Ignore pyasn1 CVE in pip-audit until python-jose supports pyasn1 0.6+.

python-jose 3.4.0 still pins pyasn1<0.5.0, so this transitive finding has no practical fix path yet.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -1,15 +1,33 @@
 APP_NAME=TK Wiki Newsletter Admin
-ENVIRONMENT=production
+# development = lokale Entwicklung ohne harte Produktions-Checks
-SECRET_KEY=PLEASE_CHANGE_TO_A_LONG_RANDOM_SECRET
+# production = erzwingt starke Secrets, ALLOWED_HOSTS, COOKIE_SECURE=true
+ENVIRONMENT=development
+# Bitte ein langes, zufälliges Secret mit mindestens 32 Zeichen generieren und hier eintragen
+SECRET_KEY=PLEASE_CHANGE_TO_A_LONG_RANDOM_SECRET_AT_LEAST_32_CHARS
 ALGORITHM=HS256
 ACCESS_TOKEN_EXPIRE_MINUTES=120
+JWT_ISSUER=tk-wiki-newsletter-admin
+JWT_AUDIENCE=tk-wiki-newsletter-admin
 HOST_PORT=8080
 DATABASE_URL=sqlite:///./data/newsletter.db
 # Beispiel PostgreSQL:
 # DATABASE_URL=postgresql+psycopg://newsletter:newsletter@postgres:5432/newsletter
 WIKI_API_URL=https://www.thomas-krenn.com/de/wikiDE/api.php
-ALLOWED_HOSTS=*
+ALLOWED_HOSTS=localhost,127.0.0.1
 COOKIE_SECURE=false
-# Auf true setzen, wenn hinter HTTPS/TLS-Terminierung (Reverse Proxy)
+# Auf true setzen, wenn hinter HTTPS/TLS-Terminierung (Reverse Proxy) – Pflicht in production
+HSTS_MAX_AGE=31536000
+# Admin-Bootstrap-Daten
 ADMIN_BOOTSTRAP_EMAIL=admin@internal.local
 ADMIN_BOOTSTRAP_PASSWORD=ChangeMe123!
+# true = setzt Passwort/Rolle/Status des Bootstrap-Admins bei jedem Start
+# auf die obigen Werte zurueck (auch wenn der User schon existiert).
+# In production nicht erlaubt. Nach Erst-Setup auf false lassen.
+ADMIN_BOOTSTRAP_RESET=false
+# Maximale Länge für Editor-Tips
+EDITOR_TIP_MAX_LENGTH=10000
+# Maximale Länge für Highlights
+HIGHLIGHTS_MAX_LENGTH=5000
+# Standardmäßig ausgeschlossene Bearbeiter (kommagetrennt)
+# Beispiel: Aranzinger, Testuser
+DEFAULT_EXCLUDED_USERS=Aranzinger

.gitea/workflows/docker-build.yml

@@ -0,0 +1,79 @@
+name: Docker Image bauen & veröffentlichen
+
+on:
+  # Kein Build auf Branch-Pushes (dev/main).
+  # Build nur, wenn ein Versions-Tag (v*) gesetzt wird
+  # -> also beim Release-Merge dev -> main inkl. Tag.
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+env:
+  # Host der Gitea Container Registry (bei Bedarf als Repo-Variable REGISTRY überschreiben)
+  REGISTRY: ${{ vars.REGISTRY || 'git.hexahost.dev' }}
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Repository auschecken
+        uses: actions/checkout@v4
+
+      - name: Python-Abhängigkeiten prüfen (pip-audit)
+        run: |
+          python -m venv .venv
+          . .venv/bin/activate
+          python -m pip install --upgrade pip
+          python -m pip install pip-audit
+          # Hinweis:
+          # - Direkte Pakete werden auf gefixte Versionen gepinnt (requirements.txt).
+          # - Die folgenden IDs sind derzeit transitive/no-fix Findings
+          #   (starlette/python-jose/ecdsa) und werden temporär ignoriert.
+          pip-audit -r requirements.txt \
+            --ignore-vuln PYSEC-2025-185 \
+            --ignore-vuln PYSEC-2026-1325 \
+            --ignore-vuln PYSEC-2026-161 \
+            --ignore-vuln PYSEC-2026-249 \
+            --ignore-vuln PYSEC-2026-248 \
+            --ignore-vuln PYSEC-2026-1942 \
+            --ignore-vuln PYSEC-2026-1941 \
+            --ignore-vuln CVE-2026-48818 \
+            --ignore-vuln CVE-2026-48817 \
+            --ignore-vuln CVE-2026-30922
+
+      - name: Docker Buildx einrichten
+        uses: docker/setup-buildx-action@v3
+
+      - name: An Gitea Container Registry anmelden
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USER || github.repository_owner }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Metadaten (Tags & Labels) bestimmen
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=sha,format=short
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
+
+      - name: Image bauen & pushen
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

README.md

@@ -7,19 +7,29 @@ Produktionsnahes internes Tool zur Erstellung von Thomas-Krenn.AG Newslettern au
 - Login und Benutzerverwaltung mit RBAC (`admin`, `editor`, `reader`)
 - Verpflichtender CSRF-Schutz auf allen POST-Formularen
 - Filter in der Web-UI:
-  - Zeitraum in Tagen
+  - Zeitraum in Tagen oder „Letzter Monat“
-  - Nur bearbeitete Artikel
+  - Artikel-Auswahl: alle, nur neue oder nur bearbeitete Artikel
   - Kategorie
+- Redaktioneller Feinschliff pro Ausgabe:
+  - **Redaktionsnotiz** – optionaler Hinweistext, der als eigene Box im Newsletter erscheint
+  - **Top-Highlights** – bis zu 3 Artikel per Titel hervorheben (erscheinen oben als Highlight-Box)
 - Datenquelle: MediaWiki API (`recentchanges` über `wikiDE/api.php`)
+- E-Mail-Layout im Thomas-Krenn Corporate Design:
+  - Hero-Header mit Logo, Artikel-Karten mit „Zum Beitrag“-Button, Kontakt- und Adress-Footer
+  - Neu-/Bearbeitet-Trennung, Zusammenfassungs-Kacheln, Outlook-taugliche Kopiervorschau
 - Export:
   - Plain Text (für Outlook)
   - Raw HTML
 - Optionaler SMTP-Versand:
-  - UI-konfigurierbar
+  - UI-konfigurierbar (nur für Admins)
-  - Verteilerlisten
+  - Verteilerlisten mit E-Mail-Validierung
-  - tägliche Zeitplanung
+  - Versand per **BCC** (Empfänger nicht im sichtbaren `To:`-Header)
-  - Versandprotokoll
+  - flexibler Zeitplan (täglich / wöchentlich / monatlich) über einen Hintergrund-Scheduler
-- Docker/Compose Betrieb
+  - eigene Inhalts-Vorgaben für den geplanten Versand (Zeitraum, Artikel-Auswahl, Kategorie)
+  - **„Generieren“ verschickt nie** – manueller Versand nur per Button „Newsletter jetzt senden“
+  - automatischer Versand nur mit **zwei** aktiven Häkchen: Zeitplan + Bestätigung „ohne manuelle Freigabe“
+  - Versandprotokoll (nur für Editor/Admin sichtbar)
+- Docker/Compose Betrieb mit Container-Hardening, inkl. automatischem Image-Build & Push in die Gitea Container Registry (per Versions-Tag)
 
 ## Start mit Docker
 
@@ -29,11 +39,17 @@ Produktionsnahes internes Tool zur Erstellung von Thomas-Krenn.AG Newslettern au
    cp .env.example .env
    ```
 
-2. Wichtige Werte in `.env` setzen:
+2. Wichtige Werte in `.env` setzen (siehe auch [Konfiguration](#konfiguration-env)):
-   - `HOST_PORT` (z. B. `8080`, falls `8000` bereits belegt ist)
+
-   - `SECRET_KEY`
+   | Variable | Lokal (Entwicklung) | Produktion |
-   - `ADMIN_BOOTSTRAP_EMAIL`
+   |----------|---------------------|------------|
-   - `ADMIN_BOOTSTRAP_PASSWORD`
+   | `ENVIRONMENT` | `development` | `production` |
+   | `HOST_PORT` | z. B. `8080` | nach Bedarf |
+   | `SECRET_KEY` | beliebig lang | mind. 32 zufällige Zeichen |
+   | `ALLOWED_HOSTS` | `localhost,127.0.0.1` | konkreter Hostname |
+   | `COOKIE_SECURE` | `false` | `true` (mit TLS) |
+   | `ADMIN_BOOTSTRAP_EMAIL` | Admin-E-Mail | Admin-E-Mail |
+   | `ADMIN_BOOTSTRAP_PASSWORD` | Bootstrap-Passwort | starkes Passwort |
 
 3. Start:
 
@@ -44,16 +60,158 @@ Produktionsnahes internes Tool zur Erstellung von Thomas-Krenn.AG Newslettern au
 4. Zugriff:
    - [http://localhost:8080/login](http://localhost:8080/login) (oder dein `HOST_PORT`)
 
-## Sicherheits-Hinweise für Produktion
+> **Hinweis:** Mit `ENVIRONMENT=production` prüft die App beim Start strikt die Konfiguration. Fehlen starke Secrets oder sind unsichere Defaults gesetzt, startet der Container nicht.
 
-- Reverse Proxy (z. B. Nginx/Traefik) mit TLS vor den Container setzen.
+## Konfiguration (`.env`)
-- `SECRET_KEY` lang und zufällig setzen.
+
-- Bootstrap-Admin-Passwort nach erstem Login ändern.
+Vollständige Vorlage: `.env.example`
-- Netzwerkzugriff auf interne IPs/Netze beschränken.
+
-- Regelmäßige Backups des `data` Volumes.
+| Variable | Beschreibung |
+|----------|--------------|
+| `ENVIRONMENT` | `development` = lokale Entwicklung ohne harte Checks; `production` = erzwingt sichere Einstellungen |
+| `SECRET_KEY` | JWT-Signierung und Verschlüsselung von SMTP-Passwörtern in der DB |
+| `ALGORITHM` | JWT-Algorithmus (Standard: `HS256`) |
+| `ACCESS_TOKEN_EXPIRE_MINUTES` | Gültigkeit der Login-Session in Minuten (Standard: `120`) |
+| `JWT_ISSUER` / `JWT_AUDIENCE` | JWT-Claims zur Token-Validierung |
+| `HOST_PORT` | Host-Port für Docker Compose (nur Compose, nicht App-intern) |
+| `DATABASE_URL` | SQLite (Standard) oder PostgreSQL |
+| `WIKI_API_URL` | MediaWiki-API-Endpunkt |
+| `ALLOWED_HOSTS` | Kommagetrennte erlaubte Host-Header |
+| `COOKIE_SECURE` | `Secure`-Flag für Session- und CSRF-Cookies (Pflicht `true` in Produktion) |
+| `HSTS_MAX_AGE` | HSTS-Header-Dauer in Sekunden (nur bei HTTPS) |
+| `ADMIN_BOOTSTRAP_EMAIL` / `ADMIN_BOOTSTRAP_PASSWORD` | Erster Admin-Account beim Start |
+| `ADMIN_BOOTSTRAP_RESET` | Admin auf `.env`-Werte zurücksetzen (nur Entwicklung/Notfall, in Produktion verboten) |
+| `EDITOR_TIP_MAX_LENGTH` | Max. Zeichen für Redaktionsnotiz (Standard: `10000`) |
+| `HIGHLIGHTS_MAX_LENGTH` | Max. Zeichen für Top-Highlights (Standard: `5000`) |
+
+## Container-Image (Gitea Packages)
+
+Fertige Images werden automatisch in die Gitea Container Registry veröffentlicht:
+
+```
+git.hexahost.dev/smueller/tk-wiki-newsletter
+```
+
+Verfügbare Tags: `latest`, die Version (`X.Y.Z`, `X.Y`, `X`) sowie der kurze Commit-SHA.
+
+Image ziehen und mit vorhandener `.env` starten:
+
+```bash
+docker login git.hexahost.dev
+docker pull git.hexahost.dev/smueller/tk-wiki-newsletter:latest
+docker run -d --name tk-newsletter-admin \
+  --env-file .env \
+  -p 8080:8000 \
+  -v newsletter_data:/app/data \
+  --read-only \
+  --tmpfs /tmp \
+  --security-opt no-new-privileges:true \
+  git.hexahost.dev/smueller/tk-wiki-newsletter:latest
+```
+
+Alternativ in `docker-compose.yml` statt `build: .` das Image referenzieren:
+
+```yaml
+services:
+  newsletter-admin:
+    image: git.hexahost.dev/smueller/tk-wiki-newsletter:latest
+    # build: .   # <- nicht mehr nötig, wenn das fertige Image genutzt wird
+```
+
+Die mitgelieferte `docker-compose.yml` setzt bereits `read_only`, `no-new-privileges` und ein `tmpfs` für `/tmp`. Persistente Daten liegen im Volume `newsletter_data` unter `/app/data`.
+
+### Automatischer Build (CI/CD)
+
+Der Workflow `.gitea/workflows/docker-build.yml` baut und pusht das Image über Gitea Actions.
+
+- **Auslöser**: nur beim Setzen eines Versions-Tags `v*` (kein Build bei normalen Pushes auf `dev`/`main`).
+- **Vor dem Build**: `pip-audit` prüft die Python-Abhängigkeiten aus `requirements.txt`.
+- **Release-Ablauf** (Build bei Merge `dev` → `main` mit Version):
+
+  ```bash
+  git checkout main
+  git merge --no-ff dev
+  git push origin main
+  git tag v1.0.0
+  git push origin v1.0.0   # <- startet Build & Push
+  ```
+
+- **Benötigte Repo-Secrets** (Settings → Actions → Secrets):
+  - `REGISTRY_TOKEN`: Gitea Access-Token mit Scope **Package: Read and write**
+  - `REGISTRY_USER` (optional): Registry-Benutzername, falls abweichend vom Repo-Owner
+- **Optionale Repo-Variable**: `REGISTRY`, um den Registry-Host zu überschreiben (Default `git.hexahost.dev`).
+
+## Admin-Login & Passwort zurücksetzen
+
+- Das Login erfolgt über **E-Mail + Passwort** (kein separater Benutzername). Beim ersten Start wird der Admin aus `ADMIN_BOOTSTRAP_EMAIL` / `ADMIN_BOOTSTRAP_PASSWORD` angelegt.
+- **Passwortpolitik:** mindestens 10 Zeichen, mindestens ein Großbuchstabe, ein Kleinbuchstabe und eine Ziffer.
+- **Rate-Limiting:** nach 5 fehlgeschlagenen Anmeldeversuchen pro IP/E-Mail innerhalb von 5 Minuten wird der Login temporär blockiert.
+- **Wichtig:** Existiert der Admin bereits (persistente DB im Volume `newsletter_data`), wird eine spätere Passwort-Änderung in der `.env` normalerweise **nicht** übernommen.
+- Um Passwort/Rolle/Status auf die `.env`-Werte zurückzusetzen (**nur Entwicklung**): `ADMIN_BOOTSTRAP_RESET=true` setzen und Container neu starten:
+
+  ```bash
+  docker compose up -d --force-recreate
+  ```
+
+  Nach erfolgreichem Login `ADMIN_BOOTSTRAP_RESET=false` setzen. In `ENVIRONMENT=production` ist `ADMIN_BOOTSTRAP_RESET=true` nicht erlaubt – die App startet dann nicht.
+
+- **Passwort ändern** (Profil) oder **Abmelden** beendet alle aktiven Sessions des Benutzers.
 
