User Management + Didaktisches Handbuch + Stadt-Editor + Emoji-Kacheln

User Management (Backend): - schema-v2.sql: students, licenses, student_results, activity_log Tabellen - auth.php: Lehrer-Registrierung/Login, Schueler-Login, Status-Check - classes.php: CRUD fuer Klassenverwaltung (mit Join-Code-Generator) - students.php: Schueler erstellen (einzeln + Batch), bearbeiten, loeschen - modules.php: Modulfreigabe pro Klasse (locked/free/teacher_started) Didaktisches Handbuch: - handbuch.html: Vollstaendiger Lehrpersonen-Guide - 6 Module detailliert beschrieben (Lernziele, Kompetenzen) - Vor/Nach-Fragen fuer jede Simulation - Empfohlener Unterrichtsablauf (45-min-Einheit) - Differenzierungshinweise, Bewertungsempfehlungen Stadt-Editor: - stadt-editor.html: Funktionierendes 8x8 Raster mit Kachel-Platzierung - 15 Emoji-Gebaude-Kacheln (Kirche, Moschee, Wohngebiet, Fabrik, etc.) - Spielplatz: Rutsche+Karussell statt schwebende Koepfe - Hochhaeuser: 6 Gebaeude in 2 Reihen Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-14 01:52:55 +02:00
parent 32ed869f23
commit 33fae37838
8 changed files with 1582 additions and 43 deletions
@@ -0,0 +1,141 @@
+<?php
+/**
+ * API: Authentifizierung (Lehrer + Schueler)
+ * POST /api/auth {action: "register"|"login"|"logout"|"student_login"|"reset_request"|"reset_confirm"}
+ */
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    Response::error('Nur POST erlaubt', 405);
+}
+
+$body = json_decode(file_get_contents('php://input'), true);
+$action = $body['action'] ?? '';
+$db = Database::get();
+
+// === LEHRER-REGISTRIERUNG ===
+if ($action === 'register') {
+    $email = trim($body['email'] ?? '');
+    $password = $body['password'] ?? '';
+    $displayName = mb_substr(trim($body['displayName'] ?? ''), 0, 128);
+    $schoolName = mb_substr(trim($body['schoolName'] ?? ''), 0, 255);
+
+    if (!$email || !filter_var($email, FILTER_VALIDATE_EMAIL)) Response::error('Gültige E-Mail-Adresse erforderlich');
+    if (strlen($password) < 8) Response::error('Passwort muss mindestens 8 Zeichen lang sein');
+    if (!$displayName) Response::error('Name erforderlich');
+
+    // Pruefen ob E-Mail schon existiert
+    $existing = $db->fetchOne('SELECT id FROM teachers WHERE email = ?', [$email]);
+    if ($existing) Response::error('Diese E-Mail-Adresse ist bereits registriert');
+
+    $username = strtolower(explode('@', $email)[0]) . '_' . rand(100, 999);
+    $hash = password_hash($password, PASSWORD_DEFAULT);
+
+    $db->execute(
+        'INSERT INTO teachers (username, email, password, display_name, school_name) VALUES (?, ?, ?, ?, ?)',
+        [$username, $email, $hash, $displayName, $schoolName]
+    );
+
+    $teacherId = (int)$db->lastInsertId();
+    Session::start();
+    Session::loginTeacher($teacherId);
+
+    Response::ok([
+        'teacherId' => $teacherId,
+        'displayName' => $displayName,
+    ]);
+}
+
+// === LEHRER-LOGIN ===
+if ($action === 'login') {
+    $email = trim($body['email'] ?? '');
+    $password = $body['password'] ?? '';
+
+    if (!$email || !$password) Response::error('E-Mail und Passwort erforderlich');
+
+    $teacher = $db->fetchOne(
+        'SELECT id, password, display_name FROM teachers WHERE email = ? OR username = ?',
+        [$email, $email]
+    );
+
+    if (!$teacher || !password_verify($password, $teacher['password'])) {
+        Response::error('E-Mail oder Passwort falsch');
+    }
+
+    Session::start();
+    Session::loginTeacher((int)$teacher['id']);
+
+    $db->execute(
+        "INSERT INTO activity_log (user_type, user_id, action) VALUES ('teacher', ?, 'login')",
+        [$teacher['id']]
+    );
+
+    Response::ok([
+        'teacherId' => (int)$teacher['id'],
+        'displayName' => $teacher['display_name'],
+    ]);
+}
+
+// === LOGOUT ===
+if ($action === 'logout') {
+    Session::logout();
