Rebuild

2026-03-04 01:58:26 +01:00
parent a7844c145a
commit c360663603
23 changed files with 1115 additions and 81 deletions
--- a/public/assets/css/app.css
+++ b/public/assets/css/app.css
@@ -1,15 +1,51 @@
@import url('https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;600&family=Space+Grotesk:wght@400;600;700&display=swap');

 :root {
-  --bg: #0b0d12;
-  --panel: #121622;
-  --panel-2: #171c2b;
-  --text: #f4f6ff;
-  --muted: #b6bdd6;
-  --accent: #ff5e5b;
-  --accent-2: #20e3b2;
-  --line: #2a3147;
-  --shadow: 0 30px 80px rgba(8, 10, 18, 0.45);
+  --bg: #f4f6fb;
+  --panel: #ffffff;
+  --panel-2: #f0f3fb;
+  --text: #151a2d;
+  --muted: #5a6685;
+  --accent: #ff6b4a;
+  --accent-2: #0fb4a4;
+  --line: #d7dceb;
+  --shadow: 0 20px 50px rgba(22, 32, 74, 0.12);
+}
+
+body[data-theme="light"] {
+  --bg: #f4f6fb;
+  --panel: #ffffff;
+  --panel-2: #f0f3fb;
+  --text: #151a2d;
+  --muted: #5a6685;
+  --accent: #ff6b4a;
+  --accent-2: #0fb4a4;
+  --line: #d7dceb;
+  --shadow: 0 20px 50px rgba(22, 32, 74, 0.12);
+}
+
+body[data-theme="ocean"] {
+  --bg: #eef6ff;
+  --panel: #ffffff;
+  --panel-2: #e6f0ff;
+  --text: #0b1b33;
+  --muted: #3a4c6e;
+  --accent: #2d7bff;
+  --accent-2: #00b6b2;
+  --line: #c9d9f3;
+  --shadow: 0 20px 50px rgba(22, 32, 74, 0.12);
+}
+
+body[data-theme="graphite"] {
+  --bg: #f7f7f8;
+  --panel: #ffffff;
+  --panel-2: #eceff3;
+  --text: #1e222a;
+  --muted: #5c667a;
+  --accent: #ff7a00;
+  --accent-2: #6b7bff;
+  --line: #d5d8df;
+  --shadow: 0 20px 50px rgba(20, 24, 34, 0.12);
 }

 * { box-sizing: border-box; }
@@ -17,8 +53,8 @@ html, body { height: 100%; }
 body {
  margin: 0;
  font-family: "Space Grotesk", "Segoe UI", sans-serif;
-  background: radial-gradient(1200px 500px at 10% -10%, rgba(255, 94, 91, 0.2), transparent 60%),
-              radial-gradient(900px 500px at 90% 10%, rgba(32, 227, 178, 0.18), transparent 55%),
+  background: radial-gradient(1200px 500px at 10% -10%, rgba(255, 107, 74, 0.12), transparent 60%),
+              radial-gradient(900px 500px at 90% 10%, rgba(15, 180, 164, 0.12), transparent 55%),
              var(--bg);
  color: var(--text);
 }
@@ -36,26 +72,50 @@ body {
 .orb-a { top: -120px; left: -80px; background: #ff5e5b; }
 .orb-b { bottom: -160px; right: -120px; background: #20e3b2; }

-.site-shell {
+.app-shell {
  position: relative;
  z-index: 1;
  min-height: 100vh;
-  display: flex;
-  flex-direction: column;
-  padding: 32px 28px 24px;
+  display: grid;
+  grid-template-columns: 260px 1fr;
+  gap: 24px;
+  padding: 24px;
 }

