Phase 5 abgeschlossen: Dateien mit vollständiger Prüfkette

Upload → quarantine/ → Typprüfung → ClamAV → Neukodierung → store/. Es gibt
keinen Pfad, auf dem eine Datei ungeprüft in store/ landet, und keinen
Schalter, der die Kette abschaltet.

Die Typprüfung liest Magic Bytes aus einer eigenen Signaturtabelle statt aus
file-type: bei einer Positivliste aus fünf Formaten hilft es nicht, hundert
erkennen zu können. Die Signatur muss an Position 0 stehen — ein Vorspann vor
%PDF- ist der klassische Weg, eine Datei für zwei Programme zugleich lesbar zu
machen. Wer trotzdem durchkommt, kommt als text/plain durch und wird unter der
Endung des erkannten Typs ausgeliefert, nicht unter der hochgeladenen.

Drei Ausgänge statt zwei: BLOCKED heisst "ist gefährlich", FAILED heisst
"wissen wir nicht". Nur FAILED lässt sich freigeben, und die Freigabe
wiederholt die Kette ohne den Scanner — Typprüfung und Neukodierung laufen
dabei mit. Ein fehlender clamd macht damit keine Datei sauber; ein Test hält
das fest.

Auslieferung nur über /api/files/[id], mit Sichtbarkeitsprüfung der
zugehörigen Akte, Protokoll ab Stufe 3 und den harten Kopfzeilen aus docs/07.
Vorschaubilder dürfen inline, weil sie serverseitig als WebP neu kodiert
wurden.

Das Lichtbild im Aktenblatt ist damit gefüllt: der Feldwert ist die Kennung
eines geprüften Anhangs, serverseitig zu einer Adresse aufgelöst.

/api/events liefert attachment.scanned über pg_notify — die Grundlage, auf der
Phase 6 den Aktenchat aufsetzt. Die Sichtbarkeit wird je Ereignis geprüft,
sonst verriete schon die Kennung die Existenz.

Nebenbei riss das Bündelbudget (121 kB gegen 120 erlaubte): lib/i18n/de.ts war
ein Objekt, und eine Client-Komponente zieht die ganze Datei mit. Die Texte
stehen jetzt in sechs Dateien nach Bereichen, de.ts setzt sie nur zusammen.
Grösste Route wieder bei 118 kB, und sie wächst nicht mehr mit jedem neuen
Bereich mit.

133 Tests im Web-Paket, 15 in der Datenbank, 28 e2e.

web/app/(app)/admin/richtlinie/PolicyForm.tsx

@@ -1,7 +1,8 @@
 'use client'
 
 import { useState, useTransition } from 'react'
-import { de } from '@/lib/i18n/de'
+import { settingsText } from '@/lib/i18n/admin'
+import { caseText } from '@/lib/i18n/cases'
 import { savePolicy } from './actions'
 
 const POLICIES = ['APPEND_ONLY', 'GRACE_WINDOW', 'OPEN'] as const
@@ -24,7 +25,7 @@ export function PolicyForm({
   const [pending, startTransition] = useTransition()
 
   function submit() {
-    if (!confirm(de.settings.confirm)) return
+    if (!confirm(settingsText.confirm)) return
     setError(null)
     startTransition(async () => {
       const result = await savePolicy({
@@ -40,7 +41,7 @@ export function PolicyForm({
   return (
     <div className="mt-6 space-y-6">
       <fieldset>
-        <legend className="font-condensed text-xs text-text-dim">{de.settings.policy}</legend>
+        <legend className="font-condensed text-xs text-text-dim">{settingsText.policy}</legend>
         <div className="mt-2 space-y-2">
           {POLICIES.map((value) => (
             <label key={value} className="flex items-start gap-2 text-sm">
@@ -55,14 +56,14 @@ export function PolicyForm({
                 }}
                 className="mt-1"
               />
-              <span>{de.settings.policies[value]}</span>
+              <span>{settingsText.policies[value]}</span>
             </label>
           ))}
         </div>
       </fieldset>
 
       <label className="block">
-        <span className="font-condensed text-xs text-text-dim">{de.settings.graceMinutes}</span>
+        <span className="font-condensed text-xs text-text-dim">{settingsText.graceMinutes}</span>
         <input
           type="number"
           min={0}
@@ -86,7 +87,7 @@ export function PolicyForm({
             setSaved(false)
           }}
         />
-        <span>{de.settings.markGrace}</span>
+        <span>{settingsText.markGrace}</span>
       </label>
 
