From d40040efd8de7b0354a10d16a81045b0e54de4f7 Mon Sep 17 00:00:00 2001
From: Johann Hoffmann <ma0646@technikum-wien.at>
Date: Tue, 21 Jul 2026 18:07:23 +0200
Subject: [PATCH] added new fkey to tbl_widget for system.tbl_berechtigung;
 check for permission status during load & in widget picker; if widget was
 already picked/configured but not permitted anymore -> show a generalized
 "missing permission" screen via fallback component during widget init;

---
 .../api/frontend/v1/dashboard/Widget.php      |   3 +
 public/js/components/Dashboard/Item.js        |  15 ++-
 .../js/components/Dashboard/Widget/Picker.js  |  12 ++-
 .../DashboardWidget/MissingPermission.js      |  21 ++++
 system/dbupdate_3.4.php                       |   1 +
 .../77757_widgets_berechtigungen.php          |  57 ++++++++++
 system/phrasesupdate.php                      | 100 ++++++++++++++++++
 7 files changed, 204 insertions(+), 5 deletions(-)
 create mode 100644 public/js/components/DashboardWidget/MissingPermission.js
 create mode 100644 system/dbupdate_3.4/77757_widgets_berechtigungen.php

diff --git a/application/controllers/api/frontend/v1/dashboard/Widget.php b/application/controllers/api/frontend/v1/dashboard/Widget.php
index ac8c682e8..99865b6db 100644
--- a/application/controllers/api/frontend/v1/dashboard/Widget.php
+++ b/application/controllers/api/frontend/v1/dashboard/Widget.php
@@ -101,6 +101,9 @@ class Widget extends FHCAPI_Controller
 			$tmpsetup = json_decode($widget->setup);
 			$tmpsetup->file = absoluteJsImportUrl($tmpsetup->file);
 			$widget->setup = $tmpsetup;
+			$widget->permitted = empty($widget->berechtigung_kurzbz) 
+				|| $this->permissionlib->isBerechtigt($widget->berechtigung_kurzbz);
+
 			return $widget;
 		}, $widgets);
 
diff --git a/public/js/components/Dashboard/Item.js b/public/js/components/Dashboard/Item.js
index 20c195178..a1623df58 100644
--- a/public/js/components/Dashboard/Item.js
+++ b/public/js/components/Dashboard/Item.js
@@ -1,5 +1,6 @@
 import BsModal from "../Bootstrap/Modal.js";
 import HeightTransition from "../Tranistion/HeightTransition.js";
+import MissingPermissionWidget from "../DashboardWidget/MissingPermission.js";
 
 import { enableDragDropTouch } from "../../../../vendor/drag-drop-touch-js/dragdroptouch/dist/drag-drop-touch.esm.min.js";
 
