changed from SolveWithSolutionCallback to Solver as of OR-Tools version change

.env.template

@@ -1,16 +1,29 @@
-# === SCHICHTPLANER DOCKER COMPOSE ENVIRONMENT VARIABLES ===
+# .env.template
-# Diese Datei wird von docker-compose automatisch geladen
+# ============================================
+# DOCKER COMPOSE ENVIRONMENT TEMPLATE
+# Copy this file to .env and adjust values
+# ============================================
 
-# Security
+# Application settings
-JWT_SECRET=${JWT_SECRET:-your-secret-key-please-change}
+NODE_ENV=production
-NODE_ENV=${NODE_ENV:-production}
+JWT_SECRET=your-secret-key-please-change
+HOSTNAME=localhost
+
+# Security & Network
+TRUST_PROXY_ENABLED=false
+TRUSTED_PROXY_IPS=127.0.0.1,::1
+FORCE_HTTPS=false
 
 # Database
-DB_PATH=${DB_PATH:-/app/data/database.db}
+DATABASE_PATH=/app/data/schichtplaner.db
 
-# Server
+# Optional features
-PORT=${PORT:-3002}
+ENABLE_PRO=false
+DEBUG=false
 
-# App Configuration
+# Port configuration
-APP_TITLE="Shift Planning App"
+APP_PORT=3002
-ENABLE_PRO=${ENABLE_PRO:-false}
+
+# ============================================
+# END OF TEMPLATE
+# ============================================

.github/workflows/docker.yml

@@ -83,9 +83,13 @@ jobs:
         with:
           node-version: '20'
 
+      - name: Create package-lock.json
+        working-directory: .
+        run: npm i --package-lock-only
+
       - name: Install backend dependencies
         working-directory: ./backend
-        run: npm install
+        run: npm ci
 
       - name: Run TypeScript check
         working-directory: ./backend

.gitignore

@@ -57,6 +57,7 @@ yarn-error.log*
 # Build outputs
 dist/
 build/
+package-lock.json
 
 # Environment variables
 .env

Dockerfile

@@ -1,22 +1,17 @@
 # Single stage build for workspaces
-FROM node:20-bullseye AS builder
+FROM node:20-bookworm AS builder
 
 WORKDIR /app
 
-# Install Python + OR-Tools
-RUN apt-get update && apt-get install -y python3 python3-pip build-essential \
-  && pip install --no-cache-dir ortools
-
-# Create symlink so python3 is callable as python
-RUN ln -sf /usr/bin/python3 /usr/bin/python
-
 # Copy root package files first
 COPY package*.json ./
 COPY tsconfig.base.json ./
 COPY ecosystem.config.cjs ./
 
 # Install root dependencies
-RUN npm install --only=production
+#RUN npm install --only=production
+RUN npm i --package-lock-only
+RUN npm ci
 
 # Copy workspace files
 COPY backend/ ./backend/
@@ -30,10 +25,7 @@ RUN npm install --workspace=frontend
 RUN npm run build --only=production --workspace=backend
 
 # Build frontend
-RUN npm run build --workspace=frontend
+RUN npm run build --only=production --workspace=frontend
-
-# Verify Python and OR-Tools installation
-RUN python -c "from ortools.sat.python import cp_model; print('OR-Tools installed successfully')"
 
 # Production stage
 FROM node:20-bookworm
@@ -57,7 +49,20 @@ COPY --from=builder /app/frontend/dist/ ./frontend-build/
 COPY --from=builder /app/ecosystem.config.cjs ./
 
 COPY --from=builder /app/backend/src/database/ ./dist/database/
-COPY --from=builder /app/backend/src/database/ ./database/
+# should be obsolete with the line above
+#COPY --from=builder /app/backend/src/database/ ./database/
+
+COPY --from=builder /app/backend/src/python-scripts/ ./python-scripts/
+
+# Install Python + OR-Tools
+RUN apt-get update && apt-get install -y python3 python3-pip build-essential \
+  && pip install --no-cache-dir --break-system-packages ortools
+
+# Create symlink so python3 is callable as python
+RUN ln -sf /usr/bin/python3 /usr/bin/python
+
+# Verify Python and OR-Tools installation
+RUN python -c "from ortools.sat.python import cp_model; print('OR-Tools installed successfully')"
 
 # Copy init script and env template
 COPY docker-init.sh /usr/local/bin/

README.md

@@ -1,6 +1,91 @@
 # Schichtenplaner
-Aufteilung der Schichten unter Mitarbeitern
 
+A web application for planning and distributing work shifts among employees. Manage your team's schedules, handle employee availability, and automatically generate optimized shift plans.
+
+## Features
+
+- Employee management with availability tracking
+- Shift plan creation and management
+- Automated scheduling optimization using constraint programming (OR-Tools CP-SAT)
+- Excel export functionality
+- User authentication with JWT
+- Responsive web interface
+
+---
+
+## For Developers
+
+### Tech Stack
+
+**Frontend:**
+- React 19 with TypeScript
+- Vite 6 (build tool & dev server)
+- React Router DOM (routing)
+- date-fns (date handling)
+- Framer Motion (animations)
+
+**Backend:**
+- Express.js with TypeScript
+- SQLite3 (database)
+- JWT authentication
+- Helmet (security headers)
+- express-rate-limit (rate limiting)
+- OR-Tools CP-SAT (Python - scheduling optimization)
+- ExcelJS (Excel exports)
+
+**Infrastructure:**
+- npm workspaces (monorepo)
+- Docker support
+
+### Prerequisites
+
+- Node.js (v18+)
+- Python 3 with OR-Tools (`pip install ortools`)
+- npm
+
+### Getting Started
+
+```bash
+# Install dependencies
+npm install
+
+# Run development server (frontend + backend)
+npm run dev
+
+# Build all packages
+npm run build:all
+```
+
+### Project Structure
+
+```
+schichtenplaner/
+├── frontend/     # React application
+├── backend/      # Express API server
+├── premium/      # Premium features (optional)
+└── package.json  # Root monorepo config
+```
+
+### Available Scripts
+
+| Command | Description |
+|---------|-------------|
+| `npm run dev` | Start both frontend and backend in development mode |
+| `npm run dev:frontend` | Start frontend only |
+| `npm run dev:backend` | Start backend only |
+| `npm run build:all` | Build frontend and backend |
+| `npm run docker:build` | Build Docker image |
+| `npm run docker:run` | Run Docker container |
+
+### Environment Variables
+
+The backend requires these environment variables in production:
+- `NODE_ENV` - Set to `production` or `development`
+- `JWT_SECRET` - Secret key for JWT token signing
+- `TRUST_PROXY_ENABLED` - Enable/disable proxy trust (default: true)
+- `TRUSTED_PROXY_IPS` - Comma-separated list of trusted proxy IPs
+
+---
 
 ## 🧾 License
 

backend/package.json

@@ -4,6 +4,9 @@
   "type": "module",
   "scripts": {
     "dev": "npm run build && npx tsx src/server.ts",
+    "dev:single": "cross-env NODE_ENV=development TRUST_PROXY_ENABLED=false SEED_TEST_DATA=true npx tsx src/server.ts",
+    "seed:test-data": "npx tsx src/scripts/seedTestData.ts",
+    "dev:all": "npm run dev:single",
     "build": "tsc",
     "start": "node dist/server.js",
     "prestart": "npm run build",
@@ -14,6 +17,8 @@
   },
   "dependencies": {
     "@types/bcrypt": "^6.0.0",
+    "@types/node": "24.9.2",
+    "vite": "7.1.12",
     "bcrypt": "^6.0.0",
     "bcryptjs": "^2.4.3",
     "express": "^4.18.2",
@@ -22,7 +27,9 @@
     "uuid": "^9.0.0",
     "express-rate-limit": "8.1.0",
     "helmet": "8.1.0",
-    "express-validator": "7.3.0"
+    "express-validator": "7.3.0",
+    "exceljs": "4.4.0",
+    "playwright-chromium": "^1.37.0"
   },
   "devDependencies": {
     "@types/bcryptjs": "^2.4.2",
@@ -32,6 +39,7 @@
     "@types/jest": "^29.5.0",
     "ts-node": "^10.9.0",
     "typescript": "^5.0.0",
-    "tsx": "^4.0.0"
+    "tsx": "^4.0.0",
+    "cross-env": "10.1.0"
   }
 }

backend/src/controllers/authController.ts

@@ -64,7 +64,7 @@ export const login = async (req: Request, res: Response) => {
       return res.status(400).json({ error: 'E-Mail und Passwort sind erforderlich' });
     }
 
-    // UPDATED: Get user from database with role from employee_roles table
+    // Get user from database with role from employee_roles table
     const user = await db.get<any>(
       `SELECT 
         e.id, e.email, e.password, e.firstname, e.lastname, 
@@ -155,7 +155,7 @@ export const getCurrentUser = async (req: Request, res: Response) => {
       return res.status(401).json({ error: 'Nicht authentifiziert' });
     }
 
-    // UPDATED: Get user with role from employee_roles table
+    // Get user with role from employee_roles table
     const user = await db.get<any>(
       `SELECT 
         e.id, e.email, e.firstname, e.lastname,

backend/src/controllers/employeeController.ts

@@ -756,8 +756,8 @@ export const changePassword = async (req: AuthRequest, res: Response): Promise<v
       return;
     }
 
-    // For non-admin users, verify current password
+    // Verify current password
-    if (currentUser?.role !== 'admin') {
+    if (employee) {
       const isValidPassword = await bcrypt.compare(currentPassword, employee.password);
       if (!isValidPassword) {
         res.status(400).json({ error: 'Current password is incorrect' });
@@ -766,8 +766,8 @@ export const changePassword = async (req: AuthRequest, res: Response): Promise<v
     }
 
     // Validate new password
-    if (!newPassword || newPassword.length < 6) {
+    if (!newPassword || newPassword.length < 8) {
-      res.status(400).json({ error: 'New password must be at least 6 characters long' });
+      res.status(400).json({ error: 'New password must be at least 8 characters long' });
       return;
     }
 

backend/src/controllers/setupController.ts

@@ -75,8 +75,8 @@ export const setupAdmin = async (req: Request, res: Response): Promise<void> =>
     }
 
     // Password length validation
-    if (password.length < 6) {
+    if (password.length < 8) {
-      res.status(400).json({ error: 'Das Passwort muss mindestens 6 Zeichen lang sein' });
+      res.status(400).json({ error: 'Das Passwort muss mindestens 8 Zeichen lang sein' });
       return;
     }
 

backend/src/middleware/Validation/Employee.md

@@ -23,7 +23,7 @@
 ### \[CREATE\] Employee
 * `firstname` 1-100 characters and must not be empty
 * `lastname` 1-100 characters and must not be empty
-* `password` must be at least 6 characters (in create mode)
+* `password` must be at least 8 characters (in create mode)
 * `employeeType` must be `manager`, `personell`, `apprentice`, or `guest`
 * `canWorkAlone` optional boolean
 * `isTrainee` optional boolean

backend/src/middleware/auth.ts

@@ -52,3 +52,35 @@ export const requireRole = (roles: string[]) => {
     next();
   };
 };
+
+export const getClientIP = (req: Request): string => {
+  const trustedHeader = process.env.TRUSTED_PROXY_HEADER || 'x-forwarded-for';
+  const forwarded = req.headers[trustedHeader];
+  const realIp = req.headers['x-real-ip'];
+  
+  if (forwarded) {
+    if (Array.isArray(forwarded)) {
+      return forwarded[0].split(',')[0].trim();
+    } else if (typeof forwarded === 'string') {
+      return forwarded.split(',')[0].trim();
+    }
+  }
+  
+  if (realIp) {
+    return realIp.toString();
+  }
+  
+  return req.socket.remoteAddress || req.ip || 'unknown';
+};
+
+export const ipSecurityCheck = (req: AuthRequest, res: Response, next: NextFunction): void => {
+  const clientIP = getClientIP(req);
+  
+  // Log suspicious activity
+  const suspiciousPaths = ['/api/auth/login', '/api/auth/register'];
+  if (suspiciousPaths.includes(req.path)) {
+    console.log(`🔐 Auth attempt from IP: ${clientIP}, Path: ${req.path}`);
+  }
+  
+  next();
+}

backend/src/middleware/rateLimit.ts

@@ -1,12 +1,75 @@
 import rateLimit from 'express-rate-limit';
 import { Request } from 'express';
 
+// Secure IP extraction that works with proxy settings
+const getClientIP = (req: Request): string => {
+  // Read from environment which header to trust
+  const trustedHeader = process.env.TRUSTED_PROXY_HEADER || 'x-forwarded-for';
+
+  const forwarded = req.headers[trustedHeader];
+  const realIp = req.headers['x-real-ip'];
+  const cfConnectingIp = req.headers['cf-connecting-ip']; // Cloudflare
+
+  // If we have a forwarded header and trust proxy is configured
+  if (forwarded) {
+    if (Array.isArray(forwarded)) {
+      const firstIP = forwarded[0].split(',')[0].trim();
+      console.log(`🔍 Extracted IP from ${trustedHeader}: ${firstIP} (from: ${forwarded[0]})`);
+      return firstIP;
+    } else if (typeof forwarded === 'string') {
+      const firstIP = forwarded.split(',')[0].trim();
+      console.log(`🔍 Extracted IP from ${trustedHeader}: ${firstIP} (from: ${forwarded})`);
+      return firstIP;
+    }
+  }
+
+  // Cloudflare support
+  if (cfConnectingIp) {
+    console.log(`🔍 Using Cloudflare IP: ${cfConnectingIp}`);
+    return cfConnectingIp.toString();
+  }
+
+  // Fallback to x-real-ip
+  if (realIp) {
+    console.log(`🔍 Using x-real-ip: ${realIp}`);
+    return realIp.toString();
+  }
+
+  // Final fallback to connection remote address
+  const remoteAddress = req.socket.remoteAddress || req.ip || 'unknown';
+  console.log(`🔍 Using remote address: ${remoteAddress}`);
+  return remoteAddress;
+};
+
+// Helper to check if an IP is a loopback address (IPv4 or IPv6)
+const isLoopbackAddress = (ip: string): boolean => {
+  // IPv4 loopback: 127.0.0.0/8
+  if (ip.startsWith('127.') || ip === 'localhost') {
+    return true;
+  }
+
+  // IPv6 loopback: ::1
+  // Also handle IPv4-mapped IPv6 addresses like ::ffff:127.0.0.1
+  if (ip === '::1' || ip === '::ffff:127.0.0.1') {
+    return true;
+  }
+
+  // Handle full IPv6 loopback notation
+  if (ip.toLowerCase().startsWith('0000:0000:0000:0000:0000:0000:0000:0001') ||
+    ip.toLowerCase() === '0:0:0:0:0:0:0:1') {
+    return true;
+  }
+
+  return false;
+};
+
 // Helper to check if request should be limited
 const shouldSkipLimit = (req: Request): boolean => {
   const skipPaths = [
     '/api/health',
     '/api/setup/status',
-    '/api/auth/validate'
+    '/api/auth/validate',
+    '/api/auth/me',
   ];
 
   // Skip for successful GET requests (data fetching)
@@ -14,35 +77,99 @@ const shouldSkipLimit = (req: Request): boolean => {
     return true;
   }
 
+  const clientIP = getClientIP(req);
+
+  // Skip for loopback addresses (local development)
+  if (isLoopbackAddress(clientIP)) {
+    console.log(`✅ Loopback address skipped: ${clientIP}`);
+    return true;
+  }
+
+  // Skip for whitelisted IPs from environment
+  const whitelist = process.env.RATE_LIMIT_WHITELIST?.split(',') || [];
+  if (whitelist.includes(clientIP)) {
+    console.log(`✅ IP whitelisted: ${clientIP}`);
+    return true;
+  }
+
   return skipPaths.includes(req.path);
 };
 
+// Environment-based configuration
+const getRateLimitConfig = () => {
+  const isProduction = process.env.NODE_ENV === 'production';
+
+  return {
+    windowMs: parseInt(process.env.RATE_LIMIT_WINDOW_MS || '900000'), // 15 minutes default
+    max: isProduction
+      ? parseInt(process.env.RATE_LIMIT_MAX_REQUESTS || '50')  // Stricter in production
+      : parseInt(process.env.RATE_LIMIT_MAX_REQUESTS || '100'), // More lenient in development
+
+    // Development-specific relaxations
+    skip: (req: Request) => {
+      // Skip all GET requests in development for easier testing
+      if (!isProduction && req.method === 'GET') {
+        return true;
+      }
+
+      return shouldSkipLimit(req);
+    }
+  };
+};
+
 // Main API limiter - nur für POST/PUT/DELETE
 export const apiLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
+  ...getRateLimitConfig(),
-  max: 200, // 200 non-GET requests per 15 minutes
   message: {
     error: 'Zu viele Anfragen, bitte verlangsamen Sie Ihre Aktionen'
   },
   standardHeaders: true,
   legacyHeaders: false,
-  skip: (req) => {
+  keyGenerator: (req) => getClientIP(req),
-    // ✅ Skip für GET requests (Data Fetching)
+  handler: (req, res) => {
-    if (req.method === 'GET') return true;
+    const clientIP = getClientIP(req);
+    console.warn(`🚨 Rate limit exceeded for IP: ${clientIP}, Path: ${req.path}, Method: ${req.method}`);
 
-    // ✅ Skip für Health/Status Checks
+    res.status(429).json({
-    return shouldSkipLimit(req);
+      error: 'Zu viele Anfragen',
+      message: 'Bitte versuchen Sie es später erneut',
+      retryAfter: '15 Minuten',
+      clientIP: process.env.NODE_ENV === 'development' ? clientIP : undefined // Only expose IP in dev
+    });
   }
 });
 
 // Strict limiter for auth endpoints
 export const authLimiter = rateLimit({
   windowMs: 15 * 60 * 1000,
-  max: 5,
+  max: parseInt(process.env.AUTH_RATE_LIMIT_MAX_REQUESTS || '50'),
   message: {
     error: 'Zu viele Login-Versuche, bitte versuchen Sie es später erneut'
   },
   standardHeaders: true,
   legacyHeaders: false,
   skipSuccessfulRequests: true,
+  keyGenerator: (req) => getClientIP(req),
+  handler: (req, res) => {
+    const clientIP = getClientIP(req);
+    console.warn(`🚨 Auth rate limit exceeded for IP: ${clientIP}`);
+
+    res.status(429).json({
+      error: 'Zu viele Login-Versuche',
+      message: 'Aus Sicherheitsgründen wurde Ihr Konto temporär gesperrt',
+      retryAfter: '15 Minuten'
+    });
+  }
+});
+
+// Separate limiter for expensive endpoints
+export const expensiveEndpointLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: parseInt(process.env.EXPENSIVE_ENDPOINT_LIMIT || '20'),
+  message: {
+    error: 'Zu viele Anfragen für diese Ressource'
+  },
+  standardHeaders: true,
+  legacyHeaders: false,
+  keyGenerator: (req) => getClientIP(req)
 });

backend/src/middleware/validation.ts

@@ -209,7 +209,7 @@ export const validateChangePassword = [
     .isLength({ min: 1 })
     .withMessage('Current password is required for self-password change'),
 
-  body('password')
+  body('newPassword')
     .isLength({ min: 8 })
     .withMessage('Password must be at least 8 characters')
     .matches(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?])/)
@@ -217,7 +217,7 @@ export const validateChangePassword = [
 
   body('confirmPassword')
     .custom((value, { req }) => {
-      if (value !== req.body.password) {
+      if (value !== req.body.newPassword) {
         throw new Error('Passwords do not match');
       }
       return true;
@@ -388,6 +388,111 @@ export const validateCreateFromPreset = [
     .withMessage('isTemplate must be a boolean')
 ];
 
+// ===== TIME SLOT VALIDATION =====
+export const validateTimeSlot = [
+  body('name')
+    .isLength({ min: 1, max: 100 })
+    .withMessage('Time slot name must be between 1-100 characters')
+    .trim()
+    .escape(),
+
+  body('startTime')
+    .matches(/^([0-1]?[0-9]|2[0-3]):[0-5][0-9]$/)
+    .withMessage('Start time must be in HH:MM format'),
+
+  body('endTime')
+    .matches(/^([0-1]?[0-9]|2[0-3]):[0-5][0-9]$/)
+    .withMessage('End time must be in HH:MM format'),
+
+  body('description')
+    .optional()
+    .isLength({ max: 500 })
+    .withMessage('Description cannot exceed 500 characters')
+    .trim()
+    .escape()
+];
+
+export const validateTimeSlotUpdate = [
+  body('name')
+    .optional()
+    .isLength({ min: 1, max: 100 })
+    .withMessage('Time slot name must be between 1-100 characters')
+    .trim()
+    .escape(),
+
+  body('startTime')
+    .optional()
+    .matches(/^([0-1]?[0-9]|2[0-3]):[0-5][0-9]$/)
+    .withMessage('Start time must be in HH:MM format'),
+
+  body('endTime')
+    .optional()
+    .matches(/^([0-1]?[0-9]|2[0-3]):[0-5][0-9]$/)
+    .withMessage('End time must be in HH:MM format'),
+
+  body('description')
+    .optional()
+    .isLength({ max: 500 })
+    .withMessage('Description cannot exceed 500 characters')
+    .trim()
+    .escape()
+];
+
+export const validateSlotId = [
+  param('slotId')
+    .isUUID()
+    .withMessage('Slot ID must be a valid UUID')
+];
+
+// ===== SHIFT VALIDATION =====
+export const validateShiftCreate = [
+  body('timeSlotId')
+    .isUUID()
+    .withMessage('Time slot ID must be a valid UUID'),
+
+  body('dayOfWeek')
+    .isInt({ min: 1, max: 7 })
+    .withMessage('Day of week must be between 1-7 (Monday-Sunday)'),
+
+  body('requiredEmployees')
+    .optional()
+    .isInt({ min: 1, max: 10 })
+    .withMessage('Required employees must be between 1-10'),
+
+  body('color')
+    .optional()
+    .isHexColor()
+    .withMessage('Color must be a valid hex color')
+];
+
+export const validateShiftUpdate = [
+  body('timeSlotId')
+    .optional()
+    .isUUID()
+    .withMessage('Time slot ID must be a valid UUID'),
+
+  body('dayOfWeek')
+    .optional()
+    .isInt({ min: 1, max: 7 })
+    .withMessage('Day of week must be between 1-7 (Monday-Sunday)'),
+
+  body('requiredEmployees')
+    .optional()
+    .isInt({ min: 1, max: 10 })
+    .withMessage('Required employees must be between 1-10'),
+
+  body('color')
+    .optional()
+    .isHexColor()
+    .withMessage('Color must be a valid hex color')
+];
+
+export const validateShiftId = [
+  param('shiftId')
+    .isUUID()
+    .withMessage('Shift ID must be a valid UUID')
+];
+
 // ===== SCHEDULED SHIFTS VALIDATION =====
 export const validateScheduledShiftUpdate = [
   body('assignedEmployees')

backend/src/models/helpers/employeeHelpers.ts

@@ -18,12 +18,12 @@ function generateEmail(firstname: string, lastname: string): string {
   return `${cleanFirstname}.${cleanLastname}@sp.de`;
 }
 
-// UPDATED: Validation for new employee model with employee types
+// Validation for new employee model with employee types
 export function validateEmployeeData(employee: CreateEmployeeRequest): string[] {
   const errors: string[] = [];
 
-  if (employee.password?.length < 6) {
+  if (employee.password?.length < 8) {
-    errors.push('Password must be at least 6 characters long');
+    errors.push('Password must be at least 8 characters long');
   }
 
   if (!employee.firstname?.trim() || employee.firstname.trim().length < 2) {
@@ -71,7 +71,7 @@ export function generateEmployeeEmail(firstname: string, lastname: string): stri
   return generateEmail(firstname, lastname);
 }
 
-// UPDATED: Business logic helpers for new employee types
+// Business logic helpers for new employee types
 export const isManager = (employee: Employee): boolean =>
   employee.employeeType === 'manager';
 
@@ -90,7 +90,7 @@ export const isInternal = (employee: Employee): boolean =>
 export const isExternal = (employee: Employee): boolean =>
   employee.employeeType === 'guest';
 
-// UPDATED: Trainee logic - now based on isTrainee field for personell type
+// Trainee logic - now based on isTrainee field for personell type
 export const isTrainee = (employee: Employee): boolean =>
   employee.employeeType === 'personell' && employee.isTrainee;
 
@@ -107,7 +107,7 @@ export const isMaintenance = (employee: Employee): boolean =>
 export const isUser = (employee: Employee): boolean =>
   employee.roles?.includes('user') || false;
 
-// UPDATED: Work alone permission - managers and experienced personell can work alone
+// Work alone permission - managers and experienced personell can work alone
 export const canEmployeeWorkAlone = (employee: Employee): boolean =>
   employee.canWorkAlone && (isManager(employee) || isExperienced(employee));
 
@@ -134,7 +134,7 @@ export function validateAvailabilityData(availability: Omit<EmployeeAvailability
   return errors;
 }
 
-// UPDATED: Helper to get employee type category
+// Helper to get employee type category
 export const getEmployeeCategory = (employee: Employee): 'internal' | 'external' => {
   return isInternal(employee) ? 'internal' : 'external';
 };

backend/src/models/helpers/shiftPlanHelpers.ts

@@ -78,7 +78,7 @@ export function calculateTotalRequiredEmployees(plan: ShiftPlan): number {
   return plan.shifts.reduce((total, shift) => total + shift.requiredEmployees, 0);
 }
 
-// UPDATED: Get scheduled shift by date and time slot
+// Get scheduled shift by date and time slot
 export function getScheduledShiftByDateAndTime(
   plan: ShiftPlan, 
   date: string, 

backend/src/models/scheduling.ts

@@ -2,7 +2,7 @@
 import { Employee } from './Employee.js';
 import { ShiftPlan } from './ShiftPlan.js';
 
-// Updated Availability interface to match new schema
+// Availability interface
 export interface Availability {
   id: string;
   employeeId: string;

backend/src/python-scripts/scheduling_solver.py

@@ -201,7 +201,7 @@ class UniversalSchedulingSolver:
             