       <div className="flex items-center gap-3">
@@ -96,10 +97,10 @@ export function PolicyForm({
           disabled={pending}
           className="border border-line bg-raised px-4 py-2 font-condensed text-xs text-accent disabled:text-text-dim"
         >
-          {pending ? de.case.saving : de.settings.save}
+          {pending ? caseText.saving : settingsText.save}
         </button>
         {saved ? (
-          <span className="font-condensed text-2xs text-text-dim">{de.settings.saved}</span>
+          <span className="font-condensed text-2xs text-text-dim">{settingsText.saved}</span>
         ) : null}
         {error ? <span className="font-condensed text-2xs text-stamp-4">{error}</span> : null}
       </div>

web/app/(app)/admin/rollen/RoleRow.tsx

@@ -1,7 +1,7 @@
 'use client'
 
 import { useState, useTransition } from 'react'
-import { de } from '@/lib/i18n/de'
+import { roleAdminText } from '@/lib/i18n/admin'
 import { OPT_IN_PERMISSIONS, PERMISSIONS, type Permission } from '@/lib/auth/permissions'
 import { saveRoleMapping } from './actions'
 
@@ -52,7 +52,7 @@ export function RoleRow({
   }
 
   function submit() {
-    if (!confirm(de.roleAdmin.confirm)) return
+    if (!confirm(roleAdminText.confirm)) return
     setError(null)
     startTransition(async () => {
       const result = await saveRoleMapping({
@@ -77,14 +77,14 @@ export function RoleRow({
         <span className="font-mono text-2xs text-text-dim">{role.discordRoleId}</span>
         {!role.isPresent ? (
           <span className="font-condensed text-2xs text-stamp-4">
-            {de.roleAdmin.missingFromGuild}
+            {roleAdminText.missingFromGuild}
           </span>
         ) : null}
       </div>
 
       <div className="mt-3 flex flex-wrap gap-x-8 gap-y-3 text-xs">
         <label className="flex items-center gap-2">
-          <span className="font-condensed text-text-dim">{de.roleAdmin.category}</span>
+          <span className="font-condensed text-text-dim">{roleAdminText.category}</span>
           <select
             value={category}
             onChange={(event) => {
@@ -95,14 +95,14 @@ export function RoleRow({
           >
             {CATEGORIES.map((value) => (
               <option key={value} value={value}>
-                {de.roleAdmin.categories[value]}
+                {roleAdminText.categories[value]}
               </option>
             ))}
           </select>
         </label>
 
         <label className="flex items-center gap-2">
-          <span className="font-condensed text-text-dim">{de.roleAdmin.clearance}</span>
+          <span className="font-condensed text-text-dim">{roleAdminText.clearance}</span>
           <select
             value={clearanceLevel}
             onChange={(event) => {
@@ -128,12 +128,12 @@ export function RoleRow({
               setSaved(false)
             }}
           />
-          <span className="font-condensed text-text-dim">{de.roleAdmin.grantsMembership}</span>
+          <span className="font-condensed text-text-dim">{roleAdminText.grantsMembership}</span>
         </label>
       </div>
 
       <fieldset className="mt-4">
-        <legend className="text-xs text-text-dim">{de.roleAdmin.permissions}</legend>
+        <legend className="text-xs text-text-dim">{roleAdminText.permissions}</legend>
         <div className="mt-2 grid grid-cols-[repeat(auto-fill,minmax(13rem,1fr))] gap-x-4 gap-y-1.5">
           {PERMISSIONS.map((permission) => {
             const optIn = OPT_IN_PERMISSIONS.includes(permission)
@@ -141,7 +141,7 @@ export function RoleRow({
               <label
                 key={permission}
                 className="flex items-center gap-2 font-mono text-2xs"
-                title={optIn ? de.roleAdmin.optIn : undefined}
+                title={optIn ? roleAdminText.optIn : undefined}
               >
                 <input
                   type="checkbox"
@@ -162,10 +162,10 @@ export function RoleRow({
           disabled={pending || !dirty}
           className="border border-line bg-raised px-3 py-1.5 font-condensed text-xs text-accent disabled:text-text-dim"
         >
-          {pending ? de.roleAdmin.saving : de.roleAdmin.save}
+          {pending ? roleAdminText.saving : roleAdminText.save}
         </button>
         {saved && !dirty ? (
-          <span className="font-condensed text-2xs text-text-dim">{de.roleAdmin.saved}</span>
+          <span className="font-condensed text-2xs text-text-dim">{roleAdminText.saved}</span>
         ) : null}
         {error ? <span className="font-condensed text-2xs text-stamp-4">{error}</span> : null}
       </div>

