admin.php
Rama main · réplica de lectura del repositorio original.
<?php
/**
* Paragrafy - Admin Command Center, Multi-Project Manager, Compliance Engine & Webhook Logger
*/
declare(strict_types=1);
ini_set('display_errors', '0');
ini_set('log_errors', '1');
error_reporting(E_ALL);
if (session_status() === PHP_SESSION_NONE) {
$isHttps = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || (($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https');
session_set_cookie_params(['lifetime' => 0, 'path' => '/', 'secure' => $isHttps, 'httponly' => true, 'samesite' => 'Lax']);
session_start();
}
require_once __DIR__ . '/db.php';
if (!is_installed()) {
header('Location: /install.php');
exit;
}
$config = get_config();
$db = get_db();
$error = null;
$earlyRoute = parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH);
if (str_starts_with($earlyRoute, '/admin/accept-invite')) {
handle_accept_invite($db);
exit;
}
if (str_starts_with($earlyRoute, '/admin/forgot-password')) {
handle_forgot_password($db);
exit;
}
if (str_starts_with($earlyRoute, '/admin/reset-password')) {
handle_reset_password($db);
exit;
}
if (str_starts_with($earlyRoute, '/admin/sso')) {
handle_sso_login($config);
exit;
}
if (isset($_POST['action']) && $_POST['action'] === 'login') {
$clientIp = get_client_ip();
$emailForRateLimit = trim(strtolower($_POST['email'] ?? ''));
$acctIdentifier = $emailForRateLimit !== '' ? 'acct:' . $emailForRateLimit : null;
$waitSeconds = max(
login_rate_limit_wait($db, $clientIp),
$acctIdentifier !== null ? login_rate_limit_wait($db, $acctIdentifier) : 0
);
if ($waitSeconds > 0) {
$error = t('admin.login.rate_limited', ['minutes' => (int)ceil($waitSeconds / 60)]);
} else {
$email = $emailForRateLimit;
$pass = $_POST['password'] ?? '';
$loggedIn = false;
$totpPending = null;
if ($email !== '') {
$stmt = $db->prepare("SELECT * FROM users WHERE email = ? AND status = 'active'");
$stmt->execute([$email]);
$user = $stmt->fetch();
if ($user && !empty($user['password_hash']) && password_verify($pass, $user['password_hash'])) {
if (!empty($user['totp_enabled_at'])) {
// Eine auf diesem Seitenaufruf gewaehlte Sprache muss ueber den TOTP-Zwischenschritt
// hinweg mitgegeben werden -- der Redirect nach /admin (unten) traegt kein ?locale=
// mehr, und beim Abschluss in handle_totp_verify() waere $_GET['locale'] dann leer.
$pendingLocaleKnown = array_keys(ui_locales());
$pendingLocale = in_array($_GET['locale'] ?? '', $pendingLocaleKnown, true) ? $_GET['locale'] : null;
$totpPending = ['type' => 'user', 'user_id' => (int)$user['id'], 'started_at' => time(), 'locale' => $pendingLocale];
} else {
finalize_user_session($user);
$loggedIn = true;
}
}
} elseif (empty($config['admin_password_login_disabled']) && password_verify($pass, $config['admin_password_hash'] ?? '')) {
if (admin_totp_available() && admin_totp_enabled()) {
$totpPending = ['type' => 'admin', 'started_at' => time()];
} else {
finalize_admin_session();
$loggedIn = true;
}
}
if ($loggedIn || $totpPending !== null) {
// Passwort war in beiden Faellen korrekt -- ein evtl. anschliessend
// falscher TOTP-Code zaehlt separat unter dem totp:-Praefix (siehe
// handle_totp_verify()), nicht hier gegen den Passwort-Zaehler.
clear_login_failures($db, $clientIp);
if ($acctIdentifier !== null) {
clear_login_failures($db, $acctIdentifier);
}
if ($totpPending !== null) {
$_SESSION['totp_pending'] = $totpPending;
}
header('Location: /admin');
exit;
}
record_login_failure($db, $clientIp);
if ($acctIdentifier !== null) {
record_login_failure($db, $acctIdentifier);
}
$error = ($email === '' && !empty($config['admin_password_login_disabled']))
? t('admin.login.admin_password_login_disabled')
: t('admin.login.invalid_credentials');
}
}
if (isset($_POST['action']) && $_POST['action'] === 'totp_verify') {
$error = handle_totp_verify($db);
}
if (isset($_GET['totp_cancel'])) {
unset($_SESSION['totp_pending']);
header('Location: /admin');
exit;
}
if (isset($_GET['logout'])) {
unset($_SESSION['paragrafy_admin'], $_SESSION['paragrafy_user_id'], $_SESSION['paragrafy_user_name'], $_SESSION['paragrafy_user_email'], $_SESSION['paragrafy_user_locale'], $_SESSION['totp_pending']);
header('Location: /admin');
exit;
}
if (empty($_SESSION['paragrafy_admin'])) {
$totpPending = $_SESSION['totp_pending'] ?? null;
if (is_array($totpPending) && ($totpPending['started_at'] ?? 0) > time() - 300) {
render_totp_view($error);
} else {
unset($_SESSION['totp_pending']);
render_login_view($error);
}
exit;
}
require_csrf();
$allProjects = $db->query("SELECT * FROM projects ORDER BY name ASC")->fetchAll();
$accessibleProjectIds = current_user_accessible_project_ids($db);
$projects = array_values(array_filter($allProjects, fn($p) => in_array((int)$p['id'], $accessibleProjectIds, true)));
$requestedProjectId = isset($_GET['project_id']) ? (int)$_GET['project_id'] : null;
$projectId = (int)($requestedProjectId ?? $_SESSION['admin_project_id'] ?? ($projects[0]['id'] ?? 0));
if ($projectId > 0 && !in_array($projectId, $accessibleProjectIds, true)) {
if ($requestedProjectId !== null) {
http_response_code(403);
echo htmlspecialchars(t('admin.common.access_denied'));
exit;
}
$projectId = (int)($projects[0]['id'] ?? 0);
}
$_SESSION['admin_project_id'] = $projectId;
$stmt = $db->prepare("SELECT * FROM projects WHERE id = ?");
$stmt->execute([$projectId]);
$project = $stmt->fetch();
if (!$project) {
render_no_access_view();
exit;
}
// Diese Aktionen wirken auf die gesamte Instanz (alle Projekte/Mandanten), nicht nur auf das
// aktuell gewaehlte Projekt -- nur der primaere Admin-Login darf sie ausloesen, sonst koennte ein
// auf ein einzelnes Projekt beschraenkter Multi-User Daten anderer Mandanten abziehen/ueberschreiben.
$instanceWideAction = ($_GET['action'] ?? $_POST['action'] ?? '');
if (in_array($instanceWideAction, ['download_backup', 'download_backup_file', 'run_backup_now', 'restore_backup_upload', 'run_webhook_queue_now', 'regenerate_cron_secret'], true) && !current_user_is_primary_admin()) {
http_response_code(403);
echo htmlspecialchars(t('admin.common.access_denied'));
exit;
}
// 1. SQLite Datenbank-Backup herunterladen
if (isset($_GET['action']) && $_GET['action'] === 'download_backup') {
if (file_exists(DB_FILE)) {
header('Content-Type: application/x-sqlite3');
header('Content-Disposition: attachment; filename="paragrafy_backup_' . date('Y-m-d_His') . '.sqlite"');
header('Content-Length: ' . filesize(DB_FILE));
readfile(DB_FILE);
exit;
}
}
// 1b. Rollierendes Backup herunterladen (7-Tage-Verlauf)
if (isset($_GET['action']) && $_GET['action'] === 'download_backup_file') {
$requested = basename((string)($_GET['file'] ?? ''));
$path = BACKUP_DIR . '/' . $requested;
if (preg_match('/^paragrafy_backup_[0-9_-]+\.sqlite$/', $requested) && file_exists($path)) {
header('Content-Type: application/x-sqlite3');
header('Content-Disposition: attachment; filename="' . $requested . '"');
header('Content-Length: ' . filesize($path));
readfile($path);
exit;
}
http_response_code(404);
echo htmlspecialchars(t('admin.common.backup_not_found'));
exit;
}
// 1b2. Einzelnes Projekt exportieren (nur Rechtsinhalte, kein Voll-Instanz-Export)
if (isset($_GET['action']) && $_GET['action'] === 'export_project') {
$exportResult = export_project_backup($db, $projectId);
if ($exportResult['success']) {
header('Content-Type: application/x-sqlite3');
header('Content-Disposition: attachment; filename="' . $exportResult['filename'] . '"');
header('Content-Length: ' . filesize($exportResult['path']));
readfile($exportResult['path']);
@unlink($exportResult['path']);
exit;
}
http_response_code(500);
echo htmlspecialchars($exportResult['error'] ?? '');
exit;
}
// 1c. Rollierendes Backup manuell anstoßen
if (isset($_POST['action']) && $_POST['action'] === 'run_backup_now') {
$result = run_scheduled_backup();
log_audit(null, '', $result['success'] ? t('admin.common.audit.backup_triggered') : t('admin.common.audit.backup_failed', ['error' => $result['error'] ?? '']));
header("Location: /admin/settings?project_id=$projectId&msg=" . ($result['success'] ? 'backup_created' : 'backup_failed'));
exit;
}
// 1e. Backup hochladen & Datenbank wiederherstellen
if (isset($_POST['action']) && $_POST['action'] === 'restore_backup_upload') {
if (empty($_FILES['backup_file']['tmp_name'])) {
header("Location: /admin/settings?project_id=$projectId&msg=restore_failed&restore_error=" . urlencode(t('db.restore.upload_failed')));
exit;
}
$result = restore_database_from_upload($_FILES['backup_file']['tmp_name']);
if ($result['success']) {
log_audit(null, '', t('admin.common.audit.restore_triggered', ['count' => $result['project_count'] ?? 0]));
$redirect = "/admin/settings?msg=restore_success&restore_count=" . (int)($result['project_count'] ?? 0);
if (!empty($result['over_limit'])) {
$redirect .= "&restore_over_limit=1&restore_limit=" . (int)($result['project_limit'] ?? 0);
}
header("Location: $redirect");
} else {
log_audit(null, '', t('admin.common.audit.restore_failed', ['error' => $result['error'] ?? '']));
header("Location: /admin/settings?project_id=$projectId&msg=restore_failed&restore_error=" . urlencode($result['error'] ?? ''));
}
exit;
}
// 1f. Einzelnes Projekt in ein explizit gewähltes, bestehendes Projekt importieren (Merge,
// andere Projekte dieser Instanz bleiben unberührt)
if (isset($_POST['action']) && $_POST['action'] === 'import_project_upload') {
$targetProjectId = (int)($_POST['target_project_id'] ?? 0);
if (empty($_FILES['project_file']['tmp_name']) || $targetProjectId <= 0 || !in_array($targetProjectId, $accessibleProjectIds, true)) {
header("Location: /admin/settings?project_id=$projectId&msg=project_import_failed&import_error=" . urlencode(t('db.restore.upload_failed')));
exit;
}
$result = import_project_backup($db, $_FILES['project_file']['tmp_name'], $targetProjectId);
if ($result['success']) {
log_audit($result['target_project_id'], '', t('admin.common.audit.project_import_merged', ['docs' => $result['documents_merged'], 'translations' => $result['translations_merged']]));
header("Location: /admin/settings?project_id=" . (int)$result['target_project_id'] . "&msg=project_import_success&import_docs=" . (int)$result['documents_merged']);
} else {
log_audit(null, '', t('admin.common.audit.project_import_failed', ['error' => $result['error'] ?? '']));
header("Location: /admin/settings?project_id=$projectId&msg=project_import_failed&import_error=" . urlencode($result['error'] ?? ''));
}
exit;
}
// 1d. Webhook-Warteschlange manuell abarbeiten
if (isset($_POST['action']) && $_POST['action'] === 'run_webhook_queue_now') {
process_webhook_queue();
header("Location: /admin/settings?project_id=$projectId&msg=queue_processed");
exit;
}
// 1e. Cron-Secret neu generieren (macht bestehende Cron-URLs ungültig)
if (isset($_POST['action']) && $_POST['action'] === 'regenerate_cron_secret') {
if (!empty(get_config()['managed_cloud']) || !empty(get_config()['is_demo'])) {
header('Location: /admin/settings?project_id=' . $projectId . '&msg=managed_cloud_blocked');
exit;
}
regenerate_cron_secret();
log_audit(null, '', t('admin.common.audit.cron_secret_regenerated'));
header("Location: /admin/settings?project_id=$projectId&msg=cron_secret_regenerated");
exit;
}
// 2. Markdown Export herunterladen
if (isset($_GET['action']) && $_GET['action'] === 'export_markdown') {
$stmt = $db->prepare("
SELECT t.title, t.slug, t.lang, t.content, t.updated_at, dt.title as type_title
FROM translations t
JOIN documents d ON t.document_id = d.id
JOIN doc_types dt ON d.doc_type_id = dt.id
WHERE d.project_id = ? AND t.status = 'published'
");
$stmt->execute([$projectId]);
$docs = $stmt->fetchAll();
if (class_exists('ZipArchive')) {
$zipFile = tempnam(sys_get_temp_dir(), 'pg_md_');
$zip = new ZipArchive();
$zip->open($zipFile, ZipArchive::CREATE | ZipArchive::OVERWRITE);
foreach ($docs as $d) {
$filename = $d['lang'] . '/' . $d['slug'] . '.md';
$md = "# " . $d['title'] . "\n\n" . t('admin.matrix.export.md_stand', ['date' => $d['updated_at']]) . "\n\n" . strip_tags($d['content']);
$zip->addFromString($filename, $md);
}
$zip->close();
header('Content-Type: application/zip');
header('Content-Disposition: attachment; filename="' . preg_replace('/[^a-zA-Z0-9]+/', '_', $project['name']) . '_legal_markdown.zip"');
header('Content-Length: ' . filesize($zipFile));
readfile($zipFile);
@unlink($zipFile);
exit;
} else {
header('Content-Type: text/plain; charset=utf-8');
header('Content-Disposition: attachment; filename="' . preg_replace('/[^a-zA-Z0-9]+/', '_', $project['name']) . '_legal_export.txt"');
foreach ($docs as $d) {
echo "========================================\n";
echo t('admin.matrix.export.txt_document', ['title' => $d['title'], 'lang' => strtoupper($d['lang']), 'slug' => $d['slug']]) . "\n";
echo t('admin.matrix.export.txt_stand', ['date' => $d['updated_at']]) . "\n";
echo "========================================\n\n";
echo strip_tags($d['content']) . "\n\n\n";
}
exit;
}
}
// 2b. Änderungsprotokoll als CSV herunterladen
if (isset($_GET['action']) && $_GET['action'] === 'export_audit_csv') {
if (current_user_is_primary_admin()) {
$stmt = $db->prepare("SELECT * FROM audit_log WHERE project_id = ? OR project_id IS NULL ORDER BY created_at DESC LIMIT 1000");
} else {
$stmt = $db->prepare("SELECT * FROM audit_log WHERE project_id = ? ORDER BY created_at DESC LIMIT 1000");
}
$stmt->execute([$projectId]);
$entries = $stmt->fetchAll();
header('Content-Type: text/csv; charset=utf-8');
header('Content-Disposition: attachment; filename="' . preg_replace('/[^a-zA-Z0-9]+/', '_', $project['name']) . '_protokoll.csv"');
$out = fopen('php://output', 'w');
fputs($out, "\xEF\xBB\xBF");
fputcsv($out, [t('admin.audit.col_time'), t('admin.audit.col_user'), t('admin.audit.col_action'), t('admin.audit.col_project')]);
foreach ($entries as $e) {
fputcsv($out, [csv_safe($e['created_at']), csv_safe($e['user_name']), csv_safe($e['action']), csv_safe($e['project_name'])]);
}
fclose($out);
exit;
}
// 2c. Consent-Nachweise als CSV herunterladen (DSGVO-Prüfbericht)
if (isset($_GET['action']) && $_GET['action'] === 'export_consent_log_csv') {
$stmt = $db->prepare("SELECT * FROM consent_logs WHERE project_id = ? ORDER BY created_at DESC LIMIT 5000");
$stmt->execute([$projectId]);
$entries = $stmt->fetchAll();
header('Content-Type: text/csv; charset=utf-8');
header('Content-Disposition: attachment; filename="' . preg_replace('/[^a-zA-Z0-9]+/', '_', $project['name']) . '_consent_nachweise.csv"');
$out = fopen('php://output', 'w');
fputs($out, "\xEF\xBB\xBF");
fputcsv($out, [
t('admin.consent_log.col_time'), t('admin.consent_log.col_consent_id'), t('admin.consent_log.col_action'),
t('admin.consent_log.col_lang'), t('admin.consent_log.col_ip'), t('admin.consent_log.col_text_hash'), t('admin.consent_log.col_useragent')
]);
foreach ($entries as $e) {
$actionLabel = $e['action'] === 'accepted' ? t('admin.consent_log.action_accepted') : t('admin.consent_log.action_declined');
fputcsv($out, [csv_safe($e['created_at']), csv_safe($e['consent_id']), $actionLabel, csv_safe($e['lang']), csv_safe($e['ip_anonymized']), csv_safe($e['banner_text_hash']), csv_safe($e['user_agent'])]);
}
fclose($out);
exit;
}
// 3. Webhook Test Trigger mit detailliertem Protokoll
if (isset($_POST['action']) && $_POST['action'] === 'test_webhook') {
header('Content-Type: application/json');
$result = dispatch_webhook($project, [
'test' => true,
'message' => t('admin.settings.webhook_test_message'),
'triggered_at' => date('c')
]);
echo json_encode($result);
exit;
}
// 4. SMTP Test-Mail Trigger
if (isset($_POST['action']) && $_POST['action'] === 'test_smtp') {
header('Content-Type: application/json');
$recipient = trim($project['audit_email_recipient'] ?? '') ?: ($project['email'] ?? '');
if (empty($recipient)) {
echo json_encode(['success' => false, 'error' => t('admin.settings.smtp_test_missing_recipient')]);
exit;
}
$html = "<h2>" . htmlspecialchars(t('admin.settings.smtp_test_heading')) . "</h2><p>" . t('admin.settings.smtp_test_body', ['project' => htmlspecialchars($project['name'])]) . "</p>";
$res = send_smtp_mail($project, $recipient, t('admin.settings.smtp_test_subject'), $html);
echo json_encode($res);
exit;
}
// 5. Webhook Logs leeren
if (isset($_POST['action']) && $_POST['action'] === 'clear_webhook_logs') {
$del = $db->prepare("DELETE FROM webhook_logs WHERE project_id = ?");
$del->execute([$projectId]);
header("Location: /admin/settings?project_id=$projectId&msg=logs_cleared");
exit;
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$action = $_POST['action'] ?? '';
// Admin-UI-Sprache des eingeloggten Benutzers speichern
if ($action === 'save_locale') {
$newLocale = $_POST['locale'] ?? '';
if (isset(ui_locales()[$newLocale]) && !empty($_SESSION['paragrafy_user_id'])) {
$upd = $db->prepare("UPDATE users SET locale = ? WHERE id = ?");
$upd->execute([$newLocale, (int)$_SESSION['paragrafy_user_id']]);
$_SESSION['paragrafy_user_locale'] = $newLocale;
}
header("Location: /admin/settings?project_id=$projectId&msg=locale_saved");
exit;
}
// Neues Projekt anlegen
if ($action === 'create_project') {
if (!empty(get_config()['managed_cloud'])) {
header('Location: /admin?msg=managed_cloud_blocked');
exit;
}
$newName = trim($_POST['new_project_name'] ?? '');
$newDomain = trim($_POST['new_project_domain'] ?? '');
$newLang = trim($_POST['new_primary_lang'] ?? 'de');
$newColor = trim($_POST['new_brand_color'] ?? '#F0A63C');
if (!str_starts_with($newColor, '#')) $newColor = '#' . $newColor;
$projectLimit = get_project_limit();
if ($projectLimit !== null && count($projects) >= $projectLimit) {
header("Location: /admin?msg=project_limit_reached");
exit;
}
if (!empty($newName) && !empty($newDomain)) {
$stmt = $db->prepare("INSERT INTO projects (name, domain, brand_color, primary_lang, active_languages) VALUES (?, ?, ?, ?, 'de,en')");
$stmt->execute([$newName, $newDomain, $newColor, $newLang]);
$newProjectId = (int)$db->lastInsertId();
$docTypes = $db->query("SELECT id FROM doc_types")->fetchAll();
foreach ($docTypes as $dt) {
$insDoc = $db->prepare("INSERT INTO documents (project_id, doc_type_id) VALUES (?, ?)");
$insDoc->execute([$newProjectId, $dt['id']]);
}
log_audit($newProjectId, $newName, t('admin.common.audit.project_created'));
header("Location: /admin?project_id=$newProjectId&msg=project_created");
exit;
}
}
// Projekt löschen
if ($action === 'delete_project') {
$delId = (int)$_POST['delete_project_id'];
if (count($projects) > 1 && in_array($delId, $accessibleProjectIds, true)) {
$delName = '';
foreach ($projects as $p) { if ((int)$p['id'] === $delId) { $delName = $p['name']; break; } }
$stmt = $db->prepare("DELETE FROM projects WHERE id = ?");
$stmt->execute([$delId]);
log_audit(null, $delName, t('admin.common.audit.project_deleted'));
header("Location: /admin?msg=project_deleted");
exit;
}
}
// Dokumenttypen sind instanzweit (gelten fuer alle Projekte/Mandanten) -- nur der primaere
// Admin darf sie anlegen/aendern/loeschen, sonst koennte ein auf ein Projekt beschraenkter
// Multi-User die Dokumentstruktur aller anderen Mandanten manipulieren.
