Initial commit

2026-07-31 10:08:13 +02:00
parent 652943fb7e
commit a69f31649c
7192 changed files with 924319 additions and 0 deletions
@@ -0,0 +1,20 @@
+from django.contrib import admin
+from django.contrib.auth.admin import UserAdmin as BaseUserAdmin
+from .models import User, RegistrationDomainRule, RegistrationRestrictionSetting
+
+@admin.register(User)
+class UserAdmin(BaseUserAdmin):
+    fieldsets = BaseUserAdmin.fieldsets + (
+        ('Zusatzinfos', {'fields': ('display_name', 'skills', 'is_admin_user')}),
+    )
+    list_display = ['username', 'email', 'display_name', 'is_admin_user', 'is_staff', 'is_superuser']
+
+@admin.register(RegistrationDomainRule)
+class RegistrationDomainRuleAdmin(admin.ModelAdmin):
+    list_display = ['domain', 'is_active', 'created_at']
+    list_filter = ['is_active']
+    search_fields = ['domain']
+
+@admin.register(RegistrationRestrictionSetting)
+class RegistrationRestrictionSettingAdmin(admin.ModelAdmin):
+    list_display = ['is_restriction_enabled']
@@ -0,0 +1,64 @@
+# Generated by Django 6.0.7 on 2026-07-31 07:21
+
+import django.contrib.auth.models
+import django.contrib.auth.validators
+import django.utils.timezone
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0012_alter_user_first_name_max_length'),
+        ('events', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='RegistrationDomainRule',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('domain', models.CharField(help_text='z. B. verein.de oder @beispiel.org', max_length=150, unique=True)),
+                ('is_active', models.BooleanField(default=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+            ],
+        ),
+        migrations.CreateModel(
+            name='RegistrationRestrictionSetting',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('is_restriction_enabled', models.BooleanField(default=False)),
+            ],
+        ),
+        migrations.CreateModel(
+            name='User',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('password', models.CharField(max_length=128, verbose_name='password')),
+                ('last_login', models.DateTimeField(blank=True, null=True, verbose_name='last login')),
+                ('is_superuser', models.BooleanField(default=False, help_text='Designates that this user has all permissions without explicitly assigning them.', verbose_name='superuser status')),
+                ('username', models.CharField(error_messages={'unique': 'A user with that username already exists.'}, help_text='Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.', max_length=150, unique=True, validators=[django.contrib.auth.validators.UnicodeUsernameValidator()], verbose_name='username')),
+                ('first_name', models.CharField(blank=True, max_length=150, verbose_name='first name')),
+                ('last_name', models.CharField(blank=True, max_length=150, verbose_name='last name')),
+                ('is_staff', models.BooleanField(default=False, help_text='Designates whether the user can log into this admin site.', verbose_name='staff status')),
+                ('is_active', models.BooleanField(default=True, help_text='Designates whether this user should be treated as active. Unselect this instead of deleting accounts.', verbose_name='active')),
+                ('date_joined', models.DateTimeField(default=django.utils.timezone.now, verbose_name='date joined')),
+                ('email', models.EmailField(max_length=254, unique=True)),
+                ('display_name', models.CharField(blank=True, default='', max_length=150)),
+                ('is_admin_user', models.BooleanField(default=False)),
+                ('groups', models.ManyToManyField(blank=True, help_text='The groups this user belongs to. A user will get all permissions granted to each of their groups.', related_name='user_set', related_query_name='user', to='auth.group', verbose_name='groups')),
+                ('skills', models.ManyToManyField(blank=True, related_name='users', to='events.skill')),
+                ('user_permissions', models.ManyToManyField(blank=True, help_text='Specific permissions for this user.', related_name='user_set', related_query_name='user', to='auth.permission', verbose_name='user permissions')),
+            ],
+            options={
+                'verbose_name': 'user',
+                'verbose_name_plural': 'users',
