feat: exclude verwalter from security lockout emails

shop/app/actions/checkout.ts

@@ -199,7 +199,7 @@ export async function checkoutAction(params: {
     .eq('id', user.id)
     .single();
 
-  const isAdminUser = dbUser?.role === 'admin';
+  const isAdminUser = dbUser?.role === 'admin' || dbUser?.role === 'verwaltung';
   if (!isAdminUser && !dbUser?.company_id) {
     throw new Error('Kein Unternehmen zugewiesen. Zugriff verweigert.');
   }

shop/app/api/orders/checkout/route.ts

@@ -36,7 +36,7 @@ export async function POST(request: Request) {
       .eq('id', user.id)
       .single();
 
-    const isAdminUser = dbUser?.role === 'admin';
+    const isAdminUser = dbUser?.role === 'admin' || dbUser?.role === 'verwaltung';
     if (!isAdminUser && !dbUser?.company_id) {
       return NextResponse.json({ error: 'Firma erforderlich' }, { status: 403 });
     }

shop/app/order/page.tsx

@@ -57,7 +57,7 @@ async function OrderDataWrapper({
     .eq('id', user.id)
     .single()
 
-  const isAdmin = userData?.role === 'admin'
+  const isAdmin = userData?.role === 'admin' || userData?.role === 'verwaltung'
   const hasCompany = !!userData?.company_id
 
   if (!isAdmin && !hasCompany) {
@@ -85,7 +85,7 @@ async function OrderDataWrapper({
       redirect('/order')
     }
 
-    const isAdmin = userData?.role === 'admin'
+    const isAdmin = userData?.role === 'admin' || userData?.role === 'verwaltung'
     const isOwner = orderData.user_id === user.id
     const isCompanyMember = userData?.company_id && orderData.company_id === userData.company_id
     if (!isAdmin && !isOwner && !isCompanyMember) {
@@ -104,7 +104,7 @@ async function OrderDataWrapper({
   
   // Admin sees all end customers across partners
   let endCustomers = []
-  if (userData?.role === 'admin') {
+  if (userData?.role === 'admin' || userData?.role === 'verwaltung') {
     try {
       const adminClient = createAdminClient()
       const { data } = await adminClient
@@ -134,7 +134,7 @@ async function OrderDataWrapper({
 
   // Fetch companies list for admin
   let companies: any[] = []
-  if (userData?.role === 'admin') {
+  if (userData?.role === 'admin' || userData?.role === 'verwaltung') {
     companies = await getCompanies().catch(() => [])
   }
 
@@ -145,7 +145,7 @@ async function OrderDataWrapper({
       initialProfile={profile}
       initialEndCustomers={endCustomers}
       initialOrder={initialOrder}
-      isAdmin={userData?.role === 'admin'}
+      isAdmin={userData?.role === 'admin' || userData?.role === 'verwaltung'}
       companies={companies}
       upgradeMode={mode === 'upgrade'}
       initialEndCustomerId={customerId || null}

shop/app/order/success/page.tsx

@@ -39,7 +39,7 @@ export default async function OrderSuccessPage({
   if (error || !order) redirect('/')
 
   // Berechtigung prüfen
-  const isAdmin = dbUser?.role === 'admin'
+  const isAdmin = dbUser?.role === 'admin' || dbUser?.role === 'verwaltung'
   const isOwner = order.user_id === user.id
   const isCompanyMember = dbUser?.company_id && order.company_id === dbUser.company_id
 

shop/lib/actions/end-customers.ts

@@ -86,7 +86,7 @@ export async function createEndCustomer(formData: EndCustomerFormData, companyId
     .eq('id', user.id)
     .single()
 
-  const isAdmin = dbUser?.role === 'admin'
+  const isAdmin = dbUser?.role === 'admin' || dbUser?.role === 'verwaltung'
   const resolvedCompanyId = dbUser?.company_id || companyId
 
   if (!isAdmin && !resolvedCompanyId) {

shop/lib/actions/orders.ts

@@ -72,7 +72,7 @@ export async function submitOrder(params: {
     .eq('id', user.id)
     .single()
 
-  const isAdminUser = dbUser?.role === 'admin'
+  const isAdminUser = dbUser?.role === 'admin' || dbUser?.role === 'verwaltung'
   if (!isAdminUser && !dbUser?.company_id) {
     throw new Error('Sie müssen einer Firma zugewiesen sein, um eine Anfrage zu erstellen.')
   }
@@ -309,7 +309,7 @@ export async function submitOrder(params: {
           const { data: admins } = await adminClient
             .from('users')
             .select('email')
-            .eq('role', 'admin')
+            .in('role', ['admin', 'verwaltung'])
           if (admins) {
             const adminEmails = admins.map((a: any) => a.email).filter(Boolean)
             for (const adminEmail of adminEmails) {
@@ -464,7 +464,7 @@ export async function updateOrderStatus(
           const { data: admins } = await adminClient
             .from('users')
             .select('email')
-            .eq('role', 'admin')
+            .in('role', ['admin', 'verwaltung'])
           if (admins) {
             const adminEmails = admins.map((a: any) => a.email).filter(Boolean)
             for (const adminEmail of adminEmails) {
@@ -625,7 +625,7 @@ export async function rejectOrder(
           const { data: admins } = await adminClient
             .from('users')
             .select('email')
-            .eq('role', 'admin')
+            .in('role', ['admin', 'verwaltung'])
           if (admins) {
             const adminEmails = admins.map((a: any) => a.email).filter(Boolean)
             for (const adminEmail of adminEmails) {
@@ -690,7 +690,7 @@ export async function updateOrder(
     .eq('id', user.id)
     .single()
 
-  const isAdmin = dbUser?.role === 'admin'
+  const isAdmin = dbUser?.role === 'admin' || dbUser?.role === 'verwaltung'
   let isAuthorized = existingOrder.user_id === user.id
 
   if (!isAuthorized && dbUser?.company_id && existingOrder.user_id) {
@@ -930,7 +930,7 @@ export async function updateOrder(
           const { data: admins } = await adminClient
             .from('users')
             .select('email')
-            .eq('role', 'admin')
+            .in('role', ['admin', 'verwaltung'])
           if (admins) {
             const adminEmails = admins.map((a: any) => a.email).filter(Boolean)
             for (const adminEmail of adminEmails) {

shop/lib/actions/queries.ts

@@ -199,7 +199,7 @@ export async function getCustomersForWizard(
     .eq('id', user.id)
     .single()
 
-  const isAdmin = dbUser?.role === 'admin'
+  const isAdmin = dbUser?.role === 'admin' || dbUser?.role === 'verwaltung'
 
   let client = supabase
   if (isAdmin) {