Main update

2026-06-24 02:24:39 +02:00
parent 5ff4c3fb2b
commit d121f74bd0
34 changed files with 2548 additions and 67 deletions
--- a/public/admin/cron/index.php
+++ b/public/admin/cron/index.php
@@ -0,0 +1,338 @@
+<?php
+
+declare(strict_types=1);
+
+require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
+
+use App\ConfigLoader;
+use App\CronManagementService;
+use App\KeycloakAuth;
+use ModulesCore\ModuleRegistry;
+
+if (session_status() !== PHP_SESSION_ACTIVE) {
+    session_start();
+}
+
+$projectRoot = dirname(__DIR__, 3);
+$auth = new KeycloakAuth(ConfigLoader::load($projectRoot, 'keycloak'));
+if (!$auth->isAuthenticated()) {
+    header('Location: /auth/keycloak', true, 302);
+    exit;
+}
+
+$currentUser = is_array($_SESSION['desktop_auth']['user'] ?? null) ? $_SESSION['desktop_auth']['user'] : [];
+$currentGroups = array_map(
+    static fn (string $group): string => strtolower(trim($group, '/')),
+    array_values(array_map('strval', (array) ($currentUser['groups'] ?? [])))
+);
+$isPartial = !empty($_GET['partial']);
+
+if (!in_array('administrators', $currentGroups, true)) {
+    http_response_code(403);
+    $forbidden = '<div class="window-app-shell cm-shell"><div class="window-app-frame cm-frame"><main class="window-app-main cm-main"><div class="window-app-panel cm-panel"><section class="window-app-card cm-card"><p class="cm-message is-error">Kein Zugriff auf Cron Tool.</p></section></div></main></div></div>';
+    if ($isPartial) {
+        echo $forbidden;
+        return;
+    }
+
+    ?><!DOCTYPE html>
+    <html lang="de">
+    <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>Cron Tool</title>
+        <link rel="stylesheet" href="/assets/desktop/desktop.css">
+        <link rel="stylesheet" href="/assets/apps/cron-management/app.css">
+    </head>
+    <body><?= $forbidden ?></body>
+    </html><?php
+    return;
+}
+
+$csrfToken = (string) ($_SESSION['cron_management_token'] ?? '');
+if ($csrfToken === '') {
+    $csrfToken = bin2hex(random_bytes(16));
+    $_SESSION['cron_management_token'] = $csrfToken;
+}
+
+$baseUrlFallback = ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http')
+    . '://'
+    . ($_SERVER['HTTP_HOST'] ?? 'localhost');
+
+$service = new CronManagementService($projectRoot, new ModuleRegistry($projectRoot . '/modules'));
+$messages = [];
+$errors = [];
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $postedToken = (string) ($_POST['csrf_token'] ?? '');
+
+    if ($postedToken === '' || !hash_equals($csrfToken, $postedToken)) {
+        $errors[] = 'Die Formularpruefung ist fehlgeschlagen.';
+    } else {
+        $action = (string) ($_POST['action'] ?? '');
+
+        try {
+            if ($action === 'save-global') {
+                $service->saveGlobal([
+                    'base_url' => (string) ($_POST['base_url'] ?? ''),
+                    'default_timezone' => (string) ($_POST['default_timezone'] ?? ''),
+                ], $baseUrlFallback);
+                $messages[] = 'Globale Cron-Einstellungen gespeichert.';
+            } elseif ($action === 'regenerate-token') {
+                $service->regenerateToken($baseUrlFallback);
+                $messages[] = 'Cron-Token wurde neu erzeugt.';
+            } elseif ($action === 'run-due') {
+                $results = $service->runDue($baseUrlFallback);
+                if ($results === []) {
+                    $messages[] = 'Aktuell war kein Cron-Job faellig.';
+                } else {
+                    foreach ($results as $result) {
+                        $messages[] = sprintf(
+                            '%s: %s',
+                            (string) ($result['job_key'] ?? 'Cron-Job'),
+                            (string) ($result['message'] ?? '')
+                        );
+                    }
+                }
+            } elseif ($action === 'save-job') {
+                $jobKey = (string) ($_POST['job_key'] ?? '');
+                $service->saveJob($jobKey, [
+                    'enabled' => !empty($_POST['enabled']),
+                    'cron_expression' => (string) ($_POST['cron_expression'] ?? ''),
+                    'timezone' => (string) ($_POST['timezone'] ?? ''),
+                ], $baseUrlFallback);
+                $messages[] = 'Cron-Job gespeichert: ' . $jobKey;
+            } elseif ($action === 'run-now') {
+                $jobKey = (string) ($_POST['job_key'] ?? '');
+                $result = $service->runNow($jobKey, $baseUrlFallback);
+                if (!empty($result['ok'])) {
+                    $messages[] = (string) ($result['message'] ?? 'Cron-Job ausgefuehrt.');
+                } else {
+                    $errors[] = (string) ($result['message'] ?? 'Cron-Job fehlgeschlagen.');
+                }
+            }
+        } catch (\Throwable $exception) {
+            $errors[] = $exception->getMessage();
+        }
+    }
+}
+
+$bootstrap = $service->bootstrap($baseUrlFallback);
+$settings = is_array($bootstrap['settings'] ?? null) ? $bootstrap['settings'] : [];
+$jobs = is_array($bootstrap['jobs'] ?? null) ? $bootstrap['jobs'] : [];
+$h = static fn (?string $value): string => htmlspecialchars($value ?? '', ENT_QUOTES);
+
+ob_start();
+?>
+<div id="cron-management-app" class="window-app-shell cm-shell">
+    <div class="window-app-frame cm-frame">
+        <aside class="window-app-sidebar cm-sidebar">
+            <div class="window-app-brand cm-brand">
+                <p class="window-app-kicker cm-kicker">Systemtool</p>
+                <h1>Cron Tool</h1>
+                <p class="window-app-copy cm-copy">Zentrale Verwaltung fuer modulweite Cron-Jobs, Zeitplaene und manuelle Testlaeufe.</p>
+            </div>
+
+            <section class="window-app-card cm-card">
+                <strong class="cm-side-title">Schnellstatus</strong>
+                <div class="cm-side-metric">
+                    <span>Definierte Jobs</span>
+                    <strong><?= count($jobs) ?></strong>
+                </div>
+                <div class="cm-side-metric">
+                    <span>Faellige Jobs</span>
