user management drin.

app/routes.py

@@ -49,13 +49,9 @@ def auth_callback():
     # Zitadel-Roles-Claim: {"Admin": {"<org-id>": "<org-name>"}, ...}
     roles_claim = userinfo.get("urn:zitadel:iam:org:project:roles", {})
 
-    logger.info(
-        "OIDC Login – sub: %s | email: %s | roles: %s | full_userinfo: %s",
-        sub, email, list(roles_claim.keys()), dict(userinfo),
-    )
-
     if not roles_claim:
         logger.warning("Kein Roles-Claim im Token für sub=%s – Zugriff verweigert.", sub)
+        _log_login(sub, email, list(roles_claim.keys()), app_role=None, projects=[])
         return redirect(url_for("main.error"))
 
     role = next(iter(roles_claim.keys()))
@@ -69,12 +65,46 @@ def auth_callback():
         db.session.add(user)
     db.session.commit()
 
+    # Projekt-Zuordnungen für den Log ermitteln
+    if role == "Mitarbeiter":
+        mappings = ProjectMitarbeiterMapping.query.filter_by(user_id=sub).all()
+        projects = Project.query.filter(
+            Project.id.in_({m.project_id for m in mappings})
+        ).all()
+    elif role == "Kunde":
+        mappings = ProjectKundenMapping.query.filter_by(user_id=sub).all()
+        projects = Project.query.filter(
+            Project.id.in_({m.project_id for m in mappings})
+        ).all()
+    else:
+        projects = Project.query.all()  # Admin sieht alles
+
+    _log_login(sub, email, list(roles_claim.keys()), app_role=role, projects=projects)
+
     session["user"] = {"sub": sub, "email": email, "role": role}
     session["id_token"] = token.get("id_token")
 
     return redirect(url_for("main.index"))
 
 
+def _log_login(sub, email, zitadel_roles, app_role, projects):
+    project_list = ", ".join(f"[{p.id}] {p.name}" for p in projects) or "–"
+    logger.info(
+        "\n"
+        "╔══ LOGIN ══════════════════════════════════\n"
+        "║  sub          : %s\n"
+        "║  email        : %s\n"
+        "║  Zitadel-Rol. : %s\n"
+        "║  App-Rolle    : %s\n"
+        "║  Projekte     : %s\n"
+        "╚═══════════════════════════════════════════",
+        sub, email,
+        ", ".join(zitadel_roles) or "–",
+        app_role or "KEIN ZUGRIFF",
+        project_list,
+    )
+
+
 @main.route("/logout")
 def logout():
     id_token = session.pop("id_token", None)