Merge pull request 'SHL-04: AccountBar-Dopplung aufgeloest' (#372) from feature/shl-03-accountbar-dedup into main

docs/ARBEITSKARTEN.md

@@ -0,0 +1,68 @@
+# Arbeitskarten (Stand 2026-10-27)
+
+Reihenfolge = Abarbeitungsfolge. Status: offen / blockiert / Entscheidung nötig / erledigt.
+Regel je Karte: eigener Branch, eigener PR, Tests auf 131 bzw. 204 (nie archivdms), PR-Beschreibung nennt Auswirkungen.
+
+## A. common/-Modul
+
+### A-01 Tag common/v0.1.0 — blockiert
+- Ziel: Tag-Workflow `common-tag.yml` erzeugt `common/v0.1.0`.
+- Blockiert durch: Runner `nexarch-131-runner` arbeitet CI-Warteschlange ab (Unit `act_runner.service` auf 131).
+- Schritte: Warteschlange beobachten; bei Lauf-Fehler Log lesen und Workflow korrigieren; Tag per `git ls-remote --tags origin 'common/*'` prüfen.
+- Fertig, wenn: Tag existiert und `go list -m gitea.perlbach24.de/scripte/nexarch/common@v0.1.0` auf 131 mit GOPRIVATE und `.netrc` funktioniert.
+- Hinweis: Lesezugriff-Token auf 131 legt der User an; Claude fasst keine Tokens an.
+
+### A-02 Umstellung archive (Pilot) — wartet auf A-01
+- Vorlage: Branches `refactor/common-modul-pilot`, `refactor/common-batch-2`.
+- Schritte: `require .../common v0.1.0` und go.sum; Importe von httpharden, svcauth, auditclient, tenantregistryclient (soweit in archive genutzt) umschreiben; interne Kopien löschen; gofmt wegen Import-Reihenfolge; Pflichttest-Gate von archive um common-Muster erweitern; Modul-Guards wiederherstellen.
+- Test: `go build/vet/test ./...` im Modul auf 131 in frischem Wurfverzeichnis; DB-Tests auf 204 mit `dms_dev` und `TEST_ADMIN_DSN`.
+- Nachweis: normalisierter md5-Vergleich (ohne Kommentare/Imports) zeigt, dass gelöschte Kopie und common-Paket gleich waren.
+- Fertig, wenn: PR offen, Tests grün, Auswirkungsliste in der PR-Beschreibung.
+
+### A-03 bis A-07 Umstellung weiterer Module — je nach A-02
+Reihenfolge: dms, mail, ai, connect, workflow; danach Root-Modul.
+- Pro Modul wie A-02. NICHT nach common: audittrail, cutoverstage, crypto, notifyclient, dms-Varianten von apierror/policyclient/httpharden, Root-httpclient.
+- Je Modul eigener PR.
+
+### A-08 CI-DB-Tests ausweiten — Entscheidung nötig
+- Stand: `testdb.AdminDSN` und `.gitea/workflows/db-tests.yml` (Label `nexarch-test`) sind gemergt, Workflow deckt nur `common/` ab.
+- Entscheidungen des Users nötig: Runner mit Label `nexarch-test` auf 204 registrieren, Secret `TEST_ADMIN_DSN` (Wegwerf-DB, nie archivdms) setzen.
+- Schritte danach: Modul-Tests auf `testdb.AdminDSN` umstellen (jeweils mit A-02..A-07), Workflow-Pfade ergänzen.
+
+### A-09 Reviewer für common/ — Entscheidung nötig
+- Offene Frage: Gitea-Benutzernamen für CODEOWNERS/Review-Pflicht auf `common/`.
+
+## B. Portal (Vorschlag Fable, Detail siehe Gesprächsverlauf)
+
+### B-01 Fundament — erledigt auf feature/portal-ausbau (Entscheidung: Ports bleiben)
+- Entscheidung: Adressen per Proxy-Pfad `/app/<key>/` oder weiter Ports.
+- Schritte: `ModuleRegistryEntry` um `group`, `path`, optional `module`; Hrefs relativ, `resolveModuleHref` nur Fallback; Route `GET /api/module-urls` (liest `/.well-known/nexarch-modules`, Env-Override `NEXARCH_MODULE_URL_<KEY>`, Cache); `ModuleGrid` nach `group` gruppieren; `tenantLabel` in `ModuleNavShell` aus Sitzungs-Identität statt Env.
+- Dateien: `web/shl/components/ModuleNavShell.tsx`, `web/portal/lib/modules.ts`, `web/portal/app/ModuleGrid.tsx`, neu `web/portal/app/api/module-urls/route.ts`.
+- Test: `web/portal` und `web/shl` vitest auf 131; Betriebsauftrag: Produktionsdatei des Modulverzeichnisses fehlt.
+
+### B-02 Arbeitsvorrat — erledigt auf feature/portal-ausbau (Entscheidung: X-User-Id als Übergang)
+- Entscheidung: Übergang mit `X-User-Id` aus verifiziertem Token-`sub`, solange Workflow kein Bearer kennt.
+- Schritte: Route `GET /api/worklist` (Token prüfen, serverseitig `/approvals`, `/tasks`, `/reminders/kanban`, Antwort nur Zähler); Cache-Schlüssel mit `sub`, 15 s, `Cache-Control: no-store`; Badges an Workflow-Kacheln und "Heute"-Leiste; Fehler je Quelle tolerant; Schnellsuche-Zeile als Deep-Link; Env `PORTAL_WORKFLOW_API_URL`.
+- Datenschutz: nur eigene Zähler, keine Inhalte.
+
+### B-03 Admin-/Prüfer-Sicht — erledigt auf feature/portal-ausbau (ohne Favoriten und ohne Ampel an Kacheln, Statusnamen passen nicht sicher zu Registry-Keys)
+- Route `GET /api/system-status` (nur nach `authorize(core.tenant.admin)`, Status-Endpunkt nur serverseitig); Route `GET /api/kennzahlen-summary` (Mandant und Rolle aus Claims, nur Totals); Ampel an Kacheln; Favoriten (localStorage, nur Modul-Keys) optional.
+
+### B-04 Umgebungsvariablen dokumentieren — erledigt (web/portal/README.md)
+- Neue Variablen: `PORTAL_CORE_API_URL`, `PORTAL_TOKEN_ISSUER`, `PORTAL_TOKEN_AUDIENCE`, `PORTAL_VISIBLE_MODULES_CACHE_SECONDS`; dazu `PORTAL_POLICY_API_URL`, `PORTAL_POLICY_SERVICE_TOKEN`. Nirgends dokumentiert; Doku im Portal anlegen.
+
+### B-05 Zielmodul `portal` im Core — Entscheidung nötig
+- Der Core stellt Modul-Tokens mit Zielmodul aus (Standard `dms`). Soll `portal` in `NEXARCH_ACCOUNT_MODULE_AUDIENCES` aufgenommen und `PORTAL_TOKEN_AUDIENCE=portal` gesetzt werden? Dann muss die Sitzung `?module=portal` mitschicken.
+
+### B-06 Workflow auf Bearer umstellen — Folgeticket
+- Workflow-API von `X-User-Id` auf Bearer (Muster: `mail/internal/moduleauth`); danach Header im Portal-BFF entfernen. Gleiches gilt für Audit-Log in dms (`caller`-Query).
+
+## C. Laufender Betrieb
+
+### C-01 Offene PRs mergen (User)
+- #373 (qa*-Gates, migration*), #374 (workflow contracttest), #375 (dms apierror 5xx), #380 (Docs), #372 (SHL: AccountBar, Portal-Route).
+- Vor Merge DB-Tests auf 204 für #373, #374, #375 laufen lassen (nie gelaufen).
+
+### C-02 Aufräumen — nur mit Freigabe
+- `/root/manticore-backup-pre29` auf 131 löschen, wenn der User es sagt.
+- 204: Dateileichen im Manticore-Datenverzeichnis (`dms_src13_*`, `mail_documents_reindex_*`, `qa10loadtest_*`) nur nach Sichtung durch den User.

web/dms-browser/components/AccountBar.tsx

@@ -1,13 +1,19 @@
 "use client";
 
-import { LogoutButton } from "@nexarch/shl";
+import { AccountBar as SharedAccountBar } from "@nexarch/shl";
 import { authMode, getSession } from "../lib/http";
 
-export function AccountBar() {
-  if (authMode() !== "token") return null;
-  return (
-    <header style={{ display: "flex", justifyContent: "flex-end", padding: "8px 16px" }}>
-      <LogoutButton onLogout={() => getSession().logout()} />
-    </header>
-  );
+// Duenner Wrapper statt kopierter JSX (Fable-Review auf Code-Dopplung):
+// die eigentliche Darstellung lebt in @nexarch/shl, authMode()/getSession()
+// sind aber App-spezifisch (eigenes lib/http.ts je App) und duerfen als
+// Funktionen nicht von layout.tsx (Server Component) ueber die Props-Grenze
+// an eine Client Component gereicht werden -- deshalb hier lokal aufgeloest.
+async function loadIdentity() {
+  const s = getSession();
+  await s.token();
+  return s.identity();
+}
+
+export function AccountBar() {
+  return <SharedAccountBar visible={authMode() === "token"} onLogout={() => getSession().logout()} loadIdentity={loadIdentity} />;
 }

web/dms-upload/components/AccountBar.tsx

@@ -1,13 +1,19 @@
 "use client";
 
-import { LogoutButton } from "@nexarch/shl";
+import { AccountBar as SharedAccountBar } from "@nexarch/shl";
 import { authMode, getSession } from "../lib/http";
 
-export function AccountBar() {
-  if (authMode() !== "token") return null;
-  return (
-    <header style={{ display: "flex", justifyContent: "flex-end", padding: "8px 16px" }}>
-      <LogoutButton onLogout={() => getSession().logout()} />
-    </header>
-  );
+// Duenner Wrapper statt kopierter JSX (Fable-Review auf Code-Dopplung):
+// die eigentliche Darstellung lebt in @nexarch/shl, authMode()/getSession()
+// sind aber App-spezifisch (eigenes lib/http.ts je App) und duerfen als
+// Funktionen nicht von layout.tsx (Server Component) ueber die Props-Grenze
+// an eine Client Component gereicht werden -- deshalb hier lokal aufgeloest.
+async function loadIdentity() {
+  const s = getSession();
+  await s.token();
+  return s.identity();
+}
+
+export function AccountBar() {
+  return <SharedAccountBar visible={authMode() === "token"} onLogout={() => getSession().logout()} loadIdentity={loadIdentity} />;
 }

web/pdf-viewer/components/AccountBar.tsx

@@ -1,13 +1,19 @@
 "use client";
 
-import { LogoutButton } from "@nexarch/shl";
+import { AccountBar as SharedAccountBar } from "@nexarch/shl";
 import { authMode, getSession } from "../lib/http";
 
