big

Internal/en/PROJECT_CONTEXT.md

@@ -66,6 +66,7 @@ Papa-Kind-Treff is a PHP-based platform for fathers. Core areas are local events
 - Existing stored community levels receive these two rights automatically in the fallback from 750 points upward, unless they were explicitly saved differently.
 
 ## Technical Frame
+- External API keys are provided only through server environment variables or the local, unversioned `config/secrets.local.php` file outside the webroot.
 - custom front controller in `public/index.php`
 - templates under `partials/`
 - business logic under `src/App/`
@@ -74,7 +75,9 @@ Papa-Kind-Treff is a PHP-based platform for fathers. Core areas are local events
 ## New Expansion Stage: Listings and Places
 - New table base: `listing_places`, `listings`, `listing_occurrences`, `listing_prices`, `listing_benefits`, `listing_categories`
 - Goal: later distinguish between own event, partner offer, general place, and editorial event entry
-- Google is not integrated productively yet; the system is only being prepared for it via settings and data fields
+- In admin approvals, enabled place providers are searched server-side in parallel: OpenStreetMap/Nominatim, Google Places, and Azure Maps. An admin deliberately selects a match; links to multiple providers can be saved for one place. Google aggregate rating and rating count are loaded only after the selected Google link.
+- The admin view for places and events has the sub-items `Approvals`, `Existing place editing` with a search field, and `Missing information`. The latter filters published entries by links missing from at least one currently enabled provider.
+- A manual admin lookup sends the open entry's name and address data to enabled place providers; privacy and consent notices must be reviewed before enabling this in production.
 
 ## Deferred To-dos
 - Large calendar-provider integrations should be added later in addition to the ICS feed, starting primarily with Google and Microsoft/Outlook.

Internal/en/PROJECT_STRUCTURE.md

@@ -4,6 +4,8 @@ Updated: 2026-08-10
 
 ## Main Directories
 - `config/`: configuration, including `prod/` and `staging/`
+- `config/secrets.local.php`: local, unversioned server secrets outside the webroot; template: `config/secrets.local.php.example`
+- `config/.htaccess`: additional web-server protection for the entire configuration directory; both deployment workflows explicitly exclude `secrets.local.php` from synchronizing deletion.
 - `partials/`: templates split into `landing/` and `structure/`
 - `public/`: webroot, assets, and page entry points
 - `src/`: backend and business logic
@@ -30,6 +32,8 @@ Updated: 2026-08-10
 - pricing, image upload, and place/address input for places and event-style entries plus a reduced own-event form: `partials/landing/account/dashboard.php` with persistence in `src/App/ListingCatalog.php`
 - approvals as well as change and deletion requests for places and event-style entries: `src/App/ListingCatalog.php`, `src/App/AccountPages.php`, `partials/landing/account/dashboard.php`
 - direct editing for not-yet-published place and event-style suggestions plus approval-right resolution: `src/App/CommunityAccess.php`, `src/App/AccountPages.php`, `src/App/ListingCatalog.php`, `partials/landing/account/dashboard.php`
+- server-side place-provider lookup and secure match selection for admin approvals: `src/App/PlaceProviderLookup.php`, `src/App/AccountPages.php`, `src/App/ListingCatalog.php`, `partials/landing/account/dashboard.php`
+- admin lists for existing place editing and missing provider links: `src/App/ListingCatalog.php`, `src/App/AccountPages.php`, `partials/landing/account/dashboard.php`
 - role assignment via user search in User Management: `src/App/AccountPages.php`, `partials/landing/account/dashboard.php`, `src/App/CommunityAccess.php`
 - legacy own events were extended in `src/App/AccountPages.php` and `Internal/db/schema.sql` with category and image fields
 

Internal/en/README.md

@@ -50,6 +50,7 @@ Papa-Kind-Treff is a PHP-based platform for fathers focused on local events, app
 - new base classes: `src/App/SystemSettings.php`, `src/App/ListingCatalog.php`
 
 ## Privacy and Security
+- Server secrets can be loaded locally through `config/secrets.local.php` outside the webroot; the file is not versioned and is not deleted by deployments.
 - password hashes via Argon2id
 - account emails are encrypted and additionally addressed through a separate HMAC lookup hash
 - personal calendar-feed tokens are stored encrypted and additionally resolved through a separate SHA-256 lookup hash