new features

2026-03-23 13:08:19 +01:00
parent 83b84664ce
commit 5032e1593b
41 changed files with 5157 additions and 40 deletions
--- a/backend/src/app.ts
+++ b/backend/src/app.ts
@@ -2,10 +2,12 @@ import express, { Application, Request, Response } from 'express';
 import cors from 'cors';
 import helmet from 'helmet';
 import rateLimit from 'express-rate-limit';
+import path from 'path';
 import environment from './config/environment';
 import logger from './utils/logger';
 import { errorHandler, notFoundHandler } from './middleware/error.middleware';
 import { requestTimeout } from './middleware/request-timeout.middleware';
+import { authenticate } from './middleware/auth.middleware';

 const app: Application = express();

@@ -93,11 +95,13 @@ import bookingRoutes     from './routes/booking.routes';
 import notificationRoutes from './routes/notification.routes';
 import bookstackRoutes   from './routes/bookstack.routes';
 import vikunjaRoutes     from './routes/vikunja.routes';
+import bestellungRoutes  from './routes/bestellung.routes';
 import configRoutes      from './routes/config.routes';
 import serviceMonitorRoutes from './routes/serviceMonitor.routes';
 import settingsRoutes       from './routes/settings.routes';
 import bannerRoutes         from './routes/banner.routes';
 import permissionRoutes     from './routes/permission.routes';
+import shopRoutes              from './routes/shop.routes';

 app.use('/api/auth',        authRoutes);
 app.use('/api/user',        userRoutes);
@@ -114,12 +118,17 @@ app.use('/api/bookings',    bookingRoutes);
 app.use('/api/notifications', notificationRoutes);
 app.use('/api/bookstack',   bookstackRoutes);
 app.use('/api/vikunja',    vikunjaRoutes);
+app.use('/api/bestellungen', bestellungRoutes);
 app.use('/api/config',     configRoutes);
 app.use('/api/admin',      serviceMonitorRoutes);
 app.use('/api/admin/settings', settingsRoutes);
 app.use('/api/settings',       settingsRoutes);
 app.use('/api/banners',        bannerRoutes);
 app.use('/api/permissions',    permissionRoutes);
+app.use('/api/shop',              shopRoutes);
+
+// Static file serving for uploads (authenticated)
+app.use('/uploads', authenticate, express.static(path.resolve(__dirname, '../../uploads')));