             # Solve with callback
             callback = SimpleSolutionCallback()
-            status = self.solver.SolveWithSolutionCallback(self.model, callback)
+            status = self.solver.Solve(self.model, callback)
             
             result = self._format_solution(status, cp_vars, model_data)
             result['metadata']['constraintsAdded'] = constraints_added

backend/src/routes/employees.ts

@@ -28,18 +28,18 @@ const router = express.Router();
 router.use(authMiddleware);
 
 // Employee CRUD Routes
-router.get('/', validatePagination, handleValidationErrors, getEmployees);
+router.get('/', validatePagination, handleValidationErrors, authMiddleware, getEmployees);
 router.get('/:id', validateId, handleValidationErrors, requireRole(['admin', 'maintenance']), getEmployee);
 router.post('/', validateEmployee, handleValidationErrors, requireRole(['admin']), createEmployee);
 router.put('/:id', validateId, validateEmployeeUpdate, handleValidationErrors, requireRole(['admin', 'maintenance']), updateEmployee);
 router.delete('/:id', validateId, handleValidationErrors, requireRole(['admin']), deleteEmployee);
 
 // Password & Login Routes
-router.put('/:id/password', validateId, validateChangePassword, handleValidationErrors, changePassword);
+router.put('/:id/password', validateId, validateChangePassword, handleValidationErrors, authMiddleware, changePassword);
-router.put('/:id/last-login', validateId, handleValidationErrors, updateLastLogin);
+router.put('/:id/last-login', validateId, handleValidationErrors, authMiddleware, updateLastLogin);
 
 // Availability Routes
-router.get('/:employeeId/availabilities', validateEmployeeId, handleValidationErrors, getAvailabilities);
+router.get('/:employeeId/availabilities', validateEmployeeId, handleValidationErrors, authMiddleware, getAvailabilities);
-router.put('/:employeeId/availabilities', validateEmployeeId, validateAvailabilities, handleValidationErrors, updateAvailabilities);
+router.put('/:employeeId/availabilities', validateEmployeeId, validateAvailabilities, handleValidationErrors, authMiddleware, updateAvailabilities);
 
 export default router;

backend/src/routes/shiftPlans.ts

@@ -7,14 +7,28 @@ import {
   updateShiftPlan,
   deleteShiftPlan,
   createFromPreset,
-  clearAssignments
+  clearAssignments,
+  exportShiftPlanToExcel,
+  exportShiftPlanToPDF,
+  addTimeSlot,
+  updateTimeSlot,
+  deleteTimeSlot,
+  addShift,
+  updateShift,
+  deleteShift
 } from '../controllers/shiftPlanController.js';
 import {
   validateShiftPlan,
   validateShiftPlanUpdate,
   validateCreateFromPreset,
   handleValidationErrors,
-  validateId 
+  validateId,
+  validateTimeSlot,
+  validateTimeSlotUpdate,
+  validateShiftCreate,
+  validateShiftUpdate,
+  validateSlotId,
+  validateShiftId
 } from '../middleware/validation.js';
 
 const router = express.Router();
@@ -30,4 +44,17 @@ router.put('/:id', validateId, validateShiftPlanUpdate, handleValidationErrors,
 router.delete('/:id', validateId, handleValidationErrors, requireRole(['admin', 'maintenance']), deleteShiftPlan);
 router.post('/:id/clear-assignments', validateId, handleValidationErrors, requireRole(['admin', 'maintenance']), clearAssignments);
 
+router.get('/:id/export/excel', validateId, handleValidationErrors, requireRole(['admin', 'maintenance']), exportShiftPlanToExcel);
+router.get('/:id/export/pdf', validateId, handleValidationErrors, requireRole(['admin', 'maintenance']), exportShiftPlanToPDF);
+
+// Time slot management
+router.post('/:id/time-slots', validateId, validateTimeSlot, handleValidationErrors, requireRole(['admin', 'maintenance']), addTimeSlot);
+router.put('/:id/time-slots/:slotId', validateId, validateSlotId, validateTimeSlotUpdate, handleValidationErrors, requireRole(['admin', 'maintenance']), updateTimeSlot);
+router.delete('/:id/time-slots/:slotId', validateId, validateSlotId, handleValidationErrors, requireRole(['admin', 'maintenance']), deleteTimeSlot);
+
+// Shift management
+router.post('/:id/shifts', validateId, validateShiftCreate, handleValidationErrors, requireRole(['admin', 'maintenance']), addShift);
+router.patch('/:id/shifts/:shiftId', validateId, validateShiftId, validateShiftUpdate, handleValidationErrors, requireRole(['admin', 'maintenance']), updateShift);
+router.delete('/:id/shifts/:shiftId', validateId, validateShiftId, handleValidationErrors, requireRole(['admin', 'maintenance']), deleteShift);
+
 export default router;

backend/src/scripts/applyMigration.ts

@@ -53,7 +53,7 @@ async function markMigrationAsApplied(migrationName: string) {
   );
 }
 
-// UPDATED: Function to handle schema changes for the new employee type system
+// Function to handle schema changes for the new employee type system
 async function applySchemaUpdates() {
   console.log('🔄 Applying schema updates for new employee type system...');
   
@@ -80,7 +80,7 @@ async function applySchemaUpdates() {
       PRAGMA table_info(employees)
     `);
     
-    // FIXED: Check for employee_type column (not roles column)
+    // Check for employee_type column (not roles column)
     const hasEmployeeType = employeesTableInfo.some((col: TableColumnInfo) => col.name === 'employee_type');
     const hasIsTrainee = employeesTableInfo.some((col: TableColumnInfo) => col.name === 'is_trainee');
     

backend/src/scripts/initializeDatabase.ts

@@ -65,7 +65,7 @@ export async function initializeDatabase(): Promise<void> {
 
       console.log('Existing tables found:', existingTables.map(t => t.name).join(', ') || 'none');
 
-      // UPDATED: Drop tables in correct dependency order for new schema
+      // Drop tables in correct dependency order for new schema
       const tablesToDrop = [
         'employee_availability',
         'shift_assignments',
@@ -95,16 +95,40 @@ export async function initializeDatabase(): Promise<void> {
       // Continue with schema creation even if table dropping fails
     }
 
-    // Execute schema creation in a transaction
+    // NEU: PRAGMA-Anweisungen außerhalb der Transaktion ausführen
-    await db.run('BEGIN EXCLUSIVE TRANSACTION');
+    console.log('Executing PRAGMA statements outside transaction...');
-    
+    const pragmaStatements = schema
-    // Execute each statement separately for better error reporting
-    const statements = schema
       .split(';')
       .map(stmt => stmt.trim())
       .filter(stmt => stmt.length > 0)
+      .filter(stmt => stmt.toUpperCase().startsWith('PRAGMA'))
+      .map(stmt => {
+        return stmt.split('\n')
+          .filter(line => !line.trim().startsWith('--'))
+          .join('\n')
+          .trim();
+      });
+
+    for (const statement of pragmaStatements) {
+      try {
+        console.log('Executing PRAGMA:', statement);
+        await db.run(statement);
+      } catch (error) {
+        console.warn('PRAGMA statement might have failed:', statement, error);
+        // Continue even if PRAGMA fails
+      }
+    }
+
+    // Schema-Erstellung in Transaktion
+    await db.run('BEGIN EXCLUSIVE TRANSACTION');
+
+    // Nur die CREATE TABLE und andere Anweisungen (ohne PRAGMA)
+    const schemaStatements = schema
+      .split(';')
+      .map(stmt => stmt.trim())
+      .filter(stmt => stmt.length > 0)
+      .filter(stmt => !stmt.toUpperCase().startsWith('PRAGMA'))
       .map(stmt => {
-        // Remove any single-line comments
         return stmt.split('\n')
           .filter(line => !line.trim().startsWith('--'))
           .join('\n')
@@ -112,7 +136,7 @@ export async function initializeDatabase(): Promise<void> {
       })
       .filter(stmt => stmt.length > 0);
 
-    for (const statement of statements) {
+    for (const statement of schemaStatements) {
       try {
         console.log('Executing statement:', statement.substring(0, 50) + '...');
         await db.run(statement);
@@ -124,7 +148,7 @@ export async function initializeDatabase(): Promise<void> {
       }
     }
 
-    // UPDATED: Insert default data in correct order
+    // Insert default data in correct order
     try {
       console.log('Inserting default employee types...');
       await db.run(`INSERT OR IGNORE INTO employee_types (type, category, has_contract_type) VALUES ('manager', 'internal', 1)`);

backend/src/scripts/seedTestData.ts

@@ -0,0 +1,347 @@
+// backend/src/scripts/seedTestData.ts
+import { db } from '../services/databaseService.js';
+import bcrypt from 'bcryptjs';
+import { v4 as uuidv4 } from 'uuid';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+interface TestData {
+    plan_name: string;
+    description: string;
+    period: string;
+    status: string;
+    created_by: string;
+    shifts: {
+        [day: string]: {
+            [shiftType: string]: {
+                time: string;
+                assignments: { [employeeName: string]: number };
+            };
+        };
+    };
+    employee_info: {
+        contract_sizes: { [name: string]: string };
+        employee_types: { [name: string]: string };
+        roles: { [name: string]: string };
+        trainees: { [name: string]: boolean };
+        can_work_alone: { [name: string]: boolean };
+    };
+    availability_scale: {
+        [key: string]: string;
+    };
+}
+
+function generateEmail(firstname: string, lastname: string): string {
+    const convertUmlauts = (str: string): string => {
+        return str
+            .toLowerCase()
+            .replace(/ü/g, 'ue')
+            .replace(/ö/g, 'oe')
+            .replace(/ä/g, 'ae')
+            .replace(/ß/g, 'ss');
+    };
+
+    const cleanFirstname = convertUmlauts(firstname).replace(/[^a-z0-9]/g, '');
+    const cleanLastname = convertUmlauts(lastname).replace(/[^a-z0-9]/g, '');
+
+    return `${cleanFirstname}.${cleanLastname}@sp.de`;
+}
+
+function mapContractType(germanType: string): 'small' | 'large' | 'flexible' {
+    switch (germanType) {
+        case 'groß': return 'large';
+        case 'klein': return 'small';
+        case 'flexible': return 'flexible';
+        default: return 'small';
+    }
+}
+
+function mapDayToNumber(day: string): number {
+    const dayMap: { [key: string]: number } = {
+        'monday': 1,
+        'tuesday': 2,
+        'wednesday': 3,
+        'thursday': 4,
+        'friday': 5,
+        'saturday': 6,
+        'sunday': 7
+    };
+    return dayMap[day.toLowerCase()] || 1;
+}
+
+function parseTimeSlot(time: string): { startTime: string; endTime: string } {
+    const [start, end] = time.split(' - ');
+    return {
+        startTime: start.trim(),
+        endTime: end.trim()
+    };
+}
+
+export async function seedTestData(): Promise<void> {
+    try {
+        console.log('🌱 Starting test data seeding...');
+
+        // Read test.json file - adjust path to be relative to project root
+        //const testDataPath = path.resolve(process.cwd(), './test.json');
+        const testDataPath = path.resolve(__dirname, './test.json');
+
+        console.log('🔍 Looking for test.json at:', testDataPath);
+
+        if (!fs.existsSync(testDataPath)) {
+            console.log('❌ test.json file not found at:', testDataPath);
+
+            // Try alternative paths
+            const alternativePaths = [
+                //path.resolve(__dirname, '../../../test.json'),
+                //path.resolve(process.cwd(), '../test.json'),
+                //path.resolve(__dirname, '../../test.json'),
+                path.resolve(__dirname, './test.json')
+            ];
+
+            for (const altPath of alternativePaths) {
+                console.log('🔍 Trying alternative path:', altPath);
+                if (fs.existsSync(altPath)) {
+                    console.log('✅ Found test.json at:', altPath);
+                    // Continue with the found path
+                    break;
+                }
+            }
+
+            return;
+        }
+
+        const testDataRaw = fs.readFileSync(testDataPath, 'utf-8');
+        const testData: TestData = JSON.parse(testDataRaw);
+
+        console.log('📊 Loaded test data:', {
+            planName: testData.plan_name,
+            employeeCount: Object.keys(testData.employee_info.contract_sizes).length,
+            days: Object.keys(testData.shifts).length
+        });
+
+        // Start transaction
+        await db.run('BEGIN TRANSACTION');
+
+        try {
+            // 1. Create employees
+            console.log('👥 Creating employees...');
+            const employeeMap: { [name: string]: string } = {};
+            const employeeNames = Object.keys(testData.employee_info.contract_sizes);
+
+            for (const name of employeeNames) {
+                const employeeId = uuidv4();
+                employeeMap[name] = employeeId;
+
+                const [firstname, lastname = ''] = name.split(' ');
+                const email = generateEmail(firstname, lastname || 'Test');
+                const passwordHash = await bcrypt.hash('ZebraAux123!', 10);
+
+                const contractType = mapContractType(testData.employee_info.contract_sizes[name]);
+                const employeeType = testData.employee_info.employee_types[name];
+                const role = testData.employee_info.roles[name];
+                const isTrainee = testData.employee_info.trainees[name];
+                const canWorkAlone = testData.employee_info.can_work_alone[name];
+
+                // Insert employee
+                await db.run(
+                    `INSERT INTO employees (
+            id, email, password, firstname, lastname, 
+            employee_type, contract_type, can_work_alone, 
+            is_trainee, is_active
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+                    [
+                        employeeId,
+                        email,
+                        passwordHash,
+                        firstname,
+                        lastname || 'Test',
+                        employeeType,
+                        contractType,
+                        canWorkAlone ? 1 : 0,
+                        isTrainee ? 1 : 0,
+                        1
+                    ]
+                );
+
+                // Insert role
+                await db.run(
+                    `INSERT INTO employee_roles (employee_id, role) VALUES (?, ?)`,
+                    [employeeId, role]
+                );
+
+                console.log(`✅ Created employee: ${name} (${email})`);
+            }
+
+            // 2. Create shift plan
+            console.log('📅 Creating shift plan...');
+            const planId = uuidv4();
+            const [startDate, endDate] = testData.period.split(' bis ');
+
+            // Use the first admin employee as creator
+            const adminEmployee = Object.entries(testData.employee_info.roles)
+                .find(([_, role]) => role === 'admin');
+            const createdBy = adminEmployee ? employeeMap[adminEmployee[0]] : employeeMap[employeeNames[0]];
+
+            await db.run(
+                `INSERT INTO shift_plans (
+          id, name, description, start_date, end_date, 
+          is_template, status, created_by
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+                [
+                    planId,
+                    testData.plan_name,
+                    testData.description,
+                    startDate.trim(),
+                    endDate.trim(),
+                    0, // is_template = false
+                    'published',
+                    createdBy
+                ]
+            );
+
+            // 3. Create time slots
+            console.log('⏰ Creating time slots...');
+            const timeSlotMap: { [key: string]: string } = {};
+
+            // Extract unique time slots from shifts
+            const uniqueTimeSlots = new Set<string>();
+            Object.values(testData.shifts).forEach(dayShifts => {
+                Object.values(dayShifts).forEach(shift => {
+                    uniqueTimeSlots.add(shift.time);
+                });
+            });
+
+            let timeSlotIndex = 0;
+            for (const time of uniqueTimeSlots) {
+                const timeSlotId = uuidv4();
+                const { startTime, endTime } = parseTimeSlot(time);
+                const name = timeSlotIndex === 0 ? 'Vormittag' : 'Nachmittag';
+
+                await db.run(
+                    `INSERT INTO time_slots (id, plan_id, name, start_time, end_time, description) 
+           VALUES (?, ?, ?, ?, ?, ?)`,
+                    [timeSlotId, planId, name, startTime, endTime, `Time slot: ${time}`]
+                );
+
+                timeSlotMap[time] = timeSlotId;
+                timeSlotIndex++;
+            }
+
+            // 4. Create shifts
+            console.log('🔄 Creating shifts...');
+            const shiftMap: { [dayTime: string]: string } = {};
+
+            for (const [dayName, dayShifts] of Object.entries(testData.shifts)) {
+                const dayOfWeek = mapDayToNumber(dayName);
+
+                for (const [shiftType, shiftData] of Object.entries(dayShifts)) {
+                    const shiftId = uuidv4();
+                    const timeSlotId = timeSlotMap[shiftData.time];
+
+                    await db.run(
+                        `INSERT INTO shifts (id, plan_id, time_slot_id, day_of_week, required_employees, color) 
+             VALUES (?, ?, ?, ?, ?, ?)`,
+                        [shiftId, planId, timeSlotId, dayOfWeek, 2, '#3498db']
+                    );
+
+                    shiftMap[`${dayName}_${shiftType}`] = shiftId;
+                }
+            }
+
+            // 5. Generate scheduled shifts for one week (for template demonstration)
+            console.log('📋 Generating scheduled shifts...');
+            const start = new Date(startDate.trim());
+
+            for (let dayOffset = 0; dayOffset < 7; dayOffset++) {
+                const currentDate = new Date(start);
+                currentDate.setDate(start.getDate() + dayOffset);
+
+                const dayOfWeek = currentDate.getDay() === 0 ? 7 : currentDate.getDay();
+                const dayName = Object.keys(testData.shifts).find(day =>
+                    mapDayToNumber(day) === dayOfWeek
+                );
+
+                if (dayName && testData.shifts[dayName]) {
+                    for (const [shiftType, shiftData] of Object.entries(testData.shifts[dayName])) {
+                        const scheduledShiftId = uuidv4();
+                        const timeSlotId = timeSlotMap[shiftData.time];
+
+                        await db.run(
+                            `INSERT INTO scheduled_shifts (id, plan_id, date, time_slot_id, required_employees, assigned_employees) 
+               VALUES (?, ?, ?, ?, ?, ?)`,
+                            [
+                                scheduledShiftId,
+                                planId,
+                                currentDate.toISOString().split('T')[0],
+                                timeSlotId,
+                                2,
+                                JSON.stringify([])
+                            ]
+                        );
+                    }
+                }
+            }
+
+            // 6. Create employee availabilities
+            console.log('📝 Creating employee availabilities...');
+
+            for (const [dayName, dayShifts] of Object.entries(testData.shifts)) {
+                const dayOfWeek = mapDayToNumber(dayName);
+
+                for (const [shiftType, shiftData] of Object.entries(dayShifts)) {
+                    const shiftId = shiftMap[`${dayName}_${shiftType}`];
+
+                    for (const [employeeName, preferenceLevel] of Object.entries(shiftData.assignments)) {
+                        const employeeId = employeeMap[employeeName];
+
+                        if (employeeId) {
+                            const availabilityId = uuidv4();
+
+                            await db.run(
+                                `INSERT INTO employee_availability (id, employee_id, plan_id, shift_id, preference_level) 
+                 VALUES (?, ?, ?, ?, ?)`,
+                                [availabilityId, employeeId, planId, shiftId, preferenceLevel]
+                            );
+                        }
+                    }
+                }
+            }
+
+            await db.run('COMMIT');
+
+            console.log('🎉 Test data seeded successfully!');
+            console.log('📊 Summary:');
+            console.log(`   - Employees: ${employeeNames.length}`);
+            console.log(`   - Shift Plan: ${testData.plan_name}`);
+            console.log(`   - Time Slots: ${Object.keys(timeSlotMap).length}`);
+            console.log(`   - Shifts: ${Object.keys(shiftMap).length}`);
+            console.log(`   - Period: ${testData.period}`);
+
+        } catch (error) {
+            await db.run('ROLLBACK');
+            console.error('❌ Error during test data seeding:', error);
+            throw error;
+        }
+
+    } catch (error) {
+        console.error('❌ Failed to seed test data:', error);
+        throw error;
+    }
+}
+
+// Run if called directly
+if (import.meta.url === `file://${process.argv[1]}`) {
+    seedTestData()
+        .then(() => {
+            console.log('✅ Seed script completed');
+            process.exit(0);
+        })
+        .catch((error) => {
+            console.error('❌ Seed script failed:', error);
+            process.exit(1);
+        });
+}

backend/src/scripts/test.json

@@ -0,0 +1,235 @@
+{
+  "plan_name": "test",
+  "description": "Standard Vorlage für ZEBRA: Mo-Do Vormittag+Nachmittag, Fr nur Vormittag",
+  "period": "2025-10-01 bis 2026-02-01",
+  "status": "published",
+  "created_by": "Max Mustermann",
+  "shifts": {
+    "monday": {
+      "early": {
+        "time": "8:00 - 12:00",
+        "assignments": {
+          "Jerome": 2,
+          "Patrick": 2,
+          "Andrey": 1,
+          "Fabian": 2,
+          "Lu": 3,
+          "Basti": 1,
+          "Kilian": 3,
+          "Gerald": 1,
+          "Uliana": 2,
+          "Nico": 1,
+          "Linuuuus": 1
+        }
+      },
+      "late": {
+        "time": "11:30 - 15:30",
+        "assignments": {
+          "Jerome": 1,
+          "Patrick": 3,
+          "Andrey": 1,
+          "Fabian": 3,
+          "Lu": 1,
+          "Basti": 1,
+          "Kilian": 3,
+          "Gerald": 3,
+          "Uliana": 3,
+          "Nico": 1,
+          "Linuuuus": 3
+        }
+      }
+    },
+    "tuesday": {
+      "early": {
+        "time": "8:00 - 12:00",
+        "assignments": {
+          "Jerome": 2,
+          "Patrick": 2,
+          "Andrey": 1,
+          "Fabian": 2,
+          "Lu": 3,
+          "Basti": 1,
+          "Kilian": 3,
+          "Gerald": 2,
+          "Uliana": 1,
+          "Nico": 1,
+          "Linuuuus": 2
+        }
+      },
+      "late": {
+        "time": "11:30 - 15:30",
+        "assignments": {
+          "Jerome": 1,
+          "Patrick": 3,
+          "Andrey": 1,
+          "Fabian": 3,
+          "Lu": 3,
+          "Basti": 1,
+          "Kilian": 3,
+          "Gerald": 2,
+          "Uliana": 2,
+          "Nico": 3,
+          "Linuuuus": 2
+        }
+      }
+    },
+    "wednesday": {
+      "early": {
+        "time": "8:00 - 12:00",
+        "assignments": {
+          "Jerome": 2,
+          "Patrick": 2,
+          "Andrey": 1,
+          "Fabian": 2,
+          "Lu": 3,
+          "Basti": 3,
+          "Kilian": 3,
+          "Gerald": 3,
+          "Uliana": 2,
+          "Nico": 3,
+          "Linuuuus": 2
+        }
+      },
+      "late": {
+        "time": "11:30 - 15:30",
+        "assignments": {
+          "Jerome": 2,
+          "Patrick": 3,
+          "Andrey": 1,
+          "Fabian": 3,
+          "Lu": 3,
+          "Basti": 3,
+          "Kilian": 3,
+          "Gerald": 3,
+          "Uliana": 3,
+          "Nico": 1,
+          "Linuuuus": 3
+        }
+      }
+    },
+    "thursday": {
+      "early": {
+        "time": "8:00 - 12:00",
+        "assignments": {
+          "Jerome": 3,
+          "Patrick": 3,
+          "Andrey": 1,
+          "Fabian": 3,
+          "Lu": 3,
+          "Basti": 3,
+          "Kilian": 3,
+          "Gerald": 3,
+          "Uliana": 3,
+          "Nico": 2,
+          "Linuuuus": 2
+        }
+      },
+      "late": {
+        "time": "11:30 - 15:30",
+        "assignments": {
+          "Jerome": 1,
+          "Patrick": 1,
+          "Andrey": 1,
+          "Fabian": 1,
+          "Lu": 3,
+          "Basti": 3,
+          "Kilian": 1,
+          "Gerald": 2,
+          "Uliana": 3,
+          "Nico": 3,
+          "Linuuuus": 3
+        }
+      }
+    },
+    "friday": {
+      "early": {
+        "time": "8:00 - 12:00",
+        "assignments": {
+          "Jerome": 1,
+          "Patrick": 1,
+          "Andrey": 1,
+          "Fabian": 1,
+          "Lu": 1,
+          "Basti": 3,
+          "Kilian": 1,
+          "Gerald": 1,
+          "Uliana": 1,
+          "Nico": 3,
+          "Linuuuus": 3
+        }
+      }
+    }
+  },
+  "employee_info": {
+    "contract_sizes": {
+      "Jerome": "groß",
+      "Patrick": "groß",
+      "Andrey": "groß",
+      "Fabian": "klein",
+      "Lu": "klein",
+      "Basti": "flexible",
+      "Kilian": "klein",
+      "Gerald": "groß",
+      "Uliana": "groß",
+      "Nico": "klein",
+      "Linuuuus": "klein"
+    },
+    "employee_types": {
+      "Jerome": "personell",
+      "Patrick": "personell",
+      "Andrey": "personell",
+      "Fabian": "personell",
+      "Lu": "personell",
+      "Basti": "manager",
+      "Kilian": "personell",
+      "Gerald": "personell",
+      "Uliana": "personell",
+      "Nico": "personell",
+      "Linuuuus": "personell"
+    },
+    "roles": {
+      "Jerome": "user",
+      "Patrick": "maintenance",
+      "Andrey": "user",
+      "Fabian": "user",
+      "Lu": "user",
+      "Basti": "admin",
+      "Kilian": "user",
+      "Gerald": "user",
+      "Uliana": "user",
+      "Nico": "user",
+      "Linuuuus": "user"
+    },
+    "trainees": {
+      "Jerome": false,
+      "Patrick": false,
+      "Andrey": false,
+      "Fabian": false,
+      "Lu": false,
+      "Basti": false,
+      "Kilian": true,
+      "Gerald": true,
+      "Uliana": true,
+      "Nico": true,
+      "Linuuuus": false
+    },
+    "can_work_alone": {
+      "Jerome": true,
+      "Patrick": true,
+      "Andrey": false,
+      "Fabian": true,
+      "Lu": false,
+      "Basti": false,
+      "Kilian": false,
+      "Gerald": false,
+      "Uliana": false,
+      "Nico": false,
+      "Linuuuus": true
+    }
+  },
+  "availability_scale": {
+    "1": "available",
+    "2": "limited",
+    "3": "unavailable"
+  }
+}

backend/src/server.ts

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'url';
 import { initializeDatabase } from './scripts/initializeDatabase.js';
 import fs from 'fs';
 import helmet from 'helmet';
+import type { ViteDevServer } from 'vite';
 