 ## Rollenmodell
 
-- `reader`: darf Ergebnisse sehen
+| Rolle | Rechte |
-- `editor`: darf Newsletter generieren und sofort versenden
+|-------|--------|
-- `admin`: zusätzlich Benutzerverwaltung und SMTP-Konfiguration
+| `reader` | Newsletter-Vorschau und Artikellisten ansehen |
+| `editor` | Newsletter generieren, exportieren und manuell versenden; Versandprotokoll und Empfängerliste einsehen |
+| `admin` | Zusätzlich Benutzerverwaltung (anlegen, Rolle ändern, aktivieren/deaktivieren) und SMTP-Konfiguration |
+
+Admins können in der Benutzerverwaltung (`/admin/users`):
+
+- neue Benutzer mit Rolle anlegen
+- die Rolle bestehender Benutzer ändern (beendet deren Sessions)
+- Benutzer aktivieren oder deaktivieren (beendet deren Sessions)
+
+Das eigene Konto kann weder deaktiviert noch die eigene Rolle geändert werden.
+
+## Sicherheit
+
+### Eingebaute Schutzmaßnahmen
+
+- **bcrypt** für Passwort-Hashes
+- **CSRF** Double-Submit-Cookie auf allen POST-Formularen
+- **HttpOnly** + **SameSite=Strict** Session-Cookies; `Secure` bei HTTPS (`COOKIE_SECURE=true`)
+- **JWT** mit `iss`, `aud`, Ablaufzeit und Session-Version (`session_version`)
+- Session-Invalidierung bei Logout, Passwortwechsel, Rollen- oder Statusänderung
+- **SMTP-Passwort** verschlüsselt in der Datenbank (Fernet), nicht im HTML-Formular
+- **Security-Header:** CSP, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, HSTS (bei HTTPS), `Cache-Control: no-store` auf geschützten Seiten
+- **OpenAPI** (`/docs`, `/redoc`) in Produktion deaktiviert
+- Abhängigkeiten in `requirements.txt` versioniert; CI führt `pip-audit` aus
+
+### Produktions-Checkliste
+
+Bei `ENVIRONMENT=production` erzwingt die App beim Start:
+
+- `SECRET_KEY` mit mindestens 32 Zeichen (keine bekannten Defaults)
+- starkes `ADMIN_BOOTSTRAP_PASSWORD`
+- `ADMIN_BOOTSTRAP_RESET=false`
+- `ALLOWED_HOSTS` mit konkreten Hostnamen (nicht `*`)
+- `COOKIE_SECURE=true`
+
+Zusätzlich empfohlen:
+
+- Reverse Proxy (z. B. Nginx/Traefik) mit TLS vor den Container; Proxy muss `X-Forwarded-Proto: https` setzen
+- Bootstrap-Admin-Passwort nach erstem Login im Profil ändern
+- Netzwerkzugriff auf interne IPs/Netze beschränken
+- Regelmäßige Backups des `newsletter_data` Volumes (SQLite-Datei unverschlüsselt)
+
+### Beispiel `.env` für Produktion
+
+```env
+ENVIRONMENT=production
+SECRET_KEY=<mind. 32 zufällige Zeichen>
+ALLOWED_HOSTS=newsletter.intern.firma.de
+COOKIE_SECURE=true
+ADMIN_BOOTSTRAP_EMAIL=admin@firma.de
+ADMIN_BOOTSTRAP_PASSWORD=<starkes Passwort>
+ADMIN_BOOTSTRAP_RESET=false
+```

app/core/config.py

@@ -1,20 +1,48 @@
+from pydantic import field_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
 class Settings(BaseSettings):
     app_name: str = "TK Wiki Newsletter Admin"
-    environment: str = "production"
+    environment: str = "development"
     secret_key: str = "change-me-in-production"
     algorithm: str = "HS256"
     access_token_expire_minutes: int = 120
+    jwt_issuer: str = "tk-wiki-newsletter-admin"
+    jwt_audience: str = "tk-wiki-newsletter-admin"
     database_url: str = "sqlite:///./data/newsletter.db"
     wiki_api_url: str = "https://www.thomas-krenn.com/de/wikiDE/api.php"
-    allowed_hosts: str = "*"
+    allowed_hosts: str = "localhost,127.0.0.1"
     cookie_secure: bool = False
+    hsts_max_age: int = 31536000
     admin_bootstrap_email: str = "admin@internal.local"
     admin_bootstrap_password: str = "ChangeMe123!"
+    # Wenn true: setzt Passwort/Rolle/Status des Bootstrap-Admins beim Start
+    # auf die .env-Werte zurück (auch wenn der User bereits existiert).
+    admin_bootstrap_reset: bool = False
+    editor_tip_max_length: int = 10000
+    highlights_max_length: int = 5000
+    default_excluded_users: str = "Aranzinger"
 
-    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8")
+    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")
+
+    @field_validator(
+        "access_token_expire_minutes",
+        "hsts_max_age",
+        "editor_tip_max_length",
+        "highlights_max_length",
+        mode="before",
+    )
+    @classmethod
+    def _parse_int_with_inline_comment(cls, value):
+        if isinstance(value, str):
+            cleaned = value.split("#", 1)[0].strip()
+            return int(cleaned) if cleaned else value
+        return value
+
+    @property
+    def is_production(self) -> bool:
+        return self.environment.lower() == "production"
 
 
 settings = Settings()

app/core/email_utils.py

@@ -0,0 +1,16 @@
+from pydantic import EmailStr, TypeAdapter
+
+_email_adapter = TypeAdapter(EmailStr)
+
+
+def parse_recipient_list(raw: str) -> list[str]:
+    recipients: list[str] = []
+    for part in raw.split(","):
+        addr = part.strip()
+        if not addr:
+            continue
+        if any(ch in addr for ch in ("\n", "\r", "\0")):
+            raise ValueError(f"Ungültige E-Mail-Adresse: {addr!r}")
+        _email_adapter.validate_python(addr)
+        recipients.append(addr)
+    return recipients

app/core/password_policy.py

@@ -0,0 +1,18 @@
+import re
+
+_PASSWORD_RULES: tuple[tuple[re.Pattern[str], str], ...] = (
+    (re.compile(r".{10,}"), "Mindestens 10 Zeichen."),
+    (re.compile(r"[A-Z]"), "Mindestens ein Großbuchstabe."),
+    (re.compile(r"[a-z]"), "Mindestens ein Kleinbuchstabe."),
+    (re.compile(r"\d"), "Mindestens eine Ziffer."),
+)
+
+
+def password_policy_errors(password: str) -> list[str]:
+    return [msg for pattern, msg in _PASSWORD_RULES if not pattern.search(password)]
+
+
+def validate_password_strength(password: str) -> None:
+    errors = password_policy_errors(password)
+    if errors:
+        raise ValueError(errors[0])

app/core/rate_limit.py

@@ -0,0 +1,35 @@
+import time
+from collections import defaultdict
+
+from fastapi import HTTPException, Request, status
+
+_WINDOW_SECONDS = 300
+_MAX_ATTEMPTS = 5
+_attempts: dict[str, list[float]] = defaultdict(list)
+
+
+def _client_key(request: Request, email: str) -> str:
+    forwarded = request.headers.get("x-forwarded-for", "")
+    ip = forwarded.split(",")[0].strip() if forwarded else (request.client.host if request.client else "unknown")
+    return f"{ip}:{email.strip().lower()}"
+
+
+def check_login_rate_limit(request: Request, email: str) -> None:
+    key = _client_key(request, email)
+    now = time.monotonic()
+    window_start = now - _WINDOW_SECONDS
+    recent = [t for t in _attempts[key] if t >= window_start]
+    _attempts[key] = recent
+    if len(recent) >= _MAX_ATTEMPTS:
+        raise HTTPException(
+            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+            detail="Zu viele Anmeldeversuche. Bitte in einigen Minuten erneut versuchen.",
+        )
+
+
+def record_failed_login(request: Request, email: str) -> None:
+    _attempts[_client_key(request, email)].append(time.monotonic())
+
+
+def clear_login_attempts(request: Request, email: str) -> None:
+    _attempts.pop(_client_key(request, email), None)

app/core/secrets_crypto.py

@@ -0,0 +1,28 @@
+import base64
+import hashlib
+
+from cryptography.fernet import Fernet, InvalidToken
+
+from app.core.config import settings
+
+
+def _fernet() -> Fernet:
+    digest = hashlib.sha256(settings.secret_key.encode("utf-8")).digest()
+    key = base64.urlsafe_b64encode(digest)
+    return Fernet(key)
+
+
+def encrypt_secret(plain: str) -> str:
+    if not plain:
+        return ""
+    return _fernet().encrypt(plain.encode("utf-8")).decode("utf-8")
+
+
+def decrypt_secret(cipher: str) -> str:
+    if not cipher:
+        return ""
+    try:
+        return _fernet().decrypt(cipher.encode("utf-8")).decode("utf-8")
+    except (InvalidToken, ValueError):
+        # Bestehende Klartext-Einträge aus älteren Installationen.
+        return cipher

app/core/security.py

@@ -15,8 +15,24 @@ def verify_password(plain_password: str, hashed_password: str) -> bool:
     return bcrypt.checkpw(plain_password.encode("utf-8"), hashed_password.encode("utf-8"))
 
 
-def create_access_token(subject: Any) -> str:
+def create_access_token(subject: Any, session_version: int = 0) -> str:
     expires_delta = timedelta(minutes=settings.access_token_expire_minutes)
     expire = datetime.now(timezone.utc) + expires_delta
-    to_encode = {"exp": expire, "sub": str(subject)}
+    to_encode = {
+        "exp": expire,
+        "sub": str(subject),
+        "sv": session_version,
+        "iss": settings.jwt_issuer,
+        "aud": settings.jwt_audience,
+    }
     return jwt.encode(to_encode, settings.secret_key, algorithm=settings.algorithm)
+
+
+def decode_access_token(token: str) -> dict[str, Any]:
+    return jwt.decode(
+        token,
+        settings.secret_key,
+        algorithms=[settings.algorithm],
+        issuer=settings.jwt_issuer,
+        audience=settings.jwt_audience,
+    )

app/core/startup_checks.py

@@ -0,0 +1,34 @@
+import sys
+
+from app.core.config import settings
+
+_WEAK_SECRET_KEYS = frozenset(
+    {
+        "change-me-in-production",
+        "please_change_to_a_long_random_secret",
+        "secret",
+        "changeme",
+    }
+)
+_WEAK_BOOTSTRAP_PASSWORDS = frozenset({"changeme123!", "change_me_123", "admin123!"})
+
+
+def validate_startup_config() -> None:
+    errors: list[str] = []
+
+    if settings.environment.lower() == "production":
+        if settings.secret_key.lower() in _WEAK_SECRET_KEYS or len(settings.secret_key) < 32:
+            errors.append("SECRET_KEY muss in Produktion mindestens 32 Zeichen lang und zufällig sein.")
+        if settings.admin_bootstrap_password.lower() in _WEAK_BOOTSTRAP_PASSWORDS:
+            errors.append("ADMIN_BOOTSTRAP_PASSWORD ist zu schwach für Produktion.")
+        if settings.admin_bootstrap_reset:
+            errors.append("ADMIN_BOOTSTRAP_RESET darf in Produktion nicht aktiv sein.")
+        if settings.allowed_hosts.strip() == "*":
+            errors.append("ALLOWED_HOSTS darf in Produktion nicht '*' sein – konkrete Hostnamen setzen.")
+        if not settings.cookie_secure:
+            errors.append("COOKIE_SECURE muss in Produktion auf true gesetzt sein (HTTPS/TLS-Terminierung).")
+
+    if errors:
+        for message in errors:
+            print(f"STARTUP-FEHLER: {message}", file=sys.stderr)
+        sys.exit(1)

app/main.py

@@ -1,4 +1,10 @@
+import asyncio
+import logging
+from datetime import datetime
 from pathlib import Path
+from urllib.parse import urlencode
+
+from pydantic import ValidationError
 
 from fastapi import Depends, FastAPI, Form, HTTPException, Request, Response, status
 from fastapi.middleware.trustedhost import TrustedHostMiddleware
@@ -10,14 +16,18 @@ from sqlalchemy.orm import Session
 
 from app.core.config import settings
 from app.core.cookies import cookie_secure
+from app.core.email_utils import parse_recipient_list
+from app.core.rate_limit import check_login_rate_limit, clear_login_attempts, record_failed_login
 from app.core.security import create_access_token, hash_password, verify_password
+from app.core.startup_checks import validate_startup_config
 from app.db.session import Base, engine, get_db
 from app.models.system import SendLog
 from app.models.user import User
-from app.schemas.user import UserCreate
+from app.schemas.user import PasswordChange, ProfileUpdate, UserCreate, UserRoleUpdate
-from app.services.auth import get_admin_user, get_current_user, get_optional_user, require_editor_or_admin
+from app.services.auth import can_view_sensitive_logs, get_admin_user, get_current_user, get_optional_user, require_editor_or_admin
-from app.services.config_store import get_config, set_config
+from app.services.config_store import get_config, has_secret_config, set_config
-from app.services.csrf import CSRF_COOKIE_NAME, ensure_csrf_cookie, validate_csrf
+from app.services.session_tokens import invalidate_user_sessions
+from app.services.csrf import CSRF_COOKIE_NAME, ensure_csrf_cookie, generate_csrf_token, validate_csrf
 from app.services.newsletter import (
     DEFAULT_DISPLAY,
     article_url,
@@ -26,13 +36,26 @@ from app.services.newsletter import (
     create_plain_text,
     create_subject,
     filter_articles,
+    parse_excluded_users,
     parse_display_options,
+    parse_highlights,
+    resolve_period,
     split_articles_by_type,
 )
-from app.services.smtp_sender import get_smtp_settings, run_scheduled_send_if_due, send_newsletter
+from app.services.smtp_sender import get_smtp_settings, mark_scheduled_sent, schedule_is_due, send_newsletter
 from app.services.wiki import WikiFetchError, WikiService
 
-app = FastAPI(title=settings.app_name)
+validate_startup_config()
+
+_openapi_url = None if settings.is_production else "/openapi.json"
+_docs_url = None if settings.is_production else "/docs"
+_redoc_url = None if settings.is_production else "/redoc"
+app = FastAPI(
+    title=settings.app_name,
+    docs_url=_docs_url,
+    redoc_url=_redoc_url,
+    openapi_url=_openapi_url,
+)
 allowed_hosts = [h.strip() for h in settings.allowed_hosts.split(",") if h.strip()]
 if allowed_hosts:
     app.add_middleware(TrustedHostMiddleware, allowed_hosts=allowed_hosts)
@@ -41,6 +64,10 @@ templates = Jinja2Templates(directory="app/templates")
 templates.env.globals["wiki_article_url"] = article_url
 wiki_service = WikiService()
 
+logger = logging.getLogger("newsletter.scheduler")
+SCHEDULER_INTERVAL_SECONDS = 60
+_scheduler_task: asyncio.Task | None = None
+
 