 // 404 handler
 app.use(notFoundHandler);
--- a/backend/src/controllers/bestellung.controller.ts
+++ b/backend/src/controllers/bestellung.controller.ts
@@ -0,0 +1,466 @@
+import { Request, Response } from 'express';
+import bestellungService from '../services/bestellung.service';
+import logger from '../utils/logger';
+import fs from 'fs';
+
+// Helper to safely extract a route param as string
+const param = (req: Request, key: string): string => req.params[key] as string;
+
+class BestellungController {
+  // ---------------------------------------------------------------------------
+  // Vendors
+  // ---------------------------------------------------------------------------
+
+  async listVendors(_req: Request, res: Response): Promise<void> {
+    try {
+      const vendors = await bestellungService.getVendors();
+      res.status(200).json({ success: true, data: vendors });
+    } catch (error) {
+      logger.error('BestellungController.listVendors error', { error });
+      res.status(500).json({ success: false, message: 'Lieferanten konnten nicht geladen werden' });
+    }
+  }
+
+  async createVendor(req: Request, res: Response): Promise<void> {
+    const { name } = req.body;
+    if (!name || typeof name !== 'string' || name.trim().length === 0) {
+      res.status(400).json({ success: false, message: 'Name ist erforderlich' });
+      return;
+    }
+    try {
+      const vendor = await bestellungService.createVendor(req.body, req.user!.id);
+      res.status(201).json({ success: true, data: vendor });
+    } catch (error) {
+      logger.error('BestellungController.createVendor error', { error });
+      res.status(500).json({ success: false, message: 'Lieferant konnte nicht erstellt werden' });
+    }
+  }
+
+  async updateVendor(req: Request, res: Response): Promise<void> {
+    const id = parseInt(param(req, 'id'), 10);
+    if (isNaN(id)) {
+      res.status(400).json({ success: false, message: 'Ungültige ID' });
+      return;
+    }
+    try {
+      const vendor = await bestellungService.updateVendor(id, req.body, req.user!.id);
+      if (!vendor) {
+        res.status(404).json({ success: false, message: 'Lieferant nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, data: vendor });
+    } catch (error) {
+      logger.error('BestellungController.updateVendor error', { error });
+      res.status(500).json({ success: false, message: 'Lieferant konnte nicht aktualisiert werden' });
+    }
+  }
+
+  async deleteVendor(req: Request, res: Response): Promise<void> {
+    const id = parseInt(param(req, 'id'), 10);
+    if (isNaN(id)) {
+      res.status(400).json({ success: false, message: 'Ungültige ID' });
+      return;
+    }
+    try {
+      const deleted = await bestellungService.deleteVendor(id);
+      if (!deleted) {
+        res.status(404).json({ success: false, message: 'Lieferant nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, message: 'Lieferant gelöscht' });
+    } catch (error) {
+      logger.error('BestellungController.deleteVendor error', { error });
+      res.status(500).json({ success: false, message: 'Lieferant konnte nicht gelöscht werden' });
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Orders
+  // ---------------------------------------------------------------------------
+
+  async listOrders(req: Request, res: Response): Promise<void> {
+    try {
+      const filters: { status?: string; lieferant_id?: number; besteller_id?: string } = {};
+      if (req.query.status) filters.status = req.query.status as string;
+      if (req.query.lieferant_id) filters.lieferant_id = parseInt(req.query.lieferant_id as string, 10);
+      if (req.query.besteller_id) filters.besteller_id = req.query.besteller_id as string;
+
+      const orders = await bestellungService.getOrders(filters);
+      res.status(200).json({ success: true, data: orders });
+    } catch (error) {
+      logger.error('BestellungController.listOrders error', { error });
+      res.status(500).json({ success: false, message: 'Bestellungen konnten nicht geladen werden' });
+    }
+  }
+
+  async getOrder(req: Request, res: Response): Promise<void> {
+    const id = parseInt(param(req, 'id'), 10);
+    if (isNaN(id)) {
+      res.status(400).json({ success: false, message: 'Ungültige ID' });
+      return;
+    }
+    try {
+      const order = await bestellungService.getOrderById(id);
+      if (!order) {
+        res.status(404).json({ success: false, message: 'Bestellung nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, data: order });
+    } catch (error) {
+      logger.error('BestellungController.getOrder error', { error });
+      res.status(500).json({ success: false, message: 'Bestellung konnte nicht geladen werden' });
+    }
+  }
+
+  async createOrder(req: Request, res: Response): Promise<void> {
+    const { titel } = req.body;
+    if (!titel || typeof titel !== 'string' || titel.trim().length === 0) {
+      res.status(400).json({ success: false, message: 'Titel ist erforderlich' });
+      return;
+    }
+    try {
+      const order = await bestellungService.createOrder(req.body, req.user!.id);
+      res.status(201).json({ success: true, data: order });
+    } catch (error) {
+      logger.error('BestellungController.createOrder error', { error });
+      res.status(500).json({ success: false, message: 'Bestellung konnte nicht erstellt werden' });
+    }
+  }
+
+  async updateOrder(req: Request, res: Response): Promise<void> {
+    const id = parseInt(param(req, 'id'), 10);
+    if (isNaN(id)) {
+      res.status(400).json({ success: false, message: 'Ungültige ID' });
+      return;
+    }
+    try {
+      const order = await bestellungService.updateOrder(id, req.body, req.user!.id);
+      if (!order) {
+        res.status(404).json({ success: false, message: 'Bestellung nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, data: order });
+    } catch (error) {
+      logger.error('BestellungController.updateOrder error', { error });
+      res.status(500).json({ success: false, message: 'Bestellung konnte nicht aktualisiert werden' });
+    }
+  }
+
+  async deleteOrder(req: Request, res: Response): Promise<void> {
+    const id = parseInt(param(req, 'id'), 10);
+    if (isNaN(id)) {
+      res.status(400).json({ success: false, message: 'Ungültige ID' });
+      return;
+    }
+    try {
+      const deleted = await bestellungService.deleteOrder(id, req.user!.id);
+      if (!deleted) {
+        res.status(404).json({ success: false, message: 'Bestellung nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, message: 'Bestellung gelöscht' });
+    } catch (error) {
+      logger.error('BestellungController.deleteOrder error', { error });
+      res.status(500).json({ success: false, message: 'Bestellung konnte nicht gelöscht werden' });
+    }
+  }
+
+  async updateStatus(req: Request, res: Response): Promise<void> {
+    const id = parseInt(param(req, 'id'), 10);
+    if (isNaN(id)) {
+      res.status(400).json({ success: false, message: 'Ungültige ID' });
+      return;
+    }
+    const { status } = req.body;
+    if (!status || typeof status !== 'string') {
+      res.status(400).json({ success: false, message: 'Status ist erforderlich' });
+      return;
+    }
+    try {
+      const order = await bestellungService.updateOrderStatus(id, status, req.user!.id);
+      if (!order) {
+        res.status(404).json({ success: false, message: 'Bestellung nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, data: order });
+    } catch (error: any) {
+      if (error.message?.includes('Ungültiger Statusübergang')) {
+        res.status(400).json({ success: false, message: error.message });
+        return;
+      }
+      logger.error('BestellungController.updateStatus error', { error });
+      res.status(500).json({ success: false, message: 'Status konnte nicht aktualisiert werden' });
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Line Items
+  // ---------------------------------------------------------------------------
+
+  async addLineItem(req: Request, res: Response): Promise<void> {
+    const bestellungId = parseInt(param(req, 'id'), 10);
+    if (isNaN(bestellungId)) {
+      res.status(400).json({ success: false, message: 'Ungültige Bestellungs-ID' });
+      return;
+    }
+    const { artikel, menge } = req.body;
+    if (!artikel || typeof artikel !== 'string' || artikel.trim().length === 0) {
+      res.status(400).json({ success: false, message: 'Artikel ist erforderlich' });
+      return;
+    }
+    if (menge === undefined || menge === null || menge <= 0) {
+      res.status(400).json({ success: false, message: 'Menge muss größer als 0 sein' });
+      return;
+    }
+    try {
+      const item = await bestellungService.addLineItem(bestellungId, req.body, req.user!.id);
+      res.status(201).json({ success: true, data: item });
+    } catch (error) {
+      logger.error('BestellungController.addLineItem error', { error });
+      res.status(500).json({ success: false, message: 'Position konnte nicht hinzugefügt werden' });
+    }
+  }
+
+  async updateLineItem(req: Request, res: Response): Promise<void> {
+    const itemId = parseInt(param(req, 'itemId'), 10);
+    if (isNaN(itemId)) {
+      res.status(400).json({ success: false, message: 'Ungültige Position-ID' });
+      return;
+    }
+    try {
+      const item = await bestellungService.updateLineItem(itemId, req.body, req.user!.id);
+      if (!item) {
+        res.status(404).json({ success: false, message: 'Position nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, data: item });
+    } catch (error) {
+      logger.error('BestellungController.updateLineItem error', { error });
+      res.status(500).json({ success: false, message: 'Position konnte nicht aktualisiert werden' });
+    }
+  }
+
+  async deleteLineItem(req: Request, res: Response): Promise<void> {
+    const itemId = parseInt(param(req, 'itemId'), 10);
+    if (isNaN(itemId)) {
+      res.status(400).json({ success: false, message: 'Ungültige Position-ID' });
+      return;
+    }
+    try {
+      const deleted = await bestellungService.deleteLineItem(itemId, req.user!.id);
+      if (!deleted) {
+        res.status(404).json({ success: false, message: 'Position nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, message: 'Position gelöscht' });
+    } catch (error) {
+      logger.error('BestellungController.deleteLineItem error', { error });
+      res.status(500).json({ success: false, message: 'Position konnte nicht gelöscht werden' });
+    }
+  }
+
+  async updateReceivedQuantity(req: Request, res: Response): Promise<void> {
+    const itemId = parseInt(param(req, 'itemId'), 10);
+    if (isNaN(itemId)) {
+      res.status(400).json({ success: false, message: 'Ungültige Position-ID' });
+      return;
+    }
+    const { menge } = req.body;
+    if (menge === undefined || menge === null || menge < 0) {
+      res.status(400).json({ success: false, message: 'Erhaltene Menge muss >= 0 sein' });
+      return;
+    }
+    try {
+      const item = await bestellungService.updateReceivedQuantity(itemId, menge, req.user!.id);
+      if (!item) {
+        res.status(404).json({ success: false, message: 'Position nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, data: item });
+    } catch (error) {
+      logger.error('BestellungController.updateReceivedQuantity error', { error });
+      res.status(500).json({ success: false, message: 'Liefermenge konnte nicht aktualisiert werden' });
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Files
+  // ---------------------------------------------------------------------------
+
+  async uploadFile(req: Request, res: Response): Promise<void> {
+    const bestellungId = parseInt(param(req, 'id'), 10);
+    if (isNaN(bestellungId)) {
+      res.status(400).json({ success: false, message: 'Ungültige Bestellungs-ID' });
+      return;
+    }
+    const file = (req as any).file;
+    if (!file) {
+      res.status(400).json({ success: false, message: 'Keine Datei hochgeladen' });
+      return;
+    }
+    try {
+      const fileRecord = await bestellungService.addFile(bestellungId, {
+        dateiname: file.originalname,
+        dateipfad: file.path,
+        dateityp: file.mimetype,
+        dateigroesse: file.size,
+      }, req.user!.id);
+      res.status(201).json({ success: true, data: fileRecord });
+    } catch (error) {
+      logger.error('BestellungController.uploadFile error', { error });
+      res.status(500).json({ success: false, message: 'Datei konnte nicht hochgeladen werden' });
+    }
+  }
+
+  async deleteFile(req: Request, res: Response): Promise<void> {
+    const fileId = parseInt(param(req, 'fileId'), 10);
+    if (isNaN(fileId)) {
+      res.status(400).json({ success: false, message: 'Ungültige Datei-ID' });
+      return;
+    }
+    try {
+      const result = await bestellungService.deleteFile(fileId, req.user!.id);
+      if (!result) {
+        res.status(404).json({ success: false, message: 'Datei nicht gefunden' });
+        return;
+      }
+      // Remove from disk
+      try {
+        if (result.dateipfad && fs.existsSync(result.dateipfad)) {
+          fs.unlinkSync(result.dateipfad);
+        }
+      } catch (err) {
+        logger.warn('Failed to delete file from disk', { path: result.dateipfad, error: err });
+      }
+      res.status(200).json({ success: true, message: 'Datei gelöscht' });
+    } catch (error) {
+      logger.error('BestellungController.deleteFile error', { error });
+      res.status(500).json({ success: false, message: 'Datei konnte nicht gelöscht werden' });
+    }
+  }
+
+  async listFiles(req: Request, res: Response): Promise<void> {
+    const bestellungId = parseInt(param(req, 'id'), 10);
+    if (isNaN(bestellungId)) {
+      res.status(400).json({ success: false, message: 'Ungültige Bestellungs-ID' });
+      return;
+    }
+    try {
+      const files = await bestellungService.getFilesByOrder(bestellungId);
+      res.status(200).json({ success: true, data: files });
+    } catch (error) {
+      logger.error('BestellungController.listFiles error', { error });
+      res.status(500).json({ success: false, message: 'Dateien konnten nicht geladen werden' });
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Reminders
+  // ---------------------------------------------------------------------------
+
+  async addReminder(req: Request, res: Response): Promise<void> {
+    const bestellungId = parseInt(param(req, 'id'), 10);
+    if (isNaN(bestellungId)) {
+      res.status(400).json({ success: false, message: 'Ungültige Bestellungs-ID' });
+      return;
+    }
+    const { titel, faellig_am } = req.body;
+    if (!titel || typeof titel !== 'string' || titel.trim().length === 0) {
+      res.status(400).json({ success: false, message: 'Titel ist erforderlich' });
+      return;
+    }
+    if (!faellig_am) {
+      res.status(400).json({ success: false, message: 'Fälligkeitsdatum ist erforderlich' });
+      return;
+    }
+    try {
+      const reminder = await bestellungService.addReminder(bestellungId, req.body, req.user!.id);
+      res.status(201).json({ success: true, data: reminder });
+    } catch (error) {
+      logger.error('BestellungController.addReminder error', { error });
+      res.status(500).json({ success: false, message: 'Erinnerung konnte nicht erstellt werden' });
+    }
+  }
+
+  async markReminderDone(req: Request, res: Response): Promise<void> {
+    const remId = parseInt(param(req, 'remId'), 10);
+    if (isNaN(remId)) {
+      res.status(400).json({ success: false, message: 'Ungültige Erinnerungs-ID' });
+      return;
+    }
+    try {
+      const reminder = await bestellungService.markReminderDone(remId, req.user!.id);
+      if (!reminder) {
+        res.status(404).json({ success: false, message: 'Erinnerung nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, data: reminder });
+    } catch (error) {
+      logger.error('BestellungController.markReminderDone error', { error });
+      res.status(500).json({ success: false, message: 'Erinnerung konnte nicht als erledigt markiert werden' });
+    }
+  }
+
+  async deleteReminder(req: Request, res: Response): Promise<void> {
+    const remId = parseInt(param(req, 'remId'), 10);
+    if (isNaN(remId)) {
+      res.status(400).json({ success: false, message: 'Ungültige Erinnerungs-ID' });
+      return;
+    }
+    try {
+      const deleted = await bestellungService.deleteReminder(remId);
+      if (!deleted) {
+        res.status(404).json({ success: false, message: 'Erinnerung nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, message: 'Erinnerung gelöscht' });
+    } catch (error) {
+      logger.error('BestellungController.deleteReminder error', { error });
+      res.status(500).json({ success: false, message: 'Erinnerung konnte nicht gelöscht werden' });
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // History
+  // ---------------------------------------------------------------------------
+
+  async getHistory(req: Request, res: Response): Promise<void> {
+    const bestellungId = parseInt(param(req, 'id'), 10);
+    if (isNaN(bestellungId)) {
+      res.status(400).json({ success: false, message: 'Ungültige Bestellungs-ID' });
+      return;
+    }
+    try {
+      const history = await bestellungService.getHistory(bestellungId);
+      res.status(200).json({ success: true, data: history });
+    } catch (error) {
+      logger.error('BestellungController.getHistory error', { error });
+      res.status(500).json({ success: false, message: 'Historie konnte nicht geladen werden' });
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Export (placeholder — returns order detail as JSON for now)
+  // ---------------------------------------------------------------------------
+
+  async exportOrder(req: Request, res: Response): Promise<void> {
+    const id = parseInt(param(req, 'id'), 10);
+    if (isNaN(id)) {
+      res.status(400).json({ success: false, message: 'Ungültige ID' });
+      return;
+    }
+    try {
+      const order = await bestellungService.getOrderById(id);
+      if (!order) {
+        res.status(404).json({ success: false, message: 'Bestellung nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, data: order });
+    } catch (error) {
+      logger.error('BestellungController.exportOrder error', { error });
+      res.status(500).json({ success: false, message: 'Export fehlgeschlagen' });
+    }
+  }
+}
+
+export default new BestellungController();
--- a/backend/src/controllers/shop.controller.ts
+++ b/backend/src/controllers/shop.controller.ts
@@ -0,0 +1,256 @@
+import { Request, Response } from 'express';
+import shopService from '../services/shop.service';
+import notificationService from '../services/notification.service';
+import logger from '../utils/logger';
+
+class ShopController {
+  // -------------------------------------------------------------------------
+  // Catalog Items
+  // -------------------------------------------------------------------------
+
+  async getItems(req: Request, res: Response): Promise<void> {
+    try {
+      const kategorie = req.query.kategorie as string | undefined;
+      const aktiv = req.query.aktiv !== undefined ? req.query.aktiv === 'true' : undefined;