+    Response::ok();
+}
+
+// === SCHUELER-LOGIN ===
+if ($action === 'student_login') {
+    $classCode = strtoupper(trim($body['classCode'] ?? ''));
+    $username = trim($body['username'] ?? '');
+    $password = $body['password'] ?? '';
+
+    if (!$classCode || !$username || !$password) Response::error('Klassencode, Benutzername und Passwort erforderlich');
+
+    $class = $db->fetchOne('SELECT id FROM classes WHERE join_code = ?', [$classCode]);
+    if (!$class) Response::error('Klasse nicht gefunden');
+
+    $student = $db->fetchOne(
+        'SELECT id, password, display_name FROM students WHERE class_id = ? AND username = ?',
+        [$class['id'], $username]
+    );
+
+    if (!$student || !password_verify($password, $student['password'])) {
+        Response::error('Benutzername oder Passwort falsch');
+    }
+
+    // Schueler-Session erstellen
+    $sessionId = Session::createStudent((int)$class['id'], $student['display_name'] ?: $username);
+
+    $db->execute('UPDATE students SET last_login = NOW() WHERE id = ?', [$student['id']]);
+    $db->execute(
+        "INSERT INTO activity_log (user_type, user_id, action) VALUES ('student', ?, 'login')",
+        [$student['id']]
+    );
+
+    Response::ok([
+        'sessionId' => $sessionId,
+        'studentId' => (int)$student['id'],
+        'displayName' => $student['display_name'] ?: $username,
+        'className' => $class['name'] ?? '',
+    ]);
+}
+
+// === STATUS ===
+if ($action === 'status') {
+    Session::start();
+    $teacherId = Session::teacherId();
+    $studentId = Session::studentId();
+
+    if ($teacherId) {
+        $teacher = $db->fetchOne('SELECT id, display_name, email, school_name FROM teachers WHERE id = ?', [$teacherId]);
+        Response::ok(['role' => 'teacher', 'user' => $teacher]);
+    }
+    if ($studentId) {
+        $session = $db->fetchOne(
+            'SELECT s.display_name, s.class_id, c.name as class_name FROM student_sessions s LEFT JOIN classes c ON c.id = s.class_id WHERE s.id = ?',
+            [$studentId]
+        );
+        Response::ok(['role' => 'student', 'session' => $session]);
+    }
+    Response::ok(['role' => 'guest']);
+}
+
+Response::error('Unbekannte Aktion');
@@ -0,0 +1,80 @@
+<?php
+/**
+ * API: Klassenverwaltung (nur fuer Lehrer)
+ * GET    /api/classes              → Alle Klassen des Lehrers
+ * POST   /api/classes {action}     → Klasse erstellen/bearbeiten/loeschen
+ */
+
+$method = $_SERVER['REQUEST_METHOD'];
+$db = Database::get();
+
+if ($method === 'GET') {
+    $teacherId = Session::requireTeacher();
+    $classes = $db->fetchAll(
+        'SELECT id, name, school_year, join_code, created_at FROM classes WHERE teacher_id = ? ORDER BY created_at DESC',
+        [$teacherId]
+    );
+    // Schueleranzahl pro Klasse
+    foreach ($classes as &$c) {
+        $c['student_count'] = (int)$db->fetchOne(
+            'SELECT COUNT(*) as cnt FROM students WHERE class_id = ?', [$c['id']]
+        )['cnt'];
+    }
+    Response::ok($classes);
+}
+
+if ($method === 'POST') {
+    $teacherId = Session::requireTeacher();
+    $body = json_decode(file_get_contents('php://input'), true);
+    $action = $body['action'] ?? '';
+
+    // === KLASSE ERSTELLEN ===
+    if ($action === 'create') {
+        $name = mb_substr(trim($body['name'] ?? ''), 0, 64);
+        $schoolYear = mb_substr(trim($body['schoolYear'] ?? ''), 0, 10);
+        if (!$name) Response::error('Klassenname erforderlich');
+
+        // Join-Code generieren (6 Zeichen, eindeutig)
+        $chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'; // ohne I,O,0,1 (Verwechslungsgefahr)
+        do {
+            $code = '';
+            for ($i = 0; $i < 6; $i++) $code .= $chars[random_int(0, strlen($chars) - 1)];
+            $exists = $db->fetchOne('SELECT id FROM classes WHERE join_code = ?', [$code]);