 @app.on_event("startup")
 def on_startup() -> None:
@@ -48,6 +75,66 @@ def on_startup() -> None:
     Base.metadata.create_all(bind=engine)
     _ensure_schema_upgrades()
     _bootstrap_admin()
+    global _scheduler_task
+    _scheduler_task = asyncio.create_task(_scheduler_loop())
+
+
+@app.on_event("shutdown")
+async def on_shutdown() -> None:
+    if _scheduler_task is not None:
+        _scheduler_task.cancel()
+
+
+async def _scheduler_loop() -> None:
+    """Prüft periodisch, ob laut Zeitplan ein Newsletter-Versand fällig ist."""
+    while True:
+        try:
+            await asyncio.sleep(SCHEDULER_INTERVAL_SECONDS)
+            await _run_scheduled_send_if_due()
+        except asyncio.CancelledError:
+            break
+        except Exception:
+            logger.exception("Fehler im Scheduler-Loop")
+
+
+async def _run_scheduled_send_if_due() -> None:
+    db = next(get_db())
+    try:
+        settings_snapshot = get_smtp_settings(db)
+        now = datetime.now()
+        if not schedule_is_due(settings_snapshot, now):
+            return
+
+        try:
+            days = int(settings_snapshot.get("gen_days") or "30")
+        except ValueError:
+            days = 30
+        gen = await _generate_newsletter(
+            period_mode=settings_snapshot.get("gen_period", "days"),
+            days=max(1, min(days, 90)),
+            article_type=settings_snapshot.get("gen_article_type", "all"),
+            category=settings_snapshot.get("gen_category", ""),
+            display=DEFAULT_DISPLAY,
+            editor_tip="",
+            highlight_list=[],
+            contact_email=settings_snapshot.get("reply_to") or settings_snapshot.get("from_email", ""),
+            excluded_users_raw=settings_snapshot.get("gen_excluded_users", ""),
+        )
+        if gen["wiki_error"] or not gen["articles"]:
+            # Kein Versand ohne Inhalt; erneuter Versuch beim nächsten Intervall.
+            logger.info("Geplanter Versand übersprungen (kein Inhalt/Wiki-Fehler).")
+            return
+
+        try:
+            recipients = parse_recipient_list(settings_snapshot.get("recipients", ""))
+        except ValueError:
+            logger.warning("Geplanter Versand übersprungen (ungültige Empfängerliste).")
+            return
+
+        send_newsletter(db, gen["subject"], gen["raw_html"], gen["plain_text"], recipients, scheduled=True)
+        mark_scheduled_sent(db, now)
+    finally:
+        db.close()
 
 
 def _ensure_schema_upgrades() -> None:
@@ -58,17 +145,51 @@ def _ensure_schema_upgrades() -> None:
             if "role" not in cols:
                 conn.execute(text("ALTER TABLE users ADD COLUMN role VARCHAR(32) NOT NULL DEFAULT 'reader'"))
                 conn.execute(text("UPDATE users SET role = CASE WHEN is_admin = 1 THEN 'admin' ELSE 'reader' END"))
+            if "session_version" not in cols:
+                conn.execute(text("ALTER TABLE users ADD COLUMN session_version INTEGER NOT NULL DEFAULT 0"))
 
 
 @app.middleware("http")
 async def add_security_headers(request: Request, call_next):
+    cookie_token = request.cookies.get(CSRF_COOKIE_NAME)
+    request.state.csrf_token = cookie_token or generate_csrf_token()
+
     response: Response = await call_next(request)
     response.headers["X-Content-Type-Options"] = "nosniff"
     response.headers["X-Frame-Options"] = "DENY"
     response.headers["Referrer-Policy"] = "same-origin"
-    response.headers["Content-Security-Policy"] = "default-src 'self'; style-src 'self'; script-src 'self';"
+    # Die Newsletter-Vorschau läuft in einem srcdoc-iframe und erbt diese CSP.
-    if not request.cookies.get(CSRF_COOKIE_NAME):
+    # E-Mail-HTML benötigt zwingend Inline-Styles; das Logo liegt auf einem externen https-Host.
-        response.set_cookie(CSRF_COOKIE_NAME, ensure_csrf_cookie(request), httponly=True, secure=cookie_secure(request), samesite="strict")
+    path = request.url.path
+    if path.startswith("/dashboard"):
+        csp = (
+            "default-src 'self'; "
+            "img-src 'self' https: data:; "
+            "style-src 'self' 'unsafe-inline'; "
+            "script-src 'self'; "
+            "frame-src 'self';"
+        )
+    else:
+        csp = (
+            "default-src 'self'; "
+            "img-src 'self' https: data:; "
+            "style-src 'self'; "
+            "script-src 'self';"
+        )
+    response.headers["Content-Security-Policy"] = csp
+    if settings.is_production and cookie_secure(request):
+        response.headers["Strict-Transport-Security"] = f"max-age={settings.hsts_max_age}; includeSubDomains"
+    if path not in {"/login", "/static"} and not path.startswith("/static/"):
+        response.headers["Cache-Control"] = "no-store"
+        response.headers["Pragma"] = "no-cache"
+    if not cookie_token:
+        response.set_cookie(
+            CSRF_COOKIE_NAME,
+            request.state.csrf_token,
+            httponly=True,
+            secure=cookie_secure(request),
+            samesite="strict",
+        )
     return response
 
 
@@ -77,6 +198,12 @@ def _bootstrap_admin() -> None:
     try:
         existing = db.query(User).filter(User.email == settings.admin_bootstrap_email).first()
         if existing:
+            if settings.admin_bootstrap_reset:
+                existing.password_hash = hash_password(settings.admin_bootstrap_password)
+                existing.is_admin = True
+                existing.role = "admin"
+                existing.is_active = True
+                db.commit()
             return
         user = User(
             email=settings.admin_bootstrap_email,
@@ -92,16 +219,30 @@ def _bootstrap_admin() -> None:
         db.close()
 
 
+def _smtp_context(db: Session, *, include_recipients: bool) -> dict[str, str]:
+    smtp = get_smtp_settings(db)
+    safe = {key: value for key, value in smtp.items() if key != "password"}
+    safe["password_configured"] = "true" if has_secret_config(db, "smtp.password") or smtp.get("password") else "false"
+    if not include_recipients:
+        safe["recipients"] = ""
+    return safe
+
+
 def _base_context(request: Request, user: User, db: Session) -> dict:
     path = request.url.path
     active_nav = "dashboard"
     if path.startswith("/admin/users"):
         active_nav = "users"
+    elif path.startswith("/profil"):
+        active_nav = "profile"
     return {
         "user": user,
-        "csrf_token": request.cookies.get(CSRF_COOKIE_NAME) or ensure_csrf_cookie(request),
+        "csrf_token": ensure_csrf_cookie(request),
-        "smtp": get_smtp_settings(db),
+        "smtp": _smtp_context(db, include_recipients=can_view_sensitive_logs(user)),
+        "can_view_sensitive": can_view_sensitive_logs(user),
         "active_nav": active_nav,
+        "editor_tip_max_length": settings.editor_tip_max_length,
+        "highlights_max_length": settings.highlights_max_length,
     }
 
 
@@ -138,7 +279,7 @@ def login_page(request: Request, db: Session = Depends(get_db)):
         request,
         "login.html",
         {
-            "csrf_token": request.cookies.get(CSRF_COOKIE_NAME) or ensure_csrf_cookie(request),
+            "csrf_token": ensure_csrf_cookie(request),
             "error_message": None,
         },
     )
@@ -159,37 +300,136 @@ def login(
             request,
             "login.html",
             {
-                "csrf_token": request.cookies.get(CSRF_COOKIE_NAME) or ensure_csrf_cookie(request),
+                "csrf_token": ensure_csrf_cookie(request),
                 "error_message": "Sitzung abgelaufen. Bitte erneut anmelden.",
             },
         )
-    user = db.query(User).filter(User.email == email, User.is_active.is_(True)).first()
+    try:
-    if not user or not verify_password(password, user.password_hash):
+        check_login_rate_limit(request, email)
+    except HTTPException:
         return _render(
             request,
             "login.html",
             {
-                "csrf_token": request.cookies.get(CSRF_COOKIE_NAME) or ensure_csrf_cookie(request),
+                "csrf_token": ensure_csrf_cookie(request),
+                "error_message": "Zu viele Anmeldeversuche. Bitte in einigen Minuten erneut versuchen.",
+            },
+        )
+    user = db.query(User).filter(User.email == email, User.is_active.is_(True)).first()
+    if not user or not verify_password(password, user.password_hash):
+        record_failed_login(request, email)
+        return _render(
+            request,
+            "login.html",
+            {
+                "csrf_token": ensure_csrf_cookie(request),
                 "error_message": "Ungültige Zugangsdaten.",
             },
         )
-    token = create_access_token(user.id)
+    clear_login_attempts(request, email)
+    token = create_access_token(user.id, session_version=user.session_version or 0)
+    max_age = settings.access_token_expire_minutes * 60
     response = RedirectResponse(url="/dashboard", status_code=status.HTTP_302_FOUND)
-    response.set_cookie("access_token", token, httponly=True, secure=cookie_secure(request), samesite="strict")
+    response.set_cookie(
+        "access_token",
+        token,
+        httponly=True,
+        secure=cookie_secure(request),
+        samesite="strict",
+        max_age=max_age,
+    )
     return response
 
 
 @app.post("/logout")
-def logout(request: Request, csrf_token: str = Form(...)):
+def logout(
+    request: Request,
+    csrf_token: str = Form(...),
+    db: Session = Depends(get_db),
+):
     validate_csrf(request, csrf_token)
+    current_user = get_optional_user(request, db)
+    if current_user:
+        invalidate_user_sessions(current_user, db)
     response = RedirectResponse(url="/login", status_code=status.HTTP_302_FOUND)
     response.delete_cookie("access_token")
     return response
 
 
+def _empty_filters() -> dict:
+    return {
+        "days": 30,
+        "period": "last_month",
+        "article_type": "new",
+        "category": "",
+        "excluded_users": settings.default_excluded_users,
+        "display": DEFAULT_DISPLAY,
+        "editor_tip": "",
+        "highlights": "",
+    }
+
+
+async def _generate_newsletter(
+    *,
+    period_mode: str,
+    days: int,
+    article_type: str,
+    category: str,
+    display,
+    editor_tip: str,
+    highlight_list: list[str],
+    contact_email: str = "",
+    excluded_users_raw: str = "",
+) -> dict:
+    p = resolve_period(period_mode, days)
+    result = {
+        "period": p,
+        "wiki_error": None,
+        "articles": [],
+        "articles_new": [],
+        "articles_edited": [],
+        "plain_text": "",
+        "raw_html": "",
+        "outlook_html": "",
+        "subject": "",
+    }
+    try:
+        excluded_users = parse_excluded_users(excluded_users_raw)
+        articles = await wiki_service.get_recent_changes(
+            days=p["days"], article_type=article_type, start=p["start"], end=p["end"]
+        )
+        filtered = filter_articles(articles, category_filter=category or None)
+        new_articles, edited_articles = split_articles_by_type(filtered, excluded_edited_users=excluded_users)
+        prange = (p["start_str"], p["end_str"])
+        result.update(
+            {
+                "articles": filtered,
+                "articles_new": new_articles,
+                "articles_edited": edited_articles,
+                "subject": create_subject(p["month_label"], p["days"]),
+                "plain_text": create_plain_text(
+                    filtered, p["days"], display, category, editor_tip, highlight_list, p["label"], prange, article_type, contact_email, excluded_users
+                ),
+                "raw_html": create_html(
+                    filtered, p["days"], display, category, editor_tip, highlight_list, p["label"], prange, article_type, p["month_label"], contact_email, excluded_users
+                ),
+                "outlook_html": create_outlook_html(
+                    filtered, p["days"], display, category, editor_tip, highlight_list, p["label"], prange, article_type, p["month_label"], contact_email, excluded_users
+                ),
+            }
+        )
+    except WikiFetchError as exc:
+        result["wiki_error"] = exc.message
+    return result
+
+
 @app.get("/dashboard", response_class=HTMLResponse)
 async def dashboard(request: Request, db: Session = Depends(get_db), current_user: User = Depends(get_current_user)):
     context = _base_context(request, current_user, db)
+    send_status = request.query_params.get("send_status")
+    send_result = None
+    if send_status:
+        send_result = {"status": send_status, "message": request.query_params.get("send_msg", "")}
     context.update({
         "articles": [],
         "articles_new": [],
@@ -197,13 +437,10 @@ async def dashboard(request: Request, db: Session = Depends(get_db), current_use
         "raw_html": "",
         "outlook_html": "",
         "plain_text": "",
-        "filters": {
+        "subject": "",
-            "days": 30,
+        "filters": _empty_filters(),
-            "only_edited": False,
-            "category": "",
-            "display": DEFAULT_DISPLAY,
-        },
         "wiki_error": None,
+        "send_result": send_result,
     })
     logs = db.query(SendLog).order_by(SendLog.created_at.desc()).limit(20).all()
     context["send_logs"] = logs
@@ -214,86 +451,130 @@ async def dashboard(request: Request, db: Session = Depends(get_db), current_use
 async def dashboard_generate(
     request: Request,
     csrf_token: str = Form(...),
+    period: str = Form("days"),
     days: int = Form(30),
-    only_edited: str | None = Form(None),
+    article_type: str = Form("all"),
     category: str = Form(""),
+    excluded_users: str = Form(""),
     show_date: str | None = Form(None),
     show_user: str | None = Form(None),
     show_category: str | None = Form(None),
+    editor_tip: str = Form(""),
+    highlights: str = Form(""),
     db: Session = Depends(get_db),
     current_user: User = Depends(require_editor_or_admin),
 ):
     validate_csrf(request, csrf_token)
+    if len(editor_tip) > settings.editor_tip_max_length:
+        editor_tip = editor_tip[: settings.editor_tip_max_length]
+    if len(highlights) > settings.highlights_max_length:
+        highlights = highlights[: settings.highlights_max_length]
     days = max(1, min(days, 90))
-    only_edited_flag = only_edited == "true"
+    if article_type not in ("all", "new", "edited"):
+        article_type = "all"
     display = parse_display_options(show_date, show_user, show_category)
-    wiki_error = None
+    highlight_list = parse_highlights(highlights)
-    filtered: list = []
+    smtp_cfg = get_smtp_settings(db)
-    articles_new: list = []
+    contact_email = smtp_cfg["reply_to"] or smtp_cfg["from_email"]
-    articles_edited: list = []
+
-    plain_text = ""
+    gen = await _generate_newsletter(
-    raw_html = ""
+        period_mode=period,
-    outlook_html = ""
+        days=days,
-    try:
+        article_type=article_type,
-        articles = await wiki_service.get_recent_changes(days=days, only_edited=only_edited_flag)
+        category=category,
-        filtered = filter_articles(articles, category_filter=category or None)
+        display=display,
-        articles_new, articles_edited = split_articles_by_type(filtered)
+        editor_tip=editor_tip,
-        title = create_subject(days, category)
+        highlight_list=highlight_list,
-        plain_text = create_plain_text(filtered, days, display, category)
+        contact_email=contact_email,
-        raw_html = create_html(filtered, days, display, category)
+        excluded_users_raw=excluded_users,
-        outlook_html = create_outlook_html(filtered, days, display, category)
+    )
-        run_scheduled_send_if_due(db, title, raw_html, plain_text)
+
-    except WikiFetchError as exc:
-        wiki_error = exc.message
     context = _base_context(request, current_user, db)
     context.update(
         {
-            "articles": filtered,
+            "articles": gen["articles"],
-            "articles_new": articles_new,
+            "articles_new": gen["articles_new"],
-            "articles_edited": articles_edited,
+            "articles_edited": gen["articles_edited"],
-            "raw_html": raw_html,
+            "raw_html": gen["raw_html"],
-            "outlook_html": outlook_html,
+            "outlook_html": gen["outlook_html"],
-            "plain_text": plain_text,
+            "plain_text": gen["plain_text"],
+            "subject": gen["subject"],
             "filters": {
                 "days": days,
-                "only_edited": only_edited_flag,
+                "period": period,
+                "article_type": article_type,
                 "category": category,
+                "excluded_users": excluded_users,
                 "display": display,
+                "editor_tip": editor_tip,
+                "highlights": highlights,
             },
             "send_logs": db.query(SendLog).order_by(SendLog.created_at.desc()).limit(20).all(),
-            "wiki_error": wiki_error,
+            "wiki_error": gen["wiki_error"],
+            "send_result": None,
         }
     )
     return _render(request, "dashboard.html", context)
 