if (in_array($action, ['toggle_required', 'create_doc_type', 'delete_doc_type'], true) && !current_user_is_primary_admin()) {
http_response_code(403);
echo htmlspecialchars(t('admin.common.access_denied'));
exit;
}
// AJAX / Post Toggle für Pflichtstatus
if ($action === 'toggle_required') {
$typeId = (int)$_POST['doc_type_id'];
$stmt = $db->prepare("UPDATE doc_types SET is_required = CASE WHEN is_required = 1 THEN 0 ELSE 1 END WHERE id = ?");
$stmt->execute([$typeId]);
if (!empty($_SERVER['HTTP_X_REQUESTED_WITH'])) {
header('Content-Type: application/json');
$stmtNew = $db->prepare("SELECT is_required FROM doc_types WHERE id = ?");
$stmtNew->execute([$typeId]);
echo json_encode(['success' => true, 'is_required' => (int)$stmtNew->fetchColumn()]);
exit;
}
header("Location: /admin?project_id=$projectId&msg=toggled");
exit;
}
// Die Projekt-Einstellungsseite besteht aus mehreren unabhaengigen Formularen (Allgemein,
// Cookie-Banner, Consent-Log, E-Mail/SMTP, Webhook/API-Keys, Firma). Jedes Formular hat einen
// eigenen action-Wert und aktualisiert NUR seine eigenen Spalten -- frueher teilten sich alle
// Formulare einen gemeinsamen 'save_project'-Handler mit einem Riesen-UPDATE ueber alle Spalten,
// wofuer jedes Formular smtp_host, brand_color usw. der jeweils anderen Tabs als hidden-Input
// mitschicken musste. Diese hidden-Werte wurden beim Seiten-Rendern eingefroren, sodass das
// Speichern eines Tabs (z. B. Webhook) unabsichtlich Aenderungen aus einem anderen, gerade erst
// gespeicherten Tab (z. B. brand_color) wieder auf den alten Stand zuruecksetzte.
if (in_array($action, ['save_general', 'save_cookie_banner', 'save_consent_log', 'save_email', 'save_webhook', 'save_company'], true)) {
// settings_updated_at wird bewusst nicht per CURRENT_TIMESTAMP gesetzt, sondern strikt
// hochgezaehlt (+1s statt Gleichstand), damit Last-Modified/If-Modified-Since bei zwei
// Aenderungen innerhalb derselben Sekunde nicht auf denselben Wert kollabiert -- siehe
// cache.php (build_public_last_modified) und update_project_company_fields() in db.php,
// die dasselbe Muster fahren.
$touchSql = "settings_updated_at=CASE WHEN datetime('now') > settings_updated_at THEN datetime('now') ELSE datetime(settings_updated_at, '+1 second') END, settings_version=settings_version + 1";
$auditName = $project['name'];
if ($action === 'save_general') {
$activeLangs = implode(',', array_filter(array_map('trim', explode(',', $_POST['active_languages'] ?? 'de,en'))));
$brandColor = trim($_POST['brand_color'] ?? '#F0A63C');
if (!str_starts_with($brandColor, '#')) {
$brandColor = '#' . $brandColor;
}
$logoUrl = trim($_POST['logo_url'] ?? '');
$auditMonths = max(1, (int)($_POST['audit_interval_months'] ?? 12));
$isLockedInstance = !empty(get_config()['managed_cloud']) || !empty(get_config()['is_demo']);
$domainToSave = $isLockedInstance ? $project['domain'] : $_POST['domain'];
$stmt = $db->prepare("
UPDATE projects SET
name=?, domain=?, brand_color=?, primary_lang=?, active_languages=?, logo_url=?, audit_interval_months=?,
$touchSql
WHERE id=?
");
$stmt->execute([
$_POST['name'], $domainToSave, $brandColor, $_POST['primary_lang'], $activeLangs, $logoUrl, $auditMonths,
$projectId
]);
$auditName = $_POST['name'];
} elseif ($action === 'save_cookie_banner') {
$cookieBanner = !empty($_POST['cookie_banner_enabled']) ? 1 : 0;
$bannerMap = [];
foreach (ui_locales() as $code => $meta) {
$text = trim($_POST['cookie_banner_text'][$code] ?? '');
if ($text !== '') {
$bannerMap[$code] = $text;
}
}
$cookieBannerText = $bannerMap ? json_encode($bannerMap, JSON_UNESCAPED_UNICODE) : '';
$stmt = $db->prepare("UPDATE projects SET cookie_banner_enabled=?, cookie_banner_text=?, $touchSql WHERE id=?");
$stmt->execute([$cookieBanner, $cookieBannerText, $projectId]);
} elseif ($action === 'save_consent_log') {
$consentLogging = !empty($_POST['consent_logging_enabled']) ? 1 : 0;
$consentLogRetentionDays = max(0, (int)($_POST['consent_log_retention_days'] ?? 1095));
$stmt = $db->prepare("UPDATE projects SET consent_logging_enabled=?, consent_log_retention_days=?, $touchSql WHERE id=?");
$stmt->execute([$consentLogging, $consentLogRetentionDays, $projectId]);
} elseif ($action === 'save_email') {
$smtpHost = trim($_POST['smtp_host'] ?? '');
$smtpPort = (int)($_POST['smtp_port'] ?? 587);
$smtpUser = trim($_POST['smtp_user'] ?? '');
// Secret-Felder werden im Formular nie mit ihrem echten Wert vorbefuellt (siehe Rendering
// weiter unten) -- ein leer abgeschicktes Feld heisst also "unveraendert lassen", nicht
// "loeschen", sonst wuerde jedes Speichern ohne Neueingabe die Secrets wegloeschen.
$smtpPass = trim($_POST['smtp_pass'] ?? '') ?: (string)($project['smtp_pass'] ?? '');
$smtpSecure = trim($_POST['smtp_secure'] ?? 'tls');
$smtpFrom = trim($_POST['smtp_from'] ?? '');
$auditRecipient = trim($_POST['audit_email_recipient'] ?? '');
$stmt = $db->prepare("
UPDATE projects SET
smtp_host=?, smtp_port=?, smtp_user=?, smtp_pass=?, smtp_secure=?, smtp_from=?, audit_email_recipient=?,
$touchSql
WHERE id=?
");
$stmt->execute([$smtpHost, $smtpPort, $smtpUser, $smtpPass, $smtpSecure, $smtpFrom, $auditRecipient, $projectId]);
} elseif ($action === 'save_webhook') {
$webhookUrl = trim($_POST['webhook_url'] ?? '');
$webhookSecret = trim($_POST['webhook_secret'] ?? '') ?: (string)($project['webhook_secret'] ?? '');
$deeplKey = trim($_POST['deepl_api_key'] ?? '') ?: (string)($project['deepl_api_key'] ?? '');
$aiProvider = in_array($_POST['ai_provider'] ?? '', ['claude', 'openai'], true) ? $_POST['ai_provider'] : '';
$aiApiKey = trim($_POST['ai_api_key'] ?? '') ?: (string)($project['ai_api_key'] ?? '');
$stmt = $db->prepare("
UPDATE projects SET
webhook_url=?, webhook_secret=?, deepl_api_key=?, ai_provider=?, ai_api_key=?,
$touchSql
WHERE id=?
");
$stmt->execute([$webhookUrl, $webhookSecret, $deeplKey, $aiProvider, $aiApiKey, $projectId]);
} elseif ($action === 'save_company') {
$stmt = $db->prepare("
UPDATE projects SET
company_name=?, address=?, email=?, phone=?, representative=?, register_info=?,
$touchSql
WHERE id=?
");
$stmt->execute([
$_POST['company_name'], $_POST['address'], $_POST['email'], $_POST['phone'], $_POST['representative'], $_POST['register_info'],
$projectId
]);
}
log_audit($projectId, $auditName, t('admin.common.audit.settings_updated'));
header("Location: /admin/settings?project_id=$projectId&msg=saved");
exit;
}
if ($action === 'create_doc_type') {
$title = trim($_POST['doc_title'] ?? '');
$slug = trim($_POST['doc_slug'] ?? '');
$isReq = !empty($_POST['is_required']) ? 1 : 0;
if ($slug === '' && $title !== '') {
$slug = strtolower(preg_replace('/[^a-zA-Z0-9]+/', '-', $title));
}
if ($title !== '' && $slug !== '') {
$stmt = $db->prepare("INSERT INTO doc_types (title, slug, is_required) VALUES (?, ?, ?)");
$stmt->execute([$title, $slug, $isReq]);
$newTypeId = (int)$db->lastInsertId();
foreach ($projects as $p) {
$docStmt = $db->prepare("INSERT INTO documents (project_id, doc_type_id) VALUES (?, ?)");
$docStmt->execute([$p['id'], $newTypeId]);
}
log_audit(null, '', t('admin.matrix.audit.doctype_created', ['title' => $title]));
}
header("Location: /admin?project_id=$projectId&msg=type_created");
exit;
}
if ($action === 'delete_doc_type') {
$typeId = (int)$_POST['doc_type_id'];
$typeTitleStmt = $db->prepare("SELECT title FROM doc_types WHERE id = ?");
$typeTitleStmt->execute([$typeId]);
$typeTitle = (string)($typeTitleStmt->fetchColumn() ?: '');
$stmt = $db->prepare("DELETE FROM doc_types WHERE id = ?");
$stmt->execute([$typeId]);
log_audit(null, '', t('admin.matrix.audit.doctype_deleted', ['title' => $typeTitle]));
header("Location: /admin?project_id=$projectId&msg=type_deleted");
exit;
}
// Nutzerverwaltung ist ausschliesslich dem primaeren Admin-Login vorbehalten -- ein
// ueber die users-Tabelle eingeloggter Benutzer darf nie selbst Benutzer verwalten.
if (in_array($action, ['invite_user', 'resend_invite', 'delete_user', 'update_user_projects'], true) && !current_user_is_primary_admin()) {
http_response_code(403);
echo htmlspecialchars(t('admin.common.access_denied'));
exit;
}
// Benutzer einladen
if ($action === 'invite_user') {
if (!empty(get_config()['managed_cloud'])) {
header('Location: /admin/users?msg=managed_cloud_blocked');
exit;
}
$name = trim($_POST['invite_name'] ?? '');
$email = trim(strtolower($_POST['invite_email'] ?? ''));
if ($name === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
header("Location: /admin/users?msg=invalid");
exit;
}
$chk = $db->prepare("SELECT id FROM users WHERE email = ?");
$chk->execute([$email]);
if ($chk->fetch()) {
header("Location: /admin/users?msg=email_exists");
exit;
}
$token = bin2hex(random_bytes(32));
$expiresAt = date('Y-m-d H:i:s', strtotime('+7 days'));
$ins = $db->prepare("INSERT INTO users (name, email, status, invite_token, invite_token_expires_at) VALUES (?, ?, 'invited', ?, ?)");
$ins->execute([$name, $email, $token, $expiresAt]);
log_audit(null, '', t('admin.users.audit.invited', ['name' => $name, 'email' => $email]));
$res = send_invite_mail($project, $name, $email, $token);
header("Location: /admin/users?msg=" . ($res['success'] ? 'invited' : 'invite_mail_failed'));
exit;
}
// Einladung erneut senden
if ($action === 'resend_invite') {
$uid = (int)($_POST['user_id'] ?? 0);
$stmt = $db->prepare("SELECT * FROM users WHERE id = ? AND status = 'invited'");
$stmt->execute([$uid]);
$u = $stmt->fetch();
if ($u) {
$token = bin2hex(random_bytes(32));
$expiresAt = date('Y-m-d H:i:s', strtotime('+7 days'));
$upd = $db->prepare("UPDATE users SET invite_token = ?, invite_token_expires_at = ? WHERE id = ?");
$upd->execute([$token, $expiresAt, $uid]);
$res = send_invite_mail($project, $u['name'], $u['email'], $token);
header("Location: /admin/users?msg=" . ($res['success'] ? 'invited' : 'invite_mail_failed'));
exit;
}
header("Location: /admin/users");
exit;
}
// Benutzer entfernen
if ($action === 'delete_user') {
$uid = (int)($_POST['user_id'] ?? 0);
if ($uid !== (int)($_SESSION['paragrafy_user_id'] ?? 0)) {
$delUserNameStmt = $db->prepare("SELECT name FROM users WHERE id = ?");
$delUserNameStmt->execute([$uid]);
$delUserName = (string)($delUserNameStmt->fetchColumn() ?: '');
$del = $db->prepare("DELETE FROM users WHERE id = ?");
$del->execute([$uid]);
log_audit(null, '', t('admin.users.audit.deleted', ['name' => $delUserName]));
}
header("Location: /admin/users?msg=user_deleted");
exit;
}
// Projekt-Zuordnung eines Benutzers speichern (Berechtigungsmatrix)
if ($action === 'update_user_projects') {
$uid = (int)($_POST['user_id'] ?? 0);
$projectIds = array_map('intval', $_POST['project_ids'] ?? []);
$userRow = $db->prepare("SELECT name FROM users WHERE id = ?");
$userRow->execute([$uid]);
$uName = (string)($userRow->fetchColumn() ?: '');
if ($uid > 0 && $uName !== '') {
$db->prepare("DELETE FROM user_projects WHERE user_id = ?")->execute([$uid]);
if (!empty($projectIds)) {
$insUp = $db->prepare("INSERT INTO user_projects (user_id, project_id) VALUES (?, ?)");
foreach (array_unique($projectIds) as $pid) {
$insUp->execute([$uid, $pid]);
}
log_audit(null, '', t('admin.users.audit.access_restricted', ['name' => $uName, 'count' => count(array_unique($projectIds))]));
} else {
log_audit(null, '', t('admin.users.audit.access_unrestricted', ['name' => $uName]));
}
}
header("Location: /admin/users?msg=access_updated");
exit;
}
}
function send_invite_mail(array $project, string $name, string $email, string $token): array {
$scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
$host = $_SERVER['HTTP_HOST'] ?? $project['domain'];
$inviteLink = $scheme . '://' . $host . '/admin/accept-invite?token=' . $token;
$html = "<h2>" . htmlspecialchars(t('admin.login.invite_mail_heading')) . "</h2>"
. "<p>" . htmlspecialchars(t('admin.login.invite_mail_greeting', ['name' => $name])) . "</p>"
. "<p>" . htmlspecialchars(t('admin.login.invite_mail_body')) . "</p>"
. "<p><a href='" . htmlspecialchars($inviteLink) . "' style='background:#F0A63C;color:#fff;padding:0.6rem 1.2rem;border-radius:6px;text-decoration:none;display:inline-block;font-weight:bold;'>" . htmlspecialchars(t('admin.login.invite_mail_button')) . "</a></p>"
. "<p>" . htmlspecialchars(t('admin.login.invite_mail_link_hint')) . "<br>" . htmlspecialchars($inviteLink) . "</p>";
return send_smtp_mail($project, $email, t('admin.login.invite_mail_subject'), $html);
}
function handle_accept_invite(PDO $db): void {
$token = trim($_GET['token'] ?? $_POST['token'] ?? '');
$stmt = $db->prepare("SELECT * FROM users WHERE invite_token = ? AND invite_token != '' AND status = 'invited' AND (invite_token_expires_at IS NULL OR invite_token_expires_at > CURRENT_TIMESTAMP)");
$stmt->execute([$token]);
$user = $stmt->fetch();
$error = null;
if ($user && isset($_POST['action']) && $_POST['action'] === 'set_password') {
$pass = $_POST['password'] ?? '';
$confirm = $_POST['password_confirm'] ?? '';
if (strlen($pass) < 8) {
$error = t('admin.login.password_too_short');
} elseif ($pass !== $confirm) {
$error = t('admin.login.passwords_mismatch');
} else {
$upd = $db->prepare("UPDATE users SET password_hash = ?, status = 'active', invite_token = '', activated_at = CURRENT_TIMESTAMP WHERE id = ?");
$upd->execute([password_hash($pass, PASSWORD_DEFAULT), $user['id']]);
session_regenerate_id(true);
$_SESSION['paragrafy_admin'] = true;
$_SESSION['paragrafy_user_id'] = (int)$user['id'];
$_SESSION['paragrafy_user_name'] = $user['name'];
$_SESSION['paragrafy_user_email'] = $user['email'];
header('Location: /admin');
exit;
}
}
render_accept_invite_view($user, $error);
}
function render_accept_invite_view(?array $user, ?string $error): void {
?>
<!DOCTYPE html>
<html lang="<?= htmlspecialchars(current_locale()) ?>">
<head>
<meta charset="utf-8"><title><?= htmlspecialchars(t('admin.login.accept_invite.page_title')) ?></title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/svg+xml" href="/paragrafy.svg">
<?= theme_head_tags_admin() ?>
<?= theme_base_css_admin() ?>
<style>
body { display: flex; flex-direction: column; min-height: 100vh; align-items: center; justify-content: center; gap: 20px; }
.login-card { background: var(--card); padding: 2.25rem; border-radius: var(--radius); width: 360px; box-shadow: none; border: 1px solid var(--border); }
.logo-header { display: flex; align-items: center; gap: 0.7rem; margin-bottom: 1.4rem; }
.logo-header img { width: 34px; height: 34px; border-radius: var(--radius); }
.logo-header h2 { margin: 0; font-size: 1.3rem; font-weight: 800; }
.err { color: var(--red); font-size: 0.8125rem; margin-bottom: 0.5rem; }
</style>
</head>
<body>
<div class="login-card">
<div class="logo-header">
<img src="/paragrafy.svg" alt="Paragrafy">
<h2><?= htmlspecialchars(t('admin.login.accept_invite.heading')) ?></h2>
</div>
<?php if (!$user): ?>
<p style="font-size:13px;color:var(--text-muted)"><?= htmlspecialchars(t('admin.login.accept_invite.invalid_token')) ?></p>
<?php else: ?>
<p style="font-size:13px;color:var(--text-muted);margin:0 0 6px"><?= t('admin.login.accept_invite.welcome', ['name' => '<strong style="color:var(--text)">' . htmlspecialchars($user['name']) . '</strong>', 'email' => '<strong style="color:var(--text)">' . htmlspecialchars($user['email']) . '</strong>']) ?></p>
<?php if ($error): ?><div class="err"><?= htmlspecialchars($error) ?></div><?php endif; ?>
<form method="post">
<input type="hidden" name="action" value="set_password">
<input type="hidden" name="token" value="<?= htmlspecialchars($_GET['token'] ?? '') ?>">
<label class="pg-label" style="margin-top:0;"><?= htmlspecialchars(t('admin.login.accept_invite.password_label')) ?></label>
<input type="password" name="password" required style="width:100%;margin-bottom:10px;">
<label class="pg-label" style="margin-top:0;"><?= htmlspecialchars(t('admin.login.accept_invite.password_confirm_label')) ?></label>
<input type="password" name="password_confirm" required style="width:100%;margin-bottom:1rem;">
<button type="submit" class="pg-btn" style="width:100%;justify-content:center;"><?= t('admin.login.accept_invite.submit_button') ?></button>
</form>
<?php endif; ?>
</div>
</body>
</html>
<?php
}
function handle_forgot_password(PDO $db): void {
$sent = false;
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$email = trim(strtolower($_POST['email'] ?? ''));
if ($email !== '') {
$stmt = $db->prepare("SELECT * FROM users WHERE email = ? AND status = 'active'");
$stmt->execute([$email]);
$user = $stmt->fetch();
if ($user) {
$token = bin2hex(random_bytes(32));
$expiresAt = date('Y-m-d H:i:s', strtotime('+1 hour'));
$upd = $db->prepare("UPDATE users SET invite_token = ?, invite_token_expires_at = ? WHERE id = ?");
$upd->execute([$token, $expiresAt, $user['id']]);
$project = $db->query("SELECT * FROM projects ORDER BY id ASC LIMIT 1")->fetch();
if ($project) {
$scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
$host = $_SERVER['HTTP_HOST'] ?? $project['domain'];
$resetLink = $scheme . '://' . $host . '/admin/reset-password?token=' . $token;
$html = "<h2>" . htmlspecialchars(t('admin.login.forgot.mail_heading')) . "</h2>"
. "<p>" . htmlspecialchars(t('admin.login.forgot.mail_greeting', ['name' => $user['name']])) . "</p>"
. "<p>" . htmlspecialchars(t('admin.login.forgot.mail_body')) . "</p>"
. "<p><a href='" . htmlspecialchars($resetLink) . "' style='background:#F0A63C;color:#fff;padding:0.6rem 1.2rem;border-radius:6px;text-decoration:none;display:inline-block;font-weight:bold;'>" . htmlspecialchars(t('admin.login.forgot.mail_button')) . "</a></p>"
. "<p>" . htmlspecialchars(t('admin.login.forgot.mail_ignore_hint')) . "</p>";
send_smtp_mail($project, $user['email'], t('admin.login.forgot.mail_subject'), $html);
}
}
}
$sent = true;
}
render_forgot_password_view($sent);
}
function render_forgot_password_view(bool $sent): void {
?>
<!DOCTYPE html>
<html lang="<?= htmlspecialchars(current_locale()) ?>">
<head>
<meta charset="utf-8"><title><?= htmlspecialchars(t('admin.login.forgot.page_title')) ?></title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/svg+xml" href="/paragrafy.svg">
<?= theme_head_tags_admin() ?>
<?= theme_base_css_admin() ?>
<style>
body { display: flex; flex-direction: column; min-height: 100vh; align-items: center; justify-content: center; gap: 20px; }
.login-card { background: var(--card); padding: 2.25rem; border-radius: var(--radius); width: 360px; box-shadow: none; border: 1px solid var(--border); }
.logo-header { display: flex; align-items: center; gap: 0.7rem; margin-bottom: 1.4rem; }
.logo-header img { width: 34px; height: 34px; border-radius: var(--radius); }
.logo-header h2 { margin: 0; font-size: 1.3rem; font-weight: 800; }
</style>
</head>
<body>
<div class="login-card">
<div class="logo-header">
<img src="/paragrafy.svg" alt="Paragrafy">
<h2><?= htmlspecialchars(t('admin.login.forgot.heading')) ?></h2>
</div>
<?php if ($sent): ?>
<p style="font-size:13px;color:var(--text-muted)"><?= htmlspecialchars(t('admin.login.forgot.sent_notice')) ?></p>
<div style="text-align:center;margin-top:14px">
<a href="/admin" style="font-size:12.5px;color:var(--text-faint)"><?= t('admin.login.forgot.back_to_login') ?></a>
</div>
<?php else: ?>
<p style="font-size:13px;color:var(--text-muted);margin:0 0 6px"><?= htmlspecialchars(t('admin.login.forgot.intro')) ?></p>
<form method="post">
<label class="pg-label" style="margin-top:0;"><?= htmlspecialchars(t('admin.login.forgot.email_label')) ?></label>
<input type="email" name="email" placeholder="<?= htmlspecialchars(t('admin.login.email_placeholder')) ?>" required autofocus style="width:100%;margin-bottom:1rem;">
<button type="submit" class="pg-btn" style="width:100%;justify-content:center;"><?= t('admin.login.forgot.submit_button') ?></button>
</form>
<div style="text-align:center;margin-top:14px">
<a href="/admin" style="font-size:12.5px;color:var(--text-faint)"><?= t('admin.login.forgot.back_to_login') ?></a>
</div>
<?php endif; ?>
</div>
</body>
</html>
<?php
}
function handle_reset_password(PDO $db): void {
$token = trim($_GET['token'] ?? $_POST['token'] ?? '');
$stmt = $db->prepare("SELECT * FROM users WHERE invite_token = ? AND invite_token != '' AND status = 'active' AND (invite_token_expires_at IS NULL OR invite_token_expires_at > CURRENT_TIMESTAMP)");
$stmt->execute([$token]);
$user = $stmt->fetch();
$error = null;
if ($user && isset($_POST['action']) && $_POST['action'] === 'set_new_password') {
$pass = $_POST['password'] ?? '';
$confirm = $_POST['password_confirm'] ?? '';
if (strlen($pass) < 8) {
$error = t('admin.login.password_too_short');
} elseif ($pass !== $confirm) {
$error = t('admin.login.passwords_mismatch');
} else {
$upd = $db->prepare("UPDATE users SET password_hash = ?, invite_token = '' WHERE id = ?");
$upd->execute([password_hash($pass, PASSWORD_DEFAULT), $user['id']]);
log_audit(null, '', t('admin.login.reset.audit_note', ['name' => $user['name']]));
// Ein neues Passwort ersetzt nicht den zweiten Faktor: TOTP-Nutzer muessen nach dem
// Reset genauso den Code eingeben wie beim normalen Login (siehe totp_pending-Handling
// oben in der action=login-Verzweigung), sonst waere ein abgefangener Reset-Token
// allein ausreichend, um TOTP komplett zu umgehen.