+        } while ($exists);
+
+        $db->execute(
+            'INSERT INTO classes (teacher_id, name, school_year, join_code) VALUES (?, ?, ?, ?)',
+            [$teacherId, $name, $schoolYear, $code]
+        );
+        Response::ok(['id' => (int)$db->lastInsertId(), 'joinCode' => $code]);
+    }
+
+    // === KLASSE BEARBEITEN ===
+    if ($action === 'update') {
+        $classId = (int)($body['classId'] ?? 0);
+        $name = mb_substr(trim($body['name'] ?? ''), 0, 64);
+        $schoolYear = mb_substr(trim($body['schoolYear'] ?? ''), 0, 10);
+        if (!$classId || !$name) Response::error('classId und name erforderlich');
+
+        // Sicherstellen dass Klasse dem Lehrer gehoert
+        $class = $db->fetchOne('SELECT id FROM classes WHERE id = ? AND teacher_id = ?', [$classId, $teacherId]);
+        if (!$class) Response::error('Klasse nicht gefunden', 404);
+
+        $db->execute('UPDATE classes SET name = ?, school_year = ? WHERE id = ?', [$name, $schoolYear, $classId]);
+        Response::ok();
+    }
+
+    // === KLASSE LOESCHEN ===
+    if ($action === 'delete') {
+        $classId = (int)($body['classId'] ?? 0);
+        $class = $db->fetchOne('SELECT id FROM classes WHERE id = ? AND teacher_id = ?', [$classId, $teacherId]);
+        if (!$class) Response::error('Klasse nicht gefunden', 404);
+
+        $db->execute('DELETE FROM classes WHERE id = ?', [$classId]);
+        Response::ok();
+    }
+
+    Response::error('Unbekannte Aktion');
+}
+
+Response::error('Methode nicht erlaubt', 405);
@@ -0,0 +1,88 @@
+<?php
+/**
+ * API: Modulfreigabe (Lehrer steuert welche Module Schueler sehen/spielen)
+ * GET  /api/modules?class_id=X     → Modulstatus fuer Klasse
+ * POST /api/modules {action}        → Modul freigeben/sperren/starten
+ */
+
+$method = $_SERVER['REQUEST_METHOD'];
+$db = Database::get();
+
+// Alle verfuegbaren Module
+$ALL_MODULES = [
+    ['id' => 'sim-05', 'name' => 'Klimawächter', 'desc' => 'Treibhauseffekt-Simulation'],
+    ['id' => 'sim-05-3d', 'name' => 'Klimawächter 3D', 'desc' => '3D-Version der Klimasimulation'],
+    ['id' => 'sim-07', 'name' => 'Erdbeben', 'desc' => 'Plattentektonik und Stadtplanung'],
+    ['id' => 'sim-09', 'name' => 'Energiemix', 'desc' => 'Energiewende planen'],
+    ['id' => 'sim-10', 'name' => 'Lieferketten', 'desc' => 'Globale Lieferketten verstehen'],
+    ['id' => 'sim-11', 'name' => 'Regenwald', 'desc' => 'Regenwald-Exploration'],
+    ['id' => 'sim-12', 'name' => 'Flussmanagement', 'desc' => 'Fluss und Hochwasserschutz'],
+    ['id' => 'sim-13', 'name' => 'Stadt & Raumplanung', 'desc' => 'Stadtsimulation mit Kacheln'],
+];
+
+if ($method === 'GET') {
+    $teacherId = Session::requireTeacher();
+    $classId = (int)($_GET['class_id'] ?? 0);
+    if (!$classId) Response::error('class_id erforderlich');
+
+    $class = $db->fetchOne('SELECT id FROM classes WHERE id = ? AND teacher_id = ?', [$classId, $teacherId]);
+    if (!$class) Response::error('Klasse nicht gefunden', 404);
+
+    // Aktuelle Freigaben laden
+    $settings = $db->fetchAll('SELECT module_id, mode, started_at, due_date FROM class_modules WHERE class_id = ?', [$classId]);
+    $settingsMap = [];
+    foreach ($settings as $s) $settingsMap[$s['module_id']] = $s;
+
+    // Mit allen Modulen zusammenfuehren
+    $result = [];
+    foreach ($ALL_MODULES as $mod) {
+        $s = $settingsMap[$mod['id']] ?? null;
+        $result[] = [
+            'id' => $mod['id'],
+            'name' => $mod['name'],
+            'desc' => $mod['desc'],
+            'mode' => $s['mode'] ?? 'locked',
+            'startedAt' => $s['started_at'] ?? null,
+            'dueDate' => $s['due_date'] ?? null,
+        ];
+    }
+    Response::ok($result);
+}
+
+if ($method === 'POST') {
+    $teacherId = Session::requireTeacher();