+                    <strong><?= count(array_filter($jobs, static fn (array $job): bool => !empty($job['is_due']))) ?></strong>
+                </div>
+                <div class="cm-side-metric">
+                    <span>Standard-Zeitzone</span>
+                    <strong><?= $h((string) ($settings['default_timezone'] ?? 'Europe/Berlin')) ?></strong>
+                </div>
+            </section>
+        </aside>
+
+        <main class="window-app-main cm-main">
+            <div class="window-app-panel cm-panel">
+                <section class="window-app-hero cm-hero">
+                    <div>
+                        <p class="window-app-kicker cm-kicker">Cron Registry</p>
+                        <h2 class="window-app-title">Globale Scheduler-Verwaltung</h2>
+                        <p class="window-app-copy cm-copy">Module hinterlegen ihre Cron-Endpunkte in der Manifest-Datei. Dieses Systemtool sammelt sie automatisch und verwaltet Zeitplaene zentral.</p>
+                    </div>
+                    <div class="window-app-pill-row cm-pill-row">
+                        <span class="window-app-pill">Base URL: <?= $h((string) ($settings['base_url'] ?? '')) ?></span>
+                        <span class="window-app-pill">Token aktiv</span>
+                        <span class="window-app-pill">Admin only</span>
+                    </div>
+                </section>
+
+                <?php if ($messages !== []): ?>
+                    <section class="window-app-card cm-card">
+                        <div class="cm-message is-success">
+                            <strong>Ergebnis</strong>
+                            <ul class="cm-list">
+                                <?php foreach ($messages as $message): ?>
+                                    <li><?= $h($message) ?></li>
+                                <?php endforeach; ?>
+                            </ul>
+                        </div>
+                    </section>
+                <?php endif; ?>
+
+                <?php if ($errors !== []): ?>
+                    <section class="window-app-card cm-card">
+                        <div class="cm-message is-error">
+                            <strong>Bitte pruefen</strong>
+                            <ul class="cm-list">
+                                <?php foreach ($errors as $error): ?>
+                                    <li><?= $h($error) ?></li>
+                                <?php endforeach; ?>
+                            </ul>
+                        </div>
+                    </section>
+                <?php endif; ?>
+
+                <section class="window-app-card cm-card">
+                    <div class="cm-section-head">
+                        <div>
+                            <p class="window-app-kicker cm-kicker">Global</p>
+                            <h3 class="cm-section-title">Runner-Einstellungen</h3>
+                        </div>
+                    </div>
+
+                    <form class="cm-form cm-form--global" method="post" action="/admin/cron/">
+                        <input type="hidden" name="csrf_token" value="<?= $h($csrfToken) ?>">
+                        <input type="hidden" name="action" value="save-global">
+                        <label class="cm-field">
+                            <span>Base URL fuer Cron-Aufrufe</span>
+                            <input type="text" name="base_url" value="<?= $h((string) ($settings['base_url'] ?? '')) ?>" placeholder="https://staging.desktop.kusche.berlin">
+                        </label>
+                        <label class="cm-field">
+                            <span>Standard-Zeitzone</span>
+                            <input type="text" name="default_timezone" value="<?= $h((string) ($settings['default_timezone'] ?? 'Europe/Berlin')) ?>" list="timezone-options">
+                        </label>
+                        <div class="cm-token-box">
+                            <strong>Cron-Token</strong>
+                            <code><?= $h((string) ($settings['cron_token'] ?? '')) ?></code>
+                            <p>Der Token wird fuer interne Cron-Aufrufe per `X-Desktop-Cron-Token` genutzt.</p>
+                        </div>
+                        <div class="cm-actions">
+                            <button class="window-app-nav-button cm-primary" type="submit">Globale Einstellungen speichern</button>
+                        </div>
+                    </form>
+
+                    <form class="cm-inline-form" method="post" action="/admin/cron/">
+                        <input type="hidden" name="csrf_token" value="<?= $h($csrfToken) ?>">
+                        <input type="hidden" name="action" value="regenerate-token">
+                        <button class="window-app-nav-button cm-secondary" type="submit">Cron-Token neu erzeugen</button>
+                    </form>
+
+                    <form class="cm-inline-form" method="post" action="/admin/cron/">
+                        <input type="hidden" name="csrf_token" value="<?= $h($csrfToken) ?>">
+                        <input type="hidden" name="action" value="run-due">
+                        <button class="window-app-nav-button cm-secondary" type="submit">Faellige Jobs jetzt ausfuehren</button>
+                    </form>
+                </section>
+
+                <section class="window-app-card cm-card">
+                    <div class="cm-section-head">
+                        <div>
+                            <p class="window-app-kicker cm-kicker">Jobs</p>
+                            <h3 class="cm-section-title">Erkannte Modul-Crons</h3>
+                        </div>
+                    </div>
+
+                    <div class="cm-job-list">
+                        <?php foreach ($jobs as $job): ?>
+                            <article class="window-app-card cm-job-card">
+                                <div class="cm-job-head">
+                                    <div>
+                                        <strong><?= $h((string) ($job['label'] ?? $job['job_key'] ?? 'Cron-Job')) ?></strong>