if (!empty($user['totp_enabled_at'])) {
$_SESSION['totp_pending'] = ['type' => 'user', 'user_id' => (int)$user['id'], 'started_at' => time()];
} else {
finalize_user_session($user);
}
header('Location: /admin');
exit;
}
}
render_reset_password_view($user, $error);
}
function render_reset_password_view(?array $user, ?string $error): void {
?>
<!DOCTYPE html>
<html lang="<?= htmlspecialchars(current_locale()) ?>">
<head>
<meta charset="utf-8"><title><?= htmlspecialchars(t('admin.login.reset.page_title')) ?></title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/svg+xml" href="/paragrafy.svg">
<?= theme_head_tags_admin() ?>
<?= theme_base_css_admin() ?>
<style>
body { display: flex; flex-direction: column; min-height: 100vh; align-items: center; justify-content: center; gap: 20px; }
.login-card { background: var(--card); padding: 2.25rem; border-radius: var(--radius); width: 360px; box-shadow: none; border: 1px solid var(--border); }
.logo-header { display: flex; align-items: center; gap: 0.7rem; margin-bottom: 1.4rem; }
.logo-header img { width: 34px; height: 34px; border-radius: var(--radius); }
.logo-header h2 { margin: 0; font-size: 1.3rem; font-weight: 800; }
.err { color: var(--red); font-size: 0.8125rem; margin-bottom: 0.5rem; }
</style>
</head>
<body>
<div class="login-card">
<div class="logo-header">
<img src="/paragrafy.svg" alt="Paragrafy">
<h2><?= htmlspecialchars(t('admin.login.reset.heading')) ?></h2>
</div>
<?php if (!$user): ?>
<p style="font-size:13px;color:var(--text-muted)"><?= htmlspecialchars(t('admin.login.reset.invalid_link')) ?></p>
<div style="text-align:center;margin-top:14px">
<a href="/admin/forgot-password" style="font-size:12.5px;color:var(--text-faint)"><?= t('admin.login.reset.request_new_link') ?></a>
</div>
<?php else: ?>
<p style="font-size:13px;color:var(--text-muted);margin:0 0 6px"><?= t('admin.login.reset.intro', ['email' => '<strong style="color:var(--text)">' . htmlspecialchars($user['email']) . '</strong>']) ?></p>
<?php if ($error): ?><div class="err"><?= htmlspecialchars($error) ?></div><?php endif; ?>
<form method="post">
<input type="hidden" name="action" value="set_new_password">
<input type="hidden" name="token" value="<?= htmlspecialchars($_GET['token'] ?? '') ?>">
<label class="pg-label" style="margin-top:0;"><?= htmlspecialchars(t('admin.login.reset.password_label')) ?></label>
<input type="password" name="password" required style="width:100%;margin-bottom:10px;">
<label class="pg-label" style="margin-top:0;"><?= htmlspecialchars(t('admin.login.reset.password_confirm_label')) ?></label>
<input type="password" name="password_confirm" required style="width:100%;margin-bottom:1rem;">
<button type="submit" class="pg-btn" style="width:100%;justify-content:center;"><?= t('admin.login.reset.submit_button') ?></button>
</form>
<?php endif; ?>
</div>
</body>
</html>
<?php
}
function handle_sso_login(array $config): void {
$ssoSecret = $config['sso_secret'] ?? '';
if ($ssoSecret === '') {
header('Location: /admin');
return;
}
$token = $_GET['token'] ?? '';
$parts = explode('.', $token);
if (count($parts) !== 2 || $parts[0] === '' || $parts[1] === '') {
header('Location: /admin');
return;
}
[$payloadB64Url, $signature] = $parts;
$expectedSignature = hash_hmac('sha256', $payloadB64Url, $ssoSecret);
if (!hash_equals($expectedSignature, $signature)) {
header('Location: /admin');
return;
}
$base64 = strtr($payloadB64Url, '-_', '+/');
$padded = $base64 . str_repeat('=', (4 - strlen($base64) % 4) % 4);
$json = base64_decode($padded, true);
$payload = $json === false ? null : json_decode($json, true);
if (!is_array($payload) || !isset($payload['exp']) || !is_int($payload['exp']) || !isset($payload['n']) || !is_string($payload['n']) || $payload['n'] === '') {
header('Location: /admin');
return;
}
if ($payload['exp'] < time()) {
header('Location: /admin');
return;
}
// Signatur und Ablauf sind bereits geprueft -- ab hier ist das Token
// "echt" und darf die Nonce-Tabelle beruehren. Die Reihenfolge ist
// wichtig: wuerde die Nonce-Pruefung vor der Signaturpruefung laufen,
// koennte ein beliebiges, nicht signiertes Token die Tabelle befuellen
// (kleiner DoS-Vektor).
$db = get_db();
try {
$db->prepare('INSERT INTO sso_nonces (nonce) VALUES (?)')->execute([$payload['n']]);
} catch (\PDOException $e) {
// UNIQUE-Constraint-Verletzung (SQLite Code 19) = Nonce wurde bereits
// eingeloest -- Replay ablehnen. Das INSERT ist selbst der atomare
// "pruefen + als benutzt markieren"-Schritt, SQLite serialisiert
// Writes ohnehin, kein zusaetzliches Locking noetig.
http_response_code(403);
exit(t('admin.sso.token_already_used'));
}
// Gelegentliches, beilaeufiges Aufraeumen abgelaufener Nonces -- diese
// sind laengst nicht mehr einloesbar, die Zeile dient nur noch der
// Replay-Erkennung waehrend der TTL. Retention ist unkritisch (keine
// personenbezogenen Daten, nur Zufallsstrings + Zeitstempel).
if (random_int(1, 20) === 1) {
try {
$db->exec("DELETE FROM sso_nonces WHERE used_at < datetime('now', '-1 hour')");
} catch (\PDOException $e) {
}
}
session_regenerate_id(true);
$_SESSION['paragrafy_admin'] = true;
$_SESSION['paragrafy_user_name'] = 'Admin';
unset($_SESSION['paragrafy_user_id'], $_SESSION['paragrafy_user_email']);
$projectId = (int)($_GET['project_id'] ?? 0);
header('Location: /admin' . ($projectId > 0 ? '?project_id=' . $projectId : ''));
exit;
}
function finalize_user_session(array $user, ?string $explicitLocale = null): void {
session_regenerate_id(true);
$_SESSION['paragrafy_admin'] = true;
$_SESSION['paragrafy_user_id'] = (int)$user['id'];
$_SESSION['paragrafy_user_name'] = $user['name'];
$_SESSION['paragrafy_user_email'] = $user['email'];
// Eine Sprache, die man gerade erst auf dem Login-Bildschirm gewaehlt hat, soll den Login
// ueberleben statt sofort von der gespeicherten Account-Praeferenz ueberschrieben zu werden --
// current_locale() gibt der Session-Praeferenz sonst immer Vorrang. Bewusst $_GET['locale'] aus
// DIESEM Request (als Default, falls $explicitLocale nicht mitgegeben wird) statt des
// paragrafy_locale-Cookies: das Cookie lebt 30 Tage und wuerde sonst auch Monate spaeter noch
// jede frisch in den Einstellungen gespeicherte Account-Praeferenz beim naechsten Login
// stillschweigend zurueckdrehen. $explicitLocale existiert fuer den TOTP-Zwischenschritt: dort
// greift der finale POST erst nach dem Redirect zur TOTP-Seite, der kein ?locale= mehr traegt,
// daher wird die Wahl dort ueber $_SESSION['totp_pending']['locale'] durchgereicht.
$known = array_keys(ui_locales());
$justChosen = $explicitLocale ?? (string)($_GET['locale'] ?? '');
$_SESSION['paragrafy_user_locale'] = in_array($justChosen, $known, true) ? $justChosen : ($user['locale'] ?? 'de');
}
function finalize_admin_session(): void {
session_regenerate_id(true);
$_SESSION['paragrafy_admin'] = true;
$_SESSION['paragrafy_user_name'] = 'Admin';
unset($_SESSION['paragrafy_user_id'], $_SESSION['paragrafy_user_email'], $_SESSION['paragrafy_user_locale']);
}
/**
* Second step of the login flow once a user's or the admin's password has
* already been verified and totp_pending was stashed in the session. Tries
* the 6-digit TOTP code first, falls back to a recovery code. Uses the same
* rate_limit_wait()/login_attempts machinery as the password step, under a
* "totp:"-prefixed identifier so a flood of bad codes can't be used to
* bypass the password throttle (and vice versa).
*/
function handle_totp_verify(PDO $db): ?string {
$pending = $_SESSION['totp_pending'] ?? null;
if (!is_array($pending) || ($pending['started_at'] ?? 0) < time() - 300) {
unset($_SESSION['totp_pending']);
header('Location: /admin');
exit;
}
$clientIp = get_client_ip();
$type = $pending['type'] ?? '';
$acctIdentifier = $type === 'user' ? ('totp:acct:user:' . (int)($pending['user_id'] ?? 0)) : 'totp:acct:admin';
$waitSeconds = max(
rate_limit_wait($db, 'totp:' . $clientIp, LOGIN_MAX_ATTEMPTS, LOGIN_WINDOW_MINUTES),
rate_limit_wait($db, $acctIdentifier, LOGIN_MAX_ATTEMPTS, LOGIN_WINDOW_MINUTES)
);
if ($waitSeconds > 0) {
return t('admin.login.rate_limited', ['minutes' => (int)ceil($waitSeconds / 60)]);
}
$input = trim($_POST['totp_code'] ?? '');
$success = false;
if ($type === 'user') {
$stmt = $db->prepare("SELECT * FROM users WHERE id = ? AND status = 'active'");
$stmt->execute([(int)($pending['user_id'] ?? 0)]);
$user = $stmt->fetch();
if ($user) {
$success = totp_finish_user_login($db, $user, $input, $pending['locale'] ?? null);
}
} elseif ($type === 'admin' && admin_totp_available()) {
$success = totp_finish_admin_login($input);
}
if ($success) {
clear_login_failures($db, $clientIp);
clear_login_failures($db, $acctIdentifier);
unset($_SESSION['totp_pending']);
header('Location: /admin');
exit;
}
record_login_failure($db, $clientIp);
record_login_failure($db, $acctIdentifier);
return t('admin.login.totp_invalid');
}
function totp_finish_user_login(PDO $db, array $user, string $input, ?string $pendingLocale = null): bool {
if (totp_consume_for_user_login($db, $user, $input)) {
finalize_user_session($user, $pendingLocale);
return true;
}
return false;
}
function totp_finish_admin_login(string $input): bool {
if (totp_consume_for_admin_login($input)) {
finalize_admin_session();
return true;
}
return false;
}
// TOTP Self-Service (/admin/security) -- gilt fuer den eingeloggten Account
// (regulaerer User oder, nur self-hosted, der primaere Admin). totp_current_identity()
// liefert null, wenn TOTP hier gar nicht angeboten wird (Admin auf Managed Cloud).
if (isset($_POST['action']) && $_POST['action'] === 'totp_setup_start') {
$identity = totp_current_identity($db);
if ($identity !== null && !totp_identity_enabled($identity) && totp_vendor_available()) {
$_SESSION['totp_setup'] = ['secret' => totp_generate_secret()];
}
header("Location: /admin/security?project_id=$projectId");
exit;
}
if (isset($_POST['action']) && $_POST['action'] === 'totp_setup_cancel') {
unset($_SESSION['totp_setup']);
header("Location: /admin/security?project_id=$projectId");
exit;
}
if (isset($_POST['action']) && $_POST['action'] === 'totp_setup_confirm') {
$identity = totp_current_identity($db);
$pendingSecret = $_SESSION['totp_setup']['secret'] ?? null;
$code = trim($_POST['totp_code'] ?? '');
if ($identity === null || totp_identity_enabled($identity) || !is_string($pendingSecret)) {
header("Location: /admin/security?project_id=$projectId");
exit;
}
if (totp_verify_and_consume($pendingSecret, $code, null) === null) {
header("Location: /admin/security?project_id=$projectId&msg=totp_setup_invalid_code");
exit;
}
$recoveryCodes = totp_generate_recovery_codes();
try {
// totp_encrypt_secret() can itself throw if the totp_encryption_key
// couldn't be persisted on its first-ever use (see
// ensure_totp_encryption_key()) -- treat that exactly like
// totp_identity_complete_setup() returning false below: do NOT show
// recovery codes or log "enabled", nothing was actually saved, and
// telling the user otherwise would make them believe the account is
// protected when it isn't. Leave $_SESSION['totp_setup']['secret']
// in place so they can simply retry the confirmation.
$persisted = totp_identity_complete_setup($db, $identity, totp_encrypt_secret($pendingSecret), totp_hash_recovery_codes($recoveryCodes));
} catch (\RuntimeException $e) {
$persisted = false;
}
if (!$persisted) {
header("Location: /admin/security?project_id=$projectId&msg=totp_setup_persist_failed");
exit;
}
$_SESSION['totp_setup'] = ['recovery_codes' => $recoveryCodes];
log_audit(null, '', t('admin.security.audit.totp_enabled', ['who' => $identity['type'] === 'user' ? $identity['row']['email'] : 'Admin']));
header("Location: /admin/security?project_id=$projectId");
exit;
}
if (isset($_POST['action']) && $_POST['action'] === 'totp_setup_ack') {
unset($_SESSION['totp_setup']);
header("Location: /admin/security?project_id=$projectId&msg=totp_enabled");
exit;
}
if (isset($_POST['action']) && $_POST['action'] === 'totp_regenerate_codes') {
$identity = totp_current_identity($db);
if ($identity === null || !totp_identity_enabled($identity)) {
header("Location: /admin/security?project_id=$projectId");
exit;
}
$recoveryCodes = totp_generate_recovery_codes();
if (!totp_identity_replace_recovery_codes($db, $identity, totp_hash_recovery_codes($recoveryCodes))) {
header("Location: /admin/security?project_id=$projectId&msg=totp_setup_persist_failed");
exit;
}
$_SESSION['totp_setup'] = ['recovery_codes' => $recoveryCodes];
log_audit(null, '', t('admin.security.audit.totp_codes_regenerated', ['who' => $identity['type'] === 'user' ? $identity['row']['email'] : 'Admin']));
header("Location: /admin/security?project_id=$projectId");
exit;
}
if (isset($_POST['action']) && $_POST['action'] === 'totp_disable') {
$identity = totp_current_identity($db);
$pass = $_POST['confirm_password'] ?? '';
if ($identity !== null && totp_identity_enabled($identity) && $pass !== '' && password_verify($pass, totp_identity_password_hash($identity, $config))) {
if (!totp_identity_disable($db, $identity)) {
header("Location: /admin/security?project_id=$projectId&msg=totp_setup_persist_failed");
exit;
}
unset($_SESSION['totp_setup']);
log_audit(null, '', t('admin.security.audit.totp_disabled', ['who' => $identity['type'] === 'user' ? $identity['row']['email'] : 'Admin']));
header("Location: /admin/security?project_id=$projectId&msg=totp_disabled");
exit;
}
header("Location: /admin/security?project_id=$projectId&msg=totp_disable_wrong_password");
exit;
}
// Admin-seitiger TOTP-Reset fuer einen regulaeren User-Account (Geraet/Recovery-Codes
// verloren). Nur der primaere Admin darf das; der betroffene User bekommt eine
// Benachrichtigungsmail, ausserdem ein Audit-Log-Eintrag.
if (isset($_POST['action']) && $_POST['action'] === 'reset_user_totp') {
if (!current_user_is_primary_admin()) {
http_response_code(403);
echo htmlspecialchars(t('admin.common.access_denied'));
exit;
}
$targetUserId = (int)($_POST['user_id'] ?? 0);
$stmt = $db->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$targetUserId]);
$targetUser = $stmt->fetch();
if ($targetUser) {
$db->prepare("UPDATE users SET totp_secret = NULL, totp_enabled_at = NULL, totp_recovery_codes = NULL, totp_last_used_step = NULL WHERE id = ?")
