Fehldende messages hinzugefügt

- Bump 'tmp' package version from 0.2.5 to 0.2.6 in package.json
- Change version from 3.0.0-pre-alpha.0.1 to 3.0.0-beta-1.0.0 in package-lock.json
- Update various dependencies in package-lock.json:
  - 'brace-expansion' from 5.0.5 to 5.0.6
  - 'dompurify' from 3.3.3 to 3.4.8
  - 'js-cookie' from 3.0.5 to 3.0.8
  - 'lodash' from 4.17.23 to 4.18.1
- Refactor date range selection in CalendarView.vue for better readability

.cursor/rules/legacy-cpp-workers.mdc

@@ -0,0 +1,9 @@
+---
+description: C++-Worker unter src/ sind obsolet — nicht erweitern oder als Quelle für Spiellogik nutzen
+alwaysApply: true
+---
+
+# Legacy C++ (`src/`)
+
+- Verzeichnis **`src/`** (C++-Worker, WebSocket-Server): **obsolet**. Keine neuen Features, keine fachlichen Fixes dort planen oder umsetzen, sofern der Nutzer nicht ausdrücklich etwas anderes verlangt.
+- Falukant-Hintergrundlogik: **Backend** (`backend/`), **externer Daemon**, **Frontend** — siehe `docs/LEGACY_CPP_WORKERS.md`.

.gitea/workflows/deploy.yml

@@ -0,0 +1,148 @@
+name: Deploy to production
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Detect vocab course changes
+        id: vocab_course_changes
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          BASE="${{ gitea.event.before }}"
+          HEAD="${{ gitea.sha }}"
+
+          if [ -z "$BASE" ] || [[ "$BASE" =~ ^0+$ ]] || ! git cat-file -e "$BASE^{commit}" 2>/dev/null; then
+            BASE="HEAD~1"
+          fi
+
+          git diff --name-only "$BASE" "$HEAD" > changed-files.txt
+          cat changed-files.txt
+          COMMIT_MESSAGE="$(git log -1 --pretty=%B "$HEAD" || true)"
+          COURSE_SCRIPT_PATTERN='^backend/scripts/.*(bisaya|course|didactics|vocab)'
+
+          if echo "$COMMIT_MESSAGE" | grep -qi '\[force-deploy\]'; then
+            echo "force_deploy=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "force_deploy=false" >> "$GITHUB_OUTPUT"
+          fi
+
+          if grep -E '^(backend/scripts/.*(bisaya|course|didactics|vocab)|backend/sql/.*vocab|backend/(migrations-active|migrations-archive)/.*vocab|docs/.*(COURSE|VOCAB|BISAYA|GERMAN_FOR_BISAYA))' changed-files.txt; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+          if grep -E "$COURSE_SCRIPT_PATTERN" changed-files.txt >/dev/null; then
+            echo "course_scripts_changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "course_scripts_changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+          if grep -E '^frontend/' changed-files.txt >/dev/null; then
+            echo "frontend_changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "frontend_changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+          # Kurs-/Didaktik-Scripts werden vor dem Sync separat uebertragen.
+          # Fuer sie sind npm ci, Migrationen und ein Backend-Restart nicht noetig.
+          if grep -E '^backend/' changed-files.txt \
+            | grep -Ev "$COURSE_SCRIPT_PATTERN" >/dev/null; then
+            echo "backend_app_changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "backend_app_changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+          # App-Code-Änderungen, die einen echten Deploy benötigen
+          if grep -E '^(frontend/|backend/)' changed-files.txt \
+            | grep -Ev "$COURSE_SCRIPT_PATTERN" >/dev/null; then
+            echo "app_changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "app_changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Prepare SSH
+        run: |
+          mkdir -p ~/.ssh
+          printf "%s" "${{ secrets.PROD_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -p "${{ secrets.PROD_PORT }}" "${{ secrets.PROD_HOST }}" >> ~/.ssh/known_hosts
+
+      - name: Test SSH connection
+        run: |
+          ssh -i ~/.ssh/id_ed25519 \
+            -o StrictHostKeyChecking=no \
+            -o BatchMode=yes \
+            -p "${{ secrets.PROD_PORT }}" \
+            "${{ secrets.PROD_USER }}@${{ secrets.PROD_HOST }}" \
+            "echo SSH OK"
+
+      - name: Deploy vocab course scripts without app rebuild
+        if: steps.vocab_course_changes.outputs.course_scripts_changed == 'true' && steps.vocab_course_changes.outputs.backend_app_changed != 'true' && steps.vocab_course_changes.outputs.force_deploy != 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          tar -czf - backend/scripts \
+            | ssh -i ~/.ssh/id_ed25519 \
+              -p "${{ secrets.PROD_PORT }}" \
+              "${{ secrets.PROD_USER }}@${{ secrets.PROD_HOST }}" \
+              "sudo -n -u yourpart tar -xzf - -C /opt/yourpart"
+
+      - name: Run deployment script
+        if: steps.vocab_course_changes.outputs.app_changed == 'true' || steps.vocab_course_changes.outputs.force_deploy == 'true'
+        run: |
+          DEPLOY_FLAGS=""
+          if [ "${{ steps.vocab_course_changes.outputs.force_deploy }}" = "true" ]; then
+            DEPLOY_FLAGS=""
+          elif [ "${{ steps.vocab_course_changes.outputs.backend_app_changed }}" = "true" ] && [ "${{ steps.vocab_course_changes.outputs.frontend_changed }}" != "true" ]; then
+            DEPLOY_FLAGS="--skip-frontend"
+          elif [ "${{ steps.vocab_course_changes.outputs.frontend_changed }}" = "true" ] && [ "${{ steps.vocab_course_changes.outputs.backend_app_changed }}" != "true" ]; then
+            DEPLOY_FLAGS="--skip-backend"
+          fi
+
+          DEPLOY_TARGET="${{ secrets.PROD_DEPLOY_TARGET }}"
+          if [ -z "$DEPLOY_TARGET" ]; then
+            DEPLOY_TARGET="/opt/yourpart-green"
+          fi
+
+          echo "Deploy-Flags: ${DEPLOY_FLAGS:-<none>}"
+          echo "Deploy-Target: $DEPLOY_TARGET"
+
+          ssh -i ~/.ssh/id_ed25519 \
+            -p "${{ secrets.PROD_PORT }}" \
+            "${{ secrets.PROD_USER }}@${{ secrets.PROD_HOST }}" \
+            "/home/tsschulz/deploy-yourpart-bluegreen.sh ${DEPLOY_TARGET} ${DEPLOY_FLAGS}"
+
+      - name: Skip full deployment (no app changes)
+        if: steps.vocab_course_changes.outputs.app_changed != 'true' && steps.vocab_course_changes.outputs.force_deploy != 'true'
+        run: |
+          echo "Kein Full-Deploy: Es wurden keine Frontend/Backend-App-Dateien geändert."
+
+      - name: Sync vocab course content
+        if: steps.vocab_course_changes.outputs.changed == 'true' || steps.vocab_course_changes.outputs.force_deploy == 'true'
+        run: |
+          # Decide whether to actually run the phase3 update on the server.
+          # By default we run the deploy script in --dry-run mode. To enable the
+          # actual run set the secret PHASE3_UPDATE=1 in the repo settings.
+          RUN_FLAG="--dry-run"
+          if [ "${{ secrets.PHASE3_UPDATE }}" = "1" ]; then
+            RUN_FLAG=""
+          fi
+
+          ssh -i ~/.ssh/id_ed25519 \
+            -p "${{ secrets.PROD_PORT }}" \
+            "${{ secrets.PROD_USER }}@${{ secrets.PROD_HOST }}" \
+            "cd /opt/yourpart && npm --prefix backend run sync:vocab-courses && if [ -x backend/scripts/deploy-phase3-update.sh ]; then bash backend/scripts/deploy-phase3-update.sh $RUN_FLAG; else echo 'deploy-phase3-update.sh not found or not executable'; fi"

.gitignore

@@ -5,7 +5,7 @@
 .depbe.sh
 node_modules
 node_modules/*
-**/package-lock.json
+# package-lock.json wird versioniert (npm ci im Deploy braucht konsistente Locks zu package.json)
 backend/.env
 backend/.env.local
 backend/images
@@ -17,6 +17,9 @@ frontend/node_modules
 frontend/node_modules/*
 frontend/dist
 frontend/dist/*
+frontend/scripts/.i18n-de-fr-cache.json
+frontend/scripts/.falukant-fr-smooth-cache.json
+frontend/ceb-locale-audit-report.json
 frontedtree.txt
 backend/dist/
 backend/data/model-cache

OAUTH_CREDENTIALS_SETUP.md

@@ -0,0 +1,259 @@
+# OAuth Credentials Setup Guide
+
+Anleitung zum Sammeln der OAuth-Credentials für alle 5 Provider.
+
+## Redirect URIs
+Für alle Provider benötigst du folgende Redirect URIs (ersetze `www.your-part.de` mit deiner echten Domain):
+
+```
+https://www.your-part.de/auth/oauth/callback
+https://www.your-part.de/auth/oauth/user/callback
+```
+
+Lokal zum Testen:
+```
+http://localhost:3000/auth/oauth/callback
+http://localhost:3000/auth/oauth/user/callback
+```
+
+---
+
+## 1. Google
+
+### Credentials besorgen:
+
+1. Öffne [Google Cloud Console](https://console.cloud.google.com/)
+2. Erstelle ein neues Projekt oder wähle ein bestehendes
+3. Navigiere zu **APIs & Services** → **Credentials**
+4. Klick **+ CREATE CREDENTIALS** → **OAuth 2.0 Client IDs**
+5. Wähle **Web application**
+6. Füge unter **Authorized redirect URIs** hinzu:
+   - `https://www.your-part.de/auth/oauth/callback`
+   - `https://www.your-part.de/auth/oauth/user/callback`
+7. Speichern und die **Client ID** und **Client Secret** kopieren
+
+### .env:
+```env
+OAUTH_GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
+OAUTH_GOOGLE_CLIENT_SECRET=your-client-secret
+```
+
+---
+
+## 2. Microsoft Azure
+
+### Credentials besorgen:
+
+1. Öffne [Azure Portal](https://portal.azure.com/)
+2. Navigiere zu **Azure Active Directory** → **App registrations** → **+ New registration**
+3. Gib einen Namen ein (z.B. "YourPart OAuth")
+4. Wähle **Accounts in any organizational directory (Any Azure AD directory - Multitenant)**
+5. Bei **Redirect URI** wähle **Web** und füge ein:
+   - `https://www.your-part.de/auth/oauth/callback`
+6. Klick **Register**
+7. Notiere die **Application (client) ID**
+8. Gehe zu **Certificates & secrets** → **+ New client secret**
+9. Erstelle ein Secret und kopiere den **Value** (nicht die ID!)
+10. Gehe zu **Token configuration** und stelle sicher, dass die richtigen Claims enthalten sind
+
+### Zusätzliche URI hinzufügen:
+1. Gehe zu **Authentication**
+2. Unter **Redirect URIs** klick **+ Add URI**
+3. Füge hinzu: `https://www.your-part.de/auth/oauth/user/callback`
+
+### .env:
+```env
+OAUTH_MICROSOFT_CLIENT_ID=your-application-id
+OAUTH_MICROSOFT_CLIENT_SECRET=your-client-secret-value
+```
+
+---
+
+## 3. Keycloak
+
+Keycloak ist ein Open-Source OIDC Provider. Du kannst ihn selbst hosten oder eine gehostete Lösung nutzen.
+
+### Option A: Selbst gehostet mit Docker
+
+```bash
+docker run -d \
+  -p 8080:8080 \
+  -e KEYCLOAK_ADMIN=admin \
+  -e KEYCLOAK_ADMIN_PASSWORD=admin \
+  quay.io/keycloak/keycloak:latest \
+  start-dev
+```
+
+Dann:
+1. Öffne http://localhost:8080
+2. Login mit `admin` / `admin`
+3. **Realm erstellen**: Oben links Dropdown → **Create realm**
+   - Name: `yourpart` (oder beliebig)
+4. Im neuen Realm: **Clients** → **Create client**
+   - Client ID: `yourpart`
+   - Client Protocol: `openid-connect`
+   - Access Type: `confidential`
+5. Im **Settings** Tab:
+   - Valid Redirect URIs:
+     ```
+     https://www.your-part.de/auth/oauth/callback
+     https://www.your-part.de/auth/oauth/user/callback
+     ```
+6. Speichern
+7. Gehe zu **Credentials** Tab
+   - **Client Secret** kopieren
+
+### Option B: Gehosteter Service
+- [Keycloak.cloud](https://www.keycloak.cloud/) oder
+- [Red Hat Managed Keycloak](https://www.keycloak.org/cloud/)
+
+### .env:
+```env
+OAUTH_KEYCLOAK_ISSUER=https://your-keycloak-domain/realms/yourpart
+OAUTH_KEYCLOAK_CLIENT_ID=yourpart
+OAUTH_KEYCLOAK_CLIENT_SECRET=your-client-secret
+```
+
+---
+
+## 4. ORY Hydra / ORY Cloud
+
+ORY ist ein moderner OIDC Provider. Am einfachsten ist ORY Cloud.
+
+### Option A: ORY Cloud (empfohlen)
+
+1. Öffne [ORY Cloud Console](https://console.ory.sh/)
+2. Registriere dich oder logge dich ein
+3. Erstelle ein neues **Project**
+4. Gehe zu **Applications**
+5. Klick **Create New Application**
+6. Gib einen Namen ein (z.B. "YourPart")
+7. Unter **Redirect URLs** füge ein:
+   ```
+   https://www.your-part.de/auth/oauth/callback
+   https://www.your-part.de/auth/oauth/user/callback
+   ```
+8. Speichern
+9. Die **Client ID** und **Client Secret** werden angezeigt
+10. Finde deine **Issuer URL** in den Project Settings (meist `https://your-project-slug.eu.hydra.cloud`)
+
+### Option B: Selbst gehostet (komplex)
+
+Siehe [ORY Hydra Dokumentation](https://www.ory.sh/hydra/docs/)
+
+### .env:
+```env
+OAUTH_ORY_ISSUER=https://your-project-slug.eu.hydra.cloud
+OAUTH_ORY_CLIENT_ID=your-client-id
+OAUTH_ORY_CLIENT_SECRET=your-client-secret
+```
+
+---
+
+## 5. ZITADEL
+
+ZITADEL ist ein Zero-Trust Identity Platform als SaaS.
+
+### Credentials besorgen:
+
+1. Öffne [ZITADEL Console](https://zitadel.cloud/)
+2. Registriere dich oder logge dich ein
+3. Erstelle eine neue **Organization** (oder verwende die existierende)
+4. Gehe zu **Projects** → **+ New Project**
+5. Gib einen Namen ein (z.B. "YourPart")
+6. Gehe zum Projekt → **Applications** → **+ New Application**
+7. Wähle **Type: Web**
+8. Gib einen Namen ein
+9. Bei **Redirect URIs** füge ein:
+   ```
+   https://www.your-part.de/auth/oauth/callback
+   https://www.your-part.de/auth/oauth/user/callback
+   ```
+10. Speichern
+11. Unter **Client Information** kopiere:
+    - **Client ID**
+    - **Client Secret** (falls sichtbar, sonst im "CREDENTIALS" Tab generieren)
+12. Finde deine **Issuer URL** in den Organization Settings (meist `https://your-instance.zitadel.cloud`)
+
+### .env:
+```env
+OAUTH_ZITADEL_ISSUER=https://your-instance.zitadel.cloud
+OAUTH_ZITADEL_CLIENT_ID=your-client-id
+OAUTH_ZITADEL_CLIENT_SECRET=your-client-secret
+```
+
+---
+
+## Komplette .env für alle 5 Provider
+
+```env
+# Google
+OAUTH_GOOGLE_CLIENT_ID=...
+OAUTH_GOOGLE_CLIENT_SECRET=...
+
+# Microsoft
+OAUTH_MICROSOFT_CLIENT_ID=...
+OAUTH_MICROSOFT_CLIENT_SECRET=...
+
+# Keycloak
+OAUTH_KEYCLOAK_ISSUER=...
+OAUTH_KEYCLOAK_CLIENT_ID=...
+OAUTH_KEYCLOAK_CLIENT_SECRET=...
+
+# ORY
+OAUTH_ORY_ISSUER=...
+OAUTH_ORY_CLIENT_ID=...
+OAUTH_ORY_CLIENT_SECRET=...
+
+# ZITADEL
+OAUTH_ZITADEL_ISSUER=...
+OAUTH_ZITADEL_CLIENT_ID=...
+OAUTH_ZITADEL_CLIENT_SECRET=...
+```
+
+---
+
+## Schnell-Checkliste
+
+- [ ] Google: Client ID & Secret
+- [ ] Microsoft: Application ID & Client Secret
+- [ ] Keycloak: Issuer, Client ID, Secret
+- [ ] ORY: Issuer, Client ID, Secret
+- [ ] ZITADEL: Issuer, Client ID, Secret
+- [ ] Alle Redirect URIs in den Providern konfiguriert
+- [ ] .env datei aktualisiert
+- [ ] Server neu gestartet (`npm restart`)
+
+---
+
+## Testing
+
+Nach der Konfiguration:
+
+1. Frontend öffnen: http://www.your-part.de
+2. Auf "Login" oder Provider-Button klicken
+3. Jeder verfügbare Provider sollte als Button angezeigt werden
+4. Test: Mit jedem Provider einloggen
+5. Test: Existender Nutzer → Einstellungen → Authentifizierung hinzufügen
+
+---
+
+## Troubleshooting
+
+### "Invalid redirect URI"
+- Stelle sicher, dass die Redirect URIs **exakt** übereinstimmen (inkl. `https://` vs `http://`)
+- Beachte Trailing Slashes
+
+### "Invalid client secret"
+- Kopiere das Secret neu (nicht die ID)
+- Manche Provider verstecken das Secret nach einmaliger Anzeige
+
+### "Discovery endpoint not found"
+- Überprüfe die Issuer URL (mit/ohne Trailing Slash)
+- Für Keycloak: URL muss auf `/realms/xxx` enden
+- Für ORY: URL darf nicht auf `/` enden
+
+### Port-Konflikt lokal
+- Keycloak benutzt `8080` → ändere auf: `docker run -p 8081:8080 ...`
+- Stelle sicher, dass 3000 (Frontend) und 5000 (Backend) frei sind
+

README.md

@@ -0,0 +1,3 @@
+## zum testen des push
+
+Hinweis: Das Verzeichnis **`src/`** (C++-Worker) ist veraltet; siehe [`docs/LEGACY_CPP_WORKERS.md`](docs/LEGACY_CPP_WORKERS.md).

backend/README_TAX.md

@@ -3,7 +3,7 @@
 This project now supports a per-region sales tax (`tax_percent`) for Falukant.
 
