V 2.1.0 Verbesserungen von Claude Code eingeügt

app/api/werte/[id]/route.ts

@@ -13,17 +13,29 @@ export async function PUT(
     const body: CreateWerteEntry = await request.json();
     
     const sql = `UPDATE ${TABLE} SET
-      Datum = '${body.Datum}',
+      Datum = ?,
-      Zeit = '${body.Zeit}',
+      Zeit = ?,
-      Zucker = ${body.Zucker || 'NULL'},
+      Zucker = ?,
-      Essen = ${body.Essen ? `'${body.Essen.replace(/'/g, "''")}'` : 'NULL'},
+      Essen = ?,
-      Gewicht = ${body.Gewicht || 'NULL'},
+      Gewicht = ?,
-      DruckS = ${body.DruckS || 'NULL'},
+      DruckS = ?,
-      DruckD = ${body.DruckD || 'NULL'},
+      DruckD = ?,
-      Puls = ${body.Puls || 'NULL'}
+      Puls = ?
-      WHERE ID = ${parseInt(id, 10)}`;
+      WHERE ID = ?`;
 
-    const result = await query(sql);
+    const params = [
+      body.Datum,
+      body.Zeit,
+      body.Zucker || null,
+      body.Essen || null,
+      body.Gewicht ? parseFloat(parseFloat(String(body.Gewicht)).toFixed(1)) : null,
+      body.DruckS || null,
+      body.DruckD || null,
+      body.Puls || null,
+      parseInt(id, 10),
+    ];
+
+    const result = await query(sql, params);
     
     return NextResponse.json({ success: true, data: result });
   } catch (error) {
@@ -42,8 +54,8 @@ export async function DELETE(
   try {
     const { id } = await context.params;
     
-    const sql = `DELETE FROM ${TABLE} WHERE ID = ${parseInt(id, 10)}`;
+    const sql = `DELETE FROM ${TABLE} WHERE ID = ?`;
-    const result = await query(sql);
+    const result = await query(sql, [parseInt(id, 10)]);
     
     return NextResponse.json({ success: true, data: result });
   } catch (error) {

app/api/werte/route.ts

@@ -16,10 +16,10 @@ export async function GET(request: NextRequest) {
     let params: (string | number)[] = [];
 
     if (from && to) {
-      sql = `SELECT ID, DATE_FORMAT(Datum, '%Y-%m-%d') as Datum, Zeit, Zucker, Essen, Gewicht, DruckD, DruckS, Puls FROM ${TABLE} WHERE Datum BETWEEN ? AND ? ORDER BY Datum ASC, Zeit ASC`;
+      sql = `SELECT ID, DATE_FORMAT(Datum, '%Y-%m-%d') as Datum, Zeit, Zucker, Essen, Gewicht, DruckS, DruckD, Puls FROM ${TABLE} WHERE Datum BETWEEN ? AND ? ORDER BY Datum ASC, Zeit ASC`;
       params = [from, to];
     } else {
-      sql = `SELECT ID, DATE_FORMAT(Datum, '%Y-%m-%d') as Datum, Zeit, Zucker, Essen, Gewicht, DruckD, DruckS, Puls FROM ${TABLE} ORDER BY Datum DESC, Zeit DESC LIMIT ${limit}`;
+      sql = `SELECT ID, DATE_FORMAT(Datum, '%Y-%m-%d') as Datum, Zeit, Zucker, Essen, Gewicht, DruckS, DruckD, Puls FROM ${TABLE} ORDER BY Datum DESC, Zeit DESC LIMIT ${limit}`;
     }
 
     const rows = await query(sql, params);
@@ -55,7 +55,7 @@ export async function POST(request: NextRequest) {
       body.Zeit,
       body.Zucker || null,
       body.Essen || null,
-      body.Gewicht || null,
+      body.Gewicht ? parseFloat(parseFloat(String(body.Gewicht)).toFixed(1)) : null,
       body.DruckS || null,
       body.DruckD || null,
       body.Puls || null,

app/login/actions.ts

@@ -12,7 +12,7 @@ export async function login(prevState: any, formData: FormData) {
     return { error: 'Bitte Benutzername und Passwort eingeben' };
   }
 