 // Route imports
 import authRoutes from './routes/auth.js';
@@ -13,7 +14,12 @@ import shiftPlanRoutes from './routes/shiftPlans.js';
 import setupRoutes from './routes/setup.js';
 import scheduledShifts from './routes/scheduledShifts.js';
 import schedulingRoutes from './routes/scheduling.js';
-import { authLimiter, apiLimiter } from './middleware/rateLimit.js';
+import {
+  apiLimiter,
+  authLimiter,
+  expensiveEndpointLimiter
+} from './middleware/rateLimit.js';
+import { ipSecurityCheck as authIpCheck } from './middleware/auth.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -21,8 +27,60 @@ const __dirname = path.dirname(__filename);
 const app = express();
 const PORT = 3002;
 const isDevelopment = process.env.NODE_ENV === 'development';
+if (isDevelopment) {
+  console.log('🔧 Running in Development mode');
+} else if (process.env.NODE_ENV === 'production') {
+  console.log('🚀 Running in Production mode');
+} else {
+  console.log('⚠️  NODE_ENV not set, defaulting to Development mode');
+  console.error('❌ Please set NODE_ENV to "production" or "development" for proper behavior.');
+  process.exit(1);
+}
 
-app.set('trust proxy', true);
+app.use(authIpCheck);
+
+let vite: ViteDevServer | undefined;
+
+if (isDevelopment) {
+  // Dynamically import and setup Vite middleware
+  const setupViteDevServer = async () => {
+    try {
+      const { createServer } = await import('vite');
+      vite = await createServer({
+        server: { middlewareMode: true },
+        appType: 'spa'
+      });
+      app.use(vite.middlewares);
+      console.log('🔧 Vite dev server integrated with Express');
+    } catch (error) {
+      console.warn('⚠️ Vite integration failed, using static files:', error);
+    }
+  };
+  setupViteDevServer();
+}
+
+const configureStaticFiles = () => {
+  const staticConfig = {
+    maxAge: '1y',
+    etag: false,
+    immutable: true,
+    index: false
+  };
+
+  // Serve frontend build
+  const frontendPath = '/app/frontend-build';
+  if (fs.existsSync(frontendPath)) {
+    console.log('✅ Serving frontend from:', frontendPath);
+    app.use(express.static(frontendPath, staticConfig));
+  }
+
+  // Serve premium assets if available
+  const premiumPath = '/app/premium-dist';
+  if (fs.existsSync(premiumPath)) {
+    console.log('✅ Serving premium assets from:', premiumPath);
+    app.use('/premium-assets', express.static(premiumPath, staticConfig));
+  }
+};
 
 // Security configuration
 if (process.env.NODE_ENV === 'production') {
@@ -34,6 +92,51 @@ if (process.env.NODE_ENV === 'production') {
   }
 }
 
+const configureTrustProxy = (): string | string[] | boolean | number => {
+  const trustedProxyIps = process.env.TRUSTED_PROXY_IPS;
+  const trustProxyEnabled = process.env.TRUST_PROXY_ENABLED !== 'false';
+
+  // If explicitly disabled
+  if (!trustProxyEnabled) {
+    console.log('🔒 Trust proxy: Disabled');
+    return false;
+  }
+
+  // If specific IPs are provided via environment variable
+  if (trustedProxyIps) {
+    console.log('🔒 Trust proxy: Using configured IPs:', trustedProxyIps);
+
+    // Handle comma-separated list of IPs/CIDR ranges
+    if (trustedProxyIps.includes(',')) {
+      return trustedProxyIps.split(',').map(ip => ip.trim());
+    }
+
+    // Handle single IP/CIDR
+    return trustedProxyIps.trim();
+  }
+
+  // Default behavior for reverse proxy setup
+  console.log('🔒 Trust proxy: Using reverse proxy defaults (trust all)');
+  return true; // Trust all proxies when behind nginx
+};
+
+app.set('trust proxy', configureTrustProxy());
+
+app.use((req, res, next) => {
+  const protocol = req.headers['x-forwarded-proto'] || req.protocol;
+  const isHttps = protocol === 'https';
+
+  // Add security warning for HTTP requests
+  if (!isHttps && process.env.NODE_ENV === 'production') {
+    res.setHeader('X-Security-Warning', 'This application is being accessed over HTTP. For secure communication, please use HTTPS.');
+
+    // Log HTTP access in production
+    console.warn(`⚠️  HTTP access detected: ${req.method} ${req.path} from ${req.ip}`);
+  }
+
+  next();
+});
+
 // Security headers
 app.use(helmet({
   contentSecurityPolicy: {
@@ -47,9 +150,14 @@ app.use(helmet({
       objectSrc: ["'none'"],
       mediaSrc: ["'self'"],
       frameSrc: ["'none'"],
+      upgradeInsecureRequests: process.env.FORCE_HTTPS === 'true' ? [] : null
     },
   },
-  hsts: false,
+  hsts: {
+    maxAge: 31536000,
+    includeSubDomains: true,
+    preload: true
+  }, // Enable HSTS for HTTPS
   crossOriginEmbedderPolicy: false
 }));
 
@@ -66,9 +174,12 @@ app.use(express.json());
 
 // Rate limiting - weniger restriktiv in Development
 if (process.env.NODE_ENV === 'production') {
+  console.log('🔒 Applying production rate limiting');
   app.use('/api/', apiLimiter);
 } else {
-  console.log('🔧 Development: Rate limiting relaxed');
+  console.log('🔧 Development: Relaxed rate limiting applied');
+  // In development, you might want to be more permissive
+  app.use('/api/', apiLimiter);
 }
 
 // API Routes
@@ -77,7 +188,7 @@ app.use('/api/auth', authLimiter, authRoutes);
 app.use('/api/employees', employeeRoutes);
 app.use('/api/shift-plans', shiftPlanRoutes);
 app.use('/api/scheduled-shifts', scheduledShifts);
-app.use('/api/scheduling', schedulingRoutes);
+app.use('/api/scheduling', expensiveEndpointLimiter, schedulingRoutes);
 
 // Health route
 app.get('/api/health', (req: express.Request, res: express.Response) => {
@@ -118,6 +229,7 @@ const findFrontendBuildPath = (): string | null => {
 };
 
 const frontendBuildPath = findFrontendBuildPath();
+configureStaticFiles();
 
 if (frontendBuildPath) {
   app.use(express.static(frontendBuildPath));
@@ -130,12 +242,25 @@ if (frontendBuildPath) {
 }
 
 // Root route
-app.get('/', (req, res) => {
+app.get('/', async (req, res) => {
-  if (!frontendBuildPath) {
+  // In development with Vite middleware
-    if (isDevelopment) {
+  if (vite) {
-      return res.redirect('http://localhost:3003');
+    try {
+      const template = fs.readFileSync(
+        path.resolve(__dirname, '../../frontend/index.html'),
+        'utf-8'
+      );
+      const html = await vite.transformIndexHtml(req.url, template);
+      res.send(html);
+    } catch (error) {
+      res.status(500).send('Vite dev server error');
     }
-    return res.status(500).send('Frontend build not found');
+    return;
+  }
+
+  // Fallback to static file serving
+  if (!frontendBuildPath) {
+    return res.status(500).send('Frontend not available');
   }
 
   const indexPath = path.join(frontendBuildPath, 'index.html');
@@ -143,20 +268,26 @@ app.get('/', (req, res) => {
 });
 
 // Client-side routing fallback
-app.get('*', (req, res) => {
+app.get('*', (req, res, next) => {
+  // Skip API routes
   if (req.path.startsWith('/api/')) {
-    return res.status(404).json({ error: 'API endpoint not found' });
+    return next();
   }
 
-  if (!frontendBuildPath) {
+  // Skip file extensions (assets)
-    if (isDevelopment) {
+  if (req.path.match(/\.[a-z0-9]+$/i)) {
-      return res.redirect(`http://localhost:3003${req.path}`);
+    return next();
-    }
-    return res.status(500).json({ error: 'Frontend application not available' });
   }
 
-  const indexPath = path.join(frontendBuildPath, 'index.html');
+  // Serve React app for all other routes
+  const frontendPath = '/app/frontend-build';
+  const indexPath = path.join(frontendPath, 'index.html');
+
+  if (fs.existsSync(indexPath)) {
     res.sendFile(indexPath);
+  } else {
+    res.status(404).send('Frontend not available');
+  }
 });
 
 // Error handling
@@ -189,6 +320,16 @@ const initializeApp = async () => {
     const { applyMigration } = await import('./scripts/applyMigration.js');
     await applyMigration();
 
+    if (isDevelopment && process.env.SEED_TEST_DATA === 'true') {
+      try {
+        const { seedTestData } = await import('./scripts/seedTestData.js');
+        await seedTestData();
+        console.log('✅ Test data seeded successfully');
+      } catch (error) {
+        console.log('⚠️ Test data seeding skipped or failed:', error);
+      }
+    }
+
     app.listen(PORT, () => {
       console.log('🎉 APPLICATION STARTED SUCCESSFULLY!');
       console.log(`📍 Port: ${PORT}`);

docker-compose.yml

@@ -6,17 +6,22 @@ services:
     image: ghcr.io/donpat1to/schichtenplaner:v1.0.0
     environment:
       - NODE_ENV=production
-      - JWT_SECRET=${JWT_SECRET:-your-secret-key-please-change}
+      - JWT_SECRET=${JWT_SECRET}
-    ports:
+      - TRUST_PROXY_ENABLED=true
-      - "3002:3002"
+      - TRUSTED_PROXY_IPS=nginx-proxy,172.0.0.0/8,10.0.0.0/8,192.168.0.0/16
+      - FORCE_HTTPS=${FORCE_HTTPS:-false}
+    networks:
+      - app-network
     volumes:
       - app_data:/app/data
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3002/api/health"]
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3002/api/health"]
       interval: 30s
       timeout: 10s
       retries: 3
+    expose:
+      - "3002"
 
 volumes:
   app_data:

docker-init.sh

@@ -3,17 +3,15 @@ set -e
 
 echo "🚀 Container Initialisierung gestartet..."
 
-# Funktion zum Generieren eines sicheren Secrets
 generate_secret() {
     length=$1
     tr -dc 'A-Za-z0-9!@#$%^&*()_+-=' < /dev/urandom | head -c $length
 }
 
-# Prüfe ob .env existiert
+# Create .env if it doesn't exist
 if [ ! -f /app/.env ]; then
     echo "📝 Erstelle .env Datei..."
     
-    # Verwende vorhandenes JWT_SECRET oder generiere ein neues
     if [ -z "$JWT_SECRET" ] || [ "$JWT_SECRET" = "your-secret-key-please-change" ]; then
         export JWT_SECRET=$(generate_secret 64)
         echo "🔑 Automatisch sicheres JWT Secret generiert"
@@ -21,30 +19,37 @@ if [ ! -f /app/.env ]; then
         echo "🔑 Verwende vorhandenes JWT Secret aus Umgebungsvariable"
     fi
     
-    # Erstelle .env aus Template mit envsubst
+    # Create .env with all proxy settings
-    envsubst < /app/.env.template > /app/.env
+    cat > /app/.env << EOF
-    echo "✅ .env Datei erstellt"
+NODE_ENV=production
+JWT_SECRET=${JWT_SECRET}
+TRUST_PROXY_ENABLED=${TRUST_PROXY_ENABLED:-true}
+TRUSTED_PROXY_IPS=${TRUSTED_PROXY_IPS:-172.0.0.0/8,10.0.0.0/8,192.168.0.0/16}
+HOSTNAME=${HOSTNAME:-localhost}
+EOF
     
+    echo "✅ .env Datei erstellt"
 else
     echo "ℹ️  .env Datei existiert bereits"
     
-    # Wenn .env existiert, aber JWT_SECRET Umgebungsvariable gesetzt ist, aktualisiere sie
+    # Update JWT_SECRET if provided
     if [ -n "$JWT_SECRET" ] && [ "$JWT_SECRET" != "your-secret-key-please-change" ]; then
         echo "🔑 Aktualisiere JWT Secret in .env Datei"
-        # Aktualisiere nur das JWT_SECRET in der .env Datei
         sed -i "s/^JWT_SECRET=.*/JWT_SECRET=$JWT_SECRET/" /app/.env
     fi
 fi
 
-# Validiere dass JWT_SECERT nicht der Standardwert ist
+# Validate JWT_SECRET
 if grep -q "JWT_SECRET=your-secret-key-please-change" /app/.env; then
     echo "❌ FEHLER: Standard JWT Secret in .env gefunden!"
     echo "❌ Bitte setzen Sie JWT_SECRET Umgebungsvariable"
     exit 1
 fi
 
-# Setze sichere Berechtigungen
 chmod 600 /app/.env
 
+echo "🔧 Proxy Configuration:"
+echo "   - TRUST_PROXY_ENABLED: ${TRUST_PROXY_ENABLED:-true}"
+echo "   - TRUSTED_PROXY_IPS: ${TRUSTED_PROXY_IPS:-172.0.0.0/8,10.0.0.0/8,192.168.0.0/16}"
 echo "🔧 Starte Anwendung..."
 exec "$@"

frontend/index.html

@@ -2,7 +2,7 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <link rel="icon" type="image/svg+xml" href="/vite.svg" />
+    <link rel="icon" type="image/svg+xml" href="/donpat1to.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Shift Planning App</title>
   </head>

frontend/package.json

@@ -7,7 +7,9 @@
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "react-router-dom": "^6.28.0",
-    "date-fns": "4.1.0"
+    "date-fns": "4.1.0",
+    "@vitejs/plugin-react": "^4.3.3",
+    "vite": "^6.0.7"
   },
   "devDependencies": {
     "@types/node": "20.19.23",
@@ -25,10 +27,12 @@
     "esbuild": "^0.21.0",
     "terser": "5.44.0",
     "babel-plugin-transform-remove-console": "6.9.4",
-    "framer-motion": "12.23.24"
+    "framer-motion": "12.23.24",
+    "file-saver": "2.0.5",
+    "@types/file-saver": "2.0.5"
   },
   "scripts": {
-    "dev": "vite",
+    "dev": "vite dev",
     "build": "tsc && vite build",
     "preview": "vite preview"
   }

frontend/src/App.tsx

@@ -15,6 +15,8 @@ import EmployeeManagement from './pages/Employees/EmployeeManagement';
 import Settings from './pages/Settings/Settings';
 import Help from './pages/Help/Help';
 import Setup from './pages/Setup/Setup';
+import ErrorBoundary from './components/ErrorBoundary/ErrorBoundary';
+import SecurityWarning from './components/SecurityWarning/SecurityWarning';
 
 // Free Footer Link Pages (always available)
 import FAQ from './components/Layout/FooterLinks/FAQ/FAQ';
@@ -160,14 +162,17 @@ const AppContent: React.FC = () => {
 
 function App() {
   return (
+    <ErrorBoundary>
       <NotificationProvider>
         <AuthProvider>
           <Router>
+            <SecurityWarning />
             <NotificationContainer />
             <AppContent />
           </Router>
         </AuthProvider>
       </NotificationProvider>
+    </ErrorBoundary>
   );
 }
 

frontend/src/components/ErrorBoundary/ErrorBoundary.tsx

@@ -0,0 +1,101 @@
+// src/components/ErrorBoundary/ErrorBoundary.tsx
+import React from 'react';
+
+interface Props {
+  children: React.ReactNode;
+  fallback?: React.ReactNode;
+}
+
+interface State {
+  hasError: boolean;
+  error?: Error;
+}
+
+class ErrorBoundary extends React.Component<Props, State> {
+  constructor(props: Props) {
+    super(props);
+    this.state = { hasError: false };
+  }
+
+  static getDerivedStateFromError(error: Error): State {
+    return { hasError: true, error };
+  }
+
+  componentDidCatch(error: Error, errorInfo: React.ErrorInfo) {
+    console.error('🚨 Application Error:', error);
+    console.error('📋 Error Details:', errorInfo);
+    
+    // In production, send to your error reporting service
+    // logErrorToService(error, errorInfo);
+  }
+
+  render() {
+    if (this.state.hasError) {
+      // You can render any custom fallback UI
+      return this.props.fallback || (
+        <div style={{ 
+          padding: '40px', 
+          textAlign: 'center',
+          fontFamily: 'Arial, sans-serif'
+        }}>
+          <div style={{ fontSize: '48px', marginBottom: '20px' }}>⚠️</div>
+          <h2>Oops! Something went wrong</h2>
+          <p style={{ margin: '20px 0', color: '#666' }}>
+            We encountered an unexpected error. Please try refreshing the page.
+          </p>
+          <div style={{ marginTop: '30px' }}>
+            <button
+              onClick={() => window.location.reload()}
+              style={{
+                padding: '10px 20px',
+                backgroundColor: '#007bff',
+                color: 'white',
+                border: 'none',
+                borderRadius: '4px',
+                cursor: 'pointer',
+                marginRight: '10px'
+              }}
+            >
+              Refresh Page
+            </button>
+            <button
+              onClick={() => this.setState({ hasError: false })}
+              style={{
+                padding: '10px 20px',
+                backgroundColor: '#6c757d',
+                color: 'white',
+                border: 'none',
+                borderRadius: '4px',
+                cursor: 'pointer'
+              }}
+            >
+              Try Again
+            </button>
+          </div>
+          {process.env.NODE_ENV === 'development' && this.state.error && (
+            <details style={{ 
+              marginTop: '20px', 
+              textAlign: 'left',
+              background: '#f8f9fa',
+              padding: '15px',
+              borderRadius: '4px'
+            }}>
+              <summary>Error Details (Development)</summary>
+              <pre style={{ 
+                whiteSpace: 'pre-wrap',
+                fontSize: '12px',
+                color: '#dc3545'
+              }}>
+                {this.state.error.stack}
+              </pre>
+            </details>
+          )}
+        </div>
+      );
+    }
+
+    return this.props.children;
+  }
+}
+
+export default ErrorBoundary;

frontend/src/components/Modal/Modal.tsx

@@ -0,0 +1,122 @@
+import React, { useEffect } from 'react';
+import { BUTTON_COLORS } from '../../utils/buttonStyles';
+
+interface ModalProps {
+  isOpen: boolean;
+  onClose: () => void;
+  title: string;
+  children: React.ReactNode;
+  width?: string;
+}
+
+const Modal: React.FC<ModalProps> = ({
+  isOpen,
+  onClose,
+  title,
+  children,
+  width = '400px'
+}) => {
+  useEffect(() => {
+    const handleEscape = (e: KeyboardEvent) => {
+      if (e.key === 'Escape') {
+        onClose();
+      }
+    };
+
+    if (isOpen) {
+      document.addEventListener('keydown', handleEscape);
+      document.body.style.overflow = 'hidden';
+    }
+
+    return () => {
+      document.removeEventListener('keydown', handleEscape);
+      document.body.style.overflow = 'unset';
+    };
+  }, [isOpen, onClose]);
+
+  if (!isOpen) return null;
+
+  const overlayStyle: React.CSSProperties = {
+    position: 'fixed',
+    top: 0,
+    left: 0,
+    right: 0,
+    bottom: 0,
+    backgroundColor: 'rgba(0, 0, 0, 0.5)',
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'center',
+    zIndex: 9999,
+  };
+
+  const modalStyle: React.CSSProperties = {
+    backgroundColor: 'white',
+    borderRadius: '8px',
+    boxShadow: '0 4px 20px rgba(0, 0, 0, 0.2)',
+    width: width,
+    maxWidth: '90vw',
+    maxHeight: '90vh',
+    overflow: 'auto',
+  };
+
+  const headerStyle: React.CSSProperties = {
+    display: 'flex',
+    justifyContent: 'space-between',
+    alignItems: 'center',
+    padding: '16px 20px',
+    borderBottom: '1px solid #dee2e6',
+    backgroundColor: BUTTON_COLORS.primary,
+    color: 'white',
+    borderRadius: '8px 8px 0 0',
+  };
+
+  const titleStyle: React.CSSProperties = {
+    margin: 0,
+    fontSize: '18px',
+    fontWeight: 'bold',
+  };
+
+  const closeButtonStyle: React.CSSProperties = {
+    background: 'none',
+    border: 'none',
+    color: 'white',
+    fontSize: '24px',
+    cursor: 'pointer',
+    padding: '0',
+    lineHeight: 1,
+    opacity: 0.8,
+  };
+
+  const contentStyle: React.CSSProperties = {
+    padding: '20px',
+  };
+
+  const handleOverlayClick = (e: React.MouseEvent) => {
+    if (e.target === e.currentTarget) {
+      onClose();
+    }
+  };
+
+  return (
+    <div style={overlayStyle} onClick={handleOverlayClick}>
+      <div style={modalStyle} onClick={(e) => e.stopPropagation()}>
+        <div style={headerStyle}>
+          <h3 style={titleStyle}>{title}</h3>
+          <button
+            onClick={onClose}
+            style={closeButtonStyle}
+            onMouseEnter={(e) => { e.currentTarget.style.opacity = '1'; }}
+            onMouseLeave={(e) => { e.currentTarget.style.opacity = '0.8'; }}
+          >
+            &times;
+          </button>
+        </div>
+        <div style={contentStyle}>
+          {children}
+        </div>
+      </div>
+    </div>
+  );
+};
+
+export default Modal;

frontend/src/components/SecurityWarning/SecurityWarning.tsx

@@ -0,0 +1,59 @@
+// src/components/SecurityWarning/SecurityWarning.tsx
+import React, { useState, useEffect } from 'react';
+
+const SecurityWarning: React.FC = () => {
+  const [isHttp, setIsHttp] = useState(false);
+  const [isDismissed, setIsDismissed] = useState(false);
+
+  useEffect(() => {
+    // Check if current protocol is HTTP
+    const checkProtocol = () => {
+      setIsHttp(window.location.protocol === 'http:');
+    };
+
+    checkProtocol();
+    window.addEventListener('load', checkProtocol);
+    
+    return () => window.removeEventListener('load', checkProtocol);
+  }, []);
+
+  if (!isHttp || isDismissed) {
+    return null;
+  }
+
+  return (
+    <div style={{
+      position: 'fixed',
+      top: 0,
+      left: 0,
+      right: 0,
+      backgroundColor: '#ff6b35',
+      color: 'white',
+      padding: '10px 20px',
+      textAlign: 'center',
+      zIndex: 10000,
+      fontSize: '14px',
+      fontWeight: 'bold',
+      boxShadow: '0 2px 4px rgba(0,0,0,0.2)'
+    }}>
+      ⚠️ SECURITY WARNING: This site is being accessed over HTTP. 
+      For secure communication, please use HTTPS.
+      <button 
+        onClick={() => setIsDismissed(true)}
+        style={{
+          marginLeft: '15px',
+          background: 'rgba(255,255,255,0.2)',
+          border: '1px solid white',
+          color: 'white',
+          padding: '2px 8px',
+          borderRadius: '3px',
+          cursor: 'pointer'
+        }}
+      >
+        Dismiss
+      </button>
+    </div>
+  );
+};
+
+export default SecurityWarning;

frontend/src/contexts/AuthContext.tsx

@@ -49,12 +49,21 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
   const checkSetupStatus = async (): Promise<void> => {
     try {
       console.log('🔍 Checking setup status...');
-      const response = await fetch(`${API_BASE_URL}/setup/status`);
+      const startTime = Date.now();
+      
+      const response = await fetch(`${API_BASE_URL}/setup/status`, {
+        signal: AbortSignal.timeout(5000)
+      });
+      
+      console.log(`✅ Setup status response received in ${Date.now() - startTime}ms`);
+      
       if (!response.ok) {
+        console.error('❌ Setup status response not OK:', response.status, response.statusText);
         throw new Error('Setup status check failed');
       }
+      
       const data = await response.json();
-      console.log('✅ Setup status response:', data);
+      console.log('✅ Setup status response data:', data);
       setNeedsSetup(data.needsSetup === true);
     } catch (error) {
       console.error('❌ Error checking setup status:', error);
@@ -95,7 +104,6 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
     }
   };
 
-  // Add the updateUser function
   const updateUser = (userData: Employee) => {
     console.log('🔄 Updating user in auth context:', userData);
     setUser(userData);
@@ -161,6 +169,8 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
     initializeAuth();
   }, []);
 
+  const calculatedNeedsSetup = needsSetup === null ? true : needsSetup;
+
   const value: AuthContextType = {
     user,
     login,
@@ -168,7 +178,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
     hasRole,
     loading,
     refreshUser,
-    needsSetup: needsSetup === null ? true : needsSetup,
+    needsSetup: calculatedNeedsSetup,
     checkSetupStatus,
     updateUser,
   };

frontend/src/design/DesignSystem.txt

@@ -20,6 +20,8 @@ export const designTokens = {
       10: '#ebd7fa',
     },
 
+    manager: '#CC0000',
+    
     // Semantic Colors
     primary: '#51258f',
     secondary: '#642ab5',

frontend/src/hooks/useBackendValidation.ts

@@ -33,35 +33,19 @@ export const useBackendValidation = () => {
         const result = await apiCall();
         return result;
       } catch (error: any) {
-        if (error.validationErrors) {
+        if (error.validationErrors && Array.isArray(error.validationErrors)) {
           setValidationErrors(error.validationErrors);
 
-          // Show specific validation error messages
+          // Show specific validation error messages from backend
-          if (error.validationErrors.length > 0) {
+          error.validationErrors.forEach((validationError: ValidationError, index: number) => {
-            // Show the first validation error as the main notification
+            setTimeout(() => {
-            const firstError = error.validationErrors[0];
               showNotification({
                 type: 'error',
                 title: 'Validierungsfehler',
-              message: firstError.message
+                message: `${validationError.field ? `${validationError.field}: ` : ''}${validationError.message}`
               });
-
+            }, index * 500); // Stagger the notifications
-            // If there are multiple errors, show additional notifications for each
-            if (error.validationErrors.length > 1) {
-              // Wait a bit before showing additional notifications to avoid overlap
-              setTimeout(() => {
-                error.validationErrors.slice(1).forEach((validationError: ValidationError, index: number) => {
-                  setTimeout(() => {
-                    showNotification({
-                      type: 'error',
-                      title: 'Weiterer Fehler',
-                      message: validationError.message
           });
-                  }, index * 300); // Stagger the notifications
-                });
-              }, 500);
-            }
-          }
         } else {
           // Show notification for other errors
           showNotification({

frontend/src/models/defaults/employeeDefaults.ts

@@ -102,7 +102,7 @@ export const AVAILABILITY_PREFERENCES = {
 } as const;
 