+      const items = await shopService.getItems({ kategorie, aktiv });
+      res.status(200).json({ success: true, data: items });
+    } catch (error) {
+      logger.error('ShopController.getItems error', { error });
+      res.status(500).json({ success: false, message: 'Artikel konnten nicht geladen werden' });
+    }
+  }
+
+  async getItemById(req: Request, res: Response): Promise<void> {
+    try {
+      const id = Number(req.params.id);
+      const item = await shopService.getItemById(id);
+      if (!item) {
+        res.status(404).json({ success: false, message: 'Artikel nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, data: item });
+    } catch (error) {
+      logger.error('ShopController.getItemById error', { error });
+      res.status(500).json({ success: false, message: 'Artikel konnte nicht geladen werden' });
+    }
+  }
+
+  async createItem(req: Request, res: Response): Promise<void> {
+    try {
+      const { bezeichnung } = req.body;
+      if (!bezeichnung || bezeichnung.trim().length === 0) {
+        res.status(400).json({ success: false, message: 'Bezeichnung ist erforderlich' });
+        return;
+      }
+      const item = await shopService.createItem(req.body, req.user!.id);
+      res.status(201).json({ success: true, data: item });
+    } catch (error) {
+      logger.error('ShopController.createItem error', { error });
+      res.status(500).json({ success: false, message: 'Artikel konnte nicht erstellt werden' });
+    }
+  }
+
+  async updateItem(req: Request, res: Response): Promise<void> {
+    try {
+      const id = Number(req.params.id);
+      const item = await shopService.updateItem(id, req.body, req.user!.id);
+      if (!item) {
+        res.status(404).json({ success: false, message: 'Artikel nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, data: item });
+    } catch (error) {
+      logger.error('ShopController.updateItem error', { error });
+      res.status(500).json({ success: false, message: 'Artikel konnte nicht aktualisiert werden' });
+    }
+  }
+
+  async deleteItem(req: Request, res: Response): Promise<void> {
+    try {
+      const id = Number(req.params.id);
+      await shopService.deleteItem(id);
+      res.status(200).json({ success: true, message: 'Artikel gelöscht' });
+    } catch (error) {
+      logger.error('ShopController.deleteItem error', { error });
+      res.status(500).json({ success: false, message: 'Artikel konnte nicht gelöscht werden' });
+    }
+  }
+
+  async getCategories(_req: Request, res: Response): Promise<void> {
+    try {
+      const categories = await shopService.getCategories();
+      res.status(200).json({ success: true, data: categories });
+    } catch (error) {
+      logger.error('ShopController.getCategories error', { error });
+      res.status(500).json({ success: false, message: 'Kategorien konnten nicht geladen werden' });
+    }
+  }
+
+  // -------------------------------------------------------------------------
+  // Requests
+  // -------------------------------------------------------------------------
+
+  async getRequests(req: Request, res: Response): Promise<void> {
+    try {
+      const status = req.query.status as string | undefined;
+      const anfrager_id = req.query.anfrager_id as string | undefined;
+      const requests = await shopService.getRequests({ status, anfrager_id });
+      res.status(200).json({ success: true, data: requests });
+    } catch (error) {
+      logger.error('ShopController.getRequests error', { error });
+      res.status(500).json({ success: false, message: 'Anfragen konnten nicht geladen werden' });
+    }
+  }
+
+  async getMyRequests(req: Request, res: Response): Promise<void> {
+    try {
+      const requests = await shopService.getMyRequests(req.user!.id);
+      res.status(200).json({ success: true, data: requests });
+    } catch (error) {
+      logger.error('ShopController.getMyRequests error', { error });
+      res.status(500).json({ success: false, message: 'Anfragen konnten nicht geladen werden' });
+    }
+  }
+
+  async getRequestById(req: Request, res: Response): Promise<void> {
+    try {
+      const id = Number(req.params.id);
+      const request = await shopService.getRequestById(id);
+      if (!request) {
+        res.status(404).json({ success: false, message: 'Anfrage nicht gefunden' });
+        return;
+      }
+      res.status(200).json({ success: true, data: request });
+    } catch (error) {
+      logger.error('ShopController.getRequestById error', { error });
+      res.status(500).json({ success: false, message: 'Anfrage konnte nicht geladen werden' });
+    }
+  }
+
+  async createRequest(req: Request, res: Response): Promise<void> {
+    try {
+      const { items, notizen } = req.body as {
+        items?: { artikel_id?: number; bezeichnung: string; menge: number; notizen?: string }[];
+        notizen?: string;
+      };
+
+      if (!items || items.length === 0) {
+        res.status(400).json({ success: false, message: 'Mindestens eine Position ist erforderlich' });
+        return;
+      }
+
+      for (const item of items) {
+        if (!item.bezeichnung || item.bezeichnung.trim().length === 0) {
+          res.status(400).json({ success: false, message: 'Bezeichnung ist für alle Positionen erforderlich' });
+          return;
+        }
+        if (!item.menge || item.menge < 1) {
+          res.status(400).json({ success: false, message: 'Menge muss mindestens 1 sein' });
+          return;
+        }
+      }
+
+      const request = await shopService.createRequest(req.user!.id, items, notizen);
+      res.status(201).json({ success: true, data: request });
+    } catch (error) {
+      logger.error('ShopController.createRequest error', { error });
+      res.status(500).json({ success: false, message: 'Anfrage konnte nicht erstellt werden' });
+    }
+  }
+
+  async updateRequestStatus(req: Request, res: Response): Promise<void> {
+    try {
+      const id = Number(req.params.id);
+      const { status, admin_notizen } = req.body as {
+        status?: string;
+        admin_notizen?: string;
+      };
+
+      if (!status) {
+        res.status(400).json({ success: false, message: 'Status ist erforderlich' });
+        return;
+      }
+
+      const validStatuses = ['offen', 'genehmigt', 'abgelehnt', 'bestellt', 'erledigt'];
+      if (!validStatuses.includes(status)) {
+        res.status(400).json({ success: false, message: `Ungültiger Status. Erlaubt: ${validStatuses.join(', ')}` });
+        return;
+      }
+
+      // Fetch request to get anfrager_id for notification
+      const existing = await shopService.getRequestById(id);
+      if (!existing) {
+        res.status(404).json({ success: false, message: 'Anfrage nicht gefunden' });
+        return;
+      }
+
+      const updated = await shopService.updateRequestStatus(id, status, admin_notizen, req.user!.id);
+
+      // Notify requester on status changes
+      if (['genehmigt', 'abgelehnt', 'bestellt', 'erledigt'].includes(status)) {
+        await notificationService.createNotification({
+          user_id: existing.anfrager_id,
+          typ: 'shop_anfrage',
+          titel: status === 'genehmigt' ? 'Anfrage genehmigt' : status === 'abgelehnt' ? 'Anfrage abgelehnt' : `Anfrage ${status}`,
+          nachricht: `Deine Shop-Anfrage #${id} wurde ${status === 'genehmigt' ? 'genehmigt' : status === 'abgelehnt' ? 'abgelehnt' : status}.`,
+          schwere: status === 'abgelehnt' ? 'warnung' : 'info',
+          link: '/shop',
+          quell_id: String(id),
+          quell_typ: 'shop_anfrage',
+        });
+      }
+
+      res.status(200).json({ success: true, data: updated });
+    } catch (error) {
+      logger.error('ShopController.updateRequestStatus error', { error });
+      res.status(500).json({ success: false, message: 'Status konnte nicht aktualisiert werden' });
+    }
+  }
+
+  async deleteRequest(req: Request, res: Response): Promise<void> {
+    try {
+      const id = Number(req.params.id);
+      await shopService.deleteRequest(id);
+      res.status(200).json({ success: true, message: 'Anfrage gelöscht' });
+    } catch (error) {
+      logger.error('ShopController.deleteRequest error', { error });
+      res.status(500).json({ success: false, message: 'Anfrage konnte nicht gelöscht werden' });
+    }
+  }
+
+  // -------------------------------------------------------------------------
+  // Linking
+  // -------------------------------------------------------------------------
+
+  async linkToOrder(req: Request, res: Response): Promise<void> {
+    try {
+      const anfrageId = Number(req.params.id);
+      const { bestellung_id } = req.body as { bestellung_id?: number };
+
+      if (!bestellung_id) {
+        res.status(400).json({ success: false, message: 'bestellung_id ist erforderlich' });
+        return;
+      }
+
+      await shopService.linkToOrder(anfrageId, bestellung_id);
+      res.status(200).json({ success: true, message: 'Verknüpfung erstellt' });
+    } catch (error) {
+      logger.error('ShopController.linkToOrder error', { error });
+      res.status(500).json({ success: false, message: 'Verknüpfung konnte nicht erstellt werden' });
+    }
+  }
+
+  async unlinkFromOrder(req: Request, res: Response): Promise<void> {
+    try {
+      const anfrageId = Number(req.params.id);
+      const bestellungId = Number(req.params.bestellungId);
+      await shopService.unlinkFromOrder(anfrageId, bestellungId);
+      res.status(200).json({ success: true, message: 'Verknüpfung entfernt' });
+    } catch (error) {
+      logger.error('ShopController.unlinkFromOrder error', { error });
+      res.status(500).json({ success: false, message: 'Verknüpfung konnte nicht entfernt werden' });
+    }
+  }
+}
+
+export default new ShopController();
--- a/backend/src/database/migrations/038_create_bestellungen.sql
+++ b/backend/src/database/migrations/038_create_bestellungen.sql
@@ -0,0 +1,145 @@
+-- Migration 038: Bestellungen (Vendor Orders) system
+-- Tables for vendors, orders, line items, file attachments, reminders, and audit trail.
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 1. Lieferanten (Vendors)
+-- ═══════════════════════════════════════════════════════════════════════════
+
+CREATE TABLE IF NOT EXISTS lieferanten (
+  id              SERIAL       PRIMARY KEY,
+  name            TEXT         NOT NULL,
+  kontakt_name    TEXT,
+  email           TEXT,
+  telefon         TEXT,
+  adresse         TEXT,
+  website         TEXT,
+  notizen         TEXT,
+  erstellt_von    UUID         REFERENCES users(id) ON DELETE SET NULL,
+  erstellt_am     TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
+  aktualisiert_am TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_lieferanten_name ON lieferanten(name);
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 2. Bestellungen (Orders)
+-- ═══════════════════════════════════════════════════════════════════════════
+
+CREATE TABLE IF NOT EXISTS bestellungen (
+  id                SERIAL       PRIMARY KEY,
+  bezeichnung       TEXT         NOT NULL,
+  lieferant_id      INT          REFERENCES lieferanten(id) ON DELETE SET NULL,
+  besteller_id      UUID         REFERENCES users(id) ON DELETE SET NULL,
+  status            TEXT         NOT NULL DEFAULT 'entwurf'
+                    CHECK (status IN ('entwurf','erstellt','bestellt','teillieferung','vollstaendig','abgeschlossen')),
+  budget            NUMERIC(10,2),
+  notizen           TEXT,
+  erstellt_von      UUID         REFERENCES users(id) ON DELETE SET NULL,
+  erstellt_am       TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
+  aktualisiert_am   TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
+  bestellt_am       TIMESTAMPTZ,
+  abgeschlossen_am  TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_bestellungen_status ON bestellungen(status);
+CREATE INDEX IF NOT EXISTS idx_bestellungen_lieferant ON bestellungen(lieferant_id);
+CREATE INDEX IF NOT EXISTS idx_bestellungen_besteller ON bestellungen(besteller_id);
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 3. Bestellpositionen (Order Line Items)
+-- ═══════════════════════════════════════════════════════════════════════════
+
+CREATE TABLE IF NOT EXISTS bestellpositionen (
+  id              SERIAL       PRIMARY KEY,
+  bestellung_id   INT          NOT NULL REFERENCES bestellungen(id) ON DELETE CASCADE,
+  bezeichnung     TEXT         NOT NULL,
+  artikelnummer   TEXT,
+  menge           NUMERIC      NOT NULL DEFAULT 1,
+  einheit         TEXT         DEFAULT 'Stk',
+  einzelpreis     NUMERIC(10,2),
+  erhalten_menge  NUMERIC      NOT NULL DEFAULT 0,
+  notizen         TEXT,
+  erstellt_am     TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
+  aktualisiert_am TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_bestellpositionen_bestellung ON bestellpositionen(bestellung_id);
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 4. Bestellung Dateien (Order File Attachments)
+-- ═══════════════════════════════════════════════════════════════════════════
+
+CREATE TABLE IF NOT EXISTS bestellung_dateien (
+  id               SERIAL       PRIMARY KEY,
+  bestellung_id    INT          NOT NULL REFERENCES bestellungen(id) ON DELETE CASCADE,
+  dateiname        TEXT         NOT NULL,
+  dateipfad        TEXT         NOT NULL,
+  dateityp         TEXT         NOT NULL,
+  dateigroesse     INT,
+  thumbnail_pfad   TEXT,
+  hochgeladen_von  UUID         REFERENCES users(id) ON DELETE SET NULL,
+  hochgeladen_am   TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_bestellung_dateien_bestellung ON bestellung_dateien(bestellung_id);
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 5. Bestellung Erinnerungen (Order Reminders)
+-- ═══════════════════════════════════════════════════════════════════════════
+
+CREATE TABLE IF NOT EXISTS bestellung_erinnerungen (
+  id              SERIAL       PRIMARY KEY,
+  bestellung_id   INT          NOT NULL REFERENCES bestellungen(id) ON DELETE CASCADE,
+  faellig_am      TIMESTAMPTZ  NOT NULL,
+  nachricht       TEXT,
+  erledigt        BOOLEAN      NOT NULL DEFAULT FALSE,
+  erstellt_von    UUID         REFERENCES users(id) ON DELETE SET NULL,
+  erstellt_am     TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_bestellung_erinnerungen_faellig ON bestellung_erinnerungen(faellig_am) WHERE NOT erledigt;
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 6. Bestellung Historie (Audit Trail)
+-- ═══════════════════════════════════════════════════════════════════════════
+
+CREATE TABLE IF NOT EXISTS bestellung_historie (
+  id              SERIAL       PRIMARY KEY,
+  bestellung_id   INT          NOT NULL REFERENCES bestellungen(id) ON DELETE CASCADE,
+  aktion          TEXT         NOT NULL,
+  details         JSONB,
+  erstellt_von    UUID         REFERENCES users(id) ON DELETE SET NULL,
+  erstellt_am     TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_bestellung_historie_bestellung ON bestellung_historie(bestellung_id);
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 7. Auto-update aktualisiert_am triggers
+-- ═══════════════════════════════════════════════════════════════════════════
+
+CREATE OR REPLACE FUNCTION update_aktualisiert_am()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.aktualisiert_am = NOW();
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'trg_lieferanten_aktualisiert') THEN
+    CREATE TRIGGER trg_lieferanten_aktualisiert BEFORE UPDATE ON lieferanten
+      FOR EACH ROW EXECUTE FUNCTION update_aktualisiert_am();
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'trg_bestellungen_aktualisiert') THEN
+    CREATE TRIGGER trg_bestellungen_aktualisiert BEFORE UPDATE ON bestellungen
+      FOR EACH ROW EXECUTE FUNCTION update_aktualisiert_am();
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'trg_bestellpositionen_aktualisiert') THEN
+    CREATE TRIGGER trg_bestellpositionen_aktualisiert BEFORE UPDATE ON bestellpositionen
+      FOR EACH ROW EXECUTE FUNCTION update_aktualisiert_am();
+  END IF;
+END $$;
--- a/backend/src/database/migrations/039_create_shop.sql
+++ b/backend/src/database/migrations/039_create_shop.sql
@@ -0,0 +1,84 @@
+-- Migration 039: Internal Shop system
+-- Tables for catalog items, member requests, request line items, and order linking.
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 1. Shop Artikel (Catalog Items)
+-- ═══════════════════════════════════════════════════════════════════════════
+
+CREATE TABLE IF NOT EXISTS shop_artikel (
+  id                  SERIAL       PRIMARY KEY,
+  bezeichnung         TEXT         NOT NULL,
+  beschreibung        TEXT,
+  kategorie           TEXT,
+  bild_pfad           TEXT,
+  geschaetzter_preis  NUMERIC(10,2),
+  aktiv               BOOLEAN      NOT NULL DEFAULT TRUE,
+  erstellt_von        UUID         REFERENCES users(id) ON DELETE SET NULL,
+  erstellt_am         TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
+  aktualisiert_am     TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_shop_artikel_kategorie ON shop_artikel(kategorie);
+CREATE INDEX IF NOT EXISTS idx_shop_artikel_aktiv ON shop_artikel(aktiv);
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 2. Shop Anfragen (Member Requests)
+-- ═══════════════════════════════════════════════════════════════════════════
+
+CREATE TABLE IF NOT EXISTS shop_anfragen (
+  id              SERIAL       PRIMARY KEY,
+  anfrager_id     UUID         NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  status          TEXT         NOT NULL DEFAULT 'offen'
+                  CHECK (status IN ('offen','genehmigt','abgelehnt','bestellt','erledigt')),
+  notizen         TEXT,
+  admin_notizen   TEXT,
+  bearbeitet_von  UUID         REFERENCES users(id) ON DELETE SET NULL,
+  erstellt_am     TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
+  aktualisiert_am TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_shop_anfragen_anfrager ON shop_anfragen(anfrager_id);
+CREATE INDEX IF NOT EXISTS idx_shop_anfragen_status ON shop_anfragen(status);
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 3. Shop Anfrage Positionen (Request Line Items)
+-- ═══════════════════════════════════════════════════════════════════════════
+
+CREATE TABLE IF NOT EXISTS shop_anfrage_positionen (
+  id          SERIAL       PRIMARY KEY,
+  anfrage_id  INT          NOT NULL REFERENCES shop_anfragen(id) ON DELETE CASCADE,
+  artikel_id  INT          REFERENCES shop_artikel(id) ON DELETE SET NULL,
+  bezeichnung TEXT         NOT NULL,
+  menge       NUMERIC      NOT NULL DEFAULT 1,
+  notizen     TEXT,
+  erstellt_am TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_shop_anfrage_positionen_anfrage ON shop_anfrage_positionen(anfrage_id);
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 4. Shop Anfrage ↔ Bestellung Link
+-- ═══════════════════════════════════════════════════════════════════════════
+
+CREATE TABLE IF NOT EXISTS shop_anfrage_bestellung (
+  anfrage_id    INT NOT NULL REFERENCES shop_anfragen(id) ON DELETE CASCADE,
+  bestellung_id INT NOT NULL REFERENCES bestellungen(id) ON DELETE CASCADE,
+  PRIMARY KEY (anfrage_id, bestellung_id)
+);