+                'abstract': False,
+            },
+            managers=[
+                ('objects', django.contrib.auth.models.UserManager()),
+            ],
+        ),
+    ]
@@ -0,0 +1,23 @@
+# Generated by Django 6.0.7 on 2026-07-31 07:31
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('users', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='registrationrestrictionsetting',
+            name='require_admin_approval',
+            field=models.BooleanField(default=False, help_text='Neue Registrierungen müssen von einem Admin freigeschaltet werden'),
+        ),
+        migrations.AddField(
+            model_name='user',
+            name='is_approved',
+            field=models.BooleanField(default=True, help_text='Vom Admin freigeschaltet'),
+        ),
+    ]
@@ -0,0 +1,29 @@
+# Generated by Django 6.0.7 on 2026-07-31 07:50
+
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0003_event_is_active'),
+        ('users', '0002_registrationrestrictionsetting_require_admin_approval_and_more'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='GuestClaimToken',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('token', models.UUIDField(default=uuid.uuid4, editable=False, unique=True)),
+                ('guest_name', models.CharField(max_length=150)),
+                ('is_claimed', models.BooleanField(default=False)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('created_by', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='created_claim_tokens', to=settings.AUTH_USER_MODEL)),
+                ('signup', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='claim_tokens', to='events.shiftsignup')),
+            ],
+        ),
+    ]
@@ -0,0 +1,59 @@
+import uuid
+from django.contrib.auth.models import AbstractUser
+from django.db import models
+from django.conf import settings
+
+class User(AbstractUser):
+    email = models.EmailField(unique=True)
+    display_name = models.CharField(max_length=150, blank=True, default='')
+    skills = models.ManyToManyField('events.Skill', blank=True, related_name='users')
+    is_admin_user = models.BooleanField(default=False)
+    is_approved = models.BooleanField(default=True, help_text="Vom Admin freigeschaltet")
+
+    def get_display_name(self):
+        return self.display_name or self.username or self.email
+
+    def __str__(self):
+        status_str = " (Ausstehend)" if not self.is_approved else ""
+        return f"{self.get_display_name()} ({self.email}){status_str}"
+
+class RegistrationDomainRule(models.Model):
+    domain = models.CharField(max_length=150, unique=True, help_text="z. B. verein.de oder @beispiel.org")
+    is_active = models.BooleanField(default=True)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+    def clean_domain(self):
+        domain = self.domain.strip().lower()
+        if not domain.startswith('@'):
+            domain = '@' + domain
+        return domain
+
+    def save(self, *args, **kwargs):
+        self.domain = self.clean_domain()
+        super().save(*args, **kwargs)
+
+    def __str__(self):
+        return f"{self.domain} ({'Aktiv' if self.is_active else 'Inaktiv'})"
+
+class RegistrationRestrictionSetting(models.Model):
+    is_restriction_enabled = models.BooleanField(default=False)
+    require_admin_approval = models.BooleanField(default=False, help_text="Neue Registrierungen müssen von einem Admin freigeschaltet werden")
+
+    @classmethod
+    def get_solo(cls):
+        obj, _ = cls.objects.get_or_create(pk=1)
+        return obj
+
+    def __str__(self):
+        return f"Domain-Einschränkung: {self.is_restriction_enabled}, Admin-Freischaltung: {self.require_admin_approval}"
+
+class GuestClaimToken(models.Model):
+    token = models.UUIDField(default=uuid.uuid4, unique=True, editable=False)
+    signup = models.ForeignKey('events.ShiftSignup', on_delete=models.CASCADE, related_name='claim_tokens')
+    guest_name = models.CharField(max_length=150)
+    created_by = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE, related_name='created_claim_tokens')
+    is_claimed = models.BooleanField(default=False)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+    def __str__(self):
+        return f"Claim Token for {self.guest_name} ({self.token})"
@@ -0,0 +1,80 @@
+from rest_framework import serializers