 // Default availability for new employees (all shifts unavailable as level 3)
-// UPDATED: Now uses shiftId instead of timeSlotId + dayOfWeek
+// Now uses shiftId instead of timeSlotId + dayOfWeek
 export function createDefaultAvailabilities(employeeId: string, planId: string, shiftIds: string[]): Omit<EmployeeAvailability, 'id'>[] {
   const availabilities: Omit<EmployeeAvailability, 'id'>[] = [];
   

frontend/src/models/helpers/employeeHelpers.ts

@@ -18,12 +18,12 @@ function generateEmail(firstname: string, lastname: string): string {
   return `${cleanFirstname}.${cleanLastname}@sp.de`;
 }
 
-// UPDATED: Validation for new employee model with employee types
+// Validation for new employee model with employee types
 export function validateEmployeeData(employee: CreateEmployeeRequest): string[] {
   const errors: string[] = [];
 
-  if (employee.password?.length < 6) {
+  if (employee.password?.length < 8) {
-    errors.push('Password must be at least 6 characters long');
+    errors.push('Password must be at least 8 characters long');
   }
 
   if (!employee.firstname?.trim() || employee.firstname.trim().length < 2) {
@@ -71,7 +71,7 @@ export function generateEmployeeEmail(firstname: string, lastname: string): stri
   return generateEmail(firstname, lastname);
 }
 
-// UPDATED: Business logic helpers for new employee types
+// Business logic helpers for new employee types
 export const isManager = (employee: Employee): boolean =>
   employee.employeeType === 'manager';
 
@@ -90,7 +90,7 @@ export const isInternal = (employee: Employee): boolean =>
 export const isExternal = (employee: Employee): boolean =>
   employee.employeeType === 'guest';
 
-// UPDATED: Trainee logic - now based on isTrainee field for personell type
+// Trainee logic - now based on isTrainee field for personell type
 export const isTrainee = (employee: Employee): boolean =>
   employee.employeeType === 'personell' && employee.isTrainee;
 
@@ -107,7 +107,7 @@ export const isMaintenance = (employee: Employee): boolean =>
 export const isUser = (employee: Employee): boolean =>
   employee.roles?.includes('user') || false;
 
-// UPDATED: Work alone permission - managers and experienced personell can work alone
+// Work alone permission - managers and experienced personell can work alone
 export const canEmployeeWorkAlone = (employee: Employee): boolean =>
   employee.canWorkAlone && (isManager(employee) || isExperienced(employee));
 
@@ -134,7 +134,7 @@ export function validateAvailabilityData(availability: Omit<EmployeeAvailability
   return errors;
 }
 
-// UPDATED: Helper to get employee type category
+// Helper to get employee type category
 export const getEmployeeCategory = (employee: Employee): 'internal' | 'external' => {
   return isInternal(employee) ? 'internal' : 'external';
 };

frontend/src/models/helpers/shiftPlanHelpers.ts

@@ -78,7 +78,7 @@ export function calculateTotalRequiredEmployees(plan: ShiftPlan): number {
   return plan.shifts.reduce((total, shift) => total + shift.requiredEmployees, 0);
 }
 
-// UPDATED: Get scheduled shift by date and time slot
+// Get scheduled shift by date and time slot
 export function getScheduledShiftByDateAndTime(
   plan: ShiftPlan, 
   date: string, 

frontend/src/models/scheduling.ts

@@ -2,7 +2,7 @@
 import { Employee } from './Employee.js';
 import { ShiftPlan } from './ShiftPlan.js';
 
-// Updated Availability interface to match new schema
+// Availability interface to match
 export interface Availability {
   id: string;
   employeeId: string;

frontend/src/pages/Auth/Login.tsx

@@ -1,4 +1,4 @@
-// frontend/src/pages/Auth/Login.tsx - UPDATED PASSWORD SECTION
+// frontend/src/pages/Auth/Login.tsx
 import React, { useState, useEffect, useRef } from 'react';
 import { useNavigate } from 'react-router-dom';
 import { useAuth } from '../../contexts/AuthContext';

frontend/src/pages/Employees/components/AvailabilityManager.tsx

@@ -317,7 +317,17 @@ const AvailabilityManager: React.FC<AvailabilityManagerProps> = ({
 
     // Convert to array and sort by start time
     const sortedTimeSlots = Array.from(allTimeSlots.values()).sort((a, b) => {
-      return (a.startTime || '').localeCompare(b.startTime || '');
+      // Convert time strings to minutes for proper numeric comparison
+      const timeToMinutes = (timeStr: string) => {
+        if (!timeStr) return 0;
+        const [hours, minutes] = timeStr.split(':').map(Number);
+        return hours * 60 + minutes;
+      };
+
+      const minutesA = timeToMinutes(a.startTime);
+      const minutesB = timeToMinutes(b.startTime);
+      
+      return minutesA - minutesB; // Ascending order (earliest first)
     });
 
     return (

frontend/src/pages/Employees/components/EmployeeForm.tsx

@@ -343,7 +343,8 @@ const useEmployeeForm = (mode: 'create' | 'edit', employee?: Employee) => {
           await executeWithValidation(() =>
             employeeService.changePassword(employee.id, {
               currentPassword: '',
-              newPassword: passwordForm.newPassword
+              newPassword: passwordForm.newPassword,
+              confirmPassword: passwordForm.confirmPassword
             })
           );
         }

frontend/src/pages/Employees/components/EmployeeList.tsx

@@ -4,6 +4,7 @@ import { ROLE_CONFIG, EMPLOYEE_TYPE_CONFIG } from '../../../models/defaults/empl
 import { Employee } from '../../../models/Employee';
 import { useAuth } from '../../../contexts/AuthContext';
 import { useNotification } from '../../../contexts/NotificationContext';
+import { ICONS, iconButtonStyle, BUTTON_COLORS } from '../../../utils/buttonStyles';
 
 interface EmployeeListProps {
   employees: Employee[];
@@ -15,7 +16,7 @@ interface EmployeeListProps {
 type SortField = 'name' | 'employeeType' | 'canWorkAlone' | 'role' | 'lastLogin';
 type SortDirection = 'asc' | 'desc';
 
-// FIXED: Use the actual employee types from the Employee interface
+// Use the actual employee types from the Employee interface
 type EmployeeType = 'manager' | 'personell' | 'apprentice' | 'guest';
 
 const EmployeeList: React.FC<EmployeeListProps> = ({
@@ -130,7 +131,7 @@ const EmployeeList: React.FC<EmployeeListProps> = ({
   const getEmployeeTypeBadge = (type: EmployeeType, isTrainee: boolean = false) => {
     const config = EMPLOYEE_TYPE_CONFIG[type];
 
-    // FIXED: Updated color mapping for actual employee types
+    // Color mapping for actual employee types
     const bgColor =
       type === 'manager'
         ? '#fadbd8' // light red
@@ -326,7 +327,7 @@ const EmployeeList: React.FC<EmployeeListProps> = ({
         </div>
 
         {sortedEmployees.map(employee => {
-          // FIXED: Type assertion to ensure type safety
+          // Type assertion to ensure type safety
           const employeeType = getEmployeeTypeBadge(employee.employeeType as EmployeeType, employee.isTrainee);
           const independence = getIndependenceBadge(employee.canWorkAlone);
           const roleInfo = getRoleBadge(employee.roles);
@@ -455,40 +456,20 @@ const EmployeeList: React.FC<EmployeeListProps> = ({
                 {/* Verfügbarkeit Button */}
                 <button
                   onClick={() => onManageAvailability(employee)}
-                  style={{
+                  style={iconButtonStyle(BUTTON_COLORS.info, false)}
-                    padding: '6px 8px',
-                    backgroundColor: '#3498db',
-                    color: 'white',
-                    border: 'none',
-                    borderRadius: '4px',
-                    cursor: 'pointer',
-                    fontSize: '12px',
-                    minWidth: '32px',
-                    height: '32px'
-                  }}
                   title="Verfügbarkeit verwalten"
                 >
-                  📅
+                  {ICONS.calendar}
                 </button>
 
                 {/* Bearbeiten Button */}
                 {canEdit && (
                   <button
                     onClick={() => onEdit(employee)}
-                    style={{
+                    style={iconButtonStyle(BUTTON_COLORS.edit, false)}
-                      padding: '6px 8px',
-                      backgroundColor: '#f39c12',
-                      color: 'white',
-                      border: 'none',
-                      borderRadius: '4px',
-                      cursor: 'pointer',
-                      fontSize: '12px',
-                      minWidth: '32px',
-                      height: '32px'
-                    }}
                     title="Mitarbeiter bearbeiten"
                   >
-                    ✏️
+                    {ICONS.edit}
                   </button>
                 )}
 
@@ -496,20 +477,10 @@ const EmployeeList: React.FC<EmployeeListProps> = ({
                 {canDelete && (
                   <button
                     onClick={() => handleDeleteClick(employee)}
-                    style={{
+                    style={iconButtonStyle(BUTTON_COLORS.delete, false)}
-                      padding: '6px 8px',
-                      backgroundColor: '#e74c3c',
-                      color: 'white',
-                      border: 'none',
-                      borderRadius: '4px',
-                      cursor: 'pointer',
-                      fontSize: '12px',
-                      minWidth: '32px',
-                      height: '32px'
-                    }}
                     title="Mitarbeiter löschen"
                   >
-                    🗑️
+                    {ICONS.delete}
                   </button>
                 )}
 

frontend/src/pages/Settings/Settings.tsx

@@ -1,8 +1,9 @@
-// frontend/src/pages/Settings/Settings.tsx - UPDATED WITH NEW STYLES
+// frontend/src/pages/Settings/Settings.tsx - UPDATED WITH VALIDATION STRATEGY
 import React, { useState, useEffect, useRef } from 'react';
 import { useAuth } from '../../contexts/AuthContext';
 import { employeeService } from '../../services/employeeService';
 import { useNotification } from '../../contexts/NotificationContext';
+import { useBackendValidation } from '../../hooks/useBackendValidation';
 import AvailabilityManager from '../Employees/components/AvailabilityManager';
 import { Employee } from '../../models/Employee';
 import { styles } from './type/SettingsType';
@@ -10,11 +11,12 @@ import { styles } from './type/SettingsType';
 const Settings: React.FC = () => {
   const { user: currentUser, updateUser } = useAuth();
   const { showNotification } = useNotification();
+  const { executeWithValidation, clearErrors, isSubmitting } = useBackendValidation();
+
   const [activeTab, setActiveTab] = useState<'profile' | 'password' | 'availability'>('profile');
-  const [loading, setLoading] = useState(false);
   const [showAvailabilityManager, setShowAvailabilityManager] = useState(false);
 
-  // Profile form state - updated for firstname/lastname
+  // Profile form state
   const [profileForm, setProfileForm] = useState({
     firstname: currentUser?.firstname || '',
     lastname: currentUser?.lastname || ''
@@ -73,7 +75,7 @@ const Settings: React.FC = () => {
     }));
   };
 
-  // Password visibility handlers for current password
+  // Password visibility handlers
   const handleCurrentPasswordMouseDown = () => {
     currentPasswordTimeoutRef.current = setTimeout(() => {
       setShowCurrentPassword(true);
@@ -88,7 +90,6 @@ const Settings: React.FC = () => {
     setShowCurrentPassword(false);
   };
 
-  // Password visibility handlers for new password
   const handleNewPasswordMouseDown = () => {
     newPasswordTimeoutRef.current = setTimeout(() => {
       setShowNewPassword(true);
@@ -103,7 +104,6 @@ const Settings: React.FC = () => {
     setShowNewPassword(false);
   };
 
-  // Password visibility handlers for confirm password
   const handleConfirmPasswordMouseDown = () => {
     confirmPasswordTimeoutRef.current = setTimeout(() => {
       setShowConfirmPassword(true);
@@ -129,7 +129,6 @@ const Settings: React.FC = () => {
     cleanup();
   };
 
-  // Prevent context menu
   const handleContextMenu = (e: React.MouseEvent) => {
     e.preventDefault();
   };
@@ -138,40 +137,46 @@ const Settings: React.FC = () => {
     e.preventDefault();
     if (!currentUser) return;
 
-    // Validation
+    // BASIC FRONTEND VALIDATION: Only check required fields
-    if (!profileForm.firstname.trim() || !profileForm.lastname.trim()) {
+    if (!profileForm.firstname.trim()) {
       showNotification({
         type: 'error',
         title: 'Fehler',
-        message: 'Vorname und Nachname sind erforderlich'
+        message: 'Vorname ist erforderlich'
+      });
+      return;
+    }
+
+    if (!profileForm.lastname.trim()) {
+      showNotification({
+        type: 'error',
+        title: 'Fehler',
+        message: 'Nachname ist erforderlich'
       });
       return;
     }
 
     try {
-      setLoading(true);
+      // Use executeWithValidation to handle backend validation
-      await employeeService.updateEmployee(currentUser.id, {
+      await executeWithValidation(async () => {
+        const updatedEmployee = await employeeService.updateEmployee(currentUser.id, {
           firstname: profileForm.firstname.trim(),
           lastname: profileForm.lastname.trim()
         });
 
         // Update the auth context with new user data
-      const updatedUser = await employeeService.getEmployee(currentUser.id);
+        updateUser(updatedEmployee);
-      updateUser(updatedUser);
 
         showNotification({
           type: 'success',
           title: 'Erfolg',
           message: 'Profil erfolgreich aktualisiert'
         });
-    } catch (error: any) {
-      showNotification({
-        type: 'error',
-        title: 'Fehler',
-        message: error.message || 'Profil konnte nicht aktualisiert werden'
       });
-    } finally {
+    } catch (error) {
-      setLoading(false);
+      // Backend validation errors are already handled by executeWithValidation
+      // We only need to handle unexpected errors here
+      console.error('Unexpected error:', error);
     }
   };
 
@@ -179,12 +184,30 @@ const Settings: React.FC = () => {
     e.preventDefault();
     if (!currentUser) return;
 
-    // Validation
+    // BASIC FRONTEND VALIDATION: Only check minimum requirements
-    if (passwordForm.newPassword.length < 6) {
+    if (!passwordForm.currentPassword) {
       showNotification({
         type: 'error',
         title: 'Fehler',
-        message: 'Das neue Passwort muss mindestens 6 Zeichen lang sein'
+        message: 'Aktuelles Passwort ist erforderlich'
+      });
+      return;
+    }
+
+    if (!passwordForm.newPassword) {
+      showNotification({
+        type: 'error',
+        title: 'Fehler',
+        message: 'Neues Passwort ist erforderlich'
+      });
+      return;
+    }
+
+    if (passwordForm.newPassword.length < 8) {
+      showNotification({
+        type: 'error',
+        title: 'Fehler',
+        message: 'Das neue Passwort muss mindestens 8 Zeichen lang sein'
       });
       return;
     }
@@ -199,12 +222,12 @@ const Settings: React.FC = () => {
     }
 
     try {
-      setLoading(true);
+      // Use executeWithValidation to handle backend validation
-      
+      await executeWithValidation(async () => {
-      // Use the actual password change endpoint
         await employeeService.changePassword(currentUser.id, {
           currentPassword: passwordForm.currentPassword,
-        newPassword: passwordForm.newPassword
+          newPassword: passwordForm.newPassword,
+          confirmPassword: passwordForm.confirmPassword
         });
 
         showNotification({
@@ -219,14 +242,10 @@ const Settings: React.FC = () => {
           newPassword: '',
           confirmPassword: ''
         });
-    } catch (error: any) {
-      showNotification({
-        type: 'error',
-        title: 'Fehler',
-        message: error.message || 'Passwort konnte nicht geändert werden'
       });
-    } finally {
+    } catch (error) {
-      setLoading(false);
+      // Backend validation errors are already handled by executeWithValidation
+      console.error('Unexpected error:', error);
     }
   };
 
@@ -243,6 +262,12 @@ const Settings: React.FC = () => {
     setShowAvailabilityManager(false);
   };
 
+  // Clear validation errors when switching tabs
+  const handleTabChange = (tab: 'profile' | 'password' | 'availability') => {
+    clearErrors();
+    setActiveTab(tab);
+  };
+
   if (!currentUser) {
     return <div style={{
       textAlign: 'center',
@@ -273,7 +298,7 @@ const Settings: React.FC = () => {
 
         <div style={styles.tabs}>
           <button
-            onClick={() => setActiveTab('profile')}
+            onClick={() => handleTabChange('profile')}
             style={{
               ...styles.tab,
               ...(activeTab === 'profile' ? styles.tabActive : {})
@@ -301,7 +326,7 @@ const Settings: React.FC = () => {
           </button>
 
           <button
-            onClick={() => setActiveTab('password')}
+            onClick={() => handleTabChange('password')}
             style={{
               ...styles.tab,
               ...(activeTab === 'password' ? styles.tabActive : {})
@@ -329,7 +354,7 @@ const Settings: React.FC = () => {
           </button>
 
           <button
-            onClick={() => setActiveTab('availability')}
+            onClick={() => handleTabChange('availability')}
             style={{
               ...styles.tab,
               ...(activeTab === 'availability' ? styles.tabActive : {})
@@ -480,28 +505,28 @@ const Settings: React.FC = () => {
               <div style={styles.actions}>
                 <button
                   type="submit"
-                  disabled={loading || !profileForm.firstname.trim() || !profileForm.lastname.trim()}
+                  disabled={isSubmitting || !profileForm.firstname.trim() || !profileForm.lastname.trim()}
                   style={{
                     ...styles.button,
                     ...styles.buttonPrimary,
-                    ...((loading || !profileForm.firstname.trim() || !profileForm.lastname.trim()) ? styles.buttonDisabled : {})
+                    ...((isSubmitting || !profileForm.firstname.trim() || !profileForm.lastname.trim()) ? styles.buttonDisabled : {})
                   }}
                   onMouseEnter={(e) => {
-                    if (!loading && profileForm.firstname.trim() && profileForm.lastname.trim()) {
+                    if (!isSubmitting && profileForm.firstname.trim() && profileForm.lastname.trim()) {
                       e.currentTarget.style.background = styles.buttonPrimaryHover.background;
                       e.currentTarget.style.transform = styles.buttonPrimaryHover.transform;
                       e.currentTarget.style.boxShadow = styles.buttonPrimaryHover.boxShadow;
                     }
                   }}
                   onMouseLeave={(e) => {
-                    if (!loading && profileForm.firstname.trim() && profileForm.lastname.trim()) {
+                    if (!isSubmitting && profileForm.firstname.trim() && profileForm.lastname.trim()) {
                       e.currentTarget.style.background = styles.buttonPrimary.background;
                       e.currentTarget.style.transform = 'none';
                       e.currentTarget.style.boxShadow = styles.buttonPrimary.boxShadow;
                     }
                   }}
                 >
-                  {loading ? '⏳ Wird gespeichert...' : 'Profil aktualisieren'}
+                  {isSubmitting ? '⏳ Wird gespeichert...' : 'Profil aktualisieren'}
                 </button>
               </div>
             </form>
@@ -575,9 +600,9 @@ const Settings: React.FC = () => {
                       value={passwordForm.newPassword}
                       onChange={handlePasswordChange}
                       required
-                      minLength={6}
+                      minLength={8}
                       style={styles.fieldInputWithIcon}
-                      placeholder="Mindestens 6 Zeichen"
+                      placeholder="Mindestens 8 Zeichen"
                       onFocus={(e) => {
                         e.target.style.borderColor = '#1a1325';
                         e.target.style.boxShadow = '0 0 0 3px rgba(26, 19, 37, 0.1)';
@@ -606,7 +631,7 @@ const Settings: React.FC = () => {
                     </button>
                   </div>
                   <div style={styles.fieldHint}>
-                    Das Passwort muss mindestens 6 Zeichen lang sein.
+                    Das Passwort muss mindestens 8 Zeichen lang sein.
                   </div>
                 </div>
 
@@ -657,28 +682,28 @@ const Settings: React.FC = () => {
               <div style={styles.actions}>
                 <button
                   type="submit"
-                  disabled={loading || !passwordForm.currentPassword || !passwordForm.newPassword || !passwordForm.confirmPassword}
+                  disabled={isSubmitting || !passwordForm.currentPassword || !passwordForm.newPassword || !passwordForm.confirmPassword}
                   style={{
                     ...styles.button,
                     ...styles.buttonPrimary,
-                    ...((loading || !passwordForm.currentPassword || !passwordForm.newPassword || !passwordForm.confirmPassword) ? styles.buttonDisabled : {})
+                    ...((isSubmitting || !passwordForm.currentPassword || !passwordForm.newPassword || !passwordForm.confirmPassword) ? styles.buttonDisabled : {})
                   }}
                   onMouseEnter={(e) => {
-                    if (!loading && passwordForm.currentPassword && passwordForm.newPassword && passwordForm.confirmPassword) {
+                    if (!isSubmitting && passwordForm.currentPassword && passwordForm.newPassword && passwordForm.confirmPassword) {
                       e.currentTarget.style.background = styles.buttonPrimaryHover.background;
                       e.currentTarget.style.transform = styles.buttonPrimaryHover.transform;
                       e.currentTarget.style.boxShadow = styles.buttonPrimaryHover.boxShadow;
                     }
                   }}
                   onMouseLeave={(e) => {
-                    if (!loading && passwordForm.currentPassword && passwordForm.newPassword && passwordForm.confirmPassword) {
+                    if (!isSubmitting && passwordForm.currentPassword && passwordForm.newPassword && passwordForm.confirmPassword) {
                       e.currentTarget.style.background = styles.buttonPrimary.background;
                       e.currentTarget.style.transform = 'none';
                       e.currentTarget.style.boxShadow = styles.buttonPrimary.boxShadow;
                     }
                   }}
                 >
-                  {loading ? '⏳ Wird geändert...' : 'Passwort ändern'}
+                  {isSubmitting ? '⏳ Wird geändert...' : 'Passwort ändern'}
                 </button>
               </div>
             </form>

frontend/src/pages/Settings/type/SettingsType.tsx

@@ -1,4 +1,4 @@
-// frontend/src/pages/Settings/type/SettingsType.tsx - CORRECTED
+// frontend/src/pages/Settings/type/SettingsType.tsx
 export const styles = {
   container: {
     display: 'flex',

frontend/src/pages/Setup/Setup.tsx

@@ -62,8 +62,8 @@ const useSetup = () => {
   };
 
   const validateStep2 = (): boolean => {
-    if (formData.password.length < 6) {
+    if (formData.password.length < 8) {
-      setError('Das Passwort muss mindestens 6 Zeichen lang sein.');
+      setError('Das Passwort muss mindestens 8 Zeichen lang sein.');
       return false;
     }
     if (formData.password !== formData.confirmPassword) {
@@ -186,7 +186,7 @@ const useSetup = () => {
   const isStepCompleted = (stepIndex: number): boolean => {
     switch (stepIndex) {
       case 0:
-        return formData.password.length >= 6 && 
+        return formData.password.length >= 8 &&
           formData.password === formData.confirmPassword;
       case 1:
         return !!formData.firstname.trim() && !!formData.lastname.trim();
@@ -342,7 +342,7 @@ const Step2Content: React.FC<StepContentProps> = ({
           fontSize: '1rem',
           transition: 'border-color 0.3s ease'
         }}
-        placeholder="Mindestens 6 Zeichen"
+        placeholder="Mindestens 8 Zeichen"
         required
         autoComplete="new-password"
       />

frontend/src/pages/ShiftPlans/ShiftPlanEdit.tsx

@@ -1,10 +1,32 @@
 // frontend/src/pages/ShiftPlans/ShiftPlanEdit.tsx
-import React, { useState, useEffect } from 'react';
+import React, { useState, useEffect, useMemo } from 'react';
 import { useParams, useNavigate } from 'react-router-dom';
 import { shiftPlanService } from '../../services/shiftPlanService';
-import { ShiftPlan, Shift, ScheduledShift } from '../../models/ShiftPlan';
+import { ShiftPlan, Shift, TimeSlot } from '../../models/ShiftPlan';
 import { useNotification } from '../../contexts/NotificationContext';
 import { useBackendValidation } from '../../hooks/useBackendValidation';
+import { formatTime } from '../../utils/foramatters';
+import {
+  ICONS,
+  smallDeleteButton,
+  addTextButton,
+  cancelTextButton,
+  addOutlineButton,
+  BUTTON_COLORS,
+} from '../../utils/buttonStyles';
+import ShiftCell from './components/ShiftCell';
+import TimeSlotEditor from './components/TimeSlotEditor';
+import AddDayButton from './components/AddDayButton';
+
+const DAYS_OF_WEEK = [
+  { id: 1, name: 'Montag', shortName: 'Mo' },
+  { id: 2, name: 'Dienstag', shortName: 'Di' },
+  { id: 3, name: 'Mittwoch', shortName: 'Mi' },
+  { id: 4, name: 'Donnerstag', shortName: 'Do' },
+  { id: 5, name: 'Freitag', shortName: 'Fr' },
+  { id: 6, name: 'Samstag', shortName: 'Sa' },
+  { id: 7, name: 'Sonntag', shortName: 'So' },
+];
 
 const ShiftPlanEdit: React.FC = () => {
   const { id } = useParams<{ id: string }>();
@@ -14,17 +36,29 @@ const ShiftPlanEdit: React.FC = () => {
 
   const [shiftPlan, setShiftPlan] = useState<ShiftPlan | null>(null);
   const [loading, setLoading] = useState(true);
-  const [editingShift, setEditingShift] = useState<Shift | null>(null);
+  const [activeDays, setActiveDays] = useState<number[]>([]);
-  const [newShift, setNewShift] = useState<Partial<Shift>>({
+
-    timeSlotId: '',
+  // New time slot form state
-    dayOfWeek: 1,
+  const [showAddTimeSlot, setShowAddTimeSlot] = useState(false);
-    requiredEmployees: 1
+  const [newTimeSlot, setNewTimeSlot] = useState({
+    name: '',
+    startTime: '08:00',
+    endTime: '12:00',
+    description: '',
   });
 
   useEffect(() => {
     loadShiftPlan();
   }, [id]);
 