 
-@app.post("/newsletter/send-now")
+@app.post("/newsletter/send-now", response_class=HTMLResponse)
 async def send_now(
     request: Request,
     csrf_token: str = Form(...),
+    period: str = Form("days"),
     days: int = Form(30),
-    only_edited: str | None = Form(None),
+    article_type: str = Form("all"),
     category: str = Form(""),
+    excluded_users: str = Form(""),
     show_date: str | None = Form(None),
     show_user: str | None = Form(None),
     show_category: str | None = Form(None),
+    editor_tip: str = Form(""),
+    highlights: str = Form(""),
     db: Session = Depends(get_db),
     current_user: User = Depends(require_editor_or_admin),
 ):
     validate_csrf(request, csrf_token)
+    if len(editor_tip) > settings.editor_tip_max_length:
+        editor_tip = editor_tip[: settings.editor_tip_max_length]
+    if len(highlights) > settings.highlights_max_length:
+        highlights = highlights[: settings.highlights_max_length]
     display = parse_display_options(show_date, show_user, show_category)
-    only_edited_flag = only_edited == "true"
+    if article_type not in ("all", "new", "edited"):
+        article_type = "all"
+    highlight_list = parse_highlights(highlights)
+    days = max(1, min(days, 90))
+    smtp_cfg = get_smtp_settings(db)
+    contact_email = smtp_cfg["reply_to"] or smtp_cfg["from_email"]
+
+    gen = await _generate_newsletter(
+        period_mode=period,
+        days=days,
+        article_type=article_type,
+        category=category,
+        display=display,
+        editor_tip=editor_tip,
+        highlight_list=highlight_list,
+        contact_email=contact_email,
+        excluded_users_raw=excluded_users,
+    )
+
+    send_result: dict[str, str]
+    if gen["wiki_error"]:
+        send_result = {"status": "failed", "message": f"Versand abgebrochen – Wiki-Fehler: {gen['wiki_error']}"}
+    elif not gen["articles"]:
+        send_result = {"status": "failed", "message": "Versand abgebrochen – im Zeitraum wurden keine Artikel gefunden."}
+    else:
         try:
-        articles = await wiki_service.get_recent_changes(days=max(1, min(days, 90)), only_edited=only_edited_flag)
+            recipients = parse_recipient_list(get_config(db, "smtp.recipients", ""))
-    except WikiFetchError as exc:
+        except ValueError as exc:
-        raise HTTPException(status_code=502, detail=exc.message) from exc
+            send_result = {"status": "failed", "message": f"Versand abgebrochen – {exc}"}
-    filtered = filter_articles(articles, category_filter=category or None)
+        else:
-    title = create_subject(max(1, min(days, 90)), category)
+            status_code, detail = send_newsletter(db, gen["subject"], gen["raw_html"], gen["plain_text"], recipients, scheduled=False)
-    plain_text = create_plain_text(filtered, max(1, min(days, 90)), display, category)
+            send_result = {"status": status_code, "message": detail}
-    raw_html = create_html(filtered, max(1, min(days, 90)), display, category)
+
-    recipients = [r.strip() for r in get_config(db, "smtp.recipients", "").split(",") if r.strip()]
+    query = urlencode({"send_status": send_result["status"], "send_msg": send_result["message"]})
-    send_newsletter(db, title, raw_html, plain_text, recipients, scheduled=False)
+    return RedirectResponse(url=f"/dashboard?{query}", status_code=status.HTTP_303_SEE_OTHER)
-    return RedirectResponse(url="/dashboard", status_code=status.HTTP_302_FOUND)
 
 
 @app.post("/admin/smtp")
@@ -306,9 +587,21 @@ def update_smtp_settings(
     username: str = Form(""),
     password: str = Form(""),
     from_email: str = Form(""),
+    from_name: str = Form(""),
+    reply_to: str = Form(""),
     use_tls: str | None = Form(None),
     recipients: str = Form(""),
+    schedule_enabled: str | None = Form(None),
+    schedule_frequency: str = Form("monthly"),
     schedule_time: str = Form("08:00"),
+    schedule_weekdays: list[str] = Form(default=[]),
+    schedule_dom: str = Form("1"),
+    schedule_acknowledged: str | None = Form(None),
+    gen_period: str = Form("days"),
+    gen_days: str = Form("30"),
+    gen_article_type: str = Form("all"),
+    gen_category: str = Form(""),
+    gen_excluded_users: str = Form(""),
     db: Session = Depends(get_db),
     admin: User = Depends(get_admin_user),
 ):
@@ -317,22 +610,83 @@ def update_smtp_settings(
     set_config(db, "smtp.host", host.strip())
     set_config(db, "smtp.port", port.strip() or "587")
     set_config(db, "smtp.username", username.strip())
-    set_config(db, "smtp.password", password)
+    if password.strip():
+        set_config(db, "smtp.password", password.strip())
     set_config(db, "smtp.from_email", from_email.strip())
+    set_config(db, "smtp.from_name", from_name.strip())
+    set_config(db, "smtp.reply_to", reply_to.strip())
     set_config(db, "smtp.use_tls", "true" if use_tls == "true" else "false")
+    try:
+        validated_recipients = parse_recipient_list(recipients)
+        set_config(db, "smtp.recipients", ", ".join(validated_recipients))
+    except ValueError:
         set_config(db, "smtp.recipients", recipients.strip())
+
+    set_config(db, "smtp.schedule_enabled", "true" if schedule_enabled == "true" else "false")
+    set_config(db, "smtp.schedule_acknowledged", "true" if schedule_acknowledged == "true" else "false")
+    if schedule_frequency not in ("daily", "weekly", "monthly"):
+        schedule_frequency = "monthly"
+    set_config(db, "smtp.schedule_frequency", schedule_frequency)
     set_config(db, "smtp.schedule_time", schedule_time.strip() or "08:00")
+    valid_weekdays = [d for d in schedule_weekdays if d in {"0", "1", "2", "3", "4", "5", "6"}]
+    set_config(db, "smtp.schedule_weekdays", ",".join(valid_weekdays))
+    try:
+        dom = max(1, min(int(schedule_dom), 28))
+    except ValueError:
+        dom = 1
+    set_config(db, "smtp.schedule_dom", str(dom))
+
+    if gen_period not in ("days", "last_month"):
+        gen_period = "days"
+    set_config(db, "smtp.gen_period", gen_period)
+    try:
+        gdays = max(1, min(int(gen_days), 90))
+    except ValueError:
+        gdays = 30
+    set_config(db, "smtp.gen_days", str(gdays))
+    if gen_article_type not in ("all", "new", "edited"):
+        gen_article_type = "all"
+    set_config(db, "smtp.gen_article_type", gen_article_type)
+    set_config(db, "smtp.gen_category", gen_category.strip())
+    set_config(db, "smtp.gen_excluded_users", gen_excluded_users.strip())
     return RedirectResponse(url="/dashboard", status_code=status.HTTP_302_FOUND)
 
 
+def _users_context(request: Request, admin: User, db: Session, **extra) -> dict:
+    context = _base_context(request, admin, db)
+    context["users"] = db.query(User).order_by(User.created_at.desc()).all()
+    context.setdefault("error_message", None)
+    context.setdefault("success_message", None)
+    context.update(extra)
+    return context
+
+
+def _format_validation_error(exc: ValidationError) -> str:
+    messages: list[str] = []
+    for err in exc.errors():
+        msg = err.get("msg", "Ungültige Eingabe")
+        if msg.startswith("Value error, "):
+            msg = msg[13:]
+        messages.append(msg)
+    return " ".join(messages) if messages else "Ungültige Eingabe."
+
+
 @app.get("/admin/users", response_class=HTMLResponse)
 def users_page(request: Request, db: Session = Depends(get_db), admin: User = Depends(get_admin_user)):
-    context = _base_context(request, admin, db)
+    created = request.query_params.get("created") == "1"
-    context["users"] = db.query(User).order_by(User.created_at.desc()).all()
+    return _render(
-    return _render(request, "users.html", context)
+        request,
+        "users.html",
+        _users_context(
+            request,
+            admin,
+            db,
+            success_message="Benutzer wurde erfolgreich angelegt." if created else None,
+        ),
+    )
 
 
-@app.post("/admin/users")
+@app.post("/admin/users", response_class=HTMLResponse)
 def create_user(
     request: Request,
     csrf_token: str = Form(...),
@@ -343,11 +697,32 @@ def create_user(
     db: Session = Depends(get_db),
     admin: User = Depends(get_admin_user),
 ):
+    try:
         validate_csrf(request, csrf_token)
-    payload = UserCreate(email=email, full_name=full_name, password=password, role=role)
+    except HTTPException:
+        return _render(
+            request,
+            "users.html",
+            _users_context(request, admin, db, error_message="Sitzung abgelaufen. Bitte Seite neu laden und erneut versuchen."),
+        )
+
+    try:
+        payload = UserCreate(email=email.strip(), full_name=full_name.strip(), password=password, role=role)
+    except ValidationError as exc:
+        return _render(
+            request,
+            "users.html",
+            _users_context(request, admin, db, error_message=_format_validation_error(exc)),
+        )
+
     existing = db.query(User).filter(User.email == payload.email).first()
     if existing:
-        raise HTTPException(status_code=400, detail="E-Mail existiert bereits.")
+        return _render(
+            request,
+            "users.html",
+            _users_context(request, admin, db, error_message="Diese E-Mail-Adresse ist bereits registriert."),
+        )
+
     user = User(
         email=payload.email,
         full_name=payload.full_name,
@@ -358,4 +733,156 @@ def create_user(
     )
     db.add(user)
     db.commit()
+    return RedirectResponse(url="/admin/users?created=1", status_code=status.HTTP_302_FOUND)
+
+
+def _profile_context(request: Request, user: User, db: Session, **extra) -> dict:
+    context = _base_context(request, user, db)
+    context.setdefault("error_message", None)
+    context.setdefault("pw_error_message", None)
+    context.setdefault("success_message", None)
+    context.update(extra)
+    return context
+
+
+@app.get("/profil", response_class=HTMLResponse)
+def profile_page(request: Request, db: Session = Depends(get_db), current_user: User = Depends(get_current_user)):
+    success = None
+    if request.query_params.get("updated") == "1":
+        success = "Profil wurde aktualisiert."
+    elif request.query_params.get("pw") == "1":
+        success = "Passwort wurde geändert."
+    return _render(request, "profile.html", _profile_context(request, current_user, db, success_message=success))
+
+
+@app.post("/profil", response_class=HTMLResponse)
+def update_profile(
+    request: Request,
+    csrf_token: str = Form(...),
+    email: str = Form(...),
+    full_name: str = Form(...),
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
+    try:
+        validate_csrf(request, csrf_token)
+    except HTTPException:
+        return _render(
+            request,
+            "profile.html",
+            _profile_context(request, current_user, db, error_message="Sitzung abgelaufen. Bitte Seite neu laden und erneut versuchen."),
+        )
+
+    try:
+        payload = ProfileUpdate(email=email.strip(), full_name=full_name.strip())
+    except ValidationError as exc:
+        return _render(
+            request,
+            "profile.html",
+            _profile_context(request, current_user, db, error_message=_format_validation_error(exc)),
+        )
+
+    clash = db.query(User).filter(User.email == payload.email, User.id != current_user.id).first()
+    if clash:
+        return _render(
+            request,
+            "profile.html",
+            _profile_context(request, current_user, db, error_message="Diese E-Mail-Adresse wird bereits verwendet."),
+        )
+
+    current_user.email = payload.email
+    current_user.full_name = payload.full_name
+    db.commit()
+    return RedirectResponse(url="/profil?updated=1", status_code=status.HTTP_302_FOUND)
+
+
+@app.post("/profil/passwort", response_class=HTMLResponse)
+def change_password(
+    request: Request,
+    csrf_token: str = Form(...),
+    current_password: str = Form(...),
+    new_password: str = Form(...),
+    confirm_password: str = Form(...),
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
+    try:
+        validate_csrf(request, csrf_token)
+    except HTTPException:
+        return _render(
+            request,
+            "profile.html",
+            _profile_context(request, current_user, db, pw_error_message="Sitzung abgelaufen. Bitte Seite neu laden und erneut versuchen."),
+        )
+
+    if not verify_password(current_password, current_user.password_hash):
+        return _render(
+            request,
+            "profile.html",
+            _profile_context(request, current_user, db, pw_error_message="Das aktuelle Passwort ist nicht korrekt."),
+        )
+
+    if new_password != confirm_password:
+        return _render(
+            request,
+            "profile.html",
+            _profile_context(request, current_user, db, pw_error_message="Die neuen Passwörter stimmen nicht überein."),
+        )
+
+    try:
+        payload = PasswordChange(new_password=new_password)
+    except ValidationError as exc:
+        return _render(
+            request,
+            "profile.html",
+            _profile_context(request, current_user, db, pw_error_message=_format_validation_error(exc)),
+        )
+
+    current_user.password_hash = hash_password(payload.new_password)
+    invalidate_user_sessions(current_user, db)
+    db.commit()
+    return RedirectResponse(url="/profil?pw=1", status_code=status.HTTP_302_FOUND)
+
+
+@app.post("/admin/users/{user_id}/role", response_class=HTMLResponse)
+def update_user_role(
+    request: Request,
+    user_id: int,
+    csrf_token: str = Form(...),
+    role: str = Form(...),
+    db: Session = Depends(get_db),
+    admin: User = Depends(get_admin_user),
+):
+    validate_csrf(request, csrf_token)
+    target = db.query(User).filter(User.id == user_id).first()
+    if not target:
+        return _render(request, "users.html", _users_context(request, admin, db, error_message="Benutzer nicht gefunden."))
+    if target.id == admin.id:
+        return _render(request, "users.html", _users_context(request, admin, db, error_message="Eigene Rolle kann hier nicht geändert werden."))
+    try:
+        payload = UserRoleUpdate(role=role)
+    except ValidationError as exc:
+        return _render(request, "users.html", _users_context(request, admin, db, error_message=_format_validation_error(exc)))
+    target.role = payload.role
+    target.is_admin = payload.role == "admin"
+    invalidate_user_sessions(target, db)
+    return RedirectResponse(url="/admin/users", status_code=status.HTTP_302_FOUND)
+
+
+@app.post("/admin/users/{user_id}/toggle-active", response_class=HTMLResponse)
+def toggle_user_active(
+    request: Request,
+    user_id: int,
+    csrf_token: str = Form(...),
+    db: Session = Depends(get_db),
+    admin: User = Depends(get_admin_user),
+):
+    validate_csrf(request, csrf_token)
+    target = db.query(User).filter(User.id == user_id).first()
+    if not target:
+        return _render(request, "users.html", _users_context(request, admin, db, error_message="Benutzer nicht gefunden."))
+    if target.id == admin.id:
+        return _render(request, "users.html", _users_context(request, admin, db, error_message="Eigenes Konto kann nicht deaktiviert werden."))
+    target.is_active = not target.is_active
+    invalidate_user_sessions(target, db)
     return RedirectResponse(url="/admin/users", status_code=status.HTTP_302_FOUND)

app/models/user.py

@@ -13,4 +13,5 @@ class User(Base):
     is_admin = Column(Boolean, default=False, nullable=False)
     role = Column(String(32), default="reader", nullable=False)
     is_active = Column(Boolean, default=True, nullable=False)
+    session_version = Column(Integer, default=0, nullable=False)
     created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)

app/schemas/user.py

@@ -1,4 +1,6 @@
-from pydantic import BaseModel, EmailStr, Field
+from pydantic import BaseModel, EmailStr, Field, field_validator
+
+from app.core.password_policy import validate_password_strength
 
 
 class UserCreate(BaseModel):
@@ -7,6 +9,31 @@ class UserCreate(BaseModel):
     password: str = Field(min_length=10, max_length=255)
     role: str = Field(default="reader", pattern="^(admin|editor|reader)$")
 
