V0.1

server/index.js

@@ -1,17 +1,13 @@
-import { randomUUID } from 'crypto';
 import cors from 'cors';
 import dotenv from 'dotenv';
 import express from 'express';
 import session from 'express-session';
 import path from 'path';
 import { fileURLToPath } from 'url';
-import db from './db.js';
-import { getSyncStatus, performLdapSync } from './ldap-sync.js';
-import { hashPassword, verifyPassword } from './password.js';
-import {
-  computeRemoteDurationSeconds,
-  registerTeamViewerRoutes,
-} from './teamviewer.js';
+import { restartLdapSyncScheduler } from './integrations.js';
+import { createApiRouter } from './routes/api/index.js';
+import { createAdminRouter } from './routes/admin/index.js';
+import authRouter from './routes/auth.js';
 
 dotenv.config();
 
@@ -42,734 +38,21 @@ app.use(
   }),
 );
 
-const UUID =
-  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+app.use('/auth', authRouter);
+app.use('/api', createApiRouter());
+app.use('/api', createAdminRouter());
 
-function badRequest(res, msg) {
-  return res.status(400).json({ message: msg });
-}
-
-function parseJsonField(v) {
-  if (v == null) return undefined;
-  if (typeof v === 'object') return v;
-  return JSON.parse(v);
-}
-
-function mapMachine(r) {
-  const o = {
-    id: r.id,
-    name: r.name,
-    typ: r.typ,
-    seriennummer: r.seriennummer,
-    standort: r.standort,
-    createdAt: r.created_at,
-    updatedAt: r.updated_at,
-  };
-  if (r.extras != null && String(r.extras).trim() !== '') {
-    try {
-      o.extras =
-        typeof r.extras === 'string' ? JSON.parse(r.extras) : r.extras;
-    } catch {
-      o.extras = null;
-    }
-  }
-  return o;
-}
-
-function mapTicket(r) {
-  const machine_row = parseJsonField(r.machine_row);
-  const t = {
-    id: r.id,
-    machineId: r.machine_id,
-    title: r.title,
-    description: r.description,
-    status: r.status,
-    priority: r.priority,
-    createdAt: r.created_at,
-    updatedAt: r.updated_at,
-  };
-  if (machine_row) {
-    t.machine = mapMachine(machine_row);
-  }
-  return t;
-}
-
-function mapEvent(r) {
-  return {
-    id: r.id,
-    ticketId: r.ticket_id,
-    type: r.type,
-    description: r.description,
-    createdAt: r.created_at,
-    callbackNumber: r.callback_number ?? null,
-    teamviewerId: r.teamviewer_id ?? null,
-    articleNumber: r.article_number ?? null,
-    remoteDurationSeconds:
-      r.remote_duration_seconds != null ? r.remote_duration_seconds : null,
-  };
-}
-
-function mapPublicUser(r) {
-  return {
-    id: r.id,
-    username: r.username,
-    role: r.role,
-    active: Boolean(r.active),
-    source: r.source,
-    ldapDn: r.ldap_dn || null,
-    createdAt: r.created_at,
-    updatedAt: r.updated_at,
-  };
-}
-
-const ticketJoinSelect = `
-  SELECT t.*,
-    json_object(
-      'id', m.id,
-      'name', m.name,
-      'typ', m.typ,
-      'seriennummer', m.seriennummer,
-      'standort', m.standort,
-      'extras', m.extras,
-      'created_at', m.created_at,
-      'updated_at', m.updated_at
-    ) AS machine_row
-  FROM tickets t
-  JOIN machines m ON m.id = t.machine_id`;
-
-const DEFAULT_INTEGRATIONS = {
-  ldap: {
-    serverUrl: '',
-    bindDn: '',
-    bindPassword: '',
-    searchBase: '',
-    userSearchFilter: '',
-    userFilter: '',
-    usernameAttribute: 'sAMAccountName',
-    firstNameAttribute: 'givenName',
-    lastNameAttribute: 'sn',
-    syncIntervalMinutes: 1440,
-    syncEnabled: false,
-    syncNotes: '',
-  },
-  /* TeamViewer: Authorization: Bearer <token> */
-  teamviewer: {
-    bearerToken: '',
-    notes: '',
-  },
-};
-
-function loadIntegrations() {
-  const row = db.prepare('SELECT value FROM app_settings WHERE key = ?').get('integrations');
-  const base = structuredClone(DEFAULT_INTEGRATIONS);
-  if (!row?.value) return base;
-  try {
-    const s = JSON.parse(row.value);
-    if (s.ldap && typeof s.ldap === 'object') Object.assign(base.ldap, s.ldap);
-    const ld = base.ldap;
-    if (!ld.userSearchFilter && ld.userFilter) ld.userSearchFilter = ld.userFilter;
-    if (s.teamviewer && typeof s.teamviewer === 'object')
-      Object.assign(base.teamviewer, s.teamviewer);
-    const tv = base.teamviewer;
-    if (!tv.bearerToken && tv.apiToken) tv.bearerToken = tv.apiToken;
-    if (tv.notes == null && tv.apiNotes) tv.notes = tv.apiNotes;
-    return base;
-  } catch {
-    return base;
-  }
-}
-
-function saveIntegrations(obj) {
-  const json = JSON.stringify(obj);
-  db.prepare(
-    `INSERT INTO app_settings (key, value) VALUES ('integrations', ?)
