Merge pull request 'b999_chrome_file_upload' (#47) from b999_chrome_file_upload into development

Reviewed-on: #47

.dockerignore

@@ -0,0 +1,3 @@
+node_modules
+build
+config.json

.gitignore

@@ -1,5 +1,8 @@
 test-results
 node_modules
+config.json
+
+src/lib/data/tatort.db
 
 # Output
 .output
@@ -22,3 +25,6 @@ Thumbs.db
 # Vite
 vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
+
+# Jetbrains
+/.idea

Dockerfile.dev

@@ -0,0 +1,17 @@
+# --- Build stage ---
+FROM node:24-alpine AS build
+ENV NODE_ENV=development
+ENV ORIGIN=https://tatort-dev.innovation-hub-niedersachsen.de
+WORKDIR /app
+COPY package.json ./
+RUN npm i --unsafe-perm
+COPY . ./
+COPY config_dev.json ./config.json
+RUN npm run build
+
+# --- Production stage ---
+FROM node:24-alpine
+COPY --from=build /app .
+ENV HOST=0.0.0.0
+EXPOSE 3000
+CMD ["sh", "-c", "npm run init-db && ORIGIN=https://tatort-dev.innovation-hub-niedersachsen.de node build/index.js"]

Dockerfile.prod

@@ -1,17 +1,21 @@
 # --- Build stage ---
 FROM node:22 AS build
-ENV NODE_ENV=production
-ENV ORIGIN=https://tatort.innovation-hub-niedersachsen.de
 WORKDIR /app
 COPY package*.json ./
 RUN npm ci
 COPY . ./
+COPY config_prod.json ./config.json
 RUN npm run build
 
 # --- Production stage ---
 FROM node:22-alpine3.20
-COPY --from=build /app .
+WORKDIR /app
+ENV NODE_ENV=production
+ENV ORIGIN=https://tatort.innovation-hub-niedersachsen.de
+COPY --from=build /app/build ./build
+COPY --from=build /app/package*.json ./
+COPY --from=build /app/config.json ./config.json
+RUN npm ci --omit=dev
 ENV HOST=0.0.0.0
 EXPOSE 3000
-CMD ["sh", "-c", "ORIGIN=https://tatort.innovation-hub-niedersachsen.de node build/index.js"]
-
+CMD ["node", "build/index.js"]

Jenkinsfile

@@ -0,0 +1,143 @@
+/* groovylint-disable-next-line UnusedVariable */
+@Library('InnoHub-Library') _
+
+def didRun = false
+def versionTag = 'null'
+
+pipeline {
+    agent any
+
+    tools {
+        nodejs 'NodeJS-24.2.0'
+    }
+
+    environment {
+        REGISTRY = 'https://gitea.innovation-hub-niedersachsen.de/'
+        USER = 'jenkins'
+        TOKEN = credentials('JenkinsGitea')
+    }
+
+    parameters {
+        string(name: 'REPO_NAME', defaultValue: '', description: 'Repo Name')
+        string(name: 'GIT_REF', defaultValue: '', description: 'Git Ref')
+    }
+
+    options {
+        buildDiscarder(
+           BuildHistoryManager([
+               [ continueAfterMatch: false, matchAtMost: 5 ],
+               [ actions: [ DeleteBuild() ] ]
+           ])
+       )
+    }
+
+    stages {
+        stage('Set Version Tag') {
+            steps {
+                script {
+                    versionTag = generateVersionTag(params.GIT_REF)
+                    echo "[INFO] Using VERSION_TAG: ${versionTag}"
+                }
+            }
+        }        
+        stage('Validate Repository') {
+            steps {
+                script {
+                    checkRepoName(params.REPO_NAME, true)
+                }
+            }
+        }
+
+        stage('Install Dependencies') {
+            steps {
+                script {
+                    didRun = true
+                }
+                sh 'npm ci'
+            }
+        }
+
+        stage('Security Audit') {
+            steps {
+                script {
+                    didRun = true
+                }
+                echo 'Start checking security vulnerabilities in npm packages'
+                sh 'npm audit --audit-level=moderate'
+            }
+        }
+
+        stage('Run Tests') {
+            steps {
+                sh 'npm run test'
+            }
+        }
+
+        stage('SonarQube Analysis') {
+            steps {
+                withSonarQubeEnv('sonarqube') {
+                    sh 'sonar-scanner -Dsonar.projectKey=tatort -Dsonar.sources=src'
+                }
+            }
+        }
+
+        stage('Push image to gitea registry') {
+            when {
+                branch 'development'
+            }
+            steps {
+                script {
+                    def imageName = "gitea.innovation-hub-niedersachsen.de/innohub/tatort-dev"
+
+                    docker.withRegistry(REGISTRY, 'JenkinsGitea') {
+                        def img = docker.build("${imageName}:${versionTag}", '-f Dockerfile.dev .')
+                        img.push()
+                        img.push('latest')
+                    }
+
+                    didRun = true
+                }
+            }
+        }
+
+        stage('Update Helm Chart Repository') {
+            when {
+                branch 'development'
+            }
+            steps {
+                script {
+                    updateHelmChart([
+                        tag: versionTag,
+                        repoUrl: 'gitea.innovation-hub-niedersachsen.de/innohub/charts.git',
+                        chartPath: 'tatort-dev/tatort',
+                        chartName: 'tatort',
+                        imageRepo: 'gitea.innovation-hub-niedersachsen.de/innohub/tatort-dev',
+                        credentialsId: 'JenkinsGitea',
+                        branch: 'main'
+                    ])
+
+                    didRun = true
+                }
+            }
+        }
+    }
+
+    post {
+        success {
+            script {
+                if (didRun) {
+                    echo 'Pipeline erfolgreich!'
+                    discordSend description: "Running ${env.BUILD_ID} on ${env.JENKINS_URL}, ${params.GIT_REF}", footer: 'Pipeline succeeded', link: env.BUILD_URL, result: currentBuild.currentResult, title: env.JOB_NAME, webhookURL: 'https://discordapp.com/api/webhooks/1389470542691831819/NdMO17sLBG2dplp_-oh6Ff0cbPOoADl0QwXKM9UzduxU44av_ZQkQjKTmpdK7YuwcZDc'
+                }
+            }
+        }
+        failure {
+            script {
+                if (didRun) {
+                    echo 'Pipeline fehlgeschlagen!'
+                    discordSend description: "Running ${env.BUILD_ID} on ${env.JENKINS_URL}, ${params.GIT_REF}", footer: 'Pipeline failed', link: env.BUILD_URL, result: currentBuild.currentResult, title: env.JOB_NAME, webhookURL: 'https://discordapp.com/api/webhooks/1389470542691831819/NdMO17sLBG2dplp_-oh6Ff0cbPOoADl0QwXKM9UzduxU44av_ZQkQjKTmpdK7YuwcZDc'
+                }
+            }
+        }
+    }
+}

README.md

@@ -36,3 +36,24 @@ npm run build
 You can preview the production build with `npm run preview`.
 
 > To deploy your app, you may need to install an [adapter](https://svelte.dev/docs/kit/adapters) for your target environment.
+
+## Initializing the SQLite DB
+
+A database initialization script `init_db.ts` in included in the `src/init` folder. It will create a users database (if not existing) and populate it with a default admin user. Additionally, an empty cases table will be created.
+
+It can be run with `node init_db.ts`
+
+Database schema:
+
+Users
+
+- id
+- name
+- pw
+
+Cases
+
+- id
+- token
+- name
+- pin

config.json

@@ -3,8 +3,8 @@
 		"endPoint": "api-s3.innovation-hub-niedersachsen.de",
 		"port": 443,
 		"useSSL": true,
-		"accessKey": "GxKhfnfkNvlDU7qzsz0D",
-		"secretKey": "cqSM5rIRr4MPtqzu2sNKgmB9k2OghPbyxwAWogeM"
+		"accessKey": "AbCdEfGhIjKlMnOpQrSt",
+		"secretKey": "UvWxYz1234567890AbCdEfGhIjKlMnOpQrStUvWx"
 	},
 	"jwt": {
 		"secret": "@S2!q@@wXz$dCQ8JoVsHLpzaJ6JCfB",

config_dev.json

@@ -0,0 +1,17 @@
+{
+	"minio": {
+		"endPoint": "api-s3.innovation-hub-niedersachsen.de",
+		"port": 443,
+		"useSSL": true,
+		"accessKey": "AbCdEfGhIjKlMnOpQrSt",
+		"secretKey": "UvWxYz1234567890AbCdEfGhIjKlMnOpQrStUvWx"
+	},
+	"jwt": {
+		"secret": "@S2!q@@wXz$dCQ8JoVsHLpzaJ6JCfB",
+		"expiresIn": 3600
+	},
+	"auth": {
+		"admin": { "password": "A-InnoHUB_2025!", "admin": true },
+		"user": { "password": "U-InnoHUB_2025!", "admin": false }
+	}
+}

config_prod.json

@@ -0,0 +1,17 @@
+{
+	"minio": {
+		"endPoint": "api-s3.innovation-hub-niedersachsen.de",
+		"port": 443,
+		"useSSL": true,
+		"accessKey": "GxKhfnfkNvlDU7qzsz0D",
+		"secretKey": "cqSM5rIRr4MPtqzu2sNKgmB9k2OghPbyxwAWogeM"
+	},
+	"jwt": {
+		"secret": "@S2!q@@wXz$dCQ8JoVsHLpzaJ6JCfB",
+		"expiresIn": 3600
+	},
+	"auth": {
+		"admin": { "password": "A-InnoHUB_2025!", "admin": true },
+		"user": { "password": "U-InnoHUB_2025!", "admin": false }
+	}
+}

e2e/demo.test.ts

@@ -1,6 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-test('home page has expected h1', async ({ page }) => {
-	await page.goto('/');
-	await expect(page.locator('h1')).toBeVisible();
-});

eslint.config.js

@@ -20,7 +20,21 @@ export default ts.config(
 		languageOptions: {
 			globals: { ...globals.browser, ...globals.node }
 		},
-		rules: { 'no-undef': 'off' }
+		rules: {
+			'no-undef': 'off',
+			'@typescript-eslint/no-unused-vars': [
+				'error',
+				{
+					args: 'all',
+					argsIgnorePattern: '^_',
+					caughtErrors: 'all',
+					caughtErrorsIgnorePattern: '^_',
+					destructuredArrayIgnorePattern: '^_',
+					varsIgnorePattern: '^_',
+					ignoreRestSiblings: true
+				}
+			]
+		}
 	},
 	{
 		files: ['**/*.svelte', '**/*.svelte.ts', '**/*.svelte.js'],

package.json

@@ -13,41 +13,47 @@
 		"format": "prettier --write .",
 		"lint": "prettier --check . && eslint .",
 		"test:unit": "vitest",
-		"test": "npm run test:unit -- --run && npm run test:e2e",
-		"test:e2e": "playwright test"
+		"test": "npm run test:unit -- --run",
+		"init-db": "tsx ./src/init/init_db.ts"
 	},
 	"devDependencies": {
-		"@eslint/compat": "^1.2.5",
+		"@eslint/compat": "^1.2.9",
 		"@eslint/js": "^9.18.0",
-		"@playwright/test": "^1.49.1",
 		"@sveltejs/adapter-auto": "^4.0.0",
-		"@sveltejs/kit": "^2.16.0",
-		"@sveltejs/vite-plugin-svelte": "^5.0.0",
-		"@testing-library/jest-dom": "^6.6.3",
-		"@testing-library/svelte": "^5.2.4",
-		"eslint": "^9.18.0",
-		"eslint-config-prettier": "^10.0.1",
-		"eslint-plugin-svelte": "^3.0.0",
-		"globals": "^16.0.0",
-		"jsdom": "^26.0.0",
-		"prettier": "^3.4.2",
-		"prettier-plugin-svelte": "^3.3.3",
-		"svelte": "^5.0.0",
-		"svelte-check": "^4.0.0",
-		"typescript": "^5.0.0",
-		"typescript-eslint": "^8.20.0",
-		"vite": "^6.2.5",
-		"vitest": "^3.0.0"
+		"@sveltejs/kit": "^2.21.3",
+		"@sveltejs/vite-plugin-svelte": "^5.1.0",
+		"@testing-library/jest-dom": "^6.8.0",
+		"@testing-library/svelte": "^5.2.8",
+		"@tsconfig/svelte": "^5.0.4",
+		"@types/better-sqlite3": "^7.6.13",
+		"@types/jsonwebtoken": "^9.0.9",
+		"eslint": "^9.28.0",
+		"eslint-config-prettier": "^10.1.5",
+		"eslint-plugin-svelte": "^3.9.2",
+		"globals": "^16.2.0",
+		"jsdom": "^26.1.0",
+		"prettier": "^3.5.3",
+		"prettier-plugin-svelte": "^3.4.0",
+		"svelte": "^5.33.18",
+		"svelte-check": "^4.2.1",
+		"tsx": "^4.20.3",
+		"typescript": "^5.8.3",
+		"typescript-eslint": "^8.34.0",
+		"vite": "^6.3.5",
+		"vitest": "^3.2.4"
 	},
 	"dependencies": {
 		"@google/model-viewer": "^4.1.0",
 		"@sveltejs/adapter-node": "^5.2.12",
 		"@tailwindcss/forms": "^0.5.10",
 		"autoprefixer": "^10.4.21",
+		"bcrypt": "^6.0.0",
+		"better-sqlite3": "^12.2.0",
 		"jsonwebtoken": "^9.0.2",
 		"minio": "^8.0.5",
-		"postcss": "^8.5.3",
-		"svelte-cubed": "^0.2.1",
-		"tailwindcss": "^3.4.17"
+		"postcss": "^8.5.4",
+		"sqlite3": "^5.1.7",
+		"tailwindcss": "^3.4.17",
+		"uuid": "^11.1.0"
 	}
 }

playwright.config.js

@@ -1,11 +0,0 @@
-/** @type {import('@playwright/test').PlaywrightTestConfig} */
-const config = {
-	webServer: {
-		command: 'npm run build && npm run preview',
-		port: 4173
-	},
-	testDir: 'tests',
-	testMatch: /(.+\.)?(test|spec)\.[jt]s/
-};
-
-export default config;

playwright.config.ts

@@ -1,9 +0,0 @@
-import { defineConfig } from '@playwright/test';
-
-export default defineConfig({
-	webServer: {
-		command: 'npm run build && npm run preview',
-		port: 4173
-	},
-	testDir: 'e2e'
-});

src/error.html

@@ -0,0 +1,4 @@
+<h1>Du wurdest automatisch ausgeloggt</h1>
+<p>Lösche deine Cookies aus dem Browser und logge dich neu ein</p>
+<p>Code %sveltekit.status%</p>
+<p>%sveltekit.error.message%</p>

src/hooks.server.js

@@ -1,16 +0,0 @@
-import { decryptToken } from '$lib/auth';
-
-/** @type {import('@sveltejs/kit').Handle} */
-export async function handle({ event, resolve }) {
-	const jwt = event.cookies.get('session');
-	try {
-		if (jwt) {
-			event.locals.user = decryptToken(jwt);
-			return resolve(event);
-		}
-	} catch (err) {
-		await event.cookies.delete('session');
-		event.locals.user = null;
-	}
-	return resolve(event);
-}

src/hooks.server.ts

@@ -0,0 +1,28 @@
+import { decryptToken } from '$lib/auth';
+import type { Handle } from '@sveltejs/kit';
+import { ROUTE_NAMES } from './routes';
+
+
+export const handle: Handle = async ({ event, resolve }) => {
+	const jwt = event.cookies.get('session');
+	try {
+		if (jwt) {
+			event.locals.user = decryptToken(jwt);
+			return resolve(event);
+		}
+	} catch (_) {
+		event.cookies.delete('session', {path: ROUTE_NAMES.ROOT});
+		event.locals.user = null;
+	}
+
+	if (event.url.pathname.startsWith('/api')) {
+		if (!event.locals.user) {
+			return new Response(JSON.stringify({ error: 'Unauthorized' }), {
+				status: 401,
+				headers: { 'Content-Type': 'application/json' }
+			});
+		}
+	}
+
+	return await resolve(event);
+}

src/init/init_db.ts

@@ -0,0 +1,46 @@
+import Database from 'better-sqlite3';
+import fs from 'fs';
+import path from 'path';
+import { DB_FULLPATH } from '../routes';
+
+const fullPath = DB_FULLPATH;
+const dir = path.dirname(fullPath);
+
+if (!fs.existsSync(dir)) {
+	fs.mkdirSync(dir);
+}
+
+const db = new Database(fullPath);
+
+let createSQLStmt = `CREATE TABLE IF NOT EXISTS users
+        (id INTEGER PRIMARY KEY AUTOINCREMENT,
+            name TEXT NOT NULL UNIQUE,
+            pw TEXT NOT NULL)`;
+db.exec(createSQLStmt);
+
+// check if there are any users; if not add one default admin one
+// const saltRounds = 12;
+// const hashedUserPassword = bcrypt.hashSync(userPasswordHashed, saltRounds);
+const hashedUserPassword = '$2b$12$d6bDzoDluXeCTuoxmWSVtOp5Cpian3mZm8qxzox6B37BIf6qtOnnG';
+const checkInsertSQLStmt = `INSERT INTO users (name, pw) SELECT 'admin', '${hashedUserPassword}'
+                    WHERE NOT EXISTS (SELECT * FROM users);`;
+
+db.exec(checkInsertSQLStmt);
+
+const usersSQLStmt = `SELECT * FROM USERS`;
+let SQLStatement = db.prepare(usersSQLStmt);
+
+// cases table
+
+createSQLStmt = `CREATE TABLE IF NOT EXISTS cases
+        (id INTEGER PRIMARY KEY AUTOINCREMENT,
+        token TEXT NOT NULL UNIQUE,
+        name TEXT NOT NULL UNIQUE,
+        pin TEXT NOT NULL)`;
+
+db.exec(createSQLStmt);
+
+const vorgangSQLStmt = `SELECT * FROM cases`;
+SQLStatement = db.prepare(vorgangSQLStmt);
+
+db.close();

src/lib/auth.js

@@ -1,29 +0,0 @@
-import jwt from 'jsonwebtoken';
-
-import config from '$lib/config';
-
-const SECRET = config.jwt.secret;
-const EXPIRES_IN = config.jwt.expiresIn;
-
-const AUTH = config.auth;
-
-export function createToken(userData) {
-	return jwt.sign(userData, SECRET, { expiresIn: EXPIRES_IN });
-}
-
-export function decryptToken(token) {
-	return jwt.verify(token, SECRET);
-}
-
-export function authenticate(user, pass) {
-	let userData = null;
-
-	if (AUTH[user]) {
-		const { password, ...data } = AUTH[user];
-		if (password && password === pass) userData = data;
-	}
-
-	if (userData == null) return null;
-
-	return createToken({ id: user, ...userData });
-}

src/lib/auth.ts

@@ -0,0 +1,35 @@
+import jwt from 'jsonwebtoken';
+import bcrypt from 'bcrypt';
+import { db } from '$lib/server/dbService';
+
+import config from '$lib/config';
+
+const SECRET = config.jwt.secret;
+const EXPIRES_IN = config.jwt.expiresIn;
+
+export function createToken(userData) {
+	return jwt.sign(userData, SECRET, { expiresIn: EXPIRES_IN });
+}
+
+export function decryptToken(token: string) {
+	return jwt.verify(token, SECRET);
+}
+
+export function authenticate(user, password) {
+	let JWTToken;
+
+	const getUserSQLStmt = 'SELECT name, pw FROM users WHERE name = ?';
+	const row = db.prepare(getUserSQLStmt).get(user);
+
+	if (!row) {
+		return null;
+	}
+	const storedPW = row.pw;
+
+	const isValid = bcrypt.compareSync(password, storedPW)
+	if (isValid) {
+		JWTToken = createToken({ id: user, admin: true });
+	}
+
+	return JWTToken;
+}

src/lib/components/Alert.svelte

@@ -46,7 +46,7 @@
 	}
 </style>
 
-<script>
+<script lang="ts">
 	export let type = 'info';
 	let classNames = '';
 	export { classNames as class };

src/lib/components/BaseInputField.svelte

@@ -0,0 +1,32 @@
+<script lang="ts">
+	import Exclamation from '$lib/icons/Exclamation.svelte';
+
+	let { label = '', error = null, value, name, id, type = 'text'} = $props();
+</script>
+
+<div>
+	<label for={name} class="block text-sm font-medium leading-6 text-gray-900"
+		><span class="flex"
+			>{#if error}
+				<span class="inline-block mr-1"><Exclamation /></span>
+			{/if}
+			{label}</span
+		></label
+	>
+	<div class="mt-2">
+		<div
+			class="flex rounded-md shadow-sm ring-1 ring-inset ring-gray-300 focus-within:ring-2 focus-within:ring-inset focus-within:ring-indigo-600"
+		>
+			<input
+				class="block flex-1 border-0 bg-transparent py-1.5 pl-1 text-gray-900 placeholder:text-gray-400 focus:ring-0 text-sm leading-6"
+				bind:value
+				{type}
+				{name}
+				{id}
+			/>
+		</div>
+	</div>
+	{#if error}
+		<p class="block text-sm leading-6 text-red-900 mt-2">{error}</p>
+	{/if}
+</div>