 Migration
-- A SQL migration was added: `backend/migrations/20260101000000-add-tax-percent-to-region.cjs`.
+- A SQL migration was added: `backend/migrations-archive/20260101000000-add-tax-percent-to-region.cjs`.
 - It adds `tax_percent` numeric NOT NULL DEFAULT 7 to `falukant_data.region`.
 
 Runtime configuration

backend/app.js

@@ -23,6 +23,7 @@ import vocabRouter from './routers/vocabRouter.js';
 import dashboardRouter from './routers/dashboardRouter.js';
 import newsRouter from './routers/newsRouter.js';
 import calendarRouter from './routers/calendarRouter.js';
+import moderationRouter from './routers/moderationRouter.js';
 import cors from 'cors';
 import './jobs/sessionCleanup.js';
 
@@ -83,7 +84,12 @@ const corsOptions = {
 };
 
 app.use(cors(corsOptions));
-app.options('*', cors(corsOptions));
+app.use((req, res, next) => {
+  if (req.method === 'OPTIONS') {
+    return cors(corsOptions)(req, res, next);
+  }
+  return next();
+});
 app.use(express.json()); // To handle JSON request bodies
 
 app.use('/api/chat', chatRouter);
@@ -100,6 +106,7 @@ app.use('/api/contact', contactRouter);
 app.use('/api/socialnetwork', socialnetworkRouter);
 app.use('/api/vocab', vocabRouter);
 app.use('/api/forum', forumRouter);
+app.use('/api/moderation', moderationRouter);
 app.use('/api/falukant', falukantRouter);
 app.use('/api/friendships', friendshipRouter);
 app.use('/api/models', modelsProxyRouter);
@@ -124,6 +131,11 @@ app.get(/^\/(?!api\/).*/, (req, res) => {
 });
 
 // Fallback 404 for unknown API routes
-app.use('/api/*', (req, res) => res.status(404).send('404 Not Found'));
+app.use((req, res, next) => {
+  if (req.path.startsWith('/api/')) {
+    return res.status(404).send('404 Not Found');
+  }
+  return next();
+});
 
 export default app;

backend/config/sequelize-cli.cjs

@@ -0,0 +1,33 @@
+const path = require('path');
+const dotenv = require('dotenv');
+
+const envPath = process.env.SEQUELIZE_ENV_FILE
+  ? path.resolve(process.cwd(), process.env.SEQUELIZE_ENV_FILE)
+  : path.resolve(process.cwd(), '.env');
+
+dotenv.config({ path: envPath });
+
+const dialectOptions = {};
+if (process.env.DB_SSL === '1' || process.env.PGSSLMODE === 'require') {
+  dialectOptions.ssl = process.env.DB_SSL_REJECT_UNAUTHORIZED === '0'
+    ? { rejectUnauthorized: false }
+    : true;
+}
+
+// pg/SCRAM: password muss ein String sein; bei fehlender .env sonst undefined-Fallen vermeiden
+const shared = {
+  username: process.env.DB_USER != null ? String(process.env.DB_USER) : undefined,
+  password: process.env.DB_PASS != null ? String(process.env.DB_PASS) : '',
+  database: process.env.DB_NAME != null ? String(process.env.DB_NAME) : undefined,
+  host: process.env.DB_HOST || '127.0.0.1',
+  port: Number.parseInt(process.env.DB_PORT || '5432', 10),
+  dialect: 'postgres',
+  logging: false,
+  dialectOptions
+};
+
+module.exports = {
+  development: shared,
+  test: shared,
+  production: shared
+};

backend/controllers/adminController.js

@@ -13,6 +13,11 @@ class AdminController {
         this.searchUser = this.searchUser.bind(this);
         this.getFalukantUserById = this.getFalukantUserById.bind(this);
         this.changeFalukantUser = this.changeFalukantUser.bind(this);
+        this.adminForceFalukantPregnancy = this.adminForceFalukantPregnancy.bind(this);
+        this.adminClearFalukantPregnancy = this.adminClearFalukantPregnancy.bind(this);
+        this.adminForceFalukantBirth = this.adminForceFalukantBirth.bind(this);
+        this.adminCleanupCharacterDeathArtifacts = this.adminCleanupCharacterDeathArtifacts.bind(this);
+        this.adminGetPotentialFathersForCharacter = this.adminGetPotentialFathersForCharacter.bind(this);
         this.getFalukantUserBranches = this.getFalukantUserBranches.bind(this);
         this.updateFalukantStock = this.updateFalukantStock.bind(this);
         this.addFalukantStock = this.addFalukantStock.bind(this);
@@ -29,6 +34,10 @@ class AdminController {
         this.getUser = this.getUser.bind(this);
         this.getUsers = this.getUsers.bind(this);
         this.updateUser = this.updateUser.bind(this);
+        this.resetUserVocabLessonProgress = this.resetUserVocabLessonProgress.bind(this);
+        this.markUserVocabLessonsCompleteThrough = this.markUserVocabLessonsCompleteThrough.bind(this);
+        this.getUserVocabCourses = this.getUserVocabCourses.bind(this);
+        this.getVocabCourseForAdmin = this.getVocabCourseForAdmin.bind(this);
         this.getAdultVerificationRequests = this.getAdultVerificationRequests.bind(this);
         this.setAdultVerificationStatus = this.setAdultVerificationStatus.bind(this);
         this.getAdultVerificationDocument = this.getAdultVerificationDocument.bind(this);
@@ -45,6 +54,9 @@ class AdminController {
         // Statistics
         this.getUserStatistics = this.getUserStatistics.bind(this);
         this.getFalukantRegions = this.getFalukantRegions.bind(this);
+        this.getFalukantAllRegions = this.getFalukantAllRegions.bind(this);
+        this.getFalukantRegionTypes = this.getFalukantRegionTypes.bind(this);
+        this.createFalukantRegion = this.createFalukantRegion.bind(this);
         this.updateFalukantRegionMap = this.updateFalukantRegionMap.bind(this);
         this.getRegionDistances = this.getRegionDistances.bind(this);
         this.upsertRegionDistance = this.upsertRegionDistance.bind(this);
@@ -125,6 +137,77 @@ class AdminController {
         }
     }
 
+    async resetUserVocabLessonProgress(req, res) {
+        const schema = Joi.object({
+            lessonId: Joi.number().integer().positive().required()
+        });
+        const { error, value } = schema.validate(req.body || {});
+        if (error) {
+            return res.status(400).json({ error: error.details[0].message });
+        }
+        try {
+            const { userid: requester } = req.headers;
+            const { id } = req.params;
+            const result = await AdminService.adminResetUserVocabLessonProgress(requester, id, value.lessonId);
+            res.status(200).json(result);
+        } catch (err) {
+            const status = err.message === 'noaccess' ? 403 : (err.message === 'lessonnotfound' ? 404 : 500);
+            res.status(status).json({ error: err.message });
+        }
+    }
+
+    async markUserVocabLessonsCompleteThrough(req, res) {
+        const schema = Joi.object({
+            courseId: Joi.number().integer().positive().required(),
+            throughLessonNumber: Joi.number().integer().positive().required()
+        });
+        const { error, value } = schema.validate(req.body || {});
+        if (error) {
+            return res.status(400).json({ error: error.details[0].message });
+        }
+        try {
+            const { userid: requester } = req.headers;
+            const { id } = req.params;
+            const result = await AdminService.adminMarkUserVocabLessonsCompleteThrough(
+                requester,
+                id,
+                value.courseId,
+                value.throughLessonNumber
+            );
+            res.status(200).json(result);
+        } catch (err) {
+            let status = 500;
+            if (err.message === 'noaccess') status = 403;
+            else if (err.message === 'notenrolled') status = 403;
+            else if (err.message === 'badrequest') status = 400;
+            res.status(status).json({ error: err.message });
+        }
+    }
+
+    async getUserVocabCourses(req, res) {
+        try {
+            const { userid: requester } = req.headers;
+            const { id } = req.params;
+            const result = await AdminService.adminListUserEnrolledVocabCourses(requester, id);
+            res.status(200).json(result);
+        } catch (err) {
+            const status = err.message === 'noaccess' ? 403 : (err.message === 'notfound' ? 404 : 500);
+            res.status(status).json({ error: err.message });
+        }
+    }
+
+    async getVocabCourseForAdmin(req, res) {
+        try {
+            const { userid: requester } = req.headers;
+            const { courseId } = req.params;
+            const result = await AdminService.adminGetVocabCourseWithLessons(requester, courseId);
+            res.status(200).json(result);
+        } catch (err) {
+            const status = err.message === 'noaccess' ? 403 : (err.message === 'coursenotfound' ? 404 : 500);
+            res.status(status).json({ error: err.message });
+        }
+    }
+
     async getAdultVerificationRequests(req, res) {
         try {
             const { userid: requester } = req.headers;
@@ -372,6 +455,77 @@ class AdminController {
         }
     }
 
+    async adminForceFalukantPregnancy(req, res) {
+        try {
+            const { userid: userId } = req.headers;
+            const { characterId, fatherCharacterId, dueInDays } = req.body;
+            const response = await AdminService.adminForceFalukantPregnancy(userId, characterId, {
+                fatherCharacterId,
+                dueInDays,
+            });
+            res.status(200).json(response);
+        } catch (error) {
+            console.log(error);
+            res.status(400).json({ error: error.message });
+        }
+    }
+
+    async adminGetPotentialFathersForCharacter(req, res) {
+        try {
+            const { userid: userId } = req.headers;
+            const { characterId } = req.params;
+            const response = await AdminService.adminGetPotentialFathersForCharacter(userId, characterId);
+            res.status(200).json(response);
+        } catch (error) {
+            console.log(error);
+            res.status(400).json({ error: error.message });
+        }
+    }
+
+    async adminClearFalukantPregnancy(req, res) {
+        try {
+            const { userid: userId } = req.headers;
+            const { characterId } = req.body;
+            const response = await AdminService.adminClearFalukantPregnancy(userId, characterId);
+            res.status(200).json(response);
+        } catch (error) {
+            console.log(error);
+            res.status(400).json({ error: error.message });
+        }
+    }
+
+    async adminForceFalukantBirth(req, res) {
+        try {
+            const { userid: userId } = req.headers;
+            const { motherCharacterId, fatherCharacterId, birthContext, legitimacy, gender } = req.body;
+            const response = await AdminService.adminForceFalukantBirth(userId, motherCharacterId, {
+                fatherCharacterId,
+                birthContext,
+                legitimacy,
+                gender,
+            });
+            res.status(200).json(response);
+        } catch (error) {
+            console.log(error);
+            res.status(400).json({ error: error.message });
+        }
+    }
+
+    async adminCleanupCharacterDeathArtifacts(req, res) {
+        try {
+            const { userid: userId } = req.headers;
+            const { characterId } = req.params;
+            const response = await AdminService.adminCleanupCharacterDeathArtifacts(userId, characterId);
+            res.status(200).json(response);
+        } catch (error) {
+            console.log(error);
+            const status = error.message === 'noaccess'
+                ? 403
+                : (['invalidCharacter', 'notfound', 'targetnotdead'].includes(error.message) ? 400 : 500);
+            res.status(status).json({ error: error.message });
+        }
+    }
+
     async getFalukantUserBranches(req, res) {
         try {
             const { userid: userId } = req.headers;
@@ -432,6 +586,42 @@ class AdminController {
         }
     }
 
+    async getFalukantAllRegions(req, res) {
+        try {
+            const { userid: userId } = req.headers;
+            const regions = await AdminService.getFalukantAllRegions(userId);
+            res.status(200).json(regions);
+        } catch (error) {
+            console.log(error);
+            const status = error.message === 'noaccess' ? 403 : 500;
+            res.status(status).json({ error: error.message });
+        }
+    }
+
+    async getFalukantRegionTypes(req, res) {
+        try {
+            const { userid: userId } = req.headers;
+            const types = await AdminService.getFalukantRegionTypes(userId);
+            res.status(200).json(types);
+        } catch (error) {
+            console.log(error);
+            const status = error.message === 'noaccess' ? 403 : 500;
+            res.status(status).json({ error: error.message });
+        }
+    }
+
+    async createFalukantRegion(req, res) {
+        try {
+            const { userid: userId } = req.headers;
+            const created = await AdminService.createFalukantRegion(userId, req.body || {});
+            res.status(200).json(created);
+        } catch (error) {
+            console.log(error);
+            const status = error.message === 'noaccess' ? 403 : 400;
+            res.status(status).json({ error: error.message });
+        }
+    }
+
     async updateFalukantRegionMap(req, res) {
         try {
             const { userid: userId } = req.headers;

backend/controllers/authController.js

@@ -1,4 +1,5 @@
 import * as userService from '../services/authService.js';
+import * as oauthService from '../services/oauthService.js';
 
 class AuthController {
     constructor() {
@@ -7,6 +8,13 @@ class AuthController {
         this.forgotPassword = this.forgotPassword.bind(this);
         this.activateAccount = this.activateAccount.bind(this);
         this.logout = this.logout.bind(this);
+        this.oauthProviders = this.oauthProviders.bind(this);
+        this.oauthStart = this.oauthStart.bind(this);
+        this.oauthExchange = this.oauthExchange.bind(this);
+        this.oauthUserIdentities = this.oauthUserIdentities.bind(this);
+        this.oauthUserStart = this.oauthUserStart.bind(this);
+        this.oauthUserExchange = this.oauthUserExchange.bind(this);
+        this.oauthUserRemove = this.oauthUserRemove.bind(this);
     }
 
     async register(req, res) {
@@ -29,6 +37,8 @@ class AuthController {
         } catch (error) {
             if (error.message === 'credentialsinvalid') {
                 res.status(404).json({ error: error.message });
+            } else if (error.message === 'userblocked') {
+                res.status(403).json({ error: error.message });
             } else {
                 res.status(500).json({ error: error.message });
             }
@@ -41,6 +51,134 @@ class AuthController {
         res.status(200).json({ result: 'loggedout' });
     }
 