->execute([$targetUserId]);
send_smtp_mail(
$project,
$targetUser['email'],
t('admin.security.reset_mail.subject'),
'<p>' . htmlspecialchars(t('admin.security.reset_mail.body', ['name' => $targetUser['name']])) . '</p>'
);
log_audit(null, '', t('admin.users.audit.totp_reset', ['name' => $targetUser['name'], 'email' => $targetUser['email']]));
}
header('Location: /admin/users?msg=totp_reset');
exit;
}
$subRoute = parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH);
if (str_starts_with($subRoute, '/admin/edit')) {
require_once __DIR__ . '/editor.php';
exit;
}
if (str_starts_with($subRoute, '/admin/settings')) {
render_settings_view($db, $project, $projects);
exit;
}
if (str_starts_with($subRoute, '/admin/security')) {
render_security_view($db, $project, $projects);
exit;
}
if (str_starts_with($subRoute, '/admin/users')) {
if (!current_user_is_primary_admin()) {
http_response_code(403);
echo htmlspecialchars(t('admin.common.access_denied'));
exit;
}
render_users_view($db, $project, $projects);
exit;
}
if (str_starts_with($subRoute, '/admin/audit')) {
render_audit_view($db, $project, $projects);
exit;
}
if (str_starts_with($subRoute, '/admin/consent-log')) {
render_consent_log_view($db, $project, $projects);
exit;
}
render_matrix_view($db, $project, $projects);
function render_login_view(?string $error): void {
?>
<!DOCTYPE html>
<html lang="<?= htmlspecialchars(current_locale()) ?>">
<head>
<meta charset="utf-8"><title><?= htmlspecialchars(t('admin.login.page_title')) ?></title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/svg+xml" href="/paragrafy.svg">
<?= theme_head_tags_admin() ?>
<?= theme_base_css_admin() ?>
<style>
body { display: flex; flex-direction: column; min-height: 100vh; align-items: center; justify-content: center; gap: 20px; }
.login-card { background: var(--card); padding: 2.25rem; border-radius: var(--radius); width: 340px; box-shadow: none; border: 1px solid var(--border); }
.logo-header { display: flex; align-items: center; gap: 0.7rem; margin-bottom: 1.4rem; }
.logo-header img { width: 34px; height: 34px; border-radius: var(--radius); }
.logo-header h2 { margin: 0; font-size: 1.3rem; font-weight: 800; }
.err { color: var(--red); font-size: 0.8125rem; margin-bottom: 0.5rem; }
.login-disclaimer { max-width: 340px; text-align: center; font-size: 11px; color: var(--text-faintest); line-height: 1.5; }
</style>
</head>
<body>
<?= render_locale_switch(true) ?>
<?php $demoBanner = render_demo_countdown_banner(); ?>
<?php if ($demoBanner !== ''): ?>
<div style="width:340px;box-sizing:border-box;"><?= $demoBanner ?></div>
<?php endif; ?>
<div class="login-card">
<div class="logo-header">
<img src="/paragrafy.svg" alt="Paragrafy">
<h2><?= htmlspecialchars(t('admin.login.heading')) ?></h2>
</div>
<?php if ($error): ?><div class="err"><?= htmlspecialchars($error) ?></div><?php endif; ?>
<form method="post">
<input type="hidden" name="action" value="login">
<label class="pg-label" style="margin-top:0;"><?= htmlspecialchars(t('admin.login.email_label')) ?> <span style="color:var(--text-faint);font-weight:400"><?= htmlspecialchars(t('admin.login.email_hint')) ?></span></label>
<input type="email" name="email" placeholder="<?= htmlspecialchars(t('admin.login.email_placeholder')) ?>" style="width:100%;margin-bottom:10px;">
<label class="pg-label" style="margin-top:0;"><?= htmlspecialchars(t('admin.login.password_label')) ?></label>
<input type="password" name="password" placeholder="<?= htmlspecialchars(t('admin.login.password_placeholder')) ?>" autofocus required style="width:100%;margin-bottom:1rem;">
<button type="submit" class="pg-btn" style="width:100%;justify-content:center;"><?= t('admin.login.submit_button') ?></button>
</form>
<div style="text-align:center;margin-top:14px">
<a href="/admin/forgot-password" style="font-size:12.5px;color:var(--text-faint)"><?= htmlspecialchars(t('admin.login.forgot_password')) ?></a>
</div>
</div>
<div class="login-disclaimer"><?= htmlspecialchars(t('admin.common.footer_disclaimer')) ?></div>
</body>
</html>
<?php
}
function render_totp_view(?string $error): void {
?>
<!DOCTYPE html>
<html lang="<?= htmlspecialchars(current_locale()) ?>">
<head>
<meta charset="utf-8"><title><?= htmlspecialchars(t('admin.login.totp.page_title')) ?></title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/svg+xml" href="/paragrafy.svg">
<?= theme_head_tags_admin() ?>
<?= theme_base_css_admin() ?>
<style>
body { display: flex; flex-direction: column; min-height: 100vh; align-items: center; justify-content: center; gap: 20px; }
.login-card { background: var(--card); padding: 2.25rem; border-radius: var(--radius); width: 340px; box-shadow: none; border: 1px solid var(--border); }
.logo-header { display: flex; align-items: center; gap: 0.7rem; margin-bottom: 1.4rem; }
.logo-header img { width: 34px; height: 34px; border-radius: var(--radius); }
.logo-header h2 { margin: 0; font-size: 1.3rem; font-weight: 800; }
.err { color: var(--red); font-size: 0.8125rem; margin-bottom: 0.5rem; }
</style>
</head>
<body>
<div class="login-card">
<div class="logo-header">
<img src="/paragrafy.svg" alt="Paragrafy">
<h2><?= htmlspecialchars(t('admin.login.totp.heading')) ?></h2>
</div>
<p style="font-size:12.5px;color:var(--text-muted);margin:0 0 14px"><?= htmlspecialchars(t('admin.login.totp.hint')) ?></p>
<?php if ($error): ?><div class="err"><?= htmlspecialchars($error) ?></div><?php endif; ?>
<form method="post">
<input type="hidden" name="action" value="totp_verify">
<label class="pg-label" style="margin-top:0;"><?= htmlspecialchars(t('admin.login.totp.code_label')) ?></label>
<input type="text" name="totp_code" inputmode="numeric" autocomplete="one-time-code" placeholder="123456" autofocus required style="width:100%;margin-bottom:1rem;letter-spacing:2px;font-family:'JetBrains Mono',monospace">
<button type="submit" class="pg-btn" style="width:100%;justify-content:center;"><?= t('admin.login.totp.submit_button') ?></button>
</form>
<div style="text-align:center;margin-top:14px">
<a href="/admin?totp_cancel=1" style="font-size:12.5px;color:var(--text-faint)"><?= htmlspecialchars(t('admin.login.totp.back_link')) ?></a>
</div>
</div>
<div class="login-disclaimer"><?= htmlspecialchars(t('admin.common.footer_disclaimer')) ?></div>
</body>
</html>
<?php
}
function render_no_access_view(): void {
?>
<!DOCTYPE html>
<html lang="<?= htmlspecialchars(current_locale()) ?>">
<head>
<meta charset="utf-8"><title><?= htmlspecialchars(t('admin.no_access.page_title')) ?></title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/svg+xml" href="/paragrafy.svg">
<?= theme_head_tags_admin() ?>
<?= theme_base_css_admin() ?>
<style>
body { display: flex; flex-direction: column; min-height: 100vh; align-items: center; justify-content: center; gap: 20px; }
.no-access-card { background: var(--card); padding: 2.25rem; border-radius: var(--radius); width: 360px; text-align: center; border: 1px solid var(--border); }
</style>
</head>
<body>
<div class="no-access-card">
<h2 style="margin:0 0 10px"><?= htmlspecialchars(t('admin.no_access.heading')) ?></h2>
<p style="font-size:13px;color:var(--text-muted);margin:0 0 18px"><?= htmlspecialchars(t('admin.no_access.body')) ?></p>
<a href="/admin?logout=1" class="pg-btn-secondary" style="display:inline-block"><?= htmlspecialchars(t('admin.common.sidebar.logout_title')) ?></a>
</div>
</body>
</html>
<?php
}
function render_matrix_view(PDO $db, array $project, array $projects): void {
$docTypes = $db->query("SELECT * FROM doc_types ORDER BY is_required DESC, title ASC")->fetchAll();
$activeLangs = array_filter(array_map('trim', explode(',', $project['active_languages'] ?? 'de,en')));
$primaryLang = $project['primary_lang'] ?: 'de';
$auditIntervalMonths = (int)($project['audit_interval_months'] ?? 12);
$unfilledWarnings = [];
$auditWarnings = [];
$totalRequired = 0;
$publishedRequired = 0;
$stmt = $db->prepare("
SELECT t.content, dt.title, t.lang, t.updated_at, t.source_hash, dt.is_required, t.document_id
FROM translations t
JOIN documents d ON t.document_id = d.id
JOIN doc_types dt ON d.doc_type_id = dt.id
WHERE d.project_id = ? AND t.status = 'published'
");
$stmt->execute([$project['id']]);
$allPublished = $stmt->fetchAll();
$now = new DateTime();
foreach ($allPublished as $row) {
$unfilled = check_unfilled_placeholders($row['content'], $project);
if (!empty($unfilled)) {
$unfilledWarnings[] = t('admin.matrix.unfilled_warning_line', ['title' => $row['title'], 'lang' => strtoupper($row['lang']), 'placeholders' => implode(', ', $unfilled)]);
}
if (!empty($row['updated_at'])) {
$updated = new DateTime($row['updated_at']);
$diffMonths = (($now->format('Y') - $updated->format('Y')) * 12) + ($now->format('m') - $updated->format('m'));
if ($diffMonths >= $auditIntervalMonths) {
$days = $now->diff($updated)->days;
$auditWarnings[] = t('admin.matrix.audit_warning_line', ['title' => $row['title'], 'lang' => strtoupper($row['lang']), 'days' => $days]);
}
}
}
foreach ($docTypes as $t) {
if ($t['is_required']) {
$totalRequired++;
$chk = $db->prepare("SELECT COUNT(*) FROM translations t JOIN documents d ON t.document_id = d.id WHERE d.project_id = ? AND d.doc_type_id = ? AND t.lang = ? AND t.status = 'published'");
$chk->execute([$project['id'], $t['id'], $primaryLang]);
if ((int)$chk->fetchColumn() > 0) {
$publishedRequired++;
}
}
}
$complianceScore = $totalRequired > 0 ? (int)round(($publishedRequired / $totalRequired) * 100) : 100;
$isManagedCloud = !empty(get_config()['managed_cloud']);
?>
<!DOCTYPE html>
<html lang="<?= htmlspecialchars(current_locale()) ?>">
<head>
<meta charset="utf-8"><title><?= htmlspecialchars(t('admin.matrix.page_title', ['project' => $project['name']])) ?></title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/svg+xml" href="/paragrafy.svg">
<?= theme_head_tags_admin() ?>
<?= theme_base_css_admin($project['brand_color'] ?: '#F0A63C') ?>
<style>
.grid-add { display: grid; grid-template-columns: 2fr 1.5fr auto auto; gap: 0.75rem; align-items: center; margin-top: 10px; }
.api-pill { background: var(--border-soft); padding: 2px 6px; border-radius: var(--radius-sm); font-family: 'JetBrains Mono', monospace; font-size: 12px; }
</style>
</head>
<body>
<div class="pg-shell">
<?= render_sidebar('dashboard', $project, $projects) ?>
<div class="pg-main">
<div class="pg-topbar">
<div class="pg-crumb"><?= htmlspecialchars($project['name']) ?> <span style="margin:0 4px">/</span> <strong><?= htmlspecialchars(t('admin.matrix.crumb')) ?></strong></div>
</div>
<div class="pg-content">
<div style="display:flex;align-items:flex-start;justify-content:space-between;margin-bottom:28px;gap:20px;flex-wrap:wrap">
<div>
<h1 style="font-size:26px;font-weight:800;margin:0 0 6px;"><?= htmlspecialchars($project['name']) ?></h1>
<div style="font-size:13px;color:var(--text-muted);display:flex;gap:14px;flex-wrap:wrap">
<span><?= htmlspecialchars(t('admin.matrix.domain_label')) ?> <strong style="color:var(--text);font-weight:600"><?= htmlspecialchars($project['domain']) ?></strong></span>
<span style="color:var(--border-strong)">·</span>
<span><?= htmlspecialchars(t('admin.matrix.api_label')) ?> <span class="api-pill">/api/:lang/:slug</span></span>
</div>
</div>
<?php $projectLimitReached = get_project_limit() !== null && count($projects) >= get_project_limit(); ?>
<?php if ($isManagedCloud): ?>
<a href="https://app.paragrafy.cloud/dashboard" class="pg-viewer-link"><?= t('admin.matrix.cloud_new_project_link') ?></a>
<?php elseif ($projectLimitReached): ?>
<span class="pg-pill pg-pill-muted" title="<?= htmlspecialchars(t('admin.matrix.project_limit_reached_title', ['count' => (int)get_project_limit(), 'suffix' => get_project_limit() === 1 ? '' : 'e'])) ?>"><?= htmlspecialchars(t('admin.matrix.project_limit_reached_pill')) ?></span>
<?php else: ?>
<button type="button" class="pg-btn" onclick="openNewProjectModal()"><?= htmlspecialchars(t('admin.matrix.new_project_button')) ?></button>
<?php endif; ?>
</div>
<?php if (($_GET['msg'] ?? '') === 'project_limit_reached'): ?>
<div class="pg-alert pg-alert-red">
<div><?= t('admin.matrix.project_limit_reached_alert', ['count' => (int)get_project_limit(), 'suffix' => get_project_limit() === 1 ? '' : 'e']) ?></div>
</div>
<?php endif; ?>
<?php if (($_GET['msg'] ?? '') === 'managed_cloud_blocked'): ?>
<div class="pg-alert pg-alert-red">
<div><?= htmlspecialchars(t('admin.matrix.managed_cloud_blocked_alert')) ?></div>
</div>
<?php endif; ?>
<!-- Health KPI Cards -->
<div class="pg-kpi-grid">
<div class="pg-kpi">
<div class="pg-kpi-label"><?= htmlspecialchars(t('admin.matrix.kpi.completeness_label')) ?><?= help_icon(t('admin.matrix.kpi.completeness_help')) ?></div>
<div class="pg-kpi-val" style="color: <?= $complianceScore === 100 ? 'var(--green)' : 'var(--accent)' ?>;"><?= $complianceScore ?>%</div>
<div class="pg-kpi-sub"><?= htmlspecialchars(t('admin.matrix.kpi.completeness_sub', ['published' => $publishedRequired, 'total' => $totalRequired])) ?></div>
</div>
<div class="pg-kpi">
<div class="pg-kpi-label"><?= htmlspecialchars(t('admin.matrix.kpi.languages_label')) ?></div>
<div class="pg-kpi-val"><?= count($activeLangs) ?></div>
<div class="pg-kpi-sub"><?= strtoupper(implode(', ', $activeLangs)) ?></div>
</div>
<div class="pg-kpi">
<div class="pg-kpi-label"><?= htmlspecialchars(t('admin.matrix.kpi.sync_label')) ?><?= help_icon(t('admin.matrix.kpi.sync_help')) ?></div>
<div class="pg-kpi-val" style="color:var(--green);display:flex;align-items:center;gap:6px;font-size:20px;">
<span style="width:8px;height:8px;border-radius:50%;background:#2fa06a;display:inline-block"></span><?= htmlspecialchars(t('admin.matrix.kpi.sync_active')) ?>
</div>
<div class="pg-kpi-sub"><?= htmlspecialchars(t('admin.matrix.kpi.sync_sub')) ?></div>
</div>
<div class="pg-kpi">
<div class="pg-kpi-label"><?= htmlspecialchars(t('admin.matrix.kpi.audit_status_label')) ?></div>
<div class="pg-kpi-val" style="font-size:20px;color: <?= empty($auditWarnings) ? 'var(--green)' : '#b4650f' ?>;">
<?= empty($auditWarnings) ? htmlspecialchars(t('admin.matrix.kpi.audit_status_current')) : htmlspecialchars(t('admin.matrix.kpi.audit_status_due', ['count' => count($auditWarnings)])) ?>
</div>
<div class="pg-kpi-sub"><?= htmlspecialchars(t('admin.matrix.kpi.audit_status_sub', ['months' => $auditIntervalMonths])) ?></div>
</div>
</div>
<?php if (!empty($auditWarnings)): ?>
<div class="pg-alert pg-alert-red">
<div><?= t('admin.matrix.audit_due_alert', ['months' => $auditIntervalMonths]) ?>
<ul>
<?php foreach (array_slice($auditWarnings, 0, 3) as $aw): ?>
<li><?= htmlspecialchars($aw) ?></li>
<?php endforeach; ?>
</ul>
</div>
</div>
<?php endif; ?>
<?php if (!empty($unfilledWarnings)): ?>
<div class="pg-alert pg-alert-amber">
<div><?= t('admin.matrix.unfilled_alert') ?>
<ul>
<?php foreach (array_slice($unfilledWarnings, 0, 3) as $w): ?>
<li><?= htmlspecialchars($w) ?></li>
<?php endforeach; ?>
</ul>
</div>
</div>
<?php endif; ?>
<!-- Matrix -->
<div class="pg-card">
<div style="padding:20px 22px 14px">
<h2><?= htmlspecialchars(t('admin.matrix.table.heading')) ?></h2>
<p class="pg-card-sub"><?= htmlspecialchars(t('admin.matrix.table.subtitle')) ?></p>
</div>
<table class="pg-table">
<thead>
<tr>
<th><?= htmlspecialchars(t('admin.matrix.table.col_doctype')) ?></th>
<th><?= htmlspecialchars(t('admin.matrix.table.col_required')) ?></th>
<?php foreach ($activeLangs as $lang): ?>
<th><?= strtoupper(htmlspecialchars($lang)) ?></th>
<?php endforeach; ?>
<th style="text-align:right"><?= htmlspecialchars(t('admin.matrix.table.col_actions')) ?></th>
</tr>
</thead>
<tbody>
<?php foreach ($docTypes as $type): ?>
<?php
$stmt = $db->prepare("SELECT id FROM documents WHERE project_id = ? AND doc_type_id = ?");
$stmt->execute([$project['id'], $type['id']]);
$doc = $stmt->fetch();
if (!$doc) {
$ins = $db->prepare("INSERT INTO documents (project_id, doc_type_id) VALUES (?, ?)");
$ins->execute([$project['id'], $type['id']]);
$docId = (int)$db->lastInsertId();
} else {
$docId = (int)$doc['id'];
}
$stmt = $db->prepare("SELECT source_hash, content FROM translations WHERE document_id = ? AND lang = ?");
$stmt->execute([$docId, $primaryLang]);
$sourceRow = $stmt->fetch();
$currentSourceHash = $sourceRow ? md5($sourceRow['content']) : '';
$primaryUrl = "https://" . $project['domain'] . "/" . $type['slug'];
?>
<tr>
<td>
<div style="font-weight:600;font-size:13.5px"><?= htmlspecialchars($type['title']) ?></div>
<div style="display:flex;align-items:center;gap:6px;margin-top:2px;white-space:nowrap">
<a href="/<?= htmlspecialchars($type['slug']) ?>" target="_blank" style="font-size:11.5px;color:var(--text-faint);font-family:'JetBrains Mono',monospace;" title="<?= htmlspecialchars(t('admin.matrix.table.primary_link_title')) ?>">/<?= htmlspecialchars($type['slug']) ?></a>
<button type="button" class="pg-copy-btn" title="<?= htmlspecialchars(t('admin.matrix.table.copy_link_title')) ?>" onclick="copyToClipboard('<?= htmlspecialchars($primaryUrl) ?>', '<?= htmlspecialchars(t('admin.matrix.table.copy_link_success'), ENT_QUOTES) ?>')"><?= svg_icon('link', '', 13) ?></button>
</div>
</td>
<td>
<button type="button" style="background:none;border:none;cursor:pointer;padding:0;" id="toggle_btn_<?= $type['id'] ?>" onclick="ajaxToggleRequired(<?= $type['id'] ?>)" title="<?= htmlspecialchars(t('admin.matrix.table.toggle_title')) ?>">
<?php if ($type['is_required']): ?>
<span class="pg-req-label" id="span_req_<?= $type['id'] ?>"><?= htmlspecialchars(t('admin.matrix.table.required_label')) ?></span>
<?php else: ?>
<span class="pg-opt-label" id="span_req_<?= $type['id'] ?>"><?= htmlspecialchars(t('admin.matrix.table.optional_label')) ?></span>
<?php endif; ?>
</button>
</td>
<?php foreach ($activeLangs as $lang): ?>
<?php
$stmt = $db->prepare("SELECT * FROM translations WHERE document_id = ? AND lang = ?");
$stmt->execute([$docId, $lang]);
$trans = $stmt->fetch();
$isOutdated = false;
if ($trans && $lang !== $primaryLang && !empty($trans['source_hash']) && !empty($currentSourceHash)) {
if ($trans['source_hash'] !== $currentSourceHash) {
$isOutdated = true;
}
}
?>
<td>
<?php if ($trans && $trans['status'] === 'published'): ?>
<?php if ($isOutdated): ?>