-.site-header {
-  display: grid;
-  grid-template-columns: 1fr auto auto;
-  gap: 24px;
-  align-items: center;
-  background: linear-gradient(140deg, rgba(18, 22, 34, 0.9), rgba(23, 28, 43, 0.9));
+.app-sidebar {
+  background: var(--panel);
  border: 1px solid var(--line);
  border-radius: 18px;
-  padding: 20px 24px;
+  padding: 20px;
  box-shadow: var(--shadow);
-  backdrop-filter: blur(6px);
+  display: flex;
+  flex-direction: column;
+  gap: 18px;
+  position: sticky;
+  top: 24px;
+  height: fit-content;
+}
+
+.sidebar-toggle {
+  background: var(--panel-2);
+  border: 1px solid var(--line);
+  border-radius: 10px;
+  padding: 8px 10px;
+  cursor: pointer;
+  color: var(--text);
+  font-weight: 700;
+}
+
+.sidebar-collapsed .app-shell {
+  grid-template-columns: 72px 1fr;
+}
+.sidebar-collapsed .app-sidebar .brand-text,
+.sidebar-collapsed .app-sidebar .nav-section,
+.sidebar-collapsed .app-sidebar .nav-link {
+  display: none;
+}
+.sidebar-collapsed .app-sidebar .brand img {
+  height: 36px;
 }

 .brand {
@@ -78,35 +138,41 @@ body {
  font-size: 0.9rem;
 }

-.site-nav {
+.sidebar-nav {
  display: flex;
-  gap: 12px;
-  flex-wrap: wrap;
+  flex-direction: column;
+  gap: 8px;
+}
+.nav-section {
+  color: var(--muted);
+  font-size: 0.8rem;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+  margin-top: 6px;
 }
 .nav-link {
-  color: var(--muted);
+  color: var(--text);
  text-decoration: none;
  padding: 8px 14px;
-  border-radius: 999px;
+  border-radius: 10px;
  border: 1px solid transparent;
  transition: all 180ms ease;
  font-weight: 600;
 }
 .nav-link:hover {
-  color: var(--text);
  border-color: var(--line);
-  background: rgba(255, 255, 255, 0.04);
+  background: var(--panel-2);
 }
 .nav-link.is-active {
-  color: var(--bg);
+  color: #ffffff;
  background: var(--accent);
  border-color: var(--accent);
 }

-.header-cta .cta-button {
+.cta-button {
  background: linear-gradient(120deg, var(--accent), #ff9f45);
  border: none;
-  color: #0b0d12;
+  color: #ffffff;
  font-weight: 700;
  padding: 10px 18px;
  border-radius: 12px;
@@ -114,9 +180,66 @@ body {
  box-shadow: 0 14px 30px rgba(255, 94, 91, 0.35);
 }

+.app-content {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+}
+
+.topbar {
+  background: var(--panel);
+  border: 1px solid var(--line);
+  border-radius: 16px;
+  padding: 16px 20px;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  box-shadow: var(--shadow);
+}
+.page-title {
+  margin: 0;
+  font-size: 1.25rem;
+}
+.topbar-actions {
+  display: flex;
+  gap: 10px;
+  flex-wrap: wrap;
+}
+
+.module-subnav {
+  display: flex;
+  gap: 10px;
+  flex-wrap: wrap;
+  padding: 8px 12px;
+  border: 1px solid var(--line);
+  border-radius: 12px;
+  background: var(--panel-2);
+}
+
+.debug-fab {
+  position: fixed;
+  right: 24px;
+  bottom: 24px;
+  width: 52px;
+  height: 52px;
+  border-radius: 50%;
+  background: var(--accent);
+  color: #ffffff;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  text-decoration: none;
+  font-size: 22px;
+  box-shadow: 0 16px 32px rgba(255, 107, 74, 0.28);
+  z-index: 50;
+}
+.debug-fab:hover {
+  filter: brightness(0.95);
+}
+
 .site-main {
  flex: 1;
-  margin-top: 28px;
 }

 .site-footer {
@@ -136,7 +259,15 @@ body {
 }
 .card input,
 .card textarea {
-  background: #0f121b;
+  background: #ffffff;
+  border: 1px solid var(--line);
+  color: var(--text);
+  padding: 10px 12px;
+  border-radius: 10px;
+  font-family: inherit;
+}
+.card select {
+  background: #ffffff;
  border: 1px solid var(--line);
  color: var(--text);
  padding: 10px 12px;
@@ -167,17 +298,13 @@ body {
  gap: 16px;
 }

-@media (max-width: 900px) {
-  .site-header {
-    grid-template-columns: 1fr;
-  }
-  .header-cta {
-    justify-self: start;
-  }
+@media (max-width: 1100px) {
+  .app-shell { grid-template-columns: 1fr; }
+  .app-sidebar { position: relative; top: 0; }
 }
@media (max-width: 720px) {
  .grid { grid-template-columns: 1fr; }
-  .site-shell { padding: 24px 18px 20px; }
+  .app-shell { padding: 18px; }
 }