src/lib/components/Button.svelte

@@ -1,3 +1,31 @@
+<script lang="ts">
+	export let href = null;
+	export let type: 'button' | 'submit' | 'reset' = 'button';
+	export let size = 'md';
+	export let variant = 'primary';
+	export let fullWidth = false;
+	export let align = 'center';
+	export let disabled = false;
+	let classNames = '';
+	export { classNames as class };
+</script>
+
+{#if href}
+	<a on:click {href} class:w-full={fullWidth} class="button {variant} {size} {classNames} {align}"
+		><slot />
+	</a>
+{:else}
+	<button
+		on:click
+		{type}
+		{disabled}
+		class:w-full={fullWidth}
+		class="button {variant} {size} {classNames} {align}"
+	>
+		<slot />
+	</button>
+{/if}
+
 <style>
 	.button {
 		@apply inline-flex;
@@ -172,31 +200,3 @@
 		@apply justify-end;
 	}
 </style>
-
-<script>
-	export let href = null;
-	export let type = 'button';
-	export let size = 'md';
-	export let variant = 'primary';
-	export let fullWidth = false;
-	export let align = 'center';
-	export let disabled = false;
-	let classNames = '';
-	export { classNames as class };
-</script>
-
-{#if href}
-	<a on:click {href} class:w-full={fullWidth} class="button {variant} {size} {classNames} {align}"
-		><slot />
-	</a>
-{:else}
-	<button
-		on:click
-		{type}
-		{disabled}
-		class:w-full={fullWidth}
-		class="button {variant} {size} {classNames} {align}"
-	>
-		<slot />
-	</button>
-{/if}

src/lib/components/DeleteIconButton.svelte

@@ -11,11 +11,11 @@
 	}
 </style>
 
-<script>
+<script lang="ts">
 	import { page } from '$app/stores';
 	import Trash from '$lib/icons/Trash.svelte';
-	import Panel from '$lib/components/ui/Panel.svelte';
-	import Button from '$lib/components/ui/Button.svelte';
+	import Panel from '$lib/components/Panel.svelte';
+	import Button from '$lib/components/Button.svelte';
 	import { clickOutside } from '$lib/helpers/clickOutside.js';
 	const { adminMode, prediction, predictionRemove } = $page.data;
 

src/lib/components/EmptyList.svelte

@@ -0,0 +1,3 @@
+<p data-testid="empty-list" class="flex justify-center m-4">
+	In dieser Liste sind keine Einträge vorhanden
+</p>

src/lib/components/ExpandableForm.svelte

@@ -0,0 +1,54 @@
+<script lang="ts">
+  import { fly, scale, fade } from 'svelte/transition';
+  import { cubicOut } from 'svelte/easing';
+  import { tick } from 'svelte';
+
+  let expanded = false;
+  let formContainer: HTMLDivElement;
+
+  async function toggle() {
+    expanded = !expanded;
+
+    if (expanded) {
+      // Wait for DOM to update
+      await tick();
+
+      // Scroll smoothly into view
+      formContainer?.scrollIntoView({ behavior: 'smooth', block: 'start' });
+    }
+  }
+</script>
+
+<div data-testid="expand-container" class="flex flex-col items-center">
+  <!-- + / × button -->
+  <button
+    data-testid="expand-button"
+    class="flex items-center justify-center w-12 h-12 rounded-full bg-blue-600 text-white text-2xl font-bold hover:bg-blue-700 transition"
+    on:click={toggle}
+    aria-expanded={expanded}
+    aria-label="Add item"
+  >
+    {#if expanded}
+      ✕
+    {:else}
+      +
+    {/if}
+  </button>
+
+  <!-- Expandable content below button -->
+  {#if expanded}
+    <div
+      bind:this={formContainer}
+      class="w-full mt-4 flex justify-center"
+      transition:fade
+    >
+      <div
+        in:fly={{ y: 10, duration: 200, easing: cubicOut }}
+        out:scale={{ duration: 150 }}
+        class="w-full max-w-2xl"
+      >
+        <slot />
+      </div>
+    </div>
+  {/if}
+</div>

src/lib/components/Footer.svelte

@@ -0,0 +1,39 @@
+<script>
+	import Profile from "$lib/icons/Profile.svelte";
+
+	import { ROUTE_NAMES } from "../../routes";
+
+    export let data;
+</script>
+
+	<div class="flex-none">
+			<footer class="justify-end">
+				<div class="bg-gray-100">
+					<div class="mx-auto max-w-7xl px-6 lg:px-8">
+						<div class="flex justify-between divide-x divide-gray-900/5 border-x border-gray-900/5">
+							<a
+								href="{ROUTE_NAMES.LIST}"
+								class="px-4 py-1 -ml-4 flex items-center justify-center gap-x-2.5 text-sm font-semibold leading-6 text-gray-500 hover:bg-gray-200 hover:text-gray-700"
+							>
+								&copy; 2023 Innovation Hub Niedersachen
+							</a>
+							<a
+								href="{ROUTE_NAMES.ROOT}"
+								class="px-4 py-1 flex items-center justify-center gap-x-2.5 text-sm font-semibold leading-6 text-gray-500 hover:bg-gray-200 hover:text-gray-700"
+							>
+								back
+							</a>
+							<a
+								href="{ROUTE_NAMES.ROOT}"
+								class="px-4 py-1 -mr-4 flex items-center justify-center gap-x-2.5 text-sm font-semibold leading-6 text-gray-500 hover:bg-gray-200 hover:text-gray-700"
+							>
+								<!--icon-->
+								<Profile />
+
+								{data?.user?.id}
+							</a>
+						</div>
+					</div>
+				</div>
+			</footer>
+		</div>

src/lib/components/Header.svelte

@@ -0,0 +1,38 @@
+<script lang="ts">
+	import Chevron from '$lib/icons/Chevron-right.svelte';
+
+	import { ROUTE_NAMES } from '../../routes';
+
+	export let data;
+</script>
+
+<div class="flex flex-col">
+	<header class="flex-none relative isolate z-10 bg-white px-8">
+		<nav
+			class="mx-auto flex max-w-7xl items-center justify-between p-6 lg:px-8"
+			aria-label="Global"
+		>
+			<div class="flex w-48">
+				<a href="{ROUTE_NAMES.ROOT}" class="-m-1.5 p-1.5 w-10">
+					<span class="sr-only">Tatort Niedersachen</span>
+					<img class="h-8 w-auto" src="/Landeswappen_NI.svg" alt="Landeswappen Niedersachsen" />
+				</a>
+			</div>
+			<h1 class="text-3xl text-slate-400 font-bold">Tatort</h1>
+			<div class="lg:flex lg:justify-end w-48">
+				{#if data.user}
+					<form method="POST" action="{ROUTE_NAMES.LOGOUT}">
+						<input type="hidden" />
+						<button type="submit" class="text-sm font-semibold leading-6 text-gray-900"
+							><span
+								><span class="align-middle inline-block">Abmelden</span><span
+									class="align-middle inline-block"><Chevron /></span
+								></span
+							></button
+						>
+					</form>
+				{/if}
+			</div>
+		</nav>
+	</header>
+</div>

src/lib/components/Modal/Modal.svelte

@@ -41,7 +41,7 @@
 	}
 </style>
 
-<script>
+<script lang="ts">
 	import { fade } from 'svelte/transition';
 	export let size = 'xl'; // https://tailwindcss.com/docs/max-width#class-reference
 	export let open = false;

src/lib/components/Modal/ModalContent.svelte

@@ -15,7 +15,7 @@
 	}
 </style>
 
-<script>
+<script lang="ts">
 	export let scroll = true;
 	export let padding = true;
 

src/lib/components/NameItemEditor.svelte

@@ -0,0 +1,116 @@
+<script lang="ts">
+	import Check from '$lib/icons/Check.svelte';
+	import Edit from '$lib/icons/Edit.svelte';
+	import Trash from '$lib/icons/Trash.svelte';
+	import X from '$lib/icons/X.svelte';
+	import { tick } from 'svelte';
+
+	interface ListItem {
+		name: string;
+		token?: string;
+	}
+
+	// props, old syntax
+	export let list: ListItem[] = [];
+	export let currentName: string;
+	export let vorgangToken: string | null;
+	export let onSave: (n: string, o: string, t?: string) => unknown = () => {};
+	export let onDelete: ((n: string) => unknown) | null = () => {};
+
+	let localName = currentName;
+	let isEditing = false;
+	let inputRef: HTMLInputElement | null = null;
+
+	$: error = validateName(localName);
+
+	function validateName(name: string): string {
+		const trimmed = name?.trim() ?? '';
+		if (!trimmed) return 'Name darf nicht leer sein.';
+		if (list.some((item) => item.name === trimmed && item.name !== currentName)) {
+			return 'Name existiert bereits.';
+		}
+		return '';
+	}
+
+	async function startEdit() {
+		isEditing = true;
+		await tick();
+		inputRef?.focus();
+	}
+
+	function cancelEdit() {
+		localName = currentName;
+		isEditing = false;
+	}
+
+	function commitEdit() {
+		if (!error && localName != currentName) onSave(localName, currentName, vorgangToken);
+		// restore original value
+		if (error) { localName = currentName }
+		
+		isEditing = false;
+	}
+
+	function handleKeydown(event: KeyboardEvent) {
+		if (event.key === 'Enter') commitEdit();
+		if (event.key === 'Escape') cancelEdit();
+	}
+
+	function handleDeleteClick() {
+		// vorgangToken defined when deleting Vorgang, otherwise Crime
+		onDelete(vorgangToken || currentName);
+	}
+</script>
+
+<div data-testid="test-nameItemEditor" class="flex flex-col gap-1">
+  {#if isEditing}
+    <div class="flex items-center gap-1">
+      <input
+        data-testid="test-input"
+        bind:this={inputRef}
+        bind:value={localName}
+        onkeydown={handleKeydown}
+        class="flex-1 border border-gray-300 rounded px-1.5 py-0.5 text-sm focus:outline-none focus:ring-1 focus:ring-blue-500"
+      />
+      <button
+        data-testid="commit-button"
+        disabled={!!error || localName === currentName}
+        onclick={commitEdit}
+        class="text-gray-500 hover:text-green-600 transition disabled:opacity-40"
+      >
+        <Check class="w-4 h-4" />
+      </button>
+      <button
+        data-testid="cancel-button"
+        onclick={cancelEdit}
+        class="text-gray-500 hover:text-red-600 transition"
+      >
+        <X class="w-4 h-4" />
+      </button>
+    </div>
+  {:else}
+    <div class="flex items-center gap-1">
+      <span class="text-sm font-medium text-gray-900 truncate">{localName}</span>
+      <button
+        data-testid="edit-button"
+        onclick={startEdit}
+        class="text-gray-500 hover:text-blue-600 transition"
+      >
+        <Edit class="w-4 h-4" />
+      </button>
+      {#if onDelete}
+		<button
+			data-testid="delete-button"
+			onclick={handleDeleteClick}
+			class="text-gray-500 hover:text-red-600 transition"
+		>
+			<Trash class="w-4 h-4" />
+		</button>
+      {/if}
+    </div>
+  {/if}
+
+  {#if error}
+    <p class="text-xs text-red-500 mt-1">{error}</p>
+  {/if}
+</div>

src/lib/components/Notification.svelte

@@ -1,4 +1,4 @@
-<script>
+<script lang="ts">
 	export let title = 'Erfolgreich';
 	export let show = false;
 

src/lib/components/Panel.svelte

@@ -5,7 +5,7 @@
 	}
 </style>
 
-<script>
+<script lang="ts">
 	export let padding = 'p-6';
 	export let shadow = true;
 	let classNames = '';

src/lib/components/Select.svelte

@@ -6,7 +6,7 @@
 	}
 </style>
 
-<script>
+<script lang="ts">
 	import { clickOutside } from '$lib/helpers/clickOutside.js';
 	import Check from '$lib/icons/Check.svelte';
 	import Selector from '$lib/icons/Selector.svelte';

src/lib/config.js

@@ -1,3 +0,0 @@
-import { readFileSync } from 'fs';
-
-export default JSON.parse(readFileSync('./config.json'));

src/lib/config.ts

@@ -0,0 +1,3 @@
+import { readFileSync } from 'fs';
+
+export default JSON.parse(readFileSync('./config.json').toString());

src/lib/helper/caseNumberOccupied.js

@@ -1,22 +0,0 @@
-import { client } from '$lib/minio';
-
-/**
- * Check if caseNumber is used
- * @param {string} caseNumber
- * @returns {Promise<boolean}
- */
-export default async function caseNumberOccupied(caseNumber) {
-	const prefix = `${caseNumber}/config.json`;
-	const promise = new Promise((resolve) => {
-		let stream = client.listObjectsV2('tatort', prefix, false, '');
-		stream.on('data', () => {
-			stream.destroy();
-			resolve(true);
-		});
-		stream.on('end', () => {
-			resolve(false);
-		});
-	});
-
-	return promise;
-}

src/lib/helper/shortenFileSize.ts

@@ -2,12 +2,7 @@ const KILO = 1024;
 const MEGA = KILO * KILO;
 const GIGA = MEGA * KILO;
 
-/**
- * Shortens the size in bytes
- * @param {number} size
- * @returns{string}
- */
-export default function shortenFileSize(size) {
+export default function shortenFileSize(size: number): string {
 	const giga = Math.floor(size / GIGA);
 	let remainder = size % GIGA;
 	const mega = Math.floor(remainder / MEGA);

src/lib/helper/timeElapsed.ts

@@ -4,12 +4,7 @@ const DAY = 24 * HOUR;
 const YEAR = 365 * DAY;
 const MONTH = YEAR / 12;
 
-/**
- * get readable string of time elapsed since date
- * @param {Date} date
- * @returns string
- */
-export default function timeElapsed(date) {
+export default function timeElapsed(date: Date): string {
 	const now = new Date();
 	const age = Math.floor((now.getTime() - date.getTime()) / 1000);
 

src/lib/helper/vorgangNumberOccupied.ts

@@ -0,0 +1,17 @@
+import { client, BUCKET } from '$lib/minio';
+
+export default async function vorgangNumberOccupied(vorgangNumber: string): Promise<boolean> {
+	const prefix = `${vorgangNumber}`;
+	const promise: Promise<boolean> = new Promise((resolve) => {
+		const stream = client.listObjectsV2(BUCKET, prefix, false, '');
+		stream.on('data', () => {
+			stream.destroy();
+			resolve(true);
+		});
+		stream.on('end', () => {
+			resolve(false);
+		});
+	});
+
+	return promise;
+}

src/lib/icons/Add-Process.svelte

@@ -0,0 +1,19 @@
+<script>
+	let classNames = '';
+	export { classNames as class };
+</script>
+
+<svg
+	class="h-6 w-6 text-gray-600 {classNames}"
+	fill="none"
+	viewBox="0 0 24 24"
+	stroke-width="1.5"
+	stroke="currentColor"
+	aria-hidden="true"
+>
+	<path
+		stroke-linecap="round"
+		stroke-linejoin="round"
+		d="M13.5 16.875h3.375m0 0h3.375m-3.375 0V13.5m0 3.375v3.375M6 10.5h2.25a2.25 2.25 0 002.25-2.25V6a2.25 2.25 0 00-2.25-2.25H6A2.25 2.25 0 003.75 6v2.25A2.25 2.25 0 006 10.5zm0 9.75h2.25A2.25 2.25 0 0010.5 18v-2.25a2.25 2.25 0 00-2.25-2.25H6a2.25 2.25 0 00-2.25 2.25V18A2.25 2.25 0 006 20.25zm9.75-9.75H18a2.25 2.25 0 002.25-2.25V6A2.25 2.25 0 0018 3.75h-2.25A2.25 2.25 0 0013.5 6v2.25a2.25 2.25 0 002.25 2.25z"
+	/>
+</svg>

src/lib/icons/Cube.svelte

@@ -0,0 +1,14 @@
+<svg
+	xmlns="http://www.w3.org/2000/svg"
+	fill="none"
+	viewBox="0 0 24 24"
+	stroke-width="1.5"
+	stroke="currentColor"
+	class=" w-6 h-6"
+>
+	<path
+		stroke-linecap="round"
+		stroke-linejoin="round"
+		d="M21 7.5l-2.25-1.313M21 7.5v2.25m0-2.25l-2.25 1.313M3 7.5l2.25-1.313M3 7.5l2.25 1.313M3 7.5v2.25m9 3l2.25-1.313M12 12.75l-2.25-1.313M12 12.75V15m0 6.75l2.25-1.313M12 21.75V19.5m0 2.25l-2.25-1.313m0-16.875L12 2.25l2.25 1.313M21 14.25v2.25l-2.25 1.313m-13.5 0L3 16.5v-2.25"
+	/>
+</svg>

src/lib/icons/Edit.svelte

@@ -0,0 +1,7 @@
+<svg height="20" width="20" xmlns="http://www.w3.org/2000/svg"
+	><path
+		d="m14.996094 3-11.9921878 11.992188h-.0039062v4.007812h1 2 1.0078125v-.0039l11.9921875-11.9921938-.001953-.0019531.001953-.0019531-4-4-.002.00195zm-1.998047 3.4121094 2.589844 2.5898437-7.587891 7.5878909v-1.589844h-1-1v-1-.589844zm-7.998047 7.9980466v1.589844h1 1v1 .589844l-.4101562.410156h-1.5898438l-1-1v-1.589844z"
+		fill="#373737"
+		transform="translate(1 1)"
+	/></svg
+>

src/lib/icons/File-rect.svelte

@@ -0,0 +1,35 @@
+<script>
+	export let outline = false;
+	let classNames = '';
+	export { classNames as class };
+</script>
+
+{#if outline}
+	<svg
+		xmlns="http://www.w3.org/2000/svg"
+		fill="none"
+		viewBox="0 0 24 24"
+		stroke-width="1.5"
+		stroke="currentColor"
+		class="w-6 h-6 {classNames}"
+	>
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M2.25 15.75l5.159-5.159a2.25 2.25 0 013.182 0l5.159 5.159m-1.5-1.5l1.409-1.409a2.25 2.25 0 013.182 0l2.909 2.909m-18 3.75h16.5a1.5 1.5 0 001.5-1.5V6a1.5 1.5 0 00-1.5-1.5H3.75A1.5 1.5 0 002.25 6v12a1.5 1.5 0 001.5 1.5zm10.5-11.25h.008v.008h-.008V8.25zm.375 0a.375.375 0 11-.75 0 .375.375 0 01.75 0z"
+		/>
+	</svg>
+{:else}
+	<svg
+		class="mx-auto h-12 w-12 text-gray-300 {classNames}"
+		viewBox="0 0 24 24"
+		fill="currentColor"
+		aria-hidden="true"
+	>
+		<path
+			fill-rule="evenodd"
+			d="M1.5 6a2.25 2.25 0 012.25-2.25h16.5A2.25 2.25 0 0122.5 6v12a2.25 2.25 0 01-2.25 2.25H3.75A2.25 2.25 0 011.5 18V6zM3 16.06V18c0 .414.336.75.75.75h16.5A.75.75 0 0021 18v-1.94l-2.69-2.689a1.5 1.5 0 00-2.12 0l-.88.879.97.97a.75.75 0 11-1.06 1.06l-5.16-5.159a1.5 1.5 0 00-2.12 0L3 16.061zm10.125-7.81a1.125 1.125 0 112.25 0 1.125 1.125 0 01-2.25 0z"
+			clip-rule="evenodd"
+		/>
+	</svg>
+{/if}

src/lib/icons/Folder.svelte

@@ -0,0 +1,14 @@
+<svg
+	xmlns="http://www.w3.org/2000/svg"
+	fill="none"
+	viewBox="0 0 24 24"
+	stroke-width="1.5"
+	stroke="currentColor"
+	class="w-6 h-6"
+>
+	<path
+		stroke-linecap="round"
+		stroke-linejoin="round"
+		d="M2.25 12.75V12A2.25 2.25 0 014.5 9.75h15A2.25 2.25 0 0121.75 12v.75m-8.69-6.44l-2.12-2.12a1.5 1.5 0 00-1.061-.44H4.5A2.25 2.25 0 002.25 6v12a2.25 2.25 0 002.25 2.25h15A2.25 2.25 0 0021.75 18V9a2.25 2.25 0 00-2.25-2.25h-5.379a1.5 1.5 0 01-1.06-.44z"
+	/>
+</svg>

src/lib/icons/List-icon.svelte

@@ -0,0 +1,19 @@
+<script>
+	let classNames = '';
+	export { classNames as class };
+</script>
+
+<svg
+	xmlns="http://www.w3.org/2000/svg"
+	fill="none"
+	viewBox="0 0 24 24"
+	stroke-width="1.5"
+	stroke="currentColor"
+	class="w-6 h-6 {classNames}"
+>
+	<path
+		stroke-linecap="round"
+		stroke-linejoin="round"
+		d="M8.25 6.75h12M8.25 12h12m-12 5.25h12M3.75 6.75h.007v.008H3.75V6.75zm.375 0a.375.375 0 11-.75 0 .375.375 0 01.75 0zM3.75 12h.007v.008H3.75V12zm.375 0a.375.375 0 11-.75 0 .375.375 0 01.75 0zm-.375 5.25h.007v.008H3.75v-.008zm.375 0a.375.375 0 11-.75 0 .375.375 0 01.75 0z"
+	/>
+</svg>

src/lib/icons/Profile.svelte

@@ -0,0 +1,15 @@
+<svg
+	data-testid="profile-component"
+	xmlns="http://www.w3.org/2000/svg"
+	fill="none"
+	viewBox="0 0 24 24"
+	stroke-width="1.5"
+	stroke="currentColor"
+	class="w-6 h-6"
+>
+	<path
+		stroke-linecap="round"
+		stroke-linejoin="round"
+		d="M17.982 18.725A7.488 7.488 0 0012 15.75a7.488 7.488 0 00-5.982 2.975m11.963 0a9 9 0 10-11.963 0m11.963 0A8.966 8.966 0 0112 21a8.966 8.966 0 01-5.982-2.275M15 9.75a3 3 0 11-6 0 3 3 0 016 0z"
+	/>
+</svg>

src/lib/minio.ts

@@ -6,3 +6,11 @@ import config from '$lib/config';
 