<a href="/admin/edit?doc_id=<?= $docId ?>&lang=<?= $lang ?>" class="pg-pill pg-pill-amber" title="<?= htmlspecialchars(t('admin.matrix.table.outdated_title')) ?>"><span class="pg-pill-dot"></span><?= htmlspecialchars(t('admin.matrix.table.outdated_label')) ?></a>
<?php else: ?>
<a href="/admin/edit?doc_id=<?= $docId ?>&lang=<?= $lang ?>" class="pg-pill pg-pill-green" title="<?= htmlspecialchars(t('admin.matrix.table.edit_title', ['title' => $trans['title']])) ?>"><span class="pg-pill-dot"></span><?= htmlspecialchars(t('admin.matrix.table.live_label')) ?></a>
<?php endif; ?>
<?php elseif ($trans && $trans['status'] === 'draft'): ?>
<a href="/admin/edit?doc_id=<?= $docId ?>&lang=<?= $lang ?>" class="pg-pill pg-pill-amber"><span class="pg-pill-dot"></span><?= htmlspecialchars(t('admin.matrix.table.draft_label')) ?></a>
<?php else: ?>
<a href="/admin/edit?doc_id=<?= $docId ?>&lang=<?= $lang ?>" class="pg-pill pg-pill-red"><?= htmlspecialchars(t('admin.matrix.table.create_label')) ?></a>
<?php endif; ?>
</td>
<?php endforeach; ?>
<td style="text-align:right">
<div style="display:flex;justify-content:flex-end;gap:4px">
<a href="/admin/edit?doc_id=<?= $docId ?>&lang=<?= htmlspecialchars($primaryLang) ?>" class="pg-icon-btn" title="<?= htmlspecialchars(t('admin.matrix.table.edit_icon_title')) ?>">
<?= svg_icon('edit', '', 14) ?>
</a>
<?php if (!in_array($type['slug'], ['impressum', 'privacy'])): ?>
<form method="post" onsubmit="return confirm('<?= htmlspecialchars(t('admin.matrix.table.confirm_delete_doctype'), ENT_QUOTES) ?>');" style="margin:0;">
<?= csrf_field() ?>
<input type="hidden" name="action" value="delete_doc_type">
<input type="hidden" name="doc_type_id" value="<?= $type['id'] ?>">
<button type="submit" class="pg-icon-btn danger" title="<?= htmlspecialchars(t('admin.matrix.table.delete_title')) ?>">
<svg width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"><path d="M3.5 4.5h9"/><path d="M6.2 4.5V3.2c0-.4.3-.7.7-.7h2.2c.4 0 .7.3.7.7v1.3"/><path d="M4.8 4.5 5.2 13c0 .4.3.7.7.7h4c.4 0 .7-.3.7-.7l.4-8.5"/><path d="M6.7 7.3v3.6"/><path d="M9.3 7.3v3.6"/></svg>
</button>
</form>
<?php endif; ?>
</div>
</td>
</tr>
<?php endforeach; ?>
</tbody>
</table>
</div>
<!-- Neuer Rechtstext hinzufügen -->
<div class="pg-card pg-card-pad" style="margin-bottom:0">
<h2><?= htmlspecialchars(t('admin.matrix.add.heading')) ?></h2>
<p class="pg-card-sub" style="margin-bottom:14px"><?= htmlspecialchars(t('admin.matrix.add.subtitle')) ?></p>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="create_doc_type">
<div class="grid-add">
<input type="text" name="doc_title" placeholder="<?= htmlspecialchars(t('admin.matrix.add.title_placeholder')) ?>" required>
<input type="text" name="doc_slug" placeholder="<?= htmlspecialchars(t('admin.matrix.add.slug_placeholder')) ?>" required>
<label style="display:flex;align-items:center;gap:6px;font-size:12.5px;color:var(--text-muted);white-space:nowrap;cursor:pointer;">
<input type="checkbox" name="is_required" value="1"> <?= htmlspecialchars(t('admin.matrix.add.required_label')) ?>
</label>
<button type="submit" class="pg-btn"><?= htmlspecialchars(t('admin.matrix.add.submit_button')) ?></button>
</div>
</form>
</div>
</div>
<div class="pg-footer-note"><?= htmlspecialchars(t('admin.common.footer_disclaimer')) ?></div>
</div>
</div>
<!-- Modal: Neues Projekt anlegen -->
<div id="newProjectModal" class="pg-modal-backdrop" onclick="if(event.target === this) closeNewProjectModal()">
<div class="pg-modal">
<h2 style="font-size:19px;font-weight:800;margin:0 0 6px"><?= htmlspecialchars(t('admin.matrix.new_project_modal.heading')) ?></h2>
<p style="font-size:13px;color:var(--text-muted);margin:0 0 20px"><?= htmlspecialchars(t('admin.matrix.new_project_modal.desc')) ?></p>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="create_project">
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.matrix.new_project_modal.name_label')) ?></label>
<input type="text" name="new_project_name" placeholder="<?= htmlspecialchars(t('admin.matrix.new_project_modal.name_placeholder')) ?>" required style="width:100%">
<label class="pg-label"><?= htmlspecialchars(t('admin.matrix.new_project_modal.domain_label')) ?></label>
<input type="text" name="new_project_domain" placeholder="<?= htmlspecialchars(t('admin.matrix.new_project_modal.domain_placeholder')) ?>" required style="width:100%">
<div style="display:grid;grid-template-columns:1fr 1fr;gap:14px">
<div>
<label class="pg-label"><?= htmlspecialchars(t('admin.matrix.new_project_modal.primary_lang_label')) ?></label>
<select name="new_primary_lang" style="width:100%">
<option value="de" selected><?= htmlspecialchars(t('install.section2.lang_de')) ?></option>
<option value="en"><?= htmlspecialchars(t('install.section2.lang_en')) ?></option>
<option value="es"><?= htmlspecialchars(t('install.section2.lang_es')) ?></option>
<option value="fr"><?= htmlspecialchars(t('install.section2.lang_fr')) ?></option>
</select>
</div>
<div>
<label class="pg-label"><?= htmlspecialchars(t('admin.matrix.new_project_modal.color_label')) ?></label>
<input type="text" name="new_brand_color" value="#F0A63C" style="width:100%;font-family:'JetBrains Mono',monospace">
</div>
</div>
<div style="display:flex;justify-content:flex-end;gap:10px;margin-top:26px">
<button type="button" class="pg-btn-secondary" onclick="closeNewProjectModal()"><?= htmlspecialchars(t('admin.matrix.new_project_modal.cancel_button')) ?></button>
<button type="submit" class="pg-btn"><?= t('admin.matrix.new_project_modal.submit_button') ?></button>
</div>
</form>
</div>
</div>
<div id="toastNotification" class="pg-toast">
<?= svg_icon('check', '', 16) ?> <span id="toastMsg"><?= htmlspecialchars(t('admin.matrix.toast.status_updated')) ?></span>
</div>
<script>
const CSRF_TOKEN = <?= json_encode(csrf_token()) ?>;
const i18n = {
copyFailed: <?= json_encode(t('admin.matrix.js.copy_failed')) ?>,
markedRequired: <?= json_encode(t('admin.matrix.js.marked_required')) ?>,
markedOptional: <?= json_encode(t('admin.matrix.js.marked_optional')) ?>,
requiredLabel: <?= json_encode(t('admin.matrix.table.required_label')) ?>,
optionalLabel: <?= json_encode(t('admin.matrix.table.optional_label')) ?>,
copySuccess: <?= json_encode(t('admin.matrix.js.copy_success')) ?>
};
function openNewProjectModal() {
document.getElementById('newProjectModal').style.display = 'flex';
}
function closeNewProjectModal() {
document.getElementById('newProjectModal').style.display = 'none';
}
function showToast(msg) {
const toast = document.getElementById('toastNotification');
document.getElementById('toastMsg').innerText = msg;
toast.classList.add('show');
setTimeout(() => { toast.classList.remove('show'); }, 2500);
}
function copyToClipboard(text, successMsg = i18n.copySuccess) {
if (navigator.clipboard && window.isSecureContext) {
navigator.clipboard.writeText(text).then(() => {
showToast(successMsg);
}).catch(() => {
fallbackCopy(text, successMsg);
});
} else {
fallbackCopy(text, successMsg);
}
}
function fallbackCopy(text, successMsg) {
const textArea = document.createElement("textarea");
textArea.value = text;
textArea.style.position = "fixed";
textArea.style.left = "-999999px";
document.body.appendChild(textArea);
textArea.focus();
textArea.select();
try {
document.execCommand('copy');
showToast(successMsg);
} catch (err) {
alert(i18n.copyFailed);
}
document.body.removeChild(textArea);
}
async function ajaxToggleRequired(id) {
const fd = new FormData();
fd.append('action', 'toggle_required');
fd.append('doc_type_id', id);
fd.append('csrf_token', CSRF_TOKEN);
try {
const res = await fetch(window.location.href, {
method: 'POST',
body: fd,
headers: { 'X-Requested-With': 'XMLHttpRequest' }
});
const data = await res.json();
if (data.success) {
const span = document.getElementById('span_req_' + id);
if (data.is_required === 1) {
span.className = 'pg-req-label';
span.innerHTML = i18n.requiredLabel;
showToast(i18n.markedRequired);
} else {
span.className = 'pg-opt-label';
span.innerHTML = i18n.optionalLabel;
showToast(i18n.markedOptional);
}
}
} catch(e) {
location.reload();
}
}
</script>
</body>
</html>
<?php
}
function render_settings_view(PDO $db, array $project, array $projects): void {
$env = load_env_file();
$envDeepl = $env['DEEPL_API_KEY'] ?? '';
$envAiKey = !empty($project['ai_api_key']) ? '' : (($project['ai_provider'] ?? '') === 'openai' ? ($env['OPENAI_API_KEY'] ?? '') : ($env['CLAUDE_API_KEY'] ?? ($env['OPENAI_API_KEY'] ?? '')));
// Letzte Webhook-Logs für dieses Projekt laden
$stmtLogs = $db->prepare("SELECT * FROM webhook_logs WHERE project_id = ? ORDER BY created_at DESC LIMIT 10");
$stmtLogs->execute([$project['id']]);
$logs = $stmtLogs->fetchAll();
$backups = list_backups();
$backupMsg = $_GET['msg'] ?? '';
$cronSecret = ensure_cron_secret();
$cronScheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
$cronHost = $_SERVER['HTTP_HOST'] ?? $project['domain'];
$cronBase = $cronScheme . '://' . $cronHost;
$queueSummary = webhook_queue_summary($db, $project['id']);
$isManagedCloud = !empty(get_config()['managed_cloud']);
$isDemo = !empty(get_config()['is_demo']);
$isLockedInstance = $isManagedCloud || $isDemo;
?>
<!DOCTYPE html>
<html lang="<?= htmlspecialchars(current_locale()) ?>">
<head>
<meta charset="utf-8"><title><?= htmlspecialchars(t('admin.settings.page_title', ['project' => $project['name']])) ?></title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/svg+xml" href="/paragrafy.svg">
<?= theme_head_tags_admin() ?>
<?= theme_base_css_admin($project['brand_color'] ?: '#F0A63C') ?>
<style>
.grid { display: grid; grid-template-columns: 1fr 1fr; gap: 16px 20px; }
label.pg-label { margin-top: 14px; }
hr.pg-sep { margin: 24px 0 18px; border: none; border-top: 1px solid var(--border-soft); }
.btn-test { background: var(--text); color: var(--bg); border: none; padding: 0.5rem 1rem; border-radius: var(--radius); font-size: 0.8125rem; cursor: pointer; font-weight: 700; margin-top: 0.5rem; display: inline-flex; align-items: center; gap: 0.35rem; }
.btn-test:hover { opacity: .85; }
.beta-badge-inline { display: inline-block; background: var(--amber-bg); color: var(--amber); font-size: 10px; font-weight: 800; letter-spacing: 0.04em; padding: 2px 6px; border-radius: 999px; vertical-align: middle; margin-left: 4px; }
/* Webhook Log Table */
.log-table { width: 100%; border-collapse: collapse; margin-top: 1rem; font-size: 13px; }
.log-table th, .log-table td { padding: 10px 0; border-bottom: 1px solid var(--border-soft); text-align: left; }
.log-table th { color: var(--text-faint); font-weight: 700; font-size: 10.5px; text-transform: uppercase; letter-spacing: .04em; }
.status-badge { padding: 3px 8px; border-radius: var(--radius-sm); border: 1px solid currentColor; font-weight: 600; font-family: 'JetBrains Mono', monospace; font-size: 11px; text-transform: uppercase; letter-spacing: .04em; }
.status-200 { background: transparent; color: var(--green); }
.status-err { background: transparent; color: var(--red); }
.payload-preview { font-family: 'JetBrains Mono', monospace; font-size: 12px; color: var(--text-muted); max-width: 250px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.pg-theme-toggle { display: inline-flex; border: 1px solid var(--border-strong); border-radius: var(--radius); overflow: hidden; }
.pg-theme-toggle button { border: none; background: var(--card); color: var(--text-muted); padding: 8px 16px; font-size: 13px; font-weight: 600; cursor: pointer; font-family: 'Inter', sans-serif; }
.pg-theme-toggle button + button { border-left: 1px solid var(--border-strong); }
.pg-theme-toggle button.active { background: var(--accent-bg); color: var(--accent); }
</style>
</head>
<body>
<div class="pg-shell">
<?= render_sidebar('settings', $project, $projects) ?>
<div class="pg-main">
<div class="pg-topbar">
<div class="pg-crumb"><?= htmlspecialchars($project['name']) ?> <span style="margin:0 4px">/</span> <strong><?= htmlspecialchars(t('admin.settings.crumb')) ?></strong></div>
</div>
<div class="pg-content" style="max-width:840px">
<div class="pg-card pg-card-pad">
<h2><?= htmlspecialchars(t('admin.settings.appearance.heading')) ?></h2>
<p class="pg-card-sub" style="margin-bottom:16px"><?= htmlspecialchars(t('admin.settings.appearance.subtitle')) ?></p>
<div class="pg-theme-toggle" id="themeToggle">
<button type="button" data-theme-choice="light"><?= htmlspecialchars(t('admin.settings.appearance.light')) ?></button>
<button type="button" data-theme-choice="dark"><?= htmlspecialchars(t('admin.settings.appearance.dark')) ?></button>
<button type="button" data-theme-choice="auto"><?= htmlspecialchars(t('admin.settings.appearance.auto')) ?></button>
</div>
</div>
<?php if (!empty($_SESSION['paragrafy_user_id'])): ?>
<div class="pg-card pg-card-pad">
<h2><?= htmlspecialchars(t('admin.settings.locale.heading')) ?></h2>
<p class="pg-card-sub" style="margin-bottom:16px"><?= htmlspecialchars(t('admin.settings.locale.subtitle')) ?></p>
<?php if (($_GET['msg'] ?? '') === 'locale_saved'): ?>
<p style="font-size:12px;color:var(--green);margin:0 0 12px"><?= htmlspecialchars(t('admin.settings.locale.saved_msg')) ?></p>
<?php endif; ?>
<form method="post" style="display:flex;gap:10px;align-items:center;flex-wrap:wrap">
<?= csrf_field() ?>
<input type="hidden" name="action" value="save_locale">
<label class="pg-label" style="margin:0"><?= htmlspecialchars(t('admin.settings.locale.label')) ?></label>
<select name="locale">
<?php foreach (ui_locales() as $code => $meta): ?>
<option value="<?= htmlspecialchars($code) ?>" <?= current_locale() === $code ? 'selected' : '' ?>><?= htmlspecialchars(($meta['flag'] ?? '') . ' ' . ($meta['label'] ?? strtoupper($code))) ?></option>
<?php endforeach; ?>
</select>
<button type="submit" class="pg-btn-secondary"><?= htmlspecialchars(t('admin.settings.locale.save_button')) ?></button>
</form>
</div>
<?php endif; ?>
<div class="pg-card pg-card-pad">
<?php if ($isManagedCloud): ?>
<h2><?= htmlspecialchars(t('admin.settings.automation.cloud_heading')) ?></h2>
<p class="pg-card-sub"><?= htmlspecialchars(t('admin.settings.automation.cloud_subtitle')) ?></p>
<?php elseif ($isDemo): ?>
<h2><?= htmlspecialchars(t('admin.settings.automation.demo_heading')) ?></h2>
<p class="pg-card-sub"><?= htmlspecialchars(t('admin.settings.automation.demo_subtitle')) ?></p>
<?php else: ?>
<h2><?= htmlspecialchars(t('admin.settings.automation.cron_heading')) ?></h2>
<p class="pg-card-sub" style="margin-bottom:16px"><?= t('admin.settings.automation.cron_subtitle') ?></p>
<?php if (($_GET['msg'] ?? '') === 'cron_secret_regenerated'): ?>
<p style="font-size:12px;color:var(--green);margin:0 0 12px"><?= htmlspecialchars(t('admin.settings.automation.secret_regenerated')) ?></p>
<?php endif; ?>
<?php
$cronRows = [
[t('admin.settings.automation.row_publish'), '/api/cron/publish', t('admin.settings.automation.freq_every_minute'), '* * * * *'],
[t('admin.settings.automation.row_webhooks'), '/api/cron/webhooks', t('admin.settings.automation.freq_every_5_min'), '*/5 * * * *'],
[t('admin.settings.automation.row_backup'), '/api/cron/backup', t('admin.settings.automation.freq_daily_3am'), '0 3 * * *'],
[t('admin.settings.automation.row_audit'), '/api/cron/audit', t('admin.settings.automation.freq_daily_8am'), '0 8 * * *'],
];
?>
<p class="pg-card-sub" style="margin-bottom:12px"><?= t('admin.settings.automation.crontab_hint') ?></p>
<div style="display:flex;flex-direction:column;gap:10px;margin-bottom:16px">
<?php foreach ($cronRows as [$cronLabel, $cronPath, $cronFreq, $cronSchedule]): ?>
<?php $cronLine = $cronSchedule . ' curl -fsS "' . $cronBase . $cronPath . '?secret=' . $cronSecret . '" > /dev/null'; ?>
<div>
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars($cronLabel) ?> <span style="color:var(--text-faint);font-weight:400"><?= htmlspecialchars(t('admin.settings.automation.recommended_suffix', ['freq' => $cronFreq])) ?></span></label>
<div style="display:flex;gap:6px">
<input type="text" readonly onclick="this.select()" value="<?= htmlspecialchars($cronLine) ?>" style="width:100%;font-family:'JetBrains Mono',monospace;font-size:12px;color:var(--text-muted)">
<button type="button" class="pg-icon-btn" title="<?= htmlspecialchars(t('admin.settings.automation.copy_title')) ?>" onclick="copyToClipboard('<?= htmlspecialchars($cronLine, ENT_QUOTES) ?>')"><?= svg_icon('copy', '', 14) ?></button>
</div>
</div>
<?php endforeach; ?>
</div>
<form method="post" onsubmit="return confirm('<?= htmlspecialchars(t('admin.settings.automation.confirm_regenerate'), ENT_QUOTES) ?>');">
<?= csrf_field() ?>
<input type="hidden" name="action" value="regenerate_cron_secret">
<button type="submit" class="pg-btn-secondary"><?= htmlspecialchars(t('admin.settings.automation.regenerate_button')) ?></button>
</form>
<?php endif; ?>
</div>
<div class="pg-card pg-card-pad">
<h2 style="margin-bottom:18px"><?= t('admin.settings.project.heading') ?></h2>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="save_general">
<div class="grid">
<div>
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.project.name_label')) ?></label>
<input type="text" name="name" value="<?= htmlspecialchars($project['name']) ?>" required style="width:100%">
</div>
<div>
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.project.domain_label')) ?></label>
<?php if ($isLockedInstance): ?>
<input type="text" value="<?= htmlspecialchars($project['domain']) ?>" disabled style="width:100%;opacity:.6;cursor:not-allowed">
<p class="pg-card-sub" style="margin-top:6px"><?= htmlspecialchars(t($isManagedCloud ? 'admin.settings.project.domain_managed_hint' : 'admin.settings.project.domain_demo_hint')) ?></p>
<?php else: ?>
<input type="text" name="domain" value="<?= htmlspecialchars($project['domain']) ?>" required style="width:100%">
<?php endif; ?>
</div>
</div>
<div class="grid">
<div>
<label class="pg-label"><?= htmlspecialchars(t('admin.settings.project.primary_lang_label')) ?></label>
<input type="text" name="primary_lang" value="<?= htmlspecialchars($project['primary_lang']) ?>" required style="width:100%">
</div>
<div>
<label class="pg-label"><?= htmlspecialchars(t('admin.settings.project.active_langs_label')) ?></label>
<input type="text" name="active_languages" value="<?= htmlspecialchars($project['active_languages']) ?>" required style="width:100%">