 /* Minimal Tailwind-like utility support for existing templates */
@@ -194,13 +321,13 @@ body {
 }

 .text-white { color: #ffffff; }
-.text-gray-200 { color: #d9deee; }
-.text-gray-300 { color: #c2c9de; }
-.text-gray-400 { color: #a9b1c9; }
-.text-gray-500 { color: #8b94ad; }
-.text-red-100 { color: #ffe2e2; }
-.text-indigo-400 { color: #9aa5ff; }
-.hover\\:text-indigo-300:hover { color: #b7c0ff; }
+.text-gray-200 { color: #3a4c6e; }
+.text-gray-300 { color: #4b5775; }
+.text-gray-400 { color: #5a6685; }
+.text-gray-500 { color: #6b7696; }
+.text-red-100 { color: #8b1d1d; }
+.text-indigo-400 { color: #2d7bff; }
+.hover\\:text-indigo-300:hover { color: #1b63da; }
 .font-medium { font-weight: 600; }
 .font-semibold { font-weight: 700; }
 .font-bold { font-weight: 700; }
@@ -219,8 +346,8 @@ body {
 .border-red-500 { border-color: #ff5e5b; }
 .border-gray-700 { border-color: var(--line); }
 .bg-gray-800 { background: var(--panel); }
-.bg-gray-900 { background: #0f121b; }
-.bg-red-900 { background: #2c1214; }
+.bg-gray-900 { background: var(--panel-2); }
+.bg-red-900 { background: #ffe9e9; }
 .shadow { box-shadow: var(--shadow); }
 .overflow-hidden { overflow: hidden; }
 .overflow-x-auto { overflow-x: auto; }
--- a/public/assets/js/app.js
+++ b/public/assets/js/app.js
@@ -1 +1,13 @@
-console.log('mini example loaded');
+(() => {
+  const toggle = document.querySelector('[data-sidebar-toggle]');
+  if (toggle) {
+    toggle.addEventListener('click', () => {
+      document.body.classList.toggle('sidebar-collapsed');
+      localStorage.setItem('sidebar-collapsed', document.body.classList.contains('sidebar-collapsed') ? '1' : '0');
+    });
+  }
+
+  if (localStorage.getItem('sidebar-collapsed') === '1') {
+    document.body.classList.add('sidebar-collapsed');
+  }
+})();
--- a/public/index.php
+++ b/public/index.php
@@ -22,6 +22,20 @@ if (defined('APP_BASIC_AUTH') && APP_BASIC_AUTH && !$isRetoolPath) {
    }
 }

+// OIDC Auth
+$publicPaths = [
+    'auth/login',
+    'auth/callback',
+    'auth/logout',
+];
+if (defined('APP_AUTH_ENABLED') && APP_AUTH_ENABLED && !in_array($uriPath, $publicPaths, true)) {
+    $user = auth_user();
+    if (!$user) {
+        header('Location: /auth/login', true, 302);
+        exit;
+    }
+}
+
 // Sicherheitscheck
 if (str_contains($uriPath, '..')) {
    http_response_code(400);
@@ -29,9 +43,23 @@ if (str_contains($uriPath, '..')) {
 }