+                                        <p><?= $h((string) ($job['description'] ?? '')) ?></p>
+                                    </div>
+                                    <div class="cm-job-meta">
+                                        <span class="window-app-pill"><?= $h((string) ($job['module_id'] ?? 'module')) ?></span>
+                                        <span class="window-app-pill"><?= $h((string) ($job['method'] ?? 'POST')) ?></span>
+                                    </div>
+                                </div>
+
+                                <div class="cm-status-grid">
+                                    <div><span>Status</span><strong><?= $h((string) (($job['state']['last_status'] ?? '') ?: ($job['enabled'] ? 'aktiv' : 'inaktiv'))) ?></strong></div>
+                                    <div><span>Naechster Lauf</span><strong><?= $h((string) (($job['next_due_at_local'] ?? '') ?: 'n/a')) ?></strong></div>
+                                    <div><span>Letzter Erfolg</span><strong><?= $h((string) (($job['state_local']['last_success_at'] ?? '') ?: 'n/a')) ?></strong></div>
+                                    <div><span>Endpoint</span><strong><?= $h((string) ($job['endpoint_path'] ?? '')) ?></strong></div>
+                                </div>
+
+                                <?php if (!empty($job['parse_error'])): ?>
+                                    <p class="cm-parse-error">Cron-Fehler: <?= $h((string) $job['parse_error']) ?></p>
+                                <?php endif; ?>
+                                <?php if (!empty($job['state']['last_message'])): ?>
+                                    <p class="cm-job-message"><?= $h((string) $job['state']['last_message']) ?></p>
+                                <?php endif; ?>
+
+                                <form class="cm-form" method="post" action="/admin/cron/">
+                                    <input type="hidden" name="csrf_token" value="<?= $h($csrfToken) ?>">
+                                    <input type="hidden" name="action" value="save-job">
+                                    <input type="hidden" name="job_key" value="<?= $h((string) ($job['job_key'] ?? '')) ?>">
+                                    <label class="cm-check">
+                                        <input type="checkbox" name="enabled" value="1" <?= !empty($job['enabled']) ? 'checked' : '' ?>>
+                                        <span>Aktiv</span>
+                                    </label>
+                                    <label class="cm-field">
+                                        <span>Cron-Ausdruck</span>
+                                        <input type="text" name="cron_expression" value="<?= $h((string) ($job['cron_expression'] ?? '0 * * * *')) ?>">
+                                    </label>
+                                    <label class="cm-field">
+                                        <span>Zeitzone</span>
+                                        <input type="text" name="timezone" value="<?= $h((string) ($job['timezone'] ?? ($settings['default_timezone'] ?? 'Europe/Berlin'))) ?>" list="timezone-options">
+                                    </label>
+                                    <div class="cm-actions">
+                                        <button class="window-app-nav-button cm-primary" type="submit">Zeitplan speichern</button>
+                                    </div>
+                                </form>
+
+                                <form class="cm-inline-form" method="post" action="/admin/cron/">
+                                    <input type="hidden" name="csrf_token" value="<?= $h($csrfToken) ?>">
+                                    <input type="hidden" name="action" value="run-now">
+                                    <input type="hidden" name="job_key" value="<?= $h((string) ($job['job_key'] ?? '')) ?>">
+                                    <button class="window-app-nav-button cm-secondary" type="submit">Jetzt ausfuehren</button>
+                                </form>
+                            </article>
+                        <?php endforeach; ?>
+                        <?php if ($jobs === []): ?>
+                            <div class="cm-empty">Aktuell wurden noch keine Cron-Jobs aus Modulen registriert.</div>
+                        <?php endif; ?>
+                    </div>
+                </section>
+            </div>
+        </main>
+    </div>
+</div>
+<datalist id="timezone-options">
+    <?php foreach (DateTimeZone::listIdentifiers() as $timezone): ?>
+        <option value="<?= $h($timezone) ?>"></option>
+    <?php endforeach; ?>
+</datalist>
+<?php
+$pageContent = (string) ob_get_clean();
+
+if ($isPartial) {
+    echo $pageContent;
+    return;
+}
+?><!DOCTYPE html>
+<html lang="de">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Cron Tool</title>
+    <link rel="stylesheet" href="/assets/desktop/desktop.css">
+    <link rel="stylesheet" href="/assets/apps/cron-management/app.css">
+</head>
+<body>
+    <?= $pageContent ?>
+    <script src="/assets/apps/cron-management/app.js"></script>
+    <script>
+        window.initCronManagementApp?.(document.getElementById('cron-management-app'), { standalone: true });
+    </script>
+</body>
+</html>
--- a/public/admin/users/index.php
+++ b/public/admin/users/index.php
@@ -134,6 +134,15 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
 $pendingRequests = $registration->pendingApprovals();
 $availableGroups = $registration->availableGroups();
 $existingUsers = $registration->searchExistingUsers('', 250);
+$selectedExistingUser = null;
+if ($manualUsername !== '') {
+    foreach ($existingUsers as $existingUser) {
+        if (strtolower((string) ($existingUser['username'] ?? '')) === strtolower($manualUsername)) {
+            $selectedExistingUser = $existingUser;
+            break;
+        }
+    }
+}
 $selected = $selectedId !== ''
    ? $registration->find($selectedId)
    : ($pendingRequests[0] ?? null);
@@ -348,17 +357,22 @@ ob_start();