+  useEffect(() => {
+    if (shiftPlan) {
+      // Determine active days from existing shifts
+      const daysWithShifts = new Set(shiftPlan.shifts.map(s => s.dayOfWeek));
+      setActiveDays(Array.from(daysWithShifts).sort((a, b) => a - b));
+    }
+  }, [shiftPlan]);
+
   const loadShiftPlan = async () => {
     if (!id) return;
 
@@ -41,68 +75,223 @@ const ShiftPlanEdit: React.FC = () => {
     });
   };
 
-  const handleUpdateShift = async (shift: Shift) => {
+  // Get shift for a specific cell
+  const getShift = (timeSlotId: string, dayOfWeek: number): Shift | null => {
+    if (!shiftPlan) return null;
+    return shiftPlan.shifts.find(
+      s => s.timeSlotId === timeSlotId && s.dayOfWeek === dayOfWeek
+    ) || null;
+  };
+
+  // Count shifts for a time slot
+  const getShiftsCountForSlot = (slotId: string): number => {
+    if (!shiftPlan) return 0;
+    return shiftPlan.shifts.filter(s => s.timeSlotId === slotId).length;
+  };
+
+  // Sort time slots by start time (early to late)
+  const sortedTimeSlots = useMemo(() => {
+    if (!shiftPlan) return [];
+
+    const timeToMinutes = (timeStr: string): number => {
+      if (!timeStr) return 0;
+      const [hours, minutes] = timeStr.split(':').map(Number);
+      return hours * 60 + minutes;
+    };
+
+    return [...shiftPlan.timeSlots].sort((a, b) => {
+      const minutesA = timeToMinutes(a.startTime);
+      const minutesB = timeToMinutes(b.startTime);
+      return minutesA - minutesB;
+    });
+  }, [shiftPlan]);
+
+  // Add a new day column
+  const handleAddDay = (dayOfWeek: number) => {
+    if (!activeDays.includes(dayOfWeek)) {
+      setActiveDays([...activeDays, dayOfWeek].sort((a, b) => a - b));
+    }
+  };
+
+  // Remove a day column (delete all shifts for that day)
+  const handleRemoveDay = async (dayOfWeek: number) => {
     if (!shiftPlan || !id) return;
 
+    const shiftsForDay = shiftPlan.shifts.filter(s => s.dayOfWeek === dayOfWeek);
+
+    if (shiftsForDay.length > 0) {
+      const confirmed = await confirmDialog({
+        title: 'Tag entfernen',
+        message: `Dieser Tag enthält ${shiftsForDay.length} Schicht(en). Alle Schichten für diesen Tag werden gelöscht. Fortfahren?`,
+        confirmText: 'Löschen',
+        cancelText: 'Abbrechen',
+        type: 'warning'
+      });
+
+      if (!confirmed) return;
+
+      // Delete all shifts for this day
       await executeWithValidation(async () => {
-      // Update logic here - will be implemented when backend API is available
+        for (const shift of shiftsForDay) {
-      // For now, just simulate success
+          await shiftPlanService.deleteShift(id, shift.id);
-      console.log('Updating shift:', shift);
+        }
-      
+        await loadShiftPlan();
-      loadShiftPlan();
-      setEditingShift(null);
-      
         showNotification({
           type: 'success',
           title: 'Erfolg',
-        message: 'Schicht wurde erfolgreich aktualisiert.'
+          message: `Alle Schichten für diesen Tag wurden gelöscht.`
         });
       });
-  };
-
-  const handleAddShift = async () => {
-    if (!shiftPlan || !id) return;
-    
-    // Basic frontend validation only
-    if (!newShift.timeSlotId) {
-      showNotification({
-        type: 'error',
-        title: 'Fehlende Angaben',
-        message: 'Bitte wählen Sie einen Zeit-Slot aus.'
-      });
-      return;
     }
 
-    if (!newShift.requiredEmployees || newShift.requiredEmployees < 1) {
+    setActiveDays(activeDays.filter(d => d !== dayOfWeek));
+  };
+
+  // Add a new time slot
+  const handleAddTimeSlot = async () => {
+    if (!id || !newTimeSlot.name || !newTimeSlot.startTime || !newTimeSlot.endTime) {
       showNotification({
         type: 'error',
         title: 'Fehlende Angaben',
-        message: 'Bitte geben Sie die Anzahl der benötigten Mitarbeiter an.'
+        message: 'Bitte füllen Sie alle Pflichtfelder aus.'
       });
       return;
     }
 
     await executeWithValidation(async () => {
-      // Add shift logic here - will be implemented when backend API is available
+      await shiftPlanService.addTimeSlot(id, {
-      // For now, just simulate success
+        name: newTimeSlot.name,
-      console.log('Adding shift:', newShift);
+        startTime: newTimeSlot.startTime,
+        endTime: newTimeSlot.endTime,
+        description: newTimeSlot.description || undefined,
+      });
 
       showNotification({
         type: 'success',
         title: 'Erfolg',
-        message: 'Neue Schicht wurde hinzugefügt.'
+        message: 'Zeit-Slot wurde hinzugefügt.'
       });
 
-      setNewShift({
+      setNewTimeSlot({ name: '', startTime: '08:00', endTime: '12:00', description: '' });
-        timeSlotId: '',
+      setShowAddTimeSlot(false);
-        dayOfWeek: 1,
+      await loadShiftPlan();
-        requiredEmployees: 1
-      });
-      loadShiftPlan();
     });
   };
 
+  // Update a time slot
+  const handleUpdateTimeSlot = async (
+    slot: TimeSlot,
+    name: string,
+    startTime: string,
+    endTime: string,
+    description?: string
+  ) => {
+    if (!id) return;
+
+    await executeWithValidation(async () => {
+      await shiftPlanService.updateTimeSlot(id, slot.id, {
+        name,
+        startTime,
+        endTime,
+        description,
+      });
+
+      showNotification({
+        type: 'success',
+        title: 'Erfolg',
+        message: 'Zeit-Slot wurde aktualisiert.'
+      });
+
+      await loadShiftPlan();
+    });
+  };
+
+  // Delete a time slot
+  const handleDeleteTimeSlot = async (slotId: string) => {
+    if (!id || !shiftPlan) return;
+
+    const shiftsCount = getShiftsCountForSlot(slotId);
+
+    const confirmed = await confirmDialog({
+      title: 'Zeit-Slot löschen',
+      message: shiftsCount > 0
+        ? `Dieser Zeit-Slot enthält ${shiftsCount} Schicht(en). Alle zugehörigen Schichten werden ebenfalls gelöscht. Fortfahren?`
+        : 'Möchten Sie diesen Zeit-Slot wirklich löschen?',
+      confirmText: 'Löschen',
+      cancelText: 'Abbrechen',
+      type: 'warning'
+    });
+
+    if (!confirmed) return;
+
+    await executeWithValidation(async () => {
+      await shiftPlanService.deleteTimeSlot(id, slotId);
+
+      showNotification({
+        type: 'success',
+        title: 'Erfolg',
+        message: 'Zeit-Slot wurde gelöscht.'
+      });
+
+      await loadShiftPlan();
+    });
+  };
+
+  // Add a new shift
+  const handleAddShift = async (
+    dayOfWeek: number,
+    timeSlotId: string,
+    requiredEmployees: number,
+    color: string
+  ) => {
+    if (!id) return;
+
+    await executeWithValidation(async () => {
+      await shiftPlanService.addShift(id, {
+        dayOfWeek,
+        timeSlotId,
+        requiredEmployees,
+        color,
+      });
+
+      showNotification({
+        type: 'success',
+        title: 'Erfolg',
+        message: 'Schicht wurde hinzugefügt.'
+      });
+
+      await loadShiftPlan();
+    });
+  };
+
+  // Update a shift
+  const handleUpdateShift = async (
+    shift: Shift,
+    requiredEmployees: number,
+    color: string
+  ) => {
+    if (!id) return;
+
+    await executeWithValidation(async () => {
+      await shiftPlanService.updateShift(id, shift.id, {
+        requiredEmployees,
+        color,
+      });
+
+      showNotification({
+        type: 'success',
+        title: 'Erfolg',
+        message: 'Schicht wurde aktualisiert.'
+      });
+
+      await loadShiftPlan();
+    });
+  };
+
+  // Delete a shift
   const handleDeleteShift = async (shiftId: string) => {
+    if (!id) return;
+
     const confirmed = await confirmDialog({
       title: 'Schicht löschen',
       message: 'Möchten Sie diese Schicht wirklich löschen?',
@@ -114,20 +303,19 @@ const ShiftPlanEdit: React.FC = () => {
     if (!confirmed) return;
 
     await executeWithValidation(async () => {
-      // Delete logic here - will be implemented when backend API is available
+      await shiftPlanService.deleteShift(id, shiftId);
-      // For now, just simulate success
-      console.log('Deleting shift:', shiftId);
-      
-      loadShiftPlan();
 
       showNotification({
         type: 'success',
         title: 'Erfolg',
-        message: 'Schicht wurde erfolgreich gelöscht.'
+        message: 'Schicht wurde gelöscht.'
       });
+
+      await loadShiftPlan();
     });
   };
 
+  // Publish the shift plan
   const handlePublish = async () => {
     if (!shiftPlan || !id) return;
 
@@ -143,7 +331,7 @@ const ShiftPlanEdit: React.FC = () => {
         message: 'Schichtplan wurde veröffentlicht.'
       });
 
-      loadShiftPlan();
+      await loadShiftPlan();
     });
   };
 
@@ -173,34 +361,19 @@ const ShiftPlanEdit: React.FC = () => {
     );
   }
 
-  // Group shifts by dayOfWeek
+  const hasTimeSlots = shiftPlan.timeSlots.length > 0;
-  const shiftsByDay = shiftPlan.shifts.reduce((acc, shift) => {
+  const hasActiveDays = activeDays.length > 0;
-    if (!acc[shift.dayOfWeek]) {
-      acc[shift.dayOfWeek] = [];
-    }
-    acc[shift.dayOfWeek].push(shift);
-    return acc;
-  }, {} as Record<number, typeof shiftPlan.shifts>);
-
-  const daysOfWeek = [
-    { id: 1, name: 'Montag' },
-    { id: 2, name: 'Dienstag' },
-    { id: 3, name: 'Mittwoch' },
-    { id: 4, name: 'Donnerstag' },
-    { id: 5, name: 'Freitag' },
-    { id: 6, name: 'Samstag' },
-    { id: 7, name: 'Sonntag' }
-  ];
 
   return (
     <div style={{ padding: '20px' }}>
+      {/* Header */}
       <div style={{
         display: 'flex',
         justifyContent: 'space-between',
         alignItems: 'center',
         marginBottom: '30px'
       }}>
-        <h1>{shiftPlan.name} bearbeiten</h1>
+        <h1 style={{ margin: 0 }}>{shiftPlan.name} bearbeiten</h1>
         <div>
           {shiftPlan.status === 'draft' && (
             <button
@@ -238,211 +411,329 @@ const ShiftPlanEdit: React.FC = () => {
         </div>
       </div>
 
-      {/* Add new shift form */}
+      {/* Empty State */}
+      {!hasTimeSlots && !hasActiveDays && (
         <div style={{
           backgroundColor: 'white',
           borderRadius: '8px',
-        padding: '20px',
+          padding: '60px 40px',
+          textAlign: 'center',
+          boxShadow: '0 2px 4px rgba(0,0,0,0.1)',
           marginBottom: '20px',
-        boxShadow: '0 2px 4px rgba(0,0,0,0.1)'
         }}>
-        <h3>Neue Schicht hinzufügen</h3>
+          <div style={{ fontSize: '48px', marginBottom: '16px', opacity: 0.5 }}>
-        <div style={{ display: 'grid', gap: '15px', gridTemplateColumns: 'repeat(auto-fit, minmax(200px, 1fr))' }}>
+            📋
-          <div>
-            <label>Wochentag</label>
-            <select
-              value={newShift.dayOfWeek}
-              onChange={(e) => setNewShift({ ...newShift, dayOfWeek: parseInt(e.target.value) })}
-              style={{ width: '100%', padding: '8px', borderRadius: '4px', border: '1px solid #ddd' }}
-              disabled={isSubmitting}
-            >
-              {daysOfWeek.map(day => (
-                <option key={day.id} value={day.id}>{day.name}</option>
-              ))}
-            </select>
-          </div>
-          <div>
-            <label>Zeit-Slot</label>
-            <select
-              value={newShift.timeSlotId}
-              onChange={(e) => setNewShift({ ...newShift, timeSlotId: e.target.value })}
-              style={{ width: '100%', padding: '8px', borderRadius: '4px', border: '1px solid #ddd' }}
-              disabled={isSubmitting}
-            >
-              <option value="">Bitte auswählen...</option>
-              {shiftPlan.timeSlots.map(slot => (
-                <option key={slot.id} value={slot.id}>
-                  {slot.name} ({slot.startTime}-{slot.endTime})
-                </option>
-              ))}
-            </select>
-          </div>
-          <div>
-            <label>Benötigte Mitarbeiter</label>
-            <input
-              type="number"
-              min="1"
-              value={newShift.requiredEmployees}
-              onChange={(e) => setNewShift({ ...newShift, requiredEmployees: parseInt(e.target.value) || 1 })}
-              style={{ width: '100%', padding: '8px', borderRadius: '4px', border: '1px solid #ddd' }}
-              disabled={isSubmitting}
-            />
-          </div>
           </div>
+          <h2 style={{ color: '#2c3e50', marginBottom: '8px' }}>
+            Keine Schichten vorhanden
+          </h2>
+          <p style={{ color: '#666', marginBottom: '24px' }}>
+            Fügen Sie zunächst einen Zeit-Slot hinzu und wählen Sie dann die Tage aus,
+            an denen Schichten stattfinden sollen.
+          </p>
           <button
-          onClick={handleAddShift}
+            onClick={() => setShowAddTimeSlot(true)}
-          disabled={isSubmitting || !newShift.timeSlotId || !newShift.requiredEmployees}
             style={{
-            marginTop: '15px',
+              ...addTextButton(false),
-            padding: '8px 16px',
+              padding: '12px 24px',
-            backgroundColor: isSubmitting ? '#bdc3c7' : '#3498db',
+              fontSize: '16px',
-            color: 'white',
-            border: 'none',
-            borderRadius: '4px',
-            cursor: isSubmitting ? 'not-allowed' : 'pointer',
-            opacity: (!newShift.timeSlotId || !newShift.requiredEmployees) ? 0.6 : 1
             }}
           >
-          {isSubmitting ? 'Wird hinzugefügt...' : 'Schicht hinzufügen'}
+            {ICONS.add} Zeit-Slot hinzufügen
           </button>
         </div>
+      )}
 
-      {/* Existing shifts */}
+      {/* Grid Editor */}
-      <div style={{ display: 'grid', gap: '20px' }}>
+      {(hasTimeSlots || hasActiveDays) && (
-        {daysOfWeek.map(day => {
+        <div style={{
-          const shifts = shiftsByDay[day.id] || [];
+          marginBottom: '30px',
-          if (shifts.length === 0) return null;
+          border: '1px solid #e0e0e0',
-          
-          return (
-            <div key={day.id} style={{
-              backgroundColor: 'white',
           borderRadius: '8px',
-              padding: '20px',
+          overflow: 'hidden'
-              boxShadow: '0 2px 4px rgba(0,0,0,0.1)'
         }}>
-              <h3 style={{ marginTop: 0 }}>{day.name}</h3>
+          {/* Header bar matching ShiftPlanView */}
-              <div style={{ display: 'grid', gap: '15px' }}>
+          <div style={{
-                {shifts.map(shift => {
+            backgroundColor: '#2c3e50',
-                  const timeSlot = shiftPlan.timeSlots.find(ts => ts.id === shift.timeSlotId);
+            color: 'white',
-                  return (
+            padding: '15px 20px',
-                    <div key={shift.id} style={{
+            fontWeight: 'bold'
-                      backgroundColor: '#f8f9fa',
-                      padding: '15px',
-                      borderRadius: '6px',
-                      boxShadow: '0 1px 3px rgba(0,0,0,0.05)'
           }}>
-                      {editingShift?.id === shift.id ? (
+            Schichtplan bearbeiten
-                        <div style={{ display: 'grid', gap: '10px', gridTemplateColumns: 'repeat(auto-fit, minmax(200px, 1fr))' }}>
+            <div style={{ fontSize: '14px', fontWeight: 'normal', marginTop: '5px' }}>
-                          <div>
+              {sortedTimeSlots.length} Zeitslots • {activeDays.length} Tage
-                            <label>Zeit-Slot</label>
-                            <select
-                              value={editingShift.timeSlotId}
-                              onChange={(e) => setEditingShift({ ...editingShift, timeSlotId: e.target.value })}
-                              style={{ width: '100%', padding: '8px', borderRadius: '4px', border: '1px solid #ddd' }}
-                              disabled={isSubmitting}
-                            >
-                              {shiftPlan.timeSlots.map(slot => (
-                                <option key={slot.id} value={slot.id}>
-                                  {slot.name} ({slot.startTime}-{slot.endTime})
-                                </option>
-                              ))}
-                            </select>
             </div>
+          </div>
+
+          <div style={{ overflowX: 'auto' }}>
+            <table style={{
+              width: '100%',
+              borderCollapse: 'collapse',
+              backgroundColor: 'white'
+            }}>
+              <thead>
+                <tr style={{ backgroundColor: '#f8f9fa' }}>
+                  <th style={{
+                    padding: '12px 16px',
+                    textAlign: 'left',
+                    border: '1px solid #dee2e6',
+                    fontWeight: 'bold',
+                    minWidth: '180px'
+                  }}>
+                    Schicht (Zeit)
+                  </th>
+                  {activeDays.map(dayId => {
+                    const day = DAYS_OF_WEEK.find(d => d.id === dayId);
+                    return (
+                      <th key={dayId} style={{
+                        padding: '12px 16px',
+                        textAlign: 'center',
+                        border: '1px solid #dee2e6',
+                        fontWeight: 'bold',
+                        minWidth: '120px'
+                      }}>
+                        <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', gap: '8px' }}>
+                          <span>{day?.name}</span>
+                          <button
+                            onClick={() => handleRemoveDay(dayId)}
+                            disabled={isSubmitting}
+                            style={smallDeleteButton(isSubmitting)}
+                            title="Tag entfernen"
+                          >
+                            {ICONS.delete}
+                          </button>
+                        </div>
+                      </th>
+                    );
+                  })}
+                  <th style={{
+                    padding: '12px 16px',
+                    textAlign: 'center',
+                    border: '1px solid #dee2e6',
+                    minWidth: '70px',
+                    backgroundColor: '#f8f9fa',
+                  }}>
+                    <AddDayButton
+                      activeDays={activeDays}
+                      onAddDay={handleAddDay}
+                      disabled={isSubmitting}
+                    />
+                  </th>
+                </tr>
+              </thead>
+              <tbody>
+                {sortedTimeSlots.map((slot, index) => (
+                  <tr key={slot.id} style={{
+                    backgroundColor: index % 2 === 0 ? 'white' : '#f8f9fa'
+                  }}>
+                    <td style={{
+                      padding: '12px 16px',
+                      border: '1px solid #dee2e6',
+                      fontWeight: '500',
+                      backgroundColor: '#f8f9fa',
+                      position: 'sticky',
+                      left: 0
+                    }}>
+                      <TimeSlotEditor
+                        slot={slot}
+                        onUpdate={handleUpdateTimeSlot}
+                        onDelete={handleDeleteTimeSlot}
+                        shiftsCount={getShiftsCountForSlot(slot.id)}
+                        disabled={isSubmitting}
+                      />
+                    </td>
+                    {activeDays.map(dayId => (
+                      <ShiftCell
+                        key={`${slot.id}-${dayId}`}
+                        shift={getShift(slot.id, dayId)}
+                        dayOfWeek={dayId}
+                        timeSlotId={slot.id}
+                        onAdd={handleAddShift}
+                        onEdit={handleUpdateShift}
+                        onDelete={handleDeleteShift}
+                        disabled={isSubmitting}
+                      />
+                    ))}
+                    <td style={{
+                      border: '1px solid #dee2e6',
+                      padding: '8px',
+                      textAlign: 'center',
+                    }}>
+                      <button
+                        onClick={() => handleDeleteTimeSlot(slot.id)}
+                        disabled={isSubmitting}
+                        style={smallDeleteButton(isSubmitting)}
+                        title="Zeit-Slot löschen"
+                      >
+                        {ICONS.delete}
+                      </button>
+                    </td>
+                  </tr>
+                ))}
+
+                {/* Add Time Slot Row */}
+                <tr>
+                  <td colSpan={activeDays.length + 2} style={{
+                    padding: '16px',
+                    borderTop: '2px solid #dee2e6',
+                  }}>
+                    {showAddTimeSlot ? (
+                      <div style={{
+                        display: 'flex',
+                        gap: '12px',
+                        alignItems: 'flex-end',
+                        flexWrap: 'wrap',
+                      }}>
                         <div>
-                            <label>Benötigte Mitarbeiter</label>
+                          <label style={{ display: 'block', fontSize: '12px', marginBottom: '4px', color: '#666' }}>
+                            Name *
+                          </label>
                           <input
-                              type="number"
+                            type="text"
-                              min="1"
+                            value={newTimeSlot.name}
-                              value={editingShift.requiredEmployees}
+                            onChange={(e) => setNewTimeSlot({ ...newTimeSlot, name: e.target.value })}
-                              onChange={(e) => setEditingShift({ ...editingShift, requiredEmployees: parseInt(e.target.value) || 1 })}
+                            placeholder="z.B. Vormittag"
-                              style={{ width: '100%', padding: '8px', borderRadius: '4px', border: '1px solid #ddd' }}
+                            style={{
+                              padding: '8px',
+                              borderRadius: '4px',
+                              border: '1px solid #ddd',
+                              width: '150px',
+                            }}
                             disabled={isSubmitting}
                           />
                         </div>
-                          <div style={{ display: 'flex', gap: '10px', alignItems: 'flex-end' }}>
+                        <div>
-                            <button
+                          <label style={{ display: 'block', fontSize: '12px', marginBottom: '4px', color: '#666' }}>
-                              onClick={() => handleUpdateShift(editingShift)}
+                            Startzeit *
-                              disabled={isSubmitting}
+                          </label>
+                          <input
+                            type="time"
+                            value={newTimeSlot.startTime}
+                            onChange={(e) => setNewTimeSlot({ ...newTimeSlot, startTime: e.target.value })}
                             style={{
-                                padding: '8px 16px',
+                              padding: '8px',
-                                backgroundColor: isSubmitting ? '#bdc3c7' : '#2ecc71',
-                                color: 'white',
-                                border: 'none',
                               borderRadius: '4px',
-                                cursor: isSubmitting ? 'not-allowed' : 'pointer'
+                              border: '1px solid #ddd',
                             }}
+                            disabled={isSubmitting}
+                          />
+                        </div>
+                        <div>
+                          <label style={{ display: 'block', fontSize: '12px', marginBottom: '4px', color: '#666' }}>
+                            Endzeit *
+                          </label>
+                          <input
+                            type="time"
+                            value={newTimeSlot.endTime}
+                            onChange={(e) => setNewTimeSlot({ ...newTimeSlot, endTime: e.target.value })}
+                            style={{
+                              padding: '8px',
+                              borderRadius: '4px',
+                              border: '1px solid #ddd',
+                            }}
+                            disabled={isSubmitting}
+                          />
+                        </div>
+                        <div>
+                          <label style={{ display: 'block', fontSize: '12px', marginBottom: '4px', color: '#666' }}>
+                            Beschreibung
+                          </label>
+                          <input
+                            type="text"
+                            value={newTimeSlot.description}
+                            onChange={(e) => setNewTimeSlot({ ...newTimeSlot, description: e.target.value })}
+                            placeholder="Optional"
+                            style={{
+                              padding: '8px',
+                              borderRadius: '4px',
+                              border: '1px solid #ddd',
+                              width: '150px',
+                            }}
+                            disabled={isSubmitting}
+                          />
+                        </div>
+                        <button
+                          onClick={handleAddTimeSlot}
+                          disabled={isSubmitting || !newTimeSlot.name}
+                          style={addTextButton(isSubmitting || !newTimeSlot.name)}
                         >
-                              {isSubmitting ? 'Speichern...' : 'Speichern'}
+                          {ICONS.add} Hinzufügen
                         </button>
                         <button
-                              onClick={() => setEditingShift(null)}
+                          onClick={() => {
-                              disabled={isSubmitting}
+                            setShowAddTimeSlot(false);
-                              style={{
+                            setNewTimeSlot({ name: '', startTime: '08:00', endTime: '12:00', description: '' });
-                                padding: '8px 16px',
-                                backgroundColor: '#95a5a6',
-                                color: 'white',
-                                border: 'none',
-                                borderRadius: '4px',
-                                cursor: isSubmitting ? 'not-allowed' : 'pointer',
-                                opacity: isSubmitting ? 0.6 : 1
                           }}
+                          disabled={isSubmitting}
+                          style={cancelTextButton(isSubmitting)}
                         >
                           Abbrechen
                         </button>
                       </div>
-                        </div>
                     ) : (
-                        <>
-                          <div style={{ fontWeight: 'bold', marginBottom: '5px' }}>
-                            {timeSlot?.name} ({timeSlot?.startTime?.substring(0, 5)} - {timeSlot?.endTime?.substring(0, 5)})
-                          </div>
-                          <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center' }}>
-                            <div style={{ fontSize: '14px', color: '#666' }}>
-                              <span>Benötigte Mitarbeiter: {shift.requiredEmployees}</span>
-                            </div>
-                            <div>
                       <button
-                                onClick={() => setEditingShift(shift)}
+                        onClick={() => setShowAddTimeSlot(true)}
                         disabled={isSubmitting}
-                                style={{
+                        style={addOutlineButton(isSubmitting)}
-                                  padding: '6px 12px',
+                        onMouseEnter={(e) => {
-                                  backgroundColor: isSubmitting ? '#bdc3c7' : '#f1c40f',
+                          if (!isSubmitting) {
-                                  color: 'white',
+                            e.currentTarget.style.backgroundColor = '#f0fff4';
-                                  border: 'none',
+                          }
-                                  borderRadius: '4px',
+                        }}
-                                  cursor: isSubmitting ? 'not-allowed' : 'pointer',
+                        onMouseLeave={(e) => {
-                                  marginRight: '8px',
+                          e.currentTarget.style.backgroundColor = 'transparent';
-                                  opacity: isSubmitting ? 0.6 : 1
                         }}
                       >
-                                Bearbeiten
+                        {ICONS.add} Neuer Zeit-Slot hinzufügen
                       </button>
-                              <button
-                                onClick={() => handleDeleteShift(shift.id)}
-                                disabled={isSubmitting}
-                                style={{
-                                  padding: '6px 12px',
-                                  backgroundColor: isSubmitting ? '#bdc3c7' : '#e74c3c',
-                                  color: 'white',
-                                  border: 'none',
-                                  borderRadius: '4px',
-                                  cursor: isSubmitting ? 'not-allowed' : 'pointer',
-                                  opacity: isSubmitting ? 0.6 : 1
-                                }}
-                              >
-                                Löschen
-                              </button>
-                            </div>
-                          </div>
-                        </>
                     )}
-                    </div>
+                  </td>
-                  );
+                </tr>
-                })}
+              </tbody>
+            </table>
+          </div>
+        </div>
+      )}
+
+      {/* Legend */}
+      <div style={{
+        marginTop: '20px',
+        padding: '16px',
+        backgroundColor: 'white',
+        borderRadius: '8px',
+        boxShadow: '0 2px 4px rgba(0,0,0,0.1)',
+      }}>
+        <h4 style={{ margin: '0 0 12px 0', color: '#2c3e50' }}>Legende</h4>
+        <div style={{ display: 'flex', gap: '24px', flexWrap: 'wrap', fontSize: '13px' }}>
+          <div style={{ display: 'flex', alignItems: 'center', gap: '8px' }}>
+            <div style={{
+              width: '24px',
+              height: '24px',
+              backgroundColor: '#d5f4e6',
+              border: `2px solid ${BUTTON_COLORS.add}`,
+              borderRadius: '4px',
+            }} />
+            <span>Aktive Schicht (klicken zum Bearbeiten)</span>
+          </div>
+          <div style={{ display: 'flex', alignItems: 'center', gap: '8px' }}>
+            <div style={{
+              width: '24px',
+              height: '24px',
+              backgroundColor: '#f8f9fa',
+              border: '2px dashed #dee2e6',
+              borderRadius: '4px',
+            }} />
+            <span>Leere Zelle (klicken zum Hinzufügen)</span>
+          </div>
+          <div style={{ display: 'flex', alignItems: 'center', gap: '8px' }}>
+            <span style={{ color: BUTTON_COLORS.edit, fontSize: '16px' }}>{ICONS.edit}</span>
+            <span>Zeit-Slot bearbeiten</span>
+          </div>
+          <div style={{ display: 'flex', alignItems: 'center', gap: '8px' }}>
+            <span style={{ color: BUTTON_COLORS.delete, fontSize: '16px' }}>{ICONS.delete}</span>
+            <span>Löschen</span>
           </div>
         </div>
-          );
-        })}
       </div>
     </div>
   );