-     ON CONFLICT(key) DO UPDATE SET value = excluded.value`,
-  ).run(json);
-}
-
-let ldapSyncTimer = null;
-
-function restartLdapSyncScheduler() {
-  if (ldapSyncTimer) {
-    clearInterval(ldapSyncTimer);
-    ldapSyncTimer = null;
-  }
-  const cfg = loadIntegrations().ldap;
-  if (!cfg.syncEnabled) return;
-  const m = Math.max(0, Number(cfg.syncIntervalMinutes) || 0);
-  if (m <= 0) return;
-  ldapSyncTimer = setInterval(() => {
-    performLdapSync(db, loadIntegrations, 'automatic').catch((err) =>
-      console.error('LDAP auto-sync:', err),
-    );
-  }, m * 60 * 1000);
-}
-
-function requireAuth(req, res, next) {
-  if (!req.session?.userId) {
-    return res.status(401).json({ message: 'Nicht angemeldet' });
-  }
-  const u = db
-    .prepare(
-      'SELECT id, active FROM users WHERE id = ?',
-    )
-    .get(req.session.userId);
-  if (!u || !u.active) {
-    req.session.destroy(() => {});
-    return res.status(401).json({ message: 'Nicht angemeldet' });
-  }
-  next();
-}
-
-function requireAdmin(req, res, next) {
-  if (req.session?.role !== 'admin') {
-    return res.status(403).json({ message: 'Administratorrechte erforderlich.' });
-  }
-  next();
-}
-
-/** ——— Öffentlich: Auth ——— */
-app.get('/auth/status', (req, res) => {
-  const count = db.prepare('SELECT COUNT(*) AS c FROM users').get().c;
-  const needsBootstrap = count === 0;
-  if (needsBootstrap) {
-    return res.json({ needsBootstrap: true, loggedIn: false, user: null });
-  }
-  if (!req.session?.userId) {
-    return res.json({ needsBootstrap: false, loggedIn: false, user: null });
-  }
-  const u = db
-    .prepare(
-      'SELECT id, username, role, active FROM users WHERE id = ?',
-    )
-    .get(req.session.userId);
-  if (!u || !u.active) {
-    req.session.destroy(() => {});
-    return res.json({ needsBootstrap: false, loggedIn: false, user: null });
-  }
-  res.json({
-    needsBootstrap: false,
-    loggedIn: true,
-    user: { id: u.id, username: u.username, role: u.role },
-  });
-});
-
-app.post('/auth/bootstrap', async (req, res) => {
-  const count = db.prepare('SELECT COUNT(*) AS c FROM users').get().c;
-  if (count > 0) {
-    return res.status(403).json({ message: 'Initialisierung nicht mehr möglich.' });
-  }
-  const { username, password } = req.body || {};
-  const un = String(username || '')
-    .trim()
-    .toLowerCase();
-  if (!un || !password || password.length < 8) {
-    return badRequest(res, 'Benutzername und Passwort (min. 8 Zeichen) erforderlich.');
-  }
-  const id = randomUUID();
-  const ph = await hashPassword(password);
-  db.prepare(
-    `INSERT INTO users (id, username, password_hash, role, source, active, updated_at)
-     VALUES (?, ?, ?, 'admin', 'local', 1, datetime('now'))`,
-  ).run(id, un, ph);
-  req.session.userId = id;
-  req.session.role = 'admin';
-  req.session.username = un;
-  res.status(201).json({
-    user: { id, username: un, role: 'admin' },
-  });
-});
-
-app.post('/auth/login', async (req, res) => {
-  const { username, password } = req.body || {};
-  const un = String(username || '')
-    .trim()
-    .toLowerCase();
-  if (!un || !password) {
-    return badRequest(res, 'Benutzername und Passwort erforderlich.');
-  }
-  const u = db.prepare('SELECT * FROM users WHERE username = ?').get(un);
-  if (!u || !u.active) {
-    return res.status(401).json({ message: 'Ungültige Zugangsdaten.' });
