bug fix zu adresse

app/main.py

@@ -782,8 +782,15 @@ def get_admin_venues():
     ]
 
 
-@app.get("/admin", response_class=HTMLResponse)
+@app.get("/admin")
 def admin_page(request: Request):
+    if not require_admin(request):
+        return HTMLResponse("<h1>Nicht erlaubt</h1>", status_code=403)
+    return RedirectResponse("/admin/users", status_code=303)
+
+
+@app.get("/admin/users", response_class=HTMLResponse)
+def admin_users_page(request: Request):
     user = require_admin(request)
 
     if not user:
@@ -812,15 +819,43 @@ def admin_page(request: Request):
         for row in rows
     ]
 
-    template = templates.get_template("admin.html")
+    template = templates.get_template("admin_users.html")
     return template.render(
         user=user,
         users=users,
-        venues=get_admin_venues(),
         invite_url=None,
     )
 
 
+@app.get("/admin/venues", response_class=HTMLResponse)
+def admin_venues_page(request: Request):
+    user = require_admin(request)
+    if not user:
+        return HTMLResponse("<h1>Nicht erlaubt</h1>", status_code=403)
+    template = templates.get_template("admin_venues.html")
+    return template.render(user=user, venues=get_admin_venues())
+
+
+@app.get("/admin/patches", response_class=HTMLResponse)
+def admin_patches_page(request: Request):
+    user = require_admin(request)
+    if not user:
+        return HTMLResponse("<h1>Nicht erlaubt</h1>", status_code=403)
+    assets = load_badge_assets()
+    patches = [
+        {
+            "code": code,
+            "name": name,
+            "icon": icon,
+            "description": description,
+            "image_path": assets.get(code),
+        }
+        for code, name, icon, _threshold, description, _category in BADGE_DEFINITIONS
+    ]
+    template = templates.get_template("admin_patches.html")
+    return template.render(user=user, patches=patches)
+
+
 @app.post("/admin/invites", response_class=HTMLResponse)
 def create_invite(request: Request):
     user = require_admin(request)
@@ -872,11 +907,10 @@ def create_invite(request: Request):
         }
         for row in rows
     ]
-    template = templates.get_template("admin.html")
+    template = templates.get_template("admin_users.html")
     return template.render(
         user=user,
         users=users,
-        venues=get_admin_venues(),
         invite_url=f"{str(request.base_url).rstrip('/')}/register/{token}",
         invite_id=invite_id,
     )
@@ -933,7 +967,7 @@ def update_venue(
             )
         connection.commit()
 
-    return RedirectResponse("/admin#venues", status_code=303)
+    return RedirectResponse("/admin/venues", status_code=303)
 
 
 @app.post("/admin/venues/{venue_id}/merge")
@@ -975,7 +1009,87 @@ def merge_venue(
             cursor.execute("DELETE FROM venues WHERE id = %s", (venue_id,))
         connection.commit()
 
-    return RedirectResponse("/admin#venues", status_code=303)
+    return RedirectResponse("/admin/venues", status_code=303)
+
+
+@app.post("/admin/venues/{venue_id}/delete")
+def delete_venue(request: Request, venue_id: int):
+    if not require_admin(request):
+        return HTMLResponse("<h1>Nicht erlaubt</h1>", status_code=403)
+
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute("DELETE FROM venues WHERE id = %s", (venue_id,))
+        connection.commit()
+
+    return RedirectResponse("/admin/venues", status_code=303)
+
+
+def remove_patch_file(path: str | None):
+    if not path:
+        return
+    filename = os.path.basename(path)
+    file_path = os.path.join(PATCH_DIR, filename)
+    if os.path.isfile(file_path):
+        os.remove(file_path)
+
+
+@app.post("/admin/patches/{badge_code}")
+async def update_patch_image(
+    request: Request,
+    badge_code: str,
+    image: UploadFile | None = File(None),
+):
+    user = require_admin(request)
+    valid_codes = {definition[0] for definition in BADGE_DEFINITIONS}
+    if not user:
+        return HTMLResponse("<h1>Nicht erlaubt</h1>", status_code=403)
+    if badge_code not in valid_codes:
+        return HTMLResponse("<h1>Patch nicht gefunden</h1>", status_code=404)
+
+    image_path, error = save_image(image, PATCH_DIR, "/static/uploads/patches/")
+    if error:
+        return error
+    if not image_path:
+        return HTMLResponse("<h1>Bitte ein Bild auswählen.</h1>", status_code=400)
+
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute("SELECT path FROM badge_assets WHERE badge_code = %s", (badge_code,))
+            old_asset = cursor.fetchone()
+            cursor.execute(
+                """
+                INSERT INTO badge_assets (badge_code, path, updated_by, updated_at)
+                VALUES (%s, %s, %s, CURRENT_TIMESTAMP)
+                ON CONFLICT (badge_code) DO UPDATE
+                SET path = EXCLUDED.path, updated_by = EXCLUDED.updated_by,
+                    updated_at = CURRENT_TIMESTAMP
+                """,
+                (badge_code, image_path, user["id"]),
+            )
+        connection.commit()
+
+    if old_asset:
+        remove_patch_file(old_asset[0])
+    return RedirectResponse("/admin/patches", status_code=303)
+
+
+@app.post("/admin/patches/{badge_code}/delete")
+def delete_patch_image(request: Request, badge_code: str):
+    if not require_admin(request):
+        return HTMLResponse("<h1>Nicht erlaubt</h1>", status_code=403)
+    if badge_code not in {definition[0] for definition in BADGE_DEFINITIONS}:
+        return HTMLResponse("<h1>Patch nicht gefunden</h1>", status_code=404)
+
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute("DELETE FROM badge_assets WHERE badge_code = %s RETURNING path", (badge_code,))
+            deleted_asset = cursor.fetchone()
+        connection.commit()
+
+    if deleted_asset:
+        remove_patch_file(deleted_asset[0])
+    return RedirectResponse("/admin/patches", status_code=303)
 
 
 @app.post("/admin/users/{user_id}")
@@ -1004,7 +1118,7 @@ def update_user_role(
             )
         connection.commit()
 
-    return RedirectResponse("/admin", status_code=303)
+    return RedirectResponse("/admin/users", status_code=303)
 
 
 @app.post("/admin/users/{user_id}/delete")
@@ -1024,7 +1138,7 @@ def delete_user(request: Request, user_id: int):
             cursor.execute("DELETE FROM users WHERE id = %s", (user_id,))
         connection.commit()
 
-    return RedirectResponse("/admin", status_code=303)
+    return RedirectResponse("/admin/users", status_code=303)
 
 @app.post("/register")
 def register_user(