-export function AccountBar() {
-  if (authMode() !== "token") return null;
-  return (
-    <header style={{ display: "flex", justifyContent: "flex-end", padding: "8px 16px" }}>
-      <LogoutButton onLogout={() => getSession().logout()} />
-    </header>
-  );
+// Duenner Wrapper statt kopierter JSX (Fable-Review auf Code-Dopplung):
+// die eigentliche Darstellung lebt in @nexarch/shl, authMode()/getSession()
+// sind aber App-spezifisch (eigenes lib/http.ts je App) und duerfen als
+// Funktionen nicht von layout.tsx (Server Component) ueber die Props-Grenze
+// an eine Client Component gereicht werden -- deshalb hier lokal aufgeloest.
+async function loadIdentity() {
+  const s = getSession();
+  await s.token();
+  return s.identity();
+}
+
+export function AccountBar() {
+  return <SharedAccountBar visible={authMode() === "token"} onLogout={() => getSession().logout()} loadIdentity={loadIdentity} />;
 }

web/portal/README.md

@@ -0,0 +1,55 @@
+# NEXARCH Portal
+
+Startseite nach der Anmeldung: Kacheln der Module, die der angemeldete Benutzer sehen darf.
+Die Modulliste kommt aus `MODULE_REGISTRY` in `@nexarch/shl`; `/api/visible-modules` filtert sie gegen die policy-api.
+
+## Umgebungsvariablen
+
+Browser-seitig (werden beim Build eingebettet):
+
+| Variable | Pflicht | Bedeutung |
+|---|---|---|
+| `NEXT_PUBLIC_CORE_API_BASE` | ja | Basis-URL des Core (`/auth/module-token`) |
+| `NEXT_PUBLIC_LOGIN_URL` | nein | Ziel der Weiterleitung, wenn die Sitzung fehlt |
+
+Server-seitig (nur Route `/api/visible-modules`, nie im Browser sichtbar):
+
+| Variable | Pflicht | Bedeutung |
+|---|---|---|
+| `PORTAL_POLICY_API_URL` | ja | Basis-URL der policy-api (`POST /authorize`) |
+| `PORTAL_POLICY_SERVICE_TOKEN` | ja | Dienst-Token für die policy-api (Secret) |
+| `PORTAL_CORE_API_URL` | nein | Basis-URL für `/auth/module-jwks`; Standard: `NEXT_PUBLIC_CORE_API_BASE` |
+| `PORTAL_TOKEN_ISSUER` | nein | Wenn gesetzt, muss der Token-Aussteller (`iss`) übereinstimmen |
+| `PORTAL_TOKEN_AUDIENCE` | nein | Wenn gesetzt, muss das Token dieses Zielmodul (`aud`) tragen |
+| `PORTAL_VISIBLE_MODULES_CACHE_SECONDS` | nein | Cache je Mandant und Rolle, Standard `30`, `0` schaltet ihn ab |
+| `PORTAL_WORKFLOW_API_URL` | nein | Basis-URL der Workflow-API für den Arbeitsvorrat; ohne sie antwortet `/api/worklist` mit 503 und die Kacheln bleiben ohne Zähler |
+| `PORTAL_WORKLIST_CACHE_SECONDS` | nein | Cache des Arbeitsvorrats je Mandant und Benutzer, Standard `15` |
+| `PORTAL_STATUS_API_URL` | nein | Basis-URL der Statusseite (`/status/overview`) für den Betriebsblock (nur Admins) |
+| `PORTAL_KENNZAHLEN_API_URL` | nein | Basis-URL der Kennzahlen-API (`/kennzahlen/totals`) für die Summenzeile (Recht `kennzahlen.read`) |
+| `NEXARCH_MODULE_URL_<KEY>` | nein | Ersetzt den festen Port-Href eines Moduls (z. B. `NEXARCH_MODULE_URL_DMS=https://dms.example`), ohne Rebuild |
+
+Fehlt `PORTAL_POLICY_API_URL`, `PORTAL_POLICY_SERVICE_TOKEN` oder die Core-URL, antwortet die Route mit 503.
+
+## Verhalten der Route
+
+- `GET /api/visible-modules` verlangt `Authorization: Bearer <Modul-Token>`; Signatur (Ed25519, JWKS vom Core) und Ablaufzeit werden geprüft, sonst 401.
+- Mandant und Rolle stammen ausschließlich aus dem Token, nie aus der URL.
+- Eine Rechteänderung wirkt wegen des Caches bis zu `PORTAL_VISIBLE_MODULES_CACHE_SECONDS` verzögert.
+- Fällt die policy-api aus, bleibt das jeweilige Modul unsichtbar (fail-closed).
+
+## Arbeitsvorrat
+
+`GET /api/worklist` liefert nur Zähler (`approvals`, `tasks`, `remindersDue`), keine Inhalte. Benutzer und Mandant kommen aus dem Token; die Workflow-API kennt bisher nur den Header `X-User-Id` (Übergangsmodus), den das Portal serverseitig setzt. Gezählt werden nur eigene Einträge: Freigaben des Benutzers, offene Aufgaben mit ihm als Person, von ihm angelegte Wiedervorlagen (überfällig oder diese Woche). Fällt eine Quelle aus, ist ihr Wert `null` und die übrigen bleiben erhalten. Die Antwort trägt `Cache-Control: no-store`.
+
+## Betriebsblock
+
+`GET /api/system-status` (Recht `core.tenant.admin`) und `GET /api/kennzahlen-summary` (Recht `kennzahlen.read`) prüfen das Recht über die policy-api, bevor sie die Quelle abfragen, und geben nur Modulname, Status, Zeitpunkt bzw. drei Summenwerte zurück (Objekte, Löschvorgänge, Speicher). Die Kennzahlen-Quelle erhält Mandant und Rolle aus dem Token. Die Statusseite ist selbst nicht authentifiziert und darf nur vom Portal-Server aufgerufen werden. Ohne Recht antworten die Routen mit 403, der Block bleibt ausgeblendet.
+
+## Oberfläche
+
+Kacheln sind nach Arbeiten, Verwalten und Prüfen gruppiert (`group` in `MODULE_REGISTRY`). Das Mandanten-Label in der Navigation stammt aus der Sitzung. Die Suchzeile leitet an `<DMS-Adresse>/search?q=` weiter und erscheint nur, wenn das DMS für den Benutzer sichtbar ist.
+
+## Tests
+
+Auf dem Test-Host (nicht lokal): `npm install && npx vitest run && npx tsc --noEmit`.
+Bekannt: `tsc` meldet Fehler zu `process` in `web/shl/components/ModuleNavShell.tsx` (`@types/node` fehlt).

web/portal/app/AccountBar.tsx

@@ -0,0 +1,14 @@
+"use client";
+
+import { AccountBar as SharedAccountBar } from "@nexarch/shl";
+import { getSession } from "../lib/http";
+
+async function loadIdentity() {
+  const s = getSession();
+  await s.token();
+  return s.identity();
+}
+
+export function AccountBar() {
+  return <SharedAccountBar visible onLogout={() => getSession().logout()} loadIdentity={loadIdentity} />;
+}

web/portal/app/AdminPanel.tsx

@@ -0,0 +1,63 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { useI18n } from "@nexarch/shl";
+import { getSession } from "../lib/http";
+import type { KennzahlenSummary, ModuleStatusRow } from "../lib/adminData";
+
+async function getJson<T>(path: string): Promise<T | null> {
+  try {
+    const res = await getSession().fetch(path);
+    return res.ok ? ((await res.json()) as T) : null;
+  } catch {
+    return null;
+  }
+}
+
+export function statusLabel(status: string): string {
+  return status === "up" ? "in Betrieb" : status === "down" ? "gestört" : "unbekannt";
+}
+
+export function AdminPanel() {
+  const { t } = useI18n();
+  const [status, setStatus] = useState<ModuleStatusRow[] | null>(null);
+  const [kpi, setKpi] = useState<KennzahlenSummary | null>(null);
+
+  useEffect(() => {
+    let cancelled = false;
+    (async () => {
+      const [s, k] = await Promise.all([
+        getJson<{ modules: ModuleStatusRow[] }>("/api/system-status"),
+        getJson<KennzahlenSummary>("/api/kennzahlen-summary"),
+      ]);
+      if (cancelled) return;
+      setStatus(s?.modules ?? null);
+      setKpi(k);
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  if (!status && !kpi) return null;
+  return (
+    <section aria-labelledby="portal-admin" style={{ marginTop: 24 }}>
+      <h2 id="portal-admin" style={{ fontSize: 18 }}>{t("portal.admin", "Betrieb")}</h2>
+      {status && (
+        <ul style={{ listStyle: "none", margin: "0 0 16px", padding: 0 }}>
+          {status.map((m) => (
+            <li key={m.name}>
+              <span aria-hidden="true">{m.status === "up" ? "●" : "○"}</span> {m.name}: {statusLabel(m.status)}
+            </li>
+          ))}
+        </ul>
+      )}
+      {kpi && (
+        <p>
+          {t("portal.kpi.objects", "Objekte")}: {kpi.objektBestand} · {t("portal.kpi.deletions", "Löschvorgänge")}: {kpi.loeschvorgaenge} ·{" "}
+          {t("portal.kpi.storage", "Speicher")}: {(kpi.speichervolumenBytes / 1024 ** 3).toFixed(2)} GB
+        </p>
+      )}
+    </section>
+  );
+}

web/portal/app/ModuleGrid.test.tsx

@@ -1,25 +1,24 @@
 import { describe, expect, it, vi } from "vitest";
 import { resolveModuleHref } from "@nexarch/shl";
-import { fetchVisibleModules } from "./ModuleGrid";
+import { badgeFor, fetchWorklist, groupModules, fetchVisibleModules } from "./ModuleGrid";
 
 describe("fetchVisibleModules", () => {
-  it("ruft die Portal-eigene Route mit tenant/role auf und gibt die Modulliste zurueck", async () => {
+  it("ruft die Portal-eigene Route ohne tenant/role in der URL auf und gibt die Modulliste zurueck", async () => {
     const fetchImpl = vi.fn(
       async () => new Response(JSON.stringify({ modules: [{ key: "dms", label: "Dokumente", description: "x", href: "http://a", permission: "dms.document.read" }] }), { status: 200 })
     ) as unknown as typeof fetch;
 