-  }
-  if (!u.password_hash) {
-    return res.status(401).json({
-      message: 'Kein lokales Passwort (LDAP). Anmeldung folgt mit Verzeichnis-Sync.',
-    });
-  }
-  const ok = await verifyPassword(password, u.password_hash);
-  if (!ok) return res.status(401).json({ message: 'Ungültige Zugangsdaten.' });
-  req.session.userId = u.id;
-  req.session.role = u.role;
-  req.session.username = u.username;
-  res.json({
-    user: { id: u.id, username: u.username, role: u.role },
-  });
-});
-
-app.post('/auth/logout', (req, res) => {
-  req.session.destroy((err) => {
-    if (err) return res.status(500).json({ message: 'Abmelden fehlgeschlagen.' });
-    res.json({ ok: true });
-  });
-});
-
-/** ——— Geschützte API ——— */
-const api = express.Router();
-api.use(requireAuth);
-
-api.get('/machines', (_req, res) => {
-  const rows = db
-    .prepare('SELECT * FROM machines ORDER BY seriennummer ASC')
-    .all();
-  res.json(rows.map(mapMachine));
-});
-
-api.post('/machines', (req, res) => {
-  const { name, typ, seriennummer, standort } = req.body || {};
-  if (!name || !typ || !seriennummer || !standort) {
-    return badRequest(res, 'Pflichtfelder fehlen.');
-  }
-  const id = randomUUID();
-  const row = db
-    .prepare(
-      `INSERT INTO machines (id, name, typ, seriennummer, standort, updated_at)
-       VALUES (?, ?, ?, ?, ?, datetime('now')) RETURNING *`,
-    )
-    .get(id, name, typ, seriennummer, standort);
-  res.status(201).json(mapMachine(row));
-});
-
-api.get('/machines/:id', (req, res) => {
-  const { id } = req.params;
-  if (!UUID.test(id)) return res.status(404).json({ message: 'Nicht gefunden' });
-  const row = db.prepare('SELECT * FROM machines WHERE id = ?').get(id);
-  if (!row) return res.status(404).json({ message: 'Nicht gefunden' });
-  res.json(mapMachine(row));
-});
-
-api.put('/machines/:id', (req, res) => {
-  const { id } = req.params;
-  if (!UUID.test(id)) return res.status(404).json({ message: 'Nicht gefunden' });
-  const cur = db.prepare('SELECT * FROM machines WHERE id = ?').get(id);
-  if (!cur) return res.status(404).json({ message: 'Nicht gefunden' });
-  const b = req.body || {};
-  const next = {
-    name: b.name ?? cur.name,
-    typ: b.typ ?? cur.typ,
-    seriennummer: b.seriennummer ?? cur.seriennummer,
-    standort: b.standort ?? cur.standort,
-  };
-  let extrasJson = cur.extras;
-  if (Object.prototype.hasOwnProperty.call(b, 'extras')) {
-    if (b.extras === null || b.extras === '') {
-      extrasJson = null;
-    } else if (typeof b.extras === 'object' && b.extras !== null) {
-      try {
-        extrasJson = JSON.stringify(b.extras);
-      } catch {
-        return badRequest(res, 'extras ist kein gültiges JSON-Objekt.');
-      }
-    } else if (typeof b.extras === 'string') {
-      try {
-        JSON.parse(b.extras);
-        extrasJson = b.extras;
-      } catch {
-        return badRequest(res, 'extras ist kein gültiger JSON-String.');
-      }
-    } else {
-      return badRequest(res, 'extras hat ein ungültiges Format.');
-    }
-  }
-  const row = db
-    .prepare(
-      `UPDATE machines SET name = ?, typ = ?, seriennummer = ?, standort = ?, extras = ?, updated_at = datetime('now')
-       WHERE id = ? RETURNING *`,
-    )
-    .get(next.name, next.typ, next.seriennummer, next.standort, extrasJson, id);