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 5. Auto-update triggers
+-- ═══════════════════════════════════════════════════════════════════════════
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'trg_shop_artikel_aktualisiert') THEN
+    CREATE TRIGGER trg_shop_artikel_aktualisiert BEFORE UPDATE ON shop_artikel
+      FOR EACH ROW EXECUTE FUNCTION update_aktualisiert_am();
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'trg_shop_anfragen_aktualisiert') THEN
+    CREATE TRIGGER trg_shop_anfragen_aktualisiert BEFORE UPDATE ON shop_anfragen
+      FOR EACH ROW EXECUTE FUNCTION update_aktualisiert_am();
+  END IF;
+END $$;
--- a/backend/src/database/migrations/040_update_permissions.sql
+++ b/backend/src/database/migrations/040_update_permissions.sql
@@ -0,0 +1,158 @@
+-- Migration 040: Permission updates
+-- 1. Add bestellungen + shop feature groups and their permissions
+-- 2. Simplify calendar permissions from 13 → 4
+-- 3. Migrate existing group_permissions to new calendar scheme
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 1. New feature groups
+-- ═══════════════════════════════════════════════════════════════════════════
+
+INSERT INTO feature_groups (id, label, sort_order) VALUES
+  ('bestellungen', 'Bestellungen', 11),
+  ('shop',         'Shop',         12)
+ON CONFLICT (id) DO NOTHING;
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 2. Bestellungen permissions
+-- ═══════════════════════════════════════════════════════════════════════════
+
+INSERT INTO permissions (id, feature_group_id, label, description, sort_order) VALUES
+  ('bestellungen:view',             'bestellungen', 'Ansehen',              'Bestellungen einsehen',                      1),
+  ('bestellungen:create',           'bestellungen', 'Erstellen/Bearbeiten', 'Bestellungen erstellen und bearbeiten',      2),
+  ('bestellungen:delete',           'bestellungen', 'Löschen',             'Bestellungen löschen',                       3),
+  ('bestellungen:manage_vendors',   'bestellungen', 'Lieferanten verwalten','Lieferanten-Datenbank verwalten',            4),
+  ('bestellungen:export',           'bestellungen', 'PDF Export',           'Bestellungen als PDF exportieren',           5),
+  ('bestellungen:manage_reminders', 'bestellungen', 'Erinnerungen',        'Erinnerungen für Bestellungen verwalten',    6),
+  ('bestellungen:widget',           'bestellungen', 'Widget',              'Dashboard-Widget für Bestellungen',          7)
+ON CONFLICT (id) DO NOTHING;
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 3. Shop permissions
+-- ═══════════════════════════════════════════════════════════════════════════
+
+INSERT INTO permissions (id, feature_group_id, label, description, sort_order) VALUES
+  ('shop:view',              'shop', 'Katalog ansehen',       'Shop-Katalog einsehen',                          1),
+  ('shop:create_request',    'shop', 'Anfrage stellen',       'Bestellanfragen an Admin stellen',               2),
+  ('shop:manage_catalog',    'shop', 'Katalog verwalten',     'Artikel im Shop-Katalog verwalten',              3),
+  ('shop:approve_requests',  'shop', 'Anfragen genehmigen',   'Bestellanfragen genehmigen oder ablehnen',       4),
+  ('shop:link_orders',       'shop', 'Mit Bestellung verknüpfen', 'Anfragen mit Lieferantenbestellungen verknüpfen', 5),
+  ('shop:widget',            'shop', 'Widget',                'Dashboard-Widget für Shop-Anfragen',             6)
+ON CONFLICT (id) DO NOTHING;
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 4. Calendar permission simplification (13 → 4)
+-- ═══════════════════════════════════════════════════════════════════════════
+-- New scheme:
+--   kalender:view            — see events + widgets
+--   kalender:create          — create/edit/cancel events, mark attendance, manage categories, view reports
+--   kalender:view_bookings   — see bookings + booking widgets
+--   kalender:manage_bookings — create/edit/cancel/delete bookings
+
+-- 4a. Collect which groups had which old permissions, then map to new ones.
+--     We use a temp table so we don't lose data during the transition.
+
+CREATE TEMP TABLE _cal_migration AS
+SELECT DISTINCT authentik_group,
+  CASE
+    -- Any group that had kalender:create OR kalender:cancel OR kalender:manage_categories
+    -- OR kalender:view_reports OR kalender:mark_attendance → gets kalender:create
+    WHEN permission_id IN ('kalender:create','kalender:cancel','kalender:manage_categories',
+                           'kalender:view_reports','kalender:mark_attendance')
+    THEN 'kalender:create'
+    -- Widget permissions → kalender:view (they already have it if they had widget perms)
+    WHEN permission_id IN ('kalender:widget_events','kalender:widget_quick_add')
+    THEN 'kalender:view'
+    -- Booking-related view widgets → kalender:view_bookings
+    WHEN permission_id IN ('kalender:widget_bookings')
+    THEN 'kalender:view_bookings'
+    -- All booking write ops → kalender:manage_bookings
+    WHEN permission_id IN ('kalender:create_bookings','kalender:edit_bookings',
+                           'kalender:cancel_own_bookings','kalender:delete_bookings')
+    THEN 'kalender:manage_bookings'
+    ELSE permission_id
+  END AS new_perm
+FROM group_permissions
+WHERE permission_id LIKE 'kalender:%';
+
+-- 4b. Delete old calendar permissions from group_permissions
+DELETE FROM group_permissions WHERE permission_id LIKE 'kalender:%';
+
+-- 4c. Delete old calendar permission definitions
+DELETE FROM permissions WHERE id LIKE 'kalender:%';
+
+-- 4d. Insert new calendar permissions
+INSERT INTO permissions (id, feature_group_id, label, description, sort_order) VALUES
+  ('kalender:view',            'kalender', 'Termine ansehen',       'Kalender-Termine und Widgets einsehen',                        1),
+  ('kalender:create',          'kalender', 'Termine verwalten',     'Termine erstellen/bearbeiten/absagen, Kategorien, Berichte',    2),
+  ('kalender:view_bookings',   'kalender', 'Buchungen ansehen',     'Fahrzeugbuchungen und Buchungs-Widget einsehen',               3),
+  ('kalender:manage_bookings', 'kalender', 'Buchungen verwalten',   'Buchungen erstellen/bearbeiten/stornieren/löschen',            4)
+ON CONFLICT (id) DO NOTHING;
+
+-- 4e. Re-insert migrated grants (only valid new permissions)
+INSERT INTO group_permissions (authentik_group, permission_id)
+SELECT DISTINCT authentik_group, new_perm
+FROM _cal_migration
+WHERE new_perm IN ('kalender:view','kalender:create','kalender:view_bookings','kalender:manage_bookings')
+ON CONFLICT DO NOTHING;
+
+-- Also ensure everyone who had any calendar perm gets kalender:view
+INSERT INTO group_permissions (authentik_group, permission_id)
+SELECT DISTINCT authentik_group, 'kalender:view'
+FROM _cal_migration
+ON CONFLICT DO NOTHING;
+
+-- And everyone who had any booking perm gets kalender:view_bookings
+INSERT INTO group_permissions (authentik_group, permission_id)
+SELECT DISTINCT authentik_group, 'kalender:view_bookings'
+FROM _cal_migration
+WHERE new_perm = 'kalender:manage_bookings'
+ON CONFLICT DO NOTHING;
+
+DROP TABLE _cal_migration;
+
+-- ═══════════════════════════════════════════════════════════════════════════
+-- 5. Seed bestellungen + shop permissions for existing groups
+-- ═══════════════════════════════════════════════════════════════════════════
+-- kommando gets full access, other groups get view + shop request
+
+INSERT INTO group_permissions (authentik_group, permission_id) VALUES
+  -- Kommando: full bestellungen + shop
+  ('dashboard_kommando', 'bestellungen:view'),
+  ('dashboard_kommando', 'bestellungen:create'),
+  ('dashboard_kommando', 'bestellungen:delete'),
+  ('dashboard_kommando', 'bestellungen:manage_vendors'),
+  ('dashboard_kommando', 'bestellungen:export'),
+  ('dashboard_kommando', 'bestellungen:manage_reminders'),
+  ('dashboard_kommando', 'bestellungen:widget'),
+  ('dashboard_kommando', 'shop:view'),
+  ('dashboard_kommando', 'shop:create_request'),
+  ('dashboard_kommando', 'shop:manage_catalog'),
+  ('dashboard_kommando', 'shop:approve_requests'),
+  ('dashboard_kommando', 'shop:link_orders'),
+  ('dashboard_kommando', 'shop:widget'),
+  -- Fahrmeister: view orders + shop request
+  ('dashboard_fahrmeister', 'bestellungen:view'),
+  ('dashboard_fahrmeister', 'bestellungen:widget'),
+  ('dashboard_fahrmeister', 'shop:view'),
+  ('dashboard_fahrmeister', 'shop:create_request'),
+  -- Zeugmeister: view orders + shop request
+  ('dashboard_zeugmeister', 'bestellungen:view'),
+  ('dashboard_zeugmeister', 'bestellungen:widget'),
+  ('dashboard_zeugmeister', 'shop:view'),
+  ('dashboard_zeugmeister', 'shop:create_request'),
+  -- Chargen: view orders + shop request
+  ('dashboard_chargen', 'bestellungen:view'),
+  ('dashboard_chargen', 'bestellungen:widget'),
+  ('dashboard_chargen', 'shop:view'),
+  ('dashboard_chargen', 'shop:create_request'),
+  -- Moderator: view orders + shop request
+  ('dashboard_moderator', 'bestellungen:view'),
+  ('dashboard_moderator', 'shop:view'),
+  ('dashboard_moderator', 'shop:create_request'),
+  -- Atemschutz: shop request only
+  ('dashboard_atemschutz', 'shop:view'),
+  ('dashboard_atemschutz', 'shop:create_request'),
+  -- Mitglied: shop request only
+  ('dashboard_mitglied', 'shop:view'),
+  ('dashboard_mitglied', 'shop:create_request')
+ON CONFLICT DO NOTHING;
--- a/backend/src/jobs/reminder.job.ts
+++ b/backend/src/jobs/reminder.job.ts
@@ -0,0 +1,75 @@
+import pool from '../config/database';
+import notificationService from '../services/notification.service';
+import logger from '../utils/logger';
+
+const INTERVAL_MS = 15 * 60 * 1000; // 15 minutes
+let jobInterval: ReturnType<typeof setInterval> | null = null;
+let isRunning = false;
+
+async function runReminderCheck(): Promise<void> {
+  if (isRunning) {
+    logger.warn('ReminderJob: previous run still in progress — skipping');
+    return;
+  }
+  isRunning = true;
+  try {
+    // Find due reminders that haven't been processed
+    const result = await pool.query(`
+      SELECT e.id, e.bestellung_id, e.nachricht, e.erstellt_von,
+             b.bezeichnung AS bestellung_bezeichnung, b.besteller_id
+      FROM bestellung_erinnerungen e
+      JOIN bestellungen b ON b.id = e.bestellung_id
+      WHERE e.faellig_am <= NOW()
+        AND e.erledigt = FALSE
+    `);
+
+    for (const row of result.rows) {
+      // Notify the order handler (besteller_id) or the creator
+      const targetUserId = row.besteller_id || row.erstellt_von;
+      if (!targetUserId) continue;
+
+      await notificationService.createNotification({
+        user_id: targetUserId,
+        typ: 'bestellung_erinnerung',
+        titel: 'Bestellungs-Erinnerung',
+        nachricht: row.nachricht || `Erinnerung für Bestellung "${row.bestellung_bezeichnung}"`,
+        schwere: 'info',
+        link: `/bestellungen/${row.bestellung_id}`,
+        quell_id: `bestellung-erinnerung-${row.id}`,
+        quell_typ: 'bestellung_erinnerung',
+      });
+
+      // Mark as done
+      await pool.query('UPDATE bestellung_erinnerungen SET erledigt = TRUE WHERE id = $1', [row.id]);
+    }
+
+    if (result.rows.length > 0) {
+      logger.info(`ReminderJob: processed ${result.rows.length} reminders`);
+    }
+  } catch (error) {
+    logger.error('ReminderJob: unexpected error', {
+      error: error instanceof Error ? error.message : String(error),
+    });
+  } finally {
+    isRunning = false;
+  }
+}
+
+export function startReminderJob(): void {
+  if (jobInterval !== null) {
+    logger.warn('Reminder job already running — skipping duplicate start');
+    return;
+  }
+  // Run once after short delay, then repeat
+  setTimeout(() => runReminderCheck(), 45 * 1000);
+  jobInterval = setInterval(() => runReminderCheck(), INTERVAL_MS);
+  logger.info('Reminder job scheduled (every 15 minutes)');
+}
+
+export function stopReminderJob(): void {
+  if (jobInterval !== null) {
+    clearInterval(jobInterval);
+    jobInterval = null;
+  }
+  logger.info('Reminder job stopped');
+}
--- a/backend/src/middleware/upload.ts
+++ b/backend/src/middleware/upload.ts
@@ -0,0 +1,52 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import multer from 'multer';
+import path from 'path';
+import fs from 'fs';
+import logger from '../utils/logger';
+
+const UPLOAD_DIR = path.resolve(__dirname, '../../../uploads/bestellungen');
+const THUMBNAIL_DIR = path.resolve(__dirname, '../../../uploads/bestellungen/thumbnails');
+
+// Ensure directories exist
+[UPLOAD_DIR, THUMBNAIL_DIR].forEach(dir => {
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+    logger.info(`Created upload directory: ${dir}`);
+  }
+});
+
+const storage = multer.diskStorage({
+  destination(_req: any, _file: any, cb: any) {
+    cb(null, UPLOAD_DIR);
+  },
+  filename(_req: any, file: any, cb: any) {
+    const uniqueSuffix = `${Date.now()}-${Math.round(Math.random() * 1e9)}`;
+    const ext = path.extname(file.originalname);
+    cb(null, `${uniqueSuffix}${ext}`);
+  },
+});
+
+const ALLOWED_TYPES = [
+  'image/jpeg', 'image/png', 'image/gif', 'image/webp',
+  'application/pdf',
+  'application/msword', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  'application/vnd.ms-excel', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  'text/plain', 'text/csv',
+];
+
+const multerOptions: any = {
+  storage,
+  fileFilter(_req: any, file: any, cb: any) {
+    if (ALLOWED_TYPES.includes(file.mimetype)) {
+      cb(null, true);
+    } else {
+      cb(new Error(`Dateityp ${file.mimetype} ist nicht erlaubt.`));
+    }
+  },
+  limits: { fileSize: 20 * 1024 * 1024 }, // 20 MB
+};
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const uploadBestellung: any = multer(multerOptions);
+
+export { UPLOAD_DIR, THUMBNAIL_DIR };
--- a/backend/src/routes/bestellung.routes.ts
+++ b/backend/src/routes/bestellung.routes.ts
@@ -0,0 +1,189 @@
+import { Router } from 'express';
+import bestellungController from '../controllers/bestellung.controller';
+import { authenticate } from '../middleware/auth.middleware';
+import { requirePermission } from '../middleware/rbac.middleware';
+import { uploadBestellung } from '../middleware/upload';
+
+const router = Router();
+
+// ---------------------------------------------------------------------------
+// Vendors (Lieferanten)
+// ---------------------------------------------------------------------------
+
+router.get(
+  '/vendors',
+  authenticate,
+  requirePermission('bestellungen:view'),
+  bestellungController.listVendors.bind(bestellungController)
+);
+
+router.post(
+  '/vendors',
+  authenticate,
+  requirePermission('bestellungen:manage_vendors'),
+  bestellungController.createVendor.bind(bestellungController)
+);
+
+router.patch(
+  '/vendors/:id',
+  authenticate,
+  requirePermission('bestellungen:manage_vendors'),
+  bestellungController.updateVendor.bind(bestellungController)
+);
+
+router.delete(
+  '/vendors/:id',
+  authenticate,
+  requirePermission('bestellungen:manage_vendors'),
+  bestellungController.deleteVendor.bind(bestellungController)
+);
+
+// ---------------------------------------------------------------------------
+// Orders (Bestellungen)
+// ---------------------------------------------------------------------------
+
+router.get(
+  '/',
+  authenticate,
+  requirePermission('bestellungen:view'),
+  bestellungController.listOrders.bind(bestellungController)
+);
+
+router.post(
+  '/',
+  authenticate,
+  requirePermission('bestellungen:create'),
+  bestellungController.createOrder.bind(bestellungController)
+);
+
+// Export must come before /:id to avoid param capture
+router.get(
+  '/export/:id',
+  authenticate,
+  requirePermission('bestellungen:export'),
+  bestellungController.exportOrder.bind(bestellungController)
+);
+
+router.get(
+  '/:id',
+  authenticate,
+  requirePermission('bestellungen:view'),
+  bestellungController.getOrder.bind(bestellungController)
+);
+
+router.patch(
+  '/:id',
+  authenticate,
+  requirePermission('bestellungen:create'),
+  bestellungController.updateOrder.bind(bestellungController)
+);
+
+router.delete(
+  '/:id',
+  authenticate,
+  requirePermission('bestellungen:delete'),
+  bestellungController.deleteOrder.bind(bestellungController)
+);
+
+router.patch(
+  '/:id/status',
+  authenticate,
+  requirePermission('bestellungen:create'),
+  bestellungController.updateStatus.bind(bestellungController)
+);
+
+// ---------------------------------------------------------------------------
+// Line Items (Bestellpositionen)
+// ---------------------------------------------------------------------------
+
+router.post(
+  '/:id/items',
+  authenticate,
+  requirePermission('bestellungen:create'),
+  bestellungController.addLineItem.bind(bestellungController)
+);
+
+router.patch(
+  '/items/:itemId',
+  authenticate,
+  requirePermission('bestellungen:create'),
+  bestellungController.updateLineItem.bind(bestellungController)
+);
+
+router.delete(
+  '/items/:itemId',
+  authenticate,
+  requirePermission('bestellungen:delete'),
+  bestellungController.deleteLineItem.bind(bestellungController)
+);
+
+router.patch(
+  '/items/:itemId/received',
+  authenticate,
+  requirePermission('bestellungen:create'),
+  bestellungController.updateReceivedQuantity.bind(bestellungController)
+);
+
+// ---------------------------------------------------------------------------
+// Files (Bestellung Dateien)
+// ---------------------------------------------------------------------------
+
+router.post(
+  '/:id/files',
+  authenticate,
+  requirePermission('bestellungen:create'),
+  uploadBestellung.single('datei'),
+  bestellungController.uploadFile.bind(bestellungController)
+);
+
+router.delete(
+  '/files/:fileId',
+  authenticate,
+  requirePermission('bestellungen:delete'),
+  bestellungController.deleteFile.bind(bestellungController)
+);
+
+router.get(
+  '/:id/files',
+  authenticate,
+  requirePermission('bestellungen:view'),
+  bestellungController.listFiles.bind(bestellungController)
+);
+
+// ---------------------------------------------------------------------------
+// Reminders (Erinnerungen)
+// ---------------------------------------------------------------------------
+
+router.post(
+  '/:id/reminders',
+  authenticate,
+  requirePermission('bestellungen:manage_reminders'),
+  bestellungController.addReminder.bind(bestellungController)
+);
+
+router.patch(
+  '/reminders/:remId',
+  authenticate,
+  requirePermission('bestellungen:manage_reminders'),
+  bestellungController.markReminderDone.bind(bestellungController)
+);
+
+router.delete(
+  '/reminders/:remId',
+  authenticate,
+  requirePermission('bestellungen:manage_reminders'),
+  bestellungController.deleteReminder.bind(bestellungController)
+);
+
+// ---------------------------------------------------------------------------
+// History & Export
+// ---------------------------------------------------------------------------
+
+router.get(
+  '/:id/history',
+  authenticate,
+  requirePermission('bestellungen:view'),
+  bestellungController.getHistory.bind(bestellungController)
+);
+
+export default router;
--- a/backend/src/routes/booking.routes.ts
+++ b/backend/src/routes/booking.routes.ts
@@ -18,15 +18,15 @@ router.get('/calendar-token', authenticate, bookingController.getCalendarToken.b

