Harden user management integration

src/frontend/components/Sidebar.tsx

@@ -7,6 +7,7 @@ import { listProjects } from "../utils/api";
 import type { ProjectDto } from "../types";
 import { ThemeToggle } from "./ThemeToggle";
 import { useAuth } from "./AuthProvider";
+import { getConfigEntry } from "../utils/config-access";
 
 // Anchors on the project overview page (/projects/[id]).
 const PROJECT_SECTIONS = [
@@ -32,6 +33,7 @@ interface SidebarProps {
 export function Sidebar({ isCollapsed, onToggleCollapsed }: SidebarProps) {
   const pathname = usePathname();
   const { user, isAdmin, logout } = useAuth();
+  const configEntry = getConfigEntry(isAdmin);
   const projectMatch = pathname?.match(PROJECT_PATH_PATTERN);
   const activeProjectId = projectMatch ? projectMatch[1] : null;
   const projectSubPath = projectMatch?.[2] ?? "";
@@ -181,18 +183,16 @@ export function Sidebar({ isCollapsed, onToggleCollapsed }: SidebarProps) {
           </>
         )}
       </nav>
-      {isAdmin && (
-        <nav className="sidebar-nav sidebar-nav-bottom">
-          <Link
-            href="/config"
-            className={pathname?.startsWith("/config") ? "sidebar-link active" : "sidebar-link"}
-            title="Config"
-          >
-            <span className="sidebar-icon">⚙</span>
-            <span className="sidebar-label">Config</span>
-          </Link>
-        </nav>
-      )}
+      <nav className="sidebar-nav sidebar-nav-bottom">
+        <Link
+          href={configEntry.href}
+          className={pathname?.startsWith("/config") ? "sidebar-link active" : "sidebar-link"}
+          title={configEntry.label}
+        >
+          <span className="sidebar-icon">⚙</span>
+          <span className="sidebar-label">{configEntry.label}</span>
+        </Link>
+      </nav>
       <div className="sidebar-footer">
         {user && !isCollapsed && (
           <div className="sidebar-identity" title={`Angemeldet als ${user.name}`}>

src/frontend/components/cable-sizing-api.ts

@@ -6,6 +6,10 @@ import type {
   CableSizingInput,
   CableSizingResult,
 } from "../../cable-sizing/domain/cable-sizing-calculation";
+import {
+  WRITE_REQUEST_HEADER_NAME,
+  WRITE_REQUEST_HEADER_VALUE,
+} from "../../shared/constants/request-security";
 
 export interface CalculateCableSizingResponse {
   result: CableSizingResult;
@@ -17,7 +21,10 @@ export async function calculateCableSizing(
 ): Promise<CalculateCableSizingResponse> {
   const response = await fetch("/api/cable-sizing/calculate", {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: {
+      "Content-Type": "application/json",
+      [WRITE_REQUEST_HEADER_NAME]: WRITE_REQUEST_HEADER_VALUE,
+    },
     body: JSON.stringify(input),
     cache: "no-store",
   });

src/frontend/utils/api.ts

@@ -1,3 +1,7 @@
+import {
+  WRITE_REQUEST_HEADER_NAME,
+  WRITE_REQUEST_HEADER_VALUE,
+} from "../../shared/constants/request-security";
 import type {
   BuildingDto,
   CircuitListDto,
@@ -122,6 +126,7 @@ async function request<T>(url: string, init?: RequestInit): Promise<T> {
     ...init,
     headers: {
       "Content-Type": "application/json",
+      [WRITE_REQUEST_HEADER_NAME]: WRITE_REQUEST_HEADER_VALUE,
       ...init?.headers,
     },
     cache: "no-store",

src/frontend/utils/auth-api.ts

@@ -1,3 +1,8 @@
+import {
+  WRITE_REQUEST_HEADER_NAME,
+  WRITE_REQUEST_HEADER_VALUE,
+} from "../../shared/constants/request-security";
+
 // Small, self-contained fetch helper for the auth/user endpoints - kept
 // separate from the large domain api.ts so this feature doesn't have to
 // touch that file's shared `request()` internals.
@@ -39,7 +44,11 @@ export class AuthApiError extends Error {
 async function request<T>(url: string, init?: RequestInit): Promise<T> {
   const response = await fetch(url, {
     ...init,
-    headers: { "Content-Type": "application/json", ...init?.headers },
+    headers: {
+      "Content-Type": "application/json",
+      [WRITE_REQUEST_HEADER_NAME]: WRITE_REQUEST_HEADER_VALUE,
+      ...init?.headers,
+    },
     cache: "no-store",
   });
   if (!response.ok) {

src/frontend/utils/config-access.ts

@@ -0,0 +1,25 @@
+export interface ConfigNavigationEntry {
+  href: string;
+  label: string;
+}
+
+const ACCOUNT_ENTRY = { href: "/config/konto", label: "Konto" } as const;
+const USERS_ENTRY = { href: "/config/benutzer", label: "Benutzer" } as const;
+
+export function getConfigTabs(isAdmin: boolean): ConfigNavigationEntry[] {
+  return isAdmin ? [USERS_ENTRY, ACCOUNT_ENTRY] : [ACCOUNT_ENTRY];
+}
+
+export function getConfigEntry(isAdmin: boolean): ConfigNavigationEntry {
+  return isAdmin ? { href: USERS_ENTRY.href, label: "Config" } : ACCOUNT_ENTRY;
+}
+
+export function getConfigRedirect(pathname: string | null, isAdmin: boolean): string | null {
+  if (pathname === "/config") {
+    return isAdmin ? USERS_ENTRY.href : ACCOUNT_ENTRY.href;
+  }
+  if (!isAdmin && pathname?.startsWith(USERS_ENTRY.href)) {
+    return ACCOUNT_ENTRY.href;
+  }
+  return null;
+}