 /** export const client = new Minio.Client(config.minio); */
 export const client = new Client(config.minio);
+
+const isProd = process.env.NODE_ENV == 'production';
+const BUCKET = isProd ? 'tatort' : 'tatort-dev';
+
+export { BUCKET };
+
+export const TOKENFILENAME = '__perm__';
+export const CONFIGFILENAME = 'config.json';

src/lib/server/authService.ts

@@ -0,0 +1,31 @@
+import { dev } from '$app/environment';
+import { fail, redirect, type Cookies, type RequestEvent } from '@sveltejs/kit';
+import { authenticate } from '$lib/auth';
+import { ROUTE_NAMES } from '../../routes';
+
+const COOKIE_NAME = 'session';
+
+export const loginUser = async ({ request, cookies }: { request: Request; cookies: Cookies }) => {
+	const data = await request.formData();
+	const user = data.get('user');
+	const password = data.get('password');
+
+	const token = authenticate(user, password);
+
+	if (!token) return fail(400, { user, incorrect: true,
+								message: "Ungültige Zugangsdaten" });
+
+	cookies.set(COOKIE_NAME, token, {
+		path: ROUTE_NAMES.ROOT,
+		httpOnly: true,
+		sameSite: 'strict',
+		secure: !dev
+	});
+	return redirect(303, ROUTE_NAMES.ROOT);
+};
+
+export const logoutUser = async (event: RequestEvent) => {
+	event.cookies.delete(COOKIE_NAME, { path: ROUTE_NAMES.ROOT });
+	event.locals.user = null;
+	return redirect(303, ROUTE_NAMES.ROOT);
+};

src/lib/server/dbService.ts

@@ -0,0 +1,7 @@
+import Database from 'better-sqlite3';
+import { DB_FULLPATH } from '../../routes';
+
+// make sure the DB is initiated
+import '../../init/init_db'
+
+export const db = new Database(DB_FULLPATH);

src/lib/server/s3ClientService.ts

@@ -0,0 +1,27 @@
+import { BUCKET, client } from '$lib/minio';
+
+export const checkIfExactDirectoryExists = (dir: string): Promise<boolean> => {
+	return new Promise<boolean>((resolve, reject) => {
+		const prefix = dir.endsWith('/') ? dir : `${dir}/`;
+
+		const stream = client.listObjectsV2(BUCKET, prefix, false, '');
+
+		stream.on('data', (obj) => {
+			if (obj.prefix === undefined && obj.name.startsWith(prefix)) {
+				stream.destroy();
+				resolve(true);
+			}
+		});
+
+		stream.on('error', (err) => reject(err));
+
+		stream.on('end', () => resolve(false));
+	});
+};
+
+export const getContentOfTextObject = async (bucket: string, objPath: string) => {
+	const res = await client.getObject(bucket, objPath);
+
+	const text = await new Response(res).text();
+	return text;
+};

src/lib/server/userService.ts

@@ -0,0 +1,51 @@
+import { db } from '$lib/server/dbService';
+
+export const getUsers = (): { userId: string; userName: string }[] => {
+	const getUsersSQLStmt = `SELECT id, name
+													 FROM users;`;
+	const statement = db.prepare(getUsersSQLStmt);
+	const result = statement.all() as { id: string; name: string }[];
+	const userList: { userId: string; userName: string }[] = [];
+
+	for (const resultItem of result) {
+		const user = { userId: resultItem.id, userName: resultItem.name };
+		userList.push(user);
+	}
+
+	return userList;
+};
+
+export const addUser = (userName: string, userPassword: string) => {
+	const addUserSQLStmt = `INSERT into users(name, pw)
+													values (?, ?)`;
+	const statement = db.prepare(addUserSQLStmt);
+
+	let rowInfo;
+	try {
+		rowInfo = statement.run(userName, userPassword);
+		return rowInfo;
+	} catch (error) {
+		console.error('ERROR: ', error);
+	}
+};
+
+export const deleteUser = (userId: string) => {
+	// make sure to not delete the last entry
+	const deleteUserSQLStmt = `DELETE
+														 FROM users
+														 WHERE id = ?
+															 AND (SELECT COUNT(*) FROM users) > 1;`;
+
+	const statement = db.prepare(deleteUserSQLStmt);
+
+	let rowCount;
+	try {
+		const info = statement.run(userId);
+		rowCount = info.changes;
+	} catch (error) {
+		console.log(error);
+		rowCount = 0;
+	}
+
+	return rowCount;
+};

src/lib/server/vorgangService.ts

@@ -0,0 +1,260 @@
+import { fail } from '@sveltejs/kit';
+import { BUCKET, client, CONFIGFILENAME, TOKENFILENAME } from '$lib/minio';
+import { checkIfExactDirectoryExists, getContentOfTextObject } from './s3ClientService';
+import { v4 as uuidv4 } from 'uuid';
+
+import { db } from './dbService';
+
+/**
+ * Get Vorgang and corresponend list of tatorte
+ * @param vorgangToken
+ * @returns
+ */
+export const getCrimesListByToken = async (vorgangToken: string) => {
+	const prefix = `${vorgangToken}/`;
+
+	const stream = client.listObjectsV2(BUCKET, prefix, false, '');
+
+	const list = [];
+	for await (const chunk of stream) {
+		const splittedNameParts = chunk.name.split('/');
+		const prefix = splittedNameParts[0];
+		const name = splittedNameParts[1];
+
+		if (name === CONFIGFILENAME || name === TOKENFILENAME) continue;
+		list.push({ ...chunk, name: name, prefix: prefix, show_button: true });
+	}
+	return list;
+};
+
+/**
+ * Get Vorgang
+ * @param vorgangToken
+ * @returns vorgangObj with keys `token`, `name`, `pin` || undefined
+ */
+export const getVorgangByToken = (
+	vorgangToken: string
+): { token: string; name: string; pin: string } | undefined => {
+	const getVorgangSQLStmt = `SELECT token, name, pin
+														 FROM cases
+														 WHERE token = ?`;
+	const statement = db.prepare(getVorgangSQLStmt);
+	const result = statement.get(vorgangToken) as
+		| { token: string; name: string; pin: string }
+		| undefined;
+
+	return result;
+};
+
+/**
+ * Create Vorgang, using a vorgangName and vorgangPIN
+ * @param vorgangName
+ * @param vorgangPIN
+ * @returns {string || false} vorgangToken if successful
+ */
+export const createVorgang = (vorgangName: string, vorgangPIN: string): string | boolean => {
+	const vorgangExists = vorgangNameExists(vorgangName);
+	if (vorgangExists) {
+		return false;
+	}
+
+	const vorgangToken = uuidv4();
+
+	const insertSQLStatement = `INSERT INTO cases (token, name, pin) VALUES (?, ?, ?)`;
+	const statement = db.prepare(insertSQLStatement);
+	const info = statement.run(vorgangToken, vorgangName, vorgangPIN);
+
+	if (info.changes) {
+		return vorgangToken;
+	} else {
+		return false;
+	}
+};
+
+/**
+ * Get Vorgang
+ * @param vorgangName
+ * @returns vorgangObj with keys `token`, `name`, `pin` || undefined
+ */
+export const getVorgangByName = (
+	vorgangName: string
+): { token: string; name: string; pin: string } | undefined => {
+	const getVorgangByNameSQLStmt = `SELECT token, name, pin
+																	 FROM cases
+																	 WHERE name = ?`;
+	const statement = db.prepare(getVorgangByNameSQLStmt);
+	const result = statement.get(vorgangName) as
+		| { token: string; name: string; pin: string }
+		| undefined;
+
+	return result;
+};
+
+/**
+ * Delete Vorgang
+ * @param vorgangToken
+ * @returns int: number of changes
+ */
+export const deleteVorgangByToken = function (vorgangToken: string) {
+	const deleteSQLStmt = 'DELETE FROM cases WHERE token = ?';
+	const statement = db.prepare(deleteSQLStmt);
+	const info = statement.run(vorgangToken);
+
+	return info.changes;
+};
+
+/**
+ * Fetches list of vorgänge from s3 bucket
+ * @returns list of available vorgaenge
+ */
+export const getListOfVorgänge = async () => {
+	const stream = client.listObjectsV2(BUCKET, '', false, '');
+
+	const list = [];
+	for await (const chunk of stream) {
+		const objPath = `${chunk.prefix}${TOKENFILENAME}`;
+
+		const token = await getContentOfTextObject(BUCKET, objPath);
+
+		const cleanedChunkPrefix = chunk.prefix.replace(/\/$/, '');
+		list.push({ name: cleanedChunkPrefix, token: token });
+	}
+	return list;
+};
+
+/**
+ * Fetches list of vorgänge from database
+ * @returns list with of available vorgaenge
+ */
+export const getVorgaenge = (): {
+	vorgangToken: string;
+	vorgangName: string;
+	vorgangPIN: string;
+}[] => {
+	const getVorgaengeSQLStmt = `SELECT token, name, pin
+															 from cases`;
+	const statement = db.prepare(getVorgaengeSQLStmt);
+	const result = statement.all() as { token: string; name: string; pin: string }[];
+	const vorgaenge_list: { vorgangToken: string; vorgangName: string; vorgangPIN: string }[] = [];
+	for (const resultItem of result) {
+		const vorg = {
+			vorgangToken: resultItem.token,
+			vorgangName: resultItem.name,
+			vorgangPIN: resultItem.pin
+		};
+		vorgaenge_list.push(vorg);
+	}
+
+	return vorgaenge_list;
+};
+
+/**
+ * Checks if Vorgang exists
+ * @param request
+ * @returns fail or true
+ */
+export const checkIfVorgangExists = async (vorgangId: string | null) => {
+	if (!vorgangId) {
+		return fail(400, {
+			success: false,
+			vorgangId,
+			error: { message: 'Die Vorgangsnummer darf nicht leer sein.' }
+		});
+	}
+
+	if (typeof vorgangId === 'string' && !(await checkIfExactDirectoryExists(vorgangId))) {
+		return fail(400, {
+			success: false,
+			vorgangId,
+			error: { message: 'Die Vorgangsnummer existiert in dieser Anwendung nicht.' }
+		});
+	}
+
+	return true;
+};
+
+export const vorgangExists = function (vorgangToken: string | null) {
+	if (!vorgangToken) {
+		return fail(400, {
+			success: false,
+			vorgangId: vorgangToken,
+			error: { message: 'Die Vorgangsnummer darf nicht leer sein.' }
+		});
+	}
+
+	const vorgaenge = getVorgaenge();
+	const vorgaengeTokens = vorgaenge.map((vorgang) => vorgang.vorgangToken);
+
+	const found = vorgaengeTokens.indexOf(vorgangToken) != -1;
+
+	return found;
+};
+
+export const vorgangNameExists = (vorgangName: string) => {
+	const vorgaenge = getVorgaenge();
+	const vorgaengeNames = vorgaenge.map((vorgang) => vorgang.vorgangName);
+
+	const found = vorgaengeNames.indexOf(vorgangName) != -1;
+
+	return found;
+};
+
+export const hasValidToken = async (vorgangId: string, vorgangToken: string) => {
+	const objPath = `${vorgangId}/${TOKENFILENAME}`;
+
+	try {
+		if (!vorgangToken) {
+			return false;
+		}
+
+		const token = await getContentOfTextObject(BUCKET, objPath);
+		if (!token || token !== vorgangToken) {
+			return false;
+		}
+
+		return true;
+	} catch (error) {
+		if (error.name == 'S3Error') {
+			console.log(error);
+			return false;
+		}
+	}
+};
+
+export const vorgangPINValidation = function (vorgangToken: string, vorgangPIN: string) {
+	if (!vorgangPIN) {
+		return false;
+	}
+
+	const vorgang = getVorgangByToken(vorgangToken);
+
+	if (!vorgang || vorgang.pin !== vorgangPIN) {
+		return false;
+	}
+
+	return true;
+};
+
+/**
+ * Change VorgangName or VorgangPIN
+ * @param vorgangToken
+ * @param newValue
+ * @returns {int} number of affected lines
+ */
+export const updateVorgangAttrByToken = function (vorgangToken: string,
+											newValue: string,
+											column: string) {
+	const renameSQLStmt = `UPDATE cases set ${column} = ? WHERE token = ?`;
+	const statement = db.prepare(renameSQLStmt);
+
+	let info;
+	
+	try {
+		info = statement.run(newValue, vorgangToken);
+	} catch (err) {
+		console.log(`error: ${err}`)
+		return 0;
+	}
+
+	return info.changes;
+};

src/routes/(angemeldet)/+layout.server.js

@@ -1,9 +0,0 @@
-import { redirect } from '@sveltejs/kit';
-
-/** @type {import('./$types').PageServerLoad} */
-export function load(event) {
-	if (!event.locals.user && event.url.pathname !== '/anmeldung') throw redirect(303, '/anmeldung');
-	return {
-		user: event.locals.user
-	};
-}

src/routes/(angemeldet)/+layout.server.ts

@@ -0,0 +1,10 @@
+import { type ServerLoadEvent } from '@sveltejs/kit';
+import type { PageServerLoad } from '../anmeldung/$types';
+
+export const load: PageServerLoad = (event: ServerLoadEvent) => {
+	if (event.locals.user) {
+		return {
+			user: event.locals.user
+		};
+	}
+};

src/routes/(angemeldet)/+layout.svelte

@@ -1,84 +1,27 @@
-<script>
-	import Chevron from '$lib/icons/Chevron-right.svelte';
-	import Login from '$lib/icons/Login.svelte';
+<script lang="ts">
+	import Footer from '$lib/components/Footer.svelte';
+	import Header from '$lib/components/Header.svelte';
 
 	export let data;
 </script>
 
+{#if data.user?.admin}
+
 <div class="h-screen v-screen flex flex-col">
 	<div class="flex flex-col h-full">
-		<header class="flex-none relative isolate z-10 bg-white px-8">
-			<nav
-				class="mx-auto flex max-w-7xl items-center justify-between p-6 lg:px-8"
-				aria-label="Global"
-			>
-				<div class="flex w-48">
-					<a href="/" class="-m-1.5 p-1.5 w-10">
-						<span class="sr-only">Tatort Niedersachen</span>
-						<img class="h-8 w-auto" src="/Landeswappen_NI.svg" alt="Landeswappen Niedersachsen" />
-					</a>
-				</div>
-				<h1 class="text-3xl text-slate-400 font-bold">Tatort</h1>
-				<div class="lg:flex lg:justify-end w-48">
-					{#if data.user}
-						<form method="POST" action="/anmeldung?/logout">
-							<input type="hidden" />
-							<button type="submit" class="text-sm font-semibold leading-6 text-gray-900"
-								><span
-									><span class="align-middle inline-block">Abmelden</span><span
-										class="align-middle inline-block"><Chevron /></span
-									></span
-								></button
-							>
-						</form>
-					{/if}
-				</div>
-			</nav>
-		</header>
+		<Header {data}/>
+
 		<div class="h-full grow overflow-scroll">
 			<slot />
 		</div>
-		<div class="flex-none">
-			<footer class="justify-end">
-				<div class="bg-gray-100">
-					<div class="mx-auto max-w-7xl px-6 lg:px-8">
-						<div class="flex justify-between divide-x divide-gray-900/5 border-x border-gray-900/5">
-							<a
-								href="/list"
-								class="px-4 py-1 -ml-4 flex items-center justify-center gap-x-2.5 text-sm font-semibold leading-6 text-gray-500 hover:bg-gray-200 hover:text-gray-700"
-							>
-								&copy; 2023 Innovation Hub Niedersachen
-							</a>
-							<a
-								href="/"
-								class="px-4 py-1 flex items-center justify-center gap-x-2.5 text-sm font-semibold leading-6 text-gray-500 hover:bg-gray-200 hover:text-gray-700"
-							>
-								back
-							</a>
-							<a
-								href="/"
-								class="px-4 py-1 -mr-4 flex items-center justify-center gap-x-2.5 text-sm font-semibold leading-6 text-gray-500 hover:bg-gray-200 hover:text-gray-700"
-							>
-								<svg
-									xmlns="http://www.w3.org/2000/svg"
-									fill="none"
-									viewBox="0 0 24 24"
-									stroke-width="1.5"
-									stroke="currentColor"
-									class="w-6 h-6"
-								>
-									<path
-										stroke-linecap="round"
-										stroke-linejoin="round"
-										d="M17.982 18.725A7.488 7.488 0 0012 15.75a7.488 7.488 0 00-5.982 2.975m11.963 0a9 9 0 10-11.963 0m11.963 0A8.966 8.966 0 0112 21a8.966 8.966 0 01-5.982-2.275M15 9.75a3 3 0 11-6 0 3 3 0 016 0z"
-									/>
-								</svg>
-								{data.user.id}
-							</a>
-						</div>
-					</div>
-				</div>
-			</footer>
-		</div>
+		<Footer {data}/>
+
 	</div>
 </div>
+
+{:else}
+
+<div class="h-screen bg-white"><slot /></div>
+
+
+{/if}

src/routes/(angemeldet)/+page.server.ts

@@ -0,0 +1,6 @@
+import { loginUser, logoutUser } from '$lib/server/authService';
+
+export const actions = {
+	login: ({ request, cookies }) => loginUser({ request, cookies }),
+	logout: (event) => logoutUser(event),
+} as const;

src/routes/(angemeldet)/+page.svelte

@@ -1,123 +1,109 @@
-<style>
-</style>
+<script lang="ts">
+	import AddProcess from '$lib/icons/Add-Process.svelte';
+	import FileRect from '$lib/icons/File-rect.svelte';
+	import ListIcon from '$lib/icons/List-icon.svelte';
+	import Button from '$lib/components/Button.svelte';
+	import ArrowRight from '$lib/icons/Arrow-right.svelte';
 