frontend/src/pages/ShiftPlans/ShiftPlanList.tsx

@@ -117,7 +117,7 @@ const ShiftPlanList: React.FC = () => {
               borderRadius: '4px',
               cursor: 'pointer'
             }}>
-              + Neuen Plan
+              + Neuer Plan
             </button>
           </Link>
         )}

frontend/src/pages/ShiftPlans/ShiftPlanView.tsx

@@ -1,5 +1,5 @@
-// frontend/src/pages/ShiftPlans/ShiftPlanView.tsx - UPDATED
+// frontend/src/pages/ShiftPlans/ShiftPlanView.tsx
-import React, { useState, useEffect } from 'react';
+import React, { useState, useEffect, useRef } from 'react';
 import { useParams, useNavigate } from 'react-router-dom';
 import { useAuth } from '../../contexts/AuthContext';
 import { shiftPlanService } from '../../services/shiftPlanService';
@@ -10,6 +10,7 @@ import { ShiftPlan, TimeSlot, ScheduledShift } from '../../models/ShiftPlan';
 import { Employee, EmployeeAvailability } from '../../models/Employee';
 import { useNotification } from '../../contexts/NotificationContext';
 import { formatDate, formatTime } from '../../utils/foramatters';
+import { saveAs } from 'file-saver';
 
 // Local interface extensions (same as AvailabilityManager)
 interface ExtendedTimeSlot extends TimeSlot {
@@ -54,6 +55,10 @@ const ShiftPlanView: React.FC = () => {
   const [scheduledShifts, setScheduledShifts] = useState<ScheduledShift[]>([]);
   const [showAssignmentPreview, setShowAssignmentPreview] = useState(false);
   const [recreating, setRecreating] = useState(false);
+  const [exporting, setExporting] = useState(false);
+  const [exportType, setExportType] = useState<'pdf' | 'excel' | null>(null);
+  const [dropdownWidth, setDropdownWidth] = useState(0);
+  const dropdownRef = useRef<HTMLDivElement>(null);
 
   useEffect(() => {
     loadShiftPlanData();
@@ -119,6 +124,12 @@ const ShiftPlanView: React.FC = () => {
     }
   }, [availabilities]);
 
+  useEffect(() => {
+    if (dropdownRef.current) {
+      setDropdownWidth(dropdownRef.current.offsetWidth / 40);  // Adjust divisor for desired slide distance
+    }
+  }, [exportType]);
+
   // Create a data structure that maps days to their shifts with time slot info - SAME AS AVAILABILITYMANAGER
   const getTimetableData = () => {
     if (!shiftPlan || !shiftPlan.shifts || !shiftPlan.timeSlots) {
@@ -189,7 +200,17 @@ const ShiftPlanView: React.FC = () => {
 
     // Convert to array and sort by start time - SAME LOGIC AS AVAILABILITYMANAGER
     const allTimeSlots = Array.from(allTimeSlotsMap.values()).sort((a, b) => {
-      return (a.startTime || '').localeCompare(b.startTime || '');
+      // Convert time strings to minutes for proper numeric comparison
+      const timeToMinutes = (timeStr: string) => {
+        if (!timeStr) return 0;
+        const [hours, minutes] = timeStr.split(':').map(Number);
+        return hours * 60 + minutes;
+      };
+
+      const minutesA = timeToMinutes(a.startTime);
+      const minutesB = timeToMinutes(b.startTime);
+      
+      return minutesA - minutesB; // Ascending order (earliest first)
     });
 
     return { days, shiftsByDay, allTimeSlots };
@@ -240,6 +261,39 @@ const ShiftPlanView: React.FC = () => {
     };
   };
 
+  const handleExport = async () => {
+    if (!shiftPlan || !exportType) return;
+
+    try {
+      setExporting(true);
+
+      let blob: Blob;
+      if (exportType === 'excel') {
+        blob = await shiftPlanService.exportShiftPlanToExcel(shiftPlan.id);
+        saveAs(blob, `Schichtplan_${shiftPlan.name}_${new Date().toISOString().split('T')[0]}.xlsx`);
+      } else {
+        blob = await shiftPlanService.exportShiftPlanToPDF(shiftPlan.id);
+        saveAs(blob, `Schichtplan_${shiftPlan.name}_${new Date().toISOString().split('T')[0]}.pdf`);
+      }
+
+      showNotification({
+        type: 'success',
+        title: 'Export erfolgreich',
+        message: `Der Schichtplan wurde als ${exportType === 'excel' ? 'Excel' : 'PDF'} exportiert.`
+      });
+
+    } catch (error) {
+      console.error(`Error exporting to ${exportType}:`, error);
+      showNotification({
+        type: 'error',
+        title: 'Export fehlgeschlagen',
+        message: `Der ${exportType === 'excel' ? 'Excel' : 'PDF'}-Export konnte nicht durchgeführt werden.`
+      });
+    } finally {
+      setExporting(false);
+    }
+  };
+
   const loadShiftPlanData = async () => {
     if (!id) return;
 
@@ -399,12 +453,12 @@ const ShiftPlanView: React.FC = () => {
       console.log('- Scheduled Shifts:', scheduledShifts.length);
 
       // DEBUG: Show shift pattern IDs
-      if (shiftPlan.shifts) {
+      /*if (shiftPlan.shifts) {
         console.log('📋 SHIFT PATTERN IDs:');
         shiftPlan.shifts.forEach((shift, index) => {
           console.log(`   ${index + 1}. ${shift.id} (Day ${shift.dayOfWeek}, TimeSlot ${shift.timeSlotId})`);
         });
-      }
+      }*/
 
       const constraints = {
         enforceNoTraineeAlone: true,
@@ -650,6 +704,20 @@ const ShiftPlanView: React.FC = () => {
     return employeesWithoutAvailabilities.length === 0;
   };
 
+  const canPublishAssignment = (): boolean => {
+    if (!assignmentResult) return false;
+
+    // Check if assignment was successful
+    if (assignmentResult.success === false) return false;
+
+    // Check if there are any critical violations
+    const hasCriticalViolations = assignmentResult.violations.some(v =>
+      v.includes('ERROR:') || v.includes('KRITISCH:')
+    );
+
+    return !hasCriticalViolations;
+  };
+
   const getAvailabilityStatus = () => {
     const totalEmployees = employees.length;
     const employeesWithAvailabilities = new Set(
@@ -820,9 +888,6 @@ const ShiftPlanView: React.FC = () => {
                     <div style={{ fontSize: '14px', color: '#666' }}>
                       {formatTime(timeSlot.startTime)} - {formatTime(timeSlot.endTime)}
                     </div>
-                    <div style={{ fontSize: '11px', color: '#999', marginTop: '4px' }}>
-                      ID: {timeSlot.id.substring(0, 8)}...
-                    </div>
                   </td>
                   {days.map(weekday => {
                     const shift = timeSlot.shiftsByDay[weekday.id];
@@ -846,7 +911,55 @@ const ShiftPlanView: React.FC = () => {
                     const isValidShift = shift.timeSlotId === timeSlot.id && shift.dayOfWeek === weekday.id;
 
                     let assignedEmployees: string[] = [];
-                    let displayText = '';
+                    let displayContent: React.ReactNode = null;
+
+                    // Helper function to create employee boxes
+                    const createEmployeeBoxes = (employeeIds: string[]) => {
+                      return employeeIds.map(empId => {
+                        const employee = employees.find(emp => emp.id === empId);
+                        if (!employee) return null;
+
+                        // Determine background color based on employee role
+                        let backgroundColor = '#642ab5'; // Default: non-trainee personnel (purple)
+
+                        if (employee.isTrainee) {
+                          backgroundColor = '#cda8f0'; // Trainee
+                        } else if (employee.employeeType === 'manager') {
+                          backgroundColor = '#CC0000'; // Manager
+                        }
+
+                        return (
+                          <div
+                            key={empId}
+                            style={{
+                              backgroundColor,
+                              color: 'white',
+                              padding: '4px 8px',
+                              borderRadius: '4px',
+                              marginBottom: '2px',
+                              fontSize: '12px',
+                              textAlign: 'center',
+                              whiteSpace: 'nowrap',
+                              overflow: 'hidden',
+                              textOverflow: 'ellipsis'
+                            }}
+                            title={`${employee.firstname} ${employee.lastname}${employee.isTrainee ? ' (Trainee)' : ''}`}
+                          >
+                            {employee.firstname} {employee.lastname}
+                          </div>
+                        );
+                      }).filter(Boolean);
+                    };
+
+                    // Helper function to get fallback content
+                    const getFallbackContent = () => {
+                      const shiftsForSlot = shiftPlan?.shifts?.filter(s =>
+                        s.dayOfWeek === weekday.id &&
+                        s.timeSlotId === timeSlot.id
+                      ) || [];
+                      const totalRequired = shiftsForSlot.reduce((sum, s) => sum + s.requiredEmployees, 0);
+                      return totalRequired === 0 ? '-' : `0/${totalRequired}`;
+                    };
 
                     if (shiftPlan?.status === 'published') {
                       // For published plans, use actual assignments from scheduled shifts
@@ -859,15 +972,21 @@ const ShiftPlanView: React.FC = () => {
                       if (scheduledShift) {
                         assignedEmployees = scheduledShift.assignedEmployees || [];
 
-                        // DEBUG: Log if we're still seeing old data
+                        // Log if we're still seeing old data
                         if (assignedEmployees.length > 0) {
                           console.warn(`⚠️ Found non-empty assignments for ${weekday.name} ${timeSlot.name}:`, assignedEmployees);
                         }
 
-                        displayText = assignedEmployees.map(empId => {
+                        const employeeBoxes = createEmployeeBoxes(assignedEmployees);
-                          const employee = employees.find(emp => emp.id === empId);
+                        displayContent = employeeBoxes.length > 0 ? (
-                          return employee ? `${employee.firstname} ${employee.lastname}` : 'Unbekannt';
+                          <div style={{ display: 'flex', flexDirection: 'column', gap: '2px' }}>
-                        }).join(', ');
+                            {employeeBoxes}
+                          </div>
+                        ) : (
+                          <div style={{ color: '#666', fontStyle: 'italic' }}>
+                            {getFallbackContent()}
+                          </div>
+                        );
                       }
                     } else if (assignmentResult) {
                       // For draft with preview, use assignment result
@@ -879,30 +998,26 @@ const ShiftPlanView: React.FC = () => {
 
                       if (scheduledShift) {
                         assignedEmployees = getAssignmentsForScheduledShift(scheduledShift);
-                        displayText = assignedEmployees.map(empId => {
+                        const employeeBoxes = createEmployeeBoxes(assignedEmployees);
-                          const employee = employees.find(emp => emp.id === empId);
+                        displayContent = employeeBoxes.length > 0 ? (
-                          return employee ? `${employee.firstname} ${employee.lastname}` : 'Unbekannt';
+                          <div style={{ display: 'flex', flexDirection: 'column', gap: '2px' }}>
-                        }).join(', ');
+                            {employeeBoxes}
+                          </div>
+                        ) : (
+                          <div style={{ color: '#666', fontStyle: 'italic' }}>
+                            {getFallbackContent()}
+                          </div>
+                        );
                       }
                     }
 
-                    // If no assignments yet, show empty or required count
+                    // If no display content set yet, use fallback
-                    if (!displayText) {
+                    if (!displayContent) {
-                      const shiftsForSlot = shiftPlan?.shifts?.filter(s => 
+                      displayContent = (
-                        s.dayOfWeek === weekday.id && 
+                        <div style={{ color: '#666', fontStyle: 'italic' }}>
-                        s.timeSlotId === timeSlot.id
+                          {getFallbackContent()}
-                      ) || [];
+                        </div>
-                      
+                      );
-                      const totalRequired = shiftsForSlot.reduce((sum, s) => 
-                        sum + s.requiredEmployees, 0);
-                      
-                      // Show "0/2" instead of just "0" to indicate it's empty
-                      displayText = `0/${totalRequired}`;
-                      
-                      // Optional: Show empty state more clearly
-                      if (totalRequired === 0) {
-                        displayText = '-';
-                      }
                     }
 
                     return (
@@ -937,7 +1052,7 @@ const ShiftPlanView: React.FC = () => {
                           </div>
                         )}
 
-                        {displayText}
+                        {displayContent}
 
                         {/* Shift debug info - SAME AS AVAILABILITYMANAGER */}
                         <div style={{
@@ -947,8 +1062,6 @@ const ShiftPlanView: React.FC = () => {
                           textAlign: 'left',
                           fontFamily: 'monospace'
                         }}>
-                          <div>Shift: {shift.id.substring(0, 6)}...</div>
-                          <div>Day: {shift.dayOfWeek}</div>
                           {!isValidShift && (
                             <div style={{ color: '#e74c3c', fontWeight: 'bold' }}>
                               VALIDATION ERROR
@@ -963,7 +1076,6 @@ const ShiftPlanView: React.FC = () => {
             </tbody>
           </table>
         </div>
-
       </div>
     );
   };
@@ -1005,6 +1117,7 @@ const ShiftPlanView: React.FC = () => {
           </div>
         </div>
         <div style={{ display: 'flex', gap: '10px', alignItems: 'center' }}>
+          {/* "Zuweisungen neu berechnen" button */}
           {shiftPlan.status === 'published' && hasRole(['admin', 'maintenance']) && (
             <button
               onClick={handleRecreateAssignments}
@@ -1118,7 +1231,7 @@ const ShiftPlanView: React.FC = () => {
         </div>
       )}
 
-      {/* Assignment Preview Modal - FIXED CONDITION */}
+      {/* Assignment Preview Modal */}
       {(showAssignmentPreview || assignmentResult) && (
         <div style={{
           position: 'fixed',
@@ -1197,15 +1310,13 @@ const ShiftPlanView: React.FC = () => {
               </div>
             )}
 
-            {/* KORRIGIERTE ZUSAMMENFASSUNG */}
+            {/* ZUSAMMENFASSUNG */}
             {assignmentResult && (
               <div style={{ marginBottom: '20px' }}>
                 <h4>Zusammenfassung:</h4>
 
                 {/* Entscheidung basierend auf tatsächlichen kritischen Problemen */}
-                {assignmentResult.violations.filter(v => 
+                {(assignmentResult.violations.length === 0) || assignmentResult.success == true ? (
-                  v.includes('ERROR:') || v.includes('❌ KRITISCH:')
-                ).length === 0 ? (
                   <div style={{
                     padding: '15px',
                     backgroundColor: '#d4edda',
@@ -1288,32 +1399,24 @@ const ShiftPlanView: React.FC = () => {
                 Abbrechen
               </button>
 
-              {/* KORRIGIERTER BUTTON MIT TYPESCRIPT-FIX */}
+              {/* BUTTON zum publishen */}
               <button
                 onClick={handlePublish}
-                disabled={publishing || (assignmentResult ? assignmentResult.violations.filter(v => 
+                disabled={publishing || !canPublishAssignment()}
-                  v.includes('ERROR:') || v.includes('❌ KRITISCH:')
-                ).length > 0 : true)}
                 style={{
                   padding: '10px 20px',
-                  backgroundColor: assignmentResult ? (assignmentResult.violations.filter(v => 
+                  backgroundColor: canPublishAssignment() ? '#2ecc71' : '#95a5a6',
-                    v.includes('ERROR:') || v.includes('❌ KRITISCH:')
-                  ).length === 0 ? '#2ecc71' : '#95a5a6') : '#95a5a6',
                   color: 'white',
                   border: 'none',
                   borderRadius: '4px',
-                  cursor: assignmentResult ? (assignmentResult.violations.filter(v => 
+                  cursor: canPublishAssignment() ? 'pointer' : 'not-allowed',
-                    v.includes('ERROR:') || v.includes('❌ KRITISCH:')
-                  ).length === 0 ? 'pointer' : 'not-allowed') : 'not-allowed',
                   fontWeight: 'bold',
                   fontSize: '16px'
                 }}
               >
                 {publishing ? 'Veröffentliche...' : (
                   assignmentResult ? (
-                    assignmentResult.violations.filter(v => 
+                    canPublishAssignment()
-                      v.includes('ERROR:') || v.includes('❌ KRITISCH:')
-                    ).length === 0 
                       ? 'Schichtplan veröffentlichen'
                       : 'Kritische Probleme müssen behoben werden'
                   ) : 'Lade Zuordnungen...'
@@ -1339,6 +1442,64 @@ const ShiftPlanView: React.FC = () => {
 
         {renderTimetable()}
 
+        {shiftPlan.status === 'published' && hasRole(['admin', 'maintenance']) && (
+          <div style={{
+            display: 'flex',
+            alignItems: 'center',
+            justifyContent: 'flex-end',
+            marginTop: '20px',
+            gap: '10px'
+          }}>
+            {/* Export Dropdown Container */}
+            <div
+              ref={dropdownRef}
+              style={{
+                transform: exportType ? `translateX(-${dropdownWidth}px)` : 'translateX(0)',
+                transition: 'transform 0.3s ease-in-out',
+                position: 'relative' 
+              }}
+            >
+              <select
+                value={exportType || ''}
+                onChange={(e) => setExportType(e.target.value as 'pdf' | 'excel' | null)}
+                style={{
+                  padding: '10px 20px',
+                  backgroundColor: 'white',
+                  border: '1px solid #ddd',
+                  borderRadius: '4px',
+                  cursor: 'pointer',
+                  minWidth: '120px'
+                }}
+              >
+                <option value="">Export</option>
+                <option value="pdf">PDF</option>
+                <option value="excel">Excel</option>
+              </select>
+            </div>
+
+            {/* Export Button - erscheint nur wenn eine Option ausgewählt ist */}
+            {exportType && (
+              <button
+                onClick={handleExport}
+                disabled={exporting}
+                style={{
+                  padding: '10px 20px',
+                  backgroundColor: '#51258f',
+                  color: 'white',
+                  border: 'none',
+                  borderRadius: '4px',
+                  cursor: exporting ? 'not-allowed' : 'pointer',
+                  fontWeight: 'bold',
+                  opacity: exporting ? 0.7 : 1,
+                  transition: 'opacity 0.2s ease'
+                }}
+              >
+                {exporting ? '🔄 Exportiert...' : 'EXPORT'}
+              </button>
+            )}
+          </div>
+        )}
+
         {/* Summary */}
         {days.length > 0 && (
           <div style={{

frontend/src/pages/ShiftPlans/components/AddDayButton.tsx

@@ -0,0 +1,123 @@
+import React, { useState } from 'react';
+import { ICONS, addIconButton, addTextButton, cancelTextButton } from '../../../utils/buttonStyles';
+import Modal from '../../../components/Modal/Modal';
+
+interface DayOption {
+  id: number;
+  name: string;
+}
+
+interface AddDayButtonProps {
+  activeDays: number[];
+  onAddDay: (dayOfWeek: number) => void;
+  disabled?: boolean;
+}
+
+const ALL_DAYS: DayOption[] = [
+  { id: 1, name: 'Montag' },
+  { id: 2, name: 'Dienstag' },
+  { id: 3, name: 'Mittwoch' },
+  { id: 4, name: 'Donnerstag' },
+  { id: 5, name: 'Freitag' },
+  { id: 6, name: 'Samstag' },
+  { id: 7, name: 'Sonntag' },
+];
+
+const AddDayButton: React.FC<AddDayButtonProps> = ({
+  activeDays,
+  onAddDay,
+  disabled = false
+}) => {
+  const [showModal, setShowModal] = useState(false);
+  const [selectedDay, setSelectedDay] = useState<number | null>(null);
+
+  const availableDays = ALL_DAYS.filter(day => !activeDays.includes(day.id));
+
+  const handleAddDay = () => {
+    if (selectedDay !== null) {
+      onAddDay(selectedDay);
+      setShowModal(false);
+      setSelectedDay(null);
+    }
+  };
+
+  const isDisabled = disabled || availableDays.length === 0;
+
+  if (availableDays.length === 0) {
+    return null;
+  }
+
+  return (
+    <>
+      <button
+        onClick={() => setShowModal(true)}
+        style={addIconButton(isDisabled)}
+        disabled={isDisabled}
+        title="Tag hinzufügen"
+      >
+        {ICONS.add}
+      </button>
+
+      <Modal
+        isOpen={showModal}
+        onClose={() => {
+          setShowModal(false);
+          setSelectedDay(null);
+        }}
+        title="Tag hinzufügen"
+        width="350px"
+      >
+        <div style={{ marginBottom: '16px' }}>
+          <label style={{
+            display: 'block',
+            marginBottom: '8px',
+            fontWeight: 'bold',
+            fontSize: '14px',
+            color: '#2c3e50'
+          }}>
+            Wählen Sie einen Tag:
+          </label>
+          <select
+            value={selectedDay ?? ''}
+            onChange={(e) => setSelectedDay(e.target.value ? Number(e.target.value) : null)}
+            style={{
+              width: '100%',
+              padding: '10px',
+              borderRadius: '4px',
+              border: '1px solid #ddd',
+              fontSize: '14px',
+            }}
+          >
+            <option value="">-- Tag auswählen --</option>
+            {availableDays.map(day => (
+              <option key={day.id} value={day.id}>
+                {day.name}
+              </option>
+            ))}
+          </select>
+        </div>
+
+        <div style={{ display: 'flex', gap: '8px', justifyContent: 'flex-end' }}>
+          <button
+            onClick={handleAddDay}
+            disabled={selectedDay === null}
+            style={addTextButton(selectedDay === null)}
+          >
+            {ICONS.add} Hinzufügen
+          </button>
+          <button
+            onClick={() => {
+              setShowModal(false);
+              setSelectedDay(null);
+            }}
+            style={cancelTextButton(false)}
+          >
+            Abbrechen
+          </button>
+        </div>
+      </Modal>
+    </>
+  );
+};
+
+export default AddDayButton;