+from django.contrib.auth import get_user_model
+from .models import RegistrationDomainRule, RegistrationRestrictionSetting
+from apps.events.models import Skill
+
+User = get_user_model()
+
+class SkillSimpleSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = Skill
+        fields = ['id', 'name', 'description', 'color']
+
+class UserSerializer(serializers.ModelSerializer):
+    skills = SkillSimpleSerializer(many=True, read_only=True)
+    skill_ids = serializers.PrimaryKeyRelatedField(
+        queryset=Skill.objects.all(), many=True, write_only=True, required=False, source='skills'
+    )
+
+    class Meta:
+        model = User
+        fields = ['id', 'username', 'email', 'display_name', 'is_admin_user', 'is_staff', 'is_superuser', 'is_approved', 'is_active', 'skills', 'skill_ids']
+        read_only_fields = ['id', 'is_staff', 'is_superuser', 'is_approved']
+
+class AdminUserSerializer(serializers.ModelSerializer):
+    skills = SkillSimpleSerializer(many=True, read_only=True)
+    skill_ids = serializers.PrimaryKeyRelatedField(
+        queryset=Skill.objects.all(), many=True, write_only=True, required=False, source='skills'
+    )
+
+    class Meta:
+        model = User
+        fields = ['id', 'username', 'email', 'display_name', 'is_admin_user', 'is_staff', 'is_superuser', 'is_approved', 'is_active', 'skills', 'skill_ids', 'date_joined']
+        read_only_fields = ['id', 'date_joined']
+
+class RegisterSerializer(serializers.ModelSerializer):
+    password = serializers.CharField(write_only=True, min_length=6)
+
+    class Meta:
+        model = User
+        fields = ['username', 'email', 'password', 'display_name']
+
+    def validate_email(self, value):
+        email = value.strip().lower()
+        setting = RegistrationRestrictionSetting.get_solo()
+        if setting.is_restriction_enabled:
+            allowed_rules = RegistrationDomainRule.objects.filter(is_active=True)
+            if allowed_rules.exists():
+                email_domain = email.split('@')[-1] if '@' in email else ''
+                matched = False
+                for rule in allowed_rules:
+                    clean_rule = rule.domain.lstrip('@').lower()
+                    if email_domain == clean_rule or email_domain.endswith('.' + clean_rule):
+                        matched = True
+                        break
+                if not matched:
+                    domains_list = ", ".join([r.domain for r in allowed_rules])
+                    raise serializers.ValidationError(
+                        f"Registrierungen sind derzeit nur für folgende E-Mail-Domains erlaubt: {domains_list}"
+                    )
+        return email
+
+    def create(self, validated_data):
+        display_name = validated_data.get('display_name', '') or validated_data['username']
+        user = User.objects.create_user(
+            username=validated_data['username'],
+            email=validated_data['email'],
+            password=validated_data['password'],
+            display_name=display_name
+        )
+        return user
+
+class RegistrationDomainRuleSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = RegistrationDomainRule
+        fields = ['id', 'domain', 'is_active', 'created_at']
+
+class RegistrationRestrictionSettingSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = RegistrationRestrictionSetting
+        fields = ['is_restriction_enabled', 'require_admin_approval']
@@ -0,0 +1,144 @@
+from django.test import TestCase
+from django.contrib.auth import get_user_model
+from rest_framework.test import APIClient
+from rest_framework import status
+from .models import RegistrationDomainRule, RegistrationRestrictionSetting
+from apps.events.models import Event, TaskArea, Shift, ShiftSignup
+
+User = get_user_model()
+
+class UserRegistrationTests(TestCase):
+    def setUp(self):
+        self.client = APIClient()
+
+    def test_domain_restriction_enforcement(self):
+        # Enable domain restriction
+        setting = RegistrationRestrictionSetting.get_solo()
+        setting.is_restriction_enabled = True
+        setting.save()
+
+        # Add rule for verein.de
+        RegistrationDomainRule.objects.create(domain='verein.de', is_active=True)
+
+        # Attempt registration with non-allowed domain
+        res = self.client.post('/api/users/register/', {
+            'username': 'testuser',