 // ── Write operations ──────────────────────────────────────────────────────────

-router.post('/',     authenticate, bookingController.create.bind(bookingController));
-router.patch('/:id', authenticate, requirePermission('kalender:edit_bookings'), bookingController.update.bind(bookingController));
+router.post('/',     authenticate, requirePermission('kalender:manage_bookings'), bookingController.create.bind(bookingController));
+router.patch('/:id', authenticate, requirePermission('kalender:manage_bookings'), bookingController.update.bind(bookingController));

 // Soft-cancel (sets abgesagt=TRUE) — creator or bookings:write
 router.delete('/:id',       authenticate, bookingController.cancel.bind(bookingController));
 router.patch('/:id/cancel', authenticate, bookingController.cancel.bind(bookingController));

 // Hard-delete (admin only)
-router.delete('/:id/force', authenticate, requirePermission('kalender:delete_bookings'), bookingController.hardDelete.bind(bookingController));
+router.delete('/:id/force', authenticate, requirePermission('kalender:manage_bookings'), bookingController.hardDelete.bind(bookingController));

 // ── Single booking read — after specific routes to avoid path conflicts ───────

--- a/backend/src/routes/bookstack.routes.ts
+++ b/backend/src/routes/bookstack.routes.ts
@@ -1,11 +1,12 @@
 import { Router } from 'express';
 import bookstackController from '../controllers/bookstack.controller';
 import { authenticate } from '../middleware/auth.middleware';
+import { requirePermission } from '../middleware/rbac.middleware';

 const router = Router();

-router.get('/recent', authenticate, bookstackController.getRecent.bind(bookstackController));
-router.get('/search', authenticate, bookstackController.search.bind(bookstackController));
-router.get('/pages/:id', authenticate, bookstackController.getPage.bind(bookstackController));
+router.get('/recent', authenticate, requirePermission('wissen:view'), bookstackController.getRecent.bind(bookstackController));
+router.get('/search', authenticate, requirePermission('wissen:view'), bookstackController.search.bind(bookstackController));
+router.get('/pages/:id', authenticate, requirePermission('wissen:view'), bookstackController.getPage.bind(bookstackController));

 export default router;
--- a/backend/src/routes/events.routes.ts
+++ b/backend/src/routes/events.routes.ts
@@ -22,7 +22,7 @@ router.get('/kategorien', authenticate, eventsController.listKategorien.bind(eve
 router.post(
  '/kategorien',
  authenticate,
-  requirePermission('kalender:manage_categories'),
+  requirePermission('kalender:create'),
  eventsController.createKategorie.bind(eventsController)
 );

@@ -33,7 +33,7 @@ router.post(
 router.patch(
  '/kategorien/:id',
  authenticate,
-  requirePermission('kalender:manage_categories'),
+  requirePermission('kalender:create'),
  eventsController.updateKategorie.bind(eventsController)
 );

@@ -44,7 +44,7 @@ router.patch(
 router.delete(
  '/kategorien/:id',
  authenticate,
-  requirePermission('kalender:manage_categories'),
+  requirePermission('kalender:create'),
  eventsController.deleteKategorie.bind(eventsController)
 );

--- a/backend/src/routes/shop.routes.ts
+++ b/backend/src/routes/shop.routes.ts
@@ -0,0 +1,38 @@
+import { Router } from 'express';
+import shopController from '../controllers/shop.controller';
+import { authenticate } from '../middleware/auth.middleware';
+import { requirePermission } from '../middleware/rbac.middleware';
+
+const router = Router();
+
+// ---------------------------------------------------------------------------
+// Catalog Items
+// ---------------------------------------------------------------------------
+
+router.get('/items', authenticate, requirePermission('shop:view'), shopController.getItems.bind(shopController));
+router.get('/items/:id', authenticate, requirePermission('shop:view'), shopController.getItemById.bind(shopController));
+router.post('/items', authenticate, requirePermission('shop:manage_catalog'), shopController.createItem.bind(shopController));
+router.patch('/items/:id', authenticate, requirePermission('shop:manage_catalog'), shopController.updateItem.bind(shopController));
+router.delete('/items/:id', authenticate, requirePermission('shop:manage_catalog'), shopController.deleteItem.bind(shopController));
+
+router.get('/categories', authenticate, requirePermission('shop:view'), shopController.getCategories.bind(shopController));
+
+// ---------------------------------------------------------------------------
+// Requests
+// ---------------------------------------------------------------------------
+
+router.get('/requests', authenticate, requirePermission('shop:approve_requests'), shopController.getRequests.bind(shopController));
+router.get('/requests/my', authenticate, shopController.getMyRequests.bind(shopController));
+router.get('/requests/:id', authenticate, shopController.getRequestById.bind(shopController));
+router.post('/requests', authenticate, requirePermission('shop:create_request'), shopController.createRequest.bind(shopController));
+router.patch('/requests/:id/status', authenticate, requirePermission('shop:approve_requests'), shopController.updateRequestStatus.bind(shopController));
+router.delete('/requests/:id', authenticate, requirePermission('shop:approve_requests'), shopController.deleteRequest.bind(shopController));
+
+// ---------------------------------------------------------------------------
+// Linking requests to orders
+// ---------------------------------------------------------------------------
+
+router.post('/requests/:id/link', authenticate, requirePermission('shop:link_orders'), shopController.linkToOrder.bind(shopController));
+router.delete('/requests/:id/link/:bestellungId', authenticate, requirePermission('shop:link_orders'), shopController.unlinkFromOrder.bind(shopController));
+
+export default router;
--- a/backend/src/routes/vikunja.routes.ts
+++ b/backend/src/routes/vikunja.routes.ts
@@ -1,12 +1,13 @@
 import { Router } from 'express';
 import vikunjaController from '../controllers/vikunja.controller';
 import { authenticate } from '../middleware/auth.middleware';
+import { requirePermission } from '../middleware/rbac.middleware';

 const router = Router();