                            <fieldset class="um-fieldset">
                                <legend>Gruppen fuer Aktivierung</legend>
-                                <div class="um-checkbox-grid">
-                                    <?php foreach ($availableGroups as $group): ?>
-                                        <label class="window-app-item um-checkbox-item">
-                                            <input type="checkbox" name="manual_group_dns[]" value="<?= $h((string) ($group['dn'] ?? '')) ?>">
-                                            <span class="window-app-item-main">
-                                                <strong><?= $h((string) ($group['label'] ?? '')) ?></strong>
-                                                <p><?= $h((string) ($group['dn'] ?? '')) ?></p>
-                                            </span>
-                                        </label>
-                                    <?php endforeach; ?>
-                                </div>
+                                        <div class="um-checkbox-grid">
+                                            <?php foreach ($availableGroups as $group): ?>
+                                                <?php
+                                                $groupDn = (string) ($group['dn'] ?? '');
+                                                $selectedGroupDns = array_values(array_map('strval', (array) ($selectedExistingUser['group_dns'] ?? [])));
+                                                $isChecked = in_array($groupDn, $selectedGroupDns, true);
+                                                ?>
+                                                <label class="window-app-item um-checkbox-item">
+                                            <input type="checkbox" name="manual_group_dns[]" value="<?= $h($groupDn) ?>" <?= $isChecked ? 'checked' : '' ?>>
+                                                    <span class="window-app-item-main">
+                                                        <strong><?= $h((string) ($group['label'] ?? '')) ?></strong>
+                                                        <p><?= $h($groupDn) ?></p>
+                                                    </span>
+                                                </label>
+                                            <?php endforeach; ?>
+                                        </div>
                            </fieldset>