web/app/(app)/admin/vorlagen/TemplateEditor.tsx

@@ -1,7 +1,8 @@
 'use client'
 
 import { useMemo, useState, useTransition } from 'react'
-import { de } from '@/lib/i18n/de'
+import { templateAdminText } from '@/lib/i18n/admin'
+import { caseText, sectionText } from '@/lib/i18n/cases'
 import { isInputField, looksLikeFields, type TemplateField } from '@/lib/templates/fields'
 import { saveTemplate } from './actions'
 
@@ -41,11 +42,11 @@ export function TemplateEditor({ vorlage }: { vorlage: Vorlage }) {
       // Nur eine grobe Formprüfung für die Vorschau. Ob die Vorlage
       // gespeichert werden darf, entscheidet allein der Server.
       if (!looksLikeFields(roh)) {
-        return { ok: false as const, fehler: de.templateAdmin.fieldsInvalid }
+        return { ok: false as const, fehler: templateAdminText.fieldsInvalid }
       }
       return { ok: true as const, fields: roh }
     } catch {
-      return { ok: false as const, fehler: de.templateAdmin.invalid }
+      return { ok: false as const, fehler: templateAdminText.invalid }
     }
   }, [json])
 
@@ -62,7 +63,7 @@ export function TemplateEditor({ vorlage }: { vorlage: Vorlage }) {
         numberPadding,
         fields: geparst.fields,
       })
-      if (antwort.ok) setResult(de.templateAdmin.saved(antwort.version))
+      if (antwort.ok) setResult(templateAdminText.saved(antwort.version))
       else setError(antwort.error)
     })
   }
@@ -73,14 +74,14 @@ export function TemplateEditor({ vorlage }: { vorlage: Vorlage }) {
         <h2 className="font-condensed">{vorlage.name}</h2>
         <span className="font-mono text-2xs text-text-dim">{vorlage.key}</span>
         <span className="font-condensed text-2xs text-text-dim">
-          {de.templateAdmin.version(vorlage.version)}
+          {templateAdminText.version(vorlage.version)}
         </span>
       </div>
 
       <div className="mt-4 grid gap-4 lg:grid-cols-2">
         <div className="space-y-3 text-xs">
           <label className="block">
-            <span className="font-condensed text-text-dim">{de.case.title}</span>
+            <span className="font-condensed text-text-dim">{caseText.title}</span>
             <input
               value={name}
               onChange={(event) => setName(event.target.value)}
@@ -89,7 +90,7 @@ export function TemplateEditor({ vorlage }: { vorlage: Vorlage }) {
           </label>
 
           <label className="block">
-            <span className="font-condensed text-text-dim">{de.case.type}</span>
+            <span className="font-condensed text-text-dim">{caseText.type}</span>
             <input
               value={description}
               onChange={(event) => setDescription(event.target.value)}
@@ -99,7 +100,7 @@ export function TemplateEditor({ vorlage }: { vorlage: Vorlage }) {
 
           <div className="flex gap-3">
             <label className="block">
-              <span className="font-condensed text-text-dim">{de.templateAdmin.numberPrefix}</span>
+              <span className="font-condensed text-text-dim">{templateAdminText.numberPrefix}</span>
               <input
                 value={numberPrefix}
                 onChange={(event) => setNumberPrefix(event.target.value)}
@@ -107,7 +108,7 @@ export function TemplateEditor({ vorlage }: { vorlage: Vorlage }) {
               />
             </label>
             <label className="block">
-              <span className="font-condensed text-text-dim">{de.templateAdmin.numberPadding}</span>
+              <span className="font-condensed text-text-dim">{templateAdminText.numberPadding}</span>
               <input
                 type="number"
                 min={1}
@@ -120,7 +121,7 @@ export function TemplateEditor({ vorlage }: { vorlage: Vorlage }) {
           </div>
 