-router.get('/tasks',   authenticate, vikunjaController.getMyTasks.bind(vikunjaController));
+router.get('/tasks',   authenticate, requirePermission('vikunja:widget_tasks'), vikunjaController.getMyTasks.bind(vikunjaController));
 router.get('/overdue', authenticate, vikunjaController.getOverdueTasks.bind(vikunjaController));
-router.get('/projects', authenticate, vikunjaController.getProjects.bind(vikunjaController));
-router.post('/tasks',  authenticate, vikunjaController.createTask.bind(vikunjaController));
+router.get('/projects', authenticate, requirePermission('vikunja:create_tasks'), vikunjaController.getProjects.bind(vikunjaController));
+router.post('/tasks',  authenticate, requirePermission('vikunja:create_tasks'), vikunjaController.createTask.bind(vikunjaController));

 export default router;
--- a/backend/src/server.ts
+++ b/backend/src/server.ts
@@ -4,6 +4,7 @@ import logger from './utils/logger';
 import { testConnection, closePool, runMigrations } from './config/database';
 import { startAuditCleanupJob, stopAuditCleanupJob } from './jobs/audit-cleanup.job';
 import { startNotificationJob, stopNotificationJob } from './jobs/notification-generation.job';
+import { startReminderJob, stopReminderJob } from './jobs/reminder.job';
 import { permissionService } from './services/permission.service';

 const startServer = async (): Promise<void> => {
@@ -28,6 +29,9 @@ const startServer = async (): Promise<void> => {
    // Start the notification generation job
    startNotificationJob();

+    // Start the order reminder job
+    startReminderJob();
+
    // Start the server
    const server = app.listen(environment.port, () => {
      logger.info('Server started successfully', {
@@ -51,6 +55,7 @@ const startServer = async (): Promise<void> => {
      // Stop scheduled jobs first
      stopAuditCleanupJob();
      stopNotificationJob();
+      stopReminderJob();

