gdpr audit implemented, email log, vollmachten, pdf delete cancel data privacy and vollmachten, removed message no id card in engergy car, and other contracts that are not telecom contracts, added insert counter for engery

backend/src/controllers/contract.controller.ts

@@ -3,6 +3,7 @@ import { PrismaClient } from '@prisma/client';
 import * as contractService from '../services/contract.service.js';
 import * as contractCockpitService from '../services/contractCockpit.service.js';
 import * as contractHistoryService from '../services/contractHistory.service.js';
+import * as authorizationService from '../services/authorization.service.js';
 import { ApiResponse, AuthRequest } from '../types/index.js';
 
 const prisma = new PrismaClient();
@@ -20,11 +21,19 @@ export async function getContracts(req: AuthRequest, res: Response): Promise<voi
       return;
     }
 
-    // Für Kundenportal-Benutzer: nur eigene + vertretene Kunden-Verträge anzeigen
+    // Für Kundenportal-Benutzer: nur eigene + vertretene Kunden MIT Vollmacht
     let customerIds: number[] | undefined;
     if (req.user?.isCustomerPortal && req.user.customerId) {
-      // Eigene Customer-ID + alle vertretenen Kunden-IDs
-      customerIds = [req.user.customerId, ...(req.user.representedCustomerIds || [])];
+      // Eigene Customer-ID immer
+      customerIds = [req.user.customerId];
+      // Vertretene Kunden nur wenn Vollmacht erteilt
+      const representedIds: number[] = req.user.representedCustomerIds || [];
+      for (const repCustId of representedIds) {
+        const hasAuth = await authorizationService.hasAuthorization(repCustId, req.user.customerId);
+        if (hasAuth) {
+          customerIds.push(repCustId);
+        }
+      }
     }
 
     const result = await contractService.getAllContracts({
@@ -60,9 +69,16 @@ export async function getContract(req: AuthRequest, res: Response): Promise<void
       return;
     }
 
-    // Für Kundenportal-Benutzer: Zugriff nur auf eigene + vertretene Kunden-Verträge
+    // Für Kundenportal-Benutzer: Zugriff nur auf eigene + vertretene Kunden MIT Vollmacht
     if (req.user?.isCustomerPortal && req.user.customerId) {
-      const allowedCustomerIds = [req.user.customerId, ...(req.user.representedCustomerIds || [])];
+      const allowedCustomerIds = [req.user.customerId];
+      const representedIds: number[] = req.user.representedCustomerIds || [];
+      for (const repCustId of representedIds) {
+        const hasAuth = await authorizationService.hasAuthorization(repCustId, req.user.customerId);
+        if (hasAuth) {
+          allowedCustomerIds.push(repCustId);
+        }
+      }
       if (!allowedCustomerIds.includes(contract.customerId)) {
         res.status(403).json({
           success: false,