-    const modules = await fetchVisibleModules("acme", "user", fetchImpl);
+    const modules = await fetchVisibleModules(fetchImpl);
 
     expect(modules).toHaveLength(1);
     expect(modules[0].key).toBe("dms");
     const calledUrl = (fetchImpl as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
-    expect(calledUrl).toContain("tenant=acme");
-    expect(calledUrl).toContain("role=user");
+    expect(calledUrl).toBe("/api/visible-modules");
   });
 
   it("gibt eine leere Liste zurueck wenn die Route fehlschlaegt", async () => {
     const fetchImpl = vi.fn(async () => new Response("", { status: 500 })) as unknown as typeof fetch;
-    const modules = await fetchVisibleModules("acme", "user", fetchImpl);
+    const modules = await fetchVisibleModules(fetchImpl);
     expect(modules).toEqual([]);
   });
 });
@@ -37,3 +36,27 @@ describe("resolveModuleHref", () => {
     expect(resolveModuleHref("http://localhost:3107/", "localhost")).toBe("http://localhost:3107/");
   });
 });
+
+describe("groupModules / badgeFor / fetchWorklist", () => {
+  const m = (key: string, group?: "work" | "admin" | "audit") => ({ key, group, label: key, description: "", href: "http://a", permission: "p" });
+
+  it("gruppiert in Reihenfolge Arbeiten, Verwalten, Pruefen und sortiert Unbekanntes unter Arbeiten ein", () => {
+    const g = groupModules([m("a", "audit"), m("b", "admin"), m("c", "work"), m("d")]);
+    expect(g.map((x) => x.key)).toEqual(["work", "admin", "audit"]);
+    expect(g[0].modules.map((x) => x.key)).toEqual(["c", "d"]);
+  });
+
+  it("zeigt Badges nur fuer Workflow-Kacheln und summiert Freigaben und Aufgaben", () => {
+    const w = { approvals: 2, tasks: 3, remindersDue: 4 };
+    expect(badgeFor("workflow", w)).toBe(5);
+    expect(badgeFor("workflow_cases", w)).toBe(4);
+    expect(badgeFor("dms", w)).toBeNull();
+    expect(badgeFor("workflow", null)).toBeNull();
+    expect(badgeFor("workflow", { approvals: null, tasks: null, remindersDue: null })).toBeNull();
+  });
+
+  it("fetchWorklist liefert null bei Fehlern", async () => {
+    expect(await fetchWorklist((async () => new Response("", { status: 500 })) as unknown as typeof fetch)).toBeNull();
+    expect(await fetchWorklist((async () => { throw new Error("x"); }) as unknown as typeof fetch)).toBeNull();
+  });
+});

web/portal/app/ModuleGrid.tsx

@@ -3,6 +3,7 @@
 import { useEffect, useState } from "react";
 import { useI18n, resolveModuleHref } from "@nexarch/shl";
 import type { ModuleEntry } from "../lib/modules";
+import type { Worklist } from "../lib/worklist";
 import { getSession } from "../lib/http";
 
 interface VisibleModulesResponse {
@@ -10,23 +11,51 @@ interface VisibleModulesResponse {
   error?: string;
 }
 
-export async function fetchVisibleModules(
-  tenant: string,
-  role: string,
-  fetchImpl: typeof fetch = fetch
-): Promise<ModuleEntry[]> {
-  const res = await fetchImpl(
-    `/api/visible-modules?tenant=${encodeURIComponent(tenant)}&role=${encodeURIComponent(role)}`
-  );
+export async function fetchVisibleModules(fetchImpl: typeof fetch): Promise<ModuleEntry[]> {
+  const res = await fetchImpl("/api/visible-modules");
   if (!res.ok) return [];
   const body = (await res.json()) as VisibleModulesResponse;
   return body.modules ?? [];
 }
 
+export async function fetchWorklist(fetchImpl: typeof fetch): Promise<Worklist | null> {
+  try {
+    const res = await fetchImpl("/api/worklist");
+    return res.ok ? ((await res.json()) as Worklist) : null;
+  } catch {
+    return null;
+  }
+}
+
+const GROUPS = [
+  { key: "work", title: "Arbeiten" },
+  { key: "admin", title: "Verwalten" },
+  { key: "audit", title: "Prüfen" },
+] as const;
+
+export function groupModules(modules: ModuleEntry[]): { key: string; title: string; modules: ModuleEntry[] }[] {
+  const known = new Set<string>(GROUPS.map((g) => g.key));
+  const out = GROUPS.map((g) => ({ ...g, modules: modules.filter((m) => m.group === g.key) }));
+  const rest = modules.filter((m) => !m.group || !known.has(m.group));
+  if (rest.length > 0) out[0].modules.push(...rest);
+  return out.filter((g) => g.modules.length > 0);
+}
+
+export function badgeFor(key: string, w: Worklist | null): number | null {
+  if (!w) return null;
+  if (key === "workflow") {
+    const parts = [w.approvals, w.tasks].filter((n): n is number => n !== null);
+    return parts.length ? parts.reduce((a, b) => a + b, 0) : null;
+  }
+  if (key === "workflow_cases") return w.remindersDue;
+  return null;
+}
+
 type State =
   | { status: "loading" }
+  | { status: "noIdentity" }
   | { status: "error"; message: string }
-  | { status: "ready"; modules: ModuleEntry[] };
+  | { status: "ready"; modules: ModuleEntry[]; worklist: Worklist | null };
 
 export function ModuleGrid() {
   const { t } = useI18n();
@@ -38,13 +67,13 @@ export function ModuleGrid() {
       try {
         const session = getSession();
         await session.token();
-        const identity = session.identity();
-        if (!identity) {
-          if (!cancelled) setState({ status: "error", message: t("portal.noIdentity", "Anmeldung erforderlich.") });
+        if (!session.identity()) {
+          if (!cancelled) setState({ status: "noIdentity" });
           return;
         }
-        const modules = await fetchVisibleModules(identity.tenant, identity.role);
-        if (!cancelled) setState({ status: "ready", modules });
+        const call = (input: RequestInfo | URL, init?: RequestInit) => session.fetch(input, init);
+        const [modules, worklist] = await Promise.all([fetchVisibleModules(call), fetchWorklist(call)]);
+        if (!cancelled) setState({ status: "ready", modules, worklist });
       } catch (err) {
         if (!cancelled) {
           setState({ status: "error", message: (err as Error).message });
@@ -54,44 +83,89 @@ export function ModuleGrid() {
     return () => {
       cancelled = true;
     };
-  }, [t]);
+  }, []);
 
   if (state.status === "loading") return <p>{t("portal.loading", "Lade Übersicht …")}</p>;
+  if (state.status === "noIdentity") return <p role="alert">{t("portal.noIdentity", "Anmeldung erforderlich.")}</p>;
   if (state.status === "error") return <p role="alert">{state.message}</p>;
   if (state.modules.length === 0) {
     return <p>{t("portal.noModules", "Für Ihr Konto sind derzeit keine Module freigeschaltet.")}</p>;
   }
 
+  const { modules, worklist } = state;
+  const dms = modules.find((m) => m.key === "dms");
+  const today = [
+    { label: t("portal.approvals", "Offene Freigaben"), value: worklist?.approvals ?? null },
+    { label: t("portal.tasks", "Meine Aufgaben"), value: worklist?.tasks ?? null },
+    { label: t("portal.reminders", "Fällige Wiedervorlagen"), value: worklist?.remindersDue ?? null },
+  ].filter((x) => x.value !== null);
+
   return (
-    <ul
-      style={{
-        listStyle: "none",
-        margin: 0,
-        padding: 0,
-        display: "grid",
-        gridTemplateColumns: "repeat(auto-fill, minmax(240px, 1fr))",
-        gap: 16,
-      }}
-    >
-      {state.modules.map((mod) => (
-        <li key={mod.key}>
-          <a
-            href={resolveModuleHref(mod.href)}
+    <div>
+      {dms && (
+        <form action={`${resolveModuleHref(dms.href).replace(/\/$/, "")}/search`} method="get" role="search" style={{ marginBottom: 24 }}>
+          <input
+            name="q"
+            type="search"
+            aria-label={t("portal.search", "Dokumente durchsuchen")}
+            placeholder={t("portal.search", "Dokumente durchsuchen")}
+            style={{ width: "100%", boxSizing: "border-box", minHeight: 44, padding: "0 12px" }}
+          />
+        </form>
+      )}
+      {today.length > 0 && (
+        <section aria-label={t("portal.today", "Heute")} style={{ display: "flex", gap: 16, flexWrap: "wrap", marginBottom: 24 }}>
+          {today.map((x) => (
+            <div key={x.label} style={{ padding: 12, border: "1px solid var(--shl-color-border, #d7dbe0)", borderRadius: 8, minWidth: 160 }}>
+              <strong style={{ fontSize: 24 }}>{x.value}</strong>
+              <div>{x.label}</div>
+            </div>
+          ))}
+        </section>
+      )}
+      {groupModules(modules).map((g) => (
+        <section key={g.key} aria-labelledby={`grp-${g.key}`} style={{ marginBottom: 24 }}>
+          <h2 id={`grp-${g.key}`} style={{ fontSize: 18 }}>{t(`portal.group.${g.key}`, g.title)}</h2>
+          <ul
             style={{
-              display: "block",
-              minHeight: 44,
-              padding: 16,
-              border: "1px solid var(--shl-color-border, #d7dbe0)",
-              borderRadius: 8,
-              textDecoration: "none",
-              color: "inherit",
+              listStyle: "none",
+              margin: 0,
+              padding: 0,
+              display: "grid",
+              gridTemplateColumns: "repeat(auto-fill, minmax(240px, 1fr))",
+              gap: 16,
             }}
           >
-            <strong>{mod.label}</strong>
-            <p style={{ margin: "4px 0 0" }}>{mod.description}</p>
-          </a>
-        </li>
+            {g.modules.map((mod) => {
+              const badge = badgeFor(mod.key, worklist);
+              return (
+                <li key={mod.key}>
+                  <a
+                    href={resolveModuleHref(mod.href)}
+                    style={{
+                      display: "block",
+                      minHeight: 44,
+                      padding: 16,
+                      border: "1px solid var(--shl-color-border, #d7dbe0)",
+                      borderRadius: 8,
+                      textDecoration: "none",
+                      color: "inherit",
+                    }}
+                  >
+                    <strong>{mod.label}</strong>
+                    {badge !== null && badge > 0 && (
+                      <span aria-label={`${badge}`} style={{ marginLeft: 8, padding: "0 8px", borderRadius: 12, border: "1px solid currentColor" }}>
+                        {badge}
+                      </span>
+                    )}
+                    <p style={{ margin: "4px 0 0" }}>{mod.description}</p>
+                  </a>
+                </li>
+              );
+            })}
+          </ul>
+        </section>
       ))}
-    </ul>
+    </div>
   );
 }

web/portal/app/PortalShell.tsx

@@ -0,0 +1,30 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import type { ReactNode } from "react";
+import { ModuleNavShell } from "@nexarch/shl";
+import { getSession } from "../lib/http";
+
+export function PortalShell({ children }: { children: ReactNode }) {
+  const [tenant, setTenant] = useState<string | undefined>(undefined);
+
+  useEffect(() => {
+    let cancelled = false;
+    const s = getSession();
+    s.token().then(
+      () => {
+        if (!cancelled) setTenant(s.identity()?.tenant);
+      },
+      () => {},
+    );
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  return (
+    <ModuleNavShell activeKey="portal" tenantLabel={tenant}>
+      {children}
+    </ModuleNavShell>
+  );
+}