      server.close(async () => {
        logger.info('HTTP server closed');
--- a/backend/src/services/bestellung.service.ts
+++ b/backend/src/services/bestellung.service.ts
@@ -0,0 +1,607 @@
+// =============================================================================
+// Bestellung (Order) Service
+// =============================================================================
+
+import pool from '../config/database';
+import logger from '../utils/logger';
+import fs from 'fs';
+
+// ---------------------------------------------------------------------------
+// Vendors (Lieferanten)
+// ---------------------------------------------------------------------------
+
+async function getVendors() {
+  try {
+    const result = await pool.query(
+      `SELECT * FROM lieferanten ORDER BY name`
+    );
+    return result.rows;
+  } catch (error) {
+    logger.error('BestellungService.getVendors failed', { error });
+    throw new Error('Lieferanten konnten nicht geladen werden');
+  }
+}
+
+async function getVendorById(id: number) {
+  try {
+    const result = await pool.query(
+      `SELECT * FROM lieferanten WHERE id = $1`,
+      [id]
+    );
+    return result.rows[0] || null;
+  } catch (error) {
+    logger.error('BestellungService.getVendorById failed', { error, id });
+    throw new Error('Lieferant konnte nicht geladen werden');
+  }
+}
+
+async function createVendor(data: { name: string; kontakt_person?: string; email?: string; telefon?: string; adresse?: string; notizen?: string }, userId: string) {
+  try {
+    const result = await pool.query(
+      `INSERT INTO lieferanten (name, kontakt_person, email, telefon, adresse, notizen, erstellt_von)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       RETURNING *`,
+      [data.name, data.kontakt_person || null, data.email || null, data.telefon || null, data.adresse || null, data.notizen || null, userId]
+    );
+    return result.rows[0];
+  } catch (error) {
+    logger.error('BestellungService.createVendor failed', { error });
+    throw new Error('Lieferant konnte nicht erstellt werden');
+  }
+}
+
+async function updateVendor(id: number, data: { name?: string; kontakt_person?: string; email?: string; telefon?: string; adresse?: string; notizen?: string }, userId: string) {
+  try {
+    const result = await pool.query(
+      `UPDATE lieferanten
+       SET name = COALESCE($1, name),
+           kontakt_person = COALESCE($2, kontakt_person),
+           email = COALESCE($3, email),
+           telefon = COALESCE($4, telefon),
+           adresse = COALESCE($5, adresse),
+           notizen = COALESCE($6, notizen),
+           aktualisiert_am = NOW()
+       WHERE id = $7
+       RETURNING *`,
+      [data.name, data.kontakt_person, data.email, data.telefon, data.adresse, data.notizen, id]
+    );
+    if (result.rows.length === 0) return null;
+
+    await logAction(0, 'Lieferant aktualisiert', `Lieferant "${result.rows[0].name}" bearbeitet`, userId);
+    return result.rows[0];
+  } catch (error) {
+    logger.error('BestellungService.updateVendor failed', { error, id });
+    throw new Error('Lieferant konnte nicht aktualisiert werden');
+  }
+}
+
+async function deleteVendor(id: number) {
+  try {
+    const result = await pool.query(
+      `DELETE FROM lieferanten WHERE id = $1 RETURNING id`,
+      [id]
+    );
+    return (result.rowCount ?? 0) > 0;
+  } catch (error) {
+    logger.error('BestellungService.deleteVendor failed', { error, id });
+    throw new Error('Lieferant konnte nicht gelöscht werden');
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Orders (Bestellungen)
+// ---------------------------------------------------------------------------
+
+async function getOrders(filters?: { status?: string; lieferant_id?: number; besteller_id?: string }) {
+  try {
+    const conditions: string[] = [];
+    const params: unknown[] = [];
+    let paramIndex = 1;
+
+    if (filters?.status) {
+      conditions.push(`b.status = $${paramIndex++}`);
+      params.push(filters.status);
+    }
+    if (filters?.lieferant_id) {
+      conditions.push(`b.lieferant_id = $${paramIndex++}`);
+      params.push(filters.lieferant_id);
+    }
+    if (filters?.besteller_id) {
+      conditions.push(`b.erstellt_von = $${paramIndex++}`);
+      params.push(filters.besteller_id);
+    }
+
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+
+    const result = await pool.query(
+      `SELECT b.*,
+              l.name AS lieferant_name,
+              u.display_name AS besteller_name,
+              COALESCE(pos.total_cost, 0) AS total_cost,
+              COALESCE(pos.items_count, 0) AS items_count
+       FROM bestellungen b
+       LEFT JOIN lieferanten l ON l.id = b.lieferant_id
+       LEFT JOIN users u ON u.id = b.erstellt_von
+       LEFT JOIN LATERAL (
+         SELECT SUM(einzelpreis * menge) AS total_cost,
+                COUNT(*) AS items_count
+         FROM bestellpositionen
+         WHERE bestellung_id = b.id
+       ) pos ON true
+       ${whereClause}
+       ORDER BY b.erstellt_am DESC`,
+      params
+    );
+    return result.rows;
+  } catch (error) {
+    logger.error('BestellungService.getOrders failed', { error });
+    throw new Error('Bestellungen konnten nicht geladen werden');
+  }
+}
+
+async function getOrderById(id: number) {
+  try {
+    const orderResult = await pool.query(
+      `SELECT b.*,
+              l.name AS lieferant_name,
+              u.display_name AS besteller_name
+       FROM bestellungen b
+       LEFT JOIN lieferanten l ON l.id = b.lieferant_id
+       LEFT JOIN users u ON u.id = b.erstellt_von
+       WHERE b.id = $1`,
+      [id]
+    );
+    if (orderResult.rows.length === 0) return null;
+
+    const [positionen, dateien, erinnerungen, historie] = await Promise.all([
+      pool.query(`SELECT * FROM bestellpositionen WHERE bestellung_id = $1 ORDER BY id`, [id]),
+      pool.query(`SELECT * FROM bestellung_dateien WHERE bestellung_id = $1 ORDER BY hochgeladen_am DESC`, [id]),
+      pool.query(`SELECT * FROM bestellung_erinnerungen WHERE bestellung_id = $1 ORDER BY faellig_am`, [id]),
+      pool.query(`SELECT h.*, u.display_name AS benutzer_name FROM bestellung_historie h LEFT JOIN users u ON u.id = h.benutzer_id WHERE h.bestellung_id = $1 ORDER BY h.erstellt_am DESC`, [id]),
+    ]);
+
+    return {
+      ...orderResult.rows[0],
+      positionen: positionen.rows,
+      dateien: dateien.rows,
+      erinnerungen: erinnerungen.rows,
+      historie: historie.rows,
+    };
+  } catch (error) {
+    logger.error('BestellungService.getOrderById failed', { error, id });
+    throw new Error('Bestellung konnte nicht geladen werden');
+  }
+}
+
+async function createOrder(data: { titel: string; lieferant_id?: number; beschreibung?: string; prioritaet?: string }, userId: string) {
+  try {
+    const result = await pool.query(
+      `INSERT INTO bestellungen (titel, lieferant_id, beschreibung, prioritaet, erstellt_von)
+       VALUES ($1, $2, $3, $4, $5)
+       RETURNING *`,
+      [data.titel, data.lieferant_id || null, data.beschreibung || null, data.prioritaet || 'normal', userId]
+    );
+    const order = result.rows[0];
+    await logAction(order.id, 'Bestellung erstellt', `Bestellung "${data.titel}" erstellt`, userId);
+    return order;
+  } catch (error) {
+    logger.error('BestellungService.createOrder failed', { error });
+    throw new Error('Bestellung konnte nicht erstellt werden');
+  }
+}
+
+async function updateOrder(id: number, data: { titel?: string; lieferant_id?: number; beschreibung?: string; prioritaet?: string; status?: string }, userId: string) {
+  try {
+    // Check current order for status change detection
+    const current = await pool.query(`SELECT * FROM bestellungen WHERE id = $1`, [id]);
+    if (current.rows.length === 0) return null;
+
+    const oldStatus = current.rows[0].status;
+    const newStatus = data.status || oldStatus;
+
+    let bestellt_am = current.rows[0].bestellt_am;
+    let abgeschlossen_am = current.rows[0].abgeschlossen_am;
+
+    if (newStatus !== oldStatus) {
+      if (newStatus === 'bestellt' && !bestellt_am) {
+        bestellt_am = new Date();
+      }
+      if (newStatus === 'abgeschlossen' && !abgeschlossen_am) {
+        abgeschlossen_am = new Date();
+      }
+    }
+
+    const result = await pool.query(
+      `UPDATE bestellungen
+       SET titel = COALESCE($1, titel),
+           lieferant_id = COALESCE($2, lieferant_id),
+           beschreibung = COALESCE($3, beschreibung),
+           prioritaet = COALESCE($4, prioritaet),
+           status = COALESCE($5, status),
+           bestellt_am = $6,
+           abgeschlossen_am = $7,
+           aktualisiert_am = NOW()
+       WHERE id = $8
+       RETURNING *`,
+      [data.titel, data.lieferant_id, data.beschreibung, data.prioritaet, data.status, bestellt_am, abgeschlossen_am, id]
+    );
+    if (result.rows.length === 0) return null;
+
+    const changes: string[] = [];
+    if (data.titel) changes.push(`Titel geändert`);
+    if (data.lieferant_id) changes.push(`Lieferant geändert`);
+    if (data.status && data.status !== oldStatus) changes.push(`Status: ${oldStatus} → ${data.status}`);
+    if (data.prioritaet) changes.push(`Priorität geändert`);
+
+    await logAction(id, 'Bestellung aktualisiert', changes.join(', ') || 'Bestellung bearbeitet', userId);
+    return result.rows[0];
+  } catch (error) {
+    logger.error('BestellungService.updateOrder failed', { error, id });
+    throw new Error('Bestellung konnte nicht aktualisiert werden');
+  }
+}
+
+async function deleteOrder(id: number, _userId: string) {
+  try {
+    // Get file paths before deleting
+    const filesResult = await pool.query(
+      `SELECT dateipfad FROM bestellung_dateien WHERE bestellung_id = $1`,
+      [id]
+    );
+    const filePaths = filesResult.rows.map((r: { dateipfad: string }) => r.dateipfad);
+
+    const result = await pool.query(
+      `DELETE FROM bestellungen WHERE id = $1 RETURNING id`,
+      [id]
+    );
+    if ((result.rowCount ?? 0) === 0) return false;
+
+    // Remove files from disk
+    for (const filePath of filePaths) {
+      try {
+        if (filePath && fs.existsSync(filePath)) {
+          fs.unlinkSync(filePath);
+        }
+      } catch (err) {
+        logger.warn('Failed to delete file from disk', { filePath, error: err });
+      }
+    }
+
+    return true;
+  } catch (error) {
+    logger.error('BestellungService.deleteOrder failed', { error, id });
+    throw new Error('Bestellung konnte nicht gelöscht werden');
+  }
+}
+
+const VALID_STATUS_TRANSITIONS: Record<string, string[]> = {
+  entwurf:        ['bestellt', 'storniert'],
+  bestellt:       ['teillieferung', 'vollstaendig', 'storniert'],
+  teillieferung:  ['vollstaendig', 'storniert'],
+  vollstaendig:   ['abgeschlossen'],
+  abgeschlossen:  [],
+  storniert:      ['entwurf'],
+};
+
+async function updateOrderStatus(id: number, status: string, userId: string) {
+  try {
+    const current = await pool.query(`SELECT status FROM bestellungen WHERE id = $1`, [id]);
+    if (current.rows.length === 0) return null;
+
+    const oldStatus = current.rows[0].status;
+    const allowed = VALID_STATUS_TRANSITIONS[oldStatus] || [];
+    if (!allowed.includes(status)) {
+      throw new Error(`Ungültiger Statusübergang: ${oldStatus} → ${status}`);
+    }
+
+    const updates: string[] = ['status = $1', 'aktualisiert_am = NOW()'];
+    const params: unknown[] = [status];
+    let paramIndex = 2;
+
+    if (status === 'bestellt') {
+      updates.push(`bestellt_am = COALESCE(bestellt_am, NOW())`);
+    }
+    if (status === 'abgeschlossen') {
+      updates.push(`abgeschlossen_am = COALESCE(abgeschlossen_am, NOW())`);
+    }
+
+    params.push(id);
+    const result = await pool.query(
+      `UPDATE bestellungen SET ${updates.join(', ')} WHERE id = $${paramIndex} RETURNING *`,
+      params
+    );
+
+    await logAction(id, 'Status geändert', `${oldStatus} → ${status}`, userId);
+    return result.rows[0];
+  } catch (error) {
+    logger.error('BestellungService.updateOrderStatus failed', { error, id });
+    throw error;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Line Items (Bestellpositionen)
+// ---------------------------------------------------------------------------
+
+async function addLineItem(bestellungId: number, data: { artikel: string; menge: number; einheit?: string; einzelpreis?: number; notizen?: string }, userId: string) {
+  try {
+    const result = await pool.query(
+      `INSERT INTO bestellpositionen (bestellung_id, artikel, menge, einheit, einzelpreis, notizen)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       RETURNING *`,
+      [bestellungId, data.artikel, data.menge, data.einheit || 'Stück', data.einzelpreis || 0, data.notizen || null]
+    );
+    await logAction(bestellungId, 'Position hinzugefügt', `"${data.artikel}" x${data.menge}`, userId);
+    return result.rows[0];
+  } catch (error) {
+    logger.error('BestellungService.addLineItem failed', { error, bestellungId });
+    throw new Error('Position konnte nicht hinzugefügt werden');
+  }
+}
+
+async function updateLineItem(id: number, data: { artikel?: string; menge?: number; einheit?: string; einzelpreis?: number; notizen?: string }, userId: string) {
+  try {
+    const result = await pool.query(
+      `UPDATE bestellpositionen
+       SET artikel = COALESCE($1, artikel),
+           menge = COALESCE($2, menge),
+           einheit = COALESCE($3, einheit),
+           einzelpreis = COALESCE($4, einzelpreis),
+           notizen = COALESCE($5, notizen)
+       WHERE id = $6
+       RETURNING *`,
+      [data.artikel, data.menge, data.einheit, data.einzelpreis, data.notizen, id]
+    );
+    if (result.rows.length === 0) return null;
+
+    const item = result.rows[0];
+    await logAction(item.bestellung_id, 'Position aktualisiert', `"${item.artikel}" bearbeitet`, userId);
+    return item;
+  } catch (error) {
+    logger.error('BestellungService.updateLineItem failed', { error, id });
+    throw new Error('Position konnte nicht aktualisiert werden');
+  }
+}
+
+async function deleteLineItem(id: number, userId: string) {
+  try {
+    const item = await pool.query(`SELECT * FROM bestellpositionen WHERE id = $1`, [id]);
+    if (item.rows.length === 0) return false;
+
+    await pool.query(`DELETE FROM bestellpositionen WHERE id = $1`, [id]);
+    await logAction(item.rows[0].bestellung_id, 'Position entfernt', `"${item.rows[0].artikel}" entfernt`, userId);
+    return true;
+  } catch (error) {
+    logger.error('BestellungService.deleteLineItem failed', { error, id });
+    throw new Error('Position konnte nicht gelöscht werden');
+  }
+}
+
+async function updateReceivedQuantity(id: number, menge: number, userId: string) {
+  try {
+    const result = await pool.query(
+      `UPDATE bestellpositionen SET erhalten_menge = $1 WHERE id = $2 RETURNING *`,
+      [menge, id]
+    );
+    if (result.rows.length === 0) return null;
+
+    const item = result.rows[0];
+    await logAction(item.bestellung_id, 'Liefermenge aktualisiert', `"${item.artikel}": ${menge} von ${item.menge} erhalten`, userId);
+
+    // Check if all items for this order are fully received
+    const allItems = await pool.query(
+      `SELECT menge, erhalten_menge FROM bestellpositionen WHERE bestellung_id = $1`,
+      [item.bestellung_id]
+    );
+    const allReceived = allItems.rows.every((r: { menge: number; erhalten_menge: number }) => r.erhalten_menge >= r.menge);
+    const someReceived = allItems.rows.some((r: { menge: number; erhalten_menge: number }) => (r.erhalten_menge ?? 0) > 0);
+
+    // Auto-update order status if currently 'bestellt'
+    const order = await pool.query(`SELECT status FROM bestellungen WHERE id = $1`, [item.bestellung_id]);
+    if (order.rows.length > 0 && (order.rows[0].status === 'bestellt' || order.rows[0].status === 'teillieferung')) {
+      if (allReceived) {
+        await pool.query(
+          `UPDATE bestellungen SET status = 'vollstaendig', aktualisiert_am = NOW() WHERE id = $1`,
+          [item.bestellung_id]
+        );
+        await logAction(item.bestellung_id, 'Status geändert', 'Alle Positionen vollständig erhalten → vollstaendig', userId);
+      } else if (someReceived && order.rows[0].status === 'bestellt') {
+        await pool.query(
+          `UPDATE bestellungen SET status = 'teillieferung', aktualisiert_am = NOW() WHERE id = $1`,
+          [item.bestellung_id]
+        );
+        await logAction(item.bestellung_id, 'Status geändert', 'Teillieferung eingegangen → teillieferung', userId);
+      }
+    }
+
+    return item;
+  } catch (error) {
+    logger.error('BestellungService.updateReceivedQuantity failed', { error, id });
+    throw new Error('Liefermenge konnte nicht aktualisiert werden');
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Files (Bestellung Dateien)
+// ---------------------------------------------------------------------------
+