+            'email': 'user@otherdomain.com',
+            'password': 'password123',
+            'display_name': 'Test User'
+        })
+        self.assertEqual(res.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn('Registrierungen sind derzeit nur für folgende E-Mail-Domains erlaubt', str(res.data))
+
+        # Attempt registration with allowed domain
+        res_ok = self.client.post('/api/users/register/', {
+            'username': 'alloweduser',
+            'email': 'user@verein.de',
+            'password': 'password123',
+            'display_name': 'Allowed User'
+        })
+        self.assertEqual(res_ok.status_code, status.HTTP_201_CREATED)
+        self.assertIn('token', res_ok.data)
+
+    def test_guest_shift_claiming_on_registration(self):
+        # Create event, task area, shift
+        event = Event.objects.create(title="Test Event", start_date="2026-08-01", end_date="2026-08-02")
+        ta = TaskArea.objects.create(event=event, name="Tresendienst")
+        shift = Shift.objects.create(task_area=ta, title="Frühschicht", start_time="09:00", end_time="13:00")
+
+        # Guest signs up with guest_name="Max Mustermann"
+        session = self.client.session
+        session.save()
+        session_key = session.session_key
+
+        signup = ShiftSignup.objects.create(
+            shift=shift,
+            guest_name="Max Mustermann",
+            guest_session_key=session_key
+        )
+
+        # Now register user with display_name="Max Mustermann"
+        res = self.client.post('/api/users/register/', {
+            'username': 'max_mustermann',
+            'email': 'max@example.com',
+            'password': 'password123',
+            'display_name': 'Max Mustermann'
+        })
+        self.assertEqual(res.status_code, status.HTTP_201_CREATED)
+        self.assertEqual(res.data['claimed_shifts_count'], 1)
+
+        signup.refresh_from_db()
+        self.assertIsNotNone(signup.user)
+        self.assertEqual(signup.user.username, 'max_mustermann')
+        self.assertIsNone(signup.guest_name)
+
+    def test_admin_approval_workflow(self):
+        # Enable admin approval requirement
+        setting = RegistrationRestrictionSetting.get_solo()
+        setting.require_admin_approval = True
+        setting.save()
+
+        # Register user
+        res_reg = self.client.post('/api/users/register/', {
+            'username': 'pending_user',
+            'email': 'pending@example.com',
+            'password': 'password123',
+            'display_name': 'Pending User'
+        })
+        self.assertEqual(res_reg.status_code, status.HTTP_201_CREATED)
+        self.assertTrue(res_reg.data.get('requires_approval'))
+        self.assertNotIn('token', res_reg.data)
+
+        # Attempt login before approval (should be blocked)
+        res_login_fail = self.client.post('/api/users/login/', {
+            'username': 'pending_user',
+            'password': 'password123'
+        })
+        self.assertEqual(res_login_fail.status_code, status.HTTP_403_FORBIDDEN)
+
+        # Admin approves user
+        admin = User.objects.create_superuser(username='admin', email='admin@test.com', password='adminpassword')
+        self.client.force_authenticate(user=admin)
+
+        pending_user = User.objects.get(username='pending_user')
+        res_approve = self.client.post(f'/api/users/{pending_user.id}/approve/')
+        self.assertEqual(res_approve.status_code, status.HTTP_200_OK)
+
+        # Attempt login after approval (should succeed)
+        self.client.logout()
+        res_login_ok = self.client.post('/api/users/login/', {
+            'username': 'pending_user',
+            'password': 'password123'
+        })
+        self.assertEqual(res_login_ok.status_code, status.HTTP_200_OK)
+        self.assertIn('token', res_login_ok.data)
+
+    def test_guest_claim_token_and_registration_link(self):
+        admin = User.objects.create_user(username="admin_gen", email="admin_gen@test.com", password="password123", is_admin_user=True)
+        event = Event.objects.create(title="Claim Event", start_date="2026-09-01", end_date="2026-09-02")
+        ta = TaskArea.objects.create(event=event, name="Kasse")
+        shift = Shift.objects.create(task_area=ta, title="Spätschicht", start_time="18:00", end_time="22:00")