web/portal/app/api/kennzahlen-summary/route.ts

@@ -0,0 +1,38 @@
+import { NextRequest, NextResponse } from "next/server";
+import { authenticate, coreConfigured } from "../../../lib/auth";
+import { kennzahlenCache } from "../../../lib/caches";
+import { loadKennzahlenSummary } from "../../../lib/adminData";
+import { policyAuthorize } from "../../../lib/policy";
+
+export const dynamic = "force-dynamic";
+
+const CACHE_TTL_MS = 15_000;
+
+export async function GET(request: NextRequest) {
+  const policyBase = process.env.PORTAL_POLICY_API_URL;
+  const policyToken = process.env.PORTAL_POLICY_SERVICE_TOKEN;
+  const base = process.env.PORTAL_KENNZAHLEN_API_URL;
+  if (!policyBase || !policyToken || !base || !coreConfigured()) {
+    return NextResponse.json({ error: "Portal nicht konfiguriert" }, { status: 503 });
+  }
+  const claims = await authenticate(request);
+  if (!claims) return NextResponse.json({ error: "Anmeldung erforderlich" }, { status: 401 });
+
+  let allowed = false;
+  try {
+    allowed = await policyAuthorize(policyBase, policyToken)(claims.tenant, claims.role, "kennzahlen.read");
+  } catch {
+    allowed = false;
+  }
+  if (!allowed) return NextResponse.json({ error: "Keine Berechtigung" }, { status: 403 });
+
+  const noStore = { "Cache-Control": "no-store" };
+  const key = `${claims.tenant}\u0000${claims.role}`;
+  const hit = kennzahlenCache.get(key, CACHE_TTL_MS);
+  if (hit) return NextResponse.json(hit, { headers: noStore });
+
+  const data = await loadKennzahlenSummary(base, claims.tenant, claims.role);
+  if (data === null) return NextResponse.json({ error: "Quelle nicht erreichbar" }, { status: 502, headers: noStore });
+  kennzahlenCache.set(key, data);
+  return NextResponse.json(data, { headers: noStore });
+}

web/portal/app/api/system-status/route.test.ts

@@ -0,0 +1,77 @@
+import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
+import { NextRequest } from "next/server";
+import { generateKeyPairSync, sign } from "node:crypto";
+import { resetKeyCacheForTests } from "../../../lib/verifyToken";
+import { kennzahlenCache, statusCache } from "../../../lib/caches";
+
+const originalFetch = global.fetch;
+const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+const rawPub = (publicKey.export({ format: "der", type: "spki" }) as Buffer).subarray(-32);
+
+function mint(claims: Record<string, unknown>): string {
+  const enc = (o: unknown) => Buffer.from(JSON.stringify(o)).toString("base64url");
+  const head = enc({ alg: "EdDSA", typ: "JWT", kid: "k1" });
+  const body = enc({ exp: Math.floor(Date.now() / 1000) + 300, ...claims });
+  return `${head}.${body}.${sign(null, Buffer.from(`${head}.${body}`), privateKey).toString("base64url")}`;
+}
+
+describe("Admin-Routen: system-status und kennzahlen-summary", () => {
+  let allowedPerms: Set<string>;
+  let upstream: string[];
+
+  const req = (path: string, token?: string) =>
+    new NextRequest(`http://portal.example${path}`, { headers: token ? { authorization: `Bearer ${token}` } : {} });
+
+  beforeEach(() => {
+    for (const [k, v] of Object.entries({
+      PORTAL_POLICY_API_URL: "http://policy.example",
+      PORTAL_POLICY_SERVICE_TOKEN: "svc",
+      PORTAL_CORE_API_URL: "http://core.example",
+      PORTAL_STATUS_API_URL: "http://status.example",
+      PORTAL_KENNZAHLEN_API_URL: "http://kz.example",
+    })) process.env[k] = v;
+    resetKeyCacheForTests();
+    statusCache.clear();
+    kennzahlenCache.clear();
+    allowedPerms = new Set();
+    upstream = [];
+    global.fetch = vi.fn(async (url: string | URL | Request, init?: RequestInit) => {
+      const u = String(url);
+      if (u.endsWith("/auth/module-jwks")) return new Response(JSON.stringify({ keys: [{ kid: "k1", public_key: rawPub.toString("base64") }] }), { status: 200 });
+      if (u.endsWith("/authorize")) {
+        const b = JSON.parse(String(init?.body));
+        return new Response(JSON.stringify({ allowed: allowedPerms.has(b.permission) }), { status: 200 });
+      }
+      upstream.push(u);
+      if (u.includes("/status/overview")) return new Response(JSON.stringify([{ name: "dms", status: "up" }]), { status: 200 });
+      return new Response(JSON.stringify({ objekt_bestand: 1, loeschvorgaenge: 0, speichervolumen_bytes: 0 }), { status: 200 });
+    }) as typeof fetch;
+  });
+  afterEach(() => {
+    global.fetch = originalFetch;
+    for (const k of ["PORTAL_POLICY_API_URL", "PORTAL_POLICY_SERVICE_TOKEN", "PORTAL_CORE_API_URL", "PORTAL_STATUS_API_URL", "PORTAL_KENNZAHLEN_API_URL"]) delete process.env[k];
+  });
+
+  it("system-status: 401 ohne Token, 403 ohne Admin-Recht, 200 mit Recht", async () => {
+    const { GET } = await import("./route");
+    const token = mint({ sub: "u", tenant: "acme", role: "user" });
+    expect((await GET(req("/api/system-status"))).status).toBe(401);
+    expect((await GET(req("/api/system-status", token))).status).toBe(403);
+    expect(upstream).toEqual([]);
+    allowedPerms.add("core.tenant.admin");
+    const res = await GET(req("/api/system-status", token));
+    expect(res.status).toBe(200);
+    expect((await res.json()).modules[0].name).toBe("dms");
+  });
+
+  it("kennzahlen-summary: Mandant aus dem Token, 403 ohne kennzahlen.read", async () => {
+    const { GET } = await import("../kennzahlen-summary/route");
+    const token = mint({ sub: "u", tenant: "acme", role: "auditor" });
+    expect((await GET(req("/api/kennzahlen-summary?tenant=fremd", token))).status).toBe(403);
+    allowedPerms.add("kennzahlen.read");
+    const res = await GET(req("/api/kennzahlen-summary?tenant=fremd", token));
+    expect(res.status).toBe(200);
+    expect(upstream[0]).toContain("tenant=acme");
+    expect(upstream[0]).not.toContain("fremd");
+  });
+});

web/portal/app/api/system-status/route.ts

@@ -0,0 +1,38 @@
+import { NextRequest, NextResponse } from "next/server";
+import { authenticate, coreConfigured } from "../../../lib/auth";
+import { statusCache } from "../../../lib/caches";
+import { loadSystemStatus } from "../../../lib/adminData";
+import { policyAuthorize } from "../../../lib/policy";
+
+export const dynamic = "force-dynamic";
+
+const CACHE_TTL_MS = 15_000;
+
+export async function GET(request: NextRequest) {
+  const policyBase = process.env.PORTAL_POLICY_API_URL;
+  const policyToken = process.env.PORTAL_POLICY_SERVICE_TOKEN;
+  const base = process.env.PORTAL_STATUS_API_URL;
+  if (!policyBase || !policyToken || !base || !coreConfigured()) {
+    return NextResponse.json({ error: "Portal nicht konfiguriert" }, { status: 503 });
+  }
+  const claims = await authenticate(request);
+  if (!claims) return NextResponse.json({ error: "Anmeldung erforderlich" }, { status: 401 });
+
+  let allowed = false;
+  try {
+    allowed = await policyAuthorize(policyBase, policyToken)(claims.tenant, claims.role, "core.tenant.admin");
+  } catch {
+    allowed = false;
+  }
+  if (!allowed) return NextResponse.json({ error: "Keine Berechtigung" }, { status: 403 });
+
+  const noStore = { "Cache-Control": "no-store" };
+  const key = "all";
+  const hit = statusCache.get(key, CACHE_TTL_MS);
+  if (hit) return NextResponse.json({ modules: hit }, { headers: noStore });
+
+  const data = await loadSystemStatus(base);
+  if (data === null) return NextResponse.json({ error: "Quelle nicht erreichbar" }, { status: 502, headers: noStore });
+  statusCache.set(key, data);
+  return NextResponse.json({ modules: data }, { headers: noStore });
+}

web/portal/app/api/visible-modules/route.test.ts

@@ -1,7 +1,9 @@
 import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
 import { NextRequest } from "next/server";
-import { filterVisibleModules, type Authorize } from "./route";
+import { generateKeyPairSync, sign } from "node:crypto";
+import { filterVisibleModules, type Authorize } from "../../../lib/policy";
 import type { ModuleEntry } from "../../../lib/modules";
+import { resetKeyCacheForTests } from "../../../lib/verifyToken";
 
 const originalFetch = global.fetch;
 
@@ -49,40 +51,91 @@ describe("filterVisibleModules (Pruefungen 1 und 4)", () => {
   });
 });
 
+const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+const rawPub = (publicKey.export({ format: "der", type: "spki" }) as Buffer).subarray(-32);
+
+function mint(claims: Record<string, unknown>, kid = "k1", key = privateKey): string {
+  const enc = (o: unknown) => Buffer.from(JSON.stringify(o)).toString("base64url");
+  const head = enc({ alg: "EdDSA", typ: "JWT", kid });
+  const body = enc({ exp: Math.floor(Date.now() / 1000) + 300, ...claims });
+  return `${head}.${body}.${sign(null, Buffer.from(`${head}.${body}`), key).toString("base64url")}`;
+}
+
 describe("GET /api/visible-modules (HTTP-Schicht)", () => {
-  beforeEach(() => {
+  let policyCalls: { tenant: string; role: string }[];
+
+  function req(token?: string, query = ""): NextRequest {
+    return new NextRequest(`http://portal.example/api/visible-modules${query}`, {
+      headers: token ? { authorization: `Bearer ${token}` } : {},
+    });
+  }
+
+  beforeEach(async () => {
     process.env.PORTAL_POLICY_API_URL = "http://policy.example";
     process.env.PORTAL_POLICY_SERVICE_TOKEN = "test-token";
+    process.env.PORTAL_CORE_API_URL = "http://core.example";
+    policyCalls = [];
+    resetKeyCacheForTests();
+    (await import("../../../lib/caches")).visibleModulesCache.clear();
+    global.fetch = vi.fn(async (url: string | URL | Request, init?: RequestInit) => {
+      const u = String(url);
+      if (u.endsWith("/auth/module-jwks")) {
+        return new Response(JSON.stringify({ keys: [{ kid: "k1", public_key: rawPub.toString("base64") }] }), { status: 200 });
+      }
+      policyCalls.push(JSON.parse(String(init?.body)));
+      return new Response(JSON.stringify({ allowed: true }), { status: 200 });
+    }) as typeof fetch;
   });
   afterEach(() => {
     global.fetch = originalFetch;
-    delete process.env.PORTAL_POLICY_API_URL;
-    delete process.env.PORTAL_POLICY_SERVICE_TOKEN;
+    for (const k of ["PORTAL_POLICY_API_URL", "PORTAL_POLICY_SERVICE_TOKEN", "PORTAL_CORE_API_URL", "PORTAL_TOKEN_AUDIENCE"]) delete process.env[k];
   });
 
-  it("gibt 400 ohne tenant/role zurueck", async () => {
+  it("gibt 401 ohne Token zurueck", async () => {
     const { GET } = await import("./route");
-    const req = new NextRequest("http://portal.example/api/visible-modules");
-    const res = await GET(req);
-    expect(res.status).toBe(400);
+    expect((await GET(req())).status).toBe(401);
+  });
+
+  it("gibt 401 bei falscher Signatur, abgelaufenem Token oder unbekannter kid", async () => {
+    const { GET } = await import("./route");
+    const other = generateKeyPairSync("ed25519").privateKey;
+    const claims = { sub: "u", tenant: "acme", role: "user" };
+    expect((await GET(req(mint(claims, "k1", other)))).status).toBe(401);
+    expect((await GET(req(mint({ ...claims, exp: 1 })))).status).toBe(401);
+    expect((await GET(req(mint(claims, "unbekannt")))).status).toBe(401);
   });
 
   it("gibt 503 zurueck wenn Portal nicht konfiguriert ist", async () => {
     delete process.env.PORTAL_POLICY_API_URL;
     const { GET } = await import("./route");
-    const req = new NextRequest("http://portal.example/api/visible-modules?tenant=acme&role=user");
-    const res = await GET(req);
-    expect(res.status).toBe(503);
+    expect((await GET(req(mint({ sub: "u", tenant: "acme", role: "user" })))).status).toBe(503);
   });
 
