseRoutes from './routes/admin/analyse.js'
 import { analyseLegalRouter } from './services/analyseLegal.js'
 import adminSwitchLinkRoutes from './routes/admin/switchLink.js'
 import adminFinanzenRoutes from './routes/admin/finanzen.js'
+import teamRoutes from './routes/team/index.js'
+import { corsMiddleware } from './middleware/cors.js'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const publicDir = path.join(__dirname, '..', 'public')
@@ -55,18 +57,7 @@ app.use('/api/abo/takeover-credits', requireSession, express.json({ limit: '15mb
 // rawBody wird fuer die HMAC-Verifikation des Gitea-Webhooks benoetigt
 app.use(express.json({ limit: '2mb', verify: (req, _res, buf) => { req.rawBody = buf } }))
 
-app.use((req, res, next) => {
-  const origin = req.get('Origin')
-  if (origin && config.cors.allowedOrigins.includes(origin)) {
-    res.setHeader('Access-Control-Allow-Origin', origin)
-    res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type')
-    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS')
-    if (req.method === 'OPTIONS') {
-      return res.sendStatus(204)
-    }
-  }
-  return next()
-})
+app.use(corsMiddleware(config.cors.allowedOrigins))
 
 app.use('/api/auth', authRoutes)
 app.use('/api/projects', projectsRoutes)
@@ -79,6 +70,7 @@ app.use('/api/abo/takeover-credits', takeoverCreditRoutes)
 app.use('/api/abo', aboRoutes)
 app.use('/api/funktionen', funktionenRoutes)
 app.use('/api/portal-admin', portalAdminRoutes)
+app.use('/api/team', teamRoutes)
 app.use('/api/admin/gitea', adminGiteaRoutes)
 app.use('/api/admin/website-projects', adminPreviewRoutes)
 app.use('/api/admin/website-projects', adminWebsiteProjectsRoutes)

server/middleware/cors.js

@@ -0,0 +1,17 @@
+// CORS fuer das Ticketsystem (Bearer-JWT, keine Cookies). Die X-*-Header braucht der Chat-Upload.
+const ALLOW_HEADERS = 'Authorization, Content-Type, X-File-Name, X-Attachment-Kind, X-Duration-Ms, X-Image-Width, X-Image-Height'
+
+export function corsMiddleware(allowedOrigins) {
+  return (req, res, next) => {
+    const origin = req.get('Origin')
+    if (origin && allowedOrigins.includes(origin)) {
+      res.setHeader('Access-Control-Allow-Origin', origin)
+      res.setHeader('Access-Control-Allow-Headers', ALLOW_HEADERS)
+      res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS')
+      if (req.method === 'OPTIONS') {
+        return res.sendStatus(204)
+      }
+    }
+    return next()
+  }
+}

server/middleware/staffJwt.js

@@ -0,0 +1,59 @@
+import { config } from '../config.js'
+import { getEmployeeByEmail, getEmployeeByUserId } from '../services/appwriteAdmin.js'
+
+/**
+ * Appwrite-Konto zum Bearer-JWT aus dem Ticketsystem (GET /account). null ohne Header oder wenn Appwrite
+ * ablehnt - auch bei einer Sitzung ohne zweiten Faktor (401 user_more_factors_required).
+ */
+export async function appwriteAccountFromJwt(req) {
+  const match = (req.get('Authorization') || '').match(/^Bearer\s+(.+)$/i)
+  if (!match) return null
+  const response = await fetch(`${config.appwrite.endpoint}/account`, {
+    headers: {
+      'Content-Type': 'application/json',
+      'X-Appwrite-Project': config.appwrite.projectId,
+      'X-Appwrite-JWT': match[1],
+    },
+  })
+  if (!response.ok) return null
+  return response.json()
+}
+
+/**
+ * Mitarbeiter fuer den Team-Eingang: employees-Eintrag zur Konto-ID, Label "admin" oder - nur mit bestaetigter
+ * Konto-Mail - ein employees-Eintrag zur Mail. Kunden haben Konten im selben Appwrite-Projekt und koennen ihre
+ * Mail ohne Bestaetigung aendern; eine unbestaetigte Mail zaehlt deshalb nie.
+ */
+export async function resolveTeamStaff(account) {
+  if (!account?.$id) return null
+  const isAdmin = Array.isArray(account.labels) && account.labels.includes('admin')
+  let employee = await getEmployeeByUserId(account.$id).catch(() => null)
+  if (!employee && !isAdmin && account.emailVerification === true && account.email) {
+    employee = await getEmployeeByEmail(account.email).catch(() => null)
+  }
+  if (!employee && !isAdmin) return null
+  return {
+    isAdmin,
+    name: employee?.displayName || account.name || 'Mitarbeiter',
+    email: account.email || employee?.email || '',
+  }
+}
+
+/**
+ * Team-Eingang (/api/team): jeder Mitarbeiter mit gueltiger Ticketsystem-Anmeldung. req.session hat dieselbe Form
+ * wie die Admin-Sitzung des Portals, damit die bestehenden Handler unveraendert laufen.
+ */
+export async function requireStaffJwt(req, res, next) {
+  try {
+    const account = await appwriteAccountFromJwt(req)
+    if (!account?.$id) return res.status(401).json({ error: 'Bitte im Ticketsystem neu anmelden.' })
+    const staff = await resolveTeamStaff(account)
+    if (!staff) return res.status(403).json({ error: 'Kein Mitarbeiterkonto.' })
+    const session = { role: 'admin', isAdmin: staff.isAdmin, appwriteUserId: account.$id, name: staff.name, email: staff.email }
+    req.session = session
+    req.staff = session
+    return next()
+  } catch (err) {
+    return res.status(500).json({ error: err.message || 'Anmeldung konnte nicht geprüft werden' })
+  }
+}

server/routes/admin/switchLink.js

@@ -1,5 +1,6 @@
 import { Router } from 'express'
 import { config } from '../../config.js'
+import { appwriteAccountFromJwt } from '../../middleware/staffJwt.js'
 import { createStaffPreviewToken } from '../../services/staffPreviewTokens.js'
 import { resolveStaffAccount } from '../../services/staffAccount.js'
 
@@ -10,20 +11,6 @@ const router = Router()
  * ueber /account geprueft (eine Sitzung ohne zweiten Faktor bekommt dort 401), aber ohne Label-Pflicht:
  * jeder Mitarbeiter darf rueber, wie beim normalen Portal-Login.
  */
-async function appwriteAccountFromJwt(req) {
-  const match = (req.get('Authorization') || '').match(/^Bearer\s+(.+)$/i)
-  if (!match) return null
-  const response = await fetch(`${config.appwrite.endpoint}/account`, {
-    headers: {
-      'Content-Type': 'application/json',
-      'X-Appwrite-Project': config.appwrite.projectId,
-      'X-Appwrite-JWT': match[1],
-    },
-  })
-  if (!response.ok) return null
-  return response.json()
-}
-
 router.post('/', async (req, res) => {
   try {
     const user = await appwriteAccountFromJwt(req)

server/routes/team/index.js

@@ -0,0 +1,8 @@
+import { Router } from 'express'
+import { requireStaffJwt } from '../../middleware/staffJwt.js'
+
+// Team-Eingang fuer das Ticketsystem: alle Mitarbeiter, Appwrite-JWT (Spec 2026-10-01 Admin-Panel ins Ticketsystem)
+const router = Router()
+router.use(requireStaffJwt)
+
+export default router