+async function addFile(bestellungId: number, fileData: { dateiname: string; dateipfad: string; dateityp: string; dateigroesse: number }, userId: string) {
+  try {
+    const result = await pool.query(
+      `INSERT INTO bestellung_dateien (bestellung_id, dateiname, dateipfad, dateityp, dateigroesse, hochgeladen_von)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       RETURNING *`,
+      [bestellungId, fileData.dateiname, fileData.dateipfad, fileData.dateityp, fileData.dateigroesse, userId]
+    );
+    await logAction(bestellungId, 'Datei hochgeladen', `"${fileData.dateiname}"`, userId);
+    return result.rows[0];
+  } catch (error) {
+    logger.error('BestellungService.addFile failed', { error, bestellungId });
+    throw new Error('Datei konnte nicht gespeichert werden');
+  }
+}
+
+async function deleteFile(id: number, userId: string) {
+  try {
+    const fileResult = await pool.query(
+      `SELECT * FROM bestellung_dateien WHERE id = $1`,
+      [id]
+    );
+    if (fileResult.rows.length === 0) return null;
+
+    const file = fileResult.rows[0];
+    await pool.query(`DELETE FROM bestellung_dateien WHERE id = $1`, [id]);
+    await logAction(file.bestellung_id, 'Datei gelöscht', `"${file.dateiname}"`, userId);
+
+    return { dateipfad: file.dateipfad, dateiname: file.dateiname };
+  } catch (error) {
+    logger.error('BestellungService.deleteFile failed', { error, id });
+    throw new Error('Datei konnte nicht gelöscht werden');
+  }
+}
+
+async function getFilesByOrder(bestellungId: number) {
+  try {
+    const result = await pool.query(
+      `SELECT * FROM bestellung_dateien WHERE bestellung_id = $1 ORDER BY hochgeladen_am DESC`,
+      [bestellungId]
+    );
+    return result.rows;
+  } catch (error) {
+    logger.error('BestellungService.getFilesByOrder failed', { error, bestellungId });
+    throw new Error('Dateien konnten nicht geladen werden');
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Reminders (Bestellung Erinnerungen)
+// ---------------------------------------------------------------------------
+
+async function addReminder(bestellungId: number, data: { titel: string; faellig_am: string; notizen?: string }, userId: string) {
+  try {
+    const result = await pool.query(
+      `INSERT INTO bestellung_erinnerungen (bestellung_id, titel, faellig_am, notizen, erstellt_von)
+       VALUES ($1, $2, $3, $4, $5)
+       RETURNING *`,
+      [bestellungId, data.titel, data.faellig_am, data.notizen || null, userId]
+    );
+    await logAction(bestellungId, 'Erinnerung erstellt', `"${data.titel}" fällig am ${data.faellig_am}`, userId);
+    return result.rows[0];
+  } catch (error) {
+    logger.error('BestellungService.addReminder failed', { error, bestellungId });
+    throw new Error('Erinnerung konnte nicht erstellt werden');
+  }
+}
+
+async function markReminderDone(id: number, userId: string) {
+  try {
+    const result = await pool.query(
+      `UPDATE bestellung_erinnerungen SET erledigt = TRUE WHERE id = $1 RETURNING *`,
+      [id]
+    );
+    if (result.rows.length === 0) return null;
+
+    const reminder = result.rows[0];
+    await logAction(reminder.bestellung_id, 'Erinnerung erledigt', `"${reminder.titel}"`, userId);
+    return reminder;
+  } catch (error) {
+    logger.error('BestellungService.markReminderDone failed', { error, id });
+    throw new Error('Erinnerung konnte nicht als erledigt markiert werden');
+  }
+}
+
+async function deleteReminder(id: number) {
+  try {
+    const result = await pool.query(
+      `DELETE FROM bestellung_erinnerungen WHERE id = $1 RETURNING id`,
+      [id]
+    );
+    return (result.rowCount ?? 0) > 0;
+  } catch (error) {
+    logger.error('BestellungService.deleteReminder failed', { error, id });
+    throw new Error('Erinnerung konnte nicht gelöscht werden');
+  }
+}
+
+async function getDueReminders() {
+  try {
+    const result = await pool.query(
+      `SELECT e.*, b.titel AS bestellung_titel, b.erstellt_von AS besteller_id
+       FROM bestellung_erinnerungen e
+       JOIN bestellungen b ON b.id = e.bestellung_id
+       WHERE e.faellig_am <= NOW() AND e.erledigt = FALSE
+       ORDER BY e.faellig_am`
+    );
+    return result.rows;
+  } catch (error) {
+    logger.error('BestellungService.getDueReminders failed', { error });
+    throw new Error('Fällige Erinnerungen konnten nicht geladen werden');
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Audit History (Bestellung Historie)
+// ---------------------------------------------------------------------------
+
+async function logAction(bestellungId: number, aktion: string, details: string, userId: string) {
+  try {
+    await pool.query(
+      `INSERT INTO bestellung_historie (bestellung_id, benutzer_id, aktion, details)
+       VALUES ($1, $2, $3, $4)`,
+      [bestellungId, userId, aktion, details]
+    );
+  } catch (error) {
+    logger.error('BestellungService.logAction failed', { error, bestellungId, aktion });
+    // Non-fatal — don't propagate
+  }
+}
+
+async function getHistory(bestellungId: number) {
+  try {
+    const result = await pool.query(
+      `SELECT h.*, u.display_name AS benutzer_name
+       FROM bestellung_historie h
+       LEFT JOIN users u ON u.id = h.benutzer_id
+       WHERE h.bestellung_id = $1
+       ORDER BY h.erstellt_am DESC`,
+      [bestellungId]
+    );
+    return result.rows;
+  } catch (error) {
+    logger.error('BestellungService.getHistory failed', { error, bestellungId });
+    throw new Error('Historie konnte nicht geladen werden');
+  }
+}
+
+export default {
+  // Vendors
+  getVendors,
+  getVendorById,
+  createVendor,
+  updateVendor,
+  deleteVendor,
+  // Orders
+  getOrders,
+  getOrderById,
+  createOrder,
+  updateOrder,
+  deleteOrder,
+  updateOrderStatus,
+  // Line Items
+  addLineItem,
+  updateLineItem,
+  deleteLineItem,
+  updateReceivedQuantity,
+  // Files
+  addFile,
+  deleteFile,
+  getFilesByOrder,
+  // Reminders
+  addReminder,
+  markReminderDone,
+  deleteReminder,
+  getDueReminders,
+  // Audit
+  logAction,
+  getHistory,
+};
--- a/backend/src/services/shop.service.ts
+++ b/backend/src/services/shop.service.ts
@@ -0,0 +1,323 @@
+import pool from '../config/database';
+import logger from '../utils/logger';
+
+// ---------------------------------------------------------------------------
+// Catalog Items (shop_artikel)
+// ---------------------------------------------------------------------------
+
+async function getItems(filters?: { kategorie?: string; aktiv?: boolean }) {
+  const conditions: string[] = [];
+  const params: unknown[] = [];
+
+  if (filters?.kategorie) {
+    params.push(filters.kategorie);
+    conditions.push(`kategorie = $${params.length}`);
+  }
+  if (filters?.aktiv !== undefined) {
+    params.push(filters.aktiv);
+    conditions.push(`aktiv = $${params.length}`);
+  }
+
+  const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+  const result = await pool.query(
+    `SELECT * FROM shop_artikel ${where} ORDER BY kategorie, bezeichnung`,
+    params,
+  );
+  return result.rows;
+}
+
+async function getItemById(id: number) {
+  const result = await pool.query('SELECT * FROM shop_artikel WHERE id = $1', [id]);
+  return result.rows[0] || null;
+}
+
+async function createItem(
+  data: {
+    bezeichnung: string;
+    beschreibung?: string;
+    kategorie?: string;
+    geschaetzte_kosten?: number;
+    url?: string;
+    aktiv?: boolean;
+  },
+  userId: string,
+) {
+  const result = await pool.query(
+    `INSERT INTO shop_artikel (bezeichnung, beschreibung, kategorie, geschaetzte_kosten, url, aktiv, erstellt_von)
+     VALUES ($1, $2, $3, $4, $5, COALESCE($6, true), $7)
+     RETURNING *`,
+    [data.bezeichnung, data.beschreibung || null, data.kategorie || null, data.geschaetzte_kosten || null, data.url || null, data.aktiv ?? true, userId],
+  );
+  return result.rows[0];
+}
+
+async function updateItem(
+  id: number,
+  data: {
+    bezeichnung?: string;
+    beschreibung?: string;
+    kategorie?: string;
+    geschaetzte_kosten?: number;
+    url?: string;
+    aktiv?: boolean;
+  },
+  userId: string,
+) {
+  const fields: string[] = [];
+  const params: unknown[] = [];
+
+  if (data.bezeichnung !== undefined) {
+    params.push(data.bezeichnung);
+    fields.push(`bezeichnung = $${params.length}`);
+  }
+  if (data.beschreibung !== undefined) {
+    params.push(data.beschreibung);
+    fields.push(`beschreibung = $${params.length}`);
+  }
+  if (data.kategorie !== undefined) {
+    params.push(data.kategorie);
+    fields.push(`kategorie = $${params.length}`);
+  }
+  if (data.geschaetzte_kosten !== undefined) {
+    params.push(data.geschaetzte_kosten);
+    fields.push(`geschaetzte_kosten = $${params.length}`);
+  }
+  if (data.url !== undefined) {
+    params.push(data.url);
+    fields.push(`url = $${params.length}`);
+  }
+  if (data.aktiv !== undefined) {
+    params.push(data.aktiv);
+    fields.push(`aktiv = $${params.length}`);
+  }
+
+  if (fields.length === 0) {
+    return getItemById(id);
+  }
+
+  params.push(userId);
+  fields.push(`aktualisiert_von = $${params.length}`);
+  params.push(new Date());
+  fields.push(`aktualisiert_am = $${params.length}`);
+
+  params.push(id);
+  const result = await pool.query(
+    `UPDATE shop_artikel SET ${fields.join(', ')} WHERE id = $${params.length} RETURNING *`,
+    params,
+  );
+  return result.rows[0] || null;
+}
+
+async function deleteItem(id: number) {
+  await pool.query('DELETE FROM shop_artikel WHERE id = $1', [id]);
+}
+
+async function getCategories() {
+  const result = await pool.query(
+    'SELECT DISTINCT kategorie FROM shop_artikel WHERE kategorie IS NOT NULL ORDER BY kategorie',
+  );
+  return result.rows.map((r: { kategorie: string }) => r.kategorie);
+}
+
+// ---------------------------------------------------------------------------
+// Requests (shop_anfragen)
+// ---------------------------------------------------------------------------
+
+async function getRequests(filters?: { status?: string; anfrager_id?: string }) {
+  const conditions: string[] = [];
+  const params: unknown[] = [];
+
+  if (filters?.status) {
+    params.push(filters.status);
+    conditions.push(`a.status = $${params.length}`);
+  }
+  if (filters?.anfrager_id) {
+    params.push(filters.anfrager_id);
+    conditions.push(`a.anfrager_id = $${params.length}`);
+  }
+
+  const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+  const result = await pool.query(
+    `SELECT a.*,
+            u.vorname || ' ' || u.nachname AS anfrager_name,
+            u2.vorname || ' ' || u2.nachname AS bearbeitet_von_name,
+            (SELECT COUNT(*)::int FROM shop_anfrage_positionen p WHERE p.anfrage_id = a.id) AS positionen_count
+     FROM shop_anfragen a
+     LEFT JOIN users u  ON u.id  = a.anfrager_id
+     LEFT JOIN users u2 ON u2.id = a.bearbeitet_von
+     ${where}
+     ORDER BY a.erstellt_am DESC`,
+    params,
+  );
+  return result.rows;
+}
+
+async function getMyRequests(userId: string) {
+  const result = await pool.query(
+    `SELECT a.*,
+            (SELECT COUNT(*)::int FROM shop_anfrage_positionen p WHERE p.anfrage_id = a.id) AS positionen_count
+     FROM shop_anfragen a
+     WHERE a.anfrager_id = $1
+     ORDER BY a.erstellt_am DESC`,
+    [userId],
+  );
+  return result.rows;
+}
+
+async function getRequestById(id: number) {
+  const reqResult = await pool.query(
+    `SELECT a.*,
+            u.vorname || ' ' || u.nachname AS anfrager_name,
+            u2.vorname || ' ' || u2.nachname AS bearbeitet_von_name
+     FROM shop_anfragen a
+     LEFT JOIN users u  ON u.id  = a.anfrager_id
+     LEFT JOIN users u2 ON u2.id = a.bearbeitet_von
+     WHERE a.id = $1`,
+    [id],
+  );
+  if (reqResult.rows.length === 0) return null;
+
+  const positionen = await pool.query(
+    `SELECT p.*, sa.bezeichnung AS artikel_bezeichnung, sa.kategorie AS artikel_kategorie
+     FROM shop_anfrage_positionen p
+     LEFT JOIN shop_artikel sa ON sa.id = p.artikel_id
+     WHERE p.anfrage_id = $1
+     ORDER BY p.id`,
+    [id],
+  );
+
+  const bestellungen = await pool.query(
+    `SELECT b.*
+     FROM shop_anfrage_bestellung ab
+     JOIN bestellungen b ON b.id = ab.bestellung_id
+     WHERE ab.anfrage_id = $1`,
+    [id],
+  );
+
+  return {
+    ...reqResult.rows[0],
+    positionen: positionen.rows,
+    bestellungen: bestellungen.rows,
+  };
+}
+
+async function createRequest(
+  userId: string,
+  items: { artikel_id?: number; bezeichnung: string; menge: number; notizen?: string }[],
+  notizen?: string,
+) {
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+
+    const anfrageResult = await client.query(
+      `INSERT INTO shop_anfragen (anfrager_id, notizen)
+       VALUES ($1, $2)
+       RETURNING *`,
+      [userId, notizen || null],
+    );
+    const anfrage = anfrageResult.rows[0];
+
+    for (const item of items) {
+      let bezeichnung = item.bezeichnung;
+
+      // If artikel_id is provided, copy bezeichnung from catalog
+      if (item.artikel_id) {
+        const artikelResult = await client.query(
+          'SELECT bezeichnung FROM shop_artikel WHERE id = $1',
+          [item.artikel_id],
+        );
+        if (artikelResult.rows.length > 0) {
+          bezeichnung = artikelResult.rows[0].bezeichnung;
+        }
+      }
+
+      await client.query(
+        `INSERT INTO shop_anfrage_positionen (anfrage_id, artikel_id, bezeichnung, menge, notizen)
+         VALUES ($1, $2, $3, $4, $5)`,
+        [anfrage.id, item.artikel_id || null, bezeichnung, item.menge, item.notizen || null],
+      );
+    }
+
+    await client.query('COMMIT');
+    return getRequestById(anfrage.id);
+  } catch (error) {
+    await client.query('ROLLBACK');
+    logger.error('shopService.createRequest failed', { error });
+    throw error;
+  } finally {
+    client.release();
+  }
+}
+
+async function updateRequestStatus(
+  id: number,
+  status: string,
+  adminNotizen?: string,
+  bearbeitetVon?: string,
+) {
+  const result = await pool.query(
+    `UPDATE shop_anfragen
+     SET status = $1,
+         admin_notizen = COALESCE($2, admin_notizen),
+         bearbeitet_von = COALESCE($3, bearbeitet_von),
+         bearbeitet_am = NOW()
+     WHERE id = $4
+     RETURNING *`,
+    [status, adminNotizen || null, bearbeitetVon || null, id],
+  );
+  return result.rows[0] || null;
+}
+
+async function deleteRequest(id: number) {
+  await pool.query('DELETE FROM shop_anfragen WHERE id = $1', [id]);
+}
+
+// ---------------------------------------------------------------------------
+// Linking (shop_anfrage_bestellung)
+// ---------------------------------------------------------------------------
+
+async function linkToOrder(anfrageId: number, bestellungId: number) {
+  await pool.query(
+    `INSERT INTO shop_anfrage_bestellung (anfrage_id, bestellung_id)
+     VALUES ($1, $2)
+     ON CONFLICT DO NOTHING`,
+    [anfrageId, bestellungId],
+  );
+}
+
+async function unlinkFromOrder(anfrageId: number, bestellungId: number) {
+  await pool.query(
+    'DELETE FROM shop_anfrage_bestellung WHERE anfrage_id = $1 AND bestellung_id = $2',
+    [anfrageId, bestellungId],
+  );
+}
+
+async function getLinkedOrders(anfrageId: number) {
+  const result = await pool.query(
+    `SELECT b.*
+     FROM shop_anfrage_bestellung ab
+     JOIN bestellungen b ON b.id = ab.bestellung_id
+     WHERE ab.anfrage_id = $1`,
+    [anfrageId],
+  );
+  return result.rows;
+}
+
+export default {
+  getItems,
+  getItemById,
+  createItem,
+  updateItem,
+  deleteItem,
+  getCategories,
+  getRequests,
+  getMyRequests,
+  getRequestById,
+  createRequest,
+  updateRequestStatus,
+  deleteRequest,
+  linkToOrder,
+  unlinkFromOrder,
+  getLinkedOrders,
+};
--- a/backend/src/services/upload.service.ts
+++ b/backend/src/services/upload.service.ts
@@ -0,0 +1,44 @@
+import path from 'path';
+import fs from 'fs';
+import logger from '../utils/logger';
+import { THUMBNAIL_DIR } from '../middleware/upload';
+
+let sharp: any = null;
+try {
+  sharp = require('sharp');
+} catch {
+  logger.warn('sharp not installed — thumbnail generation disabled');
+}
+
+async function generateThumbnail(filePath: string, mimeType: string): Promise<string | null> {
+  if (!sharp) return null;
+  if (!mimeType.startsWith('image/')) return null;
+
+  try {
+    const ext = path.extname(filePath);
+    const baseName = path.basename(filePath, ext);
+    const thumbPath = path.join(THUMBNAIL_DIR, `${baseName}_thumb.webp`);
+
+    await sharp(filePath)
+      .resize(200, 200, { fit: 'inside', withoutEnlargement: true })
+      .webp({ quality: 70 })
+      .toFile(thumbPath);
+
+    return thumbPath;
+  } catch (error) {
+    logger.error('Thumbnail generation failed', { filePath, error });
+    return null;
+  }
+}
+
+function deleteFile(filePath: string): void {
+  try {
+    if (fs.existsSync(filePath)) {
+      fs.unlinkSync(filePath);
+    }
+  } catch (error) {
+    logger.error('File deletion failed', { filePath, error });
+  }
+}
+
+export default { generateThumbnail, deleteFile };