-  res.json(mapMachine(row));
-});
-
-api.delete('/machines/:id', (req, res) => {
-  const { id } = req.params;
-  if (!UUID.test(id)) return res.status(404).json({ message: 'Nicht gefunden' });
-  const cur = db.prepare('SELECT * FROM machines WHERE id = ?').get(id);
-  if (!cur) return res.status(404).json({ message: 'Nicht gefunden' });
-  const tc = db
-    .prepare('SELECT COUNT(*) AS c FROM tickets WHERE machine_id = ?')
-    .get(id);
-  if (tc.c > 0) {
-    return res.status(409).json({
-      message:
-        'Maschine kann nicht gelöscht werden: Es existieren noch zugeordnete Tickets.',
-    });
-  }
-  const row = db
-    .prepare('DELETE FROM machines WHERE id = ? RETURNING *')
-    .get(id);
-  res.json(mapMachine(row));
-});
-
-api.get('/tickets', (req, res) => {
-  const { status, priority, machineId, open } = req.query;
-  const cond = ['1=1'];
-  const params = [];
-  const openFilter = open === '1' || open === 'true';
-  if (openFilter) {
-    cond.push("t.status IN ('OPEN', 'WAITING')");
-  } else if (status) {
-    cond.push('t.status = ?');
-    params.push(status);
-  }
-  if (priority) {
-    cond.push('t.priority = ?');
-    params.push(priority);
-  }
-  if (machineId) {
-    cond.push('t.machine_id = ?');
-    params.push(machineId);
-  }
-  const sql = `${ticketJoinSelect} WHERE ${cond.join(' AND ')} ORDER BY t.updated_at DESC`;
-  const rows = db.prepare(sql).all(...params);
-  res.json(rows.map(mapTicket));
-});
-
-api.post('/tickets', (req, res) => {
-  const { machineId, title, description, status, priority } = req.body || {};
-  if (!machineId || !title || !description) {
-    return badRequest(res, 'Pflichtfelder fehlen.');
-  }
-  const m = db
-    .prepare('SELECT 1 AS ok FROM machines WHERE id = ?')
-    .get(machineId);
-  if (!m) return res.status(404).json({ message: 'Nicht gefunden' });
-  const st = status || 'OPEN';
-  const pr = priority || 'MEDIUM';
-  const tid = randomUUID();
-  db.prepare(
-    `INSERT INTO tickets (id, machine_id, title, description, status, priority, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, datetime('now'))`,
-  ).run(tid, machineId, title, description, st, pr);
-  const full = db
-    .prepare(`${ticketJoinSelect} WHERE t.id = ?`)
-    .get(tid);
-  res.status(201).json(mapTicket(full));
-});
-
-api.get('/tickets/:id/events', (req, res) => {
-  const { id } = req.params;
-  if (!UUID.test(id)) return res.status(404).json({ message: 'Nicht gefunden' });
-  const ex = db.prepare('SELECT 1 AS ok FROM tickets WHERE id = ?').get(id);
-  if (!ex) return res.status(404).json({ message: 'Nicht gefunden' });
-  const rows = db
-    .prepare(
-      'SELECT * FROM events WHERE ticket_id = ? ORDER BY created_at DESC',
-    )
-    .all(id);
-  res.json(rows.map(mapEvent));
-});
-
-api.get('/tickets/:id', (req, res) => {
-  const { id } = req.params;
-  if (!UUID.test(id)) return res.status(404).json({ message: 'Nicht gefunden' });
-  const row = db.prepare(`${ticketJoinSelect} WHERE t.id = ?`).get(id);
-  if (!row) return res.status(404).json({ message: 'Nicht gefunden' });
-  res.json(mapTicket(row));
-});
-
-api.put('/tickets/:id', (req, res) => {
-  const { id } = req.params;
-  if (!UUID.test(id)) return res.status(404).json({ message: 'Nicht gefunden' });
-  const cur = db.prepare('SELECT * FROM tickets WHERE id = ?').get(id);