+    async oauthProviders(req, res) {
+        try {
+            const providers = await oauthService.getOAuthProviders();
+            res.status(200).json({ providers });
+        } catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    }
+
+    async oauthStart(req, res) {
+        const { provider } = req.params;
+        try {
+            const redirectTo = await oauthService.startOAuthLogin({ providerSlug: provider });
+            res.redirect(302, redirectTo.toString());
+        } catch (error) {
+            const status = error.message === 'providernotconfigured' ? 503 : 500;
+            res.status(status).json({ error: error.message });
+        }
+    }
+
+    async oauthExchange(req, res) {
+        const { code, state, iss } = req.body;
+        try {
+            const result = await oauthService.exchangeOAuthLogin({ code, state, iss });
+            res.status(200).json(result);
+        } catch (error) {
+            const knownErrors = new Set([
+                'oauthcodemissing',
+                'oauthstatemissing',
+                'oauthsubjectmissing',
+                'providernotconfigured',
+                'oauthidentityconflict'
+            ]);
+            const status = knownErrors.has(error.message) ? 400 : 500;
+            res.status(status).json({ error: error.message });
+        }
+    }
+
+    async oauthUserIdentities(req, res) {
+        const { userid: hashedUserId } = req.headers;
+        try {
+            const User = (await import('../models/community/user.js')).default;
+            const user = await User.findOne({ where: { hashedId: hashedUserId } });
+            if (!user) {
+                return res.status(404).json({ error: 'usernotfound' });
+            }
+
+            const identities = await oauthService.getUserOAuthIdentities(user.id);
+            res.status(200).json({ identities });
+        } catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    }
+
+    async oauthUserStart(req, res) {
+        const hashedUserId = req.headers.userid || req.query.userid;
+        const { provider } = req.params;
+        try {
+            const User = (await import('../models/community/user.js')).default;
+            const user = await User.findOne({ where: { hashedId: hashedUserId } });
+            if (!user) {
+                return res.status(404).json({ error: 'usernotfound' });
+            }
+
+            const redirectTo = await oauthService.startOAuthLoginForUser({
+                userId: user.id,
+                providerSlug: provider
+            });
+            res.redirect(302, redirectTo.toString());
+        } catch (error) {
+            const status = error.message === 'providernotconfigured' ? 503 : 500;
+            res.status(status).json({ error: error.message });
+        }
+    }
+
+    async oauthUserExchange(req, res) {
+        const hashedUserId = req.headers.userid || req.query.userid;
+        const { code, state, iss } = req.body;
+        try {
+            const User = (await import('../models/community/user.js')).default;
+            const user = await User.findOne({ where: { hashedId: hashedUserId } });
+            if (!user) {
+                return res.status(404).json({ error: 'usernotfound' });
+            }
+
+            const result = await oauthService.exchangeOAuthLoginForUser({
+                userId: user.id,
+                code,
+                state,
+                iss
+            });
+            res.status(200).json(result);
+        } catch (error) {
+            const knownErrors = new Set([
+                'oauthcodemissing',
+                'oauthstatemissing',
+                'oauthsubjectmissing',
+                'providernotconfigured',
+                'oauthuseridmismatch',
+                'oauthidentityalreadylinked'
+            ]);
+            const status = knownErrors.has(error.message) ? 400 : 500;
+            res.status(status).json({ error: error.message });
+        }
+    }
+
+    async oauthUserRemove(req, res) {
+        const { userid: hashedUserId } = req.headers;
+        const { identityId } = req.params;
+        try {
+            const User = (await import('../models/community/user.js')).default;
+            const user = await User.findOne({ where: { hashedId: hashedUserId } });
+            if (!user) {
+                return res.status(404).json({ error: 'usernotfound' });
+            }
+
+            const result = await oauthService.removeOAuthIdentity({
+                userId: user.id,
+                identityId: parseInt(identityId, 10)
+            });
+            res.status(200).json(result);
+        } catch (error) {
+            const status = error.message === 'forbidden' ? 403 : 500;
+            res.status(status).json({ error: error.message });
+        }
+    }
+
+
     async forgotPassword(req, res) {
         const { email } = req.body;
         try {

backend/controllers/chatController.js

@@ -16,6 +16,7 @@ class ChatController {
     this.getRoomCreateOptions = this.getRoomCreateOptions.bind(this);
     this.getOwnRooms = this.getOwnRooms.bind(this);
     this.deleteOwnRoom = this.deleteOwnRoom.bind(this);
+    this.reportChatIncident = this.reportChatIncident.bind(this);
   }
 
   async getMessages(req, res) {
@@ -215,6 +216,32 @@ class ChatController {
       res.status(status).json({ error: error.message });
     }
   }
+
+  async reportChatIncident(req, res) {
+    const schema = Joi.object({
+      context: Joi.string().valid('random_chat', 'multi_chat', 'one_to_one').required(),
+      reporterHashedId: Joi.string().allow('', null),
+      reporterRandomId: Joi.string().allow('', null),
+      reporterUsername: Joi.string().allow('', null),
+      offenderHashedId: Joi.string().allow('', null),
+      offenderRandomId: Joi.string().allow('', null),
+      offenderUsername: Joi.string().allow('', null),
+      incidentAt: Joi.date().iso().required(),
+      chatHistory: Joi.array().min(1).required(),
+      metadata: Joi.object().unknown(true).optional()
+    });
+    const { error, value } = schema.validate(req.body || {});
+    if (error) {
+      return res.status(400).json({ error: error.details[0].message });
+    }
+    try {
+      const result = await chatService.reportChatIncident(value);
+      return res.status(201).json(result);
+    } catch (err) {
+      console.error('Error in reportChatIncident:', err);
+      return res.status(400).json({ error: err.message });
+    }
+  }
 }
 
 export default ChatController;

backend/controllers/falukantController.js

@@ -1,4 +1,5 @@
 import FalukantService from '../services/falukantService.js';
+import politicalPowersService from '../services/falukantPoliticalPowersService.js';
 
 function extractHashedUserId(req) {
     return req.headers?.userid;
@@ -118,6 +119,8 @@ class FalukantController {
         });
         this.setLoverMaintenance = this._wrapWithUser((userId, req) =>
             this.service.setLoverMaintenance(userId, req.params.relationshipId, req.body?.maintenanceLevel), { blockInDebtorsPrison: true });
+        this.improveLoverAffection = this._wrapWithUser((userId, req) =>
+            this.service.improveLoverAffection(userId, req.params.relationshipId), { blockInDebtorsPrison: true });
         this.createLoverRelationship = this._wrapWithUser((userId, req) =>
             this.service.createLoverRelationship(userId, req.body?.targetCharacterId, req.body?.loverRole), { successStatus: 201, blockInDebtorsPrison: true });
         this.spendTimeWithSpouse = this._wrapWithUser((userId) =>
@@ -207,11 +210,29 @@ class FalukantController {
         }, { blockInDebtorsPrison: true });
 
         this.getPoliticsOverview = this._wrapWithUser((userId) => this.service.getPoliticsOverview(userId));
+        this.getPoliticalOfficeCatalog = this._wrapWithUser((userId) => this.service.getPoliticalOfficeCatalog(userId));
         this.getOpenPolitics = this._wrapWithUser((userId) => this.service.getOpenPolitics(userId));
         this.getElections = this._wrapWithUser((userId) => this.service.getElections(userId));
         this.vote = this._wrapWithUser((userId, req) => this.service.vote(userId, req.body.votes), { blockInDebtorsPrison: true });
         this.applyForElections = this._wrapWithUser((userId, req) => this.service.applyForElections(userId, req.body.electionIds), { blockInDebtorsPrison: true });
 
+        this.getPoliticalMyPowers = this._wrapWithUser((userId) => politicalPowersService.getMyPowers(userId));
+        this.getPoliticalTaxJurisdiction = this._wrapWithUser((userId) => politicalPowersService.getTaxJurisdiction(userId));
+        this.setPoliticalRegionTax = this._wrapWithUser((userId, req) =>
+            politicalPowersService.setRegionTax(userId, parseInt(req.params.regionId, 10), req.body?.percent), { blockInDebtorsPrison: true });
+        this.getPoliticalRegionTaxHistory = this._wrapWithUser((userId, req) =>
+            politicalPowersService.getRegionTaxHistory(userId, parseInt(req.params.regionId, 10), parseInt(req.query.limit || '5', 10)));
+        this.getPoliticalAppointableOffices = this._wrapWithUser((userId) => politicalPowersService.getAppointableOffices(userId));
+        this.createPoliticalAppointment = this._wrapWithUser(
+            (userId, req) =>
+                politicalPowersService.createAppointment(userId, {
+                    targetCharacterId: req.body?.targetCharacterId,
+                    officeTypeId: req.body?.officeTypeId,
+                    regionId: req.body?.regionId
+                }),
+            { successStatus: 201, blockInDebtorsPrison: true }
+        );
+
         this.getRegions = this._wrapWithUser((userId) => this.service.getRegions(userId));
     this.getBranchTaxes = this._wrapWithUser((userId, req) => this.service.getBranchTaxes(userId, req.params.branchId));
         this.getProductPriceInRegion = this._wrapWithUser((userId, req) => {
@@ -227,7 +248,9 @@ class FalukantController {
             if (Number.isNaN(regionId)) {
                 throw new Error('regionId is required');
             }
-            return this.service.getAllProductPricesInRegion(userId, regionId);
+            const networkWorth = req.query.networkWorth === '1' || req.query.networkWorth === 'true';
+            const branchId = req.query.branchId != null ? parseInt(req.query.branchId, 10) : null;
+            return this.service.getAllProductPricesInRegion(userId, regionId, { networkWorth, branchId });
         });
         this.getProductPricesInCities = this._wrapWithUser((userId, req) => {
             const productId = parseInt(req.query.productId, 10);
@@ -242,11 +265,17 @@ class FalukantController {
             const body = req.body || {};
             const items = Array.isArray(body.items) ? body.items : [];
             const currentRegionId = body.currentRegionId != null ? parseInt(body.currentRegionId, 10) : null;
+            const includeTransportCosts = body.includeTransportCosts === true || body.includeTransportCosts === 'true';
             const valid = items.map(i => ({
                 productId: parseInt(i.productId, 10),
                 currentPrice: parseFloat(i.currentPrice)
             })).filter(i => !Number.isNaN(i.productId) && !Number.isNaN(i.currentPrice));
-            return this.service.getProductPricesInCitiesBatch(userId, valid, Number.isNaN(currentRegionId) ? null : currentRegionId);
+            return this.service.getProductPricesInCitiesBatch(
+                userId,
+                valid,
+                Number.isNaN(currentRegionId) ? null : currentRegionId,
+                { includeTransportCosts }
+            );
         });
         this.renovate = this._wrapWithUser((userId, req) => this.service.renovate(userId, req.body.element), { blockInDebtorsPrison: true });
         this.renovateAll = this._wrapWithUser((userId) => this.service.renovateAll(userId), { blockInDebtorsPrison: true });

backend/controllers/moderationController.js

@@ -0,0 +1,79 @@
+import Joi from 'joi';
+import moderationService from '../services/moderationService.js';
+
+const moderationController = {
+  async createReport(req, res) {
+    const allowedTargetTypes = [
+      'forum_message',
+      'gallery_image',
+      'guestbook_entry',
+      'one_to_one_message',
+      'diary_entry',
+      'user_profile',
+      'blog',
+      'blog_post'
+    ];
+    const schema = Joi.object({
+      targetType: Joi.string().valid(...allowedTargetTypes).required(),
+      targetId: Joi.number().integer().min(1).optional(),
+      targetRef: Joi.string().trim().max(255).allow('').optional(),
+      reason: Joi.string().trim().min(3).max(120).required(),
+      details: Joi.string().allow('').max(2000).optional()
+    }).or('targetId', 'targetRef');
+    const { error, value } = schema.validate(req.body || {});
+    if (error) {
+      return res.status(400).json({ error: error.details[0].message });
+    }
+    try {
+      const { userid: userId } = req.headers;
+      const result = await moderationService.createReport(userId, value);
+      return res.status(201).json(result);
+    } catch (err) {
+      console.error('Error in createReport:', err);
+      return res.status(400).json({ error: err.message });
+    }
+  },
+
+  async listReports(req, res) {
+    try {
+      const { userid: userId } = req.headers;
+      const result = await moderationService.listReports(userId, req.query || {});
+      return res.status(200).json(result);
+    } catch (err) {
+      console.error('Error in listReports:', err);
+      return res.status(400).json({ error: err.message });
+    }
+  },
+
+  async updateReportStatus(req, res) {
+    const schema = Joi.object({
+      status: Joi.string().valid('open', 'in_review', 'resolved', 'rejected').required(),
+      reviewerNote: Joi.string().allow('').max(2000).optional()
+    });
+    const { error, value } = schema.validate(req.body || {});
+    if (error) {
+      return res.status(400).json({ error: error.details[0].message });
+    }
+    try {
+      const { userid: userId } = req.headers;
+      const result = await moderationService.updateReportStatus(userId, req.params.reportId, value);
+      return res.status(200).json(result);
+    } catch (err) {
+      console.error('Error in updateReportStatus:', err);
+      return res.status(400).json({ error: err.message });
+    }
+  },
+
+  async getOpenReportCount(req, res) {
+    try {
+      const { userid: userId } = req.headers;
+      const result = await moderationService.getOpenReportCount(userId);
+      return res.status(200).json(result);
+    } catch (err) {
+      console.error('Error in getOpenReportCount:', err);
+      return res.status(400).json({ error: err.message });
+    }
+  }
+};
+
+export default moderationController;

backend/controllers/navigationController.js

@@ -96,9 +96,7 @@ const menuStructure = {
             },
             eroticChat: {
                 visible: ["over18"],
-                action: "openEroticChat",
-                view: "window",
-                class: "eroticChatWindow"
+                action: "openEroticChat"
             }
         }
     },
@@ -280,6 +278,10 @@ const menuStructure = {
                 visible: ["mainadmin", "forum"],
                 path: "/admin/forum"
             },
+            moderationReports: {
+                visible: ["mainadmin", "forum"],
+                path: "/admin/moderation/reports"
+            },
             chatrooms: {
                 visible: ["mainadmin", "chatrooms"],
                 path: "/admin/chatrooms"
@@ -293,7 +295,7 @@ const menuStructure = {
                 path: "/admin/interests"
             }, 
             falukant: {
-                visible: ["mainadmin", "falukant"],
+                visible: ["mainadmin", "falukant", "worker_schedule_read"],
                 children: {
                     logentries: {
                         visible: ["mainadmin", "falukant"],
@@ -315,6 +317,10 @@ const menuStructure = {
                         visible: ["mainadmin", "falukant"],
                         path: "/admin/falukant/create-npc"
                     },
+                    workerSchedules: {
+                        visible: ["mainadmin", "worker_schedule_read"],
+                        path: "/admin/falukant/worker-schedules"
+                    },
                 }
             },
             minigames: {

backend/controllers/socialnetworkController.js

@@ -16,13 +16,16 @@ class SocialNetworkController {
         this.getFoldersByUsername = this.getFoldersByUsername.bind(this);
         this.deleteFolder = this.deleteFolder.bind(this);
         this.getAdultFolders = this.getAdultFolders.bind(this);
+        this.getAdultFoldersByUsername = this.getAdultFoldersByUsername.bind(this);
         this.createAdultFolder = this.createAdultFolder.bind(this);
         this.getAdultFolderImageList = this.getAdultFolderImageList.bind(this);
         this.uploadAdultImage = this.uploadAdultImage.bind(this);
         this.getAdultImageByHash = this.getAdultImageByHash.bind(this);
         this.changeAdultImage = this.changeAdultImage.bind(this);
         this.listEroticVideos = this.listEroticVideos.bind(this);
+        this.getEroticVideosByUsername = this.getEroticVideosByUsername.bind(this);
         this.uploadEroticVideo = this.uploadEroticVideo.bind(this);
+        this.changeEroticVideo = this.changeEroticVideo.bind(this);
         this.getEroticVideoByHash = this.getEroticVideoByHash.bind(this);
         this.reportEroticContent = this.reportEroticContent.bind(this);
         this.createGuestbookEntry = this.createGuestbookEntry.bind(this);
@@ -157,8 +160,8 @@ class SocialNetworkController {
         try {
             const userId = req.headers.userid;
             const { imageId } = req.params;
-            const { title, visibilities } = req.body;
-            const folderId = await this.socialNetworkService.changeImage(userId, imageId, title, visibilities);
+            const { title, visibilities, selectedUsers } = req.body;
+            const folderId = await this.socialNetworkService.changeImage(userId, imageId, title, visibilities, selectedUsers);
             console.log('--->', folderId);
             res.status(201).json(await this.socialNetworkService.getFolderImageList(userId, folderId));
         } catch (error) {
@@ -208,6 +211,21 @@ class SocialNetworkController {
         }
     }
 
+    async getAdultFoldersByUsername(req, res) {
+        try {
+            const requestingUserId = req.headers.userid;
+            const { username } = req.params;
+            const folders = await this.socialNetworkService.getAdultFoldersByUsername(username, requestingUserId);
+            if (!folders) {
+                return res.status(404).json({ error: 'No folders found or access denied.' });
+            }
+            res.status(200).json(folders);
+        } catch (error) {
+            console.error('Error in getAdultFoldersByUsername:', error);
+            res.status(error.status || 500).json({ error: error.message });
+        }
+    }
+
     async createAdultFolder(req, res) {
         try {
             const userId = req.headers.userid;
@@ -267,8 +285,8 @@ class SocialNetworkController {
         try {
             const userId = req.headers.userid;
             const { imageId } = req.params;
-            const { title, visibilities } = req.body;
-            const folderId = await this.socialNetworkService.changeAdultImage(userId, imageId, title, visibilities);
+            const { title, visibilities, selectedUsers } = req.body;
+            const folderId = await this.socialNetworkService.changeAdultImage(userId, imageId, title, visibilities, selectedUsers);
             res.status(201).json(await this.socialNetworkService.getAdultFolderImageList(userId, folderId));
         } catch (error) {
             console.error('Error in changeAdultImage:', error);
@@ -287,6 +305,18 @@ class SocialNetworkController {
         }
     }
 
+    async getEroticVideosByUsername(req, res) {
+        try {
+            const userId = req.headers.userid;
+            const { username } = req.params;
+            const videos = await this.socialNetworkService.getEroticVideosByUsername(username, userId);
+            res.status(200).json(videos);
+        } catch (error) {
+            console.error('Error in getEroticVideosByUsername:', error);
+            res.status(error.status || 500).json({ error: error.message });
+        }
+    }
+
     async uploadEroticVideo(req, res) {
         try {
             const userId = req.headers.userid;
@@ -300,6 +330,18 @@ class SocialNetworkController {
         }
     }
 
+    async changeEroticVideo(req, res) {
+        try {
+            const userId = req.headers.userid;
+            const { videoId } = req.params;
+            const updatedVideo = await this.socialNetworkService.changeEroticVideo(userId, videoId, req.body);
+            res.status(200).json(updatedVideo);
+        } catch (error) {
+            console.error('Error in changeEroticVideo:', error);
+            res.status(error.status || 500).json({ error: error.message });
+        }
+    }
+
     async getEroticVideoByHash(req, res) {
         try {
             const userId = req.headers.userid;

backend/controllers/vocabController.js

@@ -18,15 +18,35 @@ class VocabController {
     this.createChapter = this._wrapWithUser((userId, req) => this.service.createChapter(userId, req.params.languageId, req.body), { successStatus: 201 });
     this.listLanguageVocabs = this._wrapWithUser((userId, req) => this.service.listLanguageVocabs(userId, req.params.languageId));
     this.searchVocabs = this._wrapWithUser((userId, req) => this.service.searchVocabs(userId, req.params.languageId, req.query));
+    this.getLanguageDictionary = this._wrapWithUser((userId, req) =>
+      this.service.getLanguageDictionary(userId, req.params.languageId, req.query)
+    );
 
     this.getChapter = this._wrapWithUser((userId, req) => this.service.getChapter(userId, req.params.chapterId));
     this.listChapterVocabs = this._wrapWithUser((userId, req) => this.service.listChapterVocabs(userId, req.params.chapterId));
     this.addVocabToChapter = this._wrapWithUser((userId, req) => this.service.addVocabToChapter(userId, req.params.chapterId, req.body), { successStatus: 201 });
+    this.getLessonVocabPool = this._wrapWithUser((userId, req) => this.service.getLessonVocabPool(userId, req.params.lessonId));
 