                            <div class="um-actions">
--- a/public/api/boersenchecker/index.php
+++ b/public/api/boersenchecker/index.php
@@ -2,4 +2,34 @@

 declare(strict_types=1);

+require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
+
+use App\CronAuth;
+use ModulesCore\ModuleHttp;
+
+if (session_status() !== PHP_SESSION_ACTIVE) {
+    session_start();
+}
+
+$projectRoot = dirname(__DIR__, 3);
+$requestUri = (string) ($_SERVER['REQUEST_URI'] ?? '');
+$requestPath = (string) (parse_url($requestUri, PHP_URL_PATH) ?: '');
+$prefix = '/api/boersenchecker/index.php/';
+$relativePath = trim((string) ($_GET['path'] ?? ''), '/');
+
+if ($relativePath === '') {
+    $relativePath = str_starts_with($requestPath, $prefix)
+        ? substr($requestPath, strlen($prefix))
+        : ltrim((string) ($_SERVER['PATH_INFO'] ?? ''), '/');
+}
+
+$normalizedPath = strtolower(trim($relativePath, '/'));
+$cronPaths = [
+    'v1/cron/refresh-quotes',
+];
+
+if (!(in_array($normalizedPath, $cronPaths, true) && CronAuth::isAuthorizedRequest($projectRoot))) {
+    ModuleHttp::requireDesktopAccess($projectRoot, true);
+}
+
 require dirname(__DIR__, 3) . '/modules/boersenchecker/api/index.php';
--- a/public/api/fx-rates/index.php
+++ b/public/api/fx-rates/index.php
@@ -4,11 +4,31 @@ declare(strict_types=1);

 require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';