@@ -113,6 +114,12 @@ export default {
 		isPinned() {
 			return this.place?.pinned ? true : false;
 		},
+		permitted() {
+			// widgets without a linked permission (or before the template loaded)
+			// are considered permitted; the backend sets permitted === false only
+			// when the user is missing the widget's required permission
+			return this.widgetTemplate?.permitted !== false;
+		},
 		ready() {
 			return this.component && this.arguments !== null;
 		},
@@ -178,7 +185,11 @@ export default {
 				&& this.widgetTemplate.widget_id
 				&& this.widgetTemplate.arguments
 			) {
-				let component = (await import(this.widgetTemplate.setup.file)).default;
+				// render the "missing permission" screen instead of the actual
+				// widget when the user does not hold the widget's linked permission
+				let component = this.permitted
+					? (await import(this.widgetTemplate.setup.file)).default
+					: MissingPermissionWidget;
 				this.$options.components["widget" + this.widgetTemplate.widget_id] = component;
 				this.component = "widget" + this.widgetTemplate.widget_id;
 				this.arguments = { ...this.widgetTemplate.arguments, ...this.config };
@@ -280,7 +291,7 @@ export default {
 				</template>
 				<!-- widget link -->
 				<a
-					v-if="widgetTemplate.setup.cis4link"
+					v-if="widgetTemplate.setup.cis4link && permitted"
 					:href="getWidgetC4Link(widgetTemplate)"
 					class="col-auto ms-auto"
 					:aria-label="$p.t('dashboard/widget_link')"
diff --git a/public/js/components/Dashboard/Widget/Picker.js b/public/js/components/Dashboard/Widget/Picker.js
index 260b95874..1d49533dd 100644
--- a/public/js/components/Dashboard/Widget/Picker.js
+++ b/public/js/components/Dashboard/Widget/Picker.js
@@ -12,6 +12,12 @@ export default {
 	data: () => ({
 		callbacks: {}
 	}),
+	computed: {
+		// filter widgets away the user has no permissions for
+		availableWidgets() {
+			return (this.widgets || []).filter(widget => widget.permitted !== false);
+		}
+	},
 	methods: {
 		getWidget() {
 			return new Promise((resolve,reject) => {
@@ -37,17 +43,17 @@ export default {
 		<bs-modal
 			ref="modal"
 			class="fade"
-			:dialog-class="{ 'modal-fullscreen-sm-down': 1, 'modal-xl': widgets && widgets.length > 0 }"
+			:dialog-class="{ 'modal-fullscreen-sm-down': 1, 'modal-xl': availableWidgets.length > 0 }"
 			@hiddenBsModal="close"
 		>
 			<template v-slot:title>{{ $p.t('dashboard/createWidget') }}</template>
 			<template v-slot:default>
 				<div v-if="widgets" class="row g-2">
-					<div v-if="!widgets.length">
+					<div v-if="!availableWidgets.length">
 						{{ $p.t('dashboard/noWidgetsAvailable') }}
 					</div>
 					<div
-						v-for="widget in widgets"
+						v-for="widget in availableWidgets"
 						:key="widget.widget_id"
 						class="widget-icon-container col-sm-6 col-md-4 col-lg-3 col-xl-2"
 					>
diff --git a/public/js/components/DashboardWidget/MissingPermission.js b/public/js/components/DashboardWidget/MissingPermission.js
new file mode 100644
index 000000000..ceaff5295
--- /dev/null
+++ b/public/js/components/DashboardWidget/MissingPermission.js
@@ -0,0 +1,21 @@
+import AbstractWidget from './Abstract.js';
+
+/**
+ * Fallback screen rendered in place of a widget when the current user is missing
+ * the permission (berechtigung_kurzbz) linked to that widget. Used for widgets
+ * that are already on a user's dashboard but whose required permission the user
+ * no longer holds.
+ */
+export default {
+	mixins: [
+		AbstractWidget
+	],
+	created() {
+		this.$emit('setConfig', false);
+	},
+	template: /*html*/`
+	<div class="dashboard-widget-missing-permission d-flex flex-column justify-content-center align-items-center text-center h-100 p-3 text-body-secondary">
+		<i class="fa-solid fa-lock fa-2x mb-2" aria-hidden="true"></i>
+		<p class="mb-0">{{ $p.t('dashboard/widget_missing_permission') }}</p>
+	</div>`
+}
diff --git a/system/dbupdate_3.4.php b/system/dbupdate_3.4.php
index 9fd1b8d98..28f80b499 100644
--- a/system/dbupdate_3.4.php
+++ b/system/dbupdate_3.4.php
@@ -98,6 +98,7 @@ require_once('dbupdate_3.4/75888_reihungstest_mehrfachdurchfuehrung.php');
 require_once('dbupdate_3.4/76150_perm_other_lv_plan.php');
 require_once('dbupdate_3.4/68957_dashboard_bookmark_neue_Spalte_sort.php');
 require_once('dbupdate_3.4/68530_Dashboard_Cleanup.php');
+require_once('dbupdate_3.4/77757_widgets_berechtigungen.php');
 