     // Courses
     this.createCourse = this._wrapWithUser((userId, req) => this.service.createCourse(userId, req.body), { successStatus: 201 });
     this.getCourses = this._wrapWithUser((userId, req) => this.service.getCourses(userId, req.query));
     this.getCourse = this._wrapWithUser((userId, req) => this.service.getCourse(userId, req.params.courseId));
+    this.getCompletedLessonVocabPool = this._wrapWithUser((userId, req) =>
+      this.service.getCompletedLessonVocabPool(userId, req.params.courseId, req.query.untilLessonId)
+    );
+    this.getCourseDictionary = this._wrapWithUser((userId, req) =>
+      this.service.getCourseDictionary(userId, req.params.courseId, req.query)
+    );
+    this.getVocabDistractorPool = this._wrapWithUser((userId, req) =>
+      this.service.getVocabDistractorPool(userId, req.params.courseId, req.query.beforeLessonId)
+    );
+    this.getCourseSrsDue = this._wrapWithUser((userId, req) =>
+      this.service.getCourseSrsDue(userId, req.params.courseId, req.query)
+    );
+    this.reviewSrsItem = this._wrapWithUser((userId, req) =>
+      this.service.reviewSrsItem(userId, req.body),
+      { successStatus: 201 }
+    );
     this.getCourseByShareCode = this._wrapWithUser((userId, req) => this.service.getCourseByShareCode(userId, req.body.shareCode));
     this.updateCourse = this._wrapWithUser((userId, req) => this.service.updateCourse(userId, req.params.courseId, req.body));
     this.deleteCourse = this._wrapWithUser((userId, req) => this.service.deleteCourse(userId, req.params.courseId));
@@ -41,10 +61,12 @@ class VocabController {
     this.enrollInCourse = this._wrapWithUser((userId, req) => this.service.enrollInCourse(userId, req.params.courseId), { successStatus: 201 });
     this.unenrollFromCourse = this._wrapWithUser((userId, req) => this.service.unenrollFromCourse(userId, req.params.courseId));
     this.getMyCourses = this._wrapWithUser((userId) => this.service.getMyCourses(userId));
+    this.getDashboardLearningSummary = this._wrapWithUser((userId) => this.service.getDashboardLearningSummary(userId));
 
     // Progress
     this.getCourseProgress = this._wrapWithUser((userId, req) => this.service.getCourseProgress(userId, req.params.courseId));
     this.updateLessonProgress = this._wrapWithUser((userId, req) => this.service.updateLessonProgress(userId, req.params.lessonId, req.body));
+    this.resetLessonProgress = this._wrapWithUser((userId, req) => this.service.resetMyLessonProgress(userId, req.params.lessonId));
     
     // Grammar Exercises
     this.getExerciseTypes = this._wrapWithUser((userId) => this.service.getExerciseTypes());
@@ -77,4 +99,3 @@ class VocabController {
 }
 
 export default VocabController;
-

backend/data/lesson-checkpoints.json

@@ -0,0 +1,42 @@
+{
+  "24": true,
+  "25": true,
+  "26": true,
+  "27": true,
+  "28": true,
+  "29": true,
+  "30": true,
+  "31": true,
+  "32": true,
+  "33": true,
+  "34": true,
+  "35": true,
+  "36": true,
+  "37": true,
+  "38": true,
+  "39": true,
+  "40": true,
+  "41": true,
+  "42": true,
+  "43": true,
+  "44": true,
+  "45": true,
+  "46": true,
+  "47": true,
+  "48": true,
+  "49": true,
+  "50": true,
+  "51": true,
+  "52": true,
+  "53": true,
+  "54": true,
+  "55": true,
+  "56": true,
+  "57": true,
+  "58": true,
+  "59": true,
+  "60": true,
+  "61": true,
+  "62": true,
+  "63": true
+}

backend/env.example

@@ -19,3 +19,20 @@ DB_PASS=
 #
 # Optional (Defaults siehe utils/sequelize.js)
 # DB_CONNECT_TIMEOUT_MS=30000
+
+# OAuth / OpenID Connect
+# FRONTEND_URL muss auf die öffentliche Frontend-URL zeigen, damit der Provider nach dem Login
+# korrekt auf den Callback im SPA zurückspringen kann.
+# OAUTH_GOOGLE_CLIENT_ID=
+# OAUTH_GOOGLE_CLIENT_SECRET=
+# OAUTH_MICROSOFT_CLIENT_ID=
+# OAUTH_MICROSOFT_CLIENT_SECRET=
+# OAUTH_KEYCLOAK_ISSUER=
+# OAUTH_KEYCLOAK_CLIENT_ID=
+# OAUTH_KEYCLOAK_CLIENT_SECRET=
+# OAUTH_ORY_ISSUER=
+# OAUTH_ORY_CLIENT_ID=
+# OAUTH_ORY_CLIENT_SECRET=
+# OAUTH_ZITADEL_ISSUER=
+# OAUTH_ZITADEL_CLIENT_ID=
+# OAUTH_ZITADEL_CLIENT_SECRET=

backend/jobs/politicalBenefitsTick.js

@@ -0,0 +1,94 @@
+/**
+ * Periodischer Job: reputation_periodic für politische Amtsinhaber.
+ * Aufruf: systemd-Timer oder FALUKANT_POLITICAL_REPUTATION_JOB=1 (siehe server.js).
+ */
+import PoliticalOffice from '../models/falukant/data/political_office.js';
+import PoliticalOfficeType from '../models/falukant/type/political_office_type.js';
+import PoliticalOfficeBenefit from '../models/falukant/predefine/political_office_benefit.js';
+import PoliticalOfficeBenefitType from '../models/falukant/type/political_office_benefit_type.js';
+import PoliticalBenefitLastTick from '../models/falukant/data/political_benefit_last_tick.js';
+import FalukantCharacter from '../models/falukant/data/character.js';
+import FalukantUser from '../models/falukant/data/user.js';
+import User from '../models/community/user.js';
+import { sequelize } from '../utils/sequelize.js';
+import { notifyUser } from '../utils/socket.js';
+
+export async function runPoliticalReputationTicks() {
+    const offices = await PoliticalOffice.findAll({
+        include: [{ model: PoliticalOfficeType, as: 'type', attributes: ['id', 'name'] }]
+    });
+    const toNotify = new Set();
+    let ticks = 0;
+
+    for (const po of offices) {
+        const characterId = po.characterId;
+        const benefitRows = await PoliticalOfficeBenefit.findAll({
+            where: { officeTypeId: po.officeTypeId },
+            include: [
+                {
+                    model: PoliticalOfficeBenefitType,
+                    as: 'benefitDefinition',
+                    attributes: ['tr'],
+                    required: true,
+                    where: { tr: 'reputation_periodic' }
+                }
+            ]
+        });
+
+        for (const br of benefitRows) {
+            const v = br.value && typeof br.value === 'object' ? br.value : {};
+            const intervalDays = Math.max(1, Number(v.intervalDays ?? v.everyDays ?? 7));
+            const gain = Math.max(1, Number(v.gain ?? 1));
+
+            const [tickRow, created] = await PoliticalBenefitLastTick.findOrCreate({
+                where: {
+                    characterId,
+                    politicalOfficeBenefitId: br.id
+                },
+                defaults: {
+                    characterId,
+                    politicalOfficeBenefitId: br.id,
+                    lastTickAt: new Date(po.createdAt),
+                    ticksCount: 0
+                }
+            });
+
+            const baseMs = new Date(tickRow.lastTickAt).getTime();
+            const daysSince = Math.floor((Date.now() - baseMs) / 86400000);
+            if (daysSince < intervalDays) continue;
+
+            await sequelize.transaction(async (t) => {
+                const ch = await FalukantCharacter.findByPk(characterId, { transaction: t });
+                if (!ch) return;
+                const nextRep = Math.min(100, (ch.reputation ?? 0) + gain);
+                await ch.update({ reputation: nextRep }, { transaction: t });
+                await PoliticalBenefitLastTick.update(
+                    {
+                        lastTickAt: new Date(),
+                        ticksCount: (tickRow.ticksCount || 0) + 1
+                    },
+                    { where: { id: tickRow.id }, transaction: t }
+                );
+            });
+
+            ticks += 1;
+            toNotify.add(characterId);
+            console.info(
+                `[PoliticalBenefits] reputation_tick characterId=${characterId} benefitId=${br.id} gain=${gain}`
+            );
+        }
+    }
+
+    for (const characterId of toNotify) {
+        const ch = await FalukantCharacter.findByPk(characterId, { attributes: ['userId'] });
+        if (!ch?.userId) continue;
+        const fu = await FalukantUser.findOne({
+            where: { id: ch.userId },
+            include: [{ model: User, as: 'user', attributes: ['hashedId'] }]
+        });
+        const hid = fu?.user?.hashedId;
+        if (hid) notifyUser(hid, 'falukantUpdateStatus', {});
+    }
+
+    return { processedOffices: offices.length, ticksApplied: ticks };
+}

backend/middleware/authMiddleware.js

@@ -10,6 +10,9 @@ export const authenticate = async (req, res, next) => {
     if (!user) {
         return res.status(401).json({ error: 'Unauthorized: Invalid credentials' });
     }
+    if (!user.active) {
+        return res.status(403).json({ error: 'Unauthorized: User blocked' });
+    }
     try {
         await updateUserTimestamp(user.id);
     } catch (error) {

backend/migrations-active/20260515000000-add-oauth-identities.cjs

@@ -0,0 +1,70 @@
+'use strict';
+
+/** @type {import('sequelize-cli').Migration} */
+module.exports = {
+  async up(queryInterface, Sequelize) {
+    await queryInterface.createTable(
+      { schema: 'community', tableName: 'oauth_identity' },
+      {
+        id: {
+          type: Sequelize.INTEGER,
+          primaryKey: true,
+          autoIncrement: true,
+          allowNull: false,
+        },
+        user_id: {
+          type: Sequelize.INTEGER,
+          allowNull: false,
+          references: {
+            model: { schema: 'community', tableName: 'user' },
+            key: 'id',
+          },
+          onUpdate: 'CASCADE',
+          onDelete: 'CASCADE',
+        },
+        provider: {
+          type: Sequelize.STRING(64),
+          allowNull: false,
+        },
+        issuer: {
+          type: Sequelize.TEXT,
+          allowNull: false,
+        },
+        subject: {
+          type: Sequelize.TEXT,
+          allowNull: false,
+        },
+        email: {
+          type: Sequelize.TEXT,
+          allowNull: true,
+        },
+        created_at: {
+          type: Sequelize.DATE,
+          allowNull: false,
+          defaultValue: Sequelize.literal('CURRENT_TIMESTAMP'),
+        },
+        updated_at: {
+          type: Sequelize.DATE,
+          allowNull: false,
+          defaultValue: Sequelize.literal('CURRENT_TIMESTAMP'),
+        },
+      }
+    );
+
+    await queryInterface.addIndex(
+      { schema: 'community', tableName: 'oauth_identity' },
+      ['provider', 'subject'],
+      { unique: true, name: 'oauth_identity_provider_subject_uniq' }
+    );
+
+    await queryInterface.addIndex(
+      { schema: 'community', tableName: 'oauth_identity' },
+      ['user_id'],
+      { name: 'oauth_identity_user_idx' }
+    );
+  },
+
+  async down(queryInterface) {
+    await queryInterface.dropTable({ schema: 'community', tableName: 'oauth_identity' });
+  },
+};

backend/migrations-archive/20240913071145-add-answer-fields-to-contact_message.cjs

@@ -0,0 +1,45 @@
+'use strict';
+
+module.exports = {
+  up: async (queryInterface, Sequelize) => {
+    const table = { tableName: 'contact_message', schema: 'service' };
+    const columns = await queryInterface.describeTable(table);
+
+    if (!columns.answer) {
+      await queryInterface.addColumn(table, 'answer', {
+        type: Sequelize.TEXT,
+        allowNull: true
+      });
+    }
+
+    if (!columns.answered_at) {
+      await queryInterface.addColumn(table, 'answered_at', {
+        type: Sequelize.DATE,
+        allowNull: true
+      });
+    }
+
+    if (!columns.is_answered) {
+      await queryInterface.addColumn(table, 'is_answered', {
+        type: Sequelize.BOOLEAN,
+        allowNull: false,
+        defaultValue: false
+      });
+    }
+  },
+
+  down: async (queryInterface, Sequelize) => {
+    const table = { tableName: 'contact_message', schema: 'service' };
+    const columns = await queryInterface.describeTable(table);
+
+    if (columns.answer) {
+      await queryInterface.removeColumn(table, 'answer');
+    }
+    if (columns.answered_at) {
+      await queryInterface.removeColumn(table, 'answered_at');
+    }
+    if (columns.is_answered) {
+      await queryInterface.removeColumn(table, 'is_answered');
+    }
+  }
+};

backend/migrations-archive/20260327000000-add-erotic-video-visibility.cjs

@@ -0,0 +1,89 @@
+'use strict';
+
+/** @type {import('sequelize-cli').Migration} */
+module.exports = {
+  async up(queryInterface, Sequelize) {
+    await queryInterface.createTable(
+      { schema: 'community', tableName: 'erotic_video_image_visibility' },
+      {
+        id: {
+          type: Sequelize.INTEGER,
+          primaryKey: true,
+          autoIncrement: true,
+          allowNull: false,
+        },
+        erotic_video_id: {
+          type: Sequelize.INTEGER,
+          allowNull: false,
+          references: {
+            model: { schema: 'community', tableName: 'erotic_video' },
+            key: 'id',
+          },
+          onUpdate: 'CASCADE',
+          onDelete: 'CASCADE',
+        },
+        visibility_type_id: {
+          type: Sequelize.INTEGER,
+          allowNull: false,
+          references: {
+            model: { schema: 'type', tableName: 'image_visibility' },
+            key: 'id',
+          },
+          onUpdate: 'CASCADE',
+          onDelete: 'CASCADE',
+        },
+      }
+    );
+
+    await queryInterface.createTable(
+      { schema: 'community', tableName: 'erotic_video_visibility_user' },
+      {
+        id: {
+          type: Sequelize.INTEGER,
+          primaryKey: true,
+          autoIncrement: true,
+          allowNull: false,
+        },
+        erotic_video_id: {
+          type: Sequelize.INTEGER,
+          allowNull: false,
+          references: {
+            model: { schema: 'community', tableName: 'erotic_video' },
+            key: 'id',
+          },
+          onUpdate: 'CASCADE',
+          onDelete: 'CASCADE',
+        },
+        user_id: {
+          type: Sequelize.INTEGER,
+          allowNull: false,
+          references: {
+            model: { schema: 'community', tableName: 'user' },
+            key: 'id',
+          },
+          onUpdate: 'CASCADE',
+          onDelete: 'CASCADE',
+        },
+      }
+    );
+
+    await queryInterface.sequelize.query(`
+      INSERT INTO community.erotic_video_image_visibility (erotic_video_id, visibility_type_id)
+      SELECT ev.id, iv.id
+      FROM community.erotic_video ev
+      CROSS JOIN type.image_visibility iv
+      WHERE iv.description = 'adults'
+        AND NOT EXISTS (
+          SELECT 1
+          FROM community.erotic_video_image_visibility eviv
+          WHERE eviv.erotic_video_id = ev.id
+            AND eviv.visibility_type_id = iv.id
+        )
+    `);
+  },
+
+  async down(queryInterface) {
+    await queryInterface.dropTable({ schema: 'community', tableName: 'erotic_video_visibility_user' });
+    await queryInterface.dropTable({ schema: 'community', tableName: 'erotic_video_image_visibility' });
+  },
+};

backend/migrations-archive/20260330000000-add-character-pregnancy.cjs

@@ -0,0 +1,36 @@
+"use strict";
+
+/** Schwangerschaft (Admin / Spiel): erwarteter Geburtstermin + optionaler Vater-Charakter */
+module.exports = {
+  async up(queryInterface) {
+    await queryInterface.sequelize.query(`
+      DO $$
+      BEGIN
+        IF NOT EXISTS (
+          SELECT 1 FROM information_schema.columns
+          WHERE table_schema = 'falukant_data' AND table_name = 'character' AND column_name = 'pregnancy_due_at'
+        ) THEN
+          ALTER TABLE falukant_data."character"
+          ADD COLUMN pregnancy_due_at TIMESTAMPTZ NULL;
+        END IF;
+        IF NOT EXISTS (
+          SELECT 1 FROM information_schema.columns
+          WHERE table_schema = 'falukant_data' AND table_name = 'character' AND column_name = 'pregnancy_father_character_id'
+        ) THEN
+          ALTER TABLE falukant_data."character"
+          ADD COLUMN pregnancy_father_character_id INTEGER NULL
+            REFERENCES falukant_data."character"(id) ON DELETE SET NULL;
+        END IF;
+      END$$;
+    `);
+  },
+
+  async down(queryInterface) {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data."character" DROP COLUMN IF EXISTS pregnancy_father_character_id;
+    `);
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data."character" DROP COLUMN IF EXISTS pregnancy_due_at;
+    `);
+  },
+};