-  const isValid = verifyCredentials(username, password);
+  const isValid = await verifyCredentials(username, password);
 
   if (!isValid) {
     return { error: 'Ungültige Anmeldedaten' };

app/page.tsx

@@ -25,6 +25,7 @@ export default function Home() {
             'Cache-Control': 'no-cache',
           },
         });
+        if (!response.ok) throw new Error(`HTTP ${response.status}`);
         const data = await response.json();
         if (data.success && isMounted) {
           setEntries(data.data);
@@ -50,6 +51,7 @@ export default function Home() {
           'Cache-Control': 'no-cache',
         },
       });
+      if (!response.ok) throw new Error(`HTTP ${response.status}`);
       const data = await response.json();
       if (data.success) {
         setEntries(data.data);

components/ChartsClient.tsx

@@ -82,6 +82,7 @@ export default function ChartsClient() {
         cache: 'no-store',
         headers: { 'Cache-Control': 'no-cache' },
       });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
       const data = await res.json();
       if (data.success) {
         setEntries(data.data);

components/WerteForm.tsx

@@ -197,9 +197,10 @@ export default function WerteForm({ onSuccess, selectedEntry }: WerteFormProps)
                 <input
                   type="number"
                   className="w-20 px-2 py-1 text-sm rounded border-2 border-gray-400 bg-white focus:border-blue-500 focus:outline-none [appearance:textfield] [&::-webkit-outer-spin-button]:appearance-none [&::-webkit-inner-spin-button]:appearance-none"
+                  min={0}
+                  max={999}
                   value={formData.Zucker}
                   onChange={(e) => setFormData(prev => ({ ...prev, Zucker: e.target.value }))}
-                  maxLength={4}
                 />
               </td>
               <td className="p-2">
@@ -216,36 +217,40 @@ export default function WerteForm({ onSuccess, selectedEntry }: WerteFormProps)
                   type="number"
                   step="0.1"
                   className="w-20 px-2 py-1 text-sm rounded border-2 border-gray-400 bg-white focus:border-blue-500 focus:outline-none [appearance:textfield] [&::-webkit-outer-spin-button]:appearance-none [&::-webkit-inner-spin-button]:appearance-none"
+                  min={0}
+                  max={300}
                   value={formData.Gewicht}
                   onChange={(e) => setFormData(prev => ({ ...prev, Gewicht: e.target.value }))}
-                  maxLength={4}
                 />
               </td>
               <td className="p-2">
                 <input
                   type="number"
                   className="w-20 px-2 py-1 text-sm rounded border-2 border-gray-400 bg-white focus:border-blue-500 focus:outline-none [appearance:textfield] [&::-webkit-outer-spin-button]:appearance-none [&::-webkit-inner-spin-button]:appearance-none"
+                  min={0}
+                  max={300}
                   value={formData.DruckS}
                   onChange={(e) => setFormData(prev => ({ ...prev, DruckS: e.target.value }))}
-                  maxLength={4}
                 />
               </td>
               <td className="p-2">
                 <input
                   type="number"
                   className="w-20 px-2 py-1 text-sm rounded border-2 border-gray-400 bg-white focus:border-blue-500 focus:outline-none [appearance:textfield] [&::-webkit-outer-spin-button]:appearance-none [&::-webkit-inner-spin-button]:appearance-none"
+                  min={0}
+                  max={200}
                   value={formData.DruckD}
                   onChange={(e) => setFormData(prev => ({ ...prev, DruckD: e.target.value }))}
-                  maxLength={4}
                 />
               </td>
               <td className="p-2">
                 <input
                   type="number"
                   className="w-20 px-2 py-1 text-sm rounded border-2 border-gray-400 bg-white focus:border-blue-500 focus:outline-none [appearance:textfield] [&::-webkit-outer-spin-button]:appearance-none [&::-webkit-inner-spin-button]:appearance-none"
+                  min={0}
+                  max={250}
                   value={formData.Puls}
                   onChange={(e) => setFormData(prev => ({ ...prev, Puls: e.target.value }))}
-                  maxLength={4}
                 />
               </td>
             </tr>

lib/auth.ts

@@ -1,20 +1,10 @@
-/**
+import bcrypt from 'bcryptjs';
- * Reusable authentication library
- * Configure users via environment variables in .env:
- * AUTH_USERS=user1:$2a$10$hash1,user2:$2a$10$hash2
- * 
- * Use scripts/generate-password.js to generate password hashes
- */
 
 export interface User {
   username: string;
   password: string;
 }
 
-/**
- * Parse users from environment variable
- * Format: username:password,username2:password2
- */
 export function getUsers(): User[] {
   const usersString = process.env.AUTH_USERS || '';
   if (!usersString) {
@@ -30,21 +20,15 @@ export function getUsers(): User[] {
     .filter((user) => user.username && user.password);
 }
 