 // Spezialrouten für Module
-if (str_starts_with($uriPath, 'modules/setup/')) {
+if (str_starts_with($uriPath, 'modules/install')) {
+    $target = __DIR__ . '/page/modules_install.php';
+} elseif (str_starts_with($uriPath, 'modules/setup/')) {
    $_GET['module'] = trim(substr($uriPath, strlen('modules/setup/')), '/');
    $target = __DIR__ . '/page/modules_setup.php';
+} elseif ($uriPath === 'auth/login') {
+    $target = __DIR__ . '/page/auth_login.php';
+} elseif ($uriPath === 'auth/callback') {
+    $target = __DIR__ . '/page/auth_callback.php';
+} elseif ($uriPath === 'auth/logout') {
+    $target = __DIR__ . '/page/auth_logout.php';
+} elseif ($uriPath === 'settings') {
+    $target = __DIR__ . '/page/settings.php';
+} elseif ($uriPath === 'users') {
+    $target = __DIR__ . '/page/users.php';
+} elseif ($uriPath === 'debug') {
+    $target = __DIR__ . '/page/debug.php';
 } elseif (preg_match('~^module/([a-zA-Z0-9_-]+)(?:/(.+))?$~', $uriPath, $m)) {
    $module = $m[1];
    $page = isset($m[2]) && $m[2] !== '' ? trim($m[2], '/') : 'index';
--- a/public/page/404.php
+++ b/public/page/404.php
@@ -0,0 +1,11 @@
+<?php
+http_response_code(404);
+?>
+<div class="card">
+  <div class="pill">404</div>
+  <h1 style="margin-top:.75rem;">Seite nicht gefunden</h1>
+  <p class="muted">Die angeforderte Seite existiert nicht oder wurde verschoben.</p>
+  <div style="margin-top:1rem;">
+    <a class="nav-link" href="/">Zur Startseite</a>
+  </div>
+</div>
--- a/public/page/auth_callback.php
+++ b/public/page/auth_callback.php
@@ -0,0 +1,49 @@
+<?php
+use App\OidcClient;
+
+$config = app()->config();
+$session = app()->session();
+$session->start();
+
+if (!$config->authEnabled) {
+    echo '<div class="card">Auth ist deaktiviert.</div>';
+    return;
+}
+
+$code = (string)($_GET['code'] ?? '');
+$state = (string)($_GET['state'] ?? '');
+$expectedState = (string)($_SESSION['oidc_state'] ?? '');
+$nonce = (string)($_SESSION['oidc_nonce'] ?? '');
+
+if ($code === '' || $state === '' || $expectedState === '' || !hash_equals($expectedState, $state)) {
+    echo '<div class="card">Ungültiger Login-Status.</div>';
+    return;
+}
+
+unset($_SESSION['oidc_state']);
+
+$client = new OidcClient($config);
+$token = $client->exchangeCode($code);
+
+$idToken = (string)($token['id_token'] ?? '');
+if ($idToken === '') {
+    echo '<div class="card">Kein ID Token erhalten.</div>';
+    return;
+}
+
+$claims = $client->decodeJwt($idToken);
+$client->validateIdToken($claims, $nonce);
+unset($_SESSION['oidc_nonce']);
+
+$groups = $client->groupsFromClaims($claims);
+$user = [
+    'sub' => (string)($claims['sub'] ?? ''),
+    'email' => (string)($claims['email'] ?? ''),
+    'name' => (string)($claims['name'] ?? ($claims['preferred_username'] ?? '')),
+    'groups' => $groups,
+    'id_token' => $idToken,
+];
+
+$_SESSION['auth_user'] = $user;
+
+redirect('/');
--- a/public/page/auth_login.php
+++ b/public/page/auth_login.php
@@ -0,0 +1,19 @@
+<?php
+use App\OidcClient;
+
+$config = app()->config();
+if (!$config->authEnabled) {
+    echo '<div class="card">Auth ist deaktiviert.</div>';
+    return;
+}
+
+$session = app()->session();
+$session->start();
+
+$state = bin2hex(random_bytes(16));
+$nonce = bin2hex(random_bytes(16));
+$_SESSION['oidc_state'] = $state;
+$_SESSION['oidc_nonce'] = $nonce;
+
+$client = new OidcClient($config);
+redirect($client->authUrl($state, $nonce));