backend/migrations-archive/20260331000000-add-vocab-lesson-phase1-fields.cjs

@@ -0,0 +1,44 @@
+'use strict';
+
+module.exports = {
+  async up(queryInterface, Sequelize) {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE community.vocab_course_lesson
+      ADD COLUMN IF NOT EXISTS didactic_mode TEXT,
+      ADD COLUMN IF NOT EXISTS phase_label TEXT,
+      ADD COLUMN IF NOT EXISTS block_number INTEGER,
+      ADD COLUMN IF NOT EXISTS difficulty_weight INTEGER,
+      ADD COLUMN IF NOT EXISTS new_unit_target INTEGER,
+      ADD COLUMN IF NOT EXISTS review_weight INTEGER,
+      ADD COLUMN IF NOT EXISTS is_intensive_review BOOLEAN NOT NULL DEFAULT FALSE;
+
+      COMMENT ON COLUMN community.vocab_course_lesson.didactic_mode IS
+        'Didaktischer Modus der Lektion, z.B. core_input, guided_dialogue, intensive_review oder checkpoint.';
+      COMMENT ON COLUMN community.vocab_course_lesson.phase_label IS
+        'Übergeordnete Lernphase, z.B. quickstart, daily_life oder stabilization.';
+      COMMENT ON COLUMN community.vocab_course_lesson.block_number IS
+        'Inhaltlicher Block für Konsolidierungs- und Wiederholungswellen.';
+      COMMENT ON COLUMN community.vocab_course_lesson.difficulty_weight IS
+        'Grobe relative Schwierigkeit der Lektion von leicht bis schwer.';
+      COMMENT ON COLUMN community.vocab_course_lesson.new_unit_target IS
+        'Empfohlene Zahl neuer Spracheinheiten in dieser Lektion.';
+      COMMENT ON COLUMN community.vocab_course_lesson.review_weight IS
+        'Wie stark Wiederholung in dieser Lektion dominieren soll, typischerweise 0 bis 100.';
+      COMMENT ON COLUMN community.vocab_course_lesson.is_intensive_review IS
+        'Markiert Lektionen, die als intensive Wiederholungsphase gedacht sind.';
+    `);
+  },
+
+  async down(queryInterface, Sequelize) {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE community.vocab_course_lesson
+      DROP COLUMN IF EXISTS is_intensive_review,
+      DROP COLUMN IF EXISTS review_weight,
+      DROP COLUMN IF EXISTS new_unit_target,
+      DROP COLUMN IF EXISTS difficulty_weight,
+      DROP COLUMN IF EXISTS block_number,
+      DROP COLUMN IF EXISTS phase_label,
+      DROP COLUMN IF EXISTS didactic_mode;
+    `);
+  }
+};

backend/migrations-archive/20260401000000-add-vocab-course-progress-lesson-state.cjs

@@ -0,0 +1,20 @@
+'use strict';
+
+module.exports = {
+  async up(queryInterface) {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE community.vocab_course_progress
+      ADD COLUMN IF NOT EXISTS lesson_state JSONB NOT NULL DEFAULT '{}'::jsonb;
+
+      COMMENT ON COLUMN community.vocab_course_progress.lesson_state IS
+        'Persistierter UI- und Lernzustand pro Nutzer und Lektion fuer Resume im Sprachkurs.';
+    `);
+  },
+
+  async down(queryInterface) {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE community.vocab_course_progress
+      DROP COLUMN IF EXISTS lesson_state;
+    `);
+  }
+};

backend/migrations-archive/20260401120000-politics-benefits-and-daily-salary.cjs

@@ -0,0 +1,72 @@
+'use strict';
+
+module.exports = {
+  up: async (queryInterface, Sequelize) => {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.falukant_user
+      ADD COLUMN IF NOT EXISTS last_political_daily_salary_on date NULL;
+    `);
+
+    await queryInterface.sequelize.query(`
+      DO $$
+      BEGIN
+        IF EXISTS (
+          SELECT 1 FROM information_schema.columns
+          WHERE table_schema = 'falukant_predefine'
+            AND table_name = 'political_office_benefit'
+            AND column_name = 'political_office_id'
+        ) AND NOT EXISTS (
+          SELECT 1 FROM information_schema.columns
+          WHERE table_schema = 'falukant_predefine'
+            AND table_name = 'political_office_benefit'
+            AND column_name = 'office_type_id'
+        ) THEN
+          ALTER TABLE falukant_predefine.political_office_benefit
+            RENAME COLUMN political_office_id TO office_type_id;
+        ELSIF EXISTS (
+          SELECT 1 FROM information_schema.columns
+          WHERE table_schema = 'falukant_predefine'
+            AND table_name = 'political_office_benefit'
+            AND column_name = 'political_office_id'
+        ) AND EXISTS (
+          SELECT 1 FROM information_schema.columns
+          WHERE table_schema = 'falukant_predefine'
+            AND table_name = 'political_office_benefit'
+            AND column_name = 'office_type_id'
+        ) THEN
+          UPDATE falukant_predefine.political_office_benefit
+          SET office_type_id = COALESCE(office_type_id, political_office_id);
+          ALTER TABLE falukant_predefine.political_office_benefit
+            DROP COLUMN political_office_id;
+        END IF;
+      END $$;
+    `);
+  },
+
+  down: async (queryInterface, Sequelize) => {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.falukant_user
+      DROP COLUMN IF EXISTS last_political_daily_salary_on;
+    `);
+
+    await queryInterface.sequelize.query(`
+      DO $$
+      BEGIN
+        IF EXISTS (
+          SELECT 1 FROM information_schema.columns
+          WHERE table_schema = 'falukant_predefine'
+            AND table_name = 'political_office_benefit'
+            AND column_name = 'office_type_id'
+        ) AND NOT EXISTS (
+          SELECT 1 FROM information_schema.columns
+          WHERE table_schema = 'falukant_predefine'
+            AND table_name = 'political_office_benefit'
+            AND column_name = 'political_office_id'
+        ) THEN
+          ALTER TABLE falukant_predefine.political_office_benefit
+            RENAME COLUMN office_type_id TO political_office_id;
+        END IF;
+      END $$;
+    `);
+  }
+};

backend/migrations-archive/20260402120000-add-ui-locale-fr-user-param-value.cjs

@@ -0,0 +1,30 @@
+'use strict';
+
+/** @type {import('sequelize-cli').Migration} */
+module.exports = {
+  async up(queryInterface) {
+    await queryInterface.sequelize.query(`
+      INSERT INTO type.user_param_value (user_param_type_id, value, order_id)
+      SELECT upt.id, 'fr', COALESCE(
+        (SELECT MAX(v.order_id) FROM type.user_param_value v WHERE v.user_param_type_id = upt.id),
+        0
+      ) + 1
+      FROM type.user_param upt
+      WHERE upt.description = 'language'
+        AND NOT EXISTS (
+          SELECT 1 FROM type.user_param_value x
+          WHERE x.user_param_type_id = upt.id AND x.value = 'fr'
+        );
+    `);
+  },
+
+  async down(queryInterface) {
+    await queryInterface.sequelize.query(`
+      DELETE FROM type.user_param_value v
+      USING type.user_param upt
+      WHERE v.user_param_type_id = upt.id
+        AND upt.description = 'language'
+        AND v.value = 'fr';
+    `);
+  },
+};

backend/migrations-archive/20260402140000-add-certificate-productions-count-since.cjs

@@ -0,0 +1,22 @@
+/* eslint-disable */
+'use strict';
+
+module.exports = {
+  async up(queryInterface) {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.falukant_user
+        ADD COLUMN IF NOT EXISTS certificate_productions_count_since TIMESTAMPTZ;
+    `);
+    await queryInterface.sequelize.query(`
+      COMMENT ON COLUMN falukant_data.falukant_user.certificate_productions_count_since IS
+        'Daemon/UI: Zählt nur falukant_log.production-Zeilen mit COALESCE(production_timestamp, production_date::timestamp) >= diesem Wert; bei Stufenänderung (Aufstieg/Bankrott/Erbfolge) auf NOW() (YpDaemon QUERY_UPDATE_FALUKANT_USER_CERTIFICATE). NULL = alle passenden Log-Zeilen bis zur ersten Stufenänderung nach Migration. Kein Löschen der Logs zum Reset.';
+    `);
+  },
+
+  async down(queryInterface) {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.falukant_user
+        DROP COLUMN IF EXISTS certificate_productions_count_since;
+    `);
+  }
+};

backend/migrations-archive/20260402180000-political-benefits-mechanics.cjs

@@ -0,0 +1,61 @@
+'use strict';
+
+/** @param {import('sequelize').QueryInterface} queryInterface */
+module.exports = {
+  async up(queryInterface) {
+    await queryInterface.sequelize.query(`
+      CREATE TABLE IF NOT EXISTS falukant_data.political_benefit_last_tick (
+        id serial PRIMARY KEY,
+        character_id integer NOT NULL
+          REFERENCES falukant_data."character"(id) ON DELETE CASCADE,
+        political_office_benefit_id integer NOT NULL
+          REFERENCES falukant_predefine.political_office_benefit(id) ON DELETE CASCADE,
+        last_tick_at timestamptz NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        ticks_count integer NOT NULL DEFAULT 0,
+        CONSTRAINT political_benefit_last_tick_unique UNIQUE (character_id, political_office_benefit_id)
+      );
+      CREATE INDEX IF NOT EXISTS political_benefit_last_tick_character_idx
+        ON falukant_data.political_benefit_last_tick (character_id);
+    `);
+
+    await queryInterface.sequelize.query(`
+      CREATE TABLE IF NOT EXISTS falukant_data.region_tax_history (
+        id serial PRIMARY KEY,
+        region_id integer NOT NULL REFERENCES falukant_data.region(id) ON DELETE CASCADE,
+        old_tax_percent numeric(12,4) NOT NULL,
+        new_tax_percent numeric(12,4) NOT NULL,
+        setter_character_id integer NOT NULL REFERENCES falukant_data."character"(id) ON DELETE CASCADE,
+        political_office_id integer NULL REFERENCES falukant_data.political_office(id) ON DELETE SET NULL,
+        created_at timestamptz NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+      CREATE INDEX IF NOT EXISTS region_tax_history_region_idx
+        ON falukant_data.region_tax_history (region_id, created_at DESC);
+    `);
+
+    await queryInterface.sequelize.query(`
+      CREATE TABLE IF NOT EXISTS falukant_data.political_appointment (
+        id serial PRIMARY KEY,
+        appointer_character_id integer NOT NULL REFERENCES falukant_data."character"(id) ON DELETE CASCADE,
+        target_character_id integer NOT NULL REFERENCES falukant_data."character"(id) ON DELETE CASCADE,
+        office_type_id integer NOT NULL REFERENCES falukant_type.political_office_type(id) ON DELETE CASCADE,
+        region_id integer NOT NULL REFERENCES falukant_data.region(id) ON DELETE CASCADE,
+        status varchar(32) NOT NULL DEFAULT 'completed',
+        created_at timestamptz NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        expires_at timestamptz NULL,
+        completed_political_office_id integer NULL REFERENCES falukant_data.political_office(id) ON DELETE SET NULL
+      );
+      CREATE INDEX IF NOT EXISTS political_appointment_appointer_idx
+        ON falukant_data.political_appointment (appointer_character_id, created_at DESC);
+      CREATE INDEX IF NOT EXISTS political_appointment_target_idx
+        ON falukant_data.political_appointment (target_character_id);
+    `);
+  },
+
+  async down(queryInterface) {
+    await queryInterface.sequelize.query(`
+      DROP TABLE IF EXISTS falukant_data.political_appointment;
+      DROP TABLE IF EXISTS falukant_data.region_tax_history;
+      DROP TABLE IF EXISTS falukant_data.political_benefit_last_tick;
+    `);
+  }
+};

backend/migrations-archive/20260403120000-political-office-hierarchy-level.cjs

@@ -0,0 +1,50 @@
+'use strict';
+
+/** Stufe pro politischem Amt (Tageshonorar: base + perRank × hierarchy_level). */
+module.exports = {
+    async up(queryInterface) {
+        await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_type.political_office_type
+      ADD COLUMN IF NOT EXISTS hierarchy_level INTEGER NOT NULL DEFAULT 1;
+    `);
+
+        await queryInterface.sequelize.query(`
+      UPDATE falukant_type.political_office_type AS pot
+      SET hierarchy_level = sub.lvl
+      FROM (VALUES
+        ('assessor', 1),
+        ('councillor', 1),
+        ('council', 2),
+        ('beadle', 2),
+        ('town-clerk', 2),
+        ('mayor', 3),
+        ('master-builder', 2),
+        ('village-major', 2),
+        ('judge', 3),
+        ('bailif', 3),
+        ('taxman', 2),
+        ('sheriff', 3),
+        ('consultant', 3),
+        ('treasurer', 4),
+        ('hangman', 2),
+        ('territorial-council', 3),
+        ('territorial-council-speaker', 4),
+        ('ruler-consultant', 4),
+        ('state-administrator', 4),
+        ('super-state-administrator', 5),
+        ('governor', 5),
+        ('ministry-helper', 4),
+        ('minister', 5),
+        ('chancellor', 6)
+      ) AS sub(name, lvl)
+      WHERE pot.name = sub.name;
+    `);
+    },
+
+    async down(queryInterface) {
+        await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_type.political_office_type
+      DROP COLUMN IF EXISTS hierarchy_level;
+    `);
+    }
+};

backend/migrations-archive/20260413152500-add-relationship-state-scandal-extra-daily-pct.cjs

@@ -0,0 +1,32 @@
+/* eslint-disable */
+module.exports = {
+  async up(queryInterface, Sequelize) {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.relationship_state
+      ADD COLUMN IF NOT EXISTS scandal_extra_daily_pct double precision NOT NULL DEFAULT 0;
+    `);
+
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.relationship_state
+      DROP CONSTRAINT IF EXISTS relationship_state_scandal_extra_daily_pct_chk;
+    `);
+
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.relationship_state
+      ADD CONSTRAINT relationship_state_scandal_extra_daily_pct_chk
+      CHECK (scandal_extra_daily_pct >= 0 AND scandal_extra_daily_pct <= 100);
+    `);
+  },
+
+  async down(queryInterface, Sequelize) {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.relationship_state
+      DROP CONSTRAINT IF EXISTS relationship_state_scandal_extra_daily_pct_chk;
+    `);
+
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.relationship_state
+      DROP COLUMN IF EXISTS scandal_extra_daily_pct;
+    `);
+  },
+};

backend/migrations-archive/20260413190000-add-relationship-state-marriage-satisfaction-column.cjs

