Ergänzung Datenschutzerklärung und Impressum, Fristenformular in Einstellungen

backend/app/routers/sharing.py

@@ -40,10 +40,17 @@ from app.security import (
 
 router = APIRouter(tags=["sharing"])
 
+# Vorgabewert; maßgeblich ist die Einstellung in der Verwaltung.
 INVITE_DAYS = 14
 MAX_OPEN_INVITES = 50
 
 
+def _invite_days(db) -> int:
+    from app.runtime_settings import get_duration
+
+    return get_duration(db, "invite_days")
+
+
 def _status(invite: ListInvite) -> str:
     if invite.revoked_at:
         return "revoked"
@@ -78,8 +85,13 @@ def _guard_invite_rate(db: DbSession, request: Request, list_id: str) -> None:
     unerwünschte Mails missbrauchen - jede Einladung erzeugt schließlich
     eine Nachricht an eine frei wählbare Adresse.
     """
-    ok_list = check_rate_limit(db, f"invite-list:{list_id}", limit=20, window_minutes=60)
-    ok_ip = check_rate_limit(db, f"invite-ip:{client_ip(request)}", limit=30, window_minutes=60)
+    ok_list = check_rate_limit(
+        db, bucket_key(db, "invite-list", list_id), limit=20, window_minutes=60
+    )
+    ok_ip = check_rate_limit(
+        db, bucket_key(db, "invite-ip", client_ip(request)),
+        limit=30, window_minutes=60,
+    )
     if not (ok_list and ok_ip):
         db.commit()
         raise HTTPException(
@@ -159,6 +171,7 @@ def create_invite(
     ).all():
         old.revoked_at = utcnow()
 
+    valid_days = _invite_days(db)
     raw = new_token()
     invite = ListInvite(
         list_id=lst.id,
@@ -166,7 +179,7 @@ def create_invite(
         role=payload.role,
         token_hash=hash_token(raw),
         invited_by=user.id,
-        expires_at=utcnow() + timedelta(days=INVITE_DAYS),
+        expires_at=utcnow() + timedelta(days=valid_days),
     )
     db.add(invite)
     db.commit()
@@ -174,7 +187,7 @@ def create_invite(
 
     background.add_task(
         send_invitation, email, raw,
-        lst.name, user.display_name or user.email.split("@")[0], INVITE_DAYS,
+        lst.name, user.display_name or user.email.split("@")[0], valid_days,
     )
     return _invite_out(invite)
 
@@ -204,10 +217,11 @@ def resend_invite(
 
     _guard_invite_rate(db, request, lst.id)
 
+    valid_days = _invite_days(db)
     raw = new_token()
     invite.token_hash = hash_token(raw)
     invite.revoked_at = None
-    invite.expires_at = utcnow() + timedelta(days=INVITE_DAYS)
+    invite.expires_at = utcnow() + timedelta(days=valid_days)
     invite.last_sent_at = utcnow()
     invite.send_count += 1
     db.commit()
@@ -215,7 +229,7 @@ def resend_invite(
 
     background.add_task(
         send_invitation, invite.email, raw,
-        lst.name, user.display_name or user.email.split("@")[0], INVITE_DAYS,
+        lst.name, user.display_name or user.email.split("@")[0], valid_days,
     )
     return _invite_out(invite)