+    $body = json_decode(file_get_contents('php://input'), true);
+    $action = $body['action'] ?? '';
+    $classId = (int)($body['classId'] ?? 0);
+    $moduleId = $body['moduleId'] ?? '';
+
+    if (!$classId || !$moduleId) Response::error('classId und moduleId erforderlich');
+
+    $class = $db->fetchOne('SELECT id FROM classes WHERE id = ? AND teacher_id = ?', [$classId, $teacherId]);
+    if (!$class) Response::error('Klasse nicht gefunden', 404);
+
+    if ($action === 'set_mode') {
+        $mode = $body['mode'] ?? 'locked';
+        if (!in_array($mode, ['locked', 'free', 'teacher_started'])) Response::error('Ungültiger Modus');
+
+        $dueDate = $body['dueDate'] ?? null;
+
+        $db->execute(
+            'INSERT INTO class_modules (class_id, module_id, enabled, mode, started_at, due_date)
+             VALUES (?, ?, ?, ?, NOW(), ?)
+             ON DUPLICATE KEY UPDATE mode = VALUES(mode), started_at = VALUES(started_at), due_date = VALUES(due_date), enabled = 1',
+            [$classId, $moduleId, 1, $mode, $dueDate]
+        );
+
+        $db->execute(
+            "INSERT INTO activity_log (user_type, user_id, action, detail) VALUES ('teacher', ?, 'set_module_mode', ?)",
+            [$teacherId, "$moduleId → $mode"]
+        );
+
+        Response::ok();
+    }
+
+    Response::error('Unbekannte Aktion');
+}
+
+Response::error('Methode nicht erlaubt', 405);
@@ -0,0 +1,138 @@
+<?php
+/**
+ * API: Schueler-Verwaltung (nur fuer Lehrer)
+ * GET    /api/students?class_id=X   → Alle Schueler einer Klasse
+ * POST   /api/students {action}     → Schueler erstellen/bearbeiten/loeschen
+ */
+
+$method = $_SERVER['REQUEST_METHOD'];
+$db = Database::get();
+
+if ($method === 'GET') {
+    $teacherId = Session::requireTeacher();
+    $classId = (int)($_GET['class_id'] ?? 0);
+    if (!$classId) Response::error('class_id erforderlich');
+
+    // Sicherstellen dass Klasse dem Lehrer gehoert
+    $class = $db->fetchOne('SELECT id FROM classes WHERE id = ? AND teacher_id = ?', [$classId, $teacherId]);
+    if (!$class) Response::error('Klasse nicht gefunden', 404);
+
+    $students = $db->fetchAll(
+        'SELECT id, username, display_name, is_anonymous, created_at, last_login FROM students WHERE class_id = ? ORDER BY username',
+        [$classId]
+    );
+
+    // Letzte Ergebnisse pro Schueler
+    foreach ($students as &$s) {
+        $s['results'] = $db->fetchAll(
+            'SELECT module_id, score, balance_idx, completed_at FROM student_results WHERE student_id = ? ORDER BY completed_at DESC LIMIT 10',
+            [$s['id']]
+        );
+        $s['total_score'] = $db->fetchOne(
+            'SELECT AVG(score) as avg_score, COUNT(*) as count FROM student_results WHERE student_id = ?',
+            [$s['id']]
+        );
+    }
+
+    Response::ok($students);
+}
+
+if ($method === 'POST') {
+    $teacherId = Session::requireTeacher();
+    $body = json_decode(file_get_contents('php://input'), true);
+    $action = $body['action'] ?? '';
+
+    // === SCHUELER ERSTELLEN ===
+    if ($action === 'create') {
+        $classId = (int)($body['classId'] ?? 0);
+        $username = mb_substr(trim($body['username'] ?? ''), 0, 64);
+        $password = $body['password'] ?? '';
+        $displayName = mb_substr(trim($body['displayName'] ?? ''), 0, 128);
+        $isAnonymous = (bool)($body['isAnonymous'] ?? true);
+
+        if (!$classId || !$username || !$password) Response::error('classId, username und password erforderlich');
+        if (strlen($password) < 4) Response::error('Passwort muss mindestens 4 Zeichen lang sein');
+
+        // Klasse pruefen
+        $class = $db->fetchOne('SELECT id FROM classes WHERE id = ? AND teacher_id = ?', [$classId, $teacherId]);
+        if (!$class) Response::error('Klasse nicht gefunden', 404);
+
+        // Username eindeutig in Klasse?