+    @field_validator("password")
+    @classmethod
+    def strong_password(cls, value: str) -> str:
+        validate_password_strength(value)
+        return value
+
+
+class ProfileUpdate(BaseModel):
+    email: EmailStr
+    full_name: str = Field(min_length=2, max_length=255)
+
+
+class PasswordChange(BaseModel):
+    new_password: str = Field(min_length=10, max_length=255)
+
+    @field_validator("new_password")
+    @classmethod
+    def strong_password(cls, value: str) -> str:
+        validate_password_strength(value)
+        return value
+
+
+class UserRoleUpdate(BaseModel):
+    role: str = Field(pattern="^(admin|editor|reader)$")
+
 
 class UserOut(BaseModel):
     id: int

app/services/auth.py

@@ -1,37 +1,40 @@
 from fastapi import Depends, HTTPException, Request, status
-from jose import JWTError, jwt
+from jose import JWTError
 from sqlalchemy.orm import Session
 
-from app.core.config import settings
+from app.core.security import decode_access_token
 from app.db.session import get_db
 from app.models.user import User
 
 
+def _user_from_token(token: str, db: Session) -> User | None:
+    try:
+        payload = decode_access_token(token)
+        user_id = int(payload.get("sub"))
+        token_sv = int(payload.get("sv", 0))
+    except (JWTError, TypeError, ValueError):
+        return None
+
+    user = db.query(User).filter(User.id == user_id, User.is_active.is_(True)).first()
+    if not user or (user.session_version or 0) != token_sv:
+        return None
+    return user
+
+
 def get_optional_user(request: Request, db: Session = Depends(get_db)) -> User | None:
     token = request.cookies.get("access_token")
     if not token:
         return None
-    try:
+    return _user_from_token(token, db)
-        payload = jwt.decode(token, settings.secret_key, algorithms=[settings.algorithm])
-        user_id = int(payload.get("sub"))
-    except (JWTError, TypeError, ValueError):
-        return None
-    return db.query(User).filter(User.id == user_id, User.is_active.is_(True)).first()
 
 
 def get_current_user(request: Request, db: Session = Depends(get_db)) -> User:
     token = request.cookies.get("access_token")
     if not token:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Nicht angemeldet.")
-    try:
+    user = _user_from_token(token, db)
-        payload = jwt.decode(token, settings.secret_key, algorithms=[settings.algorithm])
-        user_id = int(payload.get("sub"))
-    except (JWTError, TypeError, ValueError) as exc:
-        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Ungültiger Token.") from exc
-
-    user = db.query(User).filter(User.id == user_id, User.is_active.is_(True)).first()
     if not user:
-        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Benutzer nicht gefunden.")
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Ungültiger oder abgelaufener Token.")
     return user
 
 
@@ -47,7 +50,5 @@ def require_editor_or_admin(current_user: User = Depends(get_current_user)) -> U
     return current_user
 
 
-def require_reader_or_higher(current_user: User = Depends(get_current_user)) -> User:
+def can_view_sensitive_logs(user: User) -> bool:
-    if current_user.role not in {"admin", "editor", "reader"}:
+    return user.role in {"admin", "editor"}
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin-Rechte erforderlich.")
-    return current_user

app/services/config_store.py

@@ -1,17 +1,29 @@
 from sqlalchemy.orm import Session
 
+from app.core.secrets_crypto import decrypt_secret, encrypt_secret
 from app.models.system import AppConfig
 
+SECRET_CONFIG_KEYS = frozenset({"smtp.password"})
+
 
 def get_config(db: Session, key: str, default: str = "") -> str:
     row = db.query(AppConfig).filter(AppConfig.key == key).first()
-    return row.value if row else default
+    if not row:
+        return default
+    if key in SECRET_CONFIG_KEYS:
+        return decrypt_secret(row.value)
+    return row.value
 
 
 def set_config(db: Session, key: str, value: str) -> None:
+    stored = encrypt_secret(value) if key in SECRET_CONFIG_KEYS else value
     row = db.query(AppConfig).filter(AppConfig.key == key).first()
     if row:
-        row.value = value
+        row.value = stored
     else:
-        db.add(AppConfig(key=key, value=value))
+        db.add(AppConfig(key=key, value=stored))
     db.commit()
+
+
+def has_secret_config(db: Session, key: str) -> bool:
+    return db.query(AppConfig).filter(AppConfig.key == key).first() is not None

app/services/csrf.py

@@ -7,13 +7,21 @@ CSRF_COOKIE_NAME = "csrf_token"
 CSRF_FORM_FIELD = "csrf_token"
 
 
-def ensure_csrf_cookie(request: Request) -> str:
+def generate_csrf_token() -> str:
-    token = request.cookies.get(CSRF_COOKIE_NAME)
-    if token:
-        return token
     return secrets.token_urlsafe(32)
 
 
+def ensure_csrf_cookie(request: Request) -> str:
+    """Liefert das CSRF-Token für die aktuelle Anfrage (Cookie oder request.state)."""
+    state_token = getattr(request.state, "csrf_token", None)
+    if state_token:
+        return state_token
+    cookie_token = request.cookies.get(CSRF_COOKIE_NAME)
+    if cookie_token:
+        return cookie_token
+    return generate_csrf_token()
+
+
 def validate_csrf(request: Request, form_token: str) -> None:
     cookie_token = request.cookies.get(CSRF_COOKIE_NAME)
     if not cookie_token or not form_token or not secrets.compare_digest(cookie_token, form_token):

app/services/session_tokens.py

@@ -0,0 +1,8 @@
+from sqlalchemy.orm import Session
+
+from app.models.user import User
+
+
+def invalidate_user_sessions(user: User, db: Session) -> None:
+    user.session_version = (user.session_version or 0) + 1
+    db.commit()

app/services/smtp_sender.py

@@ -1,14 +1,20 @@
+import logging
 import smtplib
 from datetime import datetime
 from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
+from email.utils import formataddr
 from typing import Sequence
 
 from sqlalchemy.orm import Session
 
+from app.core.config import settings
+from app.core.email_utils import parse_recipient_list
 from app.models.system import SendLog
 from app.services.config_store import get_config
 
+logger = logging.getLogger("newsletter.smtp")
+
 
 def get_smtp_settings(db: Session) -> dict[str, str]:
     return {
@@ -18,13 +24,61 @@ def get_smtp_settings(db: Session) -> dict[str, str]:
         "username": get_config(db, "smtp.username", ""),
         "password": get_config(db, "smtp.password", ""),
         "from_email": get_config(db, "smtp.from_email", ""),
+        "from_name": get_config(db, "smtp.from_name", ""),
+        "reply_to": get_config(db, "smtp.reply_to", ""),
         "use_tls": get_config(db, "smtp.use_tls", "true"),
         "recipients": get_config(db, "smtp.recipients", ""),
+        # Zeitplan
+        "schedule_enabled": get_config(db, "smtp.schedule_enabled", "false"),
+        "schedule_acknowledged": get_config(db, "smtp.schedule_acknowledged", "false"),
+        "schedule_frequency": get_config(db, "smtp.schedule_frequency", "monthly"),
         "schedule_time": get_config(db, "smtp.schedule_time", "08:00"),
+        "schedule_weekdays": get_config(db, "smtp.schedule_weekdays", "0"),
+        "schedule_dom": get_config(db, "smtp.schedule_dom", "1"),
         "last_scheduled_date": get_config(db, "smtp.last_scheduled_date", ""),
+        # Generierungs-Vorgaben für den geplanten Versand
+        "gen_period": get_config(db, "smtp.gen_period", "last_month"),
+        "gen_days": get_config(db, "smtp.gen_days", "30"),
+        "gen_article_type": get_config(db, "smtp.gen_article_type", "new"),
+        "gen_category": get_config(db, "smtp.gen_category", ""),
+        "gen_excluded_users": get_config(db, "smtp.gen_excluded_users", settings.default_excluded_users),
     }
 
 
+def schedule_is_due(settings: dict[str, str], now: datetime) -> bool:
+    """Prüft, ob laut Zeitplan jetzt ein Versand fällig ist (mit Tages-Dedupe)."""
+    if settings["enabled"].lower() != "true":
+        return False
+    if (settings.get("schedule_enabled") or "false").lower() != "true":
+        return False
+    if (settings.get("schedule_acknowledged") or "false").lower() != "true":
+        return False
+    freq = (settings.get("schedule_frequency") or "off").lower()
+    if freq == "off":
+        return False
+
+    schedule_time = settings.get("schedule_time") or "08:00"
+    if now.strftime("%H:%M") < schedule_time:
+        return False
+
+    today = now.strftime("%Y-%m-%d")
+    if settings.get("last_scheduled_date") == today:
+        return False
+
+    if freq == "daily":
+        return True
+    if freq == "weekly":
+        weekdays = {d.strip() for d in (settings.get("schedule_weekdays") or "").split(",") if d.strip() != ""}
+        return str(now.weekday()) in weekdays
+    if freq == "monthly":
+        try:
+            dom = int(settings.get("schedule_dom") or "1")
+        except ValueError:
+            dom = 1
+        return now.day == max(1, min(dom, 28))
+    return False
+
+
 def send_newsletter(
     db: Session,
     subject: str,
@@ -32,21 +86,36 @@ def send_newsletter(
     text_content: str,
     recipients: Sequence[str],
     scheduled: bool = False,
-) -> None:
+) -> tuple[str, str]:
     settings = get_smtp_settings(db)
     if settings["enabled"].lower() != "true":
-        _log(db, subject, recipients, "skipped", "SMTP ist deaktiviert.", scheduled)
+        detail = "SMTP ist deaktiviert. Bitte in der SMTP-Konfiguration aktivieren."
-        return
+        _log(db, subject, recipients, "skipped", detail, scheduled)
+        return "skipped", detail
     if not settings["host"] or not settings["from_email"] or not recipients:
-        _log(db, subject, recipients, "failed", "SMTP unvollständig konfiguriert.", scheduled)
+        detail = "SMTP unvollständig konfiguriert (Host, Absender oder Empfänger fehlen)."
-        return
+        _log(db, subject, recipients, "failed", detail, scheduled)
+        return "failed", detail
+
+    try:
+        validated_recipients = parse_recipient_list(",".join(recipients))
+    except ValueError as exc:
+        detail = f"Ungültige Empfängerliste: {exc}"
+        _log(db, subject, recipients, "failed", detail, scheduled)
+        return "failed", detail
 
     msg = MIMEMultipart("alternative")
     msg.attach(MIMEText(text_content, "plain", "utf-8"))
     msg.attach(MIMEText(html_content, "html", "utf-8"))
     msg["Subject"] = subject
+    if settings.get("from_name"):
+        msg["From"] = formataddr((settings["from_name"], settings["from_email"]))
+    else:
         msg["From"] = settings["from_email"]
-    msg["To"] = ", ".join(recipients)
+    msg["To"] = settings["from_email"]
+    msg["Bcc"] = ", ".join(validated_recipients)
+    if settings.get("reply_to"):
+        msg["Reply-To"] = settings["reply_to"]
 
     try:
         port = int(settings["port"])
@@ -55,28 +124,21 @@ def send_newsletter(
                 server.starttls()
             if settings["username"]:
                 server.login(settings["username"], settings["password"])
-            server.sendmail(settings["from_email"], list(recipients), msg.as_string())
+            server.sendmail(settings["from_email"], validated_recipients, msg.as_string())
-        _log(db, subject, recipients, "sent", "Versand erfolgreich.", scheduled)
+        detail = f"Versand erfolgreich an {len(validated_recipients)} Empfänger."
+        _log(db, subject, validated_recipients, "sent", detail, scheduled)
+        return "sent", detail
     except Exception as exc:
-        _log(db, subject, recipients, "failed", f"Versandfehler: {exc}", scheduled)
+        logger.exception("SMTP-Versand fehlgeschlagen")
+        detail = "Versandfehler: E-Mail konnte nicht zugestellt werden. Details stehen im Server-Log."
+        _log(db, subject, validated_recipients, "failed", detail, scheduled)
+        return "failed", detail
 
 
-def run_scheduled_send_if_due(db: Session, subject: str, html_content: str, text_content: str) -> None:
+def mark_scheduled_sent(db: Session, now: datetime) -> None:
-    settings = get_smtp_settings(db)
-    if settings["enabled"].lower() != "true":
-        return
-    now = datetime.now()
-    schedule_time = settings["schedule_time"] or "08:00"
-    if now.strftime("%H:%M") < schedule_time:
-        return
-    today = now.strftime("%Y-%m-%d")
-    if settings["last_scheduled_date"] == today:
-        return
-    recipients = [r.strip() for r in settings["recipients"].split(",") if r.strip()]
-    send_newsletter(db, subject, html_content, text_content, recipients, scheduled=True)
     from app.services.config_store import set_config
 
-    set_config(db, "smtp.last_scheduled_date", today)
+    set_config(db, "smtp.last_scheduled_date", now.strftime("%Y-%m-%d"))
 
 
 def _log(db: Session, subject: str, recipients: Sequence[str], status: str, detail: str, scheduled: bool) -> None:

app/services/wiki.py

@@ -19,11 +19,18 @@ class WikiService:
     def __init__(self) -> None:
         self.api_url = settings.wiki_api_url
 
-    async def get_recent_changes(self, days: int = 30, only_edited: bool = False) -> list[dict[str, Any]]:
+    async def get_recent_changes(
-        now = datetime.now(timezone.utc)
+        self,
-        start = now - timedelta(days=days)
+        days: int = 30,
-        rcstart = now.strftime("%Y-%m-%dT%H:%M:%SZ")
+        article_type: str = "all",
-        rcend = start.strftime("%Y-%m-%dT%H:%M:%SZ")
+        start: datetime | None = None,
+        end: datetime | None = None,
+    ) -> list[dict[str, Any]]:
+        # MediaWiki listet neueste Änderungen zuerst: rcstart = obere (neuere) Grenze, rcend = untere (ältere).
+        upper = end or datetime.now(timezone.utc)
+        lower = start or (upper - timedelta(days=days))
+        rcstart = upper.strftime("%Y-%m-%dT%H:%M:%SZ")
+        rcend = lower.strftime("%Y-%m-%dT%H:%M:%SZ")
 
         params: dict[str, str] = {
             "action": "query",
@@ -35,7 +42,9 @@ class WikiService:
             "rcend": rcend,
             "rcnamespace": "0",
         }
-        if only_edited:
+        if article_type == "new":
+            params["rctype"] = "new"
+        elif article_type == "edited":
             params["rctype"] = "edit"
         else:
             params["rctype"] = "new|edit"

app/static/css/main.css

@@ -115,6 +115,15 @@ a:hover { color: var(--tk-orange-dark); text-decoration: underline; }
     color: #CCCCCC;
 }
 
+a.user-chip-link {
+    text-decoration: none;
+    cursor: pointer;
+}
+
+a.user-chip-link:hover {
+    color: #FFFFFF;
+}
+
 .topbar .btn-logout {
     background: transparent;
     border: 1px solid rgba(255, 255, 255, 0.35);
@@ -487,13 +496,63 @@ tbody tr:hover { background: #FAFAFA; }
 .copy-status.success { color: var(--tk-success); }
 .copy-status.error { color: var(--tk-error); }
 
+.preview-banner {
+    margin-top: 0.5rem;
+    padding: 0.5rem 0.85rem;
+    background: var(--tk-orange-light);
+    border: 1px solid #F5D5BC;
+    border-bottom: none;
+    border-radius: var(--radius) var(--radius) 0 0;
+    font-size: 0.82rem;
+    font-weight: 600;
+    color: var(--tk-orange-dark);
+    text-align: center;
+}
+
 .newsletter-preview-frame {
     width: 100%;
     min-height: 640px;
     border: 1px solid var(--tk-border);
+    border-radius: 0 0 var(--radius) var(--radius);
+    background: #FFFFFF;
+    box-shadow: var(--shadow-md);
+    display: block;
+}
+
+.send-section {
+    margin-top: 1.25rem;
+    padding: 1rem 1.1rem;
+    border: 1px solid var(--tk-border);
+    border-left: 4px solid var(--tk-orange);
     border-radius: var(--radius);
     background: var(--tk-gray-light);
-    box-shadow: var(--shadow-md);
+}
+
+.send-banner {
+    margin-top: 1rem;
+    padding: 0.75rem 1rem;
+    border-radius: var(--radius);
+    font-size: 0.9rem;
+    font-weight: 600;
+    border: 1px solid transparent;
+}
+
+.send-banner-sent {
+    background: #E7F5EC;
+    color: #1E7A43;
+    border-color: #B7E0C6;
+}
+
+.send-banner-failed {
+    background: #FDEAEA;
+    color: #B42318;
+    border-color: #F5C2C0;
+}
+
+.send-banner-skipped {
+    background: var(--tk-orange-light);
+    color: var(--tk-orange-dark);
+    border-color: #F5C9A6;
 }
 
