Team-Eingang: /api/team mit Appwrite-JWT fuer alle Mitarbeiter, CORS-Header fuer Uploads

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/index.js

@@ -39,6 +39,8 @@ import adminAnalyseRoutes from './routes/admin/analyse.js'
 import { analyseLegalRouter } from './services/analyseLegal.js'
 import adminSwitchLinkRoutes from './routes/admin/switchLink.js'
 import adminFinanzenRoutes from './routes/admin/finanzen.js'
+import teamRoutes from './routes/team/index.js'
+import { corsMiddleware } from './middleware/cors.js'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const publicDir = path.join(__dirname, '..', 'public')
@@ -55,18 +57,7 @@ app.use('/api/abo/takeover-credits', requireSession, express.json({ limit: '15mb
 // rawBody wird fuer die HMAC-Verifikation des Gitea-Webhooks benoetigt
 app.use(express.json({ limit: '2mb', verify: (req, _res, buf) => { req.rawBody = buf } }))
 
-app.use((req, res, next) => {
-  const origin = req.get('Origin')
-  if (origin && config.cors.allowedOrigins.includes(origin)) {
-    res.setHeader('Access-Control-Allow-Origin', origin)
-    res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type')
-    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS')
-    if (req.method === 'OPTIONS') {
-      return res.sendStatus(204)
-    }
-  }
-  return next()
-})
+app.use(corsMiddleware(config.cors.allowedOrigins))
 
 app.use('/api/auth', authRoutes)
 app.use('/api/projects', projectsRoutes)
@@ -79,6 +70,7 @@ app.use('/api/abo/takeover-credits', takeoverCreditRoutes)
 app.use('/api/abo', aboRoutes)
 app.use('/api/funktionen', funktionenRoutes)
 app.use('/api/portal-admin', portalAdminRoutes)
+app.use('/api/team', teamRoutes)
 app.use('/api/admin/gitea', adminGiteaRoutes)
 app.use('/api/admin/website-projects', adminPreviewRoutes)
 app.use('/api/admin/website-projects', adminWebsiteProjectsRoutes)