Enhance CSRF protection and user management features

- Introduce CSRF token generation and management improvements, ensuring tokens are consistently retrieved from cookies or request state.
- Update user creation logic to handle validation errors more gracefully, providing user feedback for invalid input and existing email addresses.
- Revise user management UI to display success and error messages, improving user experience during user creation.
- Refactor admin user access checks to include additional role validation.

app/services/auth.py

@@ -36,7 +36,7 @@ def get_current_user(request: Request, db: Session = Depends(get_db)) -> User:
 
 
 def get_admin_user(current_user: User = Depends(get_current_user)) -> User:
-    if current_user.role != "admin":
+    if current_user.role != "admin" and not current_user.is_admin:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin-Rechte erforderlich.")
     return current_user
 

app/services/csrf.py

@@ -7,13 +7,21 @@ CSRF_COOKIE_NAME = "csrf_token"
 CSRF_FORM_FIELD = "csrf_token"
 
 
-def ensure_csrf_cookie(request: Request) -> str:
-    token = request.cookies.get(CSRF_COOKIE_NAME)
-    if token:
-        return token
+def generate_csrf_token() -> str:
     return secrets.token_urlsafe(32)
 
 
+def ensure_csrf_cookie(request: Request) -> str:
+    """Liefert das CSRF-Token für die aktuelle Anfrage (Cookie oder request.state)."""
+    state_token = getattr(request.state, "csrf_token", None)
+    if state_token:
+        return state_token
+    cookie_token = request.cookies.get(CSRF_COOKIE_NAME)
+    if cookie_token:
+        return cookie_token
+    return generate_csrf_token()
+
+
 def validate_csrf(request: Request, form_token: str) -> None:
     cookie_token = request.cookies.get(CSRF_COOKIE_NAME)
     if not cookie_token or not form_token or not secrets.compare_digest(cookie_token, form_token):