           <label className="block">
-            <span className="font-condensed text-text-dim">{de.templateAdmin.fieldsLabel}</span>
+            <span className="font-condensed text-text-dim">{templateAdminText.fieldsLabel}</span>
             <textarea
               value={json}
               onChange={(event) => setJson(event.target.value)}
@@ -128,7 +129,7 @@ export function TemplateEditor({ vorlage }: { vorlage: Vorlage }) {
               spellCheck={false}
               className="mt-1 block w-full border border-line bg-raised px-2 py-1 font-mono text-2xs"
             />
-            <span className="mt-1 block text-2xs text-text-dim">{de.templateAdmin.fieldsHelp}</span>
+            <span className="mt-1 block text-2xs text-text-dim">{templateAdminText.fieldsHelp}</span>
           </label>
 
           <div className="flex items-center gap-3">
@@ -138,7 +139,7 @@ export function TemplateEditor({ vorlage }: { vorlage: Vorlage }) {
               disabled={pending || !geparst.ok}
               className="border border-line bg-raised px-3 py-1.5 font-condensed text-accent disabled:text-text-dim"
             >
-              {pending ? de.case.saving : de.templateAdmin.save}
+              {pending ? caseText.saving : templateAdminText.save}
             </button>
             {result ? <span className="font-condensed text-2xs text-text-dim">{result}</span> : null}
             {!geparst.ok ? (
@@ -149,8 +150,8 @@ export function TemplateEditor({ vorlage }: { vorlage: Vorlage }) {
         </div>
 
         <div className="border border-line p-4">
-          <p className="font-condensed text-xs text-text-dim">{de.templateAdmin.preview}</p>
-          <p className="mt-1 text-2xs text-text-dim">{de.templateAdmin.previewIntro}</p>
+          <p className="font-condensed text-xs text-text-dim">{templateAdminText.preview}</p>
+          <p className="mt-1 text-2xs text-text-dim">{templateAdminText.previewIntro}</p>
           <div className="mt-4">
             {geparst.ok ? <Vorschau fields={geparst.fields} /> : null}
           </div>
@@ -162,7 +163,7 @@ export function TemplateEditor({ vorlage }: { vorlage: Vorlage }) {
 
 /** „So sieht eine neue Akte damit aus", ohne etwas zu speichern. */
 function Vorschau({ fields }: { fields: TemplateField[] }) {
-  if (fields.length === 0) return <p className="text-2xs text-text-dim">{de.section.empty}</p>
+  if (fields.length === 0) return <p className="text-2xs text-text-dim">{sectionText.empty}</p>
 
   return (
     <dl className="space-y-4">
@@ -176,14 +177,14 @@ function Vorschau({ fields }: { fields: TemplateField[] }) {
             ) : null}
             {isInputField(field) && field.requiredToClose ? (
               <span className="font-condensed text-2xs text-stamp-3">
-                {de.section.requiredToClose}
+                {sectionText.requiredToClose}
               </span>
             ) : null}
           </dt>
           <dd className="mt-1">
             {!isInputField(field) ? (
               <p className="text-2xs text-text-dim italic">
-                {field.text ? field.text.slice(0, 120) : de.templateAdmin.staticBlock}
+                {field.text ? field.text.slice(0, 120) : templateAdminText.staticBlock}
               </p>
             ) : field.type === 'longtext' ? (
               <div className="h-12 border border-line bg-raised" />

web/app/(app)/dateien/actions.ts

@@ -0,0 +1,38 @@
+'use server'
+
+import { revalidatePath } from 'next/cache'
+import { z } from 'zod'
+import { requireUser } from '@/lib/auth/current'
+import { AccessError } from '@/lib/errors'
+import { releaseAttachment } from '@/lib/files/service'
+import { de } from '@/lib/i18n/de'
+
+export type ActionResult = { ok: true } | { ok: false; error: string }
+
+const schema = z.object({ id: z.string().min(1) })
+
+/**
+ * Freigabe einer Datei, deren Prüfung nicht abgeschlossen werden konnte.
+ * Nur mit Recht `admin`, geprüft im Dienst — nicht hier.
+ */
+export async function releaseAttachmentAction(input: unknown): Promise<ActionResult> {
+  const user = await requireUser()
+  const parsed = schema.safeParse(input)
+  if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
+
+  try {
+    await releaseAttachment(user.permissions, parsed.data.id)
+    revalidatePath('/faelle')
+    return { ok: true }
+  } catch (error) {
+    if (error instanceof AccessError) {
+      return {
+        ok: false,
+        error:
+          de.attachment.errors[error.code] ?? de.actionErrors[error.code] ?? de.actionErrors.default!,
+      }
+    }
+    console.error('[dateien] Freigabe fehlgeschlagen', error)
+    return { ok: false, error: de.actionErrors.default! }
+  }
+}

