fix: Register /api/altcha-challenge/ route and return real display_name for own guest session signups

backend/apps/events/serializers.py

@@ -13,23 +13,47 @@ class SkillSerializer(serializers.ModelSerializer):
 class ShiftSignupSerializer(serializers.ModelSerializer):
     display_name = serializers.SerializerMethodField()
     is_guest = serializers.SerializerMethodField()
+    is_self = serializers.SerializerMethodField()
 
     class Meta:
         model = ShiftSignup
-        fields = ['id', 'display_name', 'is_guest', 'created_at']
+        fields = ['id', 'display_name', 'is_guest', 'is_self', 'created_at']
 
     def get_is_guest(self, obj):
         return obj.user is None
 
+    def _is_own_signup(self, obj, request):
+        if not request:
+            return False
+        if request.user and request.user.is_authenticated:
+            return obj.user_id == request.user.id
+        
+        # Check session key for guest user
+        session_key = getattr(request.session, 'session_key', None)
+        if session_key and obj.guest_session_key and obj.guest_session_key == session_key:
+            return True
+            
+        return False
+
+    def get_is_self(self, obj):
+        request = self.context.get('request')
+        return self._is_own_signup(obj, request)
+
     def get_display_name(self, obj):
         request = self.context.get('request')
-        # PRIVACY RULE: Guests (unauthenticated users) MUST NOT see who signed up where
-        if request and not request.user.is_authenticated:
-            return "Belegt (Anonym)"
         
-        if obj.user:
-            return obj.user.get_display_name()
-        return obj.guest_name or "Gast"
+        # Authenticated users see real names of all participants
+        if request and request.user and request.user.is_authenticated:
+            if obj.user:
+                return obj.user.get_display_name()
+            return obj.guest_name or "Gast"
+
+        # Guest users see their own real name for their own signups
+        if request and self._is_own_signup(obj, request):
+            return obj.guest_name or "Gast"
+
+        # Other participants are anonymized for privacy
+        return "Belegt (Anonym)"
 
 class ShiftSerializer(serializers.ModelSerializer):
     required_skills = SkillSerializer(many=True, read_only=True)

backend/shiftplan_backend/urls.py

@@ -1,8 +1,11 @@
 from django.contrib import admin
 from django.urls import path, include
+from apps.events.views import AltchaChallengeView
 
 urlpatterns = [
     path('admin/', admin.site.urls),
+    path('api/altcha-challenge/', AltchaChallengeView.as_view(), name='altcha-challenge-top'),
+    path('api/events/altcha-challenge/', AltchaChallengeView.as_view(), name='altcha-challenge-alias'),
     path('api/users/', include('apps.users.urls')),
     path('api/', include('apps.events.urls')),
     path('api/branding/', include('apps.branding.urls')),