-<script>
-	import Panel from '$lib/components/ui/Panel.svelte';
+	import { ROUTE_NAMES } from '../index.js';
 
 	export let data;
+	export let form;
+	export let outline = true;
 </script>
 
+{#if data.user?.admin}
 <div
 	class=" inset-x-0 top-0 -z-10 h-full flex items-center justify-center bg-white shadow-lg ring-1 ring-gray-900/5"
 >
 	<div class="mx-auto flex justify-center max-w-7xl py-10 px-8 w-full">
-		{#if data.user.admin}
 			<div class="group relative rounded-lg p-6 text-sm leading-6 hover:bg-gray-50 w-1/4">
 				<div
 					class="flex h-11 w-11 items-center justify-center rounded-lg bg-gray-50 group-hover:bg-white"
 				>
-					<svg
-						xmlns="http://www.w3.org/2000/svg"
-						fill="none"
-						viewBox="0 0 24 24"
-						stroke-width="1.5"
-						stroke="currentColor"
-						class="w-6 h-6"
-					>
-						<path
-							stroke-linecap="round"
-							stroke-linejoin="round"
-							d="M8.25 6.75h12M8.25 12h12m-12 5.25h12M3.75 6.75h.007v.008H3.75V6.75zm.375 0a.375.375 0 11-.75 0 .375.375 0 01.75 0zM3.75 12h.007v.008H3.75V12zm.375 0a.375.375 0 11-.75 0 .375.375 0 01.75 0zm-.375 5.25h.007v.008H3.75v-.008zm.375 0a.375.375 0 11-.75 0 .375.375 0 01.75 0z"
-						/>
-					</svg>
+					<ListIcon class=" group-hover:text-indigo-600" />
 				</div>
-				<a href="/list" class="mt-6 block font-semibold text-gray-900">
-					Liste
+				<a href="{ROUTE_NAMES.LIST}" class="mt-6 block font-semibold text-gray-900">
+					Vorgänge
 					<span class="absolute inset-0"></span>
 				</a>
 				<p class="mt-1 text-gray-600">
 					Verschaffe Dir einen Überblick über alle gespeicherten Tatorte.
 				</p>
 			</div>
-		{/if}
-		{#if data.user.admin}
-			<div class="group relative rounded-lg p-6 text-sm leading-6 hover:bg-gray-50 w-1/4">
-				<div
-					class="flex h-11 w-11 items-center justify-center rounded-lg bg-gray-50 group-hover:bg-white"
-				>
-					<svg
-						xmlns="http://www.w3.org/2000/svg"
-						fill="none"
-						viewBox="0 0 24 24"
-						stroke-width="1.5"
-						stroke="currentColor"
-						class="w-6 h-6"
-					>
-						<path
-							stroke-linecap="round"
-							stroke-linejoin="round"
-							d="M19.5 14.25v-2.625a3.375 3.375 0 00-3.375-3.375h-1.5A1.125 1.125 0 0113.5 7.125v-1.5a3.375 3.375 0 00-3.375-3.375H8.25m3.75 9v6m3-3H9m1.5-12H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 00-9-9z"
-						/>
-					</svg>
-				</div>
-				<a href="/tatorte" class="mt-6 block font-semibold text-gray-900">
-					Neueer Vorgang
-					<span class="absolute inset-0"></span>
-				</a>
-				<p class="mt-1 text-gray-600">Stelle einen weiteren Tatort für die Anwendung bereit.</p>
-			</div>
-		{/if}
-		{#if data.user.admin}
-			<div class="group relative rounded-lg p-6 text-sm leading-6 hover:bg-gray-50 w-1/4">
-				<div
-					class="flex h-11 w-11 items-center justify-center rounded-lg bg-gray-50 group-hover:bg-white"
-				>
-					<svg
-						class="h-6 w-6 text-gray-600 group-hover:text-indigo-600"
-						fill="none"
-						viewBox="0 0 24 24"
-						stroke-width="1.5"
-						stroke="currentColor"
-						aria-hidden="true"
-					>
-						<path
-							stroke-linecap="round"
-							stroke-linejoin="round"
-							d="M13.5 16.875h3.375m0 0h3.375m-3.375 0V13.5m0 3.375v3.375M6 10.5h2.25a2.25 2.25 0 002.25-2.25V6a2.25 2.25 0 00-2.25-2.25H6A2.25 2.25 0 003.75 6v2.25A2.25 2.25 0 006 10.5zm0 9.75h2.25A2.25 2.25 0 0010.5 18v-2.25a2.25 2.25 0 00-2.25-2.25H6a2.25 2.25 0 00-2.25 2.25V18A2.25 2.25 0 006 20.25zm9.75-9.75H18a2.25 2.25 0 002.25-2.25V6A2.25 2.25 0 0018 3.75h-2.25A2.25 2.25 0 0013.5 6v2.25a2.25 2.25 0 002.25 2.25z"
-						/>
-					</svg>
-				</div>
-				<a href="/upload" class="mt-6 block font-semibold text-gray-900">
-					Hinzufügen
-					<span class="absolute inset-0"></span>
-				</a>
-				<p class="mt-1 text-gray-600">Fügen Sie einem Tatort Bilder hinzu.</p>
-			</div>
-		{/if}
 		<div class="group relative rounded-lg p-6 text-sm leading-6 hover:bg-gray-50 w-1/4">
 			<div
 				class="flex h-11 w-11 items-center justify-center rounded-lg bg-gray-50 group-hover:bg-white"
 			>
-				<svg
-					xmlns="http://www.w3.org/2000/svg"
-					fill="none"
-					viewBox="0 0 24 24"
-					stroke-width="1.5"
-					stroke="currentColor"
-					class="w-6 h-6"
-				>
-					<path
-						stroke-linecap="round"
-						stroke-linejoin="round"
-						d="M2.25 15.75l5.159-5.159a2.25 2.25 0 013.182 0l5.159 5.159m-1.5-1.5l1.409-1.409a2.25 2.25 0 013.182 0l2.909 2.909m-18 3.75h16.5a1.5 1.5 0 001.5-1.5V6a1.5 1.5 0 00-1.5-1.5H3.75A1.5 1.5 0 002.25 6v12a1.5 1.5 0 001.5 1.5zm10.5-11.25h.008v.008h-.008V8.25zm.375 0a.375.375 0 11-.75 0 .375.375 0 01.75 0z"
-					/>
-				</svg>
+				<FileRect class=" group-hover:text-indigo-600" {outline} />
 			</div>
-			<a href="/view" class="mt-6 block font-semibold text-gray-900">
-				Ansicht
+			<a href="{ROUTE_NAMES.USERMGMT}" class="mt-6 block font-semibold text-gray-900">
+				Benutzerverwaltung
 				<span class="absolute inset-0"></span>
 			</a>
-			<p class="mt-1 text-gray-600">Schau Dir einen Tatort in der 3D Ansicht an.</p>
+			<p class="mt-1 text-gray-600">Füge neue Benutzer hinzu oder entferne welche.</p>
 		</div>
 	</div>
 </div>
+
+{:else}
+
+<div class="flex min-h-full flex-col justify-center px-6 py-12 lg:px-8">
+	<div class="sm:mx-auto sm:w-full sm:max-w-sm">
+		<img class="mx-auto h-10 w-auto" src="/Landeswappen_NI.svg" alt="Landeswappen Niedersachsen" />
+
+		<h2 class="mt-10 text-center text-2xl font-bold leading-9 tracking-tight text-gray-900">
+			Willkommen beim 3D Tatort
+		</h2>
+	</div>
+	<div class="w-full max-w-sm mx-auto">
+		<div class="relative mt-5 bg-gray-50 rounded-xl shadow-xl p-3 pt-1">
+			<div class="mt-10">
+
+<form action="{ROUTE_NAMES.LOGIN}" method="POST">
+						<div>
+							<label for="user" class="text-sm font-medium leading-6 text-gray-900">Name</label>
+							<div class="mt-2">
+								<input
+									id="user"
+									name="user"
+									type="text"
+									autocomplete="email"
+									required
+									class="rounded-md border-0 py-1.5 text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 placeholder:text-gray-400 focus:ring-2 focus:ring-inset focus:ring-indigo-600 sm:text-sm sm:leading-6"
+								/>
+							</div>
+						</div>
+
+						<div>
+							<label for="password" class="block text-sm font-medium leading-6 text-gray-900"
+								>Passwort</label
+							>
+							<div class="mt-2">
+								<input
+									id="password"
+									name="password"
+									type="password"
+									autocomplete="current-password"
+									required
+									class="block w-full rounded-md border-0 py-1.5 text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 placeholder:text-gray-400 focus:ring-2 focus:ring-inset focus:ring-indigo-600 sm:text-sm sm:leading-6"
+								/>
+							</div>
+						</div>
+						{#if form?.incorrect}
+							<p class="block text-sm leading-6 text-red-900 mt-2">{form.message}</p>
+						{/if}
+						<div class="flex justify-end">
+							<Button type="submit" class="mt-5">Anmelden</Button>
+						</div>
+					</form>
+			</div>
+		</div>
+	</div>
+</div>
+
+{/if}
+
+<style>
+</style>
+

src/routes/(angemeldet)/list/+page.server.ts

@@ -0,0 +1,35 @@
+import { createVorgang, getVorgaenge } from '$lib/server/vorgangService';
+import type { PageServerLoad } from '../../(token-based)/view/$types';
+import { error, fail } from '@sveltejs/kit';
+
+export const load: PageServerLoad = async (event) => {
+	if (!event.locals.user) {
+		error(404, 'Not Found')
+	}
+
+	const vorgangList = getVorgaenge();
+
+	return {
+		vorgangList
+	};
+};
+
+
+export const actions = {
+	default: async ({ request }: { request: Request }) => {
+		const data = await request.formData();
+		const vorgangName: string | null = data.get('vorgang') as string;
+		const vorgangPIN: string | null = data.get('pin') as string;
+
+		const err = {};
+
+		const token = createVorgang(vorgangName, vorgangPIN);
+		if (!token) {
+			err.message = "Der Vorgang konnte nicht angelegt werden"
+			return fail(400, err)
+		} else {
+			// success
+			return { token }
+		}
+	}
+};

src/routes/(angemeldet)/list/+page.svelte

@@ -1,40 +1,151 @@
-<style>
-	ul {
-		min-width: 24rem;
-	}
-</style>
+<script lang="ts">
+	import ExpandableForm from '$lib/components/ExpandableForm.svelte';
+	import Trash from '$lib/icons/Trash.svelte';
+	import Folder from '$lib/icons/Folder.svelte';
+	import EmptyList from '$lib/components/EmptyList.svelte';
+	import NameItemEditor from '$lib/components/NameItemEditor.svelte';
+	import Alert from '$lib/components/Alert.svelte';
+	import Button from '$lib/components/Button.svelte';
+	import Modal from '$lib/components/Modal/Modal.svelte';
+	import ModalTitle from '$lib/components/Modal/ModalTitle.svelte';
+	import ModalContent from '$lib/components/Modal/ModalContent.svelte';
+	import ModalFooter from '$lib/components/Modal/ModalFooter.svelte';
+	import { API_ROUTES, ROUTE_NAMES } from '../../index.js';
+	import { invalidateAll } from '$app/navigation';
 
-<script>
-	import { onMount } from 'svelte';
-	import { page } from '$app/stores';
+	let { data, form } = $props();
 
-	/**
-	 * @type any[]
-	 */
-	let list = [];
-	//$: list;
+	let vorgangList = $state(data.vorgangList);
+    
+    // same as `vorgangList` but with one different property to be used
+    // with ´NameItemEditor`
+    const derivedList = $derived.by(
+		() => {
+			return vorgangList.map(
+				({ vorgangName, ...rest }) => (
+					{
+						name: vorgangName,
+						...rest
+					}
+				)
+			)
+		}
+    );
+	
+	let isEmptyList = vorgangList.length === 0;
 
-	onMount(async () => {
-		const response = await fetch('/api/list');
-		const stream = await response.body;
-		if (!stream) return;
+	let vorgangName = $state('');
+	let vorgangPIN = $state('');
+	let errorMsg = $state('');
 
-		const reader = stream.getReader();
-
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) return;
-
-			const objs = new TextDecoder()
-				.decode(value)
-				.split('\n')
-				.filter((i) => i.length > 0)
-				.map((i) => JSON.parse(i));
-
-			console.log(objs);
-			list = list.concat(objs);
+	// reset input fields when submission successful
+	$effect(() => {
+		if (form?.token) {
+			vorgangName = '';
+			vorgangPIN = '';
+			errorMsg = '';
 		}
 	});
+
+	async function submitVorgang(ev: Event) {
+		const isValid = inputValid(vorgangName, vorgangPIN);
+		if (!isValid) {
+			ev.preventDefault();
+			return;
+		}
+
+		// continue form action on server
+	}
+
+	/**
+	 * Check for required fields
+	 * @param vorgangName
+	 * @param vorgangPIN
+	 * @returns {boolean} Indicates whether input is valid
+	 */
+	function inputValid(vorgangName, vorgangPIN) {
+		if (!(vorgangName || vorgangPIN)) {
+			errorMsg = 'Bitte beide Felder ausfüllen.';
+			return false;
+		} else if (!vorgangName) {
+			errorMsg = 'Bitte einen Vorgangsnamen vergeben.';
+			return false;
+		} else if (!vorgangPIN) {
+			errorMsg = 'Bitte einen Vorgangs-PIN eingeben.';
+			return false;
+		}
+
+		const existing = vorgangList.some((vorg) => vorg.vorgangName === vorgangName);
+		if (existing) {
+			errorMsg = 'Der Name existiert bereits.';
+			return false;
+		}
+
+		return true;
+	}
+
+	async function deleteVorgang(vorgangToken: string) {
+		let delete_item = window.confirm('Bist du sicher?');
+
+		if (delete_item) {
+			let url = API_ROUTES.VORGANG(vorgangToken);
+			
+			try {
+				const response = await fetch(url, { method: 'DELETE' });
+				if (response.status == 204) {
+					setTimeout(() => {
+						window.location.reload();
+					}, 500);
+				}
+			} catch (error) {
+				if (error instanceof Error) {
+					console.log(error.message);
+				} else {
+					console.log(error);
+				}
+			}
+		}
+	}
+	
+	//Variablen für Modal
+	let open = $state(false);
+	let inProgress = $state(false);
+	let isError = $state(false);
+
+	async function handleSave(newName: string, oldName: string, vorgangToken: string) {
+		open = true;
+		inProgress = true;
+		isError = false;
+		try {
+			const res = await fetch(API_ROUTES.VORGANG(vorgangToken), {
+				method: 'PUT',
+				headers: {
+					'Content-Type': 'application/json'
+				},
+				body: JSON.stringify({ vorgangToken, oldName, newName })
+			});
+
+			if (!res.ok) {
+				throw new Error('Fehler beim Speichern');
+			}
+			await invalidateAll();
+			vorgangList = data.vorgangList;
+			open = false;
+		} catch (err) {
+			console.error('⚠️ Netzwerkfehler beim Speichern', err);
+			isError = true;
+		} finally {
+			inProgress = false;
+		}
+	}
+	
+	
+	
+	 async function closeModal() {
+		open = false;
+		isError = false;
+	}
+	
 </script>
 
 <div class="-z-10 bg-white">
@@ -43,68 +154,111 @@
 	</div>
 	<div class="mx-auto flex justify-center max-w-7xl h-full">
 		<ul role="list" class="divide-y divide-gray-100">
-			{#each list as item}
-				<li>
-					<a href="/list/{item.name}" class="flex justify-between gap-x-6 py-5">
-						<div class="flex gap-x-4">
-							<svg
-								xmlns="http://www.w3.org/2000/svg"
-								fill="none"
-								viewBox="0 0 24 24"
-								stroke-width="1.5"
-								stroke="currentColor"
-								class="w-6 h-6"
-							>
-								<path
-									stroke-linecap="round"
-									stroke-linejoin="round"
-									d="M2.25 12.75V12A2.25 2.25 0 014.5 9.75h15A2.25 2.25 0 0121.75 12v.75m-8.69-6.44l-2.12-2.12a1.5 1.5 0 00-1.061-.44H4.5A2.25 2.25 0 002.25 6v12a2.25 2.25 0 002.25 2.25h15A2.25 2.25 0 0021.75 18V9a2.25 2.25 0 00-2.25-2.25h-5.379a1.5 1.5 0 01-1.06-.44z"
-								/>
-							</svg>
-							<div class="min-w-0 flex-auto">
-								<span class="text-sm font-semibold leading-6 text-gray-900">{item.name}</span>
-								<!-- Delete button -->
-								<button
-								style="padding: 2px"
-								id="del__{item.name}"
-								on:click|preventDefault={async (ev) => {
-									let delete_item = window.confirm("Bist du sicher?");
-
-									if (delete_item) {
-											let filename = event.currentTarget.id.split('del__')[1]
-
-											// delete request
-											// --------------
-
-											let url = `/api/list/${filename}`
-
-											console.log(`--- ${filename} + ${url}`)
-											try {
-												const response = await fetch(url,
-													{method: 'DELETE'}
-												)
-												if (response.status == 204) {
-													setTimeout(() => {window.location.reload()}, 500)
-												}
-											} catch (error) {
-												console.log(error.message)
-											}
-
-										}
-
-								}}
-								>
-									<svg
-									height="20" width="20" xmlns="http://www.w3.org/2000/svg"><path d="m8 3v1 1h1v-1h4v1h1v-1-1zm-4 3v1h14v-1zm2 2v11h1 9v-1-10h-1v10h-8v-10z" fill="#373737" transform="translate(1 1)"/></svg>
-								</button>
-							</div>
+			{#if isEmptyList}
+				<EmptyList></EmptyList>
+			{:else}
+				{#each vorgangList as vorgangItem}
+					<li data-testid="test-list-item">
+						<div class="flex items-center justify-center gap-3">
+						<a
+						href="{ROUTE_NAMES.VORGANG(vorgangItem.vorgangToken)}"
+						class="flex flex-col items-center justify-center gap-2 py-4 rounded-lg hover:bg-gray-50 transition text-center"
+						>
+							<Folder class="w-6 h-6 text-gray-600" />
+						</a>
+							<NameItemEditor
+							list={derivedList}
+							currentName={vorgangItem.vorgangName}
+							vorgangToken={vorgangItem.vorgangToken}
+							onSave={handleSave}
+							onDelete={deleteVorgang}
+							/>
 						</div>
-						<div class="hidden sm:flex sm:flex-col sm:items-end">
-							<p class="text-sm leading-6 text-gray-900">Vorgang</p>
-						</div>
-					</a>
-				</li>
-			{/each}
+					</li>
+				{/each}
+			{/if}
 		</ul>
 	</div>
 </div>
+
+
+<ExpandableForm>
+<form class="flex flex-col items-center" method="POST">
+	<div class="flex flex-col sm:flex-row sm:space-x-4 w-full max-w-lg">
+		<div class="flex-1">
+			<label for="vorgang" class="block text-sm font-medium leading-6 text-gray-900">
+				<span class="flex"> Vorgangsname </span>
+			</label>
+			<div class="mt-2">
+				<div
+					class="flex rounded-md shadow-sm ring-1 ring-inset ring-gray-300 focus-within:ring-2 focus-within:ring-inset focus-within:ring-indigo-600"
+				>
+					<input
+						required
+						bind:value={vorgangName}
+						type="text"
+						name="vorgang"
+						id="vorgang"
+						class="block flex-1 border-0 bg-transparent py-1.5 pl-1 text-gray-900 placeholder:text-gray-400 focus:ring-0 sm:text-sm sm:leading-6"
+					/>
+				</div>
+			</div>
+		</div>
+
+		<div class="flex-1 mt-4 sm:mt-0">
+			<label for="pin" class="block text-sm font-medium leading-6 text-gray-900">
+				<span class="flex"> PIN </span>
+			</label>
+			<div class="mt-2">
+				<div
+					class="flex rounded-md shadow-sm ring-1 ring-inset ring-gray-300 focus-within:ring-2 focus-within:ring-inset focus-within:ring-indigo-600"
+				>
+					<input
+						required
+						type="password"
+						bind:value={vorgangPIN}
+						name="pin"
+						id="pin"
+						class="block flex-1 border-0 bg-transparent py-1.5 pl-1 text-gray-900 placeholder:text-gray-400 focus:ring-0 sm:text-sm sm:leading-6"
+					/>
+				</div>
+			</div>
+		</div>
+	</div>
+
+	{#if errorMsg}
+		<p>{errorMsg}</p>
+	{/if}
+	{#if form?.message}
+		<p>{form.message}</p>
+	{/if}
+	<button
+		type="submit"
+		on:click={submitVorgang}
+		class="mt-4 bg-indigo-600 text-white px-6 py-2 rounded hover:bg-indigo-700 transition"
+	>
+		Neuen Vorgang hinzufügen
+	</button>
+</form>
+
+</ExpandableForm>
+
+<Modal {open}
+			><ModalTitle>Umbenennen</ModalTitle><ModalContent>
+				{#if inProgress}
+					<p class="py-2 mb-1">Vorgang läuft...</p>
+				{:else if isError}
+					<Alert class="w-full" type="error">Fehler beim Umbenennen</Alert>
+				{:else}
+					<Alert class="w-full">Umbenennen erfolgreich</Alert>
+				{/if}
+			</ModalContent>
+			<ModalFooter><Button disabled={inProgress} on:click={closeModal}>Ok</Button></ModalFooter>
+</Modal>
+
+<style>
+	ul {
+		min-width: 24rem;
+	}
+</style>
+

