From babc55e7814d30a2ba0ec2eebf9900f7bc0fd80c Mon Sep 17 00:00:00 2001
From: Florian Wilde <wilde.florian@gmail.com>
Date: Sat, 18 Jul 2026 02:08:03 +0200
Subject: [PATCH] =?UTF-8?q?Rezeptvorschl=C3=A4ge:=20=C3=B6ffentliches=20Fo?=
 =?UTF-8?q?rmular=20+=20Sichtung=20im=20Kantinen-Bereich?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Nicht angemeldete Besucher können unter /vorschlag ein fehlendes
Gericht vorschlagen (Name + optionale Beschreibung); Dublettenprüfung
gegen bestehende Gerichte, einfacher Honeypot gegen Bot-Spam. Staff/
Admin sichten eingereichte Vorschläge unter /intern/vorschlaege und
übernehmen sie als Gericht oder lehnen sie ab.
---
 app/intern/vorschlaege/page.tsx |   5 ++
 app/vorschlag/page.tsx          |   5 ++
 components/SuggestionForm.tsx   | 132 ++++++++++++++++++++++++++++++
 components/SuggestionReview.tsx | 137 ++++++++++++++++++++++++++++++++
 4 files changed, 279 insertions(+)
 create mode 100644 app/intern/vorschlaege/page.tsx
 create mode 100644 app/vorschlag/page.tsx
 create mode 100644 components/SuggestionForm.tsx
 create mode 100644 components/SuggestionReview.tsx

diff --git a/app/intern/vorschlaege/page.tsx b/app/intern/vorschlaege/page.tsx
new file mode 100644
index 0000000..d07475e
--- /dev/null
+++ b/app/intern/vorschlaege/page.tsx
@@ -0,0 +1,5 @@
+import SuggestionReview from "@/components/SuggestionReview";
+
+export default function VorschlaegePage() {
+  return <SuggestionReview />;
+}
diff --git a/app/vorschlag/page.tsx b/app/vorschlag/page.tsx
new file mode 100644
index 0000000..91c4d6e
--- /dev/null
+++ b/app/vorschlag/page.tsx
@@ -0,0 +1,5 @@
+import SuggestionForm from "@/components/SuggestionForm";
+
+export default function VorschlagPage() {
+  return <SuggestionForm />;
+}
diff --git a/components/SuggestionForm.tsx b/components/SuggestionForm.tsx
new file mode 100644
index 0000000..390f0b3
--- /dev/null
+++ b/components/SuggestionForm.tsx
@@ -0,0 +1,132 @@
+"use client";
+
+import { useState } from "react";
+import Link from "next/link";
+import { createClient } from "@/lib/supabase/client";
+import { formatMessage } from "@/lib/i18n/shared";
+import { useDict } from "@/components/i18n/LocaleProvider";
+import LanguageSwitcher from "@/components/i18n/LanguageSwitcher";
+
+export default function SuggestionForm() {
+  const supabase = createClient();
+  const dict = useDict();
+  const [name, setName] = useState("");
+  const [description, setDescription] = useState("");
+  // Honeypot: für echte Nutzer unsichtbares Feld. Füllt ein Bot es aus,
+  // tun wir so, als sei alles gut gegangen, ohne wirklich zu speichern.
+  const [website, setWebsite] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [success, setSuccess] = useState(false);
+  const [busy, setBusy] = useState(false);
+
+  async function submit(e: React.FormEvent) {
+    e.preventDefault();
+    setError(null);
+    const trimmedName = name.trim();
+    if (!trimmedName) {
+      setError(dict.suggestions.nameRequired);
+      return;
+    }
+    if (website.trim()) {
+      // Bot-Falle ausgelöst: keine echte Anfrage, aber Erfolg vortäuschen.
+      setSuccess(true);
+      return;
+    }
+    setBusy(true);
+
+    const { data: existing } = await supabase
+      .from("dishes")
+      .select("id")
+      .ilike("name", trimmedName)
+      .limit(1);
+    if (existing && existing.length > 0) {
+      setError(dict.suggestions.duplicate);
+      setBusy(false);
+      return;
+    }
+
+    const { error: insertError } = await supabase.from("dish_suggestions").insert({
+      name: trimmedName,
+      description: description.trim() || null,
+    });
+    if (insertError) {
+      setError(formatMessage(dict.suggestions.genericError, { message: insertError.message }));
+      setBusy(false);
+      return;
+    }
+    setSuccess(true);
+    setBusy(false);
+  }
+
+  return (
+    <div className="flex-1 flex items-center justify-center p-4">
+      <div className="card w-full max-w-md">
+        <div className="flex justify-between items-center mb-1">
+          <h1 className="text-xl font-bold text-[var(--c-primary)]">
+            {dict.suggestions.formTitle}
+          </h1>
+          <LanguageSwitcher variant="light" />
+        </div>
+        <p className="text-sm text-gray-600 mb-4">{dict.suggestions.formHint}</p>
+
+        {success ? (
+          <p className="text-sm text-green-700">{dict.suggestions.success}</p>
+        ) : (
+          <form onSubmit={submit} className="space-y-3">
+            <div>
+              <label className="label" htmlFor="suggestion-name">
+                {dict.suggestions.nameLabel}
+              </label>
+              <input
+                id="suggestion-name"
+                className="input"
+                value={name}
+                onChange={(e) => setName(e.target.value)}
+                required
+              />
+            </div>
+            <div>
+              <label className="label" htmlFor="suggestion-description">
+                {dict.suggestions.descriptionLabel}
+              </label>
+              <textarea
+                id="suggestion-description"
+                className="input"
+                rows={3}
+                value={description}
+                onChange={(e) => setDescription(e.target.value)}
+              />
+            </div>
+            {/* Honeypot – für Menschen unsichtbar, keine echten Nutzerdaten */}
+            <div className="absolute -left-[9999px]" aria-hidden="true">
+              <label htmlFor="website">Website</label>
+              <input