+use App\CronAuth;
 use ModulesCore\ModuleHttp;

 session_start();

 $projectRoot = dirname(__DIR__, 3);
-ModuleHttp::requireDesktopAccess($projectRoot, true);
+$requestUri = (string) ($_SERVER['REQUEST_URI'] ?? '');
+$requestPath = (string) (parse_url($requestUri, PHP_URL_PATH) ?: '');
+$prefix = '/api/fx-rates/index.php/';
+$relativePath = trim((string) ($_GET['path'] ?? ''), '/');
+
+if ($relativePath === '') {
+    $relativePath = str_starts_with($requestPath, $prefix)
+        ? substr($requestPath, strlen($prefix))
+        : ltrim((string) ($_SERVER['PATH_INFO'] ?? ''), '/');
+}
+
+$normalizedPath = strtolower(trim($relativePath, '/'));
+$cronPaths = [
+    'v1/refresh',
+    'v1/currency-catalog/sync',
+];
+
+if (!(in_array($normalizedPath, $cronPaths, true) && CronAuth::isAuthorizedRequest($projectRoot))) {
+    ModuleHttp::requireDesktopAccess($projectRoot, true);
+}

 require $projectRoot . '/modules/fx-rates/api/index.php';
--- a/public/assets/apps/cron-management/app.css
+++ b/public/assets/apps/cron-management/app.css
@@ -0,0 +1,186 @@
+#cron-management-app {
+    min-height: 100%;
+    color: #0f172a;
+    font-family: "IBM Plex Sans", "Segoe UI", sans-serif;
+}
+
+#cron-management-app,
+#cron-management-app * {
+    box-sizing: border-box;
+}
+
+#cron-management-app.is-loading {
+    opacity: 0.72;
+    pointer-events: none;
+}
+
+#cron-management-app .cm-shell,
+#cron-management-app .cm-frame,
+#cron-management-app .cm-main,
+#cron-management-app .cm-panel {
+    min-height: 100%;
+}
+
+#cron-management-app .cm-brand,
+#cron-management-app .cm-copy {
+    margin: 0;
+}
+
+#cron-management-app .cm-kicker {
+    margin: 0 0 10px;
+    font-size: 12px;
+    font-weight: 700;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: #2563eb;
+}
+
+#cron-management-app .cm-card,
+#cron-management-app .cm-job-card {
+    display: grid;
+    gap: 14px;
+}
+
+#cron-management-app .cm-side-title,
+#cron-management-app .cm-section-title {
+    margin: 0;
+    font-size: 18px;
+    line-height: 1.2;
+}
+
+#cron-management-app .cm-side-metric,
+#cron-management-app .cm-field,
+#cron-management-app .cm-token-box {
+    display: grid;
+    gap: 6px;
+}
+
+#cron-management-app .cm-side-metric span,
+#cron-management-app .cm-field span,
+#cron-management-app .cm-token-box p,
+#cron-management-app .cm-job-card p,
+#cron-management-app .cm-message,
+#cron-management-app .cm-empty {
+    font-size: 14px;
+    line-height: 1.5;
+    color: #475569;
+}
+
+#cron-management-app .cm-form {
+    display: grid;
+    gap: 14px;
+}
+
+#cron-management-app .cm-form--global {
+    grid-template-columns: repeat(auto-fit, minmax(240px, 1fr));
+    align-items: end;
+}
+
+#cron-management-app .cm-field input,
+#cron-management-app .cm-token-box,
+#cron-management-app .cm-status-grid > div {
+    width: 100%;
+    min-height: 46px;
+    padding: 12px 14px;
+    border-radius: 14px;
+    border: 1px solid rgba(148, 163, 184, 0.24);
+    background: rgba(255, 255, 255, 0.95);
+    color: #0f172a;
+    font: inherit;
+}
+
+#cron-management-app .cm-token-box code {
+    display: block;
+    overflow-wrap: anywhere;
+    font-size: 13px;
+}
+
+#cron-management-app .cm-actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 10px;
+    align-items: center;
+}
+
+#cron-management-app .cm-inline-form {
+    display: inline-flex;
+}
+
+#cron-management-app .cm-primary {
+    background: linear-gradient(135deg, #312e81, #4338ca);
+    color: #fff;
+}
+
+#cron-management-app .cm-secondary {
+    background: #eff6ff;
+    color: #1d4ed8;
+}
+
+#cron-management-app .cm-job-list {
+    display: grid;
+    gap: 16px;
+}
+
+#cron-management-app .cm-job-head,
+#cron-management-app .cm-section-head {
+    display: flex;
+    justify-content: space-between;
+    gap: 16px;
+    align-items: flex-start;
+}
+
+#cron-management-app .cm-job-meta {
+    display: flex;
+    gap: 8px;
+    flex-wrap: wrap;
+}
+
+#cron-management-app .cm-status-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+    gap: 12px;
+}
+
+#cron-management-app .cm-status-grid strong {
+    display: block;
+    margin-top: 4px;
+    color: #0f172a;
+}
+
+#cron-management-app .cm-check {
+    display: inline-flex;
+    gap: 10px;
+    align-items: center;
+    font-size: 14px;
+    color: #0f172a;
+}
+
+#cron-management-app .cm-message {
+    padding: 14px 16px;
+    border-radius: 14px;
+}
+
+#cron-management-app .cm-message.is-success {
+    background: rgba(34, 197, 94, 0.12);
+    color: #166534;
+}
+
+#cron-management-app .cm-message.is-error,
+#cron-management-app .cm-parse-error {
+    background: rgba(239, 68, 68, 0.1);
+    color: #991b1b;
+    padding: 12px 14px;
+    border-radius: 14px;
+}
+
+#cron-management-app .cm-list {
+    margin: 8px 0 0;
+    padding-left: 18px;
+}
+
+@media (max-width: 900px) {
+    #cron-management-app .cm-form--global,
+    #cron-management-app .cm-status-grid {
+        grid-template-columns: 1fr;
+    }
+}
--- a/public/assets/apps/cron-management/app.js
+++ b/public/assets/apps/cron-management/app.js
@@ -0,0 +1,103 @@
+(() => {
+    const normalizeUrl = (url) => {
+        const next = new URL(url, window.location.origin);
+        next.searchParams.set('partial', '1');
+        return next.toString();
+    };
+
+    const renderError = (host, message) => {
+        host.innerHTML = `
+            <div class="window-app-shell cm-shell">
+                <div class="window-app-frame cm-frame">
+                    <main class="window-app-main cm-main">
+                        <div class="window-app-panel cm-panel">
+                            <section class="window-app-card cm-card">
+                                <p class="cm-message is-error">${String(message || 'Cron Tool konnte nicht geladen werden.')}</p>
+                            </section>
+                        </div>
+                    </main>
+                </div>
+            </div>
+        `;
+    };
+
+    const bindInteractions = (host, loadRoute) => {
+        host.querySelectorAll('form[action]').forEach((form) => {
+            if (form.dataset.cmBound === '1') {
+                return;
+            }
+
+            const action = String(form.getAttribute('action') || '');
+            if (!action.startsWith('/admin/cron/')) {
+                return;
+            }
+
+            form.dataset.cmBound = '1';
+            form.addEventListener('submit', async (event) => {
+                event.preventDefault();
+
+                try {
+                    host.classList.add('is-loading');
+                    const response = await fetch(normalizeUrl(action), {
+                        method: 'POST',
+                        credentials: 'same-origin',
+                        body: new FormData(form),
+                    });
+
+                    const html = await response.text();
+                    if (!response.ok) {
+                        throw new Error(`HTTP ${response.status}`);
+                    }
+
+                    host.innerHTML = html;
+                    bindInteractions(host, loadRoute);
+                } catch (error) {
+                    renderError(host, error?.message || 'Cron Tool konnte nicht geladen werden.');
+                } finally {
+                    host.classList.remove('is-loading');
+                }
+            });
+        });
+    };
+
+    window.initCronManagementApp = function initCronManagementApp(host, options = {}) {
+        if (!(host instanceof Element)) {
+            return;
+        }
+
+        if (host.dataset.cmAppBound === '1') {
+            return;
+        }
+
+        host.dataset.cmAppBound = '1';
+
+        const entryRoute = String(options.entryRoute || '/admin/cron/');
+        const loadRoute = async (route) => {
+            try {
+                host.classList.add('is-loading');
+                const response = await fetch(normalizeUrl(route), {
+                    credentials: 'same-origin',
+                    headers: { Accept: 'text/html' },
+                });
+                const html = await response.text();
+                if (!response.ok) {
+                    throw new Error(`HTTP ${response.status}`);
+                }
+
+                host.innerHTML = html;
+                bindInteractions(host, loadRoute);
+            } catch (error) {
+                renderError(host, error?.message || 'Cron Tool konnte nicht geladen werden.');
+            } finally {
+                host.classList.remove('is-loading');
+            }
+        };
+
+        if (options.standalone) {
+            bindInteractions(host, loadRoute);
+            return;
+        }
+
+        loadRoute(entryRoute);
+    };
+})();
--- a/public/assets/apps/user-management/app.css
+++ b/public/assets/apps/user-management/app.css
@@ -192,6 +192,10 @@
    box-shadow: 0 20px 44px rgba(15, 23, 42, 0.12);
 }

+#user-management-app .um-user-picker-list[hidden] {
+    display: none !important;
+}
+
 #user-management-app .um-user-picker-option {
    display: grid;
    gap: 2px;
--- a/public/assets/apps/user-management/app.js
+++ b/public/assets/apps/user-management/app.js
@@ -48,6 +48,7 @@
            username: String(user?.username || ''),
            display_name: String(user?.display_name || ''),
            email: String(user?.email || ''),
+            group_dns: Array.isArray(user?.group_dns) ? user.group_dns.map((group) => String(group || '')) : [],
            search: [
                String(user?.username || ''),
                String(user?.display_name || ''),
@@ -74,6 +75,35 @@
            }
            input.dataset.umPickerBound = '1';