</div>
</div>
<div class="grid">
<div>
<label class="pg-label"><?= htmlspecialchars(t('admin.settings.project.brand_color_label')) ?></label>
<div style="display:flex;gap:8px;align-items:center">
<input type="color" id="adm_cp" value="<?= htmlspecialchars($project['brand_color'] ?: '#F0A63C') ?>" style="width:34px;height:34px;padding:0;border:1px solid var(--border-strong);border-radius:var(--radius);cursor:pointer;flex-shrink:0" oninput="document.getElementById('adm_ct').value = this.value.toUpperCase();">
<input type="text" id="adm_ct" name="brand_color" value="<?= htmlspecialchars($project['brand_color'] ?: '#F0A63C') ?>" maxlength="7" style="flex:1;font-family:'JetBrains Mono',monospace;text-transform:uppercase" oninput="if(/^#[0-9A-Fa-f]{6}$/.test(this.value)) document.getElementById('adm_cp').value = this.value;">
</div>
</div>
<div>
<label class="pg-label"><?= htmlspecialchars(t('admin.settings.project.logo_url_label')) ?> <span style="color:var(--text-faint);font-weight:400"><?= htmlspecialchars(t('admin.settings.project.optional_hint')) ?></span></label>
<input type="text" name="logo_url" value="<?= htmlspecialchars($project['logo_url'] ?? '') ?>" placeholder="/paragrafy.svg" style="width:100%">
</div>
</div>
<div style="margin-top:18px;padding-top:16px;border-top:1px solid var(--border-soft)">
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.project.audit_interval_label')) ?></label>
<input type="number" name="audit_interval_months" value="<?= htmlspecialchars((string)($project['audit_interval_months'] ?? 12)) ?>" min="1" max="36" required style="width:100px">
<div class="pg-hint"><?= htmlspecialchars(t('admin.settings.project.audit_interval_hint')) ?></div>
</div>
<div style="margin-top:18px">
<button type="submit" class="pg-btn"><?= svg_icon('disk', '', 16) ?> <?= htmlspecialchars(t('admin.settings.project.save_button')) ?></button>
</div>
</form>
</div>
<div class="pg-card pg-card-pad">
<h2><?= htmlspecialchars(t('admin.settings.cookie.heading')) ?></h2>
<p class="pg-card-sub" style="margin-bottom:16px"><?= t('admin.settings.cookie.subtitle') ?></p>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="save_cookie_banner">
<label style="display:flex;align-items:center;gap:8px;font-size:13px;font-weight:500;cursor:pointer">
<input type="checkbox" name="cookie_banner_enabled" value="1" <?= !empty($project['cookie_banner_enabled']) ? 'checked' : '' ?>>
<?= htmlspecialchars(t('admin.settings.cookie.enable_label')) ?>
</label>
<?php $bannerMap = cookie_banner_text_map($project); ?>
<?php foreach (ui_locales() as $code => $meta): ?>
<label class="pg-label"><?= htmlspecialchars(t('admin.settings.cookie.banner_text_label')) ?> (<?= htmlspecialchars($meta['label'] ?? strtoupper($code)) ?>) <span style="color:var(--text-faint);font-weight:400"><?= htmlspecialchars(t('admin.settings.cookie.banner_text_hint')) ?></span><?= help_icon(t('admin.settings.cookie.banner_text_help')) ?></label>
<textarea name="cookie_banner_text[<?= htmlspecialchars($code) ?>]" rows="2" style="width:100%;margin-bottom:10px" placeholder="<?= htmlspecialchars(t('public.consent.default_text')) ?>"><?= htmlspecialchars($bannerMap[$code] ?? '') ?></textarea>
<?php endforeach; ?>
<div style="margin-top:16px">
<button type="submit" class="pg-btn"><?= svg_icon('disk', '', 16) ?> <?= htmlspecialchars(t('admin.settings.project.save_button')) ?></button>
</div>
</form>
</div>
<div class="pg-card pg-card-pad">
<h2><?= htmlspecialchars(t('admin.settings.consent_log.heading')) ?></h2>
<p class="pg-card-sub" style="margin-bottom:16px"><?= t('admin.settings.consent_log.subtitle') ?></p>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="save_consent_log">
<label style="display:flex;align-items:center;gap:8px;font-size:13px;font-weight:500;cursor:pointer">
<input type="checkbox" name="consent_logging_enabled" value="1" <?= !empty($project['consent_logging_enabled']) ? 'checked' : '' ?>>
<?= htmlspecialchars(t('admin.settings.consent_log.enable_label')) ?>
<?= help_icon(t('admin.settings.consent_log.enable_help')) ?>
</label>
<label class="pg-label"><?= htmlspecialchars(t('admin.settings.consent_log.retention_label')) ?> <span style="color:var(--text-faint);font-weight:400"><?= htmlspecialchars(t('admin.settings.consent_log.retention_hint')) ?></span></label>
<input type="number" name="consent_log_retention_days" min="0" value="<?= htmlspecialchars((string)($project['consent_log_retention_days'] ?? 1095)) ?>" style="width:120px">
<div style="margin-top:16px;display:flex;gap:10px;align-items:center;flex-wrap:wrap">
<button type="submit" class="pg-btn"><?= svg_icon('disk', '', 16) ?> <?= htmlspecialchars(t('admin.settings.consent_log.save_button')) ?></button>
<?php if (!empty($project['consent_logging_enabled'])): ?>
<a href="/admin/consent-log?project_id=<?= $project['id'] ?>" class="pg-btn-secondary"><?= svg_icon('shield', '', 14) ?> <?= htmlspecialchars(t('admin.settings.consent_log.view_link')) ?></a>
<?php endif; ?>
</div>
</form>
</div>
<div class="pg-card pg-card-pad">
<h2><?= htmlspecialchars(t('admin.settings.email.heading')) ?></h2>
<p class="pg-card-sub" style="margin-bottom:16px"><?= htmlspecialchars(t('admin.settings.email.subtitle')) ?></p>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="save_email">
<div class="grid">
<div>
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.email.smtp_host_label')) ?></label>
<input type="text" name="smtp_host" value="<?= htmlspecialchars($project['smtp_host'] ?? '') ?>" placeholder="z. B. mail.deinefirma.de" style="width:100%">
</div>
<div>
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.email.port_encryption_label')) ?></label>
<div style="display:flex;gap:8px">
<input type="number" name="smtp_port" value="<?= htmlspecialchars((string)($project['smtp_port'] ?? 587)) ?>" style="width:90px">
<select name="smtp_secure" style="flex:1">
<option value="tls" <?= ($project['smtp_secure'] ?? 'tls') === 'tls' ? 'selected' : '' ?>><?= htmlspecialchars(t('admin.settings.email.tls_option')) ?></option>
<option value="ssl" <?= ($project['smtp_secure'] ?? '') === 'ssl' ? 'selected' : '' ?>><?= htmlspecialchars(t('admin.settings.email.ssl_option')) ?></option>
<option value="none" <?= ($project['smtp_secure'] ?? '') === 'none' ? 'selected' : '' ?>><?= htmlspecialchars(t('admin.settings.email.none_option')) ?></option>
</select>
</div>
</div>
</div>
<div class="grid">
<div>
<label class="pg-label"><?= htmlspecialchars(t('admin.settings.email.username_label')) ?></label>
<input type="text" name="smtp_user" value="<?= htmlspecialchars($project['smtp_user'] ?? '') ?>" placeholder="absender@deinedomain.de" style="width:100%">
</div>
<div>
<label class="pg-label"><?= htmlspecialchars(t('admin.settings.email.password_label')) ?></label>
<input type="password" name="smtp_pass" value="" placeholder="<?= htmlspecialchars(!empty($project['smtp_pass']) ? t('admin.common.secret_already_set') : t('admin.settings.email.password_placeholder')) ?>" autocomplete="new-password" style="width:100%">
</div>
</div>
<div class="grid">
<div>
<label class="pg-label"><?= htmlspecialchars(t('admin.settings.email.sender_label')) ?></label>
<input type="email" name="smtp_from" value="<?= htmlspecialchars($project['smtp_from'] ?? '') ?>" placeholder="legal@deinefirma.de" style="width:100%">
</div>
<div>
<label class="pg-label"><?= htmlspecialchars(t('admin.settings.email.recipient_label')) ?></label>
<input type="email" name="audit_email_recipient" value="<?= htmlspecialchars($project['audit_email_recipient'] ?? '') ?>" placeholder="deine-mail@domain.de" style="width:100%">
</div>
</div>
<div style="margin-top:16px;display:flex;gap:10px;align-items:center;flex-wrap:wrap">
<button type="submit" class="pg-btn-secondary"><?= svg_icon('disk', '', 14) ?> <?= htmlspecialchars(t('admin.settings.email.save_button')) ?></button>
<?php if (!empty($project['smtp_host'])): ?>
<button type="button" class="btn-test" onclick="triggerTestMail()"><?= svg_icon('mail', '', 14) ?> <?= htmlspecialchars(t('admin.settings.email.send_test_button')) ?></button>
<?php endif; ?>
</div>
</form>
</div>
<div class="pg-card pg-card-pad">
<h2><?= htmlspecialchars(t('admin.settings.webhooks.heading')) ?></h2>
<p class="pg-card-sub" style="margin-bottom:16px"><?= htmlspecialchars(t('admin.settings.webhooks.subtitle')) ?></p>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="save_webhook">
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.webhooks.url_label')) ?><?= help_icon(t('admin.settings.webhooks.url_help')) ?></label>
<input type="text" name="webhook_url" value="<?= htmlspecialchars($project['webhook_url'] ?? '') ?>" placeholder="https://app.deinefirma.de/api/legal-webhook" style="width:100%;margin-bottom:14px">
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.webhooks.secret_label')) ?> <span style="color:var(--text-faint);font-weight:400"><?= htmlspecialchars(t('admin.settings.webhooks.secret_hint')) ?></span><?= help_icon(t('admin.settings.webhooks.secret_help')) ?></label>
<input type="text" name="webhook_secret" value="" placeholder="<?= htmlspecialchars(!empty($project['webhook_secret']) ? t('admin.common.secret_already_set') : t('admin.settings.webhooks.secret_placeholder')) ?>" style="width:100%;margin-bottom:14px">
<div style="display:flex;gap:10px;align-items:center;flex-wrap:wrap;margin-bottom:16px">
<button type="submit" class="pg-btn-secondary"><?= svg_icon('disk', '', 14) ?> <?= htmlspecialchars(t('admin.settings.webhooks.save_button')) ?></button>
<?php if (!empty($project['webhook_url'])): ?>
<button type="button" class="btn-test" onclick="triggerTestWebhook()"><?= svg_icon('lightning', '', 14) ?> <?= htmlspecialchars(t('admin.settings.webhooks.test_button')) ?></button>
<?php endif; ?>
</div>
<div style="border-top:1px solid var(--border-soft);padding-top:16px">
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.webhooks.deepl_label')) ?> <span style="color:var(--text-faint);font-weight:400"><?= htmlspecialchars(t('admin.settings.webhooks.deepl_hint')) ?></span></label>
<input type="text" name="deepl_api_key" value="" placeholder="<?= !empty($project['deepl_api_key']) ? htmlspecialchars(t('admin.common.secret_already_set')) : 'z. B. xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx:fx' ?>" style="width:100%">
<?php if (!empty($envDeepl)): ?>
<div class="pg-hint" style="color:var(--green)"><?= htmlspecialchars(t('admin.settings.webhooks.deepl_env_hint')) ?></div>
<?php else: ?>
<div class="pg-hint"><?= t('admin.settings.webhooks.deepl_keys_hint') ?></div>
<?php endif; ?>
</div>
<div style="border-top:1px solid var(--border-soft);padding-top:16px;margin-top:16px">
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.ai_import.heading')) ?> <span class="beta-badge-inline"><?= htmlspecialchars(t('admin.settings.ai_import.beta_label')) ?></span></label>
<p class="pg-hint" style="margin-top:0;margin-bottom:10px"><?= t('admin.settings.ai_import.subtitle') ?></p>
<select name="ai_provider" style="width:100%;margin-bottom:10px">
<option value="" <?= empty($project['ai_provider']) ? 'selected' : '' ?>><?= htmlspecialchars(t('admin.settings.ai_import.provider_none')) ?></option>
<option value="claude" <?= ($project['ai_provider'] ?? '') === 'claude' ? 'selected' : '' ?>><?= htmlspecialchars(t('admin.settings.ai_import.provider_claude')) ?></option>
<option value="openai" <?= ($project['ai_provider'] ?? '') === 'openai' ? 'selected' : '' ?>><?= htmlspecialchars(t('admin.settings.ai_import.provider_openai')) ?></option>
</select>
<input type="password" name="ai_api_key" value="" placeholder="<?= htmlspecialchars(!empty($project['ai_api_key']) ? t('admin.common.secret_already_set') : t('admin.settings.ai_import.key_placeholder')) ?>" style="width:100%" autocomplete="new-password">
<?php if (!empty($envAiKey)): ?>
<div class="pg-hint" style="color:var(--green)"><?= htmlspecialchars(t('admin.settings.ai_import.env_hint')) ?></div>
<?php endif; ?>
</div>
</form>
</div>
<div class="pg-card pg-card-pad">
<h2><?= htmlspecialchars(t('admin.settings.company.heading')) ?></h2>
<p class="pg-card-sub" style="margin-bottom:16px"><?= t('admin.settings.company.subtitle') ?></p>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="save_company">
<div class="grid">
<div>
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.company.name_label')) ?></label>
<input type="text" name="company_name" value="<?= htmlspecialchars($project['company_name'] ?? '') ?>" style="width:100%">
</div>
<div>
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.company.representative_label')) ?></label>
<input type="text" name="representative" value="<?= htmlspecialchars($project['representative'] ?? '') ?>" style="width:100%">
</div>
<div style="grid-column:1/-1">
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.company.address_label')) ?></label>
<textarea name="address" rows="2" style="width:100%"><?= htmlspecialchars($project['address'] ?? '') ?></textarea>
</div>
<div>
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.company.email_label')) ?></label>
<input type="text" name="email" value="<?= htmlspecialchars($project['email'] ?? '') ?>" style="width:100%">
</div>
<div>
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.company.phone_label')) ?></label>
<input type="text" name="phone" value="<?= htmlspecialchars($project['phone'] ?? '') ?>" style="width:100%">
</div>
<div style="grid-column:1/-1">
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.settings.company.register_label')) ?></label>
<input type="text" name="register_info" value="<?= htmlspecialchars($project['register_info'] ?? '') ?>" style="width:100%">
</div>
</div>
<div style="display:flex;justify-content:space-between;align-items:center;margin-top:18px">
<button type="submit" class="pg-btn"><?= svg_icon('disk', '', 16) ?> <?= htmlspecialchars(t('admin.settings.company.save_button')) ?></button>
<?php if (count($projects) > 1): ?>
<button type="button" class="pg-btn-danger" onclick="document.getElementById('deleteProjectForm').submit()"><?= htmlspecialchars(t('admin.settings.company.delete_project_button')) ?></button>
<?php endif; ?>
</div>
</form>
<?php if (count($projects) > 1): ?>
<form id="deleteProjectForm" method="post" onsubmit="return confirm('<?= htmlspecialchars(t('admin.settings.company.confirm_delete_project', ['project' => $project['name']]), ENT_QUOTES) ?>');" style="display:none">
<?= csrf_field() ?>
<input type="hidden" name="action" value="delete_project">
<input type="hidden" name="delete_project_id" value="<?= $project['id'] ?>">
</form>
<?php endif; ?>
</div>
<!-- Sicherung & Export -->
<div class="pg-card pg-card-pad">
<h2><?= htmlspecialchars(t('admin.settings.backup.heading')) ?></h2>
<p class="pg-card-sub" style="margin-bottom:14px"><?= htmlspecialchars(t('admin.settings.backup.subtitle')) ?></p>
<div style="display:flex;gap:10px;flex-wrap:wrap">
<a href="/admin?action=download_backup" class="pg-btn-secondary"><?= svg_icon('disk', '', 14) ?> <?= htmlspecialchars(t('admin.settings.backup.download_button')) ?></a>
<a href="/admin?action=export_markdown" class="pg-btn-secondary"><?= svg_icon('folder', '', 14) ?> <?= htmlspecialchars(t('admin.settings.backup.export_button')) ?></a>
<button type="button" class="pg-btn-secondary" onclick="triggerAuditReport()"><?= svg_icon('mail', '', 14) ?> <?= htmlspecialchars(t('admin.settings.backup.audit_report_button')) ?></button>
</div>
<div style="border-top:1px solid var(--border-soft);margin-top:20px;padding-top:16px">
<div style="display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap;margin-bottom:4px">
<h2 style="margin:0;font-size:14px"><?= htmlspecialchars(t('admin.settings.backup.auto_heading')) ?><?= help_icon(t('admin.settings.backup.auto_help')) ?></h2>
<form method="post" style="margin:0">
<?= csrf_field() ?>
<input type="hidden" name="action" value="run_backup_now">
<button type="submit" class="pg-btn-secondary" style="padding:6px 12px;font-size:12px"><?= htmlspecialchars(t('admin.settings.backup.run_now_button')) ?></button>
</form>
</div>
<?php if ($backupMsg === 'backup_created'): ?>
<p style="font-size:12px;color:var(--green);margin:4px 0 10px"><?= htmlspecialchars(t('admin.settings.backup.created_msg')) ?></p>
<?php elseif ($backupMsg === 'backup_failed'): ?>
<p style="font-size:12px;color:var(--red);margin:4px 0 10px"><?= htmlspecialchars(t('admin.settings.backup.failed_msg')) ?></p>
<?php endif; ?>
<?php if ($isManagedCloud): ?>
<p class="pg-card-sub" style="margin:0 0 10px"><?= htmlspecialchars(t('admin.settings.backup.cloud_hint')) ?></p>
<?php else: ?>
<p class="pg-card-sub" style="margin:0 0 10px"><?= htmlspecialchars(t('admin.settings.backup.manual_hint')) ?></p>
<?php endif; ?>
<?php if (empty($backups)): ?>
<div style="color:var(--text-faint);font-size:13px;font-style:italic"><?= htmlspecialchars(t('admin.settings.backup.empty')) ?></div>
<?php else: ?>
<table class="pg-table" style="border:1px solid var(--border);border-radius:var(--radius);overflow:hidden">
<thead>
<tr>
<th><?= htmlspecialchars(t('admin.settings.backup.col_created')) ?></th>
<th><?= htmlspecialchars(t('admin.settings.backup.col_size')) ?></th>
<th style="width:110px"></th>
</tr>
</thead>
<tbody>
<?php foreach ($backups as $b): ?>
<tr>
<td style="color:var(--text-muted)"><?= date('d.m.Y H:i', $b['created_at']) ?></td>
<td style="color:var(--text-muted)"><?= round($b['size'] / 1024 / 1024, 2) ?> MB</td>
<td><a href="/admin?action=download_backup_file&file=<?= urlencode($b['filename']) ?>" class="pg-btn-secondary" style="padding:4px 10px;font-size:12px"><?= htmlspecialchars(t('admin.settings.backup.download_link')) ?></a></td>
</tr>
<?php endforeach; ?>
</tbody>
</table>
<?php endif; ?>
</div>
<div style="border-top:1px solid var(--border-soft);margin-top:20px;padding-top:16px">
<h2 style="margin:0 0 4px;font-size:14px"><?= htmlspecialchars(t('admin.settings.restore.heading')) ?><?= help_icon(t('admin.settings.restore.help')) ?></h2>
<?php if ($backupMsg === 'restore_success'): ?>
<p style="font-size:12px;color:var(--green);margin:4px 0 10px"><?= htmlspecialchars(t('admin.settings.restore.success_msg', ['count' => (int)($_GET['restore_count'] ?? 0)])) ?></p>