+                id="website"
+                name="website"
+                type="text"
+                tabIndex={-1}
+                autoComplete="off"
+                value={website}
+                onChange={(e) => setWebsite(e.target.value)}
+              />
+            </div>
+            {error && (
+              <p className="text-sm text-[var(--c-del)]" role="alert">
+                {error}
+              </p>
+            )}
+            <button type="submit" className="btn btn-primary w-full" disabled={busy}>
+              {busy ? dict.suggestions.submitting : dict.suggestions.submit}
+            </button>
+          </form>
+        )}
+
+        <p className="mt-4 text-center text-sm">
+          <Link href="/" className="text-gray-500 hover:text-[var(--c-primary)]">
+            {dict.suggestions.backToMenu}
+          </Link>
+        </p>
+      </div>
+    </div>
+  );
+}
diff --git a/components/SuggestionReview.tsx b/components/SuggestionReview.tsx
new file mode 100644
index 0000000..17fa909
--- /dev/null
+++ b/components/SuggestionReview.tsx
@@ -0,0 +1,137 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { createClient } from "@/lib/supabase/client";
+import { formatMessage } from "@/lib/i18n/shared";
+import { useDict } from "@/components/i18n/LocaleProvider";
+import type { DishSuggestion } from "@/lib/types";
+
+export default function SuggestionReview() {
+  const supabase = useMemo(() => createClient(), []);
+  const dict = useDict();
+  const [items, setItems] = useState<DishSuggestion[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [info, setInfo] = useState<string | null>(null);
+  const [busyId, setBusyId] = useState<string | null>(null);
+
+  const load = useCallback(async () => {
+    const { data, error } = await supabase
+      .from("dish_suggestions")
+      .select("*")
+      .order("created_at", { ascending: false });
+    if (error)
+      setError(formatMessage(dict.suggestions.loadError, { message: error.message }));
+    else setItems(data as DishSuggestion[]);
+    setLoading(false);
+  }, [supabase, dict]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  async function accept(item: DishSuggestion) {
+    setBusyId(item.id);
+    setError(null);
+    setInfo(null);
+    const { error: insertError } = await supabase.from("dishes").insert({
+      name: item.name,
+      price: 0,
+    });
+    if (insertError) {
+      setError(
+        formatMessage(dict.suggestions.actionError, { message: insertError.message })
+      );
+      setBusyId(null);
+      return;
+    }
+    const { error: deleteError } = await supabase
+      .from("dish_suggestions")
+      .delete()
+      .eq("id", item.id);
+    if (deleteError) {
+      setError(
+        formatMessage(dict.suggestions.actionError, { message: deleteError.message })
+      );
+      setBusyId(null);
+      return;
+    }
+    setInfo(dict.suggestions.accepted);
+    setBusyId(null);
+    await load();
+  }
+
+  async function reject(item: DishSuggestion) {
+    if (!window.confirm(formatMessage(dict.suggestions.confirmReject, { name: item.name })))
+      return;
+    setBusyId(item.id);
+    setError(null);
+    setInfo(null);
+    const { error } = await supabase.from("dish_suggestions").delete().eq("id", item.id);
+    if (error) {
+      setError(formatMessage(dict.suggestions.actionError, { message: error.message }));
+    } else {
+      setInfo(dict.suggestions.rejected);
+    }
+    setBusyId(null);
+    await load();
+  }
+
+  return (
+    <div className="max-w-3xl">
+      <h1 className="text-xl font-bold text-[var(--c-primary)] mb-4">
+        {dict.suggestions.reviewTitle}
+      </h1>
+
+      {error && (
+        <p className="mb-3 text-sm text-[var(--c-del)]" role="alert">
+          {error}
+        </p>
+      )}
+      {info && <p className="mb-3 text-sm text-green-700">{info}</p>}
+
+      {loading ? (
+        <p className="text-gray-500">{dict.common.loading}</p>
+      ) : (
+        <ul className="divide-y divide-gray-200 border border-gray-200 rounded-md bg-white">
+          {items.map((item) => (
+            <li key={item.id} className="flex flex-wrap items-center gap-3 px-4 py-3">
+              <span className="mr-auto">
+                <span className="font-semibold">{item.name}</span>
+                {item.description && (
+                  <span className="block text-sm text-gray-600 mt-0.5">
+                    {item.description}
+                  </span>
+                )}
+                <span className="block text-xs text-gray-400 mt-0.5">
+                  {formatMessage(dict.suggestions.submittedOn, {
+                    date: new Date(item.created_at).toLocaleDateString(dict.dateLocale),
+                  })}
+                </span>
+              </span>
+              <button
+                type="button"
+                className="btn btn-add"
+                onClick={() => accept(item)}
+                disabled={busyId === item.id}
+              >
+                {dict.suggestions.accept}
+              </button>
+              <button
+                type="button"
+                className="btn btn-del"
+                onClick={() => reject(item)}
+                disabled={busyId === item.id}
+              >
+                {dict.suggestions.reject}
+              </button>
+            </li>
+          ))}
+          {items.length === 0 && (
+            <li className="px-4 py-3 text-gray-500">{dict.suggestions.reviewEmpty}</li>
+          )}
+        </ul>
+      )}
+    </div>
+  );
+}