@@ -0,0 +1,54 @@
+'use strict';
+
+module.exports = {
+  async up(queryInterface, Sequelize) {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.relationship_state
+      ADD COLUMN IF NOT EXISTS marriage_satisfaction integer;
+    `);
+
+    await queryInterface.sequelize.query(`
+      UPDATE falukant_data.relationship_state
+      SET marriage_satisfaction = 55
+      WHERE marriage_satisfaction IS NULL;
+    `);
+
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.relationship_state
+      ALTER COLUMN marriage_satisfaction SET DEFAULT 55;
+    `);
+
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.relationship_state
+      ALTER COLUMN marriage_satisfaction SET NOT NULL;
+    `);
+
+    await queryInterface.sequelize.query(`
+      DO $$
+      BEGIN
+        IF NOT EXISTS (
+          SELECT 1
+          FROM pg_constraint
+          WHERE conname = 'relationship_state_marriage_satisfaction_check'
+            AND connamespace = 'falukant_data'::regnamespace
+        ) THEN
+          ALTER TABLE falukant_data.relationship_state
+          ADD CONSTRAINT relationship_state_marriage_satisfaction_check
+            CHECK (marriage_satisfaction >= 0 AND marriage_satisfaction <= 100);
+        END IF;
+      END $$;
+    `);
+  },
+
+  async down(queryInterface, Sequelize) {
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.relationship_state
+      DROP CONSTRAINT IF EXISTS relationship_state_marriage_satisfaction_check;
+    `);
+
+    await queryInterface.sequelize.query(`
+      ALTER TABLE falukant_data.relationship_state
+      DROP COLUMN IF EXISTS marriage_satisfaction;
+    `);
+  }
+};

backend/migrations-archive/20260417000000-add-vocab-srs-item.cjs

@@ -0,0 +1,49 @@
+'use strict';
+
+module.exports = {
+  async up(queryInterface) {
+    await queryInterface.sequelize.query(`
+      CREATE TABLE IF NOT EXISTS community.vocab_srs_item (
+        id SERIAL PRIMARY KEY,
+        user_id INTEGER NOT NULL REFERENCES community."user"(id) ON DELETE CASCADE,
+        course_id INTEGER NOT NULL REFERENCES community.vocab_course(id) ON DELETE CASCADE,
+        lesson_id INTEGER NULL REFERENCES community.vocab_course_lesson(id) ON DELETE SET NULL,
+        item_key VARCHAR(80) NOT NULL,
+        learning TEXT NOT NULL,
+        reference TEXT NOT NULL,
+        direction VARCHAR(8) NOT NULL DEFAULT 'BOTH',
+        stage INTEGER NOT NULL DEFAULT 0,
+        interval_days INTEGER NOT NULL DEFAULT 0,
+        last_reviewed_at TIMESTAMP WITH TIME ZONE NULL,
+        next_due_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+        correct_count INTEGER NOT NULL DEFAULT 0,
+        wrong_count INTEGER NOT NULL DEFAULT 0,
+        lapse_count INTEGER NOT NULL DEFAULT 0,
+        created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+        CONSTRAINT vocab_srs_item_user_key_unique UNIQUE (user_id, item_key)
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_vocab_srs_item_due
+        ON community.vocab_srs_item (user_id, course_id, next_due_at);
+
+      CREATE INDEX IF NOT EXISTS idx_vocab_srs_item_lesson
+        ON community.vocab_srs_item (user_id, course_id, lesson_id);
+
+      COMMENT ON TABLE community.vocab_srs_item IS
+        'Nutzerbezogener SRS-Fortschritt pro Vokabel/Phrase aus Sprachkursen.';
+      COMMENT ON COLUMN community.vocab_srs_item.item_key IS
+        'Stabiler deterministischer Schlüssel aus Kurs, Lektion und normalisiertem Begriffspaar.';
+      COMMENT ON COLUMN community.vocab_srs_item.stage IS
+        'SRS-Stufe. Höhere Stufen bedeuten längere Wiederholungsintervalle.';
+      COMMENT ON COLUMN community.vocab_srs_item.next_due_at IS
+        'Zeitpunkt, zu dem das Item wieder fällig ist.';
+    `);
+  },
+
+  async down(queryInterface) {
+    await queryInterface.sequelize.query(`
+      DROP TABLE IF EXISTS community.vocab_srs_item;
+    `);
+  }
+};

backend/migrations/20240913071145-add-answer-fields-to-contact_message.cjs

@@ -1,43 +0,0 @@
-'use strict';
-
-module.exports = {
-  up: async (queryInterface, Sequelize) => {
-    await queryInterface.addColumn({
-      tableName: 'contact_message',
-      schema: 'service'
-    }, 'answer', {
-      type: Sequelize.TEXT,
-      allowNull: true
-    });
-    await queryInterface.addColumn({
-      tableName: 'contact_message',
-      schema: 'service'
-    }, 'answered_at', {
-      type: Sequelize.DATE,
-      allowNull: true
-    });
-    await queryInterface.addColumn({
-      tableName: 'contact_message',
-      schema: 'service'
-    }, 'is_answered', {
-      type: Sequelize.BOOLEAN,
-      allowNull: false,
-      defaultValue: false
-    });
-  },
-
-  down: async (queryInterface, Sequelize) => {
-    await queryInterface.removeColumn({
-      tableName: 'contact_message',
-      schema: 'service'
-    }, 'answer');
-    await queryInterface.removeColumn({
-      tableName: 'contact_message',
-      schema: 'service'
-    }, 'answered_at');
-    await queryInterface.removeColumn({
-      tableName: 'contact_message',
-      schema: 'service'
-    }, 'is_answered');
-  }
-};

backend/migrations/README.md

@@ -0,0 +1,27 @@
+# Backend-Migrationen (Sequelize)
+
+## Aktive Migrationen
+
+Neue Schema-Änderungen: nur noch Dateien unter **`migrations-active/`**. Ausführung z. B.:
+
+`npm run db:migrate` (siehe `backend/package.json`, Pfad `migrations-active`).
+
+## Archiv
+
+Ältere, bereits auf den Umgebungen ausgerollte Migrationen liegen unter **`migrations-archive/`** und werden vom Sequelize-CLI **nicht** mehr ausgeführt.
+
+Vor dem ersten Deploy nach dieser Aufteilung: fehlende Einträge in `"SequelizeMeta"` für die archivierten Dateinamen per SQL ergänzen, siehe **`sql/baseline-sequelize-meta-migrations-archive.sql`** (idempotent).
+
+## Sonstiges in diesem Ordner
+
+SQL-Hilfsdateien und ältere Notizen verbleiben hier (werden nicht vom CLI geladen).
+
+## Falukant: Zertifikat und Produktionszählung
+
+| Datei (Archiv) | Inhalt |
+|--------|--------|
+| `migrations-archive/20260402140000-add-certificate-productions-count-since.cjs` | Spalte `falukant_data.falukant_user.certificate_productions_count_since` (`TIMESTAMPTZ`, nullable) inkl. Kommentar. Setzt die DB-Grundlage dafür, dass Daemon, Backend und UI dieselbe Periode für „abgeschlossene Produktionen“ nutzen (Filter mit `COALESCE(production_timestamp, production_date::timestamp)` ab diesem Zeitpunkt; `NULL` = bisherige Historie). |
+
+Eine parallele SQL-Migration im Daemon-Repository (z. B. `014_falukant_certificate_productions_count_since.sql`) kann dieselbe Spalte anlegen, wenn das Deployment dort getrennt ist – Schema doppelt anlegen vermeiden.
+
+Details zur Zähl- und Retention-Logik: `docs/FALUKANT_PRODUCTION_CERTIFICATE.md`.

backend/models/associations.js

@@ -6,6 +6,7 @@ import Room from './chat/room.js';
 import User from './community/user.js';
 import UserParam from './community/user_param.js';
 import UserDashboard from './community/user_dashboard.js';
+import OAuthIdentity from './community/oauth_identity.js';
 import UserParamType from './type/user_param.js';
 import UserRightType from './type/user_right.js';
 import UserRight from './community/user_right.js';
@@ -25,6 +26,8 @@ import ImageVisibilityUser from './community/image_visibility_user.js';
 import FolderImageVisibility from './community/folder_image_visibility.js';
 import ImageImageVisibility from './community/image_image_visibility.js';
 import FolderVisibilityUser from './community/folder_visibility_user.js';
+import EroticVideoImageVisibility from './community/erotic_video_image_visibility.js';
+import EroticVideoVisibilityUser from './community/erotic_video_visibility_user.js';
 import GuestbookEntry from './community/guestbook.js';
 import Forum from './forum/forum.js';
 import Title from './forum/title.js';
@@ -92,6 +95,9 @@ import Candidate from './falukant/data/candidate.js';
 import Vote from './falukant/data/vote.js';
 import PoliticalOfficeType from './falukant/type/political_office_type.js';
 import PoliticalOffice from './falukant/data/political_office.js';
+import PoliticalBenefitLastTick from './falukant/data/political_benefit_last_tick.js';
+import RegionTaxHistory from './falukant/data/region_tax_history.js';
+import PoliticalAppointment from './falukant/data/political_appointment.js';
 import PoliticalOfficeBenefit from './falukant/predefine/political_office_benefit.js';
 import PoliticalOfficeBenefitType from './falukant/type/political_office_benefit_type.js';
 import PoliticalOfficeRequirement from './falukant/predefine/political_office_prerequisite.js';
@@ -121,6 +127,7 @@ import VocabCourseProgress from './community/vocab_course_progress.js';
 import VocabGrammarExerciseType from './community/vocab_grammar_exercise_type.js';
 import VocabGrammarExercise from './community/vocab_grammar_exercise.js';
 import VocabGrammarExerciseProgress from './community/vocab_grammar_exercise_progress.js';
+import VocabSrsItem from './community/vocab_srs_item.js';
 import CalendarEvent from './community/calendar_event.js';
 import Campaign from './match3/campaign.js';
 import Match3Level from './match3/level.js';
@@ -176,6 +183,9 @@ export default function setupAssociations() {
   User.hasOne(UserDashboard, { foreignKey: 'userId', as: 'dashboard' });
   UserDashboard.belongsTo(User, { foreignKey: 'userId', as: 'user' });
 
+  User.hasMany(OAuthIdentity, { foreignKey: 'userId', as: 'oauthIdentities' });
+  OAuthIdentity.belongsTo(User, { foreignKey: 'userId', as: 'user' });
+
   UserParamValue.belongsTo(UserParamType, { foreignKey: 'userParamTypeId', as: 'user_param_value_type' });
   UserParamType.hasMany(UserParamValue, { foreignKey: 'userParamTypeId', as: 'user_param_type_value' });
 
@@ -242,6 +252,17 @@ export default function setupAssociations() {
     otherKey: 'imageId'
   });
 
+  EroticVideo.belongsToMany(ImageVisibilityType, {
+    through: EroticVideoImageVisibility,
+    foreignKey: 'eroticVideoId',
+    otherKey: 'visibilityTypeId'
+  });
+  ImageVisibilityType.belongsToMany(EroticVideo, {
+    through: EroticVideoImageVisibility,
+    foreignKey: 'visibilityTypeId',
+    otherKey: 'eroticVideoId'
+  });
+
   Folder.belongsToMany(ImageVisibilityUser, {
     through: FolderVisibilityUser,
     foreignKey: 'folderId',
@@ -253,6 +274,19 @@ export default function setupAssociations() {
     otherKey: 'folderId'
   });
 
+  EroticVideo.belongsToMany(User, {
+    through: EroticVideoVisibilityUser,
+    foreignKey: 'eroticVideoId',
+    otherKey: 'userId',
+    as: 'selectedVisibilityUsers'
+  });
+  User.belongsToMany(EroticVideo, {
+    through: EroticVideoVisibilityUser,
+    foreignKey: 'userId',
+    otherKey: 'eroticVideoId',
+    as: 'visibleEroticVideos'
+  });
+
   // Guestbook related associations
   User.hasMany(GuestbookEntry, { foreignKey: 'recipientId', as: 'receivedEntries' });
   User.hasMany(GuestbookEntry, { foreignKey: 'senderId', as: 'sentEntries' });
@@ -353,6 +387,8 @@ export default function setupAssociations() {
   FalukantCharacter.belongsTo(RegionData, { foreignKey: 'regionId', as: 'region' });
   RegionData.hasMany(FalukantCharacter, { foreignKey: 'regionId', as: 'charactersInRegion' });
 
+  FalukantCharacter.belongsTo(FalukantCharacter, { foreignKey: 'pregnancyFatherCharacterId', as: 'pregnancyFather' });
+
   FalukantStock.belongsTo(FalukantStockType, { foreignKey: 'stockTypeId', as: 'stockType' });
   FalukantStockType.hasMany(FalukantStock, { foreignKey: 'stockTypeId', as: 'stocks' });
 
@@ -764,6 +800,48 @@ export default function setupAssociations() {
     as: 'heldOffice'
   });
 
+  PoliticalBenefitLastTick.belongsTo(FalukantCharacter, {
+    foreignKey: 'characterId',
+    as: 'character'
+  });
+  FalukantCharacter.hasMany(PoliticalBenefitLastTick, {
+    foreignKey: 'characterId',
+    as: 'politicalBenefitTicks'
+  });
+  PoliticalBenefitLastTick.belongsTo(PoliticalOfficeBenefit, {
+    foreignKey: 'politicalOfficeBenefitId',
+    as: 'officeBenefit'
+  });
+
+  RegionTaxHistory.belongsTo(RegionData, { foreignKey: 'regionId', as: 'region' });
+  RegionData.hasMany(RegionTaxHistory, { foreignKey: 'regionId', as: 'taxHistory' });
+  RegionTaxHistory.belongsTo(FalukantCharacter, {
+    foreignKey: 'setterCharacterId',
+    as: 'setterCharacter'
+  });
+  RegionTaxHistory.belongsTo(PoliticalOffice, {
+    foreignKey: 'politicalOfficeId',
+    as: 'sourceOffice'
+  });
+
+  PoliticalAppointment.belongsTo(FalukantCharacter, {
+    foreignKey: 'appointerCharacterId',
+    as: 'appointer'
+  });
+  PoliticalAppointment.belongsTo(FalukantCharacter, {
+    foreignKey: 'targetCharacterId',
+    as: 'targetCharacter'
+  });
+  PoliticalAppointment.belongsTo(PoliticalOfficeType, {
+    foreignKey: 'officeTypeId',
+    as: 'officeType'
+  });
+  PoliticalAppointment.belongsTo(RegionData, { foreignKey: 'regionId', as: 'region' });
+  PoliticalAppointment.belongsTo(PoliticalOffice, {
+    foreignKey: 'completedPoliticalOfficeId',
+    as: 'completedOffice'
+  });
+
   // elections
   Election.belongsTo(PoliticalOfficeType, {
     foreignKey: 'officeTypeId',
@@ -1104,6 +1182,13 @@ export default function setupAssociations() {
   VocabGrammarExerciseProgress.belongsTo(VocabGrammarExercise, { foreignKey: 'exerciseId', as: 'exercise' });
   VocabGrammarExercise.hasMany(VocabGrammarExerciseProgress, { foreignKey: 'exerciseId', as: 'progress' });
 
+  VocabSrsItem.belongsTo(User, { foreignKey: 'userId', as: 'user' });
+  User.hasMany(VocabSrsItem, { foreignKey: 'userId', as: 'vocabSrsItems' });
+  VocabSrsItem.belongsTo(VocabCourse, { foreignKey: 'courseId', as: 'course' });
+  VocabCourse.hasMany(VocabSrsItem, { foreignKey: 'courseId', as: 'srsItems' });
+  VocabSrsItem.belongsTo(VocabCourseLesson, { foreignKey: 'lessonId', as: 'lesson' });
+  VocabCourseLesson.hasMany(VocabSrsItem, { foreignKey: 'lessonId', as: 'srsItems' });
+  
   // Calendar associations
   CalendarEvent.belongsTo(User, { foreignKey: 'userId', as: 'user' });
   User.hasMany(CalendarEvent, { foreignKey: 'userId', as: 'calendarEvents' });

backend/models/community/erotic_video_image_visibility.js

@@ -0,0 +1,26 @@
+import { sequelize } from '../../utils/sequelize.js';
+import { DataTypes } from 'sequelize';
+
+const EroticVideoImageVisibility = sequelize.define('erotic_video_image_visibility', {
+    id: {
+        type: DataTypes.INTEGER,
+        autoIncrement: true,
+        primaryKey: true,
+        allowNull: false
+    },
+    eroticVideoId: {
+        type: DataTypes.INTEGER,
+        allowNull: false
+    },
+    visibilityTypeId: {
+        type: DataTypes.INTEGER,
+        allowNull: false
+    }
+}, {
+    tableName: 'erotic_video_image_visibility',
+    timestamps: false,
+    underscored: true,
+    schema: 'community'
+});
+
+export default EroticVideoImageVisibility;

backend/models/community/erotic_video_visibility_user.js

@@ -0,0 +1,26 @@
+import { sequelize } from '../../utils/sequelize.js';
+import { DataTypes } from 'sequelize';
+
+const EroticVideoVisibilityUser = sequelize.define('erotic_video_visibility_user', {
+    id: {
+        type: DataTypes.INTEGER,
+        autoIncrement: true,
+        primaryKey: true,
+        allowNull: false
+    },
+    eroticVideoId: {
+        type: DataTypes.INTEGER,
+        allowNull: false
+    },
+    userId: {
+        type: DataTypes.INTEGER,
+        allowNull: false
+    }
+}, {
+    tableName: 'erotic_video_visibility_user',
+    timestamps: false,
+    underscored: true,
+    schema: 'community'
+});
+
+export default EroticVideoVisibilityUser;

backend/models/community/oauth_identity.js

@@ -0,0 +1,54 @@
+import { sequelize } from '../../utils/sequelize.js';
+import { DataTypes } from 'sequelize';
+
+const OAuthIdentity = sequelize.define('oauth_identity', {
+    userId: {
+        type: DataTypes.INTEGER,
+        allowNull: false,
+        field: 'user_id'
+    },
+    provider: {
+        type: DataTypes.STRING(64),
+        allowNull: false
+    },
+    issuer: {
+        type: DataTypes.TEXT,
+        allowNull: false
+    },
+    subject: {
+        type: DataTypes.TEXT,
+        allowNull: false
+    },
+    email: {
+        type: DataTypes.TEXT,
+        allowNull: true
+    },
+    createdAt: {
+        type: DataTypes.DATE,
+        allowNull: false,
+        field: 'created_at',
+        defaultValue: DataTypes.NOW
+    },
+    updatedAt: {
+        type: DataTypes.DATE,
+        allowNull: false,
+        field: 'updated_at',
+        defaultValue: DataTypes.NOW
+    }
+}, {
+    tableName: 'oauth_identity',
+    schema: 'community',
+    underscored: true,
+    timestamps: false,
+    indexes: [
+        {
+            unique: true,
+            fields: ['provider', 'subject']
+        },
+        {
+            fields: ['user_id']
+        }
+    ]
+});
+
+export default OAuthIdentity;

backend/models/community/user.js

@@ -8,6 +8,26 @@ function encodeEncryptedValueToBlob(value) {
     return Buffer.from(encrypted, 'utf8');
 }
 