<?php if (!empty($_GET['restore_over_limit'])): ?>
<div class="pg-alert pg-alert-amber" style="margin-bottom:12px;font-size:12.5px">
<?= htmlspecialchars(t('admin.settings.restore.over_limit_warning', ['count' => (int)($_GET['restore_count'] ?? 0), 'limit' => (int)($_GET['restore_limit'] ?? 0)])) ?>
</div>
<?php endif; ?>
<?php elseif ($backupMsg === 'restore_failed'): ?>
<p style="font-size:12px;color:var(--red);margin:4px 0 10px"><?= htmlspecialchars(t('admin.settings.restore.error_msg', ['error' => $_GET['restore_error'] ?? ''])) ?></p>
<?php endif; ?>
<div class="pg-alert pg-alert-red" style="margin-bottom:12px;font-size:12.5px">
<?= htmlspecialchars(t('admin.settings.restore.warning')) ?>
<?php if ($isManagedCloud): ?> <?= htmlspecialchars(t('admin.settings.restore.warning_cloud_domain')) ?><?php endif; ?>
</div>
<form method="post" enctype="multipart/form-data" id="restoreForm" onsubmit="return confirm(<?= json_encode(t('admin.settings.restore.confirm_dialog')) ?>);">
<?= csrf_field() ?>
<input type="hidden" name="action" value="restore_backup_upload">
<input type="file" name="backup_file" accept=".sqlite" required style="width:100%;margin-bottom:10px">
<label style="display:flex;align-items:flex-start;gap:8px;font-size:12.5px;font-weight:500;margin-bottom:12px">
<input type="checkbox" id="restoreConfirmCheckbox" onchange="document.getElementById('restoreSubmitBtn').disabled = !this.checked" style="margin-top:2px">
<?= htmlspecialchars(t('admin.settings.restore.confirm_checkbox')) ?>
</label>
<button type="submit" id="restoreSubmitBtn" class="pg-btn-secondary" disabled style="border-color:var(--red);color:var(--red)"><?= svg_icon('sync', '', 14) ?> <?= htmlspecialchars(t('admin.settings.restore.submit_button')) ?></button>
</form>
</div>
<div style="border-top:1px solid var(--border-soft);margin-top:20px;padding-top:16px">
<h2 style="margin:0 0 4px;font-size:14px"><?= htmlspecialchars(t('admin.settings.project_transfer.heading')) ?><?= help_icon(t('admin.settings.project_transfer.help')) ?></h2>
<p class="pg-card-sub" style="margin:0 0 12px"><?= htmlspecialchars(t('admin.settings.project_transfer.subtitle')) ?></p>
<div style="display:flex;gap:10px;flex-wrap:wrap;margin-bottom:16px">
<a href="/admin?action=export_project&project_id=<?= (int)$project['id'] ?>" class="pg-btn-secondary"><?= svg_icon('folder', '', 14) ?> <?= htmlspecialchars(t('admin.settings.project_transfer.export_button')) ?></a>
</div>
<?php if ($backupMsg === 'project_import_success'): ?>
<p style="font-size:12px;color:var(--green);margin:4px 0 10px"><?= htmlspecialchars(t('admin.settings.project_transfer.import_merged_msg', ['count' => (int)($_GET['import_docs'] ?? 0)])) ?></p>
<?php elseif ($backupMsg === 'project_import_failed'): ?>
<p style="font-size:12px;color:var(--red);margin:4px 0 10px"><?= htmlspecialchars(t('admin.settings.project_transfer.import_error_msg', ['error' => $_GET['import_error'] ?? ''])) ?></p>
<?php endif; ?>
<div class="pg-alert pg-alert-amber" style="margin-bottom:12px;font-size:12.5px">
<?= htmlspecialchars(t('admin.settings.project_transfer.import_warning')) ?>
</div>
<form method="post" enctype="multipart/form-data" id="projectImportForm" onsubmit="return confirm(<?= json_encode(t('admin.settings.project_transfer.confirm_dialog')) ?>);">
<?= csrf_field() ?>
<input type="hidden" name="action" value="import_project_upload">
<label class="pg-label" style="margin-top:0;font-size:12.5px"><?= htmlspecialchars(t('admin.settings.project_transfer.target_label')) ?></label>
<select name="target_project_id" required style="width:100%;margin-bottom:10px">
<?php foreach ($projects as $p): ?>
<option value="<?= $p['id'] ?>" <?= (int)$p['id'] === (int)$project['id'] ? 'selected' : '' ?>><?= htmlspecialchars($p['name']) ?> (<?= htmlspecialchars($p['domain']) ?>)</option>
<?php endforeach; ?>
</select>
<input type="file" name="project_file" accept=".sqlite" required style="width:100%;margin-bottom:10px">
<label style="display:flex;align-items:flex-start;gap:8px;font-size:12.5px;font-weight:500;margin-bottom:12px">
<input type="checkbox" id="projectImportConfirmCheckbox" onchange="document.getElementById('projectImportSubmitBtn').disabled = !this.checked" style="margin-top:2px">
<?= htmlspecialchars(t('admin.settings.project_transfer.confirm_checkbox')) ?>
</label>
<button type="submit" id="projectImportSubmitBtn" class="pg-btn-secondary" disabled><?= svg_icon('sync', '', 14) ?> <?= htmlspecialchars(t('admin.settings.project_transfer.submit_button')) ?></button>
</form>
</div>
</div>
<!-- Webhook-Warteschlange -->
<div class="pg-card pg-card-pad">
<div style="display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap;margin-bottom:4px">
<h2 style="margin:0"><?= htmlspecialchars(t('admin.settings.queue.heading')) ?><?= help_icon(t('admin.settings.queue.help')) ?></h2>
<form method="post" style="margin:0">
<?= csrf_field() ?>
<input type="hidden" name="action" value="run_webhook_queue_now">
<button type="submit" class="pg-btn-secondary" style="padding:6px 12px;font-size:12px"><?= htmlspecialchars(t('admin.settings.queue.run_now_button')) ?></button>
</form>
</div>
<?php if (($_GET['msg'] ?? '') === 'queue_processed'): ?>
<p style="font-size:12px;color:var(--green);margin:4px 0 10px"><?= htmlspecialchars(t('admin.settings.queue.processed_msg')) ?></p>
<?php endif; ?>
<div style="display:flex;gap:10px;flex-wrap:wrap">
<span class="pg-pill pg-pill-amber"><span class="pg-pill-dot"></span><?= htmlspecialchars(t('admin.settings.queue.pending', ['count' => $queueSummary['pending']])) ?></span>
<span class="pg-pill pg-pill-green"><span class="pg-pill-dot"></span><?= htmlspecialchars(t('admin.settings.queue.sent', ['count' => $queueSummary['sent']])) ?></span>
<?php if ($queueSummary['failed'] > 0): ?>
<span class="pg-pill pg-pill-red"><span class="pg-pill-dot"></span><?= htmlspecialchars(t('admin.settings.queue.failed', ['count' => $queueSummary['failed']])) ?></span>
<?php endif; ?>
</div>
</div>
<!-- Webhook Protokoll & Delivery Logs -->
<div class="pg-card pg-card-pad" style="margin-bottom:0">
<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:4px">
<h2 style="margin:0"><?= htmlspecialchars(t('admin.settings.log.heading')) ?></h2>
<?php if (!empty($logs)): ?>
<form method="post" style="margin:0;">
<?= csrf_field() ?>
<input type="hidden" name="action" value="clear_webhook_logs">
<button type="submit" class="pg-btn-secondary" style="padding:6px 12px;font-size:12px"><?= htmlspecialchars(t('admin.settings.log.clear_button')) ?></button>
</form>
<?php endif; ?>
</div>
<p class="pg-card-sub" style="margin-bottom:14px"><?= htmlspecialchars(t('admin.settings.log.subtitle')) ?></p>
<?php if (empty($logs)): ?>
<div style="color:var(--text-faint);font-size:13px;font-style:italic;padding:1rem 0;"><?= htmlspecialchars(t('admin.settings.log.empty')) ?></div>
<?php else: ?>
<table class="log-table">
<thead>
<tr>
<th><?= htmlspecialchars(t('admin.settings.log.col_time')) ?></th>
<th><?= htmlspecialchars(t('admin.settings.log.col_event')) ?></th>
<th><?= htmlspecialchars(t('admin.settings.log.col_status')) ?></th>
<th><?= htmlspecialchars(t('admin.settings.log.col_latency')) ?></th>
<th><?= htmlspecialchars(t('admin.settings.log.col_response')) ?></th>
</tr>
</thead>
<tbody>
<?php foreach ($logs as $l): ?>
<?php $isSuccess = ($l['status_code'] >= 200 && $l['status_code'] < 300); ?>
<tr>
<td style="color:var(--text-muted)"><?= date('d.m. H:i:s', strtotime($l['created_at'])) ?></td>
<td style="font-weight:500"><?= htmlspecialchars($l['event_name']) ?></td>
<td>
<span class="status-badge <?= $isSuccess ? 'status-200' : 'status-err' ?>">
<?= $l['status_code'] ?: 'ERR' ?>
</span>
</td>
<td style="color:var(--text-muted)"><?= $l['duration_ms'] ?> ms</td>
<td>
<?php if (!empty($l['error_message'])): ?>
<span style="color:var(--red);font-weight:600;"><?= htmlspecialchars($l['error_message']) ?></span>
<?php elseif (!empty($l['response_body'])): ?>
<div class="payload-preview" title="<?= htmlspecialchars($l['response_body']) ?>">
<?= htmlspecialchars($l['response_body']) ?>
</div>
<?php else: ?>
<span style="color:var(--text-faint);font-style:italic;"><?= htmlspecialchars(t('admin.settings.log.empty_response')) ?></span>
<?php endif; ?>
</td>
</tr>
<?php endforeach; ?>
</tbody>
</table>
<?php endif; ?>
</div>
</div>
<div class="pg-footer-note"><?= htmlspecialchars(t('admin.common.footer_disclaimer')) ?></div>
</div>
</div>
<div id="toastNotification" class="pg-toast">
<?= svg_icon('check', '', 16) ?> <span id="toastMsg"><?= htmlspecialchars(t('admin.settings.js.copy_success')) ?></span>
</div>
<script>
const CSRF_TOKEN = <?= json_encode(csrf_token()) ?>;
const i18n = {
copySuccess: <?= json_encode(t('admin.settings.js.copy_success')) ?>,
copyFailed: <?= json_encode(t('admin.matrix.js.copy_failed')) ?>,
auditReportSent: <?= json_encode(t('admin.settings.js.audit_report_sent')) ?>,
errorPrefix: <?= json_encode(t('admin.settings.js.error_prefix')) ?>,
auditReportFailed: <?= json_encode(t('admin.settings.js.audit_report_failed')) ?>,
webhookSuccessTemplate: <?= json_encode(t('admin.settings.js.webhook_success')) ?>,
webhookFailureTemplate: <?= json_encode(t('admin.settings.js.webhook_failure')) ?>,
emptyParen: <?= json_encode(t('admin.settings.js.empty_paren')) ?>,
unknownError: <?= json_encode(t('admin.settings.js.unknown_error')) ?>,
networkErrorPrefix: <?= json_encode(t('admin.settings.js.network_error_prefix')) ?>,
smtpTestSuccess: <?= json_encode(t('admin.settings.js.smtp_test_success')) ?>,
smtpTestFailed: <?= json_encode(t('admin.settings.js.smtp_test_failed')) ?>
};
function showToast(msg) {
const toast = document.getElementById('toastNotification');
document.getElementById('toastMsg').innerText = msg;
toast.classList.add('show');
setTimeout(() => { toast.classList.remove('show'); }, 2500);
}
function copyToClipboard(text, successMsg = i18n.copySuccess) {
if (navigator.clipboard && window.isSecureContext) {
navigator.clipboard.writeText(text).then(() => {
showToast(successMsg);
}).catch(() => {
fallbackCopy(text, successMsg);
});
} else {
fallbackCopy(text, successMsg);
}
}
function fallbackCopy(text, successMsg) {
const textArea = document.createElement("textarea");
textArea.value = text;
textArea.style.position = "fixed";
textArea.style.left = "-999999px";
document.body.appendChild(textArea);
textArea.focus();
textArea.select();
try {
document.execCommand('copy');
showToast(successMsg);
} catch (err) {
alert(i18n.copyFailed);
}
document.body.removeChild(textArea);
}
(function() {
const THEME_KEY = 'paragrafy_theme';
const toggle = document.getElementById('themeToggle');
const current = localStorage.getItem(THEME_KEY) || 'auto';
function applyActive(choice) {
toggle.querySelectorAll('button').forEach(function(btn) {
btn.classList.toggle('active', btn.dataset.themeChoice === choice);
});
}
applyActive(current);
toggle.querySelectorAll('button').forEach(function(btn) {
btn.addEventListener('click', function() {
const choice = btn.dataset.themeChoice;
try { localStorage.setItem(THEME_KEY, choice); } catch (e) {}
if (choice === 'auto') {
document.documentElement.removeAttribute('data-theme');
} else {
document.documentElement.setAttribute('data-theme', choice);
}
applyActive(choice);
});
});
})();
async function triggerAuditReport() {
try {
const res = await fetch('/api/cron/audit');
const data = await res.json();
if (data.success) {
alert(data.message || i18n.auditReportSent);
} else {
alert(i18n.errorPrefix + (data.error || i18n.auditReportFailed));
}
} catch (e) {
alert(i18n.errorPrefix + e.message);
}
}
async function triggerTestWebhook() {
const formData = new FormData();
formData.append('action', 'test_webhook');
formData.append('csrf_token', CSRF_TOKEN);
try {
const res = await fetch(window.location.href, { method: 'POST', body: formData });
const data = await res.json();
if (data.success) {
alert(i18n.webhookSuccessTemplate.replace(':status', data.status_code).replace(':duration', data.duration_ms).replace(':response', data.response || i18n.emptyParen));
location.reload();
} else {
alert(i18n.webhookFailureTemplate.replace(':status', data.status_code).replace(':error', data.error || i18n.unknownError).replace(':response', data.response || i18n.emptyParen));
location.reload();
}
} catch (e) {
alert(i18n.networkErrorPrefix + e.message);
}
}
async function triggerTestMail() {
const formData = new FormData();
formData.append('action', 'test_smtp');
formData.append('csrf_token', CSRF_TOKEN);
try {
const res = await fetch(window.location.href, { method: 'POST', body: formData });
const data = await res.json();
if (data.success) {
alert(i18n.smtpTestSuccess);
} else {
alert(i18n.errorPrefix + (data.error || i18n.smtpTestFailed));
}
} catch (e) {
alert(i18n.networkErrorPrefix + e.message);
}
}
</script>
</body>
</html>
<?php
}
function render_security_view(PDO $db, array $project, array $projects): void {
$identity = totp_current_identity($db);
$enabled = $identity !== null && totp_identity_enabled($identity);
$setupState = $_SESSION['totp_setup'] ?? null;
$pendingSecret = is_array($setupState) && isset($setupState['secret']) ? $setupState['secret'] : null;
$recoveryCodesToShow = is_array($setupState) && isset($setupState['recovery_codes']) ? $setupState['recovery_codes'] : null;
$msg = $_GET['msg'] ?? '';
$msgMap = [
'totp_setup_invalid_code' => ['err', t('admin.security.msg.invalid_code')],
'totp_enabled' => ['ok', t('admin.security.msg.enabled')],
'totp_disabled' => ['ok', t('admin.security.msg.disabled')],
'totp_disable_wrong_password' => ['err', t('admin.security.msg.wrong_password')],
'totp_setup_persist_failed' => ['err', t('admin.security.msg.persist_failed')],
];
$qrDataUri = null;
$provisioningUri = null;
if ($pendingSecret !== null && $identity !== null) {
$provisioningUri = totp_provisioning_uri($pendingSecret, totp_identity_label($identity, $project), totp_identity_issuer($identity, $project));
$qrDataUri = totp_qr_data_uri($provisioningUri);
}
?>
<!DOCTYPE html>
<html lang="<?= htmlspecialchars(current_locale()) ?>">
<head>
<meta charset="utf-8"><title><?= htmlspecialchars(t('admin.security.page_title', ['project' => $project['name']])) ?></title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/svg+xml" href="/paragrafy.svg">
<?= theme_head_tags_admin() ?>
<?= theme_base_css_admin($project['brand_color'] ?: '#F0A63C') ?>
<style>
.recovery-codes { font-family:'JetBrains Mono',monospace; font-size:14px; line-height:2; background:var(--bg); border:1px solid var(--border); border-radius:var(--radius); padding:14px 18px; display:grid; grid-template-columns:1fr 1fr; gap:2px 20px; }
</style>
</head>
<body>
<div class="pg-shell">
<?= render_sidebar('security', $project, $projects) ?>
<div class="pg-main">
<div class="pg-topbar">
<div class="pg-crumb"><?= htmlspecialchars($project['name']) ?> <span style="margin:0 4px">/</span> <strong><?= htmlspecialchars(t('admin.security.crumb')) ?></strong></div>
</div>
<div class="pg-content" style="max-width:640px">
<?php if ($msg && isset($msgMap[$msg])): ?>
<div class="pg-alert <?= $msgMap[$msg][0] === 'ok' ? 'pg-alert-amber' : 'pg-alert-red' ?>" style="<?= $msgMap[$msg][0] === 'ok' ? 'background:var(--green-bg);border-color:#bfe6cf;color:#125c3a' : '' ?>">
<div><?= htmlspecialchars($msgMap[$msg][1]) ?></div>
</div>
<?php endif; ?>
<div class="pg-card pg-card-pad">
<h2 style="margin:0 0 4px"><?= htmlspecialchars(t('admin.security.heading')) ?></h2>
<p class="pg-card-sub" style="margin-bottom:20px"><?= htmlspecialchars(t('admin.security.subtitle')) ?></p>
<?php if ($identity === null): ?>
<p style="font-size:13px;color:var(--text-muted)"><?= htmlspecialchars(t('admin.security.unavailable_managed_cloud')) ?></p>
<?php elseif (!totp_vendor_available()): ?>
<p style="font-size:13px;color:var(--text-muted)"><?= htmlspecialchars(t('admin.security.vendor_missing')) ?></p>
<?php elseif ($recoveryCodesToShow !== null): ?>
<p style="font-size:13px;color:var(--text-muted);margin-bottom:12px"><?= htmlspecialchars(t('admin.security.recovery.intro')) ?></p>
<div class="recovery-codes">
<?php foreach ($recoveryCodesToShow as $code): ?>
<div><?= htmlspecialchars($code) ?></div>
<?php endforeach; ?>
</div>
<form method="post" style="margin-top:18px">
<?= csrf_field() ?>
<input type="hidden" name="action" value="totp_setup_ack">
<label style="display:flex;align-items:flex-start;gap:8px;font-size:13px;color:var(--text-muted);margin-bottom:14px">
<input type="checkbox" required style="margin-top:3px">
<?= htmlspecialchars(t('admin.security.recovery.saved_checkbox')) ?>
</label>
<button type="submit" class="pg-btn"><?= htmlspecialchars(t('admin.security.recovery.continue_button')) ?></button>
</form>
<?php elseif ($pendingSecret !== null): ?>
<p style="font-size:13px;color:var(--text-muted);margin-bottom:12px"><?= htmlspecialchars(t('admin.security.setup.scan_hint')) ?></p>
<img src="<?= htmlspecialchars($qrDataUri) ?>" alt="QR" width="200" height="200" style="border:1px solid var(--border);border-radius:var(--radius);padding:8px;background:#fff">
<p style="font-size:12px;color:var(--text-faint);margin:12px 0 4px"><?= htmlspecialchars(t('admin.security.setup.manual_entry_hint')) ?></p>
<code style="font-family:'JetBrains Mono',monospace;font-size:13px;background:var(--bg);border:1px solid var(--border);border-radius:6px;padding:6px 10px;display:inline-block"><?= htmlspecialchars($pendingSecret) ?></code>
<form method="post" style="margin-top:20px">
<?= csrf_field() ?>
<input type="hidden" name="action" value="totp_setup_confirm">
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.security.setup.code_label')) ?></label>
<input type="text" name="totp_code" inputmode="numeric" autocomplete="one-time-code" placeholder="123456" autofocus required style="width:100%;margin-bottom:12px;letter-spacing:2px;font-family:'JetBrains Mono',monospace">
<div style="display:flex;gap:10px">
<button type="submit" class="pg-btn"><?= htmlspecialchars(t('admin.security.setup.confirm_button')) ?></button>
<button type="submit" formnovalidate name="action" value="totp_setup_cancel" class="pg-btn-secondary"><?= htmlspecialchars(t('admin.security.setup.cancel_button')) ?></button>
</div>
</form>