+            const syncGroupSelection = (username) => {
+                const normalizedUsername = String(username || '').trim().toLowerCase();
+                host.querySelectorAll('input[name="manual_group_dns[]"]').forEach((checkbox) => {
+                    if (!(checkbox instanceof HTMLInputElement)) {
+                        return;
+                    }
+
+                    checkbox.checked = false;
+                });
+
+                if (normalizedUsername === '') {
+                    return;
+                }
+
+                const user = normalizedUsers.find((entry) => entry.username.toLowerCase() === normalizedUsername);
+                if (!user) {
+                    return;
+                }
+
+                const selectedGroups = new Set(user.group_dns);
+                host.querySelectorAll('input[name="manual_group_dns[]"]').forEach((checkbox) => {
+                    if (!(checkbox instanceof HTMLInputElement)) {
+                        return;
+                    }
+
+                    checkbox.checked = selectedGroups.has(checkbox.value);
+                });
+            };
+
            const renderMatches = () => {
                const needle = input.value.trim().toLowerCase();
                const matches = normalizedUsers
@@ -109,8 +139,17 @@
                input.value = String(option.dataset.userPickerValue || '');
                list.hidden = true;
                list.innerHTML = '';
+                syncGroupSelection(input.value);
                input.dispatchEvent(new Event('change', { bubbles: true }));
            });
+
+            input.addEventListener('change', () => {
+                syncGroupSelection(input.value);
+            });
+
+            if (input.value.trim() !== '') {
+                syncGroupSelection(input.value);
+            }
        });

        if (!host.dataset.umPickerOutsideBound) {
--- a/public/assets/desktop/desktop.css
+++ b/public/assets/desktop/desktop.css
@@ -1228,6 +1228,40 @@ h1 {
    align-content: start;
 }

+.start-menu-group,
+.start-menu-group-list {
+    display: grid;
+    gap: 10px;
+}
+
+.start-menu-group {
+    gap: 12px;
+    padding-top: 6px;
+}
+
+.start-menu-group + .start-menu-group {
+    margin-top: 6px;
+    padding-top: 16px;
+    border-top: 1px solid rgba(255, 255, 255, 0.08);
+}
+
+.start-menu-group-header {
+    display: grid;
+    gap: 4px;
+    padding: 0 4px;
+}
+
+.start-menu-group-header strong {
+    font-size: 12px;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: rgba(255, 255, 255, 0.88);
+}
+
+.start-menu-group-header small {
+    color: rgba(248, 250, 252, 0.58);
+}
+
 .start-menu-selection-header {
    display: grid;
    gap: 10px;
--- a/public/assets/desktop/desktop.js
+++ b/public/assets/desktop/desktop.js
@@ -1612,6 +1612,92 @@ if (payloadNode) {
        await loadStatus();
    };