src/routes/(angemeldet)/list/[vorgang]/+page.svelte

@@ -1,237 +0,0 @@
-<style>
-	ul {
-		min-width: 24rem;
-	}
-</style>
-
-<script>
-	import { onMount, tick } from 'svelte';
-	import shortenFileSize from '$lib/helper/shortenFileSize';
-	import { page } from '$app/stores';
-
-	import timeElapsed from '$lib/helper/timeElapsed';
-
-	/** @type {import('./$types').PageData} */
-	/** export let data; */
-
-	/**
-	 * @type any[]
-	 */
-	let list = [];
-	$: list;
-
-	let rename_input;
-	$: rename_input;
-
-	onMount(async () => {
-		const response = await fetch('/api/list/' + $page.params.vorgang);
-		const stream = response.body;
-		if (!stream) return;
-
-		const reader = stream.getReader();
-
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) return;
-
-			const objs = new TextDecoder()
-				.decode(value)
-				.split('\n')
-				.filter((i) => i.length > 0)
-				.map((i) => JSON.parse(i));
-
-			console.log(objs);
-			list = list.concat(objs);
-
-			list = list.map((item) => {
-				item.show_button = true;
-				return item;
-			})
-		}
-	});
-</script>
-
-<div class="-z-10 bg-white">
-	<div class="flex flex-col items-center justify-center w-full">
-		<h1 class="text-xl">Vorgang {$page.params.vorgang}</h1>
-	</div>
-	<div class="mx-auto flex justify-center max-w-7xl h-full">
-		<ul class="divide-y divide-gray-100">
-			{#each list as item}
-				<li>
-					<a
-						href="/view/{$page.params.vorgang}/{item.name}"
-						class="flex justify-between gap-x-6 py-5"
-					>
-						<div class="flex gap-x-4">
-							<svg
-								xmlns="http://www.w3.org/2000/svg"
-								fill="none"
-								viewBox="0 0 24 24"
-								stroke-width="1.5"
-								stroke="currentColor"
-								class="w-6 h-6"
-							>
-								<path
-									stroke-linecap="round"
-									stroke-linejoin="round"
-									d="M21 7.5l-2.25-1.313M21 7.5v2.25m0-2.25l-2.25 1.313M3 7.5l2.25-1.313M3 7.5l2.25 1.313M3 7.5v2.25m9 3l2.25-1.313M12 12.75l-2.25-1.313M12 12.75V15m0 6.75l2.25-1.313M12 21.75V19.5m0 2.25l-2.25-1.313m0-16.875L12 2.25l2.25 1.313M21 14.25v2.25l-2.25 1.313m-13.5 0L3 16.5v-2.25"
-								/>
-							</svg>
-							<div class="min-w-0 flex-auto">
-								<span
-								style="display: inline-block; min-width: 5px;"
-								id="label__{item.name}"
-								class="text-sm font-semibold leading-6 text-gray-900"
-								contenteditable={! item.button}
-								on:focusout={(event) => {
-									let text_field_id = `label__${item.name}`
-
-									let text_field = document.getElementById(text_field_id)
-									text_field.setAttribute("contenteditable", false)
-									text_field.textContent = item.name;
-
-									// reshow button
-									item.show_button = true
-									return;
-								}}
-								on:keydown|stopPropagation={async (event) => {
-									if (event.key == "Escape") {
-										let text_field_id = `label__${item.name}`
-
-										let text_field = document.getElementById(text_field_id)
-										text_field.setAttribute("contenteditable", false)
-										text_field.textContent = item.name;
-
-										// reshow button
-										item.show_button = true
-										return;
-									}
-									if (event.key == "Enter") {
-										console.log('--- hitted')
-										let name_field = event.currentTarget
-										let new_name = name_field.textContent || name_field.innerText || '';
-
-
-										if (new_name == '') {
-											alert('Bitte einen gültigen Namen eingeben.');
-											event.preventDefault();
-											return;
-										}
-
-										// actual upload
-										// -------------
-
-										// to prevent from item being selected
-										event.preventDefault();
-
-										// construct PUT URL
-										const url = $page.url
-										console.log(url);
-
-										let data_obj = {}
-										data_obj["new_name"] = new_name
-										data_obj["old_name"] = event.currentTarget.id.split('__')[1]
-
-										const response = await fetch(url,
-											{method: 'PUT', body: JSON.stringify( data_obj )
-										})
-
-
-										if (!response.ok) {
-											if (response.status == 400) {
-												let json_res = await response.json()
-												alert(json_res['msg'])
-												return;
-											}
-											throw new Error(`Fehlgeschlagen: ${response.status}`)
-										} else {
-											setTimeout(() => {window.location.reload()}, 500)
-										}
-
-										// --- upload finished ---
-
-										return;
-									}
-								}}
-
-								>{item.name}</span>
-								<!-- https://iconduck.com/icons/192863/edit-rename -->
-
-								{#if item.show_button}
-								<button
-								style="padding: 2px"
-								id="edit__{item.name}"
-								on:click|preventDefault={(ev) => {
-									let text_field_id = `label__${item.name}`
-
-									let text_field = document.getElementById(text_field_id)
-									text_field.setAttribute("contenteditable", true)
-									text_field.focus();
-									text_field.textContent = '';
-
-									// hide button
-									item.show_button = false
-								}}
-								>
-									<svg
-									height="20" width="20" xmlns="http://www.w3.org/2000/svg"><path d="m14.996094 3-11.9921878 11.992188h-.0039062v4.007812h1 2 1.0078125v-.0039l11.9921875-11.9921938-.001953-.0019531.001953-.0019531-4-4-.002.00195zm-1.998047 3.4121094 2.589844 2.5898437-7.587891 7.5878909v-1.589844h-1-1v-1-.589844zm-7.998047 7.9980466v1.589844h1 1v1 .589844l-.4101562.410156h-1.5898438l-1-1v-1.589844z" fill="#373737" transform="translate(1 1)"/></svg>
-								</button>
-								{/if}
-								<!-- Delete button -->
-								<button
-								style="padding: 2px"
-								id="del__{item.name}"
-								on:click|preventDefault={async (ev) => {
-									let delete_item = window.confirm("Bist du sicher?");
-
-									if (delete_item) {
-										// bucket: tatort, name: <vorgang>/item-name
-										let vorgang = $page.params.vorgang
-										let filename = event.currentTarget.id.split('del__')[1]
-
-
-
-										// delete request
-										// --------------
-
-										let url = $page.url
-										url += `/${filename}`
-
-										console.log(`--- ${vorgang} + ${filename} + ${url}`)
-										try {
-											const response = await fetch(url,
-												{method: 'DELETE'}
-											)
-											if (response.status == 204) {
-												setTimeout(() => {window.location.reload()}, 500)
-											}
-										} catch (error) {
-											console.log(error.message)
-										}
-
-									}
-								}}
-								>
-									<svg
-									height="20" width="20" xmlns="http://www.w3.org/2000/svg"><path d="m8 3v1 1h1v-1h4v1h1v-1-1zm-4 3v1h14v-1zm2 2v11h1 9v-1-10h-1v10h-8v-10z" fill="#373737" transform="translate(1 1)"/></svg>
-								</button>
-								<p class="mt-1 truncate text-xs leading-5 text-gray-500">
-									{shortenFileSize(item.size)}
-								</p>
-							</div>
-						</div>
-						<div class="hidden sm:flex sm:flex-col sm:items-end">
-							<p class="text-sm leading-6 text-gray-900">3D Tatort</p>
-							<p class="mt-1 text-xs leading-5 text-gray-500">
-								Zuletzt geändert <time datetime="2023-01-23T13:23Z"
-									>{timeElapsed(new Date(item.lastModified))}</time
-								>
-							</p>
-						</div>
-					</a>
-				</li>
-			{/each}
-		</ul>
-	</div>
-</div>

src/routes/(angemeldet)/list/[vorgang]/+server.js

@@ -1,36 +0,0 @@
-import { client } from '$lib/minio';
-import { json } from '@sveltejs/kit';
-
-
-
-export async function PUT({ request }) {
-    const data = await request.json();
-
-    console.log(`--- ${request.url.split('/').at(-1)} +++ ${JSON.stringify(data)}`);
-
-    // Vorgang
-    let vorgang = request.url.split('/').at(-1)
-
-    // prepare copy, incl. check if new name exists already
-    let old_name = data["old_name"]
-    let src_full_path = `/tatort/${vorgang}/${old_name}`
-    let new_name = `${vorgang}/${data["new_name"]}`
-
-    try {
-        let file_stats = await client.statObject('tatort', new_name)
-        return json({ msg: 'Die Datei existiert bereits.' }, { status: 400 })
-    } catch (error) {
-        // continue operation
-        console.log('continue operation')
-    }
-
-    // actual copy operation
-    await client.copyObject('tatort', new_name, src_full_path)
-
-    // delete
-    await client.removeObject('tatort', `${vorgang}/${old_name}`)
-
-    // return success or failure
-
-    return json({ success: 'SUCKZESS' }, { status: 200 });
-};

src/routes/(angemeldet)/list/[vorgang]/[tatort]/+server.js

@@ -1,13 +0,0 @@
-import { client } from '$lib/minio';
-import { json } from '@sveltejs/kit';
-
-export async function DELETE({ request }) {
-
-    let url_fragments = request.url.split('/')
-    let item = url_fragments.at(-1);
-    let vorgang = url_fragments.at(-2);
-
-    await client.removeObject('tatort', `${vorgang}/${item}`)
-
-    return new Response(null, { status: 204 });
-};

src/routes/(angemeldet)/tatorte/+page.server.js

@@ -1,37 +0,0 @@
-import { client } from '$lib/minio';
-import { fail } from '@sveltejs/kit';
-
-import caseNumberOccupied from '$lib/helper/caseNumberOccupied';
-
-/** @type {import('./$types').Actions} */
-export const actions = {
-	default: async ({ request }) => {
-		const data = await request.formData();
-		const caseNumber = data.get('caseNumber');
-		const description = data.get('description');
-
-		if (!caseNumber) {
-			return fail(400, {
-				caseNumber,
-				description,
-				error: { caseNumber: 'Es muss eine Vorgangsnummer vorhanden sein.' }
-			});
-		}
-
-		if (await caseNumberOccupied(`${caseNumber}`)) {
-			return fail(400, {
-				caseNumber,
-				description,
-				error: { caseNumber: 'Die Vorgangsnummer wurde im System bereits angelegt.' }
-			});
-		}
-
-		const config = `${JSON.stringify({ caseNumber, description, version: 1 })}\n`;
-
-		await client.putObject('tatort', `${caseNumber}/config.json`, config, {
-			'Content-Type': 'application/json'
-		});
-
-		return { success: true };
-	}
-};

src/routes/(angemeldet)/tatorte/+page.svelte

@@ -1,99 +0,0 @@
-<script>
-	import Alert from '$lib/components/ui/Alert.svelte';
-	import Button from '$lib/components/ui/Button.svelte';
-	import Modal from '$lib/components/ui/Modal/Modal.svelte';
-	import ModalTitle from '$lib/components/ui/Modal/ModalTitle.svelte';
-	import ModalContent from '$lib/components/ui/Modal/ModalContent.svelte';
-	import ModalFooter from '$lib/components/ui/Modal/ModalFooter.svelte';
-	import Exclamation from '$lib/icons/Exclamation.svelte';
-
-	export let form;
-
-	let open = false;
-	$: open = form?.success ?? false;
-</script>
-
-<div class="mx-auto max-w-2xl">
-	<div class="flex flex-col items-center justify-center w-full">
-		<h1 class="text-xl">Neuer Vorgang</h1>
-	</div>
-
-	<form method="POST">
-		<div class="space-y-12">
-			<div class="border-b border-gray-900/10 pb-12">
-				<p class="mt-8 text-sm leading-6 text-gray-600">
-					This information will be displayed publicly so be careful what you share.
-				</p>
-
-				<div class="mt-10 grid grid-cols-1 gap-x-6 gap-y-8">
-					<div>
-						<label for="caseNumber" class="block text-sm font-medium leading-6 text-gray-900"
-							><span class="flex"
-								>{#if form?.error?.caseNumber}
-									<span class="inline-block mr-1"><Exclamation /></span>
-								{/if} Vorgangs-Nr.</span
-							></label
-						>
-						<div class="mt-2">
-							<div
-								class="flex rounded-md shadow-sm ring-1 ring-inset ring-gray-300 focus-within:ring-2 focus-within:ring-inset focus-within:ring-indigo-600"
-							>
-								<input
-									value={form?.caseNumber ?? ''}
-									type="text"
-									name="caseNumber"
-									id="caseNumber"
-									class="block flex-1 border-0 bg-transparent py-1.5 pl-1 text-gray-900 placeholder:text-gray-400 focus:ring-0 text-sm leading-6"
-								/>
-							</div>
-						</div>
-						{#if form?.error?.caseNumber}
-							<p class="block text-sm leading-6 text-red-900 mt-2">{form.error.caseNumber}</p>
-						{/if}
-					</div>
-
-					<div>
-						<label for="description" class="block text-sm font-medium leading-6 text-gray-900"
-							><span class="flex"
-								>{#if form?.error?.description}
-									<span class="inline-block mr-1"><Exclamation /></span>
-								{/if} Beschreibung</span
-							></label
-						>
-						<div class="mt-2">
-							<textarea
-								value={form?.description ?? ''}
-								id="description"
-								name="description"
-								rows="3"
-								class="block w-full rounded-md border-0 py-1.5 text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 placeholder:text-gray-400 focus:ring-2 focus:ring-inset focus:ring-indigo-600 sm:text-sm sm:leading-6"
-							></textarea>
-						</div>
-						{#if form?.error?.description}
-							<p class="block text-sm leading-6 text-red-900 mt-2">{form.error.description}</p>
-						{/if}
-					</div>
-				</div>
-			</div>
-			<div class="mt-6 flex items-center justify-end gap-x-6">
-				<button type="button" class="text-sm font-semibold leading-6 text-gray-900">Cancel</button>
-				<Button
-					type="submit"
-					class="rounded-md bg-indigo-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-indigo-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600"
-					>Save</Button
-				>
-			</div>
-		</div>
-	</form>
-
-	<Modal {open}
-		><ModalTitle>vorgang anlegen</ModalTitle><ModalContent>
-			{#if form?.success}
-				<Alert class="w-full">Vorgang erfolgreich angelegt</Alert>
-			{:else}
-				<Alert class="w-full" type="error">Fehler beim Upload</Alert>
-			{/if}
-		</ModalContent>
-		<ModalFooter><Button on:click={() => (open = false)}>Ok</Button></ModalFooter>
-	</Modal>
-</div>

src/routes/(angemeldet)/upload/+page.server.ts

@@ -1,58 +1,60 @@
-import path from 'path';
-import { writeFile } from 'fs/promises';
-import { createReadStream } from 'fs';
-/** import Minio from 'minio'; */
 import { Readable } from 'stream';
-/** const MINIO_ACCESS_KEY = 'tMhLrfog47lMm0HZ'; */
-import { client } from '$lib/minio';
-import { fail } from '@sveltejs/kit';
+import { BUCKET, client } from '$lib/minio';
+import { fail, error } from '@sveltejs/kit';
 
-function isRequiredFieldValid(value) {
+import { getVorgangByName } from '$lib/server/vorgangService';
+
+const isRequiredFieldValid = (value: unknown) => {
 	if (value == null) return false;
 
 	if (typeof value === 'string' || value instanceof String) return value.trim() !== '';
 
 	return true;
-}
+};
 
-/** @type {import('./$types').Actions} */
 export const actions = {
-	url: async ({ request }) => {
+	url: async ({ request }: { request: Request }) => {
 		const data = await request.formData();
-		const vorgang = data.get('vorgang');
-		const name = data.get('name');
-		const type = data.get('type');
-		const fileName = data.get('fileName');
+		const vorgangName: string | null = data.get('vorgang') as string;
+		const crimeName: string | null = data.get('name') as string;
+		const type: string | null = data.get('type') as string;
+		const fileName: string | null = data.get('fileName') as string;
 
-		let objectName = `${vorgang}/${name}`;
+		let vorgangToken;
+		const vorgang = getVorgangByName(vorgangName);
+		vorgangToken = vorgang.token;
+
+		let objectName = `${vorgangToken}/${crimeName}`;
 		switch (type) {
 			case 'image/png':
 				if (!objectName.endsWith('.png')) objectName += '.png';
 				break;
 			case '':
-				if (fileName.endsWith('.glb') && !objectName.endsWith('.glb')) objectName += '.glb';
+				if (fileName?.toString().endsWith('.glb') && !objectName.endsWith('.glb'))
+					objectName += '.glb';
 		}
 
-		const url = await client.presignedPutObject('tatort', objectName);
+		const url = await client.presignedPutObject(BUCKET, objectName);
 
 		return { url };
 	},
-	validate: async ({ request }) => {
+	validate: async ({ request }: { request: Request }) => {
 		const requestData = await request.formData();
 		const data = Object.fromEntries(requestData);
 		const vorgang = data.vorgang;
 		const name = data.name;
 		let success = true;
-		let err = {};
-
-		if (isRequiredFieldValid(vorgang)) err.vorgang = null;
-		else {
+		const err = {};
+		if (isRequiredFieldValid(vorgang)) {
+			err.vorgang = null;
+		} else {
 			err.vorgang = 'Das Feld Vorgang darf nicht leer bleiben.';
 			success = false;
 		}
 
-		if (isRequiredFieldValid(name)) err.name = null;
-		else {
+		if (isRequiredFieldValid(name)) {
+			err.name = null;
+		} else {
 			err.name = 'Das Feld Name darf nicht leer bleiben.';
 			success = false;
 		}
@@ -62,27 +64,24 @@ export const actions = {
 		return fail(400, err);
 	},
 
-	upload: async ({ request }) => {
+	upload: async ({ request }: { request: Request }) => {
 		const requestData = await request.formData();
 		const data = Object.fromEntries(requestData);
 		const vorgang = data.vorgang;
 		const name = data.name;
-		console.log('I:', vorgang, name);
 
-		const url = await client.presignedPutObject('tatort', `${vorgang}/${name}`, 60);
+		const url = await client.presignedPutObject(BUCKET, `${vorgang}/${name}`, 60);
 
-		console.log('O:', url);
 		return { url };
 	},
-	upload3: async ({ request }) => {
+	upload3: async ({ request }: { request: Request }) => {
 		const requestData = await request.formData();
 		const data = Object.fromEntries(requestData);
 		const name = data.name;
 		const stream = data.file.stream();
-		console.log('Data:', stream);
 		const metaData = { 'Content-Type': 'model-gtlf-binary', 'X-VorgangsNr': '4711' };
 		const result = new Promise((resolve, reject) => {
-			client.putObject('tatort', name, Readable.from(stream), metaData, function (err, etag) {
+			client.putObject(BUCKET, name, Readable.from(stream), metaData, function (err, etag) {
 				if (err) return reject(err);
 				resolve(etag);
 			});
@@ -91,13 +90,18 @@ export const actions = {
 		let error = null;
 		try {
 			etag = await result;
-			console.log(etag);
 		} catch (err) {
 			error = err;
 			console.log('Error:', err);
 		}
 
 		return { etag, error };
-		//await writeFile(filePath, Buffer.from(await data.file.arrayBuffer()));
 	}
 };
+
+
+export const load: PageServerLoad = async (event) => {
+	if (!event.locals.user) {
+		error(404, 'Not found')
+	}
+};

src/routes/(angemeldet)/upload/+page.svelte

@@ -1,35 +1,50 @@
-<script>
-	import { deserialize, enhance } from '$app/forms';
-	import Alert from '$lib/components/ui/Alert.svelte';
-	import Button from '$lib/components/ui/Button.svelte';
-	import Modal from '$lib/components/ui/Modal/Modal.svelte';
-	import ModalTitle from '$lib/components/ui/Modal/ModalTitle.svelte';
-	import ModalContent from '$lib/components/ui/Modal/ModalContent.svelte';
-	import ModalFooter from '$lib/components/ui/Modal/ModalFooter.svelte';
+<script lang="ts">
+	import { deserialize } from '$app/forms';
+	import Alert from '$lib/components/Alert.svelte';
+	import Button from '$lib/components/Button.svelte';
+	import Modal from '$lib/components/Modal/Modal.svelte';
+	import ModalTitle from '$lib/components/Modal/ModalTitle.svelte';
+	import ModalContent from '$lib/components/Modal/ModalContent.svelte';
+	import ModalFooter from '$lib/components/Modal/ModalFooter.svelte';
 	import shortenFileSize from '$lib/helper/shortenFileSize.js';
 	import Exclamation from '$lib/icons/Exclamation.svelte';
+	import FileRect from '$lib/icons/File-rect.svelte';
+	import { API_ROUTES, ROUTE_NAMES } from '../../index.js';
 
 	export let form;
 
 	let open = false;
 	let inProgress = false;
 	let vorgang = '';
+	const PINLength = 8;
+
+	function generatePIN() {
+		return Math.random()
+			.toString(36)
+			.slice(2, 2 + PINLength);
+	}
+	let vorgangPIN = '';
+	let vorgangPINOld = '';
+	$: vorgangPINOld = generatePIN();
+	$: vorgangPIN = vorgangPINOld;
+
+	let vorgangExists = undefined;
+	$: vorgangExists = false;
+
 	let name = '';
-	/** @type {?string}*/
-	let etag = null;
-	/** @type {?FileList} */
-	let files = null;
+	let etag: string | null = null;
+	let files: FileList | null = null;
 
 	$: inProgress = form === null;
 
-	/** @type {?Record<string,any>}*/
-	let formErrors;
+	let formErrors: Record<string, any> | null;
 
 	async function validateForm() {
 		let data = new FormData();
 		data.append('vorgang', vorgang);
 		data.append('name', name);
-		const response = await fetch('?/validate', { method: 'POST', body: data });
+		data.append('vorgangPIN', vorgangPIN);
+		const response = await fetch(ROUTE_NAMES.UPLOAD_VALIDATE, { method: 'POST', body: data });
 		/** @type {import('@sveltejs/kit').ActionResult} */
 		const result = deserialize(await response.text());
 
@@ -41,12 +56,15 @@
 			success = false;
 		}
 
-		console.log('File', files);
 		if (!files?.length) {
 			formErrors = { file: 'Sie haben keine Datei ausgewählt.', ...formErrors };
 			success = false;
 		}
 
+		if (!(await check_valid_glb_file())) {
+			formErrors = { file: 'Keine gültige .GLD-Datei', ...formErrors };
+			success = false;
+		}
 		return success;
 	}
 
@@ -54,11 +72,12 @@
 		let data = new FormData();
 		data.append('vorgang', vorgang);
 		data.append('name', name);
+		data.append('vorgangPIN', vorgangPIN);
 		if (files?.length === 1) {
 			data.append('type', files[0].type);
 			data.append('fileName', files[0].name);
 		}
-		const response = await fetch('?/url', { method: 'POST', body: data });
+		const response = await fetch(ROUTE_NAMES.UPLOAD_URL, { method: 'POST', body: data });
 		/** @type {import('@sveltejs/kit').ActionResult} */
 		const result = deserialize(await response.text());
 		if (result.type === 'success') return result.data?.url;
@@ -66,14 +85,12 @@
 		return null;
 	}
 
-	/** @param {MouseEvent} event*/
-	async function buttonClick(event) {
+	async function buttonClick(event: MouseEvent) {
 		if (!(await validateForm())) {
 			event.preventDefault();
 			return;
 		}
 		const url = await getUrl();
-		console.log('URL', url);
 		open = true;
 		inProgress = true;
 