--- a/public/page/auth_logout.php
+++ b/public/page/auth_logout.php
@@ -0,0 +1,23 @@
+<?php
+use App\OidcClient;
+
+$config = app()->config();
+$session = app()->session();
+$session->start();
+
+$idToken = null;
+if (!empty($_SESSION['auth_user']['id_token'])) {
+    $idToken = (string)$_SESSION['auth_user']['id_token'];
+}
+
+unset($_SESSION['auth_user']);
+
+if ($config->authEnabled) {
+    $client = new OidcClient($config);
+    $url = $client->logoutUrl($idToken);
+    if ($url) {
+        redirect($url);
+    }
+}
+
+redirect('/');
--- a/public/page/debug.php
+++ b/public/page/debug.php
@@ -0,0 +1,90 @@
+<?php
+require_admin();
+
+if (!defined('APP_DEBUG_TOOL') || !APP_DEBUG_TOOL) {
+    echo '<div class="card">Debug-Tool ist deaktiviert.</div>';
+    return;
+}
+
+$debugDir = __DIR__ . '/../../debug';
+if (!is_dir($debugDir)) {
+    echo '<div class="card">Debug-Verzeichnis fehlt.</div>';
+    return;
+}
+
+$files = array_values(array_filter(scandir($debugDir) ?: [], function ($f) use ($debugDir) {
+    if ($f === '.' || $f === '..') return false;
+    $path = $debugDir . '/' . $f;
+    return is_file($path);
+}));
+
+$selected = (string)($_GET['file'] ?? '');
+$content = null;
+
+if ($selected !== '' && preg_match('/^[a-zA-Z0-9._-]+$/', $selected)) {
+    $path = $debugDir . '/' . $selected;
+    if (is_file($path)) {
+        $content = file_get_contents($path);
+    }
+}
+
+if (isset($_GET['raw']) && $_GET['raw'] === '1') {
+    header('Content-Type: text/plain; charset=utf-8');
+    echo $content ?? '';
+    return;
+}
+?>
+<div class="card">
+  <div class="pill">Debug</div>
+  <h1 style="margin-top:.75rem;">Debug Logs</h1>
+  <p class="muted">Hier kannst du temporäre Log-Files aus dem <code>debug/</code>-Ordner ansehen.</p>
+
+  <div style="margin-top:1rem;" class="grid">
+    <div class="card" style="background:var(--panel-2);">
+      <strong>Logs</strong>
+      <ul style="margin-top:.5rem;">
+        <?php if (!$files): ?>
+          <li class="muted">Keine Logs vorhanden.</li>
+        <?php endif; ?>
+        <?php foreach ($files as $f): ?>
+          <li>
+            <a class="nav-link" href="/debug?file=<?= e($f) ?>"><?= e($f) ?></a>
+          </li>
+        <?php endforeach; ?>
+      </ul>
+    </div>
+    <div class="card" style="background:var(--panel-2);">
+      <strong>Inhalt</strong>
+      <?php if ($content === null): ?>
+        <p class="muted" style="margin-top:.5rem;">Wähle eine Datei.</p>
+      <?php else: ?>
+        <pre id="debug-content" style="margin-top:.5rem; white-space:pre-wrap; font-family:monospace;"><?= e($content) ?></pre>
+      <?php endif; ?>
+    </div>
+  </div>
+</div>
+
+<?php if ($selected !== ''): ?>
+<script>
+(() => {
+  const el = document.getElementById('debug-content');
+  if (!el) return;
+  const url = new URL(window.location.href);
+  url.searchParams.set('raw', '1');
+  let last = '';
+  async function tick() {
+    try {
+      const res = await fetch(url.toString(), { cache: 'no-store' });
+      if (!res.ok) return;
+      const text = await res.text();
+      if (text !== last) {
+        el.textContent = text;
+        last = text;
+      }
+    } catch (e) {}
+  }
+  tick();
+  setInterval(tick, 3000);
+})();
+</script>
+<?php endif; ?>
--- a/public/page/modules.php
+++ b/public/page/modules.php
@@ -4,6 +4,7 @@ $error = null;
 $notice = null;

