fix: Register /api/altcha-challenge/ route and return real display_name for own guest session signups

backend/apps/events/serializers.py

@@ -13,23 +13,47 @@ class SkillSerializer(serializers.ModelSerializer):
 class ShiftSignupSerializer(serializers.ModelSerializer):
     display_name = serializers.SerializerMethodField()
     is_guest = serializers.SerializerMethodField()
+    is_self = serializers.SerializerMethodField()
 
     class Meta:
         model = ShiftSignup
-        fields = ['id', 'display_name', 'is_guest', 'created_at']
+        fields = ['id', 'display_name', 'is_guest', 'is_self', 'created_at']
 
     def get_is_guest(self, obj):
         return obj.user is None
 
+    def _is_own_signup(self, obj, request):
+        if not request:
+            return False
+        if request.user and request.user.is_authenticated:
+            return obj.user_id == request.user.id
+        
+        # Check session key for guest user
+        session_key = getattr(request.session, 'session_key', None)
+        if session_key and obj.guest_session_key and obj.guest_session_key == session_key:
+            return True
+            
+        return False
+
+    def get_is_self(self, obj):
+        request = self.context.get('request')
+        return self._is_own_signup(obj, request)
+
     def get_display_name(self, obj):
         request = self.context.get('request')
-        # PRIVACY RULE: Guests (unauthenticated users) MUST NOT see who signed up where
-        if request and not request.user.is_authenticated:
-            return "Belegt (Anonym)"
         
-        if obj.user:
-            return obj.user.get_display_name()
-        return obj.guest_name or "Gast"
+        # Authenticated users see real names of all participants
+        if request and request.user and request.user.is_authenticated:
+            if obj.user:
+                return obj.user.get_display_name()
+            return obj.guest_name or "Gast"
+
+        # Guest users see their own real name for their own signups
+        if request and self._is_own_signup(obj, request):
+            return obj.guest_name or "Gast"
+
+        # Other participants are anonymized for privacy
+        return "Belegt (Anonym)"
 
 class ShiftSerializer(serializers.ModelSerializer):
     required_skills = SkillSerializer(many=True, read_only=True)