+/** Nur echte Adressen zurückgeben — verhindert Anzeige von Base64-/Key-artigem Müll bei fehlender Entschlüsselung. */
+function looksLikePlausibleEmail(s) {
+    if (typeof s !== 'string') {
+        return false;
+    }
+    const t = s.trim();
+    if (!t || t.length > 254) {
+        return false;
+    }
+    return /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/i.test(t);
+}
+
+function normalizeEmailCandidate(s) {
+    if (!s || typeof s !== 'string') {
+        return null;
+    }
+    const t = s.trim();
+    return looksLikePlausibleEmail(t) ? t : null;
+}
+
 function decodeEncryptedBlob(value) {
     if (!value) {
         return null;
@@ -16,8 +36,9 @@ function decodeEncryptedBlob(value) {
     try {
         const encryptedUtf8 = value.toString('utf8');
         const decryptedUtf8 = decrypt(encryptedUtf8);
-        if (decryptedUtf8) {
-            return decryptedUtf8;
+        const fromUtf8 = normalizeEmailCandidate(decryptedUtf8);
+        if (fromUtf8) {
+            return fromUtf8;
         }
     } catch (error) {
         console.warn('Email utf8 decryption failed, trying legacy hex format:', error.message);
@@ -26,15 +47,16 @@ function decodeEncryptedBlob(value) {
     try {
         const encryptedHex = value.toString('hex');
         const decryptedHex = decrypt(encryptedHex);
-        if (decryptedHex) {
-            return decryptedHex;
+        const fromHex = normalizeEmailCandidate(decryptedHex);
+        if (fromHex) {
+            return fromHex;
         }
     } catch (error) {
         console.warn('Email legacy hex decryption failed:', error.message);
     }
 
     try {
-        return value.toString('utf8');
+        return normalizeEmailCandidate(value.toString('utf8'));
     } catch (error) {
         console.warn('Email could not be read as plain text:', error.message);
         return null;

backend/models/community/vocab_course_lesson.js

@@ -48,6 +48,42 @@ VocabCourseLesson.init({
         defaultValue: 'vocab',
         field: 'lesson_type'
     },
+    didacticMode: {
+        type: DataTypes.TEXT,
+        allowNull: true,
+        field: 'didactic_mode'
+    },
+    phaseLabel: {
+        type: DataTypes.TEXT,
+        allowNull: true,
+        field: 'phase_label'
+    },
+    blockNumber: {
+        type: DataTypes.INTEGER,
+        allowNull: true,
+        field: 'block_number'
+    },
+    difficultyWeight: {
+        type: DataTypes.INTEGER,
+        allowNull: true,
+        field: 'difficulty_weight'
+    },
+    newUnitTarget: {
+        type: DataTypes.INTEGER,
+        allowNull: true,
+        field: 'new_unit_target'
+    },
+    reviewWeight: {
+        type: DataTypes.INTEGER,
+        allowNull: true,
+        field: 'review_weight'
+    },
+    isIntensiveReview: {
+        type: DataTypes.BOOLEAN,
+        allowNull: false,
+        defaultValue: false,
+        field: 'is_intensive_review'
+    },
     audioUrl: {
         type: DataTypes.TEXT,
         allowNull: true,

backend/models/community/vocab_course_progress.js

@@ -34,6 +34,12 @@ VocabCourseProgress.init({
         allowNull: false,
         defaultValue: 0
     },
+    lessonState: {
+        type: DataTypes.JSONB,
+        allowNull: false,
+        defaultValue: {},
+        field: 'lesson_state'
+    },
     lastAccessedAt: {
         type: DataTypes.DATE,
         allowNull: true,

backend/models/community/vocab_srs_item.js

@@ -0,0 +1,94 @@
+import { Model, DataTypes } from 'sequelize';
+import { sequelize } from '../../utils/sequelize.js';
+
+class VocabSrsItem extends Model {}
+
+VocabSrsItem.init({
+  id: {
+    type: DataTypes.INTEGER,
+    primaryKey: true,
+    autoIncrement: true
+  },
+  userId: {
+    type: DataTypes.INTEGER,
+    allowNull: false,
+    field: 'user_id'
+  },
+  courseId: {
+    type: DataTypes.INTEGER,
+    allowNull: false,
+    field: 'course_id'
+  },
+  lessonId: {
+    type: DataTypes.INTEGER,
+    allowNull: true,
+    field: 'lesson_id'
+  },
+  itemKey: {
+    type: DataTypes.STRING(80),
+    allowNull: false,
+    field: 'item_key'
+  },
+  learning: {
+    type: DataTypes.TEXT,
+    allowNull: false
+  },
+  reference: {
+    type: DataTypes.TEXT,
+    allowNull: false
+  },
+  direction: {
+    type: DataTypes.STRING(8),
+    allowNull: false,
+    defaultValue: 'BOTH'
+  },
+  stage: {
+    type: DataTypes.INTEGER,
+    allowNull: false,
+    defaultValue: 0
+  },
+  intervalDays: {
+    type: DataTypes.INTEGER,
+    allowNull: false,
+    defaultValue: 0,
+    field: 'interval_days'
+  },
+  lastReviewedAt: {
+    type: DataTypes.DATE,
+    allowNull: true,
+    field: 'last_reviewed_at'
+  },
+  nextDueAt: {
+    type: DataTypes.DATE,
+    allowNull: false,
+    defaultValue: DataTypes.NOW,
+    field: 'next_due_at'
+  },
+  correctCount: {
+    type: DataTypes.INTEGER,
+    allowNull: false,
+    defaultValue: 0,
+    field: 'correct_count'
+  },
+  wrongCount: {
+    type: DataTypes.INTEGER,
+    allowNull: false,
+    defaultValue: 0,
+    field: 'wrong_count'
+  },
+  lapseCount: {
+    type: DataTypes.INTEGER,
+    allowNull: false,
+    defaultValue: 0,
+    field: 'lapse_count'
+  }
+}, {
+  sequelize,
+  modelName: 'VocabSrsItem',
+  tableName: 'vocab_srs_item',
+  schema: 'community',
+  timestamps: true,
+  underscored: true
+});
+
+export default VocabSrsItem;

backend/models/falukant/data/character.js

@@ -45,6 +45,14 @@ FalukantCharacter.init(
         min: 0,
         max: 100
       }
+    },
+    pregnancyDueAt: {
+      type: DataTypes.DATE,
+      allowNull: true,
+    },
+    pregnancyFatherCharacterId: {
+      type: DataTypes.INTEGER,
+      allowNull: true,
     }
   },
   {
@@ -53,7 +61,12 @@ FalukantCharacter.init(
     tableName: 'character',
     schema: 'falukant_data',
     timestamps: true,
-    underscored: true}
+    underscored: true,
+    // Spalten erst nach Migration 20260330000000; ohne Exclude würde SELECT/INSERT auf alten DBs fehlschlagen
+    defaultScope: {
+      attributes: { exclude: ['pregnancyDueAt', 'pregnancyFatherCharacterId'] },
+    },
+  }
 );
 
 export default FalukantCharacter;

backend/models/falukant/data/director.js

@@ -33,6 +33,10 @@ Director.init({
         type: DataTypes.BOOLEAN,
         allowNull: false,
         defaultValue: true},
+    autoAdjustIncome: {
+        type: DataTypes.BOOLEAN,
+        allowNull: false,
+        defaultValue: false},
     lastSalaryPayout: {
         type: DataTypes.DATE,
         allowNull: false,

backend/models/falukant/data/political_appointment.js

@@ -0,0 +1,56 @@
+import { Model, DataTypes } from 'sequelize';
+import { sequelize } from '../../../utils/sequelize.js';
+
+class PoliticalAppointment extends Model {}
+
+PoliticalAppointment.init(
+  {
+    appointerCharacterId: {
+      type: DataTypes.INTEGER,
+      allowNull: false,
+      field: 'appointer_character_id'
+    },
+    targetCharacterId: {
+      type: DataTypes.INTEGER,
+      allowNull: false,
+      field: 'target_character_id'
+    },
+    officeTypeId: {
+      type: DataTypes.INTEGER,
+      allowNull: false,
+      field: 'office_type_id'
+    },
+    regionId: {
+      type: DataTypes.INTEGER,
+      allowNull: false,
+      field: 'region_id'
+    },
+    status: {
+      type: DataTypes.STRING(32),
+      allowNull: false,
+      defaultValue: 'completed'
+    },
+    expiresAt: {
+      type: DataTypes.DATE,
+      allowNull: true,
+      field: 'expires_at'
+    },
+    completedPoliticalOfficeId: {
+      type: DataTypes.INTEGER,
+      allowNull: true,
+      field: 'completed_political_office_id'
+    },
+  },
+  {
+    sequelize,
+    modelName: 'PoliticalAppointment',
+    tableName: 'political_appointment',
+    schema: 'falukant_data',
+    timestamps: true,
+    createdAt: 'created_at',
+    updatedAt: false,
+    underscored: true
+  }
+);
+
+export default PoliticalAppointment;

backend/models/falukant/data/political_benefit_last_tick.js

@@ -0,0 +1,40 @@
+import { Model, DataTypes } from 'sequelize';
+import { sequelize } from '../../../utils/sequelize.js';
+
+class PoliticalBenefitLastTick extends Model {}
+
+PoliticalBenefitLastTick.init(
+  {
+    characterId: {
+      type: DataTypes.INTEGER,
+      allowNull: false,
+      field: 'character_id'
+    },
+    politicalOfficeBenefitId: {
+      type: DataTypes.INTEGER,
+      allowNull: false,
+      field: 'political_office_benefit_id'
+    },
+    lastTickAt: {
+      type: DataTypes.DATE,
+      allowNull: false,
+      field: 'last_tick_at'
+    },
+    ticksCount: {
+      type: DataTypes.INTEGER,
+      allowNull: false,
+      defaultValue: 0,
+      field: 'ticks_count'
+    }
+  },
+  {
+    sequelize,
+    modelName: 'PoliticalBenefitLastTick',
+    tableName: 'political_benefit_last_tick',
+    schema: 'falukant_data',
+    timestamps: false,
+    underscored: true
+  }
+);
+
+export default PoliticalBenefitLastTick;

backend/models/falukant/data/region_tax_history.js

@@ -0,0 +1,46 @@
+import { Model, DataTypes } from 'sequelize';
+import { sequelize } from '../../../utils/sequelize.js';
+
+class RegionTaxHistory extends Model {}
+
+RegionTaxHistory.init(
+  {
+    regionId: {
+      type: DataTypes.INTEGER,
+      allowNull: false,
+      field: 'region_id'
+    },
+    oldTaxPercent: {
+      type: DataTypes.DECIMAL(12, 4),
+      allowNull: false,
+      field: 'old_tax_percent'
+    },
+    newTaxPercent: {
+      type: DataTypes.DECIMAL(12, 4),
+      allowNull: false,
+      field: 'new_tax_percent'
+    },
+    setterCharacterId: {
+      type: DataTypes.INTEGER,
+      allowNull: false,
+      field: 'setter_character_id'
+    },
+    politicalOfficeId: {
+      type: DataTypes.INTEGER,
+      allowNull: true,
+      field: 'political_office_id'
+    }
+  },
+  {
+    sequelize,
+    modelName: 'RegionTaxHistory',
+    tableName: 'region_tax_history',
+    schema: 'falukant_data',
+    timestamps: true,
+    createdAt: 'created_at',
+    updatedAt: false,
+    underscored: true
+  }
+);
+
+export default RegionTaxHistory;

backend/models/falukant/data/relationship_state.js

@@ -88,6 +88,16 @@ RelationshipState.init(
         min: 0,
       },
     },
+    scandalExtraDailyPct: {
+      type: DataTypes.FLOAT,
+      allowNull: false,
+      defaultValue: 0,
+      validate: {
+        min: 0,
+        max: 100,
+      },
+      field: 'scandal_extra_daily_pct',
+    },
     monthsUnderfunded: {
       type: DataTypes.INTEGER,
       allowNull: false,

backend/models/falukant/data/user.js

@@ -29,6 +29,10 @@ FalukantUser.init({
         type: DataTypes.INTEGER,
         allowNull: false,
         defaultValue: 1},
+    certificateProductionsCountSince: {
+        type: DataTypes.DATE,
+        allowNull: true
+    },
     mainBranchRegionId: {
         type: DataTypes.INTEGER,
         allowNull: true
@@ -36,6 +40,11 @@ FalukantUser.init({
     lastNobilityAdvanceAt: {
         type: DataTypes.DATE,
         allowNull: true
+    },
+    lastPoliticalDailySalaryOn: {
+        type: DataTypes.DATEONLY,
+        allowNull: true,
+        field: 'last_political_daily_salary_on'
     }
 }, {
     sequelize,

backend/models/falukant/data/user_house.js

@@ -4,6 +4,11 @@ import { sequelize } from '../../../utils/sequelize.js';
 class UserHouse extends Model { }
 
 UserHouse.init({
+    id: {
+        type: DataTypes.INTEGER,
+        primaryKey: true,
+        autoIncrement: true
+    },
     roofCondition: {
         type: DataTypes.INTEGER,
         allowNull: false,

backend/models/falukant/log/dayproduction.js

@@ -23,7 +23,11 @@ DayProduction.init({
     productionDate: {
         type: DataTypes.DATEONLY,
         allowNull: false,
-        defaultValue: sequelize.literal('CURRENT_DATE')}
+        defaultValue: sequelize.literal('CURRENT_DATE')},
+    completionCount: {
+        type: DataTypes.INTEGER,
+        allowNull: false,
+        defaultValue: 1}
 }, {
     sequelize,
     modelName: 'DayProduction',

backend/models/falukant/predefine/political_office_benefit.js

@@ -1,7 +1,6 @@
 // falukant/predefine/political_office_benefit.js
 import { Model, DataTypes } from 'sequelize';
 import { sequelize } from '../../../utils/sequelize.js';
-import PoliticalOfficeBenefitType from '../type/political_office_benefit_type.js';
 
 class PoliticalOfficeBenefit extends Model {}
 
@@ -9,31 +8,29 @@ PoliticalOfficeBenefit.init({
   id: {
     type: DataTypes.INTEGER,
     primaryKey: true,
-    autoIncrement: true},
-  politicalOfficeId: { 
+    autoIncrement: true
+  },
+  officeTypeId: {
     type: DataTypes.INTEGER,
-    allowNull: false},
+    allowNull: false,
+    field: 'office_type_id'
+  },
   benefitTypeId: {
     type: DataTypes.INTEGER,
-    allowNull: false},
+    allowNull: false,
+    field: 'benefit_type_id'
+  },
   value: {
     type: DataTypes.JSONB,
-    allowNull: false}}, {
+    allowNull: false
+  }
+}, {
   sequelize,
   modelName: 'PoliticalOfficeBenefit',
   tableName: 'political_office_benefit',
   schema: 'falukant_predefine',
   timestamps: false,
-  underscored: true});
-
-// Association
-PoliticalOfficeBenefit.belongsTo(PoliticalOfficeBenefitType, {
-  foreignKey: 'benefit_type_id',
-  as: 'benefitType'
-});
-PoliticalOfficeBenefitType.hasMany(PoliticalOfficeBenefit, {
-  foreignKey: 'benefit_type_id',
-  as: 'benefits'
+  underscored: true
 });
 
 export default PoliticalOfficeBenefit;

backend/models/falukant/type/political_office_type.js

@@ -20,7 +20,15 @@ PoliticalOfficeType.init({
   termLength: {
     type: DataTypes.INTEGER,
     allowNull: false,
-    defaultValue: 0}}, {
+    defaultValue: 0},
+  /** Stufe für Tageshonorar (base + perRank × level) und Sortierung; 1 = niedrigstes politisches Level */
+  hierarchyLevel: {
+    type: DataTypes.INTEGER,
+    allowNull: false,
+    defaultValue: 1,
+    field: 'hierarchy_level'
+  }
+}, {
   sequelize,
   modelName: 'PoliticalOfficeType',
   tableName: 'political_office_type',

backend/models/index.js

@@ -8,6 +8,7 @@ import WidgetType from './type/widget_type.js';
 import User from './community/user.js';
 import UserParam from './community/user_param.js';
 import UserDashboard from './community/user_dashboard.js';
+import OAuthIdentity from './community/oauth_identity.js';
 import Login from './logs/login.js';
 import UserRight from './community/user_right.js';
 import InterestType from './type/interest.js';
@@ -25,6 +26,8 @@ import ImageVisibilityUser from './community/image_visibility_user.js';
 import FolderImageVisibility from './community/folder_image_visibility.js';
 import ImageImageVisibility from './community/image_image_visibility.js';
 import FolderVisibilityUser from './community/folder_visibility_user.js';
+import EroticVideoImageVisibility from './community/erotic_video_image_visibility.js';
+import EroticVideoVisibilityUser from './community/erotic_video_visibility_user.js';
 import GuestbookEntry from './community/guestbook.js';
 import DiaryHistory from './community/diary_history.js';
 import Diary from './community/diary.js';
@@ -114,6 +117,9 @@ import PoliticalOfficeRequirement from './falukant/predefine/political_office_pr
 import PoliticalOfficeBenefitType from './falukant/type/political_office_benefit_type.js';
 import PoliticalOfficeBenefit from './falukant/predefine/political_office_benefit.js';
 import PoliticalOffice from './falukant/data/political_office.js';
+import PoliticalBenefitLastTick from './falukant/data/political_benefit_last_tick.js';
+import RegionTaxHistory from './falukant/data/region_tax_history.js';
+import PoliticalAppointment from './falukant/data/political_appointment.js';
 import Election from './falukant/data/election.js';
 import Candidate from './falukant/data/candidate.js';
 import Vote from './falukant/data/vote.js';
@@ -151,6 +157,7 @@ import VocabCourseProgress from './community/vocab_course_progress.js';
 import VocabGrammarExerciseType from './community/vocab_grammar_exercise_type.js';
 import VocabGrammarExercise from './community/vocab_grammar_exercise.js';
 import VocabGrammarExerciseProgress from './community/vocab_grammar_exercise_progress.js';
+import VocabSrsItem from './community/vocab_srs_item.js';
 import CalendarEvent from './community/calendar_event.js';
 
 const models = {
@@ -162,6 +169,7 @@ const models = {
   User,
   UserParam,
   UserDashboard,
+  OAuthIdentity,
   Login,
   UserRight,
   InterestType,
@@ -179,6 +187,8 @@ const models = {
   FolderImageVisibility,
   ImageImageVisibility,
   FolderVisibilityUser,
+  EroticVideoImageVisibility,
+  EroticVideoVisibilityUser,
   GuestbookEntry,
   DiaryHistory,
   Diary,
@@ -258,6 +268,9 @@ const models = {
   PoliticalOfficeBenefitType,
   PoliticalOfficeBenefit,
   PoliticalOffice,
+  PoliticalBenefitLastTick,
+  RegionTaxHistory,
+  PoliticalAppointment,
   Election,
   Candidate,
   Vote,
@@ -308,6 +321,7 @@ const models = {
   VocabGrammarExerciseType,
   VocabGrammarExercise,
   VocabGrammarExerciseProgress,
+  VocabSrsItem,
   