-/**
+export async function verifyCredentials(username: string, password: string): Promise<boolean> {
- * Verify user credentials
- */
-export function verifyCredentials(username: string, password: string): boolean {
   const users = getUsers();
   const user = users.find(u => u.username === username);
   if (!user) {
     return false;
   }
-  return user.password === password;
+  return bcrypt.compare(password, user.password);
 }
 
-/**
- * Check if authentication is enabled
- */
 export function isAuthEnabled(): boolean {
   return !!process.env.AUTH_USERS;
 }

lib/db.ts

@@ -4,8 +4,8 @@ import type { QueryResult } from 'mysql2/promise';
 // Database configuration
 const dbConfig = {
   host: process.env.DB_HOST || 'mydbase_mysql',
-  user: process.env.DB_USER || 'root',
+  user: process.env.DB_USER,
-  password: process.env.DB_PASS || 'SFluorit',
+  password: process.env.DB_PASS,
   database: process.env.DB_NAME || 'RXF',
   waitForConnections: true,
   connectionLimit: 10,

next.config.ts

@@ -6,6 +6,20 @@ const nextConfig: NextConfig = {
   turbopack: {
     root: path.resolve(__dirname),
   },
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: [
+          { key: 'X-Frame-Options', value: 'DENY' },
+          { key: 'X-Content-Type-Options', value: 'nosniff' },
+          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+          { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
+          { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
+        ],
+      },
+    ];
+  },
 };
 
 export default nextConfig;

package-lock.json

@@ -1,13 +1,14 @@
 {
   "name": "werte_next",
-  "version": "1.2.0",
+  "version": "2.0.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "werte_next",
-      "version": "1.2.0",
+      "version": "2.0.3",
       "dependencies": {
+        "bcryptjs": "^3.0.3",
         "highcharts": "^12.5.0",
         "highcharts-react-official": "^3.2.3",
         "jose": "^6.1.3",
@@ -18,6 +19,7 @@
       },
       "devDependencies": {
         "@tailwindcss/postcss": "^4",
+        "@types/bcryptjs": "^2.4.6",
         "@types/node": "^20",
         "@types/react": "^19",
         "@types/react-dom": "^19",
@@ -1529,6 +1531,13 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@types/bcryptjs": {
+      "version": "2.4.6",
+      "resolved": "https://registry.npmjs.org/@types/bcryptjs/-/bcryptjs-2.4.6.tgz",
+      "integrity": "sha512-9xlo6R2qDs5uixm0bcIqCeMCE6HiQsIyel9KQySStiyqNl2tnj2mP3DX1Nf56MD6KMenNNlBBsy3LJ7gUEQPXQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/estree": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
@@ -2461,6 +2470,15 @@
         "node": ">=6.0.0"
       }
     },
+    "node_modules/bcryptjs": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/bcryptjs/-/bcryptjs-3.0.3.tgz",
+      "integrity": "sha512-GlF5wPWnSa/X5LKM1o0wz0suXIINz1iHRLvTS+sLyi7XPbe5ycmYI3DlZqVGZZtDgl4DmasFg7gOB3JYbphV5g==",
+      "license": "BSD-3-Clause",
+      "bin": {
+        "bcrypt": "bin/bcrypt"
+      }
+    },
     "node_modules/brace-expansion": {
       "version": "1.1.12",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "werte_next",
-  "version": "2.0.3",
+  "version": "2.1.0",
   "private": true,
   "scripts": {
     "dev": "next dev",
@@ -9,6 +9,7 @@
     "lint": "eslint"
   },
   "dependencies": {
+    "bcryptjs": "^3.0.3",
     "highcharts": "^12.5.0",
     "highcharts-react-official": "^3.2.3",
     "jose": "^6.1.3",
@@ -19,6 +20,7 @@
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4",
+    "@types/bcryptjs": "^2.4.6",
     "@types/node": "^20",
     "@types/react": "^19",
     "@types/react-dom": "^19",