+        signup = ShiftSignup.objects.create(shift=shift, guest_name="Erika Muster")
+
+        # Admin generates claim link
+        self.client.force_authenticate(user=admin)
+        res_token = self.client.post(f'/api/users/signups/{signup.id}/generate-claim-link/')
+        self.assertEqual(res_token.status_code, status.HTTP_200_OK)
+        claim_token = res_token.data['token']
+        self.assertEqual(res_token.data['guest_name'], 'Erika Muster')
+
+        # Recipient registers using claim_token
+        self.client.logout()
+        res_reg = self.client.post('/api/users/register/', {
+            'username': 'erika_muster',
+            'email': 'erika@muster.de',
+            'password': 'password123',
+            'display_name': 'Erika Muster',
+            'claim_token': claim_token
+        })
+        self.assertEqual(res_reg.status_code, status.HTTP_201_CREATED)
+
+        signup.refresh_from_db()
+        self.assertIsNotNone(signup.user)
+        self.assertEqual(signup.user.username, 'erika_muster')
+        self.assertIsNone(signup.guest_name)
@@ -0,0 +1,24 @@
+from django.urls import path, include
+from rest_framework.routers import DefaultRouter
+from .views import (
+    RegisterView, LoginView, MeView,
+    RegistrationDomainRuleViewSet, RegistrationRestrictionSettingView,
+    PendingUsersView, ApproveUserView, AdminUserViewSet,
+    GenerateClaimLinkView, ClaimInfoView
+)
+
+router = DefaultRouter()
+router.register('domain-rules', RegistrationDomainRuleViewSet, basename='domain-rule')
+router.register('manage-users', AdminUserViewSet, basename='admin-user')
+
+urlpatterns = [
+    path('register/', RegisterView.as_view(), name='register'),
+    path('login/', LoginView.as_view(), name='login'),
+    path('me/', MeView.as_view(), name='me'),
+    path('restriction-setting/', RegistrationRestrictionSettingView.as_view(), name='restriction-setting'),
+    path('pending/', PendingUsersView.as_view(), name='pending-users'),
+    path('<int:user_id>/approve/', ApproveUserView.as_view(), name='approve-user'),
+    path('signups/<int:signup_id>/generate-claim-link/', GenerateClaimLinkView.as_view(), name='generate-claim-link'),
+    path('claim-info/<uuid:token_uuid>/', ClaimInfoView.as_view(), name='claim-info'),
+    path('', include(router.urls)),
+]
@@ -0,0 +1,231 @@
+from rest_framework import views, viewsets, permissions, status
+from rest_framework.response import Response
+from rest_framework.authtoken.models import Token
+from django.contrib.auth import authenticate, get_user_model
+from django.shortcuts import get_object_or_404
+from .models import RegistrationDomainRule, RegistrationRestrictionSetting, GuestClaimToken
+from .serializers import (
+    UserSerializer, AdminUserSerializer, RegisterSerializer,
+    RegistrationDomainRuleSerializer, RegistrationRestrictionSettingSerializer
+)
+from apps.events.models import ShiftSignup
+
+User = get_user_model()
+
+class AdminUserViewSet(viewsets.ModelViewSet):
+    queryset = User.objects.all().order_by('-date_joined')
+    serializer_class = AdminUserSerializer
+    permission_classes = [permissions.IsAdminUser]
+
+class RegisterView(views.APIView):
+    permission_classes = [permissions.AllowAny]
+
+    def post(self, request):
+        serializer = RegisterSerializer(data=request.data)
+        if serializer.is_valid():
+            user = serializer.save()
+            setting = RegistrationRestrictionSetting.get_solo()
+
+            claim_token_str = request.data.get('claim_token')
+            claimed_target_name = None
+
+            if claim_token_str:
+                try:
+                    claim_obj = GuestClaimToken.objects.get(token=claim_token_str, is_claimed=False)
+                    claim_obj.is_claimed = True
+                    claim_obj.save()
+
+                    # Assign target signup
+                    target_signup = claim_obj.signup
+                    if target_signup and not target_signup.user:
+                        target_signup.user = user
+                        target_signup.guest_name = None
+                        target_signup.guest_session_key = None
+                        target_signup.save()
+
+                    claimed_target_name = claim_obj.guest_name
+                except Exception:
+                    pass
+
+            # Reassign any guest shift signups to this newly created user!