web/app/(app)/dokumente/[documentNumber]/DocumentActions.tsx

@@ -1,7 +1,9 @@
 'use client'
 
 import { useState, useTransition } from 'react'
-import { de } from '@/lib/i18n/de'
+import { caseText } from '@/lib/i18n/cases'
+import { actionErrorsText, clearanceText, commonText } from '@/lib/i18n/common'
+import { documentText } from '@/lib/i18n/documents'
 import {
   finalizeDocumentAction,
   reclassifyDocumentAction,
@@ -45,7 +47,7 @@ export function DocumentActions({
     setError(null)
     startTransition(async () => {
       const result = await action()
-      if (!result.ok) setError(result.error ?? de.actionErrors.default!)
+      if (!result.ok) setError(result.error ?? actionErrorsText.default!)
       else setRetracting(false)
     })
   }
@@ -58,24 +60,24 @@ export function DocumentActions({
             type="button"
             disabled={pending}
             onClick={() => {
-              if (!confirm(de.document.finalizeHint)) return
+              if (!confirm(documentText.finalizeHint)) return
               run(() => finalizeDocumentAction({ documentNumber }))
             }}
             className="border border-line bg-raised px-3 py-1 font-condensed text-accent disabled:text-text-dim"
           >
-            {de.document.finalize}
+            {documentText.finalize}
           </button>
         </div>
       ) : null}
 
       {canReclassify ? (
         <div>
-          <p className="font-condensed text-text-dim">{de.document.reclassify}</p>
+          <p className="font-condensed text-text-dim">{documentText.reclassify}</p>
           <div className="mt-1.5 flex flex-wrap items-center gap-2">
             <select
               value={nextLevel}
               onChange={(event) => setNextLevel(Number(event.target.value))}
-              aria-label={de.clearance.classification}
+              aria-label={clearanceText.classification}
               className="border border-line bg-raised px-2 py-1"
             >
               {levels.map((level) => (
@@ -98,7 +100,7 @@ export function DocumentActions({
               }
               className="border border-line bg-raised px-3 py-1 font-condensed text-accent disabled:text-text-dim"
             >
-              {de.common.save}
+              {commonText.save}
             </button>
           </div>
           {lowering ? (
@@ -106,8 +108,8 @@ export function DocumentActions({
               value={levelReason}
               onChange={(event) => setLevelReason(event.target.value)}
               rows={2}
-              placeholder={de.case.reclassifyReason}
-              aria-label={de.case.reclassifyReason}
+              placeholder={caseText.reclassifyReason}
+              aria-label={caseText.reclassifyReason}
               className="mt-2 block w-full max-w-sm border border-line bg-raised px-3 py-2 text-2xs"
             />
           ) : null}
@@ -122,8 +124,8 @@ export function DocumentActions({
                 value={reason}
                 onChange={(event) => setReason(event.target.value)}
                 rows={2}
-                placeholder={de.document.retractReason}
-                aria-label={de.document.retractReason}
+                placeholder={documentText.retractReason}
+                aria-label={documentText.retractReason}
                 className="block w-full max-w-sm border border-line bg-raised px-3 py-2 text-2xs"
               />
               <div className="mt-2 flex gap-3">
@@ -133,14 +135,14 @@ export function DocumentActions({
                   onClick={() => run(() => retractDocumentAction({ documentNumber, reason }))}
                   className="border border-line bg-raised px-3 py-1 font-condensed text-stamp-4 disabled:text-text-dim"
                 >
-                  {de.document.retract}
+                  {documentText.retract}
                 </button>
                 <button
                   type="button"
                   onClick={() => setRetracting(false)}
                   className="font-condensed text-text-dim"
                 >
-                  {de.common.cancel}
+                  {commonText.cancel}
                 </button>
               </div>
             </div>
@@ -150,7 +152,7 @@ export function DocumentActions({
               onClick={() => setRetracting(true)}
               className="font-condensed text-text-dim"
             >
-              {de.document.retract}
+              {documentText.retract}
             </button>
           )}
         </div>