frontend/src/pages/ShiftPlans/components/ShiftCell.tsx

@@ -0,0 +1,234 @@
+import React, { useState, useEffect } from 'react';
+import { Shift } from '../../../models/ShiftPlan';
+import {
+  ICONS,
+  addTextButton,
+  deleteTextButton,
+  cancelTextButton,
+  BUTTON_COLORS,
+} from '../../../utils/buttonStyles';
+import Modal from '../../../components/Modal/Modal';
+
+interface ShiftCellProps {
+  shift: Shift | null;
+  dayOfWeek: number;
+  timeSlotId: string;
+  onAdd: (dayOfWeek: number, timeSlotId: string, requiredEmployees: number, color: string) => void;
+  onEdit: (shift: Shift, requiredEmployees: number, color: string) => void;
+  onDelete: (shiftId: string) => void;
+  disabled?: boolean;
+}
+
+const COLORS = [
+  '#3498db', // Blue (default)
+  '#27ae60', // Green
+  '#e74c3c', // Red
+  '#f39c12', // Orange
+  '#9b59b6', // Purple
+  '#1abc9c', // Teal
+  '#e91e63', // Pink
+  '#795548', // Brown
+];
+
+const ShiftCell: React.FC<ShiftCellProps> = ({
+  shift,
+  dayOfWeek,
+  timeSlotId,
+  onAdd,
+  onEdit,
+  onDelete,
+  disabled = false
+}) => {
+  const [showModal, setShowModal] = useState(false);
+  const [requiredEmployees, setRequiredEmployees] = useState(shift?.requiredEmployees || 2);
+  const [selectedColor, setSelectedColor] = useState(shift?.color || '#3498db');
+  const [isHovered, setIsHovered] = useState(false);
+
+  useEffect(() => {
+    if (shift) {
+      setRequiredEmployees(shift.requiredEmployees);
+      setSelectedColor(shift.color || '#3498db');
+    } else {
+      setRequiredEmployees(2);
+      setSelectedColor('#3498db');
+    }
+  }, [shift]);
+
+  const handleCellClick = () => {
+    if (disabled) return;
+    setShowModal(true);
+  };
+
+  const handleSave = () => {
+    if (shift) {
+      onEdit(shift, requiredEmployees, selectedColor);
+    } else {
+      onAdd(dayOfWeek, timeSlotId, requiredEmployees, selectedColor);
+    }
+    setShowModal(false);
+  };
+
+  const handleDelete = () => {
+    if (shift) {
+      onDelete(shift.id);
+    }
+    setShowModal(false);
+  };
+
+  const handleClose = () => {
+    if (shift) {
+      setRequiredEmployees(shift.requiredEmployees);
+      setSelectedColor(shift.color || '#3498db');
+    } else {
+      setRequiredEmployees(2);
+      setSelectedColor('#3498db');
+    }
+    setShowModal(false);
+  };
+
+  const cellStyle: React.CSSProperties = {
+    padding: '8px',
+    textAlign: 'center',
+    cursor: disabled ? 'not-allowed' : 'pointer',
+    minWidth: '80px',
+    height: '60px',
+    verticalAlign: 'middle',
+    transition: 'all 0.2s ease',
+    border: '1px solid #dee2e6',
+    ...(shift ? {
+      backgroundColor: shift.color ? `${shift.color}20` : '#d5f4e6',
+      borderColor: shift.color || '#27ae60',
+      borderWidth: '2px',
+    } : {
+      backgroundColor: isHovered ? '#f0fff4' : '#f8f9fa',
+      borderStyle: 'dashed',
+      borderColor: isHovered ? BUTTON_COLORS.add : '#dee2e6',
+    }),
+    opacity: disabled ? 0.6 : 1,
+  };
+
+  const inputStyle: React.CSSProperties = {
+    width: '100%',
+    padding: '10px',
+    borderRadius: '4px',
+    border: '1px solid #ddd',
+    fontSize: '14px',
+    boxSizing: 'border-box',
+  };
+
+  const labelStyle: React.CSSProperties = {
+    display: 'block',
+    marginBottom: '6px',
+    fontWeight: 'bold',
+    fontSize: '14px',
+    color: '#2c3e50',
+  };
+
+  return (
+    <>
+      <td
+        style={cellStyle}
+        onClick={handleCellClick}
+        onMouseEnter={() => setIsHovered(true)}
+        onMouseLeave={() => setIsHovered(false)}
+      >
+        {shift ? (
+          <div>
+            <div style={{
+              width: '28px',
+              height: '28px',
+              borderRadius: '50%',
+              backgroundColor: shift.color || '#27ae60',
+              margin: '0 auto 4px',
+              display: 'flex',
+              alignItems: 'center',
+              justifyContent: 'center',
+            }}>
+              <span style={{ color: 'white', fontSize: '12px', fontWeight: 'bold' }}>
+                {shift.requiredEmployees}
+              </span>
+            </div>
+            <span style={{ fontSize: '11px', color: '#666' }}>
+              Mitarbeiter
+            </span>
+          </div>
+        ) : (
+          <div style={{
+            color: BUTTON_COLORS.add,
+            fontSize: '24px',
+            opacity: isHovered ? 1 : 0.4,
+            transition: 'opacity 0.2s ease',
+          }}>
+            {ICONS.add}
+          </div>
+        )}
+      </td>
+
+      <Modal
+        isOpen={showModal}
+        onClose={handleClose}
+        title={shift ? 'Schicht bearbeiten' : 'Schicht hinzufügen'}
+        width="380px"
+      >
+        <div style={{ marginBottom: '16px' }}>
+          <label style={labelStyle}>Benötigte Mitarbeiter *</label>
+          <input
+            type="number"
+            min="1"
+            max="99"
+            value={requiredEmployees}
+            onChange={(e) => setRequiredEmployees(parseInt(e.target.value) || 1)}
+            style={inputStyle}
+          />
+        </div>
+
+        <div style={{ marginBottom: '20px' }}>
+          <label style={labelStyle}>Farbe</label>
+          <div style={{ display: 'flex', gap: '8px', flexWrap: 'wrap' }}>
+            {COLORS.map((color) => (
+              <button
+                key={color}
+                onClick={() => setSelectedColor(color)}
+                style={{
+                  width: '36px',
+                  height: '36px',
+                  borderRadius: '6px',
+                  backgroundColor: color,
+                  border: selectedColor === color ? '3px solid #2c3e50' : '2px solid transparent',
+                  cursor: 'pointer',
+                  transition: 'transform 0.1s ease',
+                }}
+                title={color}
+              />
+            ))}
+          </div>
+        </div>
+
+        <div style={{ display: 'flex', gap: '8px', justifyContent: 'flex-end' }}>
+          <button
+            onClick={handleSave}
+            style={{ ...addTextButton(false), flex: 1 }}
+          >
+            {shift ? 'Speichern' : `${ICONS.add} Hinzufügen`}
+          </button>
+          {shift && (
+            <button
+              onClick={handleDelete}
+              style={deleteTextButton(false)}
+            >
+              {ICONS.delete} Löschen
+            </button>
+          )}
+          <button
+            onClick={handleClose}
+            style={cancelTextButton(false)}
+          >
+            Abbrechen
+          </button>
+        </div>
+      </Modal>
+    </>
+  );
+};
+
+export default ShiftCell;

frontend/src/pages/ShiftPlans/components/TimeSlotEditor.tsx

@@ -0,0 +1,199 @@
+import React, { useState, useEffect } from 'react';
+import { TimeSlot } from '../../../models/ShiftPlan';
+import {
+  ICONS,
+  addTextButton,
+  deleteTextButton,
+  cancelTextButton,
+  borderlessEditButton,
+} from '../../../utils/buttonStyles';
+import Modal from '../../../components/Modal/Modal';
+
+interface TimeSlotEditorProps {
+  slot: TimeSlot;
+  onUpdate: (slot: TimeSlot, name: string, startTime: string, endTime: string, description?: string) => void;
+  onDelete: (slotId: string) => void;
+  shiftsCount: number;
+  disabled?: boolean;
+}
+
+const TimeSlotEditor: React.FC<TimeSlotEditorProps> = ({
+  slot,
+  onUpdate,
+  onDelete,
+  shiftsCount,
+  disabled = false
+}) => {
+  const [showModal, setShowModal] = useState(false);
+  const [name, setName] = useState(slot.name);
+  const [startTime, setStartTime] = useState(slot.startTime);
+  const [endTime, setEndTime] = useState(slot.endTime);
+  const [description, setDescription] = useState(slot.description || '');
+
+  useEffect(() => {
+    setName(slot.name);
+    setStartTime(slot.startTime);
+    setEndTime(slot.endTime);
+    setDescription(slot.description || '');
+  }, [slot]);
+
+  const handleEditClick = () => {
+    if (disabled) return;
+    setShowModal(true);
+  };
+
+  const handleSave = () => {
+    onUpdate(slot, name, startTime, endTime, description || undefined);
+    setShowModal(false);
+  };
+
+  const handleDelete = () => {
+    onDelete(slot.id);
+    setShowModal(false);
+  };
+
+  const handleClose = () => {
+    setName(slot.name);
+    setStartTime(slot.startTime);
+    setEndTime(slot.endTime);
+    setDescription(slot.description || '');
+    setShowModal(false);
+  };
+
+  const formatTime = (time: string) => {
+    return time.substring(0, 5);
+  };
+
+  const inputStyle: React.CSSProperties = {
+    width: '100%',
+    padding: '10px',
+    borderRadius: '4px',
+    border: '1px solid #ddd',
+    fontSize: '14px',
+    boxSizing: 'border-box',
+  };
+
+  const labelStyle: React.CSSProperties = {
+    display: 'block',
+    marginBottom: '6px',
+    fontWeight: 'bold',
+    fontSize: '14px',
+    color: '#2c3e50',
+  };
+
+  return (
+    <>
+      <div style={{
+        display: 'flex',
+        alignItems: 'center',
+        gap: '8px',
+      }}>
+        <button
+          onClick={handleEditClick}
+          style={borderlessEditButton(disabled)}
+          title="Zeit-Slot bearbeiten"
+          disabled={disabled}
+        >
+          {ICONS.edit}
+        </button>
+        <div>
+          <div style={{ fontWeight: 'bold', fontSize: '14px', color: '#2c3e50' }}>
+            {slot.name}
+          </div>
+          <div style={{ fontSize: '12px', color: '#666' }}>
+            {formatTime(slot.startTime)} - {formatTime(slot.endTime)}
+          </div>
+        </div>
+      </div>
+
+      <Modal
+        isOpen={showModal}
+        onClose={handleClose}
+        title="Zeit-Slot bearbeiten"
+        width="400px"
+      >
+        <div style={{ marginBottom: '16px' }}>
+          <label style={labelStyle}>Name *</label>
+          <input
+            type="text"
+            value={name}
+            onChange={(e) => setName(e.target.value)}
+            style={inputStyle}
+            placeholder="z.B. Vormittag"
+          />
+        </div>
+
+        <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: '16px', marginBottom: '16px' }}>
+          <div>
+            <label style={labelStyle}>Startzeit *</label>
+            <input
+              type="time"
+              value={startTime}
+              onChange={(e) => setStartTime(e.target.value)}
+              style={inputStyle}
+            />
+          </div>
+          <div>
+            <label style={labelStyle}>Endzeit *</label>
+            <input
+              type="time"
+              value={endTime}
+              onChange={(e) => setEndTime(e.target.value)}
+              style={inputStyle}
+            />
+          </div>
+        </div>
+
+        <div style={{ marginBottom: '20px' }}>
+          <label style={labelStyle}>Beschreibung (optional)</label>
+          <input
+            type="text"
+            value={description}
+            onChange={(e) => setDescription(e.target.value)}
+            style={inputStyle}
+            placeholder="Optionale Beschreibung"
+          />
+        </div>
+
+        {shiftsCount > 0 && (
+          <div style={{
+            marginBottom: '16px',
+            padding: '12px',
+            backgroundColor: '#fff3cd',
+            borderRadius: '4px',
+            fontSize: '13px',
+            color: '#856404',
+            border: '1px solid #ffc107',
+          }}>
+            Dieser Zeit-Slot enthält {shiftsCount} Schicht(en). Beim Löschen werden alle zugehörigen Schichten entfernt.
+          </div>
+        )}
+
+        <div style={{ display: 'flex', gap: '8px', justifyContent: 'flex-end' }}>
+          <button
+            onClick={handleSave}
+            disabled={!name}
+            style={addTextButton(!name)}
+          >
+            Speichern
+          </button>
+          <button
+            onClick={handleDelete}
+            style={deleteTextButton(false)}
+            title={shiftsCount > 0 ? `Enthält ${shiftsCount} Schicht(en)` : undefined}
+          >
+            {ICONS.delete} Löschen
+          </button>
+          <button
+            onClick={handleClose}
+            style={cancelTextButton(false)}
+          >
+            Abbrechen
+          </button>
+        </div>
+      </Modal>
+    </>
+  );
+};
+
+export default TimeSlotEditor;

frontend/src/services/apiClient.ts

@@ -0,0 +1,135 @@
+import { ValidationError, ErrorService } from './errorService';
+
+export class ApiError extends Error {
+  public validationErrors: ValidationError[];
+  public statusCode: number;
+  public originalError?: any;
+
+  constructor(message: string, validationErrors: ValidationError[] = [], statusCode: number = 0, originalError?: any) {
+    super(message);
+    this.name = 'ApiError';
+    this.validationErrors = validationErrors;
+    this.statusCode = statusCode;
+    this.originalError = originalError;
+  }
+}
+
+export class ApiClient {
+  private baseURL: string;
+
+  constructor() {
+    this.baseURL = import.meta.env.VITE_API_URL || '/api';
+  }
+
+  private getAuthHeaders(): HeadersInit {
+    const token = localStorage.getItem('token');
+    return token ? { 'Authorization': `Bearer ${token}` } : {};
+  }
+
+  private async handleApiResponse<T>(response: Response, responseType: 'json' | 'blob' = 'json'): Promise<T> {
+    if (!response.ok) {
+      let errorData;
+      
+      try {
+        // Try to parse error response as JSON
+        const responseText = await response.text();
+        errorData = responseText ? JSON.parse(responseText) : {};
+      } catch {
+        // If not JSON, create a generic error object
+        errorData = { error: `HTTP ${response.status}: ${response.statusText}` };
+      }
+      
+      // Extract validation errors using your existing ErrorService
+      const validationErrors = ErrorService.extractValidationErrors(errorData);
+
+      if (validationErrors.length > 0) {
+        // Throw error with validationErrors property for useBackendValidation hook
+        throw new ApiError(
+          errorData.error || 'Validation failed',
+          validationErrors,
+          response.status,
+          errorData
+        );
+      }
+
+      // Throw regular error for non-validation errors
+      throw new ApiError(
+        errorData.error || errorData.message || `HTTP error! status: ${response.status}`,
+        [],
+        response.status,
+        errorData
+      );
+    }
+
+    // Handle blob responses (for file downloads)
+    if (responseType === 'blob') {
+      return response.blob() as Promise<T>;
+    }
+
+    // For successful JSON responses, try to parse as JSON
+    try {
+      const responseText = await response.text();
+      return responseText ? JSON.parse(responseText) : {} as T;
+    } catch (error) {
+      // If response is not JSON but request succeeded (e.g., 204 No Content)
+      return {} as T;
+    }
+  }
+
+  async request<T>(endpoint: string, options: RequestInit = {}, responseType: 'json' | 'blob' = 'json'): Promise<T> {
+    const url = `${this.baseURL}${endpoint}`;
+    
+    const config: RequestInit = {
+      headers: {
+        'Content-Type': 'application/json',
+        ...this.getAuthHeaders(),
+        ...options.headers,
+      },
+      ...options,
+    };
+
+    try {
+      const response = await fetch(url, config);
+      return await this.handleApiResponse<T>(response, responseType);
+    } catch (error) {
+      // Re-throw the error to be caught by useBackendValidation
+      if (error instanceof ApiError) {
+        throw error;
+      }
+      
+      // Wrap non-ApiError errors
+      throw new ApiError(
+        error instanceof Error ? error.message : 'Unknown error occurred',
+        [],
+        0,
+        error
+      );
+    }
+  }
+
+  // Standardized HTTP methods
+  get = <T>(endpoint: string) => this.request<T>(endpoint);
+  
+  post = <T>(endpoint: string, data?: any) => 
+    this.request<T>(endpoint, { 
+      method: 'POST', 
+      body: data ? JSON.stringify(data) : undefined 
+    });
+  
+  put = <T>(endpoint: string, data?: any) => 
+    this.request<T>(endpoint, { 
+      method: 'PUT', 
+      body: data ? JSON.stringify(data) : undefined 
+    });
+  
+  patch = <T>(endpoint: string, data?: any) => 
+    this.request<T>(endpoint, { 
+      method: 'PATCH', 
+      body: data ? JSON.stringify(data) : undefined 
+    });
+  
+  delete = <T>(endpoint: string) => 
+    this.request<T>(endpoint, { method: 'DELETE' });
+}
+
+export const apiClient = new ApiClient();

frontend/src/services/authService.ts

@@ -1,6 +1,5 @@
-// frontend/src/services/authService.ts
 import { Employee } from '../models/Employee';
-const API_BASE_URL = import.meta.env.VITE_API_URL || '/api';
+import { apiClient } from './apiClient';
 
 export interface LoginRequest {
   email: string;
@@ -24,18 +23,7 @@ class AuthService {
   private token: string | null = null;
 
   async login(credentials: LoginRequest): Promise<AuthResponse> {
-    const response = await fetch(`${API_BASE_URL}/auth/login`, {
+    const data = await apiClient.post<AuthResponse>('/auth/login', credentials);
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(credentials)
-    });
-
-    if (!response.ok) {
-      const errorData = await response.json();
-      throw new Error(errorData.error || 'Login fehlgeschlagen');
-    }
-
-    const data: AuthResponse = await response.json();
     this.token = data.token;
     localStorage.setItem('token', data.token);
     localStorage.setItem('employee', JSON.stringify(data.employee));
@@ -43,17 +31,7 @@ class AuthService {
   }
 
   async register(userData: RegisterRequest): Promise<AuthResponse> {
-    const response = await fetch(`${API_BASE_URL}/employees`, {
+    await apiClient.post('/employees', userData);
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(userData)
-    });
-
-    if (!response.ok) {
-      const errorData = await response.json();
-      throw new Error(errorData.error || 'Registrierung fehlgeschlagen');
-    }
-
     return this.login({
       email: userData.email,
       password: userData.password
@@ -67,34 +45,23 @@ class AuthService {
 
   async fetchCurrentEmployee(): Promise<Employee | null> {
     const token = this.getToken();
-    if (!token) {
+    if (!token) return null;
-      return null;
-    }
 
     try {
-      const response = await fetch(`${API_BASE_URL}/auth/me`, {
+      const data = await apiClient.get<{ user: Employee }>('/auth/me');
-        headers: {
+      localStorage.setItem('user', JSON.stringify(data.user));
-          'Authorization': `Bearer ${token}`
+      return data.user;
-        }
-      });
-
-      if (response.ok) {
-        const data = await response.json();
-        const user = data.user;
-        localStorage.setItem('user', JSON.stringify(user));
-        return user;
-      }
     } catch (error) {
       console.error('Error fetching current user:', error);
-    }
-
       return null;
     }
+  }
 
   logout(): void {
     this.token = null;
     localStorage.removeItem('token');
     localStorage.removeItem('user');
+    localStorage.removeItem('employee');
   }
 
   getToken(): string | null {

frontend/src/services/employeeService.ts

@@ -1,154 +1,58 @@
-// frontend/src/services/employeeService.ts
 import { Employee, CreateEmployeeRequest, UpdateEmployeeRequest, EmployeeAvailability } from '../models/Employee';
-import { ErrorService, ValidationError } from './errorService';
+import { apiClient } from './apiClient';
-
-const API_BASE_URL = '/api';
-
-const getAuthHeaders = () => {
-  const token = localStorage.getItem('token');
-  return {
-    'Content-Type': 'application/json',
-    'Authorization': `Bearer ${token}`
-  };
-};
 
 export class EmployeeService {
-  private async handleApiResponse<T>(response: Response): Promise<T> {
-    if (!response.ok) {
-      const errorData = await response.json().catch(() => ({}));
-      const validationErrors = ErrorService.extractValidationErrors(errorData);
-      
-      if (validationErrors.length > 0) {
-        const error = new Error('Validation failed');
-        (error as any).validationErrors = validationErrors;
-        throw error;
-      }
-      
-      throw new Error(errorData.error || `HTTP error! status: ${response.status}`);
-    }
-    
-    return response.json();
-  }
-
   async getEmployees(includeInactive: boolean = false): Promise<Employee[]> {
     console.log('🔄 Fetching employees from API...');
 
-    const token = localStorage.getItem('token');
+    try {
-    console.log('🔑 Token exists:', !!token);
+      const employees = await apiClient.get<Employee[]>(`/employees?includeInactive=${includeInactive}`);
-    
-    const response = await fetch(`${API_BASE_URL}/employees?includeInactive=${includeInactive}`, {
-      headers: getAuthHeaders(),
-    });
-    
-    console.log('📡 Response status:', response.status);
-    
-    if (!response.ok) {
-      const errorText = await response.text();
-      console.error('❌ API Error:', errorText);
-      throw new Error('Failed to fetch employees');
-    }
-    
-    const employees = await response.json();
       console.log('✅ Employees received:', employees.length);
-    
       return employees;
+    } catch (error) {
+      console.error('❌ Error fetching employees:', error);
+      throw error; // Let useBackendValidation handle this
+    }
   }
 
   async getEmployee(id: string): Promise<Employee> {
-    const response = await fetch(`${API_BASE_URL}/employees/${id}`, {
+    return apiClient.get<Employee>(`/employees/${id}`);
-      headers: getAuthHeaders(),
-    });
-    
-    if (!response.ok) {
-      throw new Error('Failed to fetch employee');
-    }
-    
-    return response.json();
   }
 
   async createEmployee(employee: CreateEmployeeRequest): Promise<Employee> {
-    const response = await fetch(`${API_BASE_URL}/employees`, {
+    return apiClient.post<Employee>('/employees', employee);
-      method: 'POST',
-      headers: getAuthHeaders(),
-      body: JSON.stringify(employee),
-    });
-    
-    return this.handleApiResponse<Employee>(response);
   }
 
   async updateEmployee(id: string, employee: UpdateEmployeeRequest): Promise<Employee> {
-    const response = await fetch(`${API_BASE_URL}/employees/${id}`, {
+    return apiClient.put<Employee>(`/employees/${id}`, employee);
-      method: 'PUT',
-      headers: getAuthHeaders(),
-      body: JSON.stringify(employee),
-    });
-    
-    return this.handleApiResponse<Employee>(response);
   }
 
   async deleteEmployee(id: string): Promise<void> {
-    const response = await fetch(`${API_BASE_URL}/employees/${id}`, {
+    await apiClient.delete(`/employees/${id}`);
-      method: 'DELETE',
-      headers: getAuthHeaders(),
-    });
-    
-    if (!response.ok) {
-      const error = await response.json();
-      throw new Error(error.error || 'Failed to delete employee');
-    }
   }
 
   async getAvailabilities(employeeId: string): Promise<EmployeeAvailability[]> {
-    const response = await fetch(`${API_BASE_URL}/employees/${employeeId}/availabilities`, {
+    return apiClient.get<EmployeeAvailability[]>(`/employees/${employeeId}/availabilities`);
-      headers: getAuthHeaders(),
-    });
-    
-    if (!response.ok) {
-      throw new Error('Failed to fetch availabilities');
   }
 
-    return response.json();
+  async updateAvailabilities(
-  }
+    employeeId: string, 
-
+    data: { planId: string, availabilities: Omit<EmployeeAvailability, 'id' | 'employeeId'>[] }
-  async updateAvailabilities(employeeId: string, data: { planId: string, availabilities: Omit<EmployeeAvailability, 'id' | 'employeeId'>[] }): Promise<EmployeeAvailability[]> {
+  ): Promise<EmployeeAvailability[]> {
     console.log('🔄 Updating availabilities for employee:', employeeId);
-    const response = await fetch(`${API_BASE_URL}/employees/${employeeId}/availabilities`, {
+    return apiClient.put<EmployeeAvailability[]>(`/employees/${employeeId}/availabilities`, data);
-      method: 'PUT',
-      headers: getAuthHeaders(),
-      body: JSON.stringify(data),
-    });
-    
-    if (!response.ok) {
-      const error = await response.json();
-      throw new Error(error.error || 'Failed to update availabilities');
   }
 
-    return response.json();
+  async changePassword(
-  }
+    id: string, 
-
+    data: { currentPassword: string, newPassword: string, confirmPassword: string }
-  async changePassword(id: string, data: { currentPassword: string, newPassword: string }): Promise<void> {
+  ): Promise<void> {
-    const response = await fetch(`${API_BASE_URL}/employees/${id}/password`, {
+    return apiClient.put<void>(`/employees/${id}/password`, data);
-      method: 'PUT',
-      headers: getAuthHeaders(),
-      body: JSON.stringify(data),
-    });
-    
-    if (!response.ok) {
-      const error = await response.json();
-      throw new Error(error.error || 'Failed to change password');
-    }
   }
 
   async updateLastLogin(employeeId: string): Promise<void> {
     try {
-      const response = await fetch(`${API_BASE_URL}/employees/${employeeId}/last-login`, {
+      await apiClient.patch(`/employees/${employeeId}/last-login`);
-        method: 'PATCH',
-        headers: getAuthHeaders(),
-      });
-
-      if (!response.ok) {
-        throw new Error('Failed to update last login');
-      }
     } catch (error) {
       console.error('Error updating last login:', error);
       throw error;

frontend/src/services/shiftAssignmentService.ts

@@ -1,65 +1,15 @@
-// frontend/src/services/shiftAssignmentService.ts - WEEKLY PATTERN VERSION
 import { ShiftPlan, ScheduledShift } from '../models/ShiftPlan';
 import { Employee, EmployeeAvailability } from '../models/Employee';
-import { authService } from './authService';
 import { AssignmentResult, ScheduleRequest } from '../models/scheduling';
-
+import { apiClient } from './apiClient';
-const API_BASE_URL = '/api';
-
-// Helper function to get auth headers
-const getAuthHeaders = () => {
-  const token = localStorage.getItem('token');
-  return {
-    'Content-Type': 'application/json',
-    ...(token && { 'Authorization': `Bearer ${token}` })
-  };
-};
 
 export class ShiftAssignmentService {
   async updateScheduledShift(id: string, updates: { assignedEmployees: string[] }): Promise<void> {
     try {
-      //console.log('🔄 Updating scheduled shift via API:', { id, updates });
+      console.log('🔄 Updating scheduled shift via API:', { id, updates });
       
-      const response = await fetch(`${API_BASE_URL}/scheduled-shifts/${id}`, {
+      await apiClient.put(`/scheduled-shifts/${id}`, updates);
-        method: 'PUT',
+      console.log('✅ Scheduled shift updated successfully');
-        headers: {
-          'Content-Type': 'application/json',
-          ...authService.getAuthHeaders()
-        },
-        body: JSON.stringify(updates)
-      });
-
-      // First, check if we got any response
-      if (!response.ok) {
-        // Try to get error message from response
-        const responseText = await response.text();
-        console.error('❌ Server response:', responseText);
-        
-        let errorMessage = `HTTP ${response.status}: ${response.statusText}`;
-        
-        // Try to parse as JSON if possible
-        try {
-          const errorData = JSON.parse(responseText);
-          errorMessage = errorData.error || errorMessage;
-        } catch (e) {
-          // If not JSON, use the text as is
-          errorMessage = responseText || errorMessage;
-        }
-        
-        throw new Error(errorMessage);
-      }
-
-      // Try to parse successful response
-      const responseText = await response.text();
-      let result;
-      try {
-        result = responseText ? JSON.parse(responseText) : {};
-      } catch (e) {
-        console.warn('⚠️ Response was not JSON, but request succeeded');
-        result = { message: 'Update successful' };
-      }
-      
-      console.log('✅ Scheduled shift updated successfully:', result);
       