+        $existing = $db->fetchOne('SELECT id FROM students WHERE class_id = ? AND username = ?', [$classId, $username]);
+        if ($existing) Response::error('Benutzername in dieser Klasse bereits vergeben');
+
+        $hash = password_hash($password, PASSWORD_DEFAULT);
+        $db->execute(
+            'INSERT INTO students (class_id, username, password, display_name, is_anonymous) VALUES (?, ?, ?, ?, ?)',
+            [$classId, $username, $hash, $displayName ?: null, $isAnonymous ? 1 : 0]
+        );
+        Response::ok(['id' => (int)$db->lastInsertId()]);
+    }
+
+    // === MEHRERE SCHUELER AUF EINMAL ERSTELLEN ===
+    if ($action === 'create_batch') {
+        $classId = (int)($body['classId'] ?? 0);
+        $count = min(50, max(1, (int)($body['count'] ?? 10)));
+        $prefix = mb_substr(trim($body['prefix'] ?? 'schueler'), 0, 20);
+
+        $class = $db->fetchOne('SELECT id FROM classes WHERE id = ? AND teacher_id = ?', [$classId, $teacherId]);
+        if (!$class) Response::error('Klasse nicht gefunden', 404);
+
+        $created = [];
+        for ($i = 1; $i <= $count; $i++) {
+            $username = $prefix . str_pad($i, 2, '0', STR_PAD_LEFT);
+            // Einfaches Passwort generieren (4 Ziffern)
+            $pw = str_pad(random_int(1000, 9999), 4, '0', STR_PAD_LEFT);
+            $hash = password_hash($pw, PASSWORD_DEFAULT);
+
+            $existing = $db->fetchOne('SELECT id FROM students WHERE class_id = ? AND username = ?', [$classId, $username]);
+            if ($existing) continue; // Ueberspringen wenn schon vorhanden
+
+            $db->execute(
+                'INSERT INTO students (class_id, username, password, display_name, is_anonymous) VALUES (?, ?, ?, ?, 1)',
+                [$classId, $username, $hash, $username]
+            );
+            $created[] = ['username' => $username, 'password' => $pw, 'id' => (int)$db->lastInsertId()];
+        }
+        Response::ok(['created' => $created]);
+    }
+
+    // === SCHUELER BEARBEITEN ===
+    if ($action === 'update') {
+        $studentId = (int)($body['studentId'] ?? 0);
+        $displayName = mb_substr(trim($body['displayName'] ?? ''), 0, 128);
+        $newPassword = $body['newPassword'] ?? '';
+
+        // Schueler + Klasse pruefen
+        $student = $db->fetchOne(
+            'SELECT s.id, s.class_id FROM students s JOIN classes c ON c.id = s.class_id WHERE s.id = ? AND c.teacher_id = ?',
+            [$studentId, $teacherId]
+        );
+        if (!$student) Response::error('Schüler nicht gefunden', 404);
+
+        if ($displayName) {
+            $db->execute('UPDATE students SET display_name = ? WHERE id = ?', [$displayName, $studentId]);
+        }
+        if ($newPassword && strlen($newPassword) >= 4) {
+            $db->execute('UPDATE students SET password = ? WHERE id = ?', [password_hash($newPassword, PASSWORD_DEFAULT), $studentId]);
+        }
+        Response::ok();
+    }
+
+    // === SCHUELER LOESCHEN ===
+    if ($action === 'delete') {
+        $studentId = (int)($body['studentId'] ?? 0);
+        $student = $db->fetchOne(
+            'SELECT s.id FROM students s JOIN classes c ON c.id = s.class_id WHERE s.id = ? AND c.teacher_id = ?',
+            [$studentId, $teacherId]
+        );
+        if (!$student) Response::error('Schüler nicht gefunden', 404);
+
+        $db->execute('DELETE FROM students WHERE id = ?', [$studentId]);
+        Response::ok();
+    }
+
+    Response::error('Unbekannte Aktion');
+}
+
+Response::error('Methode nicht erlaubt', 405);