web/app/(app)/dokumente/[documentNumber]/page.tsx

@@ -19,6 +19,9 @@ import { Sheet } from '@/components/documents/Sheet'
 import { SheetSwitch } from '@/components/documents/SheetSwitch'
 import { saveDocumentSectionAction } from '../actions'
 import { DocumentActions } from './DocumentActions'
+import { Attachments } from '@/components/files/Attachments'
+import { listAttachments, resolvePhotoUrls } from '@/lib/files/service'
+import { toAttachmentViews } from '@/lib/files/view'
 import type { EffectivePermissions } from '@/lib/auth/permissions'
 
 export const dynamic = 'force-dynamic'
@@ -49,12 +52,24 @@ async function Body({
   canEdit: boolean
 }) {
   const sections = await loadDocumentSections(permissions, document)
+  const photoUrls = await resolvePhotoUrls(
+    permissions,
+    sections.map((section) => ({
+      fieldKey: section.fieldKey,
+      visible: section.visible,
+      value: section.visible ? section.value : null,
+      type: section.field.type,
+    })),
+  )
+
   const editor = (
     <Sections
       scope={`dokument:${document.documentNumber}`}
       save={saveDocumentSectionAction.bind(null, document.documentNumber)}
       sections={sections}
       canEdit={canEdit}
+      documentNumber={document.documentNumber}
+      photoUrls={photoUrls}
     />
   )
 
@@ -83,12 +98,35 @@ async function Body({
           issuedAt={document.createdAt}
           foundationLevels={foundationLevels}
           footerNote={de.document.footerNote}
+          photoUrls={photoUrls}
         />
       }
     />
   )
 }
 
+async function AttachmentBlock({
+  documentId,
+  documentNumber,
+  permissions,
+  canUpload,
+}: {
+  documentId: string
+  documentNumber: string
+  permissions: EffectivePermissions
+  canUpload: boolean
+}) {
+  const anhaenge = await listAttachments(permissions, { documentId })
+  return (
+    <Attachments
+      target={{ documentNumber }}
+      initial={toAttachmentViews(anhaenge)}
+      canUpload={canUpload}
+      canRelease={permissions.isAdmin}
+    />
+  )
+}
+
 /**
  * Ein Dokument.
  *
@@ -228,6 +266,20 @@ export default async function DocumentPage({
           <Body document={doc} permissions={user.permissions} canEdit={canEdit} />
         </Suspense>
       </section>
+
+      <section className="no-print mt-10">
+        <h2 className="font-condensed">{de.attachment.heading}</h2>
+        <div className="mt-4">
+          <Suspense fallback={<SkeletonLine width="50%" />}>
+            <AttachmentBlock
+              documentId={doc.id}
+              documentNumber={doc.documentNumber}
+              permissions={user.permissions}
+              canUpload={canEdit}
+            />
+          </Suspense>
+        </div>
+      </section>
     </main>
   )
 }

web/app/(app)/faelle/[caseNumber]/CaseActions.tsx

@@ -1,7 +1,8 @@
 'use client'
 
 import { useState, useTransition } from 'react'
-import { de } from '@/lib/i18n/de'
+import { caseText, entryText } from '@/lib/i18n/cases'
+import { actionErrorsText, commonText } from '@/lib/i18n/common'
 import { changeStatusAction, reclassifyAction } from '../actions'
 
 /**
@@ -38,7 +39,7 @@ export function CaseActions({
     setError(null)
     startTransition(async () => {
       const result = await action()
-      if (!result.ok) setError(result.error ?? de.actionErrors.default!)
+      if (!result.ok) setError(result.error ?? actionErrorsText.default!)
     })
   }
 