<?php elseif ($enabled): ?>
<div style="display:flex;align-items:center;gap:10px;margin-bottom:20px">
<span class="pg-pill pg-pill-green"><span class="pg-pill-dot"></span><?= htmlspecialchars(t('admin.security.status_active')) ?></span>
</div>
<form method="post" style="margin-bottom:22px">
<?= csrf_field() ?>
<input type="hidden" name="action" value="totp_regenerate_codes">
<p style="font-size:12.5px;color:var(--text-faint);margin:0 0 10px"><?= htmlspecialchars(t('admin.security.regenerate.hint')) ?></p>
<button type="submit" class="pg-btn-secondary" onclick="return confirm(<?= json_encode(t('admin.security.regenerate.confirm')) ?>)"><?= htmlspecialchars(t('admin.security.regenerate.button')) ?></button>
</form>
<hr class="pg-sep">
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="totp_disable">
<p style="font-size:12.5px;color:var(--text-faint);margin:0 0 10px"><?= htmlspecialchars(t('admin.security.disable.hint')) ?></p>
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.security.disable.password_label')) ?></label>
<input type="password" name="confirm_password" required style="width:100%;margin-bottom:12px">
<button type="submit" class="pg-btn-secondary danger" onclick="return confirm(<?= json_encode(t('admin.security.disable.confirm')) ?>)"><?= htmlspecialchars(t('admin.security.disable.button')) ?></button>
</form>
<?php else: ?>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="totp_setup_start">
<button type="submit" class="pg-btn"><?= htmlspecialchars(t('admin.security.setup.start_button')) ?></button>
</form>
<?php endif; ?>
</div>
</div>
<div class="pg-footer-note"><?= htmlspecialchars(t('admin.common.footer_disclaimer')) ?></div>
</div>
</div>
</body>
</html>
<?php
}
function render_users_view(PDO $db, array $project, array $projects): void {
$users = $db->query("SELECT * FROM users ORDER BY (status = 'active') DESC, name ASC")->fetchAll();
$accessMap = [];
foreach ($db->query("SELECT user_id, project_id FROM user_projects") as $row) {
$accessMap[(int)$row['user_id']][] = (int)$row['project_id'];
}
$msg = $_GET['msg'] ?? '';
$msgMap = [
'invited' => ['ok', t('admin.users.msg.invited')],
'invite_mail_failed' => ['err', t('admin.users.msg.invite_mail_failed')],
'email_exists' => ['err', t('admin.users.msg.email_exists')],
'invalid' => ['err', t('admin.users.msg.invalid')],
'user_deleted' => ['ok', t('admin.users.msg.user_deleted')],
'managed_cloud_blocked' => ['err', t('admin.users.msg.managed_cloud_blocked')],
'access_updated' => ['ok', t('admin.users.msg.access_updated')],
'totp_reset' => ['ok', t('admin.users.msg.totp_reset')],
];
?>
<!DOCTYPE html>
<html lang="<?= htmlspecialchars(current_locale()) ?>">
<head>
<meta charset="utf-8"><title><?= htmlspecialchars(t('admin.users.page_title', ['project' => $project['name']])) ?></title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/svg+xml" href="/paragrafy.svg">
<?= theme_head_tags_admin() ?>
<?= theme_base_css_admin($project['brand_color'] ?: '#F0A63C') ?>
<style>
.users-table th { text-align:left; }
</style>
</head>
<body>
<div class="pg-shell">
<?= render_sidebar('users', $project, $projects) ?>
<div class="pg-main">
<div class="pg-topbar">
<div class="pg-crumb"><?= htmlspecialchars($project['name']) ?> <span style="margin:0 4px">/</span> <strong><?= htmlspecialchars(t('admin.users.crumb')) ?></strong></div>
</div>
<div class="pg-content" style="max-width:840px">
<?php if ($msg && isset($msgMap[$msg])): ?>
<div class="pg-alert <?= $msgMap[$msg][0] === 'ok' ? 'pg-alert-amber' : 'pg-alert-red' ?>" style="<?= $msgMap[$msg][0] === 'ok' ? 'background:var(--green-bg);border-color:#bfe6cf;color:#125c3a' : '' ?>">
<div><?= htmlspecialchars($msgMap[$msg][1]) ?></div>
</div>
<?php endif; ?>
<div class="pg-card pg-card-pad">
<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:4px">
<h2 style="margin:0"><?= htmlspecialchars(t('admin.users.heading')) ?></h2>
<button type="button" class="pg-btn" style="padding:8px 14px;font-size:12.5px" onclick="openInviteModal()"><?= htmlspecialchars(t('admin.users.invite_button')) ?></button>
</div>
<p class="pg-card-sub" style="margin-bottom:16px"><?= htmlspecialchars(t('admin.users.subtitle')) ?></p>
<p class="pg-card-sub" style="margin:-4px 0 14px;font-size:12px"><?= htmlspecialchars(t('admin.users.access.hint')) ?></p>
<div style="overflow-x:auto">
<table class="pg-table users-table" style="border:1px solid var(--border);border-radius:var(--radius);overflow:hidden">
<thead>
<tr>
<th><?= htmlspecialchars(t('admin.users.col_name')) ?></th>
<th><?= htmlspecialchars(t('admin.users.col_email')) ?></th>
<th><?= htmlspecialchars(t('admin.users.col_notes')) ?></th>
<th><?= htmlspecialchars(t('admin.users.col_status')) ?></th>
<th style="text-align:center"><?= htmlspecialchars(t('admin.users.col_totp')) ?></th>
<?php foreach ($projects as $p): ?>
<th style="text-align:center;white-space:nowrap"><?= htmlspecialchars($p['name']) ?></th>
<?php endforeach; ?>
<th style="width:120px"></th>
</tr>
</thead>
<tbody>
<?php if (empty($users)): ?>
<tr><td colspan="<?= 6 + count($projects) ?>" style="color:var(--text-faint);font-style:italic"><?= htmlspecialchars(t('admin.users.empty')) ?></td></tr>
<?php endif; ?>
<?php foreach ($users as $u): ?>
<?php
$isSelf = (int)$u['id'] === (int)($_SESSION['paragrafy_user_id'] ?? 0);
$userProjectIds = $accessMap[(int)$u['id']] ?? [];
$formId = 'uf-' . (int)$u['id'];
?>
<tr>
<td style="font-weight:600"><?= htmlspecialchars($u['name']) ?><?= $isSelf ? ' <span style="color:var(--text-faint);font-weight:500">' . htmlspecialchars(t('admin.users.you_suffix')) . '</span>' : '' ?></td>
<td style="color:var(--text-muted)"><?= htmlspecialchars($u['email']) ?></td>
<td style="color:var(--text-muted)"><?= htmlspecialchars($u['notes'] ?? '') ?></td>
<td>
<?php if ($u['status'] === 'active'): ?>
<span class="pg-pill pg-pill-green"><span class="pg-pill-dot"></span><?= htmlspecialchars(t('admin.users.status_active')) ?></span>
<?php else: ?>
<span class="pg-pill pg-pill-muted"><?= htmlspecialchars(t('admin.users.status_invited')) ?></span>
<?php endif; ?>
</td>
<td style="text-align:center">
<?php if (!empty($u['totp_enabled_at'])): ?>
<form method="post" style="margin:0" onsubmit="return confirm('<?= htmlspecialchars(t('admin.users.confirm_totp_reset', ['name' => $u['name']]), ENT_QUOTES) ?>');">
<?= csrf_field() ?>
<input type="hidden" name="action" value="reset_user_totp">
<input type="hidden" name="user_id" value="<?= $u['id'] ?>">
<button type="submit" class="pg-icon-btn" title="<?= htmlspecialchars(t('admin.users.totp_reset_title')) ?>">
<span class="pg-pill pg-pill-green" style="cursor:pointer"><span class="pg-pill-dot"></span><?= htmlspecialchars(t('admin.security.status_active')) ?></span>
</button>
</form>
<?php else: ?>
<span style="color:var(--text-faintest)">—</span>
<?php endif; ?>
</td>
<?php foreach ($projects as $p): ?>
<td style="text-align:center">
<input type="checkbox" form="<?= $formId ?>" name="project_ids[]" value="<?= (int)$p['id'] ?>" <?= in_array((int)$p['id'], $userProjectIds, true) ? 'checked' : '' ?>>
</td>
<?php endforeach; ?>
<td>
<div style="display:flex;justify-content:flex-end;gap:4px">
<?php if (!empty($projects)): ?>
<button type="submit" form="<?= $formId ?>" class="pg-icon-btn" title="<?= htmlspecialchars(t('admin.users.access.save_title')) ?>" onclick="return confirmAccessSave('<?= $formId ?>')">
<svg width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"><path d="M3 3h8l2 2v8H3z"/><path d="M5 3v4h6V3"/><path d="M5 13v-4h6v4"/></svg>
</button>
<?php endif; ?>
<?php if ($u['status'] === 'invited'): ?>
<form method="post" style="margin:0">
<?= csrf_field() ?>
<input type="hidden" name="action" value="resend_invite">
<input type="hidden" name="user_id" value="<?= $u['id'] ?>">
<button type="submit" class="pg-icon-btn" title="<?= htmlspecialchars(t('admin.users.resend_invite_title')) ?>">
<svg width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"><path d="M2 8a6 6 0 1 1 1.8 4.3"/><path d="M2 12v-3h3"/></svg>
</button>
</form>
<?php endif; ?>
<?php if ($isSelf): ?>
<span style="color:var(--text-faintest);padding:6px 8px">—</span>
<?php else: ?>
<form method="post" onsubmit="return confirm('<?= htmlspecialchars(t('admin.users.confirm_delete', ['name' => $u['name']]), ENT_QUOTES) ?>');" style="margin:0">
<?= csrf_field() ?>
<input type="hidden" name="action" value="delete_user">
<input type="hidden" name="user_id" value="<?= $u['id'] ?>">
<button type="submit" class="pg-icon-btn danger" title="<?= htmlspecialchars(t('admin.users.delete_title')) ?>">
<svg width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"><path d="M3.5 4.5h9"/><path d="M6.2 4.5V3.2c0-.4.3-.7.7-.7h2.2c.4 0 .7.3.7.7v1.3"/><path d="M4.8 4.5 5.2 13c0 .4.3.7.7.7h4c.4 0 .7-.3.7-.7l.4-8.5"/><path d="M6.7 7.3v3.6"/><path d="M9.3 7.3v3.6"/></svg>
</button>
</form>
<?php endif; ?>
</div>
</td>
</tr>
<?php endforeach; ?>
</tbody>
</table>
</div>
<?php foreach ($users as $u): ?>
<form id="uf-<?= (int)$u['id'] ?>" method="post" hidden>
<?= csrf_field() ?>
<input type="hidden" name="action" value="update_user_projects">
<input type="hidden" name="user_id" value="<?= (int)$u['id'] ?>">
</form>
<?php endforeach; ?>
</div>
</div>
<div class="pg-footer-note"><?= htmlspecialchars(t('admin.common.footer_disclaimer')) ?></div>
</div>
</div>
<!-- Modal: Person einladen -->
<div id="inviteModal" class="pg-modal-backdrop" onclick="if(event.target === this) closeInviteModal()">
<div class="pg-modal">
<h2 style="font-size:19px;font-weight:800;margin:0 0 6px"><?= htmlspecialchars(t('admin.users.modal.heading')) ?></h2>
<p style="font-size:13px;color:var(--text-muted);margin:0 0 20px"><?= htmlspecialchars(t('admin.users.modal.desc')) ?></p>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="invite_user">
<label class="pg-label" style="margin-top:0"><?= htmlspecialchars(t('admin.users.modal.name_label')) ?></label>
<input type="text" name="invite_name" placeholder="<?= htmlspecialchars(t('admin.users.modal.name_placeholder')) ?>" required style="width:100%">
<label class="pg-label"><?= htmlspecialchars(t('admin.users.modal.email_label')) ?></label>
<input type="email" name="invite_email" placeholder="<?= htmlspecialchars(t('admin.users.modal.email_placeholder')) ?>" required style="width:100%">
<div style="display:flex;justify-content:flex-end;gap:10px;margin-top:26px">
<button type="button" class="pg-btn-secondary" onclick="closeInviteModal()"><?= htmlspecialchars(t('admin.users.modal.cancel_button')) ?></button>
<button type="submit" class="pg-btn"><?= t('admin.users.modal.submit_button') ?></button>
</div>
</form>
</div>
</div>
<script>
function openInviteModal() {
document.getElementById('inviteModal').style.display = 'flex';
}
function closeInviteModal() {
document.getElementById('inviteModal').style.display = 'none';
}
function confirmAccessSave(formId) {
var checked = document.querySelectorAll('input[type=checkbox][form="' + formId + '"]:checked');
if (checked.length === 0) {
return confirm(<?= json_encode(t('admin.users.access.confirm_unrestricted')) ?>);
}
return true;
}
</script>
</body>
</html>
<?php
}
function render_consent_log_view(PDO $db, array $project, array $projects): void {
$loggingEnabled = !empty($project['consent_logging_enabled']);
$entries = [];
if ($loggingEnabled) {
$stmt = $db->prepare("SELECT * FROM consent_logs WHERE project_id = ? ORDER BY created_at DESC LIMIT 500");
$stmt->execute([$project['id']]);
$entries = $stmt->fetchAll();
}
?>
<!DOCTYPE html>
<html lang="<?= htmlspecialchars(current_locale()) ?>">
<head>
<meta charset="utf-8"><title><?= htmlspecialchars(t('admin.consent_log.page_title', ['project' => $project['name']])) ?></title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/svg+xml" href="/paragrafy.svg">
<?= theme_head_tags_admin() ?>
<?= theme_base_css_admin($project['brand_color'] ?: '#F0A63C') ?>
</head>
<body>
<div class="pg-shell">
<?= render_sidebar('consent_log', $project, $projects) ?>
<div class="pg-main">
<div class="pg-topbar">
<div class="pg-crumb"><?= htmlspecialchars($project['name']) ?> <span style="margin:0 4px">/</span> <strong><?= htmlspecialchars(t('admin.consent_log.crumb')) ?></strong></div>
</div>
<div class="pg-content" style="max-width:1040px">
<div class="pg-card pg-card-pad" style="margin-bottom:0">
<div style="display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap">
<h2 style="margin:0"><?= htmlspecialchars(t('admin.consent_log.heading')) ?></h2>
<?php if (!empty($entries)): ?>
<a href="/admin?project_id=<?= $project['id'] ?>&action=export_consent_log_csv" class="pg-btn-secondary" style="padding:6px 12px;font-size:12px"><?= svg_icon('folder', '', 13) ?> <?= htmlspecialchars(t('admin.consent_log.export_csv')) ?></a>
<?php endif; ?>
</div>
<p class="pg-card-sub" style="margin:5px 0 16px"><?= htmlspecialchars(t('admin.consent_log.subtitle')) ?></p>
<?php if (!$loggingEnabled): ?>
<div style="color:var(--text-faint);font-size:13px;padding:1rem 0;">
<?= htmlspecialchars(t('admin.consent_log.disabled_hint')) ?>
<a href="/admin/settings?project_id=<?= $project['id'] ?>"><?= htmlspecialchars(t('admin.consent_log.disabled_hint_link')) ?></a>
</div>
<?php elseif (empty($entries)): ?>
<div style="color:var(--text-faint);font-size:13px;font-style:italic;padding:1rem 0;"><?= htmlspecialchars(t('admin.consent_log.empty')) ?></div>
<?php else: ?>
<div style="overflow-x:auto">
<table class="pg-table" style="border:1px solid var(--border);border-radius:var(--radius);overflow:hidden">
<thead>
<tr>
<th><?= htmlspecialchars(t('admin.consent_log.col_time')) ?></th>
<th><?= htmlspecialchars(t('admin.consent_log.col_action')) ?></th>
<th><?= htmlspecialchars(t('admin.consent_log.col_ip')) ?></th>
<th><?= htmlspecialchars(t('admin.consent_log.col_consent_id')) ?></th>
<th><?= htmlspecialchars(t('admin.consent_log.col_lang')) ?></th>
<th><?= htmlspecialchars(t('admin.consent_log.col_useragent')) ?></th>
</tr>
</thead>
<tbody>
<?php foreach ($entries as $e): ?>
<tr>
<td style="color:var(--text-muted);white-space:nowrap"><?= date('d.m.Y H:i', strtotime($e['created_at'])) ?></td>
<td>
<?php if ($e['action'] === 'accepted'): ?>
<span class="pg-pill pg-pill-green"><span class="pg-pill-dot"></span><?= htmlspecialchars(t('admin.consent_log.action_accepted')) ?></span>
<?php else: ?>
<span class="pg-pill pg-pill-amber"><span class="pg-pill-dot"></span><?= htmlspecialchars(t('admin.consent_log.action_declined')) ?></span>
<?php endif; ?>
</td>
<td style="font-family:'JetBrains Mono',monospace;font-size:12px"><?= htmlspecialchars($e['ip_anonymized']) ?></td>
<td style="font-family:'JetBrains Mono',monospace;font-size:11px;color:var(--text-faint);max-width:160px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="<?= htmlspecialchars($e['consent_id']) ?>"><?= htmlspecialchars($e['consent_id']) ?></td>
<td><?= htmlspecialchars($e['lang']) ?></td>
<td style="color:var(--text-faint);font-size:12px;max-width:220px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="<?= htmlspecialchars($e['user_agent']) ?>"><?= htmlspecialchars($e['user_agent']) ?></td>
</tr>
<?php endforeach; ?>
</tbody>
</table>
</div>
<?php endif; ?>
</div>
</div>
<div class="pg-footer-note"><?= htmlspecialchars(t('admin.common.footer_disclaimer')) ?></div>
</div>
</div>
</body>
</html>
<?php
}
function render_audit_view(PDO $db, array $project, array $projects): void {
if (current_user_is_primary_admin()) {
$stmt = $db->prepare("SELECT * FROM audit_log WHERE project_id = ? OR project_id IS NULL ORDER BY created_at DESC LIMIT 200");
} else {
$stmt = $db->prepare("SELECT * FROM audit_log WHERE project_id = ? ORDER BY created_at DESC LIMIT 200");
}
$stmt->execute([$project['id']]);
$entries = $stmt->fetchAll();
?>
<!DOCTYPE html>
<html lang="<?= htmlspecialchars(current_locale()) ?>">
<head>
<meta charset="utf-8"><title><?= htmlspecialchars(t('admin.audit.page_title', ['project' => $project['name']])) ?></title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/svg+xml" href="/paragrafy.svg">
<?= theme_head_tags_admin() ?>
<?= theme_base_css_admin($project['brand_color'] ?: '#F0A63C') ?>
</head>
<body>
<div class="pg-shell">
<?= render_sidebar('audit', $project, $projects) ?>
<div class="pg-main">
<div class="pg-topbar">
<div class="pg-crumb"><?= htmlspecialchars($project['name']) ?> <span style="margin:0 4px">/</span> <strong><?= htmlspecialchars(t('admin.audit.crumb')) ?></strong></div>
</div>
<div class="pg-content" style="max-width:840px">
<div class="pg-card pg-card-pad" style="margin-bottom:0">
<div style="display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap">
<h2 style="margin:0"><?= htmlspecialchars(t('admin.audit.heading')) ?></h2>
<?php if (!empty($entries)): ?>
<a href="/admin?project_id=<?= $project['id'] ?>&action=export_audit_csv" class="pg-btn-secondary" style="padding:6px 12px;font-size:12px"><?= svg_icon('folder', '', 13) ?> <?= htmlspecialchars(t('admin.audit.export_csv')) ?></a>
<?php endif; ?>
</div>
<p class="pg-card-sub" style="margin:5px 0 16px"><?= htmlspecialchars(t('admin.audit.subtitle')) ?></p>
<?php if (empty($entries)): ?>
<div style="color:var(--text-faint);font-size:13px;font-style:italic;padding:1rem 0;"><?= htmlspecialchars(t('admin.audit.empty')) ?></div>
<?php else: ?>
<table class="pg-table" style="border:1px solid var(--border);border-radius:var(--radius);overflow:hidden">
<thead>
<tr>
<th><?= htmlspecialchars(t('admin.audit.col_time')) ?></th>
<th><?= htmlspecialchars(t('admin.audit.col_user')) ?></th>
<th><?= htmlspecialchars(t('admin.audit.col_action')) ?></th>
</tr>
</thead>
<tbody>
<?php foreach ($entries as $e): ?>
<tr>
<td style="color:var(--text-muted);white-space:nowrap"><?= date('d.m.Y H:i', strtotime($e['created_at'])) ?></td>
<td style="font-weight:600"><?= htmlspecialchars($e['user_name']) ?></td>
<td><?= htmlspecialchars($e['action']) ?><?php if (!empty($e['project_name'])): ?> <span style="color:var(--text-faint)">· <?= htmlspecialchars($e['project_name']) ?></span><?php endif; ?></td>
</tr>
<?php endforeach; ?>
</tbody>
</table>
<?php endif; ?>
</div>
</div>
<div class="pg-footer-note"><?= htmlspecialchars(t('admin.common.footer_disclaimer')) ?></div>
</div>
</div>
</body>
</html>
<?php
}