 .textarea-actions {
@@ -648,6 +707,54 @@ body.login-page .container {
     flex-wrap: wrap;
 }
 
+/* ── Zeitplan ── */
+.schedule-box {
+    border: 1px solid var(--tk-border);
+    border-radius: 8px;
+    padding: 0.85rem 1rem 1rem;
+    margin: 0.25rem 0;
+}
+
+.schedule-box legend {
+    font-weight: 600;
+    padding: 0 0.4rem;
+    color: var(--tk-orange-dark, #c15200);
+}
+
+.weekday-row {
+    display: flex;
+    gap: 0.4rem;
+    flex-wrap: wrap;
+    margin: 0.25rem 0 0.75rem;
+}
+
+.weekday-chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.3rem;
+    border: 1px solid var(--tk-border);
+    border-radius: 6px;
+    padding: 0.3rem 0.55rem;
+    font-size: 0.85rem;
+    cursor: pointer;
+    user-select: none;
+}
+
+.inline-form {
+    display: inline;
+    margin: 0;
+}
+
+.inline-form select,
+.inline-form button {
+    font-size: 0.85rem;
+}
+
+.btn-small {
+    padding: 0.35rem 0.65rem;
+    font-size: 0.82rem;
+}
+
 /* ── Footer ── */
 .site-footer {
     text-align: center;

app/static/js/newsletter.js

@@ -181,6 +181,39 @@ function showCopyDialog(text, title) {
     document.addEventListener("keydown", copyDialogKeyHandler);
 }
 
+function copyFromPreviewFrame() {
+    const frame = document.getElementById("newsletter-preview-frame");
+    const doc = frame?.contentDocument;
+    const win = frame?.contentWindow;
+    if (!doc?.body || !win || !doc.body.innerHTML.trim()) {
+        return false;
+    }
+
+    const range = doc.createRange();
+    range.selectNodeContents(doc.body);
+    const selection = win.getSelection();
+    selection.removeAllRanges();
+    selection.addRange(range);
+
+    let ok = false;
+    try {
+        ok = doc.execCommand("copy");
+    } catch (err) {
+        console.warn("Copy from preview frame failed.", err);
+    } finally {
+        selection.removeAllRanges();
+    }
+    return ok;
+}
+
+function loadPreviewFrame() {
+    const frame = document.getElementById("newsletter-preview-frame");
+    const html = getNewsletterOutlookHtml();
+    if (frame && html) {
+        frame.srcdoc = html;
+    }
+}
+
 function copyViaIframe(html) {
     const iframe = document.createElement("iframe");
     iframe.setAttribute("aria-hidden", "true");
@@ -247,8 +280,13 @@ async function copyForOutlook() {
         return;
     }
 
-    if (copyHtmlWithFallback(html)) {
+    if (copyFromPreviewFrame()) {
-        setCopyStatus("Newsletter kopiert. In Outlook: Strg+V, dann ggf. Rechtsklick → „Format beibehalten“.");
+        setCopyStatus("Vorschau kopiert – in Outlook mit Strg+V einfügen (Rechtsklick → „Format beibehalten“).");
+        return;
+    }
+
+    if (copyViaIframe(html)) {
+        setCopyStatus("Newsletter kopiert – in Outlook mit Strg+V einfügen (Rechtsklick → „Format beibehalten“).");
         return;
     }
 
@@ -261,14 +299,14 @@ async function copyForOutlook() {
                     "text/plain": new Blob([plain], { type: "text/plain" }),
                 }),
             ]);
-            setCopyStatus("Newsletter kopiert. In Outlook: Strg+V, dann ggf. Rechtsklick → „Format beibehalten“.");
+            setCopyStatus("Newsletter kopiert – in Outlook mit Strg+V einfügen.");
             return;
         } catch (err) {
             console.warn("Clipboard API HTML copy failed.", err);
         }
     }
 
-    setCopyStatus("Bitte „Im Browser öffnen“ nutzen und dort Strg+A → Strg+C.", true);
+    setCopyStatus("Kopieren fehlgeschlagen. Bitte „Im Browser öffnen“ nutzen.", true);
 }
 
 function copyHtmlSource() {
@@ -332,17 +370,11 @@ function openOutlookInBrowser() {
     popup.document.write(html);
     popup.document.close();
     popup.document.title = "Wiki-Newsletter – zum Kopieren";
-    setCopyStatus("Newsletter im Browser geöffnet: Strg+A → Strg+C, dann in Outlook einfügen.");
+    setCopyStatus("Im neuen Tab: Alles markieren (Strg+A) → kopieren (Strg+C) → in Outlook einfügen.");
 }
 
 document.addEventListener("DOMContentLoaded", () => {
-    const outlookSource = document.getElementById("newsletter-outlook-source");
+    loadPreviewFrame();
-    const htmlSource = document.getElementById("newsletter-html-source");
-    const frame = document.getElementById("newsletter-preview-frame");
-    const previewHtml = outlookSource?.value.trim() || htmlSource?.value.trim() || "";
-    if (frame && previewHtml) {
-        frame.srcdoc = previewHtml;
-    }
 
     const htmlDisplay = document.getElementById("newsletter-html-display");
     htmlDisplay?.addEventListener("focus", () => selectTextarea(htmlDisplay));

app/templates/base.html

@@ -4,7 +4,7 @@
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <title>{% block title %}{{ title if title else "Wiki Newsletter Admin" }}{% endblock %} · Thomas-Krenn.AG</title>
-    <link rel="stylesheet" href="/static/css/main.css?v=3">
+    <link rel="stylesheet" href="/static/css/main.css?v=6">
 </head>
 <body class="{% block body_class %}{% endblock %}">
 <header class="topbar">
@@ -22,11 +22,12 @@
             {% if user.role == "admin" %}
             <a href="/admin/users" class="{% if active_nav == 'users' %}active{% endif %}">Benutzer</a>
             {% endif %}
+            <a href="/profil" class="{% if active_nav == 'profile' %}active{% endif %}">Profil</a>
         </nav>
-        <div class="user-chip">
+        <a href="/profil" class="user-chip user-chip-link">
             <span>{{ user.full_name }}</span>
             <span class="badge badge-{{ user.role }}">{{ user.role }}</span>
-        </div>
+        </a>
         <form method="post" action="/logout">
             <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
             <button type="submit" class="btn-logout">Abmelden</button>

app/templates/dashboard.html

@@ -35,16 +35,31 @@
             <form method="post" action="/dashboard" class="form-grid">
                 <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                 <div class="form-row">
-                    <label>Zeitraum (Tage)
+                    <label>Zeitraum
+                        <select name="period">
+                            <option value="days" {% if filters.period != 'last_month' %}selected{% endif %}>Letzte X Tage</option>
+                            <option value="last_month" {% if filters.period == 'last_month' %}selected{% endif %}>Letzter Monat (voller Kalendermonat)</option>
+                        </select>
+                    </label>
+                    <label>Tage (nur bei „Letzte X Tage“)
                         <input type="number" name="days" min="1" max="90" value="{{ filters.days }}">
                     </label>
+                </div>
+                <div class="form-row">
                     <label>Kategorie (optional)
                         <input type="text" name="category" value="{{ filters.category }}" placeholder="z. B. Linux">
                     </label>
+                    <label>Bearbeiter ausschließen (optional)
+                        <input type="text" name="excluded_users" value="{{ filters.excluded_users }}" placeholder="z. B. Aranzinger, Testuser">
+                    </label>
                 </div>
-                <label class="checkbox">
+                <p class="hint">Nur bei „Bearbeitete Artikel“ relevant: Benutzer in dieser Liste werden aus den bearbeiteten Artikeln entfernt.</p>
-                    <input type="checkbox" name="only_edited" value="true" {% if filters.only_edited %}checked{% endif %}>
+                <label>Artikel-Auswahl
-                    Nur bearbeitete Artikel (keine neu erstellten)
+                    <select name="article_type">
+                        <option value="all" {% if filters.article_type == 'all' %}selected{% endif %}>Alle (neue &amp; bearbeitete)</option>
+                        <option value="new" {% if filters.article_type == 'new' %}selected{% endif %}>Nur neue Artikel</option>
+                        <option value="edited" {% if filters.article_type == 'edited' %}selected{% endif %}>Nur bearbeitete Artikel (keine neu erstellten)</option>
+                    </select>
                 </label>
                 <fieldset class="display-options">
                     <legend>Anzeige im Newsletter</legend>
@@ -61,6 +76,14 @@
                         Kategorie anzeigen
                     </label>
                 </fieldset>
+                <label>Top-Highlights (optional)
+                    <textarea name="highlights" rows="3" maxlength="{{ highlights_max_length }}" placeholder="Ein Artikeltitel pro Zeile – muss exakt einem gefundenen Artikel entsprechen (max. 3)">{{ filters.highlights }}</textarea>
+                </label>
+                <p class="hint">Hervorgehobene Artikel erscheinen als „Top Highlights“-Box oben im Newsletter.</p>
+                <label>Redaktionsnotiz (optional)
+                    <textarea name="editor_tip" rows="3" maxlength="{{ editor_tip_max_length }}" placeholder="Optionaler Hinweis der Redaktion für diese Ausgabe…">{{ filters.editor_tip }}</textarea>
+                </label>
+                <p class="hint">Wird nur angezeigt, wenn Text hinterlegt ist – erscheint als eigene Box im Newsletter.</p>
                 {% if wiki_error %}
                 <p class="error">{{ wiki_error }}</p>
                 {% endif %}
@@ -79,20 +102,60 @@
                     <p class="card-desc">Formatierten Newsletter ansehen und für Outlook kopieren.</p>
                 </div>
             </div>
-            <p class="hint"><strong>Empfohlen:</strong> „Im Browser öffnen“ → <strong>Strg+A</strong>, <strong>Strg+C</strong> → in Outlook <strong>Strg+V</strong>.</p>
+            <p class="hint">Die Vorschau unten zeigt <strong>exakt</strong>, wie der Newsletter aussieht. „Vorschau kopieren“ übernimmt dieses Layout 1:1 in die Zwischenablage.</p>
             <div class="copy-actions">
-                <button type="button" id="open-outlook-btn" class="btn-primary">Im Browser öffnen</button>
+                <button type="button" id="copy-outlook-btn" class="btn-primary">Vorschau kopieren</button>
-                <button type="button" id="copy-outlook-btn" class="btn-secondary">Für Outlook kopieren</button>
+                <button type="button" id="open-outlook-btn" class="btn-secondary">Im Browser öffnen</button>
                 <button type="button" id="download-html-btn" class="btn-secondary">HTML herunterladen</button>
                 <button type="button" id="copy-html-source-btn" class="btn-outline">HTML-Quelltext</button>
                 <span id="copy-status" class="copy-status" aria-live="polite"></span>
             </div>
+            <div class="preview-banner">Live-Vorschau – so wird der Newsletter dargestellt</div>
             <iframe id="newsletter-preview-frame" class="newsletter-preview-frame" title="Newsletter Vorschau"></iframe>
             <textarea id="newsletter-html-source" class="hidden-source" hidden readonly>{{ raw_html }}</textarea>
             <textarea id="newsletter-outlook-source" class="hidden-source" hidden readonly>{{ outlook_html }}</textarea>
             <textarea id="newsletter-plain-source" class="hidden-source" hidden readonly>{{ plain_text }}</textarea>
+
+            {% if send_result %}
+            <div class="send-banner send-banner-{{ send_result.status }}">{{ send_result.message }}</div>
+            {% endif %}
+
+            {% if raw_html and (articles_new or articles_edited) %}
+            <div class="send-section">
+                <h4 style="margin:0 0 0.35rem;">Per E-Mail versenden</h4>
+                <p class="hint" style="margin:0 0 0.75rem;">Bitte oben die Vorschau prüfen. Beim Versenden wird genau dieser Newsletter (aktuelle Filter) an die Verteilerliste geschickt.</p>
+                <p class="hint" style="margin:0 0 0.75rem;">
+                    <strong>Betreff:</strong> {{ subject }}<br>
+                    {% if can_view_sensitive %}
+                    <strong>Empfänger:</strong> {{ smtp.recipients if smtp.recipients else "— keine konfiguriert —" }}
+                    {% else %}
+                    <strong>Empfänger:</strong> Nur für Editor/Admin sichtbar
+                    {% endif %}
+                    {% if smtp.enabled != "true" %}<br><strong style="color:var(--tk-orange-dark);">SMTP ist deaktiviert</strong> – bitte zuerst in „SMTP-Konfiguration“ aktivieren.{% endif %}
+                </p>
+                {% if user.role in ["admin", "editor"] %}
+                <form method="post" action="/newsletter/send-now" onsubmit="return confirm('Diesen Newsletter jetzt per E-Mail an die Verteilerliste senden?');">
+                    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
+                    <input type="hidden" name="period" value="{{ filters.period }}">
+                    <input type="hidden" name="days" value="{{ filters.days }}">
+                    <input type="hidden" name="category" value="{{ filters.category }}">
+                    <input type="hidden" name="excluded_users" value="{{ filters.excluded_users }}">
+                    <input type="hidden" name="article_type" value="{{ filters.article_type }}">
+                    <input type="hidden" name="show_date" value="{{ 'true' if filters.display.show_date else 'false' }}">
+                    <input type="hidden" name="show_user" value="{{ 'true' if filters.display.show_user else 'false' }}">
+                    <input type="hidden" name="show_category" value="{{ 'true' if filters.display.show_category else 'false' }}">
+                    <input type="hidden" name="highlights" value="{{ filters.highlights }}">
+                    <input type="hidden" name="editor_tip" value="{{ filters.editor_tip }}">
+                    <button type="submit" class="btn-primary">Newsletter jetzt senden</button>
+                </form>
+                {% else %}
+                <p class="hint">Sie haben Leserechte – Versand nur für Editor/Admin.</p>
+                {% endif %}
+            </div>
+            {% endif %}
         </section>
 
+        {% if filters.article_type != 'edited' %}
         <section class="card card-accent-gray">
             <div class="card-header">
                 <h3>Neue Artikel <span class="count-badge orange">{{ articles_new|length }}</span></h3>
@@ -122,7 +185,9 @@
                 </table>
             </div>
         </section>
+        {% endif %}
 
+        {% if filters.article_type != 'new' %}
         <section class="card card-accent-gray">
             <div class="card-header">
                 <h3>Bearbeitete Artikel <span class="count-badge">{{ articles_edited|length }}</span></h3>
@@ -152,6 +217,7 @@
                 </table>
             </div>
         </section>
+        {% endif %}
 
         <details class="card-details">
             <summary>Weitere Ausgabeformate</summary>
@@ -170,25 +236,6 @@
             </div>
         </details>
 