 // *** Pruefung und hinzufuegen der neuen Attribute und Tabellen
 echo '<H2>Pruefe Tabellen und Attribute!</H2>';
diff --git a/system/dbupdate_3.4/77757_widgets_berechtigungen.php b/system/dbupdate_3.4/77757_widgets_berechtigungen.php
new file mode 100644
index 000000000..da7fc7d0c
--- /dev/null
+++ b/system/dbupdate_3.4/77757_widgets_berechtigungen.php
@@ -0,0 +1,57 @@
+<?php
+/* Copyright (C) 2026 fhcomplete.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Beschreibung:
+ * Dashboard Widgets: Verknüpfung einer (einzelnen) Berechtigung pro Widget.
+ * Neue Spalte dashboard.tbl_widget.berechtigung_kurzbz mit FK auf
+ * system.tbl_berechtigung. Ist die Spalte NULL, erfordert das Widget keine
+ * gesonderte Berechtigung. Benutzer denen die verknüpfte Berechtigung fehlt,
+ * bekommen das Widget nicht mehr zur Auswahl angezeigt bzw. sehen (falls bereits
+ * am Dashboard) einen "Fehlende Berechtigung"-Screen.
+ */
+if (! defined('DB_NAME')) exit('No direct script access allowed');
+
+// Add column dashboard.tbl_widget.berechtigung_kurzbz (FK => system.tbl_berechtigung)
+if ($result = @$db->db_query("
+	SELECT 1
+	FROM information_schema.columns
+	WHERE table_schema = 'dashboard'
+		AND table_name = 'tbl_widget'
+		AND column_name = 'berechtigung_kurzbz';"))
+{
+	if ($db->db_num_rows($result) == 0)
+	{
+		$qry = "
+			ALTER TABLE dashboard.tbl_widget
+				ADD COLUMN berechtigung_kurzbz VARCHAR(32) NULL;
+
+			ALTER TABLE dashboard.tbl_widget
+				ADD CONSTRAINT tbl_widget_berechtigung_fk
+				FOREIGN KEY (berechtigung_kurzbz)
+				REFERENCES system.tbl_berechtigung (berechtigung_kurzbz)
+				ON UPDATE CASCADE ON DELETE SET NULL;";
+
+		if (!$db->db_query($qry))
+		{
+			echo '<strong>dashboard.tbl_widget: '.$db->db_last_error().'</strong><br>';
+		}
+		else
+		{
+			echo 'dashboard.tbl_widget: Spalte berechtigung_kurzbz (FK system.tbl_berechtigung) hinzugefuegt<br>';
+		}
+	}
+}
diff --git a/system/phrasesupdate.php b/system/phrasesupdate.php
index 14be42163..77e78c230 100644
--- a/system/phrasesupdate.php
+++ b/system/phrasesupdate.php
@@ -32514,6 +32514,86 @@ array(
 			)
 		)
 	),
+	array(
+		'app' => 'anwesenheiten',
+		'category' => 'global',
+		'phrase' => 'anwKontrolle',
+		'insertvon' => 'system',
+		'phrases' => array(
+			array(
+				'sprache' => 'German',
+				'text' => 'Anwesenheitskontrolle',
+				'description' => '',
+				'insertvon' => 'system'
+			),
+			array(
+				'sprache' => 'English',
+				'text' => 'Attendance check',
+				'description' => '',
+				'insertvon' => 'system'
+			)
+		)
+	),
+	array(
+		'app' => 'anwesenheiten',
+		'category' => 'global',
+		'phrase' => 'anwKontrolleOeffnen',
+		'insertvon' => 'system',
+		'phrases' => array(
+			array(
+				'sprache' => 'German',
+				'text' => 'Anwesenheitskontrolle öffnen',
+				'description' => '',
+				'insertvon' => 'system'
+			),
+			array(
+				'sprache' => 'English',
+				'text' => 'Open attendance check',
+				'description' => '',
+				'insertvon' => 'system'
+			)
+		)
+	),
+	array(
+		'app' => 'anwesenheiten',
+		'category' => 'global',
+		'phrase' => 'anwKeinUnterricht',
+		'insertvon' => 'system',
+		'phrases' => array(
+			array(
+				'sprache' => 'German',
+				'text' => 'Kein Unterricht in diesem Zeitraum',
+				'description' => '',
+				'insertvon' => 'system'
+			),
+			array(
+				'sprache' => 'English',
+				'text' => 'No lessons in this period',
+				'description' => '',
+				'insertvon' => 'system'
+			)
+		)
+	),
+	array(
+		'app' => 'anwesenheiten',
+		'category' => 'global',
+		'phrase' => 'anwJetzt',
+		'insertvon' => 'system',
+		'phrases' => array(
+			array(
+				'sprache' => 'German',
+				'text' => 'Jetzt',
+				'description' => '',
+				'insertvon' => 'system'
+			),
+			array(
+				'sprache' => 'English',
+				'text' => 'Now',
+				'description' => '',
+				'insertvon' => 'system'
+			)
+		)
+	),
 	array(
 		'app' => 'anwesenheiten',
 		'category' => 'global',
@@ -48681,6 +48761,26 @@ array(
 			)
 		)
 	),
+	array(
+		'app' => 'core',
+		'category' => 'dashboard',
+		'phrase' => 'widget_missing_permission',
+		'insertvon' => 'system',
+		'phrases' => array(
+			array(
+				'sprache' => 'German',
+				'text' => 'Ihnen fehlt die erforderliche Berechtigung, um dieses Widget anzuzeigen.',
+				'description' => '',
+				'insertvon' => 'system'
+			),
+			array(
+				'sprache' => 'English',
+				'text' => 'You do not have the permission required to display this widget.',
+				'description' => '',
+				'insertvon' => 'system'
+			)
+		)
+	),
 // CIS4 phrases from legacy code end
 // FHC4 Phrases Abschlusspruefung
 	array(