+            session_key = request.session.session_key
+            display_name = user.get_display_name()
+
+            guest_signups = ShiftSignup.objects.filter(user=None)
+            assigned_count = 0
+            for signup in guest_signups:
+                matches_session = session_key and signup.guest_session_key == session_key
+                matches_display = signup.guest_name and signup.guest_name.strip().lower() == display_name.strip().lower()
+                matches_claimed_name = claimed_target_name and signup.guest_name and signup.guest_name.strip().lower() == claimed_target_name.strip().lower()
+
+                if matches_session or matches_display or matches_claimed_name:
+                    signup.user = user
+                    signup.guest_name = None
+                    signup.guest_session_key = None
+                    signup.save()
+                    assigned_count += 1
+
+            if setting.require_admin_approval:
+                user.is_approved = False
+                user.is_active = False
+                user.save()
+                return Response({
+                    'requires_approval': True,
+                    'claimed_shifts_count': assigned_count,
+                    'message': 'Konto erfolgreich registriert! Ein Administrator muss dein Konto vor der ersten Anmeldung freischalten.'
+                }, status=status.HTTP_201_CREATED)
+
+            token, _ = Token.objects.get_or_create(user=user)
+            user_data = UserSerializer(user).data
+            return Response({
+                'token': token.key,
+                'user': user_data,
+                'claimed_shifts_count': assigned_count,
+                'message': f'Konto erfolgreich erstellt! {assigned_count} Gast-Schichten wurden deinem Konto zugewiesen.' if assigned_count > 0 else 'Konto erfolgreich erstellt!'
+            }, status=status.HTTP_201_CREATED)
+
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+class GenerateClaimLinkView(views.APIView):
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request, signup_id):
+        signup = get_object_or_404(ShiftSignup, pk=signup_id)
+        if signup.user:
+            return Response({'error': 'Diese Schicht ist bereits mit einem festen Benutzerkonto verknüpft.'}, status=status.HTTP_400_BAD_REQUEST)
+
+        guest_name = signup.guest_name or "Gast"
+
+        claim_obj, _ = GuestClaimToken.objects.get_or_create(
+            signup=signup,
+            created_by=request.user,
+            defaults={'guest_name': guest_name}
+        )
+
+        return Response({
+            'token': str(claim_obj.token),
+            'guest_name': guest_name,
+            'event_title': signup.shift.task_area.event.title,
+            'shift_title': signup.shift.title,
+            'created_by': request.user.get_display_name()
+        })
+
+class ClaimInfoView(views.APIView):
+    permission_classes = [permissions.AllowAny]
+
+    def get(self, request, token_uuid):
+        claim_obj = get_object_or_404(GuestClaimToken, token=token_uuid)
+        return Response({
+            'token': str(claim_obj.token),
+            'guest_name': claim_obj.guest_name,
+            'is_claimed': claim_obj.is_claimed,
+            'event_title': claim_obj.signup.shift.task_area.event.title if claim_obj.signup else 'Veranstaltung',
+            'shift_title': claim_obj.signup.shift.title if claim_obj.signup else 'Schicht',
+            'created_by': claim_obj.created_by.get_display_name()
+        })
+
+class LoginView(views.APIView):
+    permission_classes = [permissions.AllowAny]
+
+    def post(self, request):
+        username = request.data.get('username')
+        password = request.data.get('password')
+        if not username or not password:
+            return Response({'error': 'Benutzername und Passwort erforderlich.'}, status=status.HTTP_400_BAD_REQUEST)
+
+        user_obj = None
+        if '@' in username:
+            try:
+                user_obj = User.objects.get(email__iexact=username)
+                username = user_obj.username
+            except User.DoesNotExist:
+                pass
+        else:
+            try:
+                user_obj = User.objects.get(username__iexact=username)
+            except User.DoesNotExist:
+                pass
+
+        if user_obj:
+            if not user_obj.is_approved or not user_obj.is_active:
+                return Response({
+                    'error': 'Dein Konto wurde noch nicht von einem Administrator freigeschaltet. Bitte gedulde dich.'