 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    require_admin();
    $name = (string)($_POST['module'] ?? '');
    $action = (string)($_POST['action'] ?? '');

@@ -18,8 +19,10 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
 }
 ?>
 <div class="card">
+  <?php require_auth(); ?>
  <div class="pill">Module</div>
  <h1 style="margin-top:.75rem;">Module verwalten</h1>
+  <p class="muted">Hier siehst du nur aktive Module. Installierte Module kannst du unten verwalten.</p>

  <?php if ($error): ?>
    <div class="bg-red-900 border-l-4 border-red-500 text-red-100 p-4 mb-6" role="alert">
@@ -33,31 +36,28 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {

  <div style="margin-top:1rem;" class="grid">
    <?php foreach ($modules as $module): ?>
+      <?php if (empty($module['enabled'])) { continue; } ?>
      <div class="card" style="background:var(--panel-2);">
        <div style="display:flex; align-items:center; justify-content:space-between; gap:12px;">
          <div>
            <strong><?= e($module['title']) ?></strong>
            <div class="muted" style="font-size:.85rem;"><?= e($module['description'] ?? '') ?></div>
          </div>
-          <?php if (!empty($module['enabled'])): ?>
-            <span class="pill" style="border-color:var(--accent-2); color:var(--accent-2);">aktiv</span>
-          <?php else: ?>
-            <span class="pill">inaktiv</span>
-          <?php endif; ?>
+          <span class="pill" style="border-color:var(--accent-2); color:var(--accent-2);">aktiv</span>
        </div>
        <div style="margin-top:.75rem; display:flex; gap:10px; flex-wrap:wrap;">
          <a class="nav-link" href="/module/<?= e($module['name']) ?>">Öffnen</a>
          <a class="nav-link" href="/modules/setup/<?= e($module['name']) ?>">Setup</a>
          <form method="post" style="margin:0;">
            <input type="hidden" name="module" value="<?= e($module['name']) ?>">
-            <?php if (!empty($module['enabled'])): ?>
-              <button class="cta-button" name="action" value="disable" style="background:var(--panel); color:var(--text);">Deaktivieren</button>
-            <?php else: ?>
-              <button class="cta-button" name="action" value="enable">Aktivieren</button>
-            <?php endif; ?>
+            <button class="cta-button" name="action" value="disable" style="background:var(--panel); color:var(--text);">Deaktivieren</button>
          </form>
        </div>
      </div>
    <?php endforeach; ?>
  </div>
+
+  <div style="margin-top:1.5rem;">
+    <a class="nav-link" href="/modules/install">Modul installieren/aktivieren</a>
+  </div>
 </div>
--- a/public/page/modules_install.php
+++ b/public/page/modules_install.php
@@ -0,0 +1,78 @@
+<?php
+$modules = modules()->all();
+$error = null;
+$notice = null;
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    require_admin();
+    $name = (string)($_POST['module'] ?? '');
+    $action = (string)($_POST['action'] ?? '');
+    if ($name !== '' && ($action === 'enable' || $action === 'disable')) {
+        modules()->setEnabled($name, $action === 'enable');
+        $notice = $action === 'enable' ? 'Modul aktiviert.' : 'Modul deaktiviert.';
+        $modules = modules()->all();
+    } else {
+        $error = 'Ungültige Aktion.';
+    }
+}
+
+$active = [];
+$inactive = [];
+foreach ($modules as $m) {
+    if (!empty($m['enabled'])) {
+        $active[] = $m;
+    } else {
+        $inactive[] = $m;
+    }
+}
+?>
+<?php require_auth(); ?>
+<div class="card">
+  <div class="pill">Module</div>
+  <h1 style="margin-top:.75rem;">Module installieren/aktivieren</h1>
+  <p class="muted">Erkannte Module basieren auf Ordnern in <code>modules/</code>.</p>
+
+  <?php if ($error): ?>
+    <div class="bg-red-900 border-l-4 border-red-500 text-red-100 p-4 mb-6" role="alert">
+      <?= e($error) ?>
+    </div>
+  <?php elseif ($notice): ?>
+    <div class="card" style="margin-top:1rem; border-color:var(--accent-2);">
+      <?= e($notice) ?>
+    </div>
+  <?php endif; ?>
+
+  <h3 style="margin-top:1.25rem;">Aktive Module</h3>
+  <div style="margin-top:.5rem;" class="grid">
+    <?php foreach ($active as $module): ?>
+      <div class="card" style="background:var(--panel-2);">
+        <strong><?= e($module['title']) ?></strong>
+        <div class="muted" style="font-size:.85rem;"><?= e($module['description'] ?? '') ?></div>
+        <div style="margin-top:.75rem; display:flex; gap:10px;">
+          <a class="nav-link" href="/module/<?= e($module['name']) ?>">Öffnen</a>
+          <form method="post" style="margin:0;">
+            <input type="hidden" name="module" value="<?= e($module['name']) ?>">
+            <button class="cta-button" name="action" value="disable" style="background:var(--panel); color:var(--text);">Deaktivieren</button>
+          </form>
+        </div>
+      </div>
+    <?php endforeach; ?>
+  </div>
+
+  <h3 style="margin-top:1.5rem;">Deaktivierte Module</h3>
+  <div style="margin-top:.5rem;" class="grid">
+    <?php foreach ($inactive as $module): ?>
+      <div class="card" style="background:var(--panel-2);">
+        <strong><?= e($module['title']) ?></strong>
+        <div class="muted" style="font-size:.85rem;"><?= e($module['description'] ?? '') ?></div>
+        <div style="margin-top:.75rem; display:flex; gap:10px;">
+          <a class="nav-link" href="/modules/setup/<?= e($module['name']) ?>">Setup</a>
+          <form method="post" style="margin:0;">
+            <input type="hidden" name="module" value="<?= e($module['name']) ?>">
+            <button class="cta-button" name="action" value="enable">Aktivieren</button>
+          </form>
+        </div>
+      </div>
+    <?php endforeach; ?>
+  </div>
+</div>
--- a/public/page/modules_setup.php
+++ b/public/page/modules_setup.php
@@ -4,6 +4,8 @@ $module = modules()->get($moduleName);
 $error = null;
 $notice = null;