-  it("ruft policy-api mit Dienst-Token auf, Token nie im Response sichtbar", async () => {
-    global.fetch = vi.fn(async () => new Response(JSON.stringify({ allowed: true }), { status: 200 })) as typeof fetch;
+  it("nimmt Mandant und Rolle aus dem Token, nicht aus der URL", async () => {
     const { GET } = await import("./route");
-    const req = new NextRequest("http://portal.example/api/visible-modules?tenant=acme&role=user");
-    const res = await GET(req);
-    const body = await res.json();
+    const res = await GET(req(mint({ sub: "u", tenant: "acme", role: "user" }), "?tenant=fremd&role=admin"));
     expect(res.status).toBe(200);
-    expect(JSON.stringify(body)).not.toContain("test-token");
-    expect((global.fetch as ReturnType<typeof vi.fn>).mock.calls[0][1].headers["X-Service-Token"]).toBe("test-token");
+    expect(policyCalls.length).toBeGreaterThan(0);
+    expect(policyCalls.every((c) => c.tenant === "acme" && c.role === "user")).toBe(true);
+    expect(JSON.stringify(await res.json())).not.toContain("test-token");
+  });
+
+  it("verlangt das konfigurierte Zielmodul", async () => {
+    process.env.PORTAL_TOKEN_AUDIENCE = "portal";
+    const { GET } = await import("./route");
+    const claims = { sub: "u", tenant: "acme", role: "user" };
+    expect((await GET(req(mint({ ...claims, aud: ["dms"] })))).status).toBe(401);
+    expect((await GET(req(mint({ ...claims, aud: ["portal"] })))).status).toBe(200);
+  });
+
+  it("fragt die policy-api je Mandant/Rolle nur einmal innerhalb der Cache-Zeit", async () => {
+    const { GET } = await import("./route");
+    const token = mint({ sub: "u", tenant: "acme", role: "user" });
+    await GET(req(token));
+    const first = policyCalls.length;
+    await GET(req(token));
+    expect(policyCalls.length).toBe(first);
+    await GET(req(mint({ sub: "u", tenant: "acme", role: "admin" })));
+    expect(policyCalls.length).toBeGreaterThan(first);
   });
 });

web/portal/app/api/visible-modules/route.ts

@@ -1,65 +1,41 @@
 import { NextRequest, NextResponse } from "next/server";
-import { loadModuleRegistry, type ModuleEntry } from "../../../lib/modules";
+import { applyUrlOverrides, loadModuleRegistry } from "../../../lib/modules";
+import { authenticate, coreConfigured } from "../../../lib/auth";
+import { visibleModulesCache } from "../../../lib/caches";
+import { filterVisibleModules, policyAuthorize } from "../../../lib/policy";
 
 export const dynamic = "force-dynamic";
 
-export type Authorize = (tenant: string, role: string, permission: string) => Promise<boolean>;
-
-// Reine, testbare Kernlogik: iteriert generisch ueber JEDE Registry, egal
-// wie viele/welche Eintraege config/modules.json enthaelt (Akzeptanz-
-// kriterium 3 -- ein neues Modul braucht hier keine Codeaenderung).
-// Ausfall/Verweigerung von 'authorize' lassen ein Modul nie durch
-// (fail-closed, Pruefung 4: kein Modul ohne Berechtigung sichtbar).
-export async function filterVisibleModules(
-  registry: ModuleEntry[],
-  tenant: string,
-  role: string,
-  authorize: Authorize
-): Promise<ModuleEntry[]> {
-  const results = await Promise.all(
-    registry.map(async (mod) => {
-      try {
-        return (await authorize(tenant, role, mod.permission)) ? mod : null;
-      } catch {
-        return null;
-      }
-    })
-  );
-  return results.filter((m): m is ModuleEntry => m !== null);
-}
-
-function policyAuthorize(base: string, token: string): Authorize {
-  return async (tenant, role, permission) => {
-    const res = await fetch(`${base.replace(/\/$/, "")}/authorize`, {
-      method: "POST",
-      headers: { "X-Service-Token": token, "Content-Type": "application/json" },
-      body: JSON.stringify({ tenant, role, permission }),
-      cache: "no-store",
-    });
-    if (!res.ok) return false;
-    const body = (await res.json()) as { allowed?: boolean };
-    return body.allowed === true;
-  };
-}
+const CACHE_TTL_MS = Number(process.env.PORTAL_VISIBLE_MODULES_CACHE_SECONDS ?? "30") * 1000;
 
+// Mandant und Rolle kommen ausschliesslich aus dem verifizierten Token,
+// nie aus der URL. Der Cache haelt nur positive Ergebnisse je Mandant/Rolle
+// kurz vor; Rechteaenderungen wirken bis zu CACHE_TTL_MS verzoegert.
 // Backend-for-Frontend: haelt das Dienst-Token fuer policy-api server-
 // seitig (der Browser bekommt es nie zu Gesicht, gleiches Prinzip wie
 // tenant-admins Proxy-Route). Core entscheidet ueber Rolle UND Feature-
 // Flag in einem Aufruf (AuthorizeRequest), das Portal trifft keine
 // eigene zweite Entscheidung (Akzeptanzkriterium 2).
 export async function GET(request: NextRequest) {
-  const tenant = request.nextUrl.searchParams.get("tenant");
-  const role = request.nextUrl.searchParams.get("role");
-  if (!tenant || !role) {
-    return NextResponse.json({ error: "'tenant' und 'role' sind erforderlich" }, { status: 400 });
-  }
-
   const base = process.env.PORTAL_POLICY_API_URL;
   const token = process.env.PORTAL_POLICY_SERVICE_TOKEN;
-  if (!base || !token) {
+  if (!base || !token || !coreConfigured()) {
     return NextResponse.json({ error: "Portal nicht konfiguriert" }, { status: 503 });
   }
 
-  const modules = await filterVisibleModules(loadModuleRegistry(), tenant, role, policyAuthorize(base, token));
+  const claims = await authenticate(request);
+  if (!claims) {
+    return NextResponse.json({ error: "Anmeldung erforderlich" }, { status: 401 });
+  }
+
+  const cacheKey = `${claims.tenant}\u0000${claims.role}`;
+  const hit = visibleModulesCache.get(cacheKey, CACHE_TTL_MS);
+  if (hit) return NextResponse.json({ modules: hit });
+
+  const modules = applyUrlOverrides(
+    await filterVisibleModules(loadModuleRegistry(), claims.tenant, claims.role, policyAuthorize(base, token)),
+    process.env
+  );
+  visibleModulesCache.set(cacheKey, modules);
   return NextResponse.json({ modules });
 }

web/portal/app/api/worklist/route.test.ts

@@ -0,0 +1,69 @@
+import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
+import { NextRequest } from "next/server";
+import { generateKeyPairSync, sign } from "node:crypto";
+import { resetKeyCacheForTests } from "../../../lib/verifyToken";
+
+const originalFetch = global.fetch;
+const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+const rawPub = (publicKey.export({ format: "der", type: "spki" }) as Buffer).subarray(-32);
+
+function mint(claims: Record<string, unknown>): string {
+  const enc = (o: unknown) => Buffer.from(JSON.stringify(o)).toString("base64url");
+  const head = enc({ alg: "EdDSA", typ: "JWT", kid: "k1" });
+  const body = enc({ exp: Math.floor(Date.now() / 1000) + 300, ...claims });
+  return `${head}.${body}.${sign(null, Buffer.from(`${head}.${body}`), privateKey).toString("base64url")}`;
+}
+
+describe("GET /api/worklist", () => {
+  let wfCalls: { url: string; user: string }[];
+
+  const req = (token?: string, query = "") =>
+    new NextRequest(`http://portal.example/api/worklist${query}`, { headers: token ? { authorization: `Bearer ${token}` } : {} });
+
+  beforeEach(async () => {
+    process.env.PORTAL_WORKFLOW_API_URL = "http://wf.example";
+    process.env.PORTAL_CORE_API_URL = "http://core.example";
+    wfCalls = [];
+    resetKeyCacheForTests();
+    (await import("../../../lib/caches")).worklistCache.clear();
+    global.fetch = vi.fn(async (url: string | URL | Request, init?: RequestInit) => {
+      const u = String(url);
+      if (u.endsWith("/auth/module-jwks")) {
+        return new Response(JSON.stringify({ keys: [{ kid: "k1", public_key: rawPub.toString("base64") }] }), { status: 200 });
+      }
+      wfCalls.push({ url: u, user: (init?.headers as Record<string, string>)["X-User-Id"] });
+      return new Response(JSON.stringify([]), { status: 200 });
+    }) as typeof fetch;
+  });
+  afterEach(() => {
+    global.fetch = originalFetch;
+    delete process.env.PORTAL_WORKFLOW_API_URL;
+    delete process.env.PORTAL_CORE_API_URL;
+  });
+
+  it("gibt 401 ohne Token und 503 ohne Konfiguration zurueck", async () => {
+    const { GET } = await import("./route");
+    expect((await GET(req())).status).toBe(401);
+    delete process.env.PORTAL_WORKFLOW_API_URL;
+    expect((await GET(req(mint({ sub: "u1", tenant: "acme" })))).status).toBe(503);
+  });
+
+  it("nimmt den Benutzer aus dem Token, nie aus der URL, und sendet no-store", async () => {
+    const { GET } = await import("./route");
+    const res = await GET(req(mint({ sub: "u1", tenant: "acme", role: "user" }), "?userId=fremd"));
+    expect(res.status).toBe(200);
+    expect(res.headers.get("cache-control")).toBe("no-store");
+    expect(wfCalls.length).toBe(3);
+    expect(wfCalls.every((c) => c.user === "u1")).toBe(true);
+  });
+
+  it("cached je Mandant und Benutzer", async () => {
+    const { GET } = await import("./route");
+    await GET(req(mint({ sub: "u1", tenant: "acme" })));
+    await GET(req(mint({ sub: "u1", tenant: "acme" })));
+    expect(wfCalls.length).toBe(3);
+    await GET(req(mint({ sub: "u2", tenant: "acme" })));
+    expect(wfCalls.length).toBe(6);
+    expect(wfCalls.slice(3).every((c) => c.user === "u2")).toBe(true);
+  });
+});