-  if (!cur) return res.status(404).json({ message: 'Nicht gefunden' });
-  const b = req.body || {};
-  const next = {
-    title: b.title ?? cur.title,
-    description: b.description ?? cur.description,
-    status: b.status ?? cur.status,
-    priority: b.priority ?? cur.priority,
-  };
-
-  const lines = [];
-  if (b.status !== undefined && b.status !== cur.status) {
-    lines.push(`Status: ${cur.status} → ${b.status}`);
-  }
-  if (b.priority !== undefined && b.priority !== cur.priority) {
-    lines.push(`Priorität: ${cur.priority} → ${b.priority}`);
-  }
-  if (b.title !== undefined && b.title !== cur.title) lines.push('Titel geändert');
-  if (b.description !== undefined && b.description !== cur.description) {
-    lines.push('Beschreibung geändert');
-  }
-  if (lines.length > 0) {
-    const eid = randomUUID();
-    db.prepare(
-      `INSERT INTO events (id, ticket_id, type, description, callback_number, teamviewer_id, article_number, remote_duration_seconds)
-       VALUES (?, ?, 'SYSTEM', ?, NULL, NULL, NULL, NULL)`,
-    ).run(eid, id, lines.join('; '));
-  }
-
-  db.prepare(
-    `UPDATE tickets SET title = ?, description = ?, status = ?, priority = ?, updated_at = datetime('now')
-     WHERE id = ?`,
-  ).run(next.title, next.description, next.status, next.priority, id);
-
-  const row = db.prepare(`${ticketJoinSelect} WHERE t.id = ?`).get(id);
-  res.json(mapTicket(row));
-});
-
-const EVENT_TYPES_USER = new Set(['NOTE', 'CALL', 'REMOTE', 'PART']);
-
-registerTeamViewerRoutes(api, loadIntegrations);
-
-api.post('/events', (req, res) => {
-  const b = req.body || {};
-  const ticketId = b.ticketId;
-  const type = b.type;
-  if (!ticketId || !type || !EVENT_TYPES_USER.has(type)) {
-    return badRequest(res, 'Pflichtfelder fehlen oder ungültiger Typ.');
-  }
-  const t = db
-    .prepare('SELECT 1 AS ok FROM tickets WHERE id = ?')
-    .get(ticketId);
-  if (!t) return res.status(404).json({ message: 'Nicht gefunden' });
-
-  const desc = b.description != null ? String(b.description).trim() : '';
-  const callbackNumber =
-    b.callbackNumber != null ? String(b.callbackNumber).trim() : '';
-  const teamviewerId =
-    b.teamviewerId != null ? String(b.teamviewerId).trim() : '';
-  const articleNumber =
-    b.articleNumber != null ? String(b.articleNumber).trim() : '';
-
-  let description = desc;
-  let cb = callbackNumber || null;
-  let tv = teamviewerId || null;
-  let art = articleNumber || null;
-
-  if (type === 'NOTE') {
-    if (!description) return badRequest(res, 'Beschreibung fehlt.');
-    cb = null;
-    tv = null;
-    art = null;
-  } else if (type === 'CALL') {
-    if (!description) return badRequest(res, 'Beschreibung fehlt.');
-    if (!callbackNumber) return badRequest(res, 'Rückrufnummer fehlt.');
-    tv = null;
-    art = null;
-  } else if (type === 'REMOTE') {
-    if (!description?.trim() && !tv) {
-      return badRequest(res, 'Beschreibung oder TeamViewer-Gerät erforderlich.');
-    }
-    cb = null;
-    art = null;
-  } else if (type === 'PART') {
-    if (!articleNumber) return badRequest(res, 'Artikelnummer fehlt.');
-    description = desc;
-    cb = null;
-    tv = null;
-  }
-
-  let remoteDurationSeconds = null;
-  if (type === 'REMOTE') {
-    remoteDurationSeconds = computeRemoteDurationSeconds(
-      b.teamviewerStartDate,
-      b.teamviewerEndDate,
-    );