+require_admin();
+
 if (!$module) {
    http_response_code(404);
    echo '<div class="card">Modul nicht gefunden.</div>';
--- a/public/page/settings.php
+++ b/public/page/settings.php
@@ -0,0 +1,47 @@
+<?php
+$themes = [
+    'light' => 'Light',
+    'ocean' => 'Ocean',
+    'graphite' => 'Graphite',
+];
+
+require_auth();
+
+$current = user_theme();
+$notice = null;
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $theme = (string)($_POST['theme'] ?? 'light');
+    if (!isset($themes[$theme])) {
+        $theme = 'light';
+    }
+    set_user_theme($theme);
+    $current = $theme;
+    $notice = 'Theme gespeichert.';
+}
+?>
+<div class="card">
+  <div class="pill">Einstellungen</div>
+  <h1 style="margin-top:.75rem;">User-Design</h1>
+  <p class="muted">Wähle deine persönliche Farbpalette.</p>
+
+  <?php if ($notice): ?>
+    <div class="card" style="margin-top:1rem; border-color:var(--accent-2);">
+      <?= e($notice) ?>
+    </div>
+  <?php endif; ?>
+
+  <form method="post" style="margin-top:1rem; display:grid; gap:12px; max-width:360px;">
+    <label class="muted" style="display:grid; gap:6px;">
+      <span>Farbpalette</span>
+      <select name="theme">
+        <?php foreach ($themes as $key => $label): ?>
+          <option value="<?= e($key) ?>" <?= $current === $key ? 'selected' : '' ?>>
+            <?= e($label) ?>
+          </option>
+        <?php endforeach; ?>
+      </select>
+    </label>
+    <button class="cta-button" type="submit">Speichern</button>
+  </form>
+</div>
--- a/public/page/users.php
+++ b/public/page/users.php
@@ -0,0 +1,128 @@
+<?php
+$pdo = app()->basePdo();
+$error = null;
+$notice = null;
+
+require_admin();
+
+if (!$pdo) {
+    echo '<div class="card">Base-DB nicht aktiviert.</div>';
+    return;
+}
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $action = (string)($_POST['action'] ?? '');
+
+    if ($action === 'add_role') {
+        $role = trim((string)($_POST['role'] ?? ''));
+        $desc = trim((string)($_POST['description'] ?? ''));
+        if ($role === '') {
+            $error = 'Rollenname fehlt.';
+        } else {
+            $stmt = $pdo->prepare(
+                "INSERT INTO nexus_roles (name, description)
+                 VALUES (:name, :description)
+                 ON CONFLICT(name) DO UPDATE SET description = excluded.description"
+            );
+            $stmt->execute(['name' => $role, 'description' => $desc]);
+            $notice = 'Rolle gespeichert.';
+        }
+    } elseif ($action === 'add_user') {
+        $email = trim((string)($_POST['email'] ?? ''));
+        $password = (string)($_POST['password'] ?? '');
+        $role = trim((string)($_POST['role'] ?? 'user'));
+
+        if ($email === '' || $password === '') {
+            $error = 'E-Mail und Passwort sind erforderlich.';
+        } else {
+            $hash = password_hash($password, PASSWORD_DEFAULT);
+            $pdo->prepare(
+                "INSERT INTO nexus_users (email, password_hash, role, is_active)
+                 VALUES (:email, :hash, :role, 1)"
+            )->execute([
+                'email' => $email,
+                'hash' => $hash,
+                'role' => $role !== '' ? $role : 'user',
+            ]);
+
+            $pdo->prepare(
+                "INSERT INTO nexus_roles (name) VALUES (:name)
+                 ON CONFLICT(name) DO NOTHING"
+            )->execute(['name' => $role !== '' ? $role : 'user']);