@@ -46,7 +47,7 @@ export function CaseActions({
     <div className="mt-6 flex flex-wrap gap-x-10 gap-y-5 border-t border-line pt-5 text-xs">
       {statusTargets.length > 0 ? (
         <div>
-          <p className="font-condensed text-text-dim">{de.case.statusChange}</p>
+          <p className="font-condensed text-text-dim">{caseText.statusChange}</p>
           <div className="mt-1.5 flex flex-wrap items-center gap-2">
             <select
               value={nextStatus}
@@ -55,14 +56,14 @@ export function CaseActions({
             >
               {statusTargets.map((target) => (
                 <option key={target} value={target}>
-                  {de.case.statusNames[target] ?? target}
+                  {caseText.statusNames[target] ?? target}
                 </option>
               ))}
             </select>
             <input
               value={statusReason}
               onChange={(event) => setStatusReason(event.target.value)}
-              placeholder={de.entry.changeReason}
+              placeholder={entryText.changeReason}
               className="w-56 border border-line bg-raised px-2 py-1"
             />
             <button
@@ -76,19 +77,19 @@ export function CaseActions({
                       to: nextStatus,
                       reason: statusReason || undefined,
                     }),
-                  `${de.case.statusChange}: ${de.case.statusNames[nextStatus] ?? nextStatus}?`,
+                  `${caseText.statusChange}: ${caseText.statusNames[nextStatus] ?? nextStatus}?`,
                 )
               }
               className="border border-line bg-raised px-3 py-1 font-condensed text-accent disabled:text-text-dim"
             >
-              {pending ? de.case.saving : de.common.save}
+              {pending ? caseText.saving : commonText.save}
             </button>
           </div>
         </div>
       ) : null}
 
       <div>
-        <p className="font-condensed text-text-dim">{de.case.reclassify}</p>
+        <p className="font-condensed text-text-dim">{caseText.reclassify}</p>
         <div className="mt-1.5 flex flex-wrap items-center gap-2">
           <select
             value={nextLevel}
@@ -109,7 +110,7 @@ export function CaseActions({
             <input
               value={levelReason}
               onChange={(event) => setLevelReason(event.target.value)}
-              placeholder={de.case.reclassifyReason}
+              placeholder={caseText.reclassifyReason}
               className="w-64 border border-line bg-raised px-2 py-1"
             />
           ) : null}
@@ -124,12 +125,12 @@ export function CaseActions({
                     to: nextLevel,
                     reason: levelReason || undefined,
                   }),
-                `${de.case.reclassify}: ${nextLevel}?`,
+                `${caseText.reclassify}: ${nextLevel}?`,
               )
             }
             className="border border-line bg-raised px-3 py-1 font-condensed text-accent disabled:text-text-dim"
           >
-            {pending ? de.case.saving : de.common.save}
+            {pending ? caseText.saving : commonText.save}
           </button>
         </div>
       </div>

web/app/(app)/faelle/[caseNumber]/CaseLinks.tsx

@@ -2,7 +2,8 @@
 
 import { useState, useTransition } from 'react'
 import Link from 'next/link'
-import { de } from '@/lib/i18n/de'
+import { linkText } from '@/lib/i18n/cases'
+import { commonText } from '@/lib/i18n/common'
 import { LINK_KINDS } from '@/lib/cases/terms'
 import { linkCasesAction, unlinkCasesAction } from '../actions'
 import { classificationEdgeStyle } from '@/components/StampMark'
@@ -37,7 +38,7 @@ export function CaseLinks({
   return (
     <div>
       {links.length === 0 ? (
-        <p className="text-text-dim">{de.link.empty}</p>
+        <p className="text-text-dim">{linkText.empty}</p>
       ) : (
         <ul className="border-t border-line">
           {links.map((link) => (
@@ -47,7 +48,7 @@ export function CaseLinks({
               style={classificationEdgeStyle(link.other.classification)}
             >
               <span className="font-condensed text-2xs text-text-dim">
-                {(link.direction === 'in' ? de.link.incoming : de.link.kinds)[link.kind] ??
+                {(link.direction === 'in' ? linkText.incoming : linkText.kinds)[link.kind] ??
                   link.kind}
               </span>
               <Link
@@ -74,7 +75,7 @@ export function CaseLinks({
                   }
                   className="font-condensed text-2xs text-text-dim"
                 >
-                  {de.link.remove}
+                  {linkText.remove}
                 </button>
               ) : null}
             </li>
@@ -90,20 +91,20 @@ export function CaseLinks({
             <select
               value={kind}
               onChange={(event) => setKind(event.target.value)}
-              aria-label={de.link.kind}
+              aria-label={linkText.kind}
               className="border border-line bg-raised px-2 py-1 text-2xs"
             >
               {LINK_KINDS.map((value) => (
                 <option key={value} value={value}>
-                  {de.link.kinds[value] ?? value}
+                  {linkText.kinds[value] ?? value}
                 </option>
               ))}
             </select>
             <input
               value={target}
               onChange={(event) => setTarget(event.target.value)}
-              placeholder={de.link.target}
-              aria-label={de.link.target}
+              placeholder={linkText.target}
+              aria-label={linkText.target}
               className="border border-line bg-raised px-2 py-1 font-mono text-2xs"
             />
             <button
@@ -127,14 +128,14 @@ export function CaseLinks({
               }
               className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent disabled:text-text-dim"
             >
-              {de.link.add}
+              {linkText.add}
             </button>
             <button
               type="button"
               onClick={() => setOpen(false)}
               className="font-condensed text-2xs text-text-dim"
             >
-              {de.common.cancel}
+              {commonText.cancel}
             </button>
           </div>
         ) : (
@@ -143,7 +144,7 @@ export function CaseLinks({
             onClick={() => setOpen(true)}
             className="mt-4 border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent"
           >
-            {de.link.add}
+            {linkText.add}
           </button>
         )
       ) : null}