     } catch (error) {
       console.error('❌ Error updating scheduled shift:', error);
@@ -69,48 +19,16 @@ export class ShiftAssignmentService {
 
   async getScheduledShift(id: string): Promise<any> {
     try {
-      const response = await fetch(`${API_BASE_URL}/scheduled-shifts/${id}`, {
+      return await apiClient.get(`/scheduled-shifts/${id}`);
-        headers: {
-          'Authorization': `Bearer ${localStorage.getItem('token')}`
-        }
-      });
-
-      if (!response.ok) {
-        const responseText = await response.text();
-        let errorMessage = `HTTP ${response.status}: ${response.statusText}`;
-        
-        try {
-          const errorData = JSON.parse(responseText);
-          errorMessage = errorData.error || errorMessage;
-        } catch (e) {
-          errorMessage = responseText || errorMessage;
-        }
-        
-        throw new Error(errorMessage);
-      }
-
-      const responseText = await response.text();
-      return responseText ? JSON.parse(responseText) : {};
     } catch (error) {
       console.error('Error fetching scheduled shift:', error);
       throw error;
     }
   }
 
-  // New method to get all scheduled shifts for a plan
   async getScheduledShiftsForPlan(planId: string): Promise<ScheduledShift[]> {
     try {
-      const response = await fetch(`${API_BASE_URL}/scheduled-shifts/plan/${planId}`, {
+      const shifts = await apiClient.get<ScheduledShift[]>(`/scheduled-shifts/plan/${planId}`);
-        headers: {
-          'Authorization': `Bearer ${localStorage.getItem('token')}`
-        }
-      });
-
-      if (!response.ok) {
-        throw new Error(`Failed to fetch scheduled shifts: ${response.status}`);
-      }
-
-      const shifts = await response.json();
       
       // DEBUG: Check the structure of returned shifts
       console.log('🔍 SCHEDULED SHIFTS STRUCTURE:', shifts.slice(0, 3));
@@ -132,21 +50,7 @@ export class ShiftAssignmentService {
   }
 
   private async callSchedulingAPI(request: ScheduleRequest): Promise<AssignmentResult> {
-    const response = await fetch(`${API_BASE_URL}/scheduling/generate-schedule`, {
+    return await apiClient.post<AssignmentResult>('/scheduling/generate-schedule', request);
-      method: 'POST',
-      headers: {
-          'Content-Type': 'application/json',
-          ...authService.getAuthHeaders()
-        },
-      body: JSON.stringify(request)
-    });
-
-    if (!response.ok) {
-      const errorData = await response.json();
-      throw new Error(errorData.error || 'Scheduling failed');
-    }
-
-    return response.json();
   }
 
   async assignShifts(

frontend/src/services/shiftPlanService.ts

@@ -1,198 +1,141 @@
-// frontend/src/services/shiftPlanService.ts
+import { ShiftPlan, CreateShiftPlanRequest, TimeSlot, Shift } from '../models/ShiftPlan';
-import { authService } from './authService';
-import { ShiftPlan, CreateShiftPlanRequest } from '../models/ShiftPlan';
 import { TEMPLATE_PRESETS } from '../models/defaults/shiftPlanDefaults';
+import { apiClient } from './apiClient';
 
-const API_BASE_URL = '/api/shift-plans';
+// Request types for time slot and shift operations
-
+export interface CreateTimeSlotRequest {
-// Helper function to get auth headers
+  name: string;
-const getAuthHeaders = () => {
+  startTime: string;
-  const token = localStorage.getItem('token');
+  endTime: string;
-  return {
+  description?: string;
-    'Content-Type': 'application/json',
+}
-    ...(token && { 'Authorization': `Bearer ${token}` })
+
-  };
+export interface UpdateTimeSlotRequest {
-};
+  name?: string;
-
+  startTime?: string;
-// Helper function to handle responses
+  endTime?: string;
-const handleResponse = async (response: Response) => {
+  description?: string;
-  if (!response.ok) {
+}
-    const errorData = await response.json().catch(() => ({ error: 'Unknown error' }));
+
-    throw new Error(errorData.error || `HTTP error! status: ${response.status}`);
+export interface CreateShiftRequest {
+  timeSlotId: string;
+  dayOfWeek: number;
+  requiredEmployees: number;
+  color?: string;
+}
+
+export interface UpdateShiftRequest {
+  requiredEmployees?: number;
+  color?: string;
 }
-  return response.json();
-};
 
 export const shiftPlanService = {
   async getShiftPlans(): Promise<ShiftPlan[]> {
-    const response = await fetch(API_BASE_URL, {
+    try {
-      headers: {
+      const plans = await apiClient.get<ShiftPlan[]>('/shift-plans');
-        'Content-Type': 'application/json',
-        ...authService.getAuthHeaders()
-      }
-    });
-    
-    if (!response.ok) {
-      if (response.status === 401) {
-        authService.logout();
-        throw new Error('Nicht authorisiert - bitte erneut anmelden');
-      }
-      throw new Error('Fehler beim Laden der Schichtpläne');
-    }
-    
-    const plans = await response.json();
       
       // Ensure scheduledShifts is always an array
       return plans.map((plan: any) => ({
         ...plan,
         scheduledShifts: plan.scheduledShifts || []
       }));
+    } catch (error: any) {
+      if (error.statusCode === 401) {
+        // You might want to import and use authService here if needed
+        localStorage.removeItem('token');
+        localStorage.removeItem('employee');
+        throw new Error('Nicht authorisiert - bitte erneut anmelden');
+      }
+      throw new Error('Fehler beim Laden der Schichtpläne');
+    }
   },
 
   async getShiftPlan(id: string): Promise<ShiftPlan> {
-    const response = await fetch(`${API_BASE_URL}/${id}`, {
+    try {
-      headers: {
+      return await apiClient.get<ShiftPlan>(`/shift-plans/${id}`);
-        'Content-Type': 'application/json',
+    } catch (error: any) {
-        ...authService.getAuthHeaders()
+      if (error.statusCode === 401) {
-      }
+        localStorage.removeItem('token');
-    });
+        localStorage.removeItem('employee');
-    
-    if (!response.ok) {
-      if (response.status === 401) {
-        authService.logout();
         throw new Error('Nicht authorisiert - bitte erneut anmelden');
       }
       throw new Error('Schichtplan nicht gefunden');
     }
-    
-    return await response.json();
   },
 
   async createShiftPlan(plan: CreateShiftPlanRequest): Promise<ShiftPlan> {
-    const response = await fetch(API_BASE_URL, {
+    try {
-      method: 'POST',
+      return await apiClient.post<ShiftPlan>('/shift-plans', plan);
-      headers: {
+    } catch (error: any) {
-        'Content-Type': 'application/json',
+      if (error.statusCode === 401) {
-        ...authService.getAuthHeaders()
+        localStorage.removeItem('token');
-      },
+        localStorage.removeItem('employee');
-      body: JSON.stringify(plan)
-    });
-
-    if (!response.ok) {
-      if (response.status === 401) {
-        authService.logout();
         throw new Error('Nicht authorisiert - bitte erneut anmelden');
       }
       throw new Error('Fehler beim Erstellen des Schichtplans');
     }
-
-    return response.json();
   },
 
   async updateShiftPlan(id: string, plan: Partial<ShiftPlan>): Promise<ShiftPlan> {
-    const response = await fetch(`${API_BASE_URL}/${id}`, {
+    try {
-      method: 'PUT',
+      return await apiClient.put<ShiftPlan>(`/shift-plans/${id}`, plan);
-      headers: {
+    } catch (error: any) {
-        'Content-Type': 'application/json',
+      if (error.statusCode === 401) {
-        ...authService.getAuthHeaders()
+        localStorage.removeItem('token');
-      },
+        localStorage.removeItem('employee');
-      body: JSON.stringify(plan)
-    });
-
-    if (!response.ok) {
-      if (response.status === 401) {
-        authService.logout();
         throw new Error('Nicht authorisiert - bitte erneut anmelden');
       }
       throw new Error('Fehler beim Aktualisieren des Schichtplans');
     }
-
-    return response.json();
   },
 
   async deleteShiftPlan(id: string): Promise<void> {
-    const response = await fetch(`${API_BASE_URL}/${id}`, {
+    try {
-      method: 'DELETE',
+      await apiClient.delete(`/shift-plans/${id}`);
-      headers: {
+    } catch (error: any) {
-        'Content-Type': 'application/json',
+      if (error.statusCode === 401) {
-        ...authService.getAuthHeaders()
+        localStorage.removeItem('token');
-      }
+        localStorage.removeItem('employee');
-    });
-
-    if (!response.ok) {
-      if (response.status === 401) {
-        authService.logout();
         throw new Error('Nicht authorisiert - bitte erneut anmelden');
       }
       throw new Error('Fehler beim Löschen des Schichtplans');
     }
   },
 
-  // Get specific template or plan
+  async getTemplate(id: string): Promise<ShiftPlan> {
-  getTemplate: async (id: string): Promise<ShiftPlan> => {
+    return await apiClient.get<ShiftPlan>(`/shift-plans/${id}`);
-    const response = await fetch(`${API_BASE_URL}/${id}`, {
-      headers: getAuthHeaders()
-    });
-    return handleResponse(response);
   },
 
-
   async regenerateScheduledShifts(planId: string): Promise<void> {
     try {
       console.log('🔄 Attempting to regenerate scheduled shifts...');
-        
+      await apiClient.post(`/shift-plans/${planId}/regenerate-shifts`);
-        // You'll need to add this API endpoint to your backend
-        const response = await fetch(`${API_BASE_URL}/${planId}/regenerate-shifts`, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            'Authorization': `Bearer ${localStorage.getItem('token')}`
-        }
-        });
-
-        if (response.ok) {
       console.log('✅ Scheduled shifts regenerated');
-        } else {
-        console.error('❌ Failed to regenerate shifts');
-        }
     } catch (error) {
       console.error('❌ Error regenerating shifts:', error);
+      throw error;
     }
   },
 
-  // Create new plan
+  async createPlan(data: CreateShiftPlanRequest): Promise<ShiftPlan> {
-  createPlan: async (data: CreateShiftPlanRequest): Promise<ShiftPlan> => {
+    return await apiClient.post<ShiftPlan>('/shift-plans', data);
-    const response = await fetch(`${API_BASE_URL}`, {
-      method: 'POST',
-      headers: getAuthHeaders(),
-      body: JSON.stringify(data),
-    });
-    return handleResponse(response);
   },
 
-  createFromPreset: async (data: {
+  async createFromPreset(data: {
     presetName: string;
     name: string;
     startDate: string;
     endDate: string;
     isTemplate?: boolean;
-  }): Promise<ShiftPlan> => {
+  }): Promise<ShiftPlan> {
-    const response = await fetch(`${API_BASE_URL}/from-preset`, {
+    try {
-      method: 'POST',
+      return await apiClient.post<ShiftPlan>('/shift-plans/from-preset', data);
-      headers: getAuthHeaders(),
+    } catch (error: any) {
-      body: JSON.stringify(data),
+      throw new Error(error.message || `HTTP error! status: ${error.statusCode}`);
-    });
-    
-    if (!response.ok) {
-      const errorData = await response.json().catch(() => ({ error: 'Unknown error' }));
-      throw new Error(errorData.error || `HTTP error! status: ${response.status}`);
     }
-    
-    return response.json();
   },
 
-  getTemplatePresets: async (): Promise<{name: string, label: string, description: string}[]> => {
+  async getTemplatePresets(): Promise<{name: string, label: string, description: string}[]> {
-    // name = label
     return Object.entries(TEMPLATE_PRESETS).map(([key, preset]) => ({
       name: key,
       label: preset.name,
@@ -203,25 +146,147 @@ export const shiftPlanService = {
   async clearAssignments(planId: string): Promise<void> {
     try {
       console.log('🔄 Clearing assignments for plan:', planId);
-      
+      await apiClient.post(`/shift-plans/${planId}/clear-assignments`);
-      const response = await fetch(`${API_BASE_URL}/${planId}/clear-assignments`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          ...authService.getAuthHeaders()
-        }
-      });
-
-      if (!response.ok) {
-        const errorData = await response.json().catch(() => ({ error: 'Unknown error' }));
-        throw new Error(errorData.error || `Failed to clear assignments: ${response.status}`);
-      }
-
       console.log('✅ Assignments cleared successfully');
-      
     } catch (error) {
       console.error('❌ Error clearing assignments:', error);
       throw error;
     }
   },
+
+  async exportShiftPlanToExcel(planId: string): Promise<Blob> {
+    try {
+      console.log('📊 Exporting shift plan to Excel:', planId);
+      
+      // Use the apiClient with blob response handling
+      const blob = await apiClient.request<Blob>(`/shift-plans/${planId}/export/excel`, {
+        method: 'GET',
+      }, 'blob');
+      
+      console.log('✅ Excel export successful');
+      return blob;
+    } catch (error: any) {
+      console.error('❌ Error exporting to Excel:', error);
+      
+      if (error.statusCode === 401) {
+        localStorage.removeItem('token');
+        localStorage.removeItem('employee');
+        throw new Error('Nicht authorisiert - bitte erneut anmelden');
+      }
+      
+      if (error.statusCode === 404) {
+        throw new Error('Schichtplan nicht gefunden');
+      }
+      
+      throw new Error('Fehler beim Excel-Export des Schichtplans');
+    }
+  },
+
+  async exportShiftPlanToPDF(planId: string): Promise<Blob> {
+    try {
+      console.log('📄 Exporting shift plan to PDF:', planId);
+
+      // Use the apiClient with blob response handling
+      const blob = await apiClient.request<Blob>(`/shift-plans/${planId}/export/pdf`, {
+        method: 'GET',
+      }, 'blob');
+
+      console.log('✅ PDF export successful');
+      return blob;
+    } catch (error: any) {
+      console.error('❌ Error exporting to PDF:', error);
+
+      if (error.statusCode === 401) {
+        localStorage.removeItem('token');
+        localStorage.removeItem('employee');
+        throw new Error('Nicht authorisiert - bitte erneut anmelden');
+      }
+
+      if (error.statusCode === 404) {
+        throw new Error('Schichtplan nicht gefunden');
+      }
+
+      throw new Error('Fehler beim PDF-Export des Schichtplans');
+    }
+  },
+
+  // Time Slot operations
+  async addTimeSlot(planId: string, timeSlot: CreateTimeSlotRequest): Promise<TimeSlot> {
+    try {
+      return await apiClient.post<TimeSlot>(`/shift-plans/${planId}/time-slots`, timeSlot);
+    } catch (error: any) {
+      if (error.statusCode === 401) {
+        localStorage.removeItem('token');
+        localStorage.removeItem('employee');
+        throw new Error('Nicht authorisiert - bitte erneut anmelden');
+      }
+      throw new Error('Fehler beim Hinzufügen des Zeit-Slots');
+    }
+  },
+
+  async updateTimeSlot(planId: string, slotId: string, data: UpdateTimeSlotRequest): Promise<TimeSlot> {
+    try {
+      return await apiClient.put<TimeSlot>(`/shift-plans/${planId}/time-slots/${slotId}`, data);
+    } catch (error: any) {
+      if (error.statusCode === 401) {
+        localStorage.removeItem('token');
+        localStorage.removeItem('employee');
+        throw new Error('Nicht authorisiert - bitte erneut anmelden');
+      }
+      throw new Error('Fehler beim Aktualisieren des Zeit-Slots');
+    }
+  },
+
+  async deleteTimeSlot(planId: string, slotId: string): Promise<void> {
+    try {
+      await apiClient.delete(`/shift-plans/${planId}/time-slots/${slotId}`);
+    } catch (error: any) {
+      if (error.statusCode === 401) {
+        localStorage.removeItem('token');
+        localStorage.removeItem('employee');
+        throw new Error('Nicht authorisiert - bitte erneut anmelden');
+      }
+      throw new Error('Fehler beim Löschen des Zeit-Slots');
+    }
+  },
+
+  // Shift operations
+  async addShift(planId: string, shift: CreateShiftRequest): Promise<Shift> {
+    try {
+      return await apiClient.post<Shift>(`/shift-plans/${planId}/shifts`, shift);
+    } catch (error: any) {
+      if (error.statusCode === 401) {
+        localStorage.removeItem('token');
+        localStorage.removeItem('employee');
+        throw new Error('Nicht authorisiert - bitte erneut anmelden');
+      }
+      throw new Error('Fehler beim Hinzufügen der Schicht');
+    }
+  },
+
+  async updateShift(planId: string, shiftId: string, data: UpdateShiftRequest): Promise<Shift> {
+    try {
+      return await apiClient.patch<Shift>(`/shift-plans/${planId}/shifts/${shiftId}`, data);
+    } catch (error: any) {
+      if (error.statusCode === 401) {
+        localStorage.removeItem('token');
+        localStorage.removeItem('employee');
+        throw new Error('Nicht authorisiert - bitte erneut anmelden');
+      }
+      throw new Error('Fehler beim Aktualisieren der Schicht');
+    }
+  },
+
+  async deleteShift(planId: string, shiftId: string): Promise<void> {
+    try {
+      await apiClient.delete(`/shift-plans/${planId}/shifts/${shiftId}`);
+    } catch (error: any) {
+      if (error.statusCode === 401) {
+        localStorage.removeItem('token');
+        localStorage.removeItem('employee');
+        throw new Error('Nicht authorisiert - bitte erneut anmelden');
+      }
+      throw new Error('Fehler beim Löschen der Schicht');
+    }
+  },
 };

frontend/src/utils/buttonStyles.ts

@@ -0,0 +1,150 @@
+// Unified button styles for consistent UI across the application
+
+import React from 'react';
+
+// Color palette
+export const BUTTON_COLORS = {
+  delete: '#e74c3c',
+  add: '#27ae60',
+  edit: '#f39c12',
+  cancel: '#95a5a6',
+  info: '#3498db',
+  primary: '#2c3e50',
+};
+
+// Icon constants for uniform usage
+export const ICONS = {
+  delete: '-',
+  add: '+',
+  edit: '✎',
+  close: '✕',
+  calendar: '📅',
+};
+
+// Base button style
+const baseButtonStyle: React.CSSProperties = {
+  border: 'none',
+  borderRadius: '4px',
+  cursor: 'pointer',
+  fontWeight: 'bold',
+  transition: 'opacity 0.2s ease',
+};
+
+// Icon button (small, square) - for inline actions
+export const iconButtonStyle = (
+  color: string,
+  disabled = false
+): React.CSSProperties => ({
+  ...baseButtonStyle,
+  padding: '6px 8px',
+  backgroundColor: color,
+  color: 'white',
+  fontSize: '14px',
+  minWidth: '32px',
+  height: '32px',
+  display: 'inline-flex',
+  alignItems: 'center',
+  justifyContent: 'center',
+  cursor: disabled ? 'not-allowed' : 'pointer',
+  opacity: disabled ? 0.5 : 1,
+});
+
+// Small inline icon button (for table cells, headers)
+export const smallIconButtonStyle = (
+  color: string,
+  disabled = false
+): React.CSSProperties => ({
+  ...baseButtonStyle,
+  padding: '4px 8px',
+  backgroundColor: color,
+  color: 'white',
+  fontSize: '12px',
+  minWidth: '24px',
+  height: '24px',
+  display: 'inline-flex',
+  alignItems: 'center',
+  justifyContent: 'center',
+  cursor: disabled ? 'not-allowed' : 'pointer',
+  opacity: disabled ? 0.5 : 1,
+});
+
+// Text button with icon prefix
+export const textButtonStyle = (
+  color: string,
+  disabled = false
+): React.CSSProperties => ({
+  ...baseButtonStyle,
+  padding: '8px 16px',
+  backgroundColor: color,
+  color: 'white',
+  fontSize: '14px',
+  cursor: disabled ? 'not-allowed' : 'pointer',
+  opacity: disabled ? 0.6 : 1,
+});
+
+// Outline/dashed button for "add new" actions
+export const outlineButtonStyle = (
+  color: string,
+  disabled = false
+): React.CSSProperties => ({
+  ...baseButtonStyle,
+  padding: '10px 20px',
+  backgroundColor: 'transparent',
+  color: color,
+  border: `2px dashed ${color}`,
+  fontSize: '14px',
+  width: '100%',
+  cursor: disabled ? 'not-allowed' : 'pointer',
+  opacity: disabled ? 0.6 : 1,
+});
+
+// Borderless icon button (for minimal UI elements)
+export const borderlessIconButtonStyle = (
+  color: string,
+  disabled = false
+): React.CSSProperties => ({
+  background: 'none',
+  border: 'none',
+  color: color,
+  cursor: disabled ? 'not-allowed' : 'pointer',
+  fontSize: '16px',
+  padding: '4px 8px',
+  opacity: disabled ? 0.5 : 1,
+  display: 'inline-flex',
+  alignItems: 'center',
+  justifyContent: 'center',
+});
+
+// Preset button styles for common actions
+export const deleteIconButton = (disabled = false) =>
+  iconButtonStyle(BUTTON_COLORS.delete, disabled);
+
+export const addIconButton = (disabled = false) =>
+  iconButtonStyle(BUTTON_COLORS.add, disabled);
+
+export const editIconButton = (disabled = false) =>
+  iconButtonStyle(BUTTON_COLORS.edit, disabled);
+
+export const deleteTextButton = (disabled = false) =>
+  textButtonStyle(BUTTON_COLORS.delete, disabled);
+
+export const addTextButton = (disabled = false) =>
+  textButtonStyle(BUTTON_COLORS.add, disabled);
+
+export const cancelTextButton = (disabled = false) =>
+  textButtonStyle(BUTTON_COLORS.cancel, disabled);
+
+export const addOutlineButton = (disabled = false) =>
+  outlineButtonStyle(BUTTON_COLORS.add, disabled);
+
+export const smallDeleteButton = (disabled = false) =>
+  smallIconButtonStyle(BUTTON_COLORS.delete, disabled);
+
+export const smallAddButton = (disabled = false) =>
+  smallIconButtonStyle(BUTTON_COLORS.add, disabled);
+
+export const borderlessDeleteButton = (disabled = false) =>
+  borderlessIconButtonStyle(BUTTON_COLORS.delete, disabled);
+
+export const borderlessEditButton = (disabled = false) =>
+  borderlessIconButtonStyle(BUTTON_COLORS.edit, disabled);

frontend/vite.config.ts

@@ -1,29 +1,18 @@
-// vite.config.ts
 import { defineConfig, loadEnv } from 'vite'
 import react from '@vitejs/plugin-react'
 import { resolve } from 'path'
 
 export default defineConfig(({ mode }) => {
   const isProduction = mode === 'production'
-  const isDevelopment = mode === 'development'
-
   const env = loadEnv(mode, process.cwd(), '')
 
-  // 🆕 WICHTIG: Relative Pfade für Production
-  const clientEnv = {
-    NODE_ENV: mode,
-    ENABLE_PRO: env.ENABLE_PRO || 'false',
-    VITE_APP_TITLE: env.APP_TITLE || 'Shift Planning App',
-    VITE_API_URL: isProduction ? '/api' : '/api',
-  }
-
   return {
     plugins: [react()],
 
-    server: {
+    // Development proxy
+    server: isProduction ? undefined : {
       port: 3003,
       host: true,
-      //open: isDevelopment,
       proxy: {
         '/api': {
           target: 'http://localhost:3002',
@@ -33,25 +22,38 @@ export default defineConfig(({ mode }) => {
       }
     },
 
+    // Production build optimized for Express serving
     build: {
       outDir: 'dist',
-      sourcemap: isDevelopment,
+      sourcemap: false, // Disable in production
-      base: isProduction ? '/' : '/',
+      minify: 'terser',
+      
+      // Bundle optimization
       rollupOptions: {
         output: {
+          // Efficient chunking
+          manualChunks: {
+            vendor: ['react', 'react-dom', 'react-router-dom'],
+            utils: ['date-fns']
+          },
+          // Cache-friendly naming
           chunkFileNames: 'assets/[name]-[hash].js',
           entryFileNames: 'assets/[name]-[hash].js',
           assetFileNames: 'assets/[name]-[hash].[ext]',
         }
       },
-      minify: isProduction ? 'terser' : false,
+      
-      terserOptions: isProduction ? {
+      // Performance optimizations
+      terserOptions: {
         compress: {
           drop_console: true,
           drop_debugger: true,
-          pure_funcs: ['console.log', 'console.debug', 'console.info']
+          pure_funcs: ['console.log', 'console.debug']
         }
-      } : undefined,
+      },
+      
+      // Reduce chunking overhead
+      chunkSizeWarningLimit: 800
     },
 
     resolve: {
@@ -67,9 +69,11 @@ export default defineConfig(({ mode }) => {
       }
     },
 
-    define: Object.keys(clientEnv).reduce((acc, key) => {
+    // Environment variables
-      acc[`import.meta.env.${key}`] = JSON.stringify(clientEnv[key])
+    define: {
-      return acc
+      'import.meta.env.VITE_API_URL': JSON.stringify(isProduction ? '/api' : '/api'),
-    }, {} as Record<string, string>)
+      'import.meta.env.ENABLE_PRO': JSON.stringify(env.ENABLE_PRO || 'false'),
+      'import.meta.env.NODE_ENV': JSON.stringify(mode)
+    }
   }
 })

package.json

@@ -9,9 +9,13 @@
   "scripts": {
     "docker:build": "docker build -t schichtplan-app .",
     "docker:run": "docker run -p 3002:3002 schichtplan-app",
-    "build:all": "npm run build --workspace=backend && npm run build --workspace=frontend"
+    "build:all": "npm run build --workspace=backend && npm run build --workspace=frontend",
+    "dev": "concurrently \"npm run dev:backend\" \"npm run dev:frontend\"",
+    "dev:frontend": "cd frontend && npm run dev",
+    "dev:backend": "cd backend && npm run dev:all"
   },
   "devDependencies": {
-    "typescript": "^5.3.3"
+    "typescript": "^5.3.3",
+    "concurrently": "9.2.1"
   }
 }