@@ -81,7 +98,6 @@
 			.then((response) => {
 				inProgress = false;
 				etag = '123';
-				console.log('SUCCESS', response);
 			})
 			.catch((err) => {
 				inProgress = false;
@@ -91,12 +107,94 @@
 	}
 
 	function uploadSuccessful() {
-		console.log('reset');
 		open = false;
 		vorgang = '';
 		name = '';
 		files = null;
 	}
+
+	// `val` is hex string
+	function swap_endian(val) {
+		// from https://www.geeksforgeeks.org/bit-manipulation-swap-endianness-of-a-number/
+
+		let leftmost_byte = (val & eval(0x000000ff)) >> 0;
+		let left_middle_byte = (val & eval(0x0000ff00)) >> 8;
+		let right_middle_byte = (val & eval(0x00ff0000)) >> 16;
+		let rightmost_byte = (val & eval(0xff000000)) >> 24;
+
+		leftmost_byte <<= 24;
+		left_middle_byte <<= 16;
+		right_middle_byte <<= 8;
+		rightmost_byte <<= 0;
+
+		let res = leftmost_byte | left_middle_byte | right_middle_byte | rightmost_byte;
+
+		return res;
+	}
+
+	async function check_valid_glb_file() {
+		// GLD Header, magic value 0x46546C67, identifies data as binary glTF, 4 bytes
+		// little endian!
+		const GLD_MAGIC = 0x46546c67;
+
+		// big endian!
+		let file = files[0];
+		let file_header = file.slice(0, 4);
+		console.log(file_header);
+		let header_bytes = await file_header.bytes();
+		let file_header_hex = '0x' + header_bytes.toHex().toString();
+
+		if (GLD_MAGIC == swap_endian(file_header_hex)) {
+			return true;
+		} else {
+			return false;
+		}
+		return true;
+	}
+
+	async function checkVorgangExists(vorgangName: string) {
+		if (vorgangName == '') {
+			vorgangPIN = vorgangPINOld;
+			return;
+		}
+
+		try {
+			// `HEAD` method
+			const url = API_ROUTES.VORGANG_NAME_EXIST(vorgangName);
+			const response = await fetch(url, { method: 'HEAD' });
+
+			if (response.status === 200) {
+				console.log('Vorgang existiert:', vorgangName);
+				vorgangExists = true;
+				const token = await getVorgangPIN(vorgangName);
+				vorgangPIN = token;
+				return true;
+			} else {
+				console.log('Vorgang existiert nicht!');
+				vorgangExists = false;
+				vorgangPIN = vorgangPINOld;
+				return false;
+			}
+		} catch (err) {
+			console.error('Fehler bei checkVorgangExists:', err);
+			vorgangExists = false;
+			vorgangPIN = vorgangPINOld;
+			return false;
+		}
+	}
+
+	async function getVorgangPIN(vorgangName: string) {
+		if (vorgangName == '') return;
+
+		let url = API_ROUTES.VORGANG_PIN(vorgangName);
+		const response = await fetch(url);
+
+		if (response.status == 200) {
+			return response.text();
+		} else {
+			return -1;
+		}
+	}
 </script>
 
 <div class="mx-auto max-w-2xl">
@@ -117,7 +215,7 @@
 							><span class="flex"
 								>{#if formErrors?.vorgang}
 									<span class="inline-block mr-1"><Exclamation /></span>
-								{/if} Vorgang</span
+								{/if} Vorgangsname</span
 							></label
 						>
 						<div class="mt-2">
@@ -131,12 +229,18 @@
 									id="vorgang"
 									autocomplete={vorgang}
 									class="block flex-1 border-0 bg-transparent py-1.5 pl-1 text-gray-900 placeholder:text-gray-400 focus:ring-0 sm:text-sm sm:leading-6"
+									on:input={() => checkVorgangExists(vorgang)}
 								/>
 							</div>
 						</div>
 						{#if formErrors?.vorgang}
 							<p class="block text-sm leading-6 text-red-900 mt-2">{formErrors.vorgang}</p>
 						{/if}
+						{#if vorgangExists && vorgang.length > 0}
+							<span>Datei wird zum existierenden Vorgang hinzugefügt.</span>
+						{:else if vorgang.length > 0}
+							<span>Neuer Vorgang wird angelegt.</span>
+						{/if}
 					</div>
 
 					<div>
@@ -144,7 +248,7 @@
 							><span class="flex"
 								>{#if formErrors?.name}
 									<span class="inline-block mr-1"><Exclamation /></span>
-								{/if} Name</span
+								{/if} Modellname</span
 							></label
 						>
 						<div class="mt-2">
@@ -166,6 +270,44 @@
 						{/if}
 					</div>
 
+					<div>
+						<label for="vorgang-pin" class="block text-sm font-medium leading-6 text-gray-900"
+							><span class="flex"
+								>{#if formErrors?.vorgangPIN}
+									<span class="inline-block mr-1"><Exclamation /></span>
+								{/if} Zugangs-PIN</span
+							></label
+						>
+						<div class="mt-2">
+							<div
+								class="flex rounded-md shadow-sm ring-1 ring-inset ring-gray-300 focus-within:ring-2 focus-within:ring-inset focus-within:ring-indigo-600"
+							>
+								<input
+									bind:value={vorgangPIN}
+									type="text"
+									name="vorgang-pin"
+									id="vorgang-pin"
+									on:input={(ev) => {
+										vorgangPINOld = ev.target.value;
+									}}
+									class="block flex-1 border-0 bg-transparent py-1.5 pl-1 text-gray-900 placeholder:text-gray-400 focus:ring-0 sm:text-sm sm:leading-6"
+								/>
+							</div>
+							<button
+								class="rounded-md bg-blue-500 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-indigo-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600"
+								on:click={() => {
+									vorgangPIN = vorgangPINOld = generatePIN();
+								}}
+								type="button"
+							>
+								Generiere Zugangs-PIN
+							</button>
+						</div>
+						{#if formErrors?.vorgangPIN}
+							<p class="block text-sm leading-6 text-red-900 mt-2">{formErrors.vorgangPIN}</p>
+						{/if}
+					</div>
+
 					<div class="col-span-full">
 						<label for="file" class="block text-sm font-medium leading-6 text-gray-900"
 							><span class="flex"
@@ -178,18 +320,7 @@
 							class="mt-2 flex justify-center rounded-lg border border-dashed border-gray-900/25 px-6 py-10"
 						>
 							<div class="text-center">
-								<svg
-									class="mx-auto h-12 w-12 text-gray-300"
-									viewBox="0 0 24 24"
-									fill="currentColor"
-									aria-hidden="true"
-								>
-									<path
-										fill-rule="evenodd"
-										d="M1.5 6a2.25 2.25 0 012.25-2.25h16.5A2.25 2.25 0 0122.5 6v12a2.25 2.25 0 01-2.25 2.25H3.75A2.25 2.25 0 011.5 18V6zM3 16.06V18c0 .414.336.75.75.75h16.5A.75.75 0 0021 18v-1.94l-2.69-2.689a1.5 1.5 0 00-2.12 0l-.88.879.97.97a.75.75 0 11-1.06 1.06l-5.16-5.159a1.5 1.5 0 00-2.12 0L3 16.061zm10.125-7.81a1.125 1.125 0 112.25 0 1.125 1.125 0 01-2.25 0z"
-										clip-rule="evenodd"
-									/>
-								</svg>
+								<FileRect />
 								<div class="mt-4 flex text-sm leading-6 text-gray-600">
 									<label
 										for="file"

src/routes/(angemeldet)/user-management/+page.server.ts

@@ -0,0 +1,8 @@
+import type { PageServerLoad } from '../../(token-based)/view/$types';
+import { error } from '@sveltejs/kit';
+
+export const load: PageServerLoad = async (event) => {
+	if (!event.locals.user) {
+		error(404, 'Not Found')
+	}
+};

src/routes/(angemeldet)/user-management/+page.svelte

@@ -0,0 +1,211 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import Button from '$lib/components/Button.svelte';
+	import { API_ROUTES } from '../../index.js';
+
+	const { data } = $props();
+
+	let userName = $state('');
+	let userPassword = $state('');
+	let userList: { userId: string; userName: string }[] = $state([]);
+	let addUserError = $state(false);
+	let addUserSuccess = $state(false);
+	const currentUser: string = data.user.id;
+
+	onMount(async () => {
+		try {
+			userList = await getUsers();
+		} catch (error) {
+			console.log(`An error occured while retrieving users: ${error}`);
+		}
+	});
+
+	async function getUsers() {
+		const URL = API_ROUTES.USERS;
+
+		try {
+			const response = await fetch(URL);
+			return await response.json();
+		} catch (error) {
+			console.log(`Error fetching users: ${error}`);
+			return null;
+		}
+	}
+
+	async function addUser() {
+		if (userName == '') {
+			alert('Der Benutzername darf nicht leer sein.');
+			return;
+		}
+
+		if (userPassword == '') {
+			alert('Das Passwort darf nicht leer sein.');
+			return;
+		}
+
+		const URL = API_ROUTES.USERS;
+		const userData = { userName: userName, userPassword: userPassword };
+
+		try {
+			const response = await fetch(URL, {
+				method: 'POST',
+				headers: {
+					'Content-Type': 'application/json'
+				},
+				body: JSON.stringify(userData)
+			});
+
+			if (response.ok) {
+				const newUser = await response.json();
+				userList = [...userList, newUser];
+				addUserSuccess = true;
+				resetInput();
+			} else {
+				addUserError = true;
+			}
+		} catch (error) {
+			console.log(`Error creating user: ${error}`);
+			addUserError = true;
+		}
+	}
+
+	function resetInput() {
+		userName = '';
+		userPassword = '';
+		addUserError = false;
+		setInterval(() => {
+			addUserSuccess = false;
+		}, 5000);
+	}
+
+	async function deleteUser(userId: string) {
+		const URL = API_ROUTES.USER(userId);
+
+		try {
+			const response = await fetch(URL, {
+				method: 'DELETE',
+				headers: {
+					'Content-Type': 'application/json'
+				}
+			});
+
+			if (response.status == 204) {
+				userList = await getUsers();
+			} else {
+				alert('Nutzer konnte nicht gelöscht werden');
+			}
+
+		} catch (error) {
+			console.log(`Error deleting users: ${error}`);
+		}
+	}
+
+</script>
+
+<h1 class="flex justify-center text-3xl md:text-4xl font-bold text-gray-800 dark:text-white tracking-tight mb-4">
+	Benutzerverwaltung
+</h1>
+
+<h1 class="flex justify-center text-lg md:text-xl font-medium text-gray-800 dark:text-white tracking-tight mb-2">
+	Benutzerliste
+</h1>
+
+<div class="w-1/4 mx-auto">
+	<table class="min-w-full border border-gray-300 rounded overflow-hidden">
+		<thead class="bg-gray-100 dark:bg-gray-700">
+		<tr>
+			<th class="text-left px-4 py-2">Benutzername</th>
+			<th class="text-center px-4 py-2">Entfernen</th>
+		</tr>
+		</thead>
+		<tbody>
+		{#each userList as userItem}
+			<tr class="border-t border-gray-200 dark:border-gray-600">
+				<td class="px-4 py-2 text-gray-800 dark:text-white">{userItem.userName}</td>
+				<td class="px-4 py-2 text-center">
+					<button
+						class="text-red-600 hover:text-red-800 focus:outline-none focus:ring-2 focus:ring-red-500 rounded-full p-1 transition"
+						on:click={() => deleteUser(userItem.userId)}
+						aria-label="Delete user"
+					>
+						{#if (userItem.userName != currentUser)}
+							<svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4" fill="none" viewBox="0 0 24 24"
+									 stroke="currentColor">
+								<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+											d="M6 18L18 6M6 6l12 12" />
+							</svg>
+						{/if}
+					</button>
+				</td>
+			</tr>
+		{/each}
+		</tbody>
+	</table>
+</div>
+
+<h1 style="margin-top: 50px;"
+		class="flex justify-center text-lg md:text-xl font-medium text-gray-800 dark:text-white tracking-tight mb-2">
+	Neuer Nutzer
+</h1>
+
+<div class="mx-auto flex justify-center">
+	<form>
+		<div class="form-group">
+			<label for="username">Benutzername</label>
+			<input bind:value={userName} type="text" id="username" placeholder="Namen eingeben" />
+		</div>
+
+		<div class="form-group">
+			<label for="password">Passwort</label>
+			<input bind:value={userPassword} type="password" id="password" placeholder="Passwort vergeben" />
+		</div>
+	</form>
+</div>
+
+<div class="mx-auto flex flex-col items-center space-y-4" style="margin-top: 20px;">
+	{#if addUserError}
+		<div class="flex items-center bg-yellow-100 border-l-4 border-yellow-500 text-yellow-700 p-4 rounded shadow-sm"
+				 role="alert">
+			<svg class="h-5 w-5 mr-3 text-yellow-500" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
+					 stroke="currentColor">
+				<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+							d="M12 9v2m0 4h.01M12 5a7 7 0 100 14 7 7 0 000-14z" />
+			</svg>
+			<span class="text-sm font-medium">Der Benutzer konnte nicht hinzugefügt werden.</span>
+		</div>
+	{/if}
+	{#if addUserSuccess}
+		<div class="flex items-center bg-yellow-100 border-l-4 border-yellow-500 text-yellow-700 p-4 rounded shadow-sm"
+				 role="alert">
+			<svg class="h-5 w-5 mr-3 text-yellow-500" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
+					 stroke="currentColor">
+				<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+							d="M12 9v2m0 4h.01M12 5a7 7 0 100 14 7 7 0 000-14z" />
+			</svg>
+			<span class="text-sm font-medium">Der Benutzer wurde hinzugefügt.</span>
+		</div>
+	{/if}
+
+	<Button on:click={addUser}>Benutzer hinzufügen</Button>
+</div>
+
+<style>
+    .form-group {
+        display: flex;
+        flex-direction: column;
+        margin-bottom: 15px;
+    }
+
+    label {
+        margin-bottom: 5px;
+        font-weight: bold;
+    }
+
+    input[type="text"],
+    input[type="password"] {
+        padding: 8px;
+        font-size: 16px;
+        border: 1px solid #ccc;
+        border-radius: 4px;
+    }
+</style>

src/routes/(angemeldet)/view/+page.server.js

@@ -1,27 +0,0 @@
-import caseNumberOccupied from '$lib/helper/caseNumberOccupied';
-import { fail, redirect } from '@sveltejs/kit';
-
-/** @type {import('./$types').Actions} */
-export const actions = {
-	default: async ({ request }) => {
-		const data = await request.formData();
-		const caseNumber = data.get('caseNumber');
-
-		if (!caseNumber) {
-			return fail(400, {
-				success: false,
-				caseNumber,
-				error: { caseNumber: 'Die Vorgangsnummer darf nicht leer sein.' }
-			});
-		}
-
-		if (!(await caseNumberOccupied(caseNumber))) {
-			return fail(400, {
-				success: false,
-				caseNumber,
-				error: { caseNumber: 'Die Vorgangsnummer existiert in dieser Anwendung nicht.' }
-			});
-		}
-		throw redirect(303, `/list/${caseNumber}`);
-	}
-};

src/routes/(angemeldet)/view/+page.svelte

@@ -1,64 +0,0 @@
-<script>
-	import Alert from '$lib/components/ui/Alert.svelte';
-	import Button from '$lib/components/ui/Button.svelte';
-	import Modal from '$lib/components/ui/Modal/Modal.svelte';
-	import ModalTitle from '$lib/components/ui/Modal/ModalTitle.svelte';
-	import ModalContent from '$lib/components/ui/Modal/ModalContent.svelte';
-	import ModalFooter from '$lib/components/ui/Modal/ModalFooter.svelte';
-	import Exclamation from '$lib/icons/Exclamation.svelte';
-
-	export let form;
-</script>
-
-<div class="mx-auto max-w-2xl">
-	<div class="flex flex-col items-center justify-center w-full">
-		<h1 class="text-xl">Vorgang ansehen</h1>
-	</div>
-
-	<form method="POST">
-		<div class="space-y-12">
-			<div class="border-b border-gray-900/10 pb-12">
-				<!-- <h2 class="text-base font-semibold leading-7 text-gray-900">Profile</h2> -->
-				<p class="mt-8 text-sm leading-6 text-gray-600">
-					Anhand der Vorgangsnummer werden Sie zu den Dateien des Vorgangs weitergeleitet und können
-					sich den Vorgang dann ansehen.
-				</p>
-
-				<div class="mt-10 grid grid-cols-1 gap-x-6 gap-y-8">
-					<div>
-						<label for="caseNumber" class="block text-sm font-medium leading-6 text-gray-900"
-							><span class="flex"
-								>{#if form?.error?.caseNumber}
-									<span class="inline-block mr-1"><Exclamation /></span>
-								{/if} Vorgangs-Nr.</span
-							></label
-						>
-						<div class="mt-2 w-full">
-							<div
-								class="flex w-full rounded-md shadow-sm ring-1 ring-inset ring-gray-300 focus-within:ring-2 focus-within:ring-inset focus-within:ring-indigo-600"
-							>
-								<input
-									value={form?.caseNumber ?? ''}
-									type="text"
-									name="caseNumber"
-									id="caseNumber"
-									class="block w-full flex-1 border-0 bg-transparent py-1.5 pl-1 text-gray-900 placeholder:text-gray-400 focus:ring-0 sm:text-sm sm:leading-6"
-								/>
-							</div>
-						</div>
-						{#if form?.error?.caseNumber}
-							<p class="block text-sm leading-6 text-red-900 mt-2">{form.error.caseNumber}</p>
-						{/if}
-					</div>
-				</div>
-			</div>
-			<div class="mt-6 flex items-center justify-end gap-x-6">
-				<Button
-					type="submit"
-					class="rounded-md bg-indigo-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-indigo-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600"
-					>Weiter</Button
-				>
-			</div>
-		</div>
-	</form>
-</div>

src/routes/(angemeldet)/view/[vorgang]/[tatort]/+page.server.js

@@ -1,8 +0,0 @@
-import { client } from '$lib/minio';
-
-/** @type {import('./$types').PageServerLoad} */
-export async function load({ params }) {
-	const { vorgang, tatort } = params;
-	const url = await client.presignedUrl('GET', 'tatort', `${vorgang}/${tatort}`);
-	return { url };
-}

src/routes/(angemeldet)/view/[vorgang]/[tatort]/+page.svelte

@@ -1,55 +0,0 @@
-<style>
-	model-viewer {
-		height: 100%;
-		width: 100%;
-	}
-</style>
-
-<script>
-	import { preloadCode } from '$app/navigation';
-	import Panel from '$lib/components/ui/Panel.svelte';
-	import { onMount } from 'svelte';
-	export let data;
-
-	onMount(() => {
-		import('@google/model-viewer');
-	});
-
-	let progress = 0;
-	let hideProgressScreen = false;
-	$: style = `width: ${progress}%`;
-
-	function onProgress({ detail }) {
-		progress = Math.ceil(detail.totalProgress * 100.0);
-		if (progress == 100) {
-			setTimeout(() => {
-				hideProgressScreen = true;
-			}, 250);
-		} else hideProgressScreen = false;
-	}
-</script>
-
-<div class="h-full w-full bg-neutral-100 p-4">
-	<model-viewer
-		src={data.url}
-		camera-controls
-		field-of-view="auto"
-		max-field-of-view="10deg"
-		min-field-of-view="0.1deg"
-		on:progress={onProgress}
-	>
-		<div
-			slot="progress-bar"
-			class="flex items-center justify-center h-full w-full transition-all delay-250"
-			class:opacity-0={hideProgressScreen}
-			class:hidden={hideProgressScreen}
-		>
-			<Panel class="w-72 bg-gray-50 flex items-center flex-col"
-				><p class="mb-5">Loading {progress}%</p>
-				<div class="h-1 w-full bg-neutral-200 dark:bg-neutral-600">
-					<div class="h-1 bg-blue-500" {style} ></div>
-				</div></Panel
-			>
-		</div>
-	</model-viewer>
-</div>

src/routes/(token-based)/+layout.server.ts

@@ -0,0 +1,22 @@
+import { vorgangPINValidation, vorgangExists } from '$lib/server/vorgangService';
+import { redirect } from '@sveltejs/kit';
+import type { LayoutServerLoad } from './$types';
+import { ROUTE_NAMES } from '..';
+
+export const load: LayoutServerLoad = async ({ params, cookies, locals }) => {
+	if (locals.user) {
+		return {
+			user: locals.user
+		};
+	}
+
+	const vorgangToken = params.vorgang ?? '';
+	const COOKIE_NAME = `token-${vorgangToken}`;
+	const vorgangPIN = cookies.get(COOKIE_NAME) ?? '';
+
+	const isVorgangValid = vorgangExists(vorgangToken);
+	const isVorgangPINValid = vorgangPINValidation(vorgangToken, vorgangPIN);
+
+	if (!isVorgangValid || !isVorgangPINValid)
+		throw redirect(303, ROUTE_NAMES.ANMELDUNG_VORGANG_PARAM(vorgangToken));
+};

src/routes/(token-based)/+layout.svelte

@@ -0,0 +1,16 @@
+<script lang="ts">
+	import Footer from '$lib/components/Footer.svelte';
+	import Header from '$lib/components/Header.svelte';
+
+	export let data;
+</script>
+
+<div class="h-screen v-screen flex flex-col">
+	<Header {data} />
+
+	<div class="mt-10 flex-grow items-center justify-center">
+		<slot />
+	</div>
+
+	<Footer {data} />
+</div>

src/routes/(token-based)/list/[vorgang]/+page.server.ts

@@ -0,0 +1,23 @@
+import { getCrimesListByToken, getVorgaenge } from '$lib/server/vorgangService.js';
+import type { PageServerLoad } from './$types';
+
+export const load: PageServerLoad = async ({ params, url }) => {
+	const vorgangList = getVorgaenge();
+	const vorgangToken = params.vorgang;
+	const crimesList = await getCrimesListByToken(vorgangToken);
+	const vorgang = vorgangList.find((v) => v.vorgangToken === vorgangToken); //vorgang sollte ein eigener Typ werden, und dann kann man es hier vernünftig typisieren
+	if (!vorgang || !crimesList) {
+		throw new Error(`Fehlgeschlagen, es wurden keine Daten zum token gefunden`);
+	}
+
+	//Variabeln für NameItemEditor
+	const crimeNames: string[] = crimesList.map((l) => l.name);
+
+	return {
+		vorgang,
+		vorgangList,
+		crimesList,
+		url,
+		crimeNames
+	};
+}