web/portal/app/api/worklist/route.ts

@@ -0,0 +1,27 @@
+import { NextRequest, NextResponse } from "next/server";
+import { authenticate, coreConfigured } from "../../../lib/auth";
+import { worklistCache } from "../../../lib/caches";
+import { loadWorklist } from "../../../lib/worklist";
+
+export const dynamic = "force-dynamic";
+
+const CACHE_TTL_MS = Number(process.env.PORTAL_WORKLIST_CACHE_SECONDS ?? "15") * 1000;
+// Nur Zaehler, keine Inhalte. Benutzer und Mandant stammen aus dem verifizierten Token;
+// die Workflow-API kennt bisher nur X-User-Id (Uebergangsmodus), der Header wird hier serverseitig gesetzt.
+export async function GET(request: NextRequest) {
+  const base = process.env.PORTAL_WORKFLOW_API_URL;
+  if (!base || !coreConfigured()) {
+    return NextResponse.json({ error: "Portal nicht konfiguriert" }, { status: 503 });
+  }
+  const claims = await authenticate(request);
+  if (!claims) return NextResponse.json({ error: "Anmeldung erforderlich" }, { status: 401 });
+
+  const noStore = { "Cache-Control": "no-store" };
+  const key = `${claims.tenant}\u0000${claims.sub}`;
+  const hit = worklistCache.get(key, CACHE_TTL_MS);
+  if (hit) return NextResponse.json(hit, { headers: noStore });
+
+  const data = await loadWorklist(base, claims.tenant, claims.sub);
+  worklistCache.set(key, data);
+  return NextResponse.json(data, { headers: noStore });
+}

web/portal/app/layout.tsx

@@ -1,6 +1,8 @@
 import Script from "next/script";
-import { ThemeProvider, I18nProvider, ToastProvider, ModuleNavShell, typography, themeInitScript, focusVisibleStyles } from "@nexarch/shl";
+import { ThemeProvider, I18nProvider, ToastProvider, typography, themeInitScript, focusVisibleStyles } from "@nexarch/shl";
 import type { ReactNode } from "react";
+import { AccountBar } from "./AccountBar";
+import { PortalShell } from "./PortalShell";
 
 export const metadata = {
   title: "NEXARCH Portal",
@@ -25,7 +27,7 @@ export default function RootLayout({ children }: { children: ReactNode }) {
       >
         <ThemeProvider>
           <I18nProvider initialLocale="de">
-            <ToastProvider><ModuleNavShell activeKey="portal">{children}</ModuleNavShell></ToastProvider>
+            <ToastProvider><PortalShell><AccountBar />{children}</PortalShell></ToastProvider>
           </I18nProvider>
         </ThemeProvider>
       </body>

web/portal/app/page.tsx

@@ -1,3 +1,4 @@
+import { AdminPanel } from "./AdminPanel";
 import { ModuleGrid } from "./ModuleGrid";
 
 export default function Page() {
@@ -5,6 +6,7 @@ export default function Page() {
     <div style={{ maxWidth: 960, margin: "0 auto", padding: 24 }}>
       <h1>NEXARCH Portal</h1>
       <ModuleGrid />
+      <AdminPanel />
     </div>
   );
 }

web/portal/lib/adminData.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it, vi } from "vitest";
+import { loadKennzahlenSummary, loadSystemStatus } from "./adminData";
+
+describe("loadSystemStatus", () => {
+  it("mappt Name, Status und Zeitpunkt", async () => {
+    const f = vi.fn(async () => new Response(JSON.stringify([{ name: "dms", status: "up", last_checked: "2026-10-27T10:00:00Z", host: "geheim" }]), { status: 200 })) as unknown as typeof fetch;
+    const r = await loadSystemStatus("http://s.example/", f);
+    expect(r).toEqual([{ name: "dms", status: "up", lastChecked: "2026-10-27T10:00:00Z" }]);
+    expect(JSON.stringify(r)).not.toContain("geheim");
+  });
+
+  it("liefert null bei Fehler oder falscher Form", async () => {
+    expect(await loadSystemStatus("http://s", (async () => new Response("", { status: 500 })) as unknown as typeof fetch)).toBeNull();
+    expect(await loadSystemStatus("http://s", (async () => new Response("{}", { status: 200 })) as unknown as typeof fetch)).toBeNull();
+    expect(await loadSystemStatus("http://s", (async () => { throw new Error("x"); }) as unknown as typeof fetch)).toBeNull();
+  });
+});
+
+describe("loadKennzahlenSummary", () => {
+  it("sendet Mandant und Rolle aus den Argumenten und gibt nur die drei Summen zurueck", async () => {
+    const f = vi.fn(async () => new Response(JSON.stringify({ objekt_bestand: 5, loeschvorgaenge: 2, speichervolumen_bytes: 1024, aufbewahrungsstatus: { a: 1 } }), { status: 200 }));
+    const r = await loadKennzahlenSummary("http://k.example", "acme", "auditor", f as unknown as typeof fetch);
+    expect(r).toEqual({ objektBestand: 5, loeschvorgaenge: 2, speichervolumenBytes: 1024 });
+    const [url, init] = f.mock.calls[0] as unknown as [string, RequestInit];
+    expect(url).toBe("http://k.example/kennzahlen/totals?tenant=acme");
+    expect((init.headers as Record<string, string>)["X-User-Role"]).toBe("auditor");
+  });
+
+  it("liefert null, wenn die Quelle ablehnt", async () => {
+    expect(await loadKennzahlenSummary("http://k", "t", "r", (async () => new Response("", { status: 403 })) as unknown as typeof fetch)).toBeNull();
+  });
+});

web/portal/lib/adminData.ts

@@ -0,0 +1,53 @@
+export interface ModuleStatusRow {
+  name: string;
+  status: string;
+  lastChecked: string | null;
+}
+
+export interface KennzahlenSummary {
+  objektBestand: number;
+  loeschvorgaenge: number;
+  speichervolumenBytes: number;
+}
+
+const num = (v: unknown): number => (typeof v === "number" && Number.isFinite(v) ? v : 0);
+
+export async function loadSystemStatus(base: string, fetchImpl: typeof fetch = fetch): Promise<ModuleStatusRow[] | null> {
+  try {
+    const res = await fetchImpl(`${base.replace(/\/$/, "")}/status/overview`, { cache: "no-store" });
+    if (!res.ok) return null;
+    const body = (await res.json()) as unknown;
+    if (!Array.isArray(body)) return null;
+    return body.map((r: { name?: unknown; status?: unknown; last_checked?: unknown }) => ({
+      name: String(r.name ?? ""),
+      status: String(r.status ?? "unknown"),
+      lastChecked: typeof r.last_checked === "string" ? r.last_checked : null,
+    }));
+  } catch {
+    return null;
+  }
+}
+
+// Nur die drei Summenwerte verlassen das Portal; Mandant und Rolle kommen aus dem Token.
+export async function loadKennzahlenSummary(
+  base: string,
+  tenant: string,
+  role: string,
+  fetchImpl: typeof fetch = fetch
+): Promise<KennzahlenSummary | null> {
+  try {
+    const res = await fetchImpl(`${base.replace(/\/$/, "")}/kennzahlen/totals?tenant=${encodeURIComponent(tenant)}`, {
+      headers: { "X-User-Role": role, Accept: "application/json" },
+      cache: "no-store",
+    });
+    if (!res.ok) return null;
+    const b = (await res.json()) as Record<string, unknown>;
+    return {
+      objektBestand: num(b.objekt_bestand),
+      loeschvorgaenge: num(b.loeschvorgaenge),
+      speichervolumenBytes: num(b.speichervolumen_bytes),
+    };
+  } catch {
+    return null;
+  }
+}

web/portal/lib/auth.ts

@@ -0,0 +1,19 @@
+import type { NextRequest } from "next/server";
+import { verifyModuleToken, type VerifiedClaims } from "./verifyToken";
+
+export async function authenticate(request: NextRequest): Promise<VerifiedClaims | null> {
+  const coreBase = process.env.PORTAL_CORE_API_URL ?? process.env.NEXT_PUBLIC_CORE_API_BASE;
+  if (!coreBase) return null;
+  const auth = request.headers.get("authorization") ?? "";
+  const bearer = auth.startsWith("Bearer ") ? auth.slice(7).trim() : "";
+  if (!bearer) return null;
+  return verifyModuleToken(bearer, {
+    jwksUrl: `${coreBase.replace(/\/$/, "")}/auth/module-jwks`,
+    issuer: process.env.PORTAL_TOKEN_ISSUER,
+    audience: process.env.PORTAL_TOKEN_AUDIENCE,
+  });
+}
+
+export function coreConfigured(): boolean {
+  return Boolean(process.env.PORTAL_CORE_API_URL ?? process.env.NEXT_PUBLIC_CORE_API_BASE);
+}

web/portal/lib/caches.ts

@@ -0,0 +1,24 @@
+import type { ModuleEntry } from "./modules";
+import type { Worklist } from "./worklist";
+
+export class TtlCache<T> {
+  private readonly entries = new Map<string, { at: number; value: T }>();
+
+  get(key: string, ttlMs: number): T | undefined {
+    const hit = this.entries.get(key);
+    return hit && Date.now() - hit.at < ttlMs ? hit.value : undefined;
+  }
+
+  set(key: string, value: T): void {
+    this.entries.set(key, { at: Date.now(), value });
+  }
+
+  clear(): void {
+    this.entries.clear();
+  }
+}
+
+export const visibleModulesCache = new TtlCache<ModuleEntry[]>();
+export const worklistCache = new TtlCache<Worklist>();
+export const statusCache = new TtlCache<unknown>();
+export const kennzahlenCache = new TtlCache<unknown>();

web/portal/lib/modules.test.ts

@@ -83,3 +83,17 @@ describe("loadModuleRegistry", () => {
     expect(new Set(keys).size).toBe(keys.length);
   });
 });
+
+describe("applyUrlOverrides", () => {
+  const mods = [{ key: "dms", label: "D", description: "x", href: "http://localhost:3101", permission: "p" }];
+
+  it("ersetzt den Href per NEXARCH_MODULE_URL_<KEY>", async () => {
+    const { applyUrlOverrides } = await import("./modules");
+    expect(applyUrlOverrides(mods, { NEXARCH_MODULE_URL_DMS: "https://dms.example" })[0].href).toBe("https://dms.example");
+  });
+
+  it("laesst den Href ohne Override unveraendert", async () => {
+    const { applyUrlOverrides } = await import("./modules");
+    expect(applyUrlOverrides(mods, {})[0].href).toBe("http://localhost:3101");
+  });
+});

web/portal/lib/modules.ts

@@ -1,7 +1,8 @@
-import { MODULE_REGISTRY } from "@nexarch/shl";
+import { MODULE_REGISTRY, type ModuleGroup } from "@nexarch/shl";
 
 export interface ModuleEntry {
   key: string;
+  group?: ModuleGroup;
   label: string;
   description: string;
   href: string;
@@ -18,3 +19,11 @@ export function loadModuleRegistry(): ModuleEntry[] {
     (m): m is ModuleEntry => m.key !== "portal" && m.description !== undefined && m.permission !== undefined
   );
 }
+
+// NEXARCH_MODULE_URL_<KEY> ersetzt den festen Port-Href eines Moduls, ohne Rebuild.
+export function applyUrlOverrides(modules: ModuleEntry[], env: Record<string, string | undefined>): ModuleEntry[] {
+  return modules.map((m) => {
+    const override = env[`NEXARCH_MODULE_URL_${m.key.toUpperCase()}`];
+    return override ? { ...m, href: override } : m;
+  });
+}

