admin berreich, user anmeldung

app/main.py

@@ -159,7 +159,12 @@ app = FastAPI(title="Pingu Concerts", lifespan=lifespan)
 
 @app.middleware("http")
 async def require_login(request: Request, call_next):
-    if request.url.path == "/login" or request.url.path.startswith("/static/"):
+    if (
+        request.url.path == "/login"
+        or request.url.path == "/register"
+        or request.url.path.startswith("/register/")
+        or request.url.path.startswith("/static/")
+    ):
         return await call_next(request)
 
     if get_current_user(request):
@@ -544,15 +549,55 @@ def resolve_venue(
     return selected_venue_id
 
 
-@app.get("/admin/invites")
-def create_invite(request: Request):
+def require_admin(request: Request):
     user = get_current_user(request)
 
     if not user or not user["is_admin"]:
-        return HTMLResponse(
-            "<h1>Nicht erlaubt</h1>",
-            status_code=403,
-        )
+        return None
+
+    return user
+
+
+@app.get("/admin", response_class=HTMLResponse)
+def admin_page(request: Request):
+    user = require_admin(request)
+
+    if not user:
+        return HTMLResponse("<h1>Nicht erlaubt</h1>", status_code=403)
+
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute(
+                """
+                SELECT id, username, email, display_name, is_admin, created_at
+                FROM users
+                ORDER BY is_admin DESC, username ASC
+                """
+            )
+            rows = cursor.fetchall()
+
+    users = [
+        {
+            "id": row[0],
+            "username": row[1],
+            "email": row[2],
+            "display_name": row[3] or row[1],
+            "is_admin": bool(row[4]),
+            "created_at": row[5].strftime("%d.%m.%Y"),
+        }
+        for row in rows
+    ]
+
+    template = templates.get_template("admin.html")
+    return template.render(user=user, users=users, invite_url=None)
+
+
+@app.post("/admin/invites", response_class=HTMLResponse)
+def create_invite(request: Request):
+    user = require_admin(request)
+
+    if not user:
+        return HTMLResponse("<h1>Nicht erlaubt</h1>", status_code=403)
 
     token = secrets.token_urlsafe(32)
 
@@ -576,10 +621,84 @@ def create_invite(request: Request):
 
         connection.commit()
 
-    return {
-        "invite_id": invite_id,
-        "invite_url": f"/register/{token}"
-    }
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute(
+                """
+                SELECT id, username, email, display_name, is_admin, created_at
+                FROM users
+                ORDER BY is_admin DESC, username ASC
+                """
+            )
+            rows = cursor.fetchall()
+
+    users = [
+        {
+            "id": row[0],
+            "username": row[1],
+            "email": row[2],
+            "display_name": row[3] or row[1],
+            "is_admin": bool(row[4]),
+            "created_at": row[5].strftime("%d.%m.%Y"),
+        }
+        for row in rows
+    ]
+    template = templates.get_template("admin.html")
+    return template.render(
+        user=user,
+        users=users,
+        invite_url=f"{str(request.base_url).rstrip('/')}/register/{token}",
+        invite_id=invite_id,
+    )
+
+
+@app.post("/admin/users/{user_id}")
+def update_user_role(
+    request: Request,
+    user_id: int,
+    role: str = Form(...),
+):
+    user = require_admin(request)
+
+    if not user:
+        return HTMLResponse("<h1>Nicht erlaubt</h1>", status_code=403)
+    if role not in {"admin", "user"}:
+        return HTMLResponse("<h1>Ungültige Rolle</h1>", status_code=400)
+    if user_id == user["id"] and role != "admin":
+        return HTMLResponse(
+            "<h1>Die eigenen Adminrechte können nicht entfernt werden.</h1>",
+            status_code=400,
+        )
+
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute(
+                "UPDATE users SET is_admin = %s WHERE id = %s",
+                (role == "admin", user_id),
+            )
+        connection.commit()
+
+    return RedirectResponse("/admin", status_code=303)
+
+
+@app.post("/admin/users/{user_id}/delete")
+def delete_user(request: Request, user_id: int):
+    user = require_admin(request)
+
+    if not user:
+        return HTMLResponse("<h1>Nicht erlaubt</h1>", status_code=403)
+    if user_id == user["id"]:
+        return HTMLResponse(
+            "<h1>Der eigene Account kann nicht gelöscht werden.</h1>",
+            status_code=400,
+        )
+
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute("DELETE FROM users WHERE id = %s", (user_id,))
+        connection.commit()
+
+    return RedirectResponse("/admin", status_code=303)
 
 @app.post("/register")
 def register_user(