src/routes/(token-based)/list/[vorgang]/+page.svelte

@@ -0,0 +1,530 @@
+<script lang="ts">
+    import { fade } from 'svelte/transition';
+	import shortenFileSize from '$lib/helper/shortenFileSize';
+	import timeElapsed from '$lib/helper/timeElapsed';
+	import { deserialize } from '$app/forms';
+	import ExpandableForm from '$lib/components/ExpandableForm.svelte';
+	import Alert from '$lib/components/Alert.svelte';
+	import Button from '$lib/components/Button.svelte';
+	import Modal from '$lib/components/Modal/Modal.svelte';
+	import ModalTitle from '$lib/components/Modal/ModalTitle.svelte';
+	import ModalContent from '$lib/components/Modal/ModalContent.svelte';
+	import ModalFooter from '$lib/components/Modal/ModalFooter.svelte';
+	import Cube from '$lib/icons/Cube.svelte';
+	import { invalidateAll } from '$app/navigation';
+	import NameItemEditor from '$lib/components/NameItemEditor.svelte';
+	import EmptyList from '$lib/components/EmptyList.svelte';
+	import FileRect from '$lib/icons/File-rect.svelte';
+	import Exclamation from '$lib/icons/Exclamation.svelte';
+	import { API_ROUTES, ROUTE_NAMES } from '../../../index.js';
+
+	//Seite für die Tatort-Liste
+	let { data, form } = $props();
+
+	interface ListItem {
+		//sollte Typ Vorgang sein, aber der einfachheit ist es noch ListItem, damit die Komponente NameItemEditor für Vorgang und Tatort eingesetzt werden kann
+		name: string;
+		size: number;
+		lastModified: string | number | Date;
+		show_button?: boolean;
+		prefix?: string;
+		// add other properties as needed
+	}
+
+	let crimesList = $state<ListItem[]>(data.crimesList);
+	let vorgangName: string = data.vorgang.vorgangName;
+	const vorgangPIN: string = data.vorgang.vorgangPIN;
+	let vorgangToken: string = data.vorgang.vorgangToken;
+	let isEmptyList = $derived(crimesList.length === 0);
+
+	// File Upload Variablen
+	let name = $state('');
+	let formErrors: Record<string, any> | null = $state(null);
+	let etag: string | null = $state(null);
+	let files: FileList | null = $state(null);
+	let fileInput = $state(null);
+
+	// Model Variablen für Upload
+	let openUL = $state(false);
+	let inProgressUL = $state(form === null);
+	
+	// Variablen für Copy-Funktion
+    let copied = $state(false);
+
+	async function buttonClick(event: MouseEvent) {
+		if (!(await validateForm())) {
+			event.preventDefault();
+			return;
+		}
+		const url = await getUrl();
+		openUL = true;
+		inProgressUL = true;
+
+		fetch(url, { method: 'PUT', body: files[0] })
+			.then((response) => {
+				inProgressUL = false;
+				etag = '123';
+			})
+			.catch((err) => {
+				inProgressUL = false;
+				etag = null;
+				console.log('ERROR', err);
+			});
+	}
+
+	async function validateForm() {
+		let data = new FormData();
+		data.append('vorgang', vorgangName);
+		data.append('name', name);
+		const response = await fetch(ROUTE_NAMES.UPLOAD_VALIDATE, { method: 'POST', body: data });
+		const result = deserialize(await response.text());
+
+		let success = true;
+		if (result.type === 'success') {
+			formErrors = null;
+		} else {
+			if (result.type === 'failure' && result.data) formErrors = result.data;
+			success = false;
+		}
+
+		if (!files?.length) {
+			formErrors = { file: 'Sie haben keine Datei ausgewählt.', ...formErrors };
+			success = false;
+		}
+
+		if (!(await check_valid_glb_file())) {
+			formErrors = { file: 'Keine gültige .GLD-Datei', ...formErrors };
+			success = false;
+		}
+		return success;
+	}
+
+	async function uploadSuccessful() {
+		openUL = false;
+		name = '';
+		files = null;
+		fileInput.value = "";
+		await invalidateAll();
+		crimesList = data.crimesList;
+	}
+
+	// `val` is hex string
+	function swap_endian(val) {
+		// from https://www.geeksforgeeks.org/bit-manipulation-swap-endianness-of-a-number/
+
+		let leftmost_byte = (val & eval(0x000000ff)) >> 0;
+		let left_middle_byte = (val & eval(0x0000ff00)) >> 8;
+		let right_middle_byte = (val & eval(0x00ff0000)) >> 16;
+		let rightmost_byte = (val & eval(0xff000000)) >> 24;
+
+		leftmost_byte <<= 24;
+		left_middle_byte <<= 16;
+		right_middle_byte <<= 8;
+		rightmost_byte <<= 0;
+
+		let res = leftmost_byte | left_middle_byte | right_middle_byte | rightmost_byte;
+
+		return res;
+	}
+
+	async function check_valid_glb_file() {
+		// GLD Header, magic value 0x46546C67, identifies data as binary glTF, 4 bytes
+		// little endian!
+		const GLD_MAGIC = 0x46546c67;
+
+		// big endian!
+		let file = files[0];
+		const fileHeader = file.slice(0, 4);
+		const buffer = await fileHeader.arrayBuffer();
+		console.log(fileHeader);
+		let headerBytes = new Uint8Array(buffer);
+		let fileHeaderHex = '0x' + headerBytes.toHex().toString();
+
+		if (GLD_MAGIC == swap_endian(fileHeaderHex)) {
+			return true;
+		} else {
+			return false;
+		}
+	}
+
+	async function getUrl() {
+		let data = new FormData();
+		data.append('vorgang', vorgangName);
+		data.append('name', name);
+		if (files?.length === 1) {
+			data.append('type', files[0].type);
+			data.append('fileName', files[0].name);
+		}
+		const response = await fetch(ROUTE_NAMES.UPLOAD_URL, { method: 'POST', body: data });
+		const result = deserialize(await response.text());
+		if (result.type === 'success') return result.data?.url;
+
+		return null;
+	}
+
+	//Variablen für Modal
+	let open = $state(false);
+	let inProgress = $state(false);
+	let isError = $state(false);
+
+	let admin = data?.user?.admin;
+
+	async function handleSave(newName: string, oldName: string) {
+		open = true;
+		inProgress = true;
+		isError = false;
+		try {
+			const res = await fetch(API_ROUTES.CRIME(vorgangToken, oldName), {
+				method: 'PUT',
+				headers: {
+					'Content-Type': 'application/json'
+				},
+				body: JSON.stringify({ vorgangToken, oldName, newName })
+			});
+
+			if (!res.ok) {
+				throw new Error('Fehler beim Speichern');
+			}
+			await invalidateAll();
+			crimesList = data.crimesList;
+			open = false;
+		} catch (err) {
+			console.error('⚠️ Netzwerkfehler beim Speichern', err);
+			isError = true;
+		} finally {
+			inProgress = false;
+		}
+	}
+
+	async function savePIN(newVorgangPIN: string, oldVorgangPIN: string) {
+		open = true;
+		inProgress = true;
+		isError = false;
+		try {
+			const res = await fetch(API_ROUTES.VORGANG(vorgangToken), {
+				method: 'PUT',
+				headers: {
+					'Content-Type': 'application/json'
+				},
+				body: JSON.stringify({ vorgangToken, oldVorgangPIN, newVorgangPIN,
+										changePIN: true})
+			});
+
+			if (!res.ok) {
+				throw new Error('Fehler beim Speichern');
+			}
+			await invalidateAll();
+			crimesList = data.crimesList;
+			open = false;
+		} catch (err) {
+			console.error('⚠️ Netzwerkfehler beim Speichern', err);
+			isError = true;
+		} finally {
+			inProgress = false;
+		}
+	}
+
+	async function handleDelete(tatort: string) {
+		open = true;
+		inProgress = true;
+		isError = false;
+		let path = API_ROUTES.CRIME(vorgangToken, tatort)
+
+		try {
+			const res = await fetch(path, {
+				method: 'DELETE',
+				headers: {
+					'Content-Type': 'application/json'
+				},
+				body: JSON.stringify({ vorgangToken, tatort })
+			});
+
+			if (!res.ok) {
+				throw new Error('Fehler beim Löschen');
+			}
+			crimesList = crimesList.filter((i) => i.name !== tatort);
+			await invalidateAll();
+			console.log('🗑️ Erfolgreich gelöscht:', path);
+			open = false;
+		} catch (err) {
+			console.error('⚠️ Netzwerkfehler beim Speichern', err);
+			isError = true;
+		} finally {
+			inProgress = false;
+		}
+	}
+
+	async function copyAndOpenMail() {
+		const subject = 'Link zum Tatvorgang';
+		const link = data.url.origin + data.url.pathname;
+		const body = `Hallo,
+
+hier ist der Link zum Tatvorgang:
+${link}
+
+Der Zugangs-PIN wird zur Sicherheit über einen zweiten Kommunikationskanal übermittelt.
+
+Mit freundlichen Grüßen,
+`;
+
+    try {
+        await navigator.clipboard.writeText(body);
+        
+        copied = true;
+
+        // Kurz warten, dann Mail öffnen
+        setTimeout(() => {
+            const mailtoLink = `mailto:?subject=${encodeURIComponent(subject)}`;
+            window.location.href = mailtoLink;
+        }, 1000);
+        
+        setTimeout(() => copied = false, 2000);
+    } catch (err) {
+        console.error('Clipboard-Fehler:', err);
+        error = 'Konnte Text nicht kopieren. Bitte manuell markieren und kopieren.';
+        }
+    }
+
+	function closeModal() {
+		open = false;
+		isError = false;
+	}
+
+	// drag and drop functionality
+		let isDragging = $state(false);
+
+		async function handleDrop(event) {
+			event.preventDefault();
+			isDragging = false;
+
+			if (event.dataTransfer?.files?.length) {
+				files = event.dataTransfer.files;
+			}
+			if (!(await check_valid_glb_file())) {
+				formErrors = { file: 'Keine gültige .GLD-Datei' }
+				// reset form fields etc.
+				files = null;
+				fileInput.value = '';
+			} else {
+				formErrors = { ...formErrors, file: ''}
+			};
+		}
+
+</script>
+
+<svelte:window
+	on:dragover|preventDefault
+	on:drop|preventDefault
+/>
+
+{#if data.vorgang && crimesList}
+	<div class="-z-10 bg-white">
+		<div class="flex flex-col items-center justify-center w-full">
+			<h1 class="text-xl">{vorgangName}</h1>
+
+			{#if admin}
+				<div class="flex items-center gap-2">
+				Zugangs-PIN:
+				<NameItemEditor
+				list={[]}
+				currentName={vorgangPIN}
+				onSave={savePIN}
+				onDelete={null}
+				/>
+				</div>
+                <Button variant="secondary" on:click={copyAndOpenMail} disabled={isEmptyList}>Link kopieren und Mail verfassen</Button>
+                {#if copied}
+                <p transition:fade>✔ Kopiert! Per Ctrl+V einfügen.</p>
+                {/if}
+			{/if}
+		</div>
+		<div class="mx-auto flex justify-center max-w-7xl h-full">
+			<ul class="divide-y divide-gray-100">
+				{#if isEmptyList}
+					<EmptyList></EmptyList>
+				{:else}
+					{#each crimesList as item (item.name)}
+					<li
+					data-testid="test-list-item"
+					class="flex items-center justify-between gap-6 py-4 px-2 hover:bg-gray-50 rounded-lg transition"
+					>
+					<div class="flex items-center gap-4 flex-1">
+						<a
+						data-testid="crime-link"
+						href="{ROUTE_NAMES.CRIME(vorgangToken, item.name, vorgangPIN)}"
+						class="flex items-center justify-center w-8 h-8 text-gray-600 hover:text-blue-600 transition"
+						aria-label="{ROUTE_NAMES.CRIME(vorgangToken, item.name, vorgangPIN)}"
+						title={item.name}
+						>
+						<Cube class="w-5 h-5" />
+						</a>
+
+						<div class="flex flex-col flex-1 min-w-0">
+						{#if admin}
+							<NameItemEditor
+							list={crimesList}
+							currentName={item.name}
+							onSave={handleSave}
+							onDelete={handleDelete}
+							/>
+						{:else}
+							<p
+							data-testid="test-nameItem-p"
+							class="text-sm font-semibold leading-6 text-gray-900 truncate"
+							>
+							{item.name}
+							</p>
+						{/if}
+
+						<!-- size left, last modified right -->
+						<div class="flex items-center justify-between mt-1 text-xs leading-5 text-gray-500">
+							{#if item.size}
+							<span>{shortenFileSize(item.size)}</span>
+							{:else}
+							<span></span>
+							{/if}
+							{#if item.lastModified}
+							<span>
+								Zuletzt geändert
+								<time datetime={item.lastModified}>
+								{timeElapsed(new Date(item.lastModified))}
+								</time>
+							</span>
+							{/if}
+						</div>
+						</div>
+					</div>
+					</li>
+					{/each}
+				{/if}
+			</ul>
+		</div>
+
+		{#if admin}
+		<div class="flex justify-center my-4">
+		<ExpandableForm>
+			<div class="mx-auto max-w-2xl">
+				<div class="flex flex-col items-center space-y-6">
+					<!-- Name Input -->
+					<div class="w-full max-w-md">
+						<label for="name" class="block text-sm font-medium leading-6 text-gray-900">
+							<span class="flex">
+								{#if formErrors?.name}
+									<span class="inline-block mr-1"><Exclamation /></span>
+								{/if} Modellname
+							</span>
+						</label>
+						<div class="mt-2">
+							<div
+								class="flex rounded-md shadow-sm ring-1 ring-inset ring-gray-300 focus-within:ring-2 focus-within:ring-inset focus-within:ring-indigo-600"
+							>
+								<input
+									bind:value={name}
+									type="text"
+									name="name"
+									id="name"
+									autocomplete={name}
+									class="block flex-1 border-0 bg-transparent py-1.5 pl-1 text-gray-900 placeholder:text-gray-400 focus:ring-0 sm:text-sm sm:leading-6"
+								/>
+							</div>
+						</div>
+						{#if formErrors?.name}
+							<p class="block text-sm leading-6 text-red-900 mt-2">{formErrors.name}</p>
+						{/if}
+					</div>
+
+					<!-- File Upload -->
+					<div class="w-full max-w-md">
+						<label for="file" class="block text-sm font-medium leading-6 text-gray-900">
+							<span class="flex">
+								{#if formErrors?.file}
+									<span class="inline-block mr-1"><Exclamation /></span>
+								{/if} Datei
+							</span>
+						</label>
+						<div
+							class="mt-2 flex justify-center rounded-lg border border-dashed px-6 py-10
+								{isDragging
+								? 'border-blue-500 bg-blue-50'
+								: 'border-gray-900/25'}"
+							on:dragover|preventDefault={() => (isDragging = true)}
+							on:dragleave={() => (isDragging = false)}
+							on:drop={handleDrop}
+						>
+							<div class="text-center">
+								<FileRect />
+								<div class="mt-4 flex text-sm leading-6 text-gray-600">
+									<label
+										for="file"
+										class="relative cursor-pointer rounded-md bg-white font-semibold text-indigo-600 focus-within:outline-none focus-within:ring-2 focus-within:ring-indigo-600 focus-within:ring-offset-2 hover:text-indigo-500"
+									>
+										<span>Wähle eine Datei aus</span>
+										<input id="file" bind:this={fileInput} bind:files name="file" type="file" class="sr-only" />
+									</label>
+									<p class="pl-1">oder ziehe sie ins Feld</p>
+								</div>
+								<p class="text-xs leading-5 text-gray-600">GLB Dateien bis zu 1GB</p>
+								{#if files?.length}
+									<div class="flex justify-center text-xs mt-2">
+										<p class="mx-2">Datei: <span class="font-bold">{files[0].name}</span></p>
+										<p class="mx-2">
+											Größe: <span class="font-bold">{shortenFileSize(files[0].size)}</span>
+										</p>
+									</div>
+								{/if}
+							</div>
+						</div>
+						{#if formErrors?.file}
+							<p class="block text-sm leading-6 text-red-900 mt-2">{formErrors.file}</p>
+						{/if}
+					</div>
+
+					<div class="mt-6 flex items-center justify-end gap-x-6">
+						<Button
+							on:click={buttonClick}
+							class="rounded-md bg-indigo-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-indigo-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600"
+						>
+							Hinzufügen
+						</Button>
+					</div>
+				</div>
+				</div>
+			</ExpandableForm>
+			</div>
+		{/if}
+
+		<Modal {open}
+			><ModalTitle>Umbenennen</ModalTitle><ModalContent>
+				{#if inProgress}
+					<p class="py-2 mb-1">Vorgang läuft...</p>
+				{:else if isError}
+					<Alert class="w-full" type="error">Fehler beim Umbenennen</Alert>
+				{:else}
+					<Alert class="w-full">Umbenennen erfolgreich</Alert>
+				{/if}
+			</ModalContent>
+			<ModalFooter><Button disabled={inProgress} on:click={closeModal}>Ok</Button></ModalFooter>
+		</Modal>
+
+		<Modal open={openUL}
+			><ModalTitle>Upload</ModalTitle><ModalContent>
+				{#if inProgressUL}
+					<p class="py-2 mb-1">Upload läuft...</p>
+				{:else if etag}
+					<Alert class="w-full">Upload erfolgreich</Alert>
+				{:else}
+					<Alert class="w-full" type="error">Fehler beim Upload</Alert>
+				{/if}
+			</ModalContent>
+			<ModalFooter
+				><Button disabled={inProgressUL} on:click={uploadSuccessful}>Ok</Button></ModalFooter
+			>
+		</Modal>
+	</div>
+{/if}
+
+<style>
+	ul {
+		min-width: 24rem;
+	}
+</style>

src/routes/(token-based)/view/[vorgang]/[tatort]/+page.server.ts

@@ -0,0 +1,8 @@
+import { BUCKET, client } from '$lib/minio';
+import type { PageServerLoad } from './$types';
+
+export const load: PageServerLoad = async ({ params }) => {
+	const { vorgang, tatort } = params;
+	const url = await client.presignedUrl('GET', BUCKET, `${vorgang}/${tatort}`);
+	return { url };
+};