web/app/(app)/faelle/[caseNumber]/EntryActions.tsx

@@ -1,7 +1,8 @@
 'use client'
 
 import { useState, useTransition } from 'react'
-import { de } from '@/lib/i18n/de'
+import { caseText, entryText } from '@/lib/i18n/cases'
+import { actionErrorsText } from '@/lib/i18n/common'
 import { editEntryAction, restoreEntryAction, retractEntryAction } from '../actions'
 
 /**
@@ -39,7 +40,7 @@ export function EntryActions({
         setMode('idle')
         setReason('')
       } else {
-        setError(result.error ?? de.actionErrors.default!)
+        setError(result.error ?? actionErrorsText.default!)
       }
     })
   }
@@ -51,7 +52,7 @@ export function EntryActions({
         <input
           value={reason}
           onChange={(event) => setReason(event.target.value)}
-          placeholder={de.entry.retractReason}
+          placeholder={entryText.retractReason}
           className="w-64 border border-line bg-raised px-2 py-1"
         />
         <button
@@ -60,7 +61,7 @@ export function EntryActions({
           onClick={() => run(() => restoreEntryAction({ entryId, caseNumber, reason }))}
           className="font-condensed text-accent disabled:text-text-dim"
         >
-          {de.entry.restore}
+          {entryText.restore}
         </button>
         {error ? <span className="text-stamp-4">{error}</span> : null}
       </div>
@@ -73,7 +74,7 @@ export function EntryActions({
       <div className="mt-1.5 flex gap-3 text-2xs">
         {canEdit ? (
           <button type="button" onClick={() => setMode('edit')} className="font-condensed text-accent">
-            {de.entry.edit}
+            {entryText.edit}
           </button>
         ) : null}
         {canRetract ? (
@@ -82,7 +83,7 @@ export function EntryActions({
             onClick={() => setMode('retract')}
             className="font-condensed text-accent"
           >
-            {de.entry.retract}
+            {entryText.retract}
           </button>
         ) : null}
       </div>
@@ -103,7 +104,7 @@ export function EntryActions({
       <input
         value={reason}
         onChange={(event) => setReason(event.target.value)}
-        placeholder={mode === 'edit' ? de.entry.changeReason : de.entry.retractReason}
+        placeholder={mode === 'edit' ? entryText.changeReason : entryText.retractReason}
         className="mt-2 block w-full border border-line bg-raised px-2 py-1"
       />
 
@@ -120,7 +121,7 @@ export function EntryActions({
           }
           className="border border-line bg-raised px-3 py-1 font-condensed text-accent disabled:text-text-dim"
         >
-          {pending ? de.case.saving : mode === 'edit' ? de.entry.editSave : de.entry.retract}
+          {pending ? caseText.saving : mode === 'edit' ? entryText.editSave : entryText.retract}
         </button>
         <button
           