   // Calendar
   CalendarEvent,

backend/models/trigger.js

@@ -129,24 +129,27 @@ export async function createTriggers() {
             p_falukant_user_id integer,
             p_money_change numeric,
             p_activity text,
-            p_changed_by       integer DEFAULT NULL
+            p_changed_by integer DEFAULT NULL::integer
         )
         RETURNS void
         LANGUAGE plpgsql
         AS $function$
         DECLARE
-            v_money_before   numeric(10,2);
-            v_money_after    numeric(10,2);
+            v_money_before   numeric(14,2);
+            v_money_after    numeric(14,2);
             v_moneyflow_id   bigint;
         BEGIN
             SELECT money
               INTO v_money_before
               FROM falukant_data.falukant_user
              WHERE id = p_falukant_user_id;
+
             IF NOT FOUND THEN
                 RAISE EXCEPTION 'FalukantUser mit ID % nicht gefunden', p_falukant_user_id;
             END IF;
+
             v_money_after := v_money_before + p_money_change;
+
             INSERT INTO falukant_log.moneyflow (
                 falukant_user_id,
                 activity,
@@ -160,15 +163,17 @@ export async function createTriggers() {
                 p_falukant_user_id,
                 p_activity,
                 v_money_before,
-                NULL,            -- Wird gleich aktualisiert
+                NULL, -- wird gleich aktualisiert
                 p_money_change,
                 p_changed_by,
                 NOW()
             )
             RETURNING id INTO v_moneyflow_id;
+
             UPDATE falukant_data.falukant_user
                SET money = v_money_after
              WHERE id = p_falukant_user_id;
+
             UPDATE falukant_log.moneyflow
                SET money_after = (
                    SELECT money

backend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "backend",
   "version": "1.0.0",
-  "description": "",
+  "description": "Nach Änderungen an dependencies: npm install ausführen und package-lock.json committen (npm ci im Deploy).",
   "type": "module",
   "main": "index.js",
   "scripts": {
@@ -9,17 +9,21 @@
     "dev": "NODE_ENV=development node server.js",
     "start-daemon": "node daemonServer.js",
     "sync-db": "node sync-database.js",
+    "db:migrate": "sequelize-cli db:migrate --config config/sequelize-cli.cjs --migrations-path migrations-active --env production",
     "sync-tables": "node sync-tables-only.js",
     "check-connections": "node check-connections.js",
     "cleanup-connections": "node cleanup-connections.js",
     "diag:town-worth": "QUIET_ENV_LOGS=1 DOTENV_CONFIG_QUIET=1 node scripts/falukant-town-product-worth-stats.mjs",
     "diag:moneyflow": "QUIET_ENV_LOGS=1 DOTENV_CONFIG_QUIET=1 node scripts/falukant-moneyflow-report.mjs",
+    "sync:vocab-courses": "node scripts/sync-vocab-course-content.js",
+    "lockfile:sync": "npm install --package-lock-only",
     "test": "echo \"Error: no test specified\" && exit 1"
   },
   "keywords": [],
   "author": "",
   "license": "ISC",
   "dependencies": {
+    "@gltf-transform/cli": "^4.3.0",
     "amqplib": "^0.10.9",
     "bcryptjs": "^3.0.3",
     "connect-redis": "^9.0.0",
@@ -35,17 +39,23 @@
     "multer": "^2.1.1",
     "mysql2": "^3.20.0",
     "nodemailer": "^8.0.3",
+    "openid-client": "^6.8.4",
     "pg": "^8.20.0",
     "pg-hstore": "^2.3.4",
     "redis": "^5.11.0",
     "sequelize": "^6.37.8",
     "sharp": "^0.34.5",
     "socket.io": "^4.8.3",
-    "uuid": "^13.0.0",
-    "ws": "^8.20.0",
-    "@gltf-transform/cli": "^4.3.0"
+    "uuid": "^14.0.0",
+    "ws": "^8.20.0"
   },
   "devDependencies": {
     "sequelize-cli": "^6.6.5"
+  },
+  "overrides": {
+    "minimatch": "10.2.4",
+    "sequelize": {
+      "uuid": "14.0.0"
+    }
   }
 }

backend/routers/adminRouter.js

@@ -2,6 +2,7 @@
 import { Router } from 'express';
 import { authenticate } from '../middleware/authMiddleware.js';
 import AdminController from '../controllers/adminController.js';
+import moderationController from '../controllers/moderationController.js';
 
 const router = Router();
 const adminController = new AdminController();
@@ -25,6 +26,14 @@ router.put('/users/:id/adult-verification', authenticate, adminController.setAdu
 router.get('/users/erotic-moderation', authenticate, adminController.getEroticModerationReports);
 router.get('/users/erotic-moderation/preview/:type/:targetId', authenticate, adminController.getEroticModerationPreview);
 router.put('/users/erotic-moderation/:id', authenticate, adminController.applyEroticModerationAction);
+router.get('/users/:id/vocab-courses', authenticate, adminController.getUserVocabCourses);
+router.post('/users/:id/vocab-lesson-progress/reset', authenticate, adminController.resetUserVocabLessonProgress);
+router.post(
+    '/users/:id/vocab-lesson-progress/mark-complete-through',
+    authenticate,
+    adminController.markUserVocabLessonsCompleteThrough
+);
+router.get('/vocab/courses/:courseId', authenticate, adminController.getVocabCourseForAdmin);
 router.get('/users/:id', authenticate, adminController.getUser);
 router.put('/users/:id', authenticate, adminController.updateUser);
 
@@ -43,15 +52,26 @@ router.post('/contacts/answer', authenticate, adminController.answerContact);
 router.post('/falukant/searchuser', authenticate, adminController.searchUser);
 router.get('/falukant/getuser/:id', authenticate, adminController.getFalukantUserById);
 router.post('/falukant/edituser', authenticate, adminController.changeFalukantUser);
+router.get('/falukant/character/:characterId/potential-fathers', authenticate, adminController.adminGetPotentialFathersForCharacter);
+router.post('/falukant/character/force-pregnancy', authenticate, adminController.adminForceFalukantPregnancy);
+router.post('/falukant/character/clear-pregnancy', authenticate, adminController.adminClearFalukantPregnancy);
+router.post('/falukant/character/force-birth', authenticate, adminController.adminForceFalukantBirth);
+router.post('/falukant/character/:characterId/death-cleanup', authenticate, adminController.adminCleanupCharacterDeathArtifacts);
 router.get('/falukant/branches/:falukantUserId', authenticate, adminController.getFalukantUserBranches);
 router.put('/falukant/stock/:stockId', authenticate, adminController.updateFalukantStock);
 router.post('/falukant/stock', authenticate, adminController.addFalukantStock);
 router.get('/falukant/stock-types', authenticate, adminController.getFalukantStockTypes);
+router.get('/falukant/region-types', authenticate, adminController.getFalukantRegionTypes);
 router.get('/falukant/regions', authenticate, adminController.getFalukantRegions);
+router.get('/falukant/regions/all', authenticate, adminController.getFalukantAllRegions);
+router.post('/falukant/regions', authenticate, adminController.createFalukantRegion);
 router.put('/falukant/regions/:id/map', authenticate, adminController.updateFalukantRegionMap);
 router.get('/falukant/region-distances', authenticate, adminController.getRegionDistances);
 router.post('/falukant/region-distances', authenticate, adminController.upsertRegionDistance);
 router.delete('/falukant/region-distances/:id', authenticate, adminController.deleteRegionDistance);
+router.get('/moderation/reports', authenticate, moderationController.listReports);
+router.get('/moderation/reports/open-count', authenticate, moderationController.getOpenReportCount);
+router.post('/moderation/reports/:reportId/status', authenticate, moderationController.updateReportStatus);
 router.post('/falukant/npcs/create', authenticate, adminController.createNPCs);
 router.get('/falukant/npcs/status/:jobId', authenticate, adminController.getNPCsCreationStatus);
 router.get('/falukant/titles', authenticate, adminController.getTitlesOfNobility);

backend/routers/authRouter.js

@@ -9,8 +9,15 @@ router.post('/register', authController.register);
 router.post('/login', authController.login);
 router.post('/forgot-password', authController.forgotPassword);
 router.post('/activate', authController.activateAccount);
+router.get('/oauth/providers', authController.oauthProviders);
+router.get('/oauth/:provider/start', authController.oauthStart);
+router.post('/oauth/exchange', authController.oauthExchange);
 
 // Geschützte Routen (Authentifizierung erforderlich)
 router.get('/logout', authController.logout);
+router.get('/oauth/user/identities', authController.oauthUserIdentities);
+router.get('/oauth/user/:provider/start', authController.oauthUserStart);
+router.post('/oauth/user/exchange', authController.oauthUserExchange);
+router.delete('/oauth/user/:identityId', authController.oauthUserRemove);
 
 export default router;

backend/routers/chatRouter.js

@@ -18,5 +18,6 @@ router.get('/rooms', authenticate, chatController.getRoomList);
 router.get('/room-create-options', authenticate, chatController.getRoomCreateOptions);
 router.get('/my-rooms', authenticate, chatController.getOwnRooms);
 router.delete('/my-rooms/:id', authenticate, chatController.deleteOwnRoom);
+router.post('/report', chatController.reportChatIncident);
 
 export default router;

backend/routers/falukantRouter.js

@@ -22,10 +22,12 @@ router.post('/production', falukantController.createProduction);
 router.get('/production/:branchId', falukantController.getProduction);
 router.get('/stocktypes', falukantController.getStockTypes);
 router.get('/stockoverview', falukantController.getStockOverview);
-router.get('/stock/?:branchId', falukantController.getStock);
+router.get('/stock', falukantController.getStock);
+router.get('/stock/:branchId', falukantController.getStock);
 router.post('/stock', falukantController.createStock);
 router.get('/products', falukantController.getProducts);
-router.get('/inventory/?:branchId', falukantController.getInventory);
+router.get('/inventory', falukantController.getInventory);
+router.get('/inventory/:branchId', falukantController.getInventory);
 router.post('/sell/all', falukantController.sellAllProducts);
 router.post('/sell', falukantController.sellProduct);
 router.post('/moneyhistory', falukantController.moneyHistory);
@@ -52,6 +54,7 @@ router.post('/family/marriage/spend-time', falukantController.spendTimeWithSpous
 router.post('/family/marriage/gift', falukantController.giftToSpouse);
 router.post('/family/marriage/reconcile', falukantController.reconcileMarriage);
 router.post('/family/lover/:relationshipId/maintenance', falukantController.setLoverMaintenance);
+router.post('/family/lover/:relationshipId/improve-affection', falukantController.improveLoverAffection);
 router.post('/family/lover/:relationshipId/acknowledge', falukantController.acknowledgeLover);
 router.post('/family/lover/:relationshipId/end', falukantController.endLoverRelationship);
 router.get('/heirs/potential', falukantController.getPotentialHeirs);
@@ -93,6 +96,13 @@ router.post('/nobility', falukantController.advanceNobility);
 router.get('/health', falukantController.getHealth);
 router.post('/health', falukantController.healthActivity);
 router.get('/politics/overview', falukantController.getPoliticsOverview);
+router.get('/politics/offices', falukantController.getPoliticalOfficeCatalog);
+router.get('/politics/my-powers', falukantController.getPoliticalMyPowers);
+router.get('/politics/tax-jurisdiction', falukantController.getPoliticalTaxJurisdiction);
+router.put('/politics/region/:regionId/tax', falukantController.setPoliticalRegionTax);
+router.get('/politics/region/:regionId/tax-history', falukantController.getPoliticalRegionTaxHistory);
+router.get('/politics/appointable-offices', falukantController.getPoliticalAppointableOffices);
+router.post('/politics/appointments', falukantController.createPoliticalAppointment);
 router.get('/politics/open', falukantController.getOpenPolitics);
 router.post('/politics/open', falukantController.applyForElections);
 router.get('/politics/elections', falukantController.getElections);

backend/routers/moderationRouter.js

@@ -0,0 +1,10 @@
+import express from 'express';
+import { authenticate } from '../middleware/authMiddleware.js';
+import moderationController from '../controllers/moderationController.js';
+
+const router = express.Router();
+
+router.use(authenticate);
+router.post('/reports', moderationController.createReport);
+
+export default router;

backend/routers/socialnetworkRouter.js

@@ -17,12 +17,15 @@ router.get('/folder/:folderId', socialNetworkController.getFolderImageList);
 router.post('/images', upload.single('image'), socialNetworkController.uploadImage);
 router.post('/erotic/folders/:folderId', socialNetworkController.createAdultFolder);
 router.get('/erotic/folders', socialNetworkController.getAdultFolders);
+router.get('/profile/erotic/folders/:username', socialNetworkController.getAdultFoldersByUsername);
+router.get('/profile/erotic/videos/:username', socialNetworkController.getEroticVideosByUsername);
 router.get('/erotic/folder/:folderId', socialNetworkController.getAdultFolderImageList);
 router.post('/erotic/images', upload.single('image'), socialNetworkController.uploadAdultImage);
 router.put('/erotic/images/:imageId', socialNetworkController.changeAdultImage);
 router.get('/erotic/image/:hash', socialNetworkController.getAdultImageByHash);
 router.get('/erotic/videos', socialNetworkController.listEroticVideos);
 router.post('/erotic/videos', upload.single('video'), socialNetworkController.uploadEroticVideo);
+router.put('/erotic/videos/:videoId', socialNetworkController.changeEroticVideo);
 router.get('/erotic/video/:hash', socialNetworkController.getEroticVideoByHash);
 router.post('/erotic/report', socialNetworkController.reportEroticContent);
 router.get('/images/:imageId', socialNetworkController.getImage);

backend/routers/vocabRouter.js

@@ -7,6 +7,8 @@ const vocabController = new VocabController();
 
 router.use(authenticate);
 
+router.get('/dashboard-widget', vocabController.getDashboardLearningSummary);
+
 router.get('/languages', vocabController.listLanguages);
 router.get('/languages/all', vocabController.listAllLanguages);
 router.post('/languages', vocabController.createLanguage);
@@ -18,19 +20,26 @@ router.get('/languages/:languageId/chapters', vocabController.listChapters);
 router.post('/languages/:languageId/chapters', vocabController.createChapter);
 router.get('/languages/:languageId/vocabs', vocabController.listLanguageVocabs);
 router.get('/languages/:languageId/search', vocabController.searchVocabs);
+router.get('/languages/:languageId/dictionary', vocabController.getLanguageDictionary);
 
 router.get('/chapters/:chapterId', vocabController.getChapter);
 router.get('/chapters/:chapterId/vocabs', vocabController.listChapterVocabs);
 router.post('/chapters/:chapterId/vocabs', vocabController.addVocabToChapter);
+router.get('/lessons/:lessonId/vocab-pool', vocabController.getLessonVocabPool);
 
 // Courses
 router.post('/courses', vocabController.createCourse);
 router.get('/courses', vocabController.getCourses);
 router.get('/courses/my', vocabController.getMyCourses);
 router.post('/courses/find-by-code', vocabController.getCourseByShareCode);
+router.get('/courses/:courseId/completed-lesson-vocabs', vocabController.getCompletedLessonVocabPool);
+router.get('/courses/:courseId/dictionary', vocabController.getCourseDictionary);
+router.get('/courses/:courseId/distractor-pool', vocabController.getVocabDistractorPool);
+router.get('/courses/:courseId/srs/due', vocabController.getCourseSrsDue);
 router.get('/courses/:courseId', vocabController.getCourse);
 router.put('/courses/:courseId', vocabController.updateCourse);
 router.delete('/courses/:courseId', vocabController.deleteCourse);
+router.post('/srs/review', vocabController.reviewSrsItem);
 
 // Lessons
 router.post('/courses/:courseId/lessons', vocabController.addLessonToCourse);
@@ -45,6 +54,7 @@ router.delete('/courses/:courseId/enroll', vocabController.unenrollFromCourse);
 router.get('/courses/:courseId/progress', vocabController.getCourseProgress);
 router.get('/lessons/:lessonId', vocabController.getLesson);
 router.put('/lessons/:lessonId/progress', vocabController.updateLessonProgress);
+router.delete('/lessons/:lessonId/progress', vocabController.resetLessonProgress);
 
 // Grammar Exercises
 router.get('/grammar/exercise-types', vocabController.getExerciseTypes);
@@ -58,4 +68,3 @@ router.put('/grammar-exercises/:exerciseId', vocabController.updateGrammarExerci
 router.delete('/grammar-exercises/:exerciseId', vocabController.deleteGrammarExercise);
 
 export default router;
-