+
+            $notice = 'User angelegt.';
+        }
+    }
+}
+
+$roles = $pdo->query("SELECT name, description FROM nexus_roles ORDER BY name")->fetchAll(PDO::FETCH_ASSOC) ?: [];
+$users = $pdo->query("SELECT id, email, role, is_active, created_at FROM nexus_users ORDER BY id DESC")->fetchAll(PDO::FETCH_ASSOC) ?: [];
+?>
+<div class="card">
+  <div class="pill">Userverwaltung</div>
+  <h1 style="margin-top:.75rem;">User & Rollen</h1>
+  <p class="muted">Admin kann Module aktivieren/deaktivieren, Benutzer können Module nutzen.</p>
+
+  <?php if ($error): ?>
+    <div class="bg-red-900 border-l-4 border-red-500 text-red-100 p-4 mb-6" role="alert">
+      <?= e($error) ?>
+    </div>
+  <?php elseif ($notice): ?>
+    <div class="card" style="margin-top:1rem; border-color:var(--accent-2);">
+      <?= e($notice) ?>
+    </div>
+  <?php endif; ?>
+
+  <div style="margin-top:1.5rem;" class="grid">
+    <div class="card" style="background:var(--panel-2);">
+      <strong>Rollen</strong>
+      <ul style="margin-top:.5rem;">
+        <?php foreach ($roles as $r): ?>
+          <li><?= e($r['name']) ?> <span class="muted"><?= e($r['description'] ?? '') ?></span></li>
+        <?php endforeach; ?>
+      </ul>
+
+      <form method="post" style="margin-top:1rem; display:grid; gap:10px;">
+        <input type="hidden" name="action" value="add_role">
+        <input type="text" name="role" placeholder="Rollenname (z. B. admin)">
+        <input type="text" name="description" placeholder="Beschreibung">
+        <button class="cta-button" type="submit">Rolle hinzufügen</button>
+      </form>
+    </div>
+
+    <div class="card" style="background:var(--panel-2);">
+      <strong>User anlegen</strong>
+      <form method="post" style="margin-top:1rem; display:grid; gap:10px;">
+        <input type="hidden" name="action" value="add_user">
+        <input type="email" name="email" placeholder="E-Mail">
+        <input type="password" name="password" placeholder="Passwort">
+        <input type="text" name="role" placeholder="Rolle (admin|user|...)">
+        <button class="cta-button" type="submit">User anlegen</button>
+      </form>
+    </div>
+  </div>
+
+  <h3 style="margin-top:1.5rem;">Userliste</h3>
+  <div style="margin-top:.5rem; background:var(--panel-2);" class="card">
+    <table class="min-w-full divide-y divide-gray-700">
+      <thead class="bg-gray-900">
+        <tr>
+          <th class="px-6 py-3 text-left text-xs font-medium text-gray-400 uppercase tracking-wider">E-Mail</th>
+          <th class="px-6 py-3 text-left text-xs font-medium text-gray-400 uppercase tracking-wider">Rolle</th>
+          <th class="px-6 py-3 text-left text-xs font-medium text-gray-400 uppercase tracking-wider">Aktiv</th>
+          <th class="px-6 py-3 text-left text-xs font-medium text-gray-400 uppercase tracking-wider">Erstellt</th>
+        </tr>
+      </thead>
+      <tbody class="bg-gray-800 divide-y divide-gray-700">
+        <?php foreach ($users as $u): ?>
+          <tr>
+            <td class="px-6 py-4 text-sm"><?= e($u['email']) ?></td>
+            <td class="px-6 py-4 text-sm"><?= e($u['role']) ?></td>
+            <td class="px-6 py-4 text-sm"><?= !empty($u['is_active']) ? 'Ja' : 'Nein' ?></td>
+            <td class="px-6 py-4 text-sm"><?= e((string)$u['created_at']) ?></td>
+          </tr>
+        <?php endforeach; ?>
+      </tbody>
+    </table>
+  </div>
+</div>