src/routes/(token-based)/view/[vorgang]/[tatort]/+page.svelte

@@ -0,0 +1,178 @@
+<script lang="ts">
+	import Panel from '$lib/components/Panel.svelte';
+	import { onMount } from 'svelte';
+	import Button from '$lib/components/Button.svelte';
+	import type { ModelViewerElement } from '@google/model-viewer';
+
+	export let data;
+
+	onMount(() => {
+		import('@google/model-viewer');
+	});
+
+	let progress = 0;
+	let hideProgressScreen = false;
+
+	let cameraOrbit = '0deg 0deg 100%';
+	let cameraTarget = '0m 0m 0m';
+	let fieldOfView = '10deg';
+
+	let cameraAzimuth = 0;
+	let cameraPolar = 0;
+
+	let cameraZoom = 100;
+	let xRotation = 0;
+	let yRotation = 0;
+	let zRotation = 0;
+
+	let modelViewer: ModelViewerElement | null = null;
+
+	$: style = `width: ${progress}%`;
+
+	const updateModelProgress = ({ detail }: { detail: { totalProgress: number } }) => {
+		progress = Math.ceil(detail.totalProgress * 100.0);
+		if (progress == 100) {
+			setTimeout(() => {
+				hideProgressScreen = true;
+			}, 250);
+		} else hideProgressScreen = false;
+	};
+
+	function onResetView() {
+		if (modelViewer) {
+			cameraAzimuth = 0;
+			cameraPolar = 0;
+			cameraZoom = 100;
+			modelViewer.cameraOrbit = cameraOrbit;
+			modelViewer.cameraTarget = cameraTarget;
+			modelViewer.fieldOfView = fieldOfView;
+			cameraAzimuth = 0;
+			cameraPolar = 0;
+			cameraZoom = 100;
+			fieldOfView = '10deg';
+		}
+	}
+
+	function updateCameraOrbit(azimuth: number, polar: number, zoom: number) {
+		cameraAzimuth = azimuth;
+		cameraPolar = polar;
+		cameraZoom = zoom;
+	}
+</script>
+
+<div class="h-full w-full bg-neutral-200 p-4 transition-all delay-250">
+	<!-- xr-environment -->
+	<model-viewer
+		class="h-full w-full"
+		shadow-intensity="1"
+		src={data.url}
+		bind:this={modelViewer}
+		touch-action="pan-y"
+		field-of-view={fieldOfView}
+		min-field-of-view="1deg"
+		max-field-of-view="10deg"
+		camera-controls
+		orientation={`${xRotation}deg ${yRotation}deg ${zRotation}deg`}
+		camera-target="0m 0m 0m"
+		camera-orbit={`${cameraAzimuth}deg ${cameraPolar}deg ${cameraZoom}%`}
+		on:progress={updateModelProgress}
+	>
+		<!--Buttons zum Steuern-->
+		<div
+			class=" p-4 flex z-10 absolute bottom-0"
+			class:opacity-0={!hideProgressScreen}
+			class:hidden={!hideProgressScreen}
+		>
+			<div class="flex flex-col bg-white/50">
+				<!--3 Buttons-->
+				<div class="p-2">
+					<Button
+						on:click={() => {
+							updateCameraOrbit(0, 0, cameraZoom);
+						}}
+						type="button"
+						variant="white"
+						align="left"
+						class="relative cursor-default justify-start py-2 pl-3 pr-10 text-left "
+					>
+						Draufsicht
+					</Button>
+					<Button
+						on:click={() => {
+							onResetView();
+						}}
+						type="button"
+						variant="white"
+						align="left"
+						class="relative cursor-default justify-start py-2 pl-3 pr-10 text-left"
+					>
+						Werte zurücksetzen
+					</Button>
+
+					<Button
+						on:click={() => {
+							updateCameraOrbit(0, 90, cameraZoom);
+						}}
+						type="button"
+						variant="white"
+						align="left"
+						class="relative cursor-default justify-start py-2 pl-3 pr-10 text-left"
+					>
+						Frontansicht
+					</Button>
+				</div>
+
+				<!--Horizontal-->
+				<div class="p-2">
+					<label for="cazimuth">Horizontal drehen (Azimut):</label>
+					<input id="cazimuth" type="range" min="0" max="360" bind:value={cameraAzimuth} />
+				</div>
+				<!--Vertikal-->
+				<div class="p-2">
+					<label class="  mb-2" for="polarSlider">Vertikal drehen (Polar):</label>
+					<input id="polarSlider" type="range" min="0" max="90" bind:value={cameraPolar} />
+				</div>
+				<!--Zoom/Distanz-->
+				<div class="p-2">
+					<label for="cZoom">Abstand (zoom):</label>
+					<input id="cZoom" type="range" min="0" max="100" bind:value={cameraZoom} />
+				</div>
+			</div>
+			<!--Rotationen-->
+			<div class="flex flex-col ml-2 p-4 bg-white/50">
+				Modell rotieren lassen:
+				<br />
+				Modell auf dem Kopf? -> y auf 270°
+				<div class="p-2">
+					<label class="" for="polarSlider">Rotation X:</label>
+					<input id="polarSlider" type="range" min="0" max="360" bind:value={xRotation} />
+				</div>
+				<div class="p-2">
+					<label class="" for="polarSlider">Rotation Y:</label>
+					<input id="polarSlider" type="range" min="0" max="360" bind:value={yRotation} />
+				</div>
+				<div class="p-2">
+					<label class="" for="polarSlider">Rotation Z:</label>
+					<input id="polarSlider" type="range" min="0" max="360" bind:value={zRotation} />
+				</div>
+			</div>
+		</div>
+		<!--Loading-->
+		<div
+			slot="progress-bar"
+			class="flex items-center justify-center h-5/6 w-full transition-all delay-250"
+			class:opacity-0={hideProgressScreen}
+			class:hidden={hideProgressScreen}
+		>
+			<Panel class="w-72 bg-gray-50 flex items-center flex-col"
+				><p class="mb-5">Loading {progress}%</p>
+				<div class="h-1 w-full bg-neutral-200 dark:bg-neutral-600">
+					<div class="h-1 bg-blue-500" {style}></div>
+				</div></Panel
+			>
+		</div>
+	</model-viewer>
+</div>
+
+<style>
+</style>

src/routes/+layout.svelte

@@ -1,4 +1,4 @@
-<script>
+<script lang="ts">
 	import '../app.css';
 </script>
 

src/routes/anmeldung/+page.server.js

@@ -1,31 +0,0 @@
-import { dev } from '$app/environment';
-import { fail, redirect } from '@sveltejs/kit';
-import { authenticate } from '$lib/auth';
-
-const COOKIE_NAME = 'session';
-
-/** @type {import('./$types').Actions} */
-export const actions = {
-	login: async ({ request, cookies }) => {
-		const data = await request.formData();
-		const user = data.get('user');
-		const password = data.get('password');
-
-		const token = authenticate(user, password);
-
-		if (!token) return fail(400, { user, incorrect: true });
-
-		cookies.set(COOKIE_NAME, token, {
-			path: '/',
-			httpOnly: true,
-			sameSite: 'strict',
-			secure: !dev
-		});
-		throw redirect(303, '/');
-	},
-	logout: async (event) => {
-		event.cookies.delete(COOKIE_NAME, {path: '/'});
-		event.locals.user = null;
-		return { success: true };
-	}
-};

src/routes/anmeldung/+page.server.ts

@@ -0,0 +1,35 @@
+import { dev } from '$app/environment';
+import { error, fail, redirect } from '@sveltejs/kit';
+import { ROUTE_NAMES } from '../index.js';
+import { vorgangPINValidation } from '$lib/server/vorgangService.js';
+
+export const actions = {
+	default: async ({ request, cookies }) => {
+		const data = await request.formData();
+		const vorgangToken = data.get('vorgang-token');
+		const vorgangPIN = data.get('vorgang-pin') as string;
+
+		if (!vorgangPIN) {
+			return fail(400, { message: 'Bitte einen PIN eingeben.'});
+		}
+
+		if (!vorgangPINValidation(vorgangToken, vorgangPIN)) {
+			return fail(400, { message: 'Falsche Zugangsdaten.'});
+		}
+
+		const COOKIE_NAME = `token-${vorgangToken}`;
+		cookies.set(COOKIE_NAME, vorgangPIN, {
+			path: '/',
+			httpOnly: true,
+			sameSite: 'strict',
+			secure: !dev
+		});
+
+		throw redirect(303, ROUTE_NAMES.VORGANG(vorgangToken));
+	}
+} as const;
+
+export const load: PageServerLoad = async ({ url }) => {
+	const vorgang = url.searchParams.get('vorgang');
+	if (!vorgang) error(404, "Not Found");
+};

src/routes/anmeldung/+page.svelte

@@ -1,75 +1,50 @@
-<script>
-	import Panel from '$lib/components/ui/Panel.svelte';
-	import Button from '$lib/components/ui/Button.svelte';
-	import Alert from '$lib/components/ui/Alert.svelte';
-	import Login from '$lib/icons/Login.svelte';
+<script lang="ts">
+	import BaseInputField from '$lib/components/BaseInputField.svelte';
+	import Button from '$lib/components/Button.svelte';
+	import ArrowRight from '$lib/icons/Arrow-right.svelte';
 
-	/** @type {import('./$types').ActionData} */
 	export let form;
-
-	let user = form?.user ?? '';
-
-	function buttonClick() {}
+	import { page } from '$app/state';
+	import { ROUTE_NAMES } from '../index.js';
+	const vorgangToken = page.url.searchParams.get('vorgang');
 </script>
 
-<!--
-  This example requires updating your template:
-
-  ```
-  <html class="h-full bg-white">
-  <body class="h-full">
-  ```
--->
+{#if vorgangToken}
 <div class="flex min-h-full flex-col justify-center px-6 py-12 lg:px-8">
 	<div class="sm:mx-auto sm:w-full sm:max-w-sm">
 		<img class="mx-auto h-10 w-auto" src="/Landeswappen_NI.svg" alt="Landeswappen Niedersachsen" />
 
 		<h2 class="mt-10 text-center text-2xl font-bold leading-9 tracking-tight text-gray-900">
-			Anmeldung zum 3D Tatort
+			Willkommen beim 3D Tatort
 		</h2>
 	</div>
+	<div class="w-full max-w-sm mx-auto">
+		<div class="relative mt-5 bg-gray-50 rounded-xl shadow-xl p-3 pt-1">
+			<div class="mt-10">
 
-	<div class="mt-10 sm:mx-auto sm:w-full sm:max-w-sm">
-		<form class="space-y-6" action="?/login" method="POST">
-			<div>
-				<label for="user" class="block text-sm font-medium leading-6 text-gray-900">Kennung</label>
-				<div class="mt-2">
-					<input
-						id="user"
-						name="user"
-						type="text"
-						autocomplete="email"
-						required
-						class="block w-full rounded-md border-0 py-1.5 text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 placeholder:text-gray-400 focus:ring-2 focus:ring-inset focus:ring-indigo-600 sm:text-sm sm:leading-6"
-					/>
-				</div>
-			</div>
+					<form method="POST">
+						<input type="hidden" name="vorgang-token" value={vorgangToken} />
+						<div class="mt-5">
+							<BaseInputField
+								id="vorgang-pin"
+								name="vorgang-pin"
+								label="Zugangs-PIN"
+								type="text"
+								value={form?.vorgangPIN}
+								error={form?.error?.message}
+							/>
+						</div>
+						{#if form?.message}
+							<p class="block text-sm leading-6 text-red-900 mt-2">{form.message}</p>
+						{/if}
 
-			<div>
-				<div class="flex items-center justify-between">
-					<label for="password" class="block text-sm font-medium leading-6 text-gray-900"
-						>Passwort</label
-					>
-				</div>
-				<div class="mt-2">
-					<input
-						id="password"
-						name="password"
-						type="password"
-						autocomplete="current-password"
-						required
-						class="block w-full rounded-md border-0 py-1.5 text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 placeholder:text-gray-400 focus:ring-2 focus:ring-inset focus:ring-indigo-600 sm:text-sm sm:leading-6"
-					/>
-				</div>
-			</div>
+						<div class="flex justify-end pt-4">
+							<Button type="submit"><ArrowRight /></Button>
+						</div>
+					</form>
 
-			<div>
-				<button
-					type="submit"
-					class="mt-10 flex w-full justify-center rounded-md bg-indigo-600 px-3 py-1.5 text-sm font-semibold leading-6 text-white shadow-sm hover:bg-indigo-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600"
-					>Anmelden</button
-				>
 			</div>
-		</form>
+		</div>
 	</div>
 </div>
+{/if}

src/routes/api/list/+server.ts

@@ -0,0 +1,9 @@
+import { getVorgaenge } from '$lib/server/vorgangService';
+
+export async function GET() {
+	const vorgaenge = getVorgaenge();
+
+	return new Response(JSON.stringify(vorgaenge), {
+		status: 200
+	});
+}

src/routes/api/list/[[vorgang]]/+server.js

@@ -1,63 +0,0 @@
-import { client } from '$lib/minio';
-
-/** @type {import('./$types').RequestHandler} */
-export async function GET({ params }) {
-	const prefix = params.vorgang ? `${params.vorgang}/` : '';
-	let stream = client.listObjectsV2('tatort', prefix, false, '');
-	const result = new ReadableStream({
-		start(controller) {
-			stream.on('data', (data) => {
-				if (prefix === '') {
-					if (data.prefix)
-						controller.enqueue(`${JSON.stringify({ ...data, name: data.prefix.slice(0, -1) })}\n`);
-					return;
-				}
-
-				const name = data.name.slice(prefix.length);
-				if (name === 'config.json') return;
-
-				controller.enqueue(`${JSON.stringify({ ...data, name, prefix })}\n`);
-			});
-			stream.on('end', () => {
-				controller.close();
-			});
-		},
-		cancel() {
-			stream.destroy();
-		}
-	});
-
-	return new Response(result, {
-		headers: {
-			'content-type': 'text/event-stream'
-		}
-	});
-}
-
-
-export async function DELETE({ params }) {
-	const vorgang = params.vorgang
-
-	const object_list = await new Promise((resolve, reject) => {
-
-		const res = []
-		const items_str = client.listObjects('tatort', vorgang, true)
-
-		items_str.on('data', (obj) => {
-			res.push(obj.name)
-		})
-
-		items_str.on('error', reject)
-
-		items_str.on('end', async () => {
-			resolve(res)
-		})
-
-		console.log(`+++ ${vorgang}`)
-
-	})
-
-	await client.removeObjects('tatort', object_list)
-
-    return new Response(null, { status: 204 });
-};

src/routes/api/list/[vorgang]/+server.ts

@@ -0,0 +1,88 @@
+import { BUCKET, client } from '$lib/minio';
+import { json } from '@sveltejs/kit';
+import {
+	deleteVorgangByToken,
+	getCrimesListByToken,
+	vorgangNameExists,
+	updateVorgangAttrByToken
+} from '$lib/server/vorgangService';
+
+export async function DELETE({ params }) {
+	const vorgangToken = params.vorgang;
+
+	const object_list = await new Promise((resolve, reject) => {
+		const res = [];
+		const items_str = client.listObjects(BUCKET, vorgangToken, true);
+
+		items_str.on('data', (obj) => {
+			res.push(obj.name);
+		});
+
+		items_str.on('error', reject);
+
+		items_str.on('end', async () => {
+			resolve(res);
+		});
+	});
+
+	await client.removeObjects(BUCKET, object_list);
+	deleteVorgangByToken(vorgangToken);
+
+	return new Response(null, { status: 204 });
+}
+
+export async function HEAD({ params }) {
+	try {
+		const vorgangName = params.vorgang;
+		const existing = vorgangNameExists(vorgangName);
+
+		return new Response(null, {
+			status: existing ? 200 : 404
+		});
+	} catch (err) {
+		console.error('Fehler im HEAD-Handler:', err);
+		return new Response(null, { status: 500 });
+	}
+}
+
+export async function GET({ params }) {
+	try {
+		const vorgangToken = params.vorgang;
+		const crimesList = await getCrimesListByToken(vorgangToken);
+
+		return new Response(JSON.stringify(crimesList), {
+			status: 200
+		});
+	} catch (err) {
+		console.error('Fehler im GET-Handler:', err);
+		return new Response(null, { status: 500 });
+	}
+}
+
+// change Vorgang properties
+export async function PUT({ request }) {
+	const data = await request.json();
+	
+	const vorgangToken = data['vorgangToken'];
+
+	const changePIN = data['changePIN'];
+
+	let attrChanged;
+	let newValue;
+	
+	if (changePIN) {
+		attrChanged = 'pin';
+		newValue = data['newVorgangPIN']
+	} else {
+		attrChanged = 'name';
+		newValue = data['newName']
+	}
+
+	const res = updateVorgangAttrByToken(vorgangToken, newValue, attrChanged);
+	
+	if (!res) {
+		return json({ msg: 'Fehler beim Umbenennen' }, { status: 400 });
+	}
+
+	return json({ success: 'success' }, { status: 200 });
+}

src/routes/api/list/[vorgang]/[tatort]/+server.ts

@@ -0,0 +1,63 @@
+import { BUCKET, client } from '$lib/minio';
+import { json } from '@sveltejs/kit';
+
+export async function GET() {
+	const stream = client.listObjectsV2(BUCKET, '', true);
+	const result = new ReadableStream({
+		start(controller) {
+			stream.on('data', (data) => {
+				controller.enqueue(`${JSON.stringify(data)}\n`);
+			});
+			stream.on('end', () => {
+				controller.close();
+			});
+		},
+		cancel() {
+			stream.destroy();
+		}
+	});
+
+	return new Response(result, {
+		headers: {
+			'content-type': 'text/event-stream'
+		}
+	});
+}
+
+export async function DELETE({ request }) {
+	const url_fragments = request.url.split('/');
+	const item = url_fragments.at(-1);
+	const vorgang = url_fragments.at(-2);
+
+	await client.removeObject(BUCKET, `${vorgang}/${item}`);
+
+	return new Response(null, { status: 204 });
+}
+
+// rename operation for crimes
+export async function PUT({ params, request }) {
+	const data = await request.json();
+
+	const vorgangToken = params.vorgang;
+
+	// prepare copy, incl. check if new name exists already
+	const crimeOldName = data['oldName'];
+	const crimeS3FullBucketPathOld = `/${BUCKET}/${vorgangToken}/${crimeOldName}`;
+	const crimeNewName = `${vorgangToken}/${data['newName']}`;
+
+	if (!crimeOldName || !crimeNewName) {
+		return json({ msg: 'Der Name darf nicht leer sein.' }, { status: 400 });
+	}
+
+	try {
+		await client.statObject(BUCKET, crimeNewName);
+		return json({ msg: 'Die Datei existiert bereits.' }, { status: 400 });
+	} catch (error) {
+		console.log(error, 'continue operation');
+	}
+
+	await client.copyObject(BUCKET, crimeNewName, crimeS3FullBucketPathOld);
+	await client.removeObject(BUCKET, `${vorgangToken}/${crimeOldName}`);
+
+	return json({ success: 'success' }, { status: 200 });
+}

src/routes/api/tatort/+server.js

@@ -1,26 +0,0 @@
-import { client } from '$lib/minio';
-
-/** @type {import('./$types').RequestHandler} */
-export async function GET() {
-	var stream = client.listObjectsV2('tatort', '', true);
-	const result = new ReadableStream({
-		start(controller) {
-			stream.on('data', (data) => {
-				//console.log(data);
-				controller.enqueue(`${JSON.stringify(data)}\n`);
-			});
-			stream.on('end', () => {
-				controller.close();
-			});
-		},
-		cancel() {
-			stream.destroy();
-		}
-	});
-
-	return new Response(result, {
-		headers: {
-			'content-type': 'text/event-stream'
-		}
-	});
-}

src/routes/api/upload/+server.js

@@ -1,6 +0,0 @@
-import { client } from '$lib/minio';
-
-/** @type {import('./$types').RequestHandler} */
-export async function GET(params) {
-	console.log('GET', params);
-}

src/routes/api/upload/+server.ts

@@ -0,0 +1,5 @@
+import type { RequestHandler } from "@sveltejs/kit";
+
+export async function GET(params: RequestHandler) {
+	console.log('GET', params);
+}

src/routes/api/user/+server.ts

@@ -0,0 +1,10 @@
+//Rollenabfrage ob Benutzer admin ist
+
+import { json } from "@sveltejs/kit";
+
+export async function GET({locals}) {
+    const isAdmin = locals.user?.admin === true;
+    const data = {admin: isAdmin}
+    return json(data)
+
+}

src/routes/api/users/+server.ts

@@ -0,0 +1,31 @@
+import { json } from '@sveltejs/kit';
+import { addUser, getUsers } from '$lib/server/userService';
+import bcrypt from 'bcrypt';
+
+const saltRounds = 12;
+
+export function GET() {
+
+	const userList = getUsers();
+
+	return new Response(JSON.stringify(userList));
+}
+
+export async function POST({ request }) {
+	const data = await request.json();
+	const userName = data.userName;
+	const userPassword = data.userPassword;
+
+	if (!userName || !userPassword) {
+		return json({ error: 'Missing input' }, { status: 400 });
+	}
+
+	const hashedPassword = bcrypt.hashSync(userPassword, saltRounds);
+	const rowInfo = addUser(userName, hashedPassword);
+
+	if (rowInfo?.changes == 1) {
+		return json({ userId: rowInfo.lastInsertRowid, userName: userName }, { status: 201 });
+	} else {
+		return new Response(null, { status: 400 });
+	}
+}

src/routes/api/users/[user]/+server.ts

@@ -0,0 +1,8 @@
+import { deleteUser } from '$lib/server/userService';
+
+export async function DELETE({ params }) {
+	const userId = params.user;
+	const rowCount = deleteUser(userId);
+
+	return new Response(null, { status: rowCount == 1 ? 204 : 400 });
+}

src/routes/api/vorgang/[vorgang]/vorgangPIN/+server.ts

@@ -0,0 +1,18 @@
+import { db } from '$lib/server/dbService';
+
+/** @type {import('./$types').RequestHandler} */
+export async function GET({ params }) {
+	const vorgangName = params.vorgang;
+
+	const getPINSQLStatement = `SELECT pin
+															FROM cases
+															WHERE name = ?;`;
+	const row = db.prepare(getPINSQLStatement).get(vorgangName);
+	const vorgangPIN = row?.pin;
+
+	if (vorgangPIN) {
+		return new Response(vorgangPIN, { status: 200 });
+	} else {
+		return new Response(null, { status: 404 });
+	}
+}

src/routes/index.ts

@@ -0,0 +1,41 @@
+export const ROUTE_NAMES = {
+	ROOT: '/',
+
+	// (angemeldet)
+	LIST: '/list',
+	UPLOAD: '/upload',
+	// UPLOAD actions
+	UPLOAD_URL: '/upload?/url',
+	UPLOAD_VALIDATE: '/upload?/validate',
+
+	USERMGMT: '/user-management',
+
+	// (token-based)
+	VORGANG: (vorgangToken: string) => `/list/${vorgangToken}`,
+	CRIME: (vorgangToken: string, tatort: string) => `/view/${vorgangToken}/${tatort}`,
+
+	// Anmeldung: actions
+	ANMELDUNG: '/anmeldung',
+	LOGIN: '/?/login',
+	LOGOUT: '/?/logout',
+	ANMELDUNG_GET_VORGANG_BY_TOKEN: '/anmeldung?/getVorgangByToken',
+	ANMELDUNG_VORGANG_PARAM: (vorgangToken: string) => `/anmeldung?vorgang=${vorgangToken}`
+};
+
+export const API_ROUTES = {
+	LIST: '/api/list',
+	VORGANG: (vorgangToken: string) => `/api/list/${vorgangToken}`,
+	// via `HEAD` method
+	VORGANG_NAME_EXIST: (vorgangName: string) => `/api/list/${vorgangName}`,
+	VORGANG_PIN: (vorgangName: string) => `/api/vorgang/${vorgangName}/vorgangPIN`,
+
+	// Tatort
+	CRIME: (vorgangToken: string, crimeName: string) => `/api/list/${vorgangToken}/${crimeName}`,
+
+	// Users
+	USERS: '/api/users',
+	USER: (userId: string) => `/api/users/${userId}`
+};
+
+const isProd = process.env.NODE_ENV == 'production';
+export const DB_FULLPATH = !isProd ? './src/lib/data/tatort.db' : '/daten/tatort.db';