-  }
-
-  const eid = randomUUID();
-  const row = db
-    .prepare(
-      `INSERT INTO events (id, ticket_id, type, description, callback_number, teamviewer_id, article_number, remote_duration_seconds)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
-    )
-    .get(
-      eid,
-      ticketId,
-      type,
-      description,
-      cb,
-      tv,
-      art,
-      remoteDurationSeconds,
-    );
-  res.status(201).json(mapEvent(row));
-});
-
-app.use('/api', api);
-
-/** ——— Admin ——— */
-const admin = express.Router();
-admin.use(requireAuth, requireAdmin);
-
-admin.get('/users', (_req, res) => {
-  const rows = db
-    .prepare(
-      'SELECT id, username, role, source, active, ldap_dn, created_at, updated_at FROM users ORDER BY username ASC',
-    )
-    .all();
-  res.json(rows.map(mapPublicUser));
-});
-
-admin.post('/users', async (req, res) => {
-  const { username, password, role } = req.body || {};
-  const un = String(username || '')
-    .trim()
-    .toLowerCase();
-  if (!un || !password) return badRequest(res, 'Benutzername und Passwort erforderlich.');
-  const r = role === 'admin' ? 'admin' : 'user';
-  const id = randomUUID();
-  const ph = await hashPassword(password);
-  try {
-    db.prepare(
-      `INSERT INTO users (id, username, password_hash, role, source, active, updated_at)
-       VALUES (?, ?, ?, ?, 'local', 1, datetime('now'))`,
-    ).run(id, un, ph, r);
-  } catch (e) {
-    if (String(e.message || e).includes('UNIQUE')) {
-      return res.status(409).json({ message: 'Benutzername bereits vergeben.' });
-    }
-    throw e;
-  }
-  const row = db.prepare('SELECT * FROM users WHERE id = ?').get(id);
-  res.status(201).json(mapPublicUser(row));
-});
-
-admin.put('/users/:id', async (req, res) => {
-  const { id } = req.params;
-  if (!UUID.test(id)) return res.status(404).json({ message: 'Nicht gefunden' });
-  const cur = db.prepare('SELECT * FROM users WHERE id = ?').get(id);
-  if (!cur) return res.status(404).json({ message: 'Nicht gefunden' });
-  const b = req.body || {};
-
-  if (b.password != null && String(b.password).length > 0) {
-    if (cur.source !== 'local') {
-      return badRequest(res, 'Passwort nur für lokale Benutzer änderbar.');
-    }
-    const ph = await hashPassword(b.password);
-    db.prepare(
-      'UPDATE users SET password_hash = ?, updated_at = datetime(\'now\') WHERE id = ?',
-    ).run(ph, id);
-  }
-  if (b.role !== undefined) {
-    if (b.role !== 'admin' && b.role !== 'user') {
-      return badRequest(res, 'Ungültige Rolle.');
-    }
-    const admins = db
-      .prepare(
-        "SELECT COUNT(*) AS c FROM users WHERE role = 'admin' AND active = 1",
-      )
-      .get().c;
-    if (cur.role === 'admin' && b.role === 'user' && admins <= 1) {
-      return res.status(400).json({ message: 'Letzter Administrator kann nicht herabgestuft werden.' });
-    }
-    db.prepare('UPDATE users SET role = ?, updated_at = datetime(\'now\') WHERE id = ?').run(
-      b.role,
-      id,
-    );
-  }
-  if (b.active !== undefined) {
-    const active = b.active ? 1 : 0;
-    const admins = db
-      .prepare(
-        "SELECT COUNT(*) AS c FROM users WHERE role = 'admin' AND active = 1",
-      )
-      .get().c;
-    if (cur.role === 'admin' && cur.active && !active && admins <= 1) {
-      return res.status(400).json({ message: 'Letzter Administrator kann nicht deaktiviert werden.' });