web/portal/lib/policy.ts

@@ -0,0 +1,41 @@
+import type { ModuleEntry } from "./modules";
+
+export type Authorize = (tenant: string, role: string, permission: string) => Promise<boolean>;
+
+// Reine, testbare Kernlogik: iteriert generisch ueber JEDE Registry, egal
+// wie viele/welche Eintraege config/modules.json enthaelt (Akzeptanz-
+// kriterium 3 -- ein neues Modul braucht hier keine Codeaenderung).
+// Ausfall/Verweigerung von 'authorize' lassen ein Modul nie durch
+// (fail-closed, Pruefung 4: kein Modul ohne Berechtigung sichtbar).
+export async function filterVisibleModules(
+  registry: ModuleEntry[],
+  tenant: string,
+  role: string,
+  authorize: Authorize
+): Promise<ModuleEntry[]> {
+  const results = await Promise.all(
+    registry.map(async (mod) => {
+      try {
+        return (await authorize(tenant, role, mod.permission)) ? mod : null;
+      } catch {
+        return null;
+      }
+    })
+  );
+  return results.filter((m): m is ModuleEntry => m !== null);
+}
+
+export function policyAuthorize(base: string, token: string): Authorize {
+  return async (tenant, role, permission) => {
+    const res = await fetch(`${base.replace(/\/$/, "")}/authorize`, {
+      method: "POST",
+      headers: { "X-Service-Token": token, "Content-Type": "application/json" },
+      body: JSON.stringify({ tenant, role, permission }),
+      cache: "no-store",
+    });
+    if (!res.ok) return false;
+    const body = (await res.json()) as { allowed?: boolean };
+    return body.allowed === true;
+  };
+}
+

web/portal/lib/verifyToken.ts

@@ -0,0 +1,84 @@
+import { createPublicKey, verify, type KeyObject } from "node:crypto";
+
+export interface VerifiedClaims {
+  sub: string;
+  tenant: string;
+  role: string;
+}
+
+export interface VerifyOptions {
+  jwksUrl: string;
+  issuer?: string;
+  audience?: string;
+  fetchImpl?: typeof fetch;
+  now?: () => number;
+}
+
+const SPKI_ED25519_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+const JWKS_TTL_MS = 60_000;
+
+let keyCache: { url: string; at: number; keys: Map<string, KeyObject> } | null = null;
+
+export function resetKeyCacheForTests(): void {
+  keyCache = null;
+}
+
+async function loadKeys(opts: VerifyOptions, force: boolean): Promise<Map<string, KeyObject>> {
+  const now = (opts.now ?? Date.now)();
+  if (!force && keyCache && keyCache.url === opts.jwksUrl && now - keyCache.at < JWKS_TTL_MS) return keyCache.keys;
+  const res = await (opts.fetchImpl ?? fetch)(opts.jwksUrl, { cache: "no-store" });
+  if (!res.ok) throw new Error(`jwks ${res.status}`);
+  const body = (await res.json()) as { keys?: { kid?: string; public_key?: string }[] };
+  const keys = new Map<string, KeyObject>();
+  for (const k of body.keys ?? []) {
+    if (!k.kid || !k.public_key) continue;
+    const raw = Buffer.from(k.public_key, "base64");
+    if (raw.length !== 32) continue;
+    keys.set(k.kid, createPublicKey({ key: Buffer.concat([SPKI_ED25519_PREFIX, raw]), format: "der", type: "spki" }));
+  }
+  keyCache = { url: opts.jwksUrl, at: now, keys };
+  return keys;
+}
+
+function parseJson(part: string): Record<string, unknown> | null {
+  try {
+    const v = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+    return typeof v === "object" && v !== null ? v : null;
+  } catch {
+    return null;
+  }
+}
+
+// Gibt nur bei gueltiger Signatur, Ablaufzeit und (falls gesetzt) Aussteller/Zielmodul Claims zurueck.
+export async function verifyModuleToken(token: string, opts: VerifyOptions): Promise<VerifiedClaims | null> {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const header = parseJson(parts[0]);
+  const claims = parseJson(parts[1]);
+  if (!header || !claims || header.alg !== "EdDSA" || typeof header.kid !== "string") return null;
+
+  let keys: Map<string, KeyObject>;
+  try {
+    keys = await loadKeys(opts, false);
+    if (!keys.has(header.kid)) keys = await loadKeys(opts, true);
+  } catch {
+    return null;
+  }
+  const key = keys.get(header.kid);
+  if (!key) return null;
+
+  const signed = Buffer.from(`${parts[0]}.${parts[1]}`);
+  const sig = Buffer.from(parts[2], "base64url");
+  if (!verify(null, signed, key, sig)) return null;
+
+  const nowSec = Math.floor((opts.now ?? Date.now)() / 1000);
+  if (typeof claims.exp !== "number" || claims.exp <= nowSec) return null;
+  if (typeof claims.nbf === "number" && claims.nbf > nowSec) return null;
+  if (opts.issuer && claims.iss !== opts.issuer) return null;
+  if (opts.audience) {
+    const aud = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+    if (!aud.includes(opts.audience)) return null;
+  }
+  if (typeof claims.sub !== "string" || typeof claims.tenant !== "string" || !claims.sub || !claims.tenant) return null;
+  return { sub: claims.sub, tenant: claims.tenant, role: typeof claims.role === "string" ? claims.role : "" };
+}

web/portal/lib/worklist.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, it, vi } from "vitest";
+import { countApprovals, countOwnReminders, countOwnTasks, loadWorklist } from "./worklist";
+
+describe("Zaehler", () => {
+  it("zaehlt nur eigene, nicht erledigte Personen-Aufgaben", () => {
+    const rows = [
+      { AssigneeType: "person", AssigneeID: "u1", Status: "open" },
+      { AssigneeType: "person", AssigneeID: "u1", Status: "done" },
+      { AssigneeType: "person", AssigneeID: "u2", Status: "open" },
+      { AssigneeType: "group", AssigneeID: "u1", Status: "open" },
+    ];
+    expect(countOwnTasks(rows, "u1")).toBe(1);
+  });
+
+  it("zaehlt nur eigene ueberfaellige oder diese Woche faellige Wiedervorlagen", () => {
+    const rows = [
+      { Column: "overdue", Reminder: { CreatedBy: "u1" } },
+      { Column: "this_week", Reminder: { CreatedBy: "u1" } },
+      { Column: "open", Reminder: { CreatedBy: "u1" } },
+      { Column: "overdue", Reminder: { CreatedBy: "u2" } },
+    ];
+    expect(countOwnReminders(rows, "u1")).toBe(2);
+  });
+
+  it("liefert 0 bei unerwarteter Antwortform", () => {
+    expect(countApprovals(null)).toBe(0);
+    expect(countOwnTasks({}, "u1")).toBe(0);
+    expect(countOwnReminders("x", "u1")).toBe(0);
+  });
+});
+
+describe("loadWorklist", () => {
+  it("setzt X-User-Id und X-Tenant-Slug und gibt nur Zaehler zurueck", async () => {
+    const calls: { url: string; headers: Record<string, string> }[] = [];
+    const fetchImpl = vi.fn(async (url: string, init: RequestInit) => {
+      calls.push({ url, headers: init.headers as Record<string, string> });
+      if (url.endsWith("/approvals")) return new Response(JSON.stringify([{ ID: "a" }, { ID: "b" }]), { status: 200 });
+      if (url.endsWith("/tasks")) return new Response(JSON.stringify([{ AssigneeType: "person", AssigneeID: "u1", Status: "open", Title: "geheim" }]), { status: 200 });
+      return new Response(JSON.stringify([]), { status: 200 });
+    }) as unknown as typeof fetch;
+
+    const w = await loadWorklist("http://wf.example/", "acme", "u1", fetchImpl);
+
+    expect(w).toEqual({ approvals: 2, tasks: 1, remindersDue: 0 });
+    expect(JSON.stringify(w)).not.toContain("geheim");
+    expect(calls.every((c) => c.headers["X-User-Id"] === "u1" && c.headers["X-Tenant-Slug"] === "acme")).toBe(true);
+  });
+
+  it("markiert ausgefallene Quellen mit null, ohne die anderen zu verlieren", async () => {
+    const fetchImpl = vi.fn(async (url: string) => {
+      if (url.endsWith("/tasks")) throw new Error("down");
+      if (url.endsWith("/reminders/kanban")) return new Response("", { status: 500 });
+      return new Response(JSON.stringify([{ ID: "a" }]), { status: 200 });
+    }) as unknown as typeof fetch;
+    expect(await loadWorklist("http://wf.example", "acme", "u1", fetchImpl)).toEqual({ approvals: 1, tasks: null, remindersDue: null });
+  });
+});

web/portal/lib/worklist.ts

@@ -0,0 +1,60 @@
+export interface Worklist {
+  approvals: number | null;
+  tasks: number | null;
+  remindersDue: number | null;
+}
+
+interface TaskRow {
+  AssigneeType?: string;
+  AssigneeID?: string;
+  Status?: string;
+}
+
+interface KanbanRow {
+  Column?: string;
+  Reminder?: { CreatedBy?: string };
+}
+
+export function countApprovals(rows: unknown): number {
+  return Array.isArray(rows) ? rows.length : 0;
+}
+
+// /tasks liefert alle Aufgaben der Instanz; nur die eigenen, offenen werden gezaehlt.
+export function countOwnTasks(rows: unknown, userId: string): number {
+  if (!Array.isArray(rows)) return 0;
+  return (rows as TaskRow[]).filter(
+    (t) => t.AssigneeType === "person" && t.AssigneeID === userId && t.Status !== "done"
+  ).length;
+}
+
+// /reminders/kanban liefert alle Wiedervorlagen; gezaehlt werden die eigenen, ueberfaelligen oder diese Woche faelligen.
+export function countOwnReminders(rows: unknown, userId: string): number {
+  if (!Array.isArray(rows)) return 0;
+  return (rows as KanbanRow[]).filter(
+    (k) => k.Reminder?.CreatedBy === userId && (k.Column === "overdue" || k.Column === "this_week")
+  ).length;
+}
+
+export async function loadWorklist(
+  base: string,
+  tenant: string,
+  userId: string,
+  fetchImpl: typeof fetch = fetch
+): Promise<Worklist> {
+  const root = base.replace(/\/$/, "");
+  const headers = { "X-User-Id": userId, "X-Tenant-Slug": tenant, Accept: "application/json" };
+  const get = async (path: string): Promise<unknown | null> => {
+    try {
+      const res = await fetchImpl(`${root}${path}`, { headers, cache: "no-store" });
+      return res.ok ? await res.json() : null;
+    } catch {
+      return null;
+    }
+  };
+  const [approvals, tasks, reminders] = await Promise.all([get("/approvals"), get("/tasks"), get("/reminders/kanban")]);
+  return {
+    approvals: approvals === null ? null : countApprovals(approvals),
+    tasks: tasks === null ? null : countOwnTasks(tasks, userId),
+    remindersDue: reminders === null ? null : countOwnReminders(reminders, userId),
+  };
+}