-        {% if user.role in ["admin", "editor"] %}
-        <details class="card-details">
-            <summary>SMTP-Versand</summary>
-            <div class="details-body">
-                <p class="hint">Newsletter direkt per E-Mail versenden (aktuell gewählte Filter).</p>
-                <form method="post" action="/newsletter/send-now">
-                    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
-                    <input type="hidden" name="days" value="{{ filters.days }}">
-                    <input type="hidden" name="category" value="{{ filters.category }}">
-                    <input type="hidden" name="only_edited" value="{{ 'true' if filters.only_edited else 'false' }}">
-                    <input type="hidden" name="show_date" value="{{ 'true' if filters.display.show_date else 'false' }}">
-                    <input type="hidden" name="show_user" value="{{ 'true' if filters.display.show_user else 'false' }}">
-                    <input type="hidden" name="show_category" value="{{ 'true' if filters.display.show_category else 'false' }}">
-                    <button type="submit" class="btn-secondary">Newsletter jetzt senden</button>
-                </form>
-            </div>
-        </details>
-        {% endif %}
-
         {% if user.role == "admin" %}
         <details class="card-details">
             <summary>SMTP-Konfiguration</summary>
@@ -212,12 +259,20 @@
                             <input type="text" name="username" value="{{ smtp.username }}">
                         </label>
                         <label>Passwort
-                            <input type="password" name="password" value="{{ smtp.password }}">
+                            <input type="password" name="password" autocomplete="new-password" placeholder="{% if smtp.password_configured == 'true' %}•••••••• (unverändert lassen){% else %}SMTP-Passwort{% endif %}">
                         </label>
                     </div>
+                    <label>Absender-Name
+                        <input type="text" name="from_name" value="{{ smtp.from_name }}" placeholder="Thomas-Krenn Wiki-Team">
+                    </label>
+                    <div class="form-row">
                         <label>Absender E-Mail
                             <input type="email" name="from_email" value="{{ smtp.from_email }}">
                         </label>
+                        <label>Antwort-Adresse (Reply-To)
+                            <input type="email" name="reply_to" value="{{ smtp.reply_to }}" placeholder="wiki-team@firma.de">
+                        </label>
+                    </div>
                     <label class="checkbox">
                         <input type="checkbox" name="use_tls" value="true" {% if smtp.use_tls == "true" %}checked{% endif %}>
                         STARTTLS verwenden
@@ -225,15 +280,83 @@
                     <label>Verteilerliste (kommagetrennt)
                         <textarea rows="3" name="recipients" placeholder="kollege@firma.de, team@firma.de">{{ smtp.recipients }}</textarea>
                     </label>
-                    <label>Geplanter täglicher Versand (HH:MM)
+
+                    <fieldset class="schedule-box">
+                        <legend>Geplanter Versand</legend>
+                        <label class="checkbox">
+                            <input type="checkbox" name="schedule_enabled" value="true" {% if smtp.schedule_enabled == "true" %}checked{% endif %}>
+                            Automatischen Versand aktivieren
+                        </label>
+                        <label class="checkbox">
+                            <input type="checkbox" name="schedule_acknowledged" value="true" {% if smtp.schedule_acknowledged == "true" %}checked{% endif %}>
+                            Ich bestätige den automatischen Versand ohne manuelle Freigabe (ohne Redaktionsnotiz/Highlights)
+                        </label>
+                        <p class="hint" style="margin:0 0 0.6rem;">Beide Häkchen sind nötig, damit der Zeitplan greift. Für manuelle Kontrolle nur den ersten Schalter nutzen und „Newsletter jetzt senden“ verwenden.</p>
+                        <div class="form-row">
+                            <label>Häufigkeit
+                                <select name="schedule_frequency">
+                                    <option value="daily" {% if smtp.schedule_frequency == 'daily' %}selected{% endif %}>Täglich</option>
+                                    <option value="weekly" {% if smtp.schedule_frequency == 'weekly' %}selected{% endif %}>Wöchentlich</option>
+                                    <option value="monthly" {% if smtp.schedule_frequency == 'monthly' %}selected{% endif %}>Monatlich</option>
+                                </select>
+                            </label>
+                            <label>Uhrzeit (HH:MM)
                                 <input type="time" name="schedule_time" value="{{ smtp.schedule_time }}">
                             </label>
+                        </div>
+
+                        {% set active_days = smtp.schedule_weekdays.split(',') %}
+                        <label>Wochentage (nur bei „Wöchentlich“)</label>
+                        <div class="weekday-row">
+                            {% for value, label in [('0','Mo'), ('1','Di'), ('2','Mi'), ('3','Do'), ('4','Fr'), ('5','Sa'), ('6','So')] %}
+                            <label class="weekday-chip">
+                                <input type="checkbox" name="schedule_weekdays" value="{{ value }}" {% if value in active_days %}checked{% endif %}>
+                                {{ label }}
+                            </label>
+                            {% endfor %}
+                        </div>
+
+                        <label>Tag im Monat (nur bei „Monatlich“, 1–28)
+                            <input type="number" name="schedule_dom" min="1" max="28" value="{{ smtp.schedule_dom }}">
+                        </label>
+
+                        <p class="hint" style="margin:0.5rem 0 0.25rem;">Inhalt des geplanten Newsletters:</p>
+                        <div class="form-row">
+                            <label>Zeitraum
+                                <select name="gen_period">
+                                    <option value="days" {% if smtp.gen_period != 'last_month' %}selected{% endif %}>Letzte X Tage</option>
+                                    <option value="last_month" {% if smtp.gen_period == 'last_month' %}selected{% endif %}>Letzter Monat</option>
+                                </select>
+                            </label>
+                            <label>Tage (bei „Letzte X Tage“)
+                                <input type="number" name="gen_days" min="1" max="90" value="{{ smtp.gen_days }}">
+                            </label>
+                        </div>
+                        <div class="form-row">
+                            <label>Artikel-Auswahl
+                                <select name="gen_article_type">
+                                    <option value="all" {% if smtp.gen_article_type == 'all' %}selected{% endif %}>Alle</option>
+                                    <option value="new" {% if smtp.gen_article_type == 'new' %}selected{% endif %}>Nur neue</option>
+                                    <option value="edited" {% if smtp.gen_article_type == 'edited' %}selected{% endif %}>Nur bearbeitete</option>
+                                </select>
+                            </label>
+                            <label>Kategorie (optional)
+                                <input type="text" name="gen_category" value="{{ smtp.gen_category }}">
+                            </label>
+                        </div>
+                        <label>Bearbeiter ausschließen (optional)
+                            <input type="text" name="gen_excluded_users" value="{{ smtp.gen_excluded_users }}" placeholder="z. B. Aranzinger, Testuser">
+                        </label>
+                        <p class="hint" style="margin-top:-0.2rem;">Diese Benutzer werden bei „Bearbeitete Artikel“ ignoriert (gilt für den geplanten Versand).</p>
+                    </fieldset>
+
                     <button type="submit">Einstellungen speichern</button>
                 </form>
             </div>
         </details>
         {% endif %}
 
+        {% if can_view_sensitive %}
         <section class="card">
             <div class="card-header">
                 <h3>Versandprotokoll</h3>
@@ -260,6 +383,7 @@
                 </table>
             </div>
         </section>
+        {% endif %}
 
     </div>
 
@@ -276,10 +400,10 @@
         <div class="sidebar-card">
             <h4>Outlook-Tipp</h4>
             <ul>
-                <li>„Im Browser öffnen“ nutzen</li>
+                <li><strong>Vorschau kopieren</strong> – übernimmt die Live-Vorschau</li>
-                <li>Alles markieren (Strg+A)</li>
+                <li>In Outlook: <strong>Strg+V</strong></li>
-                <li>Kopieren (Strg+C)</li>
+                <li>Rechtsklick → <strong>Format beibehalten</strong></li>
-                <li>In Outlook einfügen</li>
+                <li>Bei Dunkelmodus: Outlook-Design auf „Weiß“ stellen</li>
             </ul>
         </div>
         {% if user.role == "admin" %}
@@ -297,5 +421,5 @@
 {% endblock %}
 
 {% block scripts %}
-<script src="/static/js/newsletter.js?v=6"></script>
+<script src="/static/js/newsletter.js?v=8"></script>
 {% endblock %}

app/templates/login.html

@@ -11,7 +11,7 @@
     <form method="post" action="/login" class="form-grid">
         <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
         <label>E-Mail
-            <input type="email" name="email" required autocomplete="username" placeholder="name@firma.de">
+            <input type="email" name="email" required autocomplete="username">
         </label>
         <label>Passwort
             <input type="password" name="password" required autocomplete="current-password">

app/templates/profile.html

@@ -0,0 +1,74 @@
+{% extends "base.html" %}
+{% block title %}Mein Profil{% endblock %}
+{% block content %}
+
+<div class="page-header">
+    <h2>Mein Profil</h2>
+    <p class="page-lead"><a href="/dashboard">← Zurück zum Dashboard</a></p>
+</div>
+
+{% if success_message %}
+<p class="hint" style="color:var(--tk-success);font-weight:600;">{{ success_message }}</p>
+{% endif %}
+
+<div class="layout-2col">
+    <div class="main-col">
+        <section class="card card-accent-orange">
+            <div class="card-header">
+                <h3>Profil bearbeiten</h3>
+            </div>
+            {% if error_message %}
+            <p class="error">{{ error_message }}</p>
+            {% endif %}
+            <form method="post" action="/profil" class="form-grid">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
+                <div class="form-row">
+                    <label>Vollständiger Name
+                        <input type="text" name="full_name" required minlength="2" value="{{ user.full_name }}">
+                    </label>
+                    <label>E-Mail
+                        <input type="email" name="email" required value="{{ user.email }}">
+                    </label>
+                </div>
+                <button type="submit" class="btn-primary">Profil speichern</button>
+            </form>
+        </section>
+
+        <section class="card">
+            <div class="card-header">
+                <h3>Passwort ändern</h3>
+            </div>
+            {% if pw_error_message %}
+            <p class="error">{{ pw_error_message }}</p>
+            {% endif %}
+            <form method="post" action="/profil/passwort" class="form-grid">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
+                <label>Aktuelles Passwort
+                    <input type="password" name="current_password" required autocomplete="current-password">
+                </label>
+                <div class="form-row">
+                    <label>Neues Passwort
+                        <input type="password" name="new_password" required minlength="10" autocomplete="new-password" placeholder="Mind. 10 Zeichen, Groß/Klein/Ziffer">
+                    </label>
+                    <label>Neues Passwort bestätigen
+                        <input type="password" name="confirm_password" required minlength="10" autocomplete="new-password">
+                    </label>
+                </div>
+                <button type="submit" class="btn-primary">Passwort ändern</button>
+            </form>
+        </section>
+    </div>
+
+    <aside class="sidebar-col">
+        <div class="sidebar-card">
+            <h4>Konto</h4>
+            <ul>
+                <li><strong>Rolle:</strong> {{ user.role }}</li>
+                <li><strong>Status:</strong> {{ "Aktiv" if user.is_active else "Inaktiv" }}</li>
+            </ul>
+            <p class="hint">Die Rolle kann nur ein Administrator ändern.</p>
+        </div>
+    </aside>
+</div>
+
+{% endblock %}

app/templates/users.html

@@ -13,6 +13,12 @@
             <div class="card-header">
                 <h3>Neuen Benutzer anlegen</h3>
             </div>
+            {% if error_message %}
+            <p class="error">{{ error_message }}</p>
+            {% endif %}
+            {% if success_message %}
+            <p class="hint" style="color:var(--tk-success);font-weight:600;">{{ success_message }}</p>
+            {% endif %}
             <form method="post" action="/admin/users" class="form-grid">
                 <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                 <div class="form-row">
@@ -25,7 +31,7 @@
                 </div>
                 <div class="form-row">
                     <label>Passwort
-                        <input type="password" name="password" required minlength="10">
+                        <input type="password" name="password" required minlength="10" placeholder="Mind. 10 Zeichen, Groß/Klein/Ziffer">
                     </label>
                     <label>Rolle
                         <select name="role">
@@ -46,15 +52,40 @@
             <div class="table-wrap">
                 <table>
                     <thead>
-                        <tr><th>E-Mail</th><th>Name</th><th>Rolle</th><th>Status</th></tr>
+                        <tr><th>E-Mail</th><th>Name</th><th>Rolle</th><th>Status</th><th>Aktionen</th></tr>
                     </thead>
                     <tbody>
                     {% for u in users %}
                         <tr>
                             <td>{{ u.email }}</td>
                             <td>{{ u.full_name }}</td>
-                            <td><span class="badge badge-{{ u.role }}">{{ u.role }}</span></td>
+                            <td>
+                                {% if u.id == user.id %}
+                                <span class="badge badge-{{ u.role }}">{{ u.role }}</span>
+                                {% else %}
+                                <form method="post" action="/admin/users/{{ u.id }}/role" class="inline-form">
+                                    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
+                                    <select name="role" onchange="this.form.submit()">
+                                        <option value="reader" {% if u.role == 'reader' %}selected{% endif %}>reader</option>
+                                        <option value="editor" {% if u.role == 'editor' %}selected{% endif %}>editor</option>
+                                        <option value="admin" {% if u.role == 'admin' %}selected{% endif %}>admin</option>
+                                    </select>
+                                </form>
+                                {% endif %}
+                            </td>
                             <td>{{ "Aktiv" if u.is_active else "Inaktiv" }}</td>
+                            <td>
+                                {% if u.id != user.id %}
+                                <form method="post" action="/admin/users/{{ u.id }}/toggle-active" class="inline-form">
+                                    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
+                                    <button type="submit" class="btn-secondary btn-small">
+                                        {% if u.is_active %}Deaktivieren{% else %}Aktivieren{% endif %}
+                                    </button>
+                                </form>
+                                {% else %}
+                                <span class="hint">Eigenes Konto</span>
+                                {% endif %}
+                            </td>
                         </tr>
                     {% endfor %}
                     </tbody>
@@ -72,6 +103,12 @@
                 <li><strong>Admin</strong> – Benutzer &amp; SMTP</li>
             </ul>
         </div>
+        <div class="sidebar-card">
+            <h4>Sicherheit</h4>
+            <ul>
+                <li>Rollen- oder Statusänderung beendet alle aktiven Sitzungen des Benutzers.</li>
+            </ul>
+        </div>
     </aside>
 </div>
 

docker-compose.yml

@@ -9,6 +9,11 @@ services:
     volumes:
       - newsletter_data:/app/data
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    read_only: true
+    tmpfs:
+      - /tmp
     healthcheck:
       test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/login').read()\""]
       interval: 30s