+                }, status=status.HTTP_403_FORBIDDEN)
+
+        user = authenticate(username=username, password=password)
+        if not user:
+            return Response({'error': 'Ungültige Anmeldedaten.'}, status=status.HTTP_401_UNAUTHORIZED)
+
+        token, _ = Token.objects.get_or_create(user=user)
+        return Response({
+            'token': token.key,
+            'user': UserSerializer(user).data
+        })
+
+class MeView(views.APIView):
+    permission_classes = [permissions.IsAuthenticated]
+
+    def get(self, request):
+        return Response(UserSerializer(request.user).data)
+
+    def patch(self, request):
+        serializer = UserSerializer(request.user, data=request.data, partial=True)
+        if serializer.is_valid():
+            serializer.save()
+            return Response(serializer.data)
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+class RegistrationDomainRuleViewSet(viewsets.ModelViewSet):
+    queryset = RegistrationDomainRule.objects.all()
+    serializer_class = RegistrationDomainRuleSerializer
+    permission_classes = [permissions.IsAdminUser]
+
+class RegistrationRestrictionSettingView(views.APIView):
+    def get_permissions(self):
+        if self.request.method == 'GET':
+            return [permissions.AllowAny()]
+        return [permissions.IsAdminUser()]
+
+    def get(self, request):
+        setting = RegistrationRestrictionSetting.get_solo()
+        active_domains = list(RegistrationDomainRule.objects.filter(is_active=True).values_list('domain', flat=True))
+        return Response({
+            'is_restriction_enabled': setting.is_restriction_enabled,
+            'require_admin_approval': setting.require_admin_approval,
+            'active_domains': active_domains
+        })
+
+    def post(self, request):
+        setting = RegistrationRestrictionSetting.get_solo()
+        if 'is_restriction_enabled' in request.data:
+            setting.is_restriction_enabled = request.data['is_restriction_enabled']
+        if 'require_admin_approval' in request.data:
+            setting.require_admin_approval = request.data['require_admin_approval']
+        setting.save()
+        return Response({
+            'is_restriction_enabled': setting.is_restriction_enabled,
+            'require_admin_approval': setting.require_admin_approval
+        })
+
+class PendingUsersView(views.APIView):
+    permission_classes = [permissions.IsAdminUser]
+
+    def get(self, request):
+        pending_users = User.objects.filter(is_approved=False).order_by('-date_joined')
+        return Response(UserSerializer(pending_users, many=True).data)
+
+class ApproveUserView(views.APIView):
+    permission_classes = [permissions.IsAdminUser]
+
+    def post(self, request, user_id):
+        user = get_object_or_404(User, pk=user_id)
+        user.is_approved = True
+        user.is_active = True
+        user.save()
+        return Response({'message': f'Nutzer {user.get_display_name()} wurde erfolgreich freigeschaltet.'})
+
+    def delete(self, request, user_id):
+        user = get_object_or_404(User, pk=user_id)
+        name = user.get_display_name()
+        user.delete()
+        return Response({'message': f'Registrierung von {name} wurde abgelehnt und gelöscht.'})