-    }
-    db.prepare('UPDATE users SET active = ?, updated_at = datetime(\'now\') WHERE id = ?').run(
-      active,
-      id,
-    );
-  }
-
-  const row = db.prepare('SELECT * FROM users WHERE id = ?').get(id);
-  res.json(mapPublicUser(row));
-});
-
-admin.delete('/users/:id', (req, res) => {
-  const { id } = req.params;
-  if (!UUID.test(id)) return res.status(404).json({ message: 'Nicht gefunden' });
-  if (id === req.session.userId) {
-    return res.status(400).json({ message: 'Eigenes Konto kann nicht gelöscht werden.' });
-  }
-  const cur = db.prepare('SELECT * FROM users WHERE id = ?').get(id);
-  if (!cur) return res.status(404).json({ message: 'Nicht gefunden' });
-  if (cur.role === 'admin') {
-    const admins = db
-      .prepare(
-        "SELECT COUNT(*) AS c FROM users WHERE role = 'admin' AND active = 1",
-      )
-      .get().c;
-    if (admins <= 1) {
-      return res.status(400).json({ message: 'Letzter Administrator kann nicht gelöscht werden.' });
-    }
-  }
-  db.prepare('DELETE FROM users WHERE id = ?').run(id);
-  res.json({ ok: true });
-});
-
-admin.get('/settings/integrations', (_req, res) => {
-  res.json(loadIntegrations());
-});
-
-admin.put('/settings/integrations', (req, res) => {
-  const b = req.body || {};
-  const cur = loadIntegrations();
-  if (b.ldap && typeof b.ldap === 'object') {
-    const incoming = { ...b.ldap };
-    if (incoming.bindPassword === '' || incoming.bindPassword == null) {
-      delete incoming.bindPassword;
-    }
-    if (incoming.syncIntervalMinutes != null) {
-      const n = Number(incoming.syncIntervalMinutes);
-      incoming.syncIntervalMinutes = Number.isFinite(n) ? Math.max(0, Math.floor(n)) : 1440;
-    }
-    Object.assign(cur.ldap, incoming);
-    if (b.ldap.userSearchFilter != null) {
-      cur.ldap.userFilter = String(b.ldap.userSearchFilter);
-    }
-  }
-  if (b.teamviewer && typeof b.teamviewer === 'object') {
-    const inc = { ...b.teamviewer };
-    if (inc.bearerToken === '' || inc.bearerToken == null) {
-      delete inc.bearerToken;
-    }
-    Object.assign(cur.teamviewer, inc);
-  }
-  saveIntegrations(cur);
-  restartLdapSyncScheduler();
-  res.json(loadIntegrations());
-});
-
-admin.get('/ldap/sync-status', (_req, res) => {
-  res.json(getSyncStatus(db));
-});
-
-admin.post('/ldap/sync', async (_req, res) => {
-  const r = await performLdapSync(db, loadIntegrations, 'manual');
-  if (r.skipped) {
-    return res.status(409).json({ message: r.message });
-  }
-  res.json(r);
-});
-
-app.use('/api', admin);
-
-/** Unbekannte /api/*-Routen: JSON 404 — verhindert SPA index.html (HTML) mit 200 bei falscher Route/alter Serverversion */
+/** Unbekannte /api/*-Routen: JSON 404 */
 app.use('/api', (req, res) => {
   res.status(404).json({ message: 'API nicht gefunden' });
 });
 
-app.use(express.static(path.join(__dirname, '..', 'public')));
-
-/** SPA: Direktaufrufe wie /tickets ohne Hash liefern index.html (Client-Routing) */
-app.get('*', (req, res) => {
-  res.sendFile(path.join(__dirname, '..', 'public', 'index.html'));
+app.get('/', (_req, res) => {
+  res.redirect(302, '/start.html');
 });
 
+app.use(express.static(path.join(__dirname, '..', 'public')));
+
 app.listen(PORT, () => {
   restartLdapSyncScheduler();
   console.log(`CRM-Server http://localhost:${PORT}`);