preview_send.html

@@ -0,0 +1,129 @@
+<!DOCTYPE html>
+<html lang="de" xmlns="http://www.w3.org/1999/xhtml" xmlns:o="urn:schemas-microsoft-com:office:office">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Interner Wiki-Newsletter – Thomas-Krenn.AG (30 Tage)</title>
+  <style type="text/css">
+    html, body { margin:0 !important; padding:0 !important; width:100% !important; background:#ECEEF1; }
+    table, td { border-collapse:collapse; mso-table-lspace:0pt; mso-table-rspace:0pt; }
+    img { border:0; outline:none; text-decoration:none; -ms-interpolation-mode:bicubic; }
+    a { text-decoration:none; }
+    .preheader { display:none !important; visibility:hidden; opacity:0; color:transparent; height:0; width:0; max-height:0; max-width:0; overflow:hidden; mso-hide:all; }
+    @media only screen and (max-width: 700px) {
+      .email-container { width:100% !important; }
+      .mobile-padding { padding-left:16px !important; padding-right:16px !important; }
+      .mobile-headline { font-size:28px !important; line-height:34px !important; }
+      .mobile-card-title { font-size:18px !important; line-height:25px !important; }
+    }
+  </style>
+  <!--[if mso]>
+  <style type="text/css">
+    body, table, td, p, a, li, h1, h2, h3, span, strong { font-family: Arial, sans-serif !important; }
+  </style>
+  <![endif]-->
+</head>
+<body style="margin:0;padding:0;background:#ECEEF1;font-family:Arial, Helvetica, sans-serif;color:#1A1A1A;">
+  <div class="preheader">Es gibt 3 neue bzw. aktualisierte Wiki-Artikel.&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;</div>
+  <center role="article" aria-roledescription="email" lang="de" style="width:100%;background:#ECEEF1;">
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" bgcolor="#ECEEF1" style="width:100%;background:#ECEEF1;">
+      <tr>
+        <td align="center" style="padding:22px 10px;">
+          <table role="presentation" width="700" cellpadding="0" cellspacing="0" border="0" class="email-container" style="width:100%;max-width:700px;background:#FFFFFF;border-top:4px solid #ED6B06;">
+            <tr>
+              <td align="center" style="padding:24px 32px 18px 32px;background:#4A4A4A;" class="mobile-padding">
+                <img src="https://www.thomas-krenn.com/res/pics/tk_logo_340px.png" width="190" alt="Thomas-Krenn Logo" style="display:block;margin:0 auto;border:0;outline:none;text-decoration:none;height:auto;">
+              </td>
+            </tr>
+            <tr>
+              <td style="padding:0 32px;" class="mobile-padding">
+                <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="width:100%;background:#4A4A4A;">
+                  <tr>
+                    <td style="padding:28px 26px;font-family:Arial, Helvetica, sans-serif;">
+                      <div style="font-size:12px;line-height:16px;font-weight:bold;color:#ED6B06;letter-spacing:1px;text-transform:uppercase;">Thomas-Krenn Wiki Update</div>
+                      <div class="mobile-headline" style="font-size:32px;line-height:38px;font-weight:bold;color:#FFFFFF;margin-top:10px;">Die neuesten Wiki-Artikel</div>
+                      <div style="font-size:16px;line-height:25px;color:#DDDDDD;margin-top:10px;">07.06.2026 – 07.07.2026 &nbsp;|&nbsp; Es gibt 3 neue bzw. aktualisierte Wiki-Artikel.</div>
+                    </td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+            <tr>
+              <td style="padding:22px 32px 6px 32px;" class="mobile-padding">
+                <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="background:#FFF4ED;border-left:4px solid #ED6B06;">
+                  <tr>
+                    <td style="padding:18px 20px;font-family:Arial, Helvetica, sans-serif;font-size:15px;line-height:24px;color:#1A1A1A;">
+                      <p style="margin:0 0 10px;font-family:Arial, Helvetica, sans-serif;">Servus,</p>
+                      <p style="margin:0;font-family:Arial, Helvetica, sans-serif;">hier ist deine Übersicht mit den neuesten Beiträgen aus dem Thomas-Krenn-Wiki vom 07.06.2026 bis 07.07.2026.</p>
+                    </td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+            
+            <tr><td style="padding:8px 32px 4px 32px;" class="mobile-padding"><table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="width:100%;background:#FFF4ED;border:1px solid #F5C9A6;border-radius:12px;"><tr><td style="padding:16px 18px 8px 18px;font-family:Arial, Helvetica, sans-serif;font-size:11px;line-height:15px;color:#C95605;font-weight:bold;letter-spacing:.8px;text-transform:uppercase;">Top Highlights</td></tr><tr><td style="padding:0 18px 12px 18px;"><table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0"><tr><td style="padding:0 0 8px 0;font-family:Arial, Helvetica, sans-serif;font-size:15px;line-height:22px;color:#1A1A1A;"><span style="display:inline-block;min-width:22px;font-weight:bold;color:#ED6B06;">1.</span> <a href="https://www.thomas-krenn.com/de/wiki/RAID_Grundlagen_und_Konfiguration" target="_blank" style="color:#1A1A1A;text-decoration:none;">RAID Grundlagen und Konfiguration</a></td></tr></table></td></tr></table></td></tr>
+            <tr><td style="padding:26px 32px 8px 32px;font-family:Arial, Helvetica, sans-serif;" class="mobile-padding"><div style="font-family:Arial, Helvetica, sans-serif;font-size:18px;line-height:24px;font-weight:bold;color:#4A4A4A;border-bottom:2px solid #ED6B06;padding-bottom:8px;">Neue Artikel <span style="color:#ED6B06;">(2)</span></div></td></tr><tr><td style="padding:0 32px 16px 32px;" class="mobile-padding"><table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="width:100%;background:#FFFFFF;border:1px solid #E0E0E0;border-left:4px solid #ED6B06;border-radius:12px;"><tr><td style="padding:16px 22px 4px 22px;font-family:Arial, Helvetica, sans-serif;font-size:11px;line-height:16px;font-weight:bold;letter-spacing:.7px;text-transform:uppercase;color:#ED6B06;">1. Neuer Beitrag</td></tr><tr><td class="mobile-card-title" style="padding:0 22px 8px 22px;font-family:Arial, Helvetica, sans-serif;font-size:20px;line-height:27px;font-weight:bold;color:#4A4A4A;"><a href="https://www.thomas-krenn.com/de/wiki/Proxmox_VE_Cluster_einrichten" target="_blank" style="color:#4A4A4A;text-decoration:none;">Proxmox VE Cluster einrichten</a></td></tr><tr><td style="padding:0 22px 12px 22px;font-family:Arial, Helvetica, sans-serif;font-size:13px;line-height:20px;color:#6B6B6B;">Veröffentlicht am 02.07.2026 14:10 von AnnaSchmidt.</td></tr><tr><td style="padding:0 22px 12px 22px;font-family:Arial, Helvetica, sans-serif;font-size:12px;line-height:18px;color:#6B6B6B;">Kategorie: Virtualisierung</td></tr><tr><td style="padding:2px 22px 18px 22px;"><table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin:0 auto;"><tr><td bgcolor="#ED6B06" style="background:#ED6B06;border-radius:6px;"><a href="https://www.thomas-krenn.com/de/wiki/Proxmox_VE_Cluster_einrichten" target="_blank" style="display:inline-block;padding:12px 22px;font-family:Arial, Helvetica, sans-serif;font-size:14px;line-height:18px;font-weight:bold;color:#FFFFFF;text-decoration:none;">Zum Beitrag →</a></td></tr></table></td></tr></table></td></tr><tr><td style="padding:0 32px 16px 32px;" class="mobile-padding"><table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="width:100%;background:#FFFFFF;border:1px solid #E0E0E0;border-left:4px solid #ED6B06;border-radius:12px;"><tr><td style="padding:16px 22px 4px 22px;font-family:Arial, Helvetica, sans-serif;font-size:11px;line-height:16px;font-weight:bold;letter-spacing:.7px;text-transform:uppercase;color:#ED6B06;">2. Neuer Beitrag</td></tr><tr><td class="mobile-card-title" style="padding:0 22px 8px 22px;font-family:Arial, Helvetica, sans-serif;font-size:20px;line-height:27px;font-weight:bold;color:#4A4A4A;"><a href="https://www.thomas-krenn.com/de/wiki/RAID_Grundlagen_und_Konfiguration" target="_blank" style="color:#4A4A4A;text-decoration:none;">RAID Grundlagen und Konfiguration</a></td></tr><tr><td style="padding:0 22px 12px 22px;font-family:Arial, Helvetica, sans-serif;font-size:13px;line-height:20px;color:#6B6B6B;">Veröffentlicht am 01.07.2026 09:30 von MaxMuster.</td></tr><tr><td style="padding:0 22px 12px 22px;font-family:Arial, Helvetica, sans-serif;font-size:12px;line-height:18px;color:#6B6B6B;">Kategorie: Storage, Linux</td></tr><tr><td style="padding:2px 22px 18px 22px;"><table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin:0 auto;"><tr><td bgcolor="#ED6B06" style="background:#ED6B06;border-radius:6px;"><a href="https://www.thomas-krenn.com/de/wiki/RAID_Grundlagen_und_Konfiguration" target="_blank" style="display:inline-block;padding:12px 22px;font-family:Arial, Helvetica, sans-serif;font-size:14px;line-height:18px;font-weight:bold;color:#FFFFFF;text-decoration:none;">Zum Beitrag →</a></td></tr></table></td></tr></table></td></tr>
+<tr><td style="padding:26px 32px 8px 32px;font-family:Arial, Helvetica, sans-serif;" class="mobile-padding"><div style="font-family:Arial, Helvetica, sans-serif;font-size:18px;line-height:24px;font-weight:bold;color:#4A4A4A;border-bottom:2px solid #4A4A4A;padding-bottom:8px;">Bearbeitete Artikel <span style="color:#4A4A4A;">(1)</span></div></td></tr><tr><td style="padding:0 32px 16px 32px;" class="mobile-padding"><table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="width:100%;background:#FFFFFF;border:1px solid #E0E0E0;border-left:4px solid #4A4A4A;border-radius:12px;"><tr><td style="padding:16px 22px 4px 22px;font-family:Arial, Helvetica, sans-serif;font-size:11px;line-height:16px;font-weight:bold;letter-spacing:.7px;text-transform:uppercase;color:#4A4A4A;">1. Aktualisierter Beitrag</td></tr><tr><td class="mobile-card-title" style="padding:0 22px 8px 22px;font-family:Arial, Helvetica, sans-serif;font-size:20px;line-height:27px;font-weight:bold;color:#4A4A4A;"><a href="https://www.thomas-krenn.com/de/wiki/ESXi_8_Update_Hinweise" target="_blank" style="color:#4A4A4A;text-decoration:none;">ESXi 8 Update Hinweise</a></td></tr><tr><td style="padding:0 22px 12px 22px;font-family:Arial, Helvetica, sans-serif;font-size:13px;line-height:20px;color:#6B6B6B;">Veröffentlicht am 03.07.2026 12:00 von TomWeber.</td></tr><tr><td style="padding:0 22px 12px 22px;font-family:Arial, Helvetica, sans-serif;font-size:12px;line-height:18px;color:#6B6B6B;">Kategorie: VMware</td></tr><tr><td style="padding:2px 22px 18px 22px;"><table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin:0 auto;"><tr><td bgcolor="#ED6B06" style="background:#ED6B06;border-radius:6px;"><a href="https://www.thomas-krenn.com/de/wiki/ESXi_8_Update_Hinweise" target="_blank" style="display:inline-block;padding:12px 22px;font-family:Arial, Helvetica, sans-serif;font-size:14px;line-height:18px;font-weight:bold;color:#FFFFFF;text-decoration:none;">Zum Beitrag →</a></td></tr></table></td></tr></table></td></tr>
+            <tr><td style="padding:24px 32px 0 32px;" class="mobile-padding"><table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="margin-top:4px;font-family:Arial, Helvetica, sans-serif;">
+  <tr>
+    <td style="padding:0 0 10px;font-family:Arial, Helvetica, sans-serif;font-size:14px;line-height:20px;font-weight:bold;color:#4A4A4A;">Zusammenfassung</td>
+  </tr>
+  <tr>
+    <td style="font-family:Arial, Helvetica, sans-serif;">
+      <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="font-family:Arial, Helvetica, sans-serif;">
+        <tr>
+          <td width="33%" style="padding:18px 12px;background:#FFF4ED;border:1px solid #E0E0E0;text-align:center;font-family:Arial, Helvetica, sans-serif;">
+            <div style="font-family:Arial, Helvetica, sans-serif;font-size:28px;line-height:32px;font-weight:bold;color:#ED6B06;">2</div>
+            <div style="margin-top:4px;font-family:Arial, Helvetica, sans-serif;font-size:12px;line-height:16px;color:#6B6B6B;">Neue Artikel</div>
+          </td>
+          <td width="4" style="font-size:0;line-height:0;">&nbsp;</td>
+          <td width="33%" style="padding:18px 12px;background:#EEEEEE;border:1px solid #E0E0E0;text-align:center;font-family:Arial, Helvetica, sans-serif;">
+            <div style="font-family:Arial, Helvetica, sans-serif;font-size:28px;line-height:32px;font-weight:bold;color:#4A4A4A;">1</div>
+            <div style="margin-top:4px;font-family:Arial, Helvetica, sans-serif;font-size:12px;line-height:16px;color:#6B6B6B;">Bearbeitet</div>
+          </td>
+          <td width="4" style="font-size:0;line-height:0;">&nbsp;</td>
+          <td width="33%" style="padding:18px 12px;background:#F5F5F5;border:1px solid #E0E0E0;text-align:center;font-family:Arial, Helvetica, sans-serif;">
+            <div style="font-family:Arial, Helvetica, sans-serif;font-size:28px;line-height:32px;font-weight:bold;color:#4A4A4A;">3</div>
+            <div style="margin-top:4px;font-family:Arial, Helvetica, sans-serif;font-size:12px;line-height:16px;color:#6B6B6B;">Gesamt</div>
+          </td>
+        </tr>
+      </table>
+    </td>
+  </tr>
+</table></td></tr>
+            <tr><td style="padding:16px 32px 4px 32px;" class="mobile-padding"><table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="width:100%;background:#F5F5F5;border:1px solid #E0E0E0;border-radius:12px;"><tr><td style="padding:16px 18px 8px 18px;font-family:Arial, Helvetica, sans-serif;font-size:11px;line-height:15px;color:#4A4A4A;font-weight:bold;letter-spacing:.8px;text-transform:uppercase;">Redaktionsnotiz</td></tr><tr><td style="padding:0 18px 16px 18px;font-family:Arial, Helvetica, sans-serif;font-size:15px;line-height:24px;color:#1A1A1A;">Bitte gebt bis Freitag Feedback zu den neuen RAID-Artikeln.</td></tr></table></td></tr>
+            <tr>
+              <td align="center" style="padding:28px 32px 4px 32px;" class="mobile-padding">
+                <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin:0 auto;"><tr><td bgcolor="#ED6B06" style="background:#ED6B06;border-radius:6px;"><a href="https://www.thomas-krenn.com/de/wiki/Hauptseite" target="_blank" style="display:inline-block;padding:12px 22px;font-family:Arial, Helvetica, sans-serif;font-size:14px;line-height:18px;font-weight:bold;color:#FFFFFF;text-decoration:none;">Zum Thomas-Krenn-Wiki →</a></td></tr></table>
+              </td>
+            </tr>
+            <tr>
+              <td style="padding:24px 32px 28px 32px;" class="mobile-padding">
+                <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0">
+                  <tr>
+                    <td style="font-family:Arial, Helvetica, sans-serif;font-size:15px;line-height:24px;color:#1A1A1A;">
+                      Fragen oder ein Themenwunsch? Meldet euch gern beim Wiki-Team.<br><br>
+                      Viele Grüße<br>
+                      Euer Thomas-Krenn-Wiki Team
+                    </td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+            <tr>
+              <td style="background:#4A4A4A;padding:22px 20px;text-align:center;font-family:Arial, Helvetica, sans-serif;">
+                <div style="font-size:12px;line-height:19px;color:#EEF0F2;">
+                  Thomas-Krenn.AG | Speltenbach-Steinäcker 1 | D-94078 Freyung<br>
+                  Tel.: +49 8551 9150 0 | Fax: +49 8551 9150 55 |
+                  <a href="https://www.thomas-krenn.com/de/wiki/Hauptseite" target="_blank" style="color:#ED6B06;text-decoration:underline;">thomas-krenn.com</a><br>
+                  <span style="color:#AEB2B7;">Automatisch erstellter interner Newsletter &middot; Nur für den internen Gebrauch</span>
+                </div>
+              </td>
+            </tr>
+          </table>
+        </td>
+      </tr>
+    </table>
+  </center>
+</body>
+</html>

requirements.txt

@@ -1,12 +1,13 @@
-fastapi
+fastapi==0.115.6
-uvicorn[standard]
+uvicorn[standard]==0.32.1
-jinja2
+jinja2==3.1.6
-sqlalchemy
+sqlalchemy==2.0.36
-alembic
+alembic==1.14.0
-python-multipart
+python-multipart==0.0.31
-httpx
+httpx==0.28.1
-bcrypt
+bcrypt==4.2.1
-python-jose[cryptography]
+python-jose[cryptography]==3.4.0
-pydantic-settings
+pydantic-settings==2.6.1
-email-validator
+email-validator==2.2.0
-psycopg[binary]
+psycopg[binary]==3.2.13
+cryptography==48.0.1