+    const renderActionPanelWidget = async (card, widget) => {
+        const statusNode = card.querySelector('[data-widget-status]');
+        const messageNode = card.querySelector('[data-widget-message]');
+        const actionButtons = Array.from(card.querySelectorAll('[data-widget-action]'));
+
+        const loadStatus = async () => {
+            if (!(statusNode instanceof HTMLElement) || !widget.status_api) {
+                return;
+            }
+
+            statusNode.textContent = 'Status wird geladen ...';
+
+            try {
+                const response = await fetch(widget.status_api, {
+                    credentials: 'same-origin',
+                    headers: { Accept: 'application/json' },
+                });
+                const payload = await response.json().catch(() => ({}));
+                if (!response.ok) {
+                    throw new Error(payload?.message || payload?.error || `HTTP ${response.status}`);
+                }
+
+                const data = payload?.data || {};
+                statusNode.textContent = String(data.status_text || data.message || 'Status geladen.');
+            } catch (error) {
+                statusNode.textContent = error instanceof Error ? error.message : 'Status konnte nicht geladen werden.';
+            }
+        };
+
+        const runAction = async (actionConfig) => {
+            if (!(messageNode instanceof HTMLElement) || !actionConfig || typeof actionConfig !== 'object') {
+                return;
+            }
+
+            const method = String(actionConfig.method || 'POST').toUpperCase();
+            const endpoint = String(actionConfig.endpoint || '');
+            if (endpoint === '') {
+                return;
+            }
+
+            messageNode.textContent = 'Aktion wird ausgefuehrt ...';
+
+            try {
+                const response = await fetch(endpoint, {
+                    method,
+                    credentials: 'same-origin',
+                    headers: {
+                        Accept: 'application/json',
+                        'Content-Type': 'application/json',
+                    },
+                    body: method === 'GET'
+                        ? null
+                        : JSON.stringify(actionConfig.payload && typeof actionConfig.payload === 'object' ? actionConfig.payload : {}),
+                });
+                const payload = await response.json().catch(() => ({}));
+                if (!response.ok) {
+                    throw new Error(payload?.message || payload?.error || `HTTP ${response.status}`);
+                }
+
+                messageNode.textContent = String(
+                    payload?.message
+                    || payload?.data?.message
+                    || payload?.data?.status_text
+                    || 'Aktion erfolgreich ausgefuehrt.'
+                );
+                await loadStatus();
+            } catch (error) {
+                messageNode.textContent = error instanceof Error ? error.message : 'Aktion fehlgeschlagen.';
+            }
+        };
+
+        actionButtons.forEach((button) => {
+            button.addEventListener('click', () => {
+                const actionId = button.getAttribute('data-widget-action') || '';
+                const actionConfig = Array.isArray(widget.actions)
+                    ? widget.actions.find((entry) => String(entry?.action_id || '') === actionId)
+                    : null;
+                if (actionConfig) {
+                    runAction(actionConfig);
+                }
+            });
+        });
+
+        await loadStatus();
+    };
+
    const renderWidgets = () => {
        if (!widgetZoneRoot) {
            return;
@@ -1643,6 +1729,21 @@ if (payloadNode) {
                            ${widget.launch_app_id ? `<button class="widget-card-action widget-card-action--secondary" type="button" data-app-id="${escapeHtml(widget.launch_app_id)}">${escapeHtml(widget.action_label || 'Oeffnen')}</button>` : ''}
                        </div>
                    `
+                    : widget.widget_type === 'action-panel'
+                        ? `
+                            <div class="widget-card-status" data-widget-status>${widget.content || 'Status wird geladen ...'}</div>
+                            <p class="widget-card-message" data-widget-message>${widget.summary || ''}</p>
+                            <div class="widget-card-actions">
+                                ${(Array.isArray(widget.actions) ? widget.actions : []).map((action) => `
+                                    <button
+                                        class="widget-card-action${action?.variant === 'secondary' ? ' widget-card-action--secondary' : ''}"
+                                        type="button"
+                                        data-widget-action="${escapeHtml(String(action?.action_id || ''))}"
+                                    >${escapeHtml(String(action?.label || 'Aktion'))}</button>
+                                `).join('')}
+                                ${widget.launch_app_id ? `<button class="widget-card-action widget-card-action--secondary" type="button" data-app-id="${escapeHtml(widget.launch_app_id)}">${escapeHtml(widget.action_label || 'Oeffnen')}</button>` : ''}
+                            </div>
+                        `
                    : `<p>${widget.content || ''}</p>${actionMarkup}`;
                card.innerHTML = `
                    <div class="widget-card-header">
@@ -1668,6 +1769,8 @@ if (payloadNode) {
                widgetZoneRoot.appendChild(card);
                if (widget.widget_type === 'fx-rates-refresh') {
                    renderFxRatesWidget(card, widget);
+                } else if (widget.widget_type === 'action-panel') {
+                    renderActionPanelWidget(card, widget);
                }
            });
    };
@@ -1706,23 +1809,58 @@ if (payloadNode) {
            return;
        }

-        payload.apps.forEach((app) => {
-            const button = document.createElement('button');
-            button.type = 'button';
-            button.className = 'start-menu-entry start-menu-entry--app';
-            button.innerHTML = `
-                <span class="start-menu-entry-badge">${buildAppIconMarkup(app, 'start-menu-app-icon')}</span>
-                <span>
-                    <strong>${app.title}</strong>
-                    <small>${app.summary || ''}</small>
-                </span>
-                <span class="start-menu-entry-toggle">Open</span>
-            `;
-            button.addEventListener('click', () => {
-                openApp(app);
-                closeStartMenu();
+        const groups = [
+            { id: 'core', label: 'Desktop', description: 'Globale Bereiche und Shell-Funktionen' },
+            { id: 'system_tool', label: 'Systemtools', description: 'Verwaltung und Setup' },
+            { id: 'module', label: 'Module', description: 'Installierte Fachanwendungen' },
+        ];
+
+        groups.forEach((group) => {
+            const apps = payload.apps.filter((app) => {
+                if (app.show_in_start_menu === false) {
+                    return false;
+                }
+
+                return String(app.app_scope || 'module') === group.id;
            });
-            startMenuApps.appendChild(button);
+
+            if (apps.length === 0) {
+                return;
+            }
+
+            const section = document.createElement('section');
+            section.className = 'start-menu-group';
+            section.innerHTML = `
+                <header class="start-menu-group-header">
+                    <strong>${group.label}</strong>
+                    <small>${group.description}</small>
+                </header>
+            `;
+
+            const list = document.createElement('div');
+            list.className = 'start-menu-group-list';
+
+            apps.forEach((app) => {
+                const button = document.createElement('button');
+                button.type = 'button';
+                button.className = 'start-menu-entry start-menu-entry--app';
+                button.innerHTML = `
+                    <span class="start-menu-entry-badge">${buildAppIconMarkup(app, 'start-menu-app-icon')}</span>
+                    <span>
+                        <strong>${app.title}</strong>
+                        <small>${app.summary || ''}</small>
+                    </span>
+                    <span class="start-menu-entry-toggle">Open</span>
+                `;
+                button.addEventListener('click', () => {
+                    openApp(app);
+                    closeStartMenu();
+                });
+                list.appendChild(button);
+            });
+
+            section.appendChild(list);
+            startMenuApps.appendChild(section);
        });
    };