web/shl/__tests__/AccountBar.test.tsx

@@ -0,0 +1,36 @@
+import { describe, expect, it } from "vitest";
+import { render, screen } from "@testing-library/react";
+import { AccountBar } from "../components/AccountBar";
+import { I18nProvider } from "../i18n/i18n";
+import { ThemeProvider } from "../theme/ThemeProvider";
+
+function renderBar(props: Partial<React.ComponentProps<typeof AccountBar>>) {
+  return render(
+    <ThemeProvider>
+      <I18nProvider>
+        <AccountBar visible onLogout={() => {}} {...props} />
+      </I18nProvider>
+    </ThemeProvider>,
+  );
+}
+
+describe("AccountBar", () => {
+  it("zeigt Benutzer, Rolle und Mandant", async () => {
+    renderBar({ loadIdentity: async () => ({ userId: "u-1", tenant: "t-1", role: "admin" }) });
+    const el = await screen.findByTestId("account-identity");
+    expect(el.textContent).toContain("u-1");
+    expect(el.textContent).toContain("admin");
+    expect(el.textContent).toContain("t-1");
+  });
+
+  it("zeigt nur Abmelden, wenn die Identitaet nicht ladbar ist", async () => {
+    renderBar({ loadIdentity: async () => { throw new Error("x"); } });
+    await screen.findByRole("button");
+    expect(screen.queryByTestId("account-identity")).toBeNull();
+  });
+
+  it("rendert nichts, wenn nicht sichtbar", () => {
+    const { container } = renderBar({ visible: false });
+    expect(container.querySelector("header")).toBeNull();
+  });
+});

web/shl/auth/session.ts

@@ -35,6 +35,8 @@ export interface Identity {
   role: string;
 }
 
+export type IdentityLoader = () => Promise<Identity | null>;
+
 export interface SessionOptions {
   coreBase: string;
   fetchImpl?: typeof fetch;

web/shl/components/AccountBar.tsx

@@ -0,0 +1,43 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { LogoutButton } from "../auth/LogoutButton";
+import type { Identity, IdentityLoader } from "../auth/session";
+import { useI18n } from "../i18n/i18n";
+
+export interface AccountBarProps {
+  visible: boolean;
+  onLogout: () => void;
+  loadIdentity?: IdentityLoader;
+}
+
+export function AccountBar({ visible, onLogout, loadIdentity }: AccountBarProps) {
+  const { t } = useI18n();
+  const [identity, setIdentity] = useState<Identity | null>(null);
+
+  useEffect(() => {
+    if (!visible || !loadIdentity) return;
+    let cancelled = false;
+    loadIdentity().then(
+      (id) => {
+        if (!cancelled) setIdentity(id);
+      },
+      () => {},
+    );
+    return () => {
+      cancelled = true;
+    };
+  }, [visible, loadIdentity]);
+
+  if (!visible) return null;
+  return (
+    <header style={{ display: "flex", justifyContent: "flex-end", alignItems: "center", gap: 16, padding: "8px 16px" }}>
+      {identity && (
+        <span data-testid="account-identity">
+          {identity.userId} · {t("shl.auth.role")}: {identity.role} · {t("shl.auth.tenant")}: {identity.tenant}
+        </span>
+      )}
+      <LogoutButton onLogout={onLogout} />
+    </header>
+  );
+}

web/shl/components/ModuleNavShell.tsx

@@ -17,8 +17,11 @@ import { useEffect, useState } from "react";
 import type { ReactNode } from "react";
 import { Shell } from "./Shell";
 
+export type ModuleGroup = "work" | "admin" | "audit";
+
 export interface ModuleRegistryEntry {
   key: string;
+  group?: ModuleGroup;
   label: string;
   href: string;
   description?: string;
@@ -27,55 +30,55 @@ export interface ModuleRegistryEntry {
 
 export const MODULE_REGISTRY: ModuleRegistryEntry[] = [
   {
-    key: "dms", label: "Dokumente", href: "http://localhost:3101",
+    key: "dms", group: "work", label: "Dokumente", href: "http://localhost:3101",
     description: "Dokumente durchsuchen und verwalten.", permission: "dms.document.read",
   },
   {
-    key: "dms_upload", label: "Dokumente hochladen", href: "http://localhost:3107",
+    key: "dms_upload", group: "work", label: "Dokumente hochladen", href: "http://localhost:3107",
     description: "Dokumente und Kassenbelege hochladen, inklusive mobiler Kamera-Erfassung.", permission: "dms.upload.read",
   },
   {
-    key: "mail", label: "Postfach", href: "http://localhost:3102",
+    key: "mail", group: "work", label: "Postfach", href: "http://localhost:3102",
     description: "E-Mails durchsuchen und verwalten.", permission: "mail.message.read",
   },
   {
-    key: "workflow", label: "Aufgaben & Freigaben", href: "http://localhost:3103",
+    key: "workflow", group: "work", label: "Aufgaben & Freigaben", href: "http://localhost:3103",
     description: "Freigaben bearbeiten, Akten einsehen, Aufgaben verwalten.", permission: "workflow.approval.read",
   },
   {
-    key: "workflow_cases", label: "Akten & Vorgänge", href: "http://localhost:3108",
+    key: "workflow_cases", group: "work", label: "Akten & Vorgänge", href: "http://localhost:3108",
     description: "Akten, Vermerke und Wiedervorlagen einsehen.", permission: "workflow.case.read",
   },
   {
-    key: "routing_rules", label: "Routing-Regeln", href: "http://localhost:3109",
+    key: "routing_rules", group: "admin", label: "Routing-Regeln", href: "http://localhost:3109",
     description: "Regelbasiertes Routing anlegen und testen.", permission: "workflow.routingrule.read",
   },
   {
-    key: "ai", label: "KI-Funktionen", href: "http://localhost:3104",
+    key: "ai", group: "work", label: "KI-Funktionen", href: "http://localhost:3104",
     description: "Zusammenfassungen, Extraktion und semantische Suche.", permission: "ai.summary.read",
   },
   {
-    key: "ai_extraction", label: "Extraktions-Korrektur", href: "http://localhost:3110",
+    key: "ai_extraction", group: "work", label: "Extraktions-Korrektur", href: "http://localhost:3110",
     description: "Von der KI extrahierte Werte prüfen und korrigieren.", permission: "ai.extraction.read",
   },
   {
-    key: "connect", label: "Externe Anbindungen", href: "http://localhost:3105",
+    key: "connect", group: "admin", label: "Externe Anbindungen", href: "http://localhost:3105",
     description: "Status externer Systemanbindungen (ERP, DATEV, CRM).", permission: "connect.status.read",
   },
   {
-    key: "connect_datev", label: "DATEV-Export", href: "http://localhost:3111",
+    key: "connect_datev", group: "admin", label: "DATEV-Export", href: "http://localhost:3111",
     description: "DATEV-Exporte anstoßen und Übertragungsprotokoll einsehen.", permission: "connect.datev.read",
   },
   {
-    key: "tenant_admin", label: "Mandantenverwaltung", href: "http://localhost:3106",
+    key: "tenant_admin", group: "admin", label: "Mandantenverwaltung", href: "http://localhost:3106",
     description: "Mandanten und Import-Verzeichnisse verwalten.", permission: "core.tenant.admin",
   },
   {
-    key: "rbac_admin", label: "Rollen & Rechte", href: "http://localhost:3112",
+    key: "rbac_admin", group: "admin", label: "Rollen & Rechte", href: "http://localhost:3112",
     description: "Rollen und Berechtigungen verwalten.", permission: "core.tenant.admin",
   },
   {
-    key: "kennzahlen_dashboard", label: "Kennzahlen", href: "http://localhost:3113",
+    key: "kennzahlen_dashboard", group: "audit", label: "Kennzahlen", href: "http://localhost:3113",
     description: "Löschkennzahlen je Tenant und Modul einsehen.", permission: "kennzahlen.read",
   },
   { key: "portal", label: "Übersicht", href: "http://localhost:3900" },
@@ -83,6 +86,7 @@ export const MODULE_REGISTRY: ModuleRegistryEntry[] = [
 
 export interface ModuleNavShellProps {
   activeKey: string;
+  tenantLabel?: string;
   children: ReactNode;
 }
 
@@ -119,7 +123,7 @@ function tenantLabel(): string {
   return process.env.NEXT_PUBLIC_TENANT_SLUG ?? process.env.NEXT_PUBLIC_MAIL_TENANT_SLUG ?? "demo";
 }
 
-export function ModuleNavShell({ activeKey, children }: ModuleNavShellProps) {
+export function ModuleNavShell({ activeKey, tenantLabel: tenantLabelProp, children }: ModuleNavShellProps) {
   const [hrefs, setHrefs] = useState<Record<string, string>>({});
 
   useEffect(() => {
@@ -134,7 +138,7 @@ export function ModuleNavShell({ activeKey, children }: ModuleNavShellProps) {
   }));
 
   return (
-    <Shell modules={modules} tenantLabel={tenantLabel()}>
+    <Shell modules={modules} tenantLabel={tenantLabelProp ?? tenantLabel()}>
       {children}
     </Shell>
   );

web/shl/i18n/messages.ts

@@ -19,6 +19,8 @@ const baseMessages: MessageBundle = {
     "shl.theme.toggleToLight": "Helles Erscheinungsbild",
     "shl.theme.toggleToDark": "Dunkles Erscheinungsbild",
     "shl.auth.logout": "Abmelden",
+    "shl.auth.role": "Rolle",
+    "shl.auth.tenant": "Mandant",
   },
   en: {
     "shl.dialog.close": "Close",
@@ -27,6 +29,8 @@ const baseMessages: MessageBundle = {
     "shl.theme.toggleToLight": "Switch to light theme",
     "shl.theme.toggleToDark": "Switch to dark theme",
     "shl.auth.logout": "Sign out",
+    "shl.auth.role": "Role",
+    "shl.auth.tenant": "Tenant",
   },
 };
 

web/shl/index.ts

@@ -15,7 +15,10 @@ export { Shell } from "./components/Shell";
 export type { ShellProps, ModuleLink } from "./components/Shell";
 
 export { ModuleNavShell, MODULE_REGISTRY, resolveModuleHref } from "./components/ModuleNavShell";
-export type { ModuleNavShellProps, ModuleRegistryEntry } from "./components/ModuleNavShell";
+export type { ModuleNavShellProps, ModuleRegistryEntry, ModuleGroup } from "./components/ModuleNavShell";
+
+export { AccountBar } from "./components/AccountBar";
+export type { AccountBarProps } from "./components/AccountBar";
 
 export { Dialog } from "./components/Dialog";
 export type { DialogProps } from "./components/Dialog";
@@ -27,7 +30,7 @@ export { TextField, SelectField, CheckboxField } from "./components/FormElements
 export type { TextFieldProps, SelectFieldProps, CheckboxFieldProps } from "./components/FormElements";
 
 export { createSession, redirectToLogin, describeHttpError, authMessages, AuthError } from "./auth/session";
-export type { Session, SessionOptions, Identity, AuthErrorKind } from "./auth/session";
+export type { Session, SessionOptions, Identity, IdentityLoader, AuthErrorKind } from "./auth/session";
 export { LogoutButton } from "./auth/LogoutButton";
 export type { LogoutButtonProps } from "./auth/LogoutButton";