VOs (Vertriebspartner-Nummern)
- New vos table (one row per VO, scoped to a provider). Migrations
add tarife.vo_id and schaltungen.vo_id columns (nullable so legacy
rows survive).
- New /api/vos CRUD (list, create, update, delete with use-checks).
- Admin: new "VOs (Vertriebspartner)" sub-tab. List/create with
provider dropdown; edit via prompt; delete refuses while used.
- /api/tarife?vo_id=X filter for fetching tariffs of a specific VO.
Tariff editor
- Add-tariff form requires a VO; new dependent VO dropdown that
populates after the provider is chosen.
- Edit-tariff modal now shows the VO dropdown and a checkbox grid of
all anbieter-wide tarifoptionen. Saving the dialog applies the
selection via the existing tarifoptionen_tarife table.
- New GET /api/tarife/:id/tarifoptionen-multi returns the option set
scoped to the tariff's provider, each annotated with whether it is
currently assigned to this tariff.
- POST/PUT /api/tarife accept vo_id (required for create, validated
against the provider) and an optional tarifoption_ids array.
Schaltung wizard
- The Schaltung-erfassen tab is now a 2-step wizard:
step 1 picks a provider from a button row (mirrors the screenshot
the user shared); step 2 shows a 2-column form mirroring the
Aktivierungs-/Vertragsdaten layout.
- Step 2 cascades: VO -> tariffs filtered by VO -> tarifoptionen
filtered by tariff. Erfasser is autofilled from the logged-in user
(read-only).
- Removed customer fields that the user does not need (Kundennummer,
Kennwort/Service-PIN never existed; Rufnummer is now optional both
in the form and in the API validation).
- After saving, the wizard resets to step 1 ready for the next entry.
Schema
- tarife: vo_id added.
- schaltungen: vo_id added; rufnummer is nullable in new DBs.
Existing DBs may still have NOT NULL on rufnummer; the schaltungen
route now sends an empty string instead of NULL to remain
compatible.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Backend
- New routes/users.js (admin-only via requireAdmin) with list, create,
update (incl. password reset) and delete endpoints.
- All user-facing API responses identify users by uuid, not the
numeric primary key — usernames can now be renamed without breaking
external references.
- Protection rules: cannot delete or demote the last admin; cannot
delete or demote your own account.
Schema / data
- users table gained a uuid TEXT column (unique). Existing rows are
backfilled with crypto.randomUUID() on startup. Setup endpoint and
the create-user CLI both generate a UUID for new users.
Frontend
- New "Benutzer" tab in nav-tabs, marked admin-only and shown only
after /api/auth/me reports isAdmin.
- Modal with create / edit forms (password optional on edit = leave
unchanged). XSS-safe rendering of the user list using the existing
escapeHtml helper and data-* attributes for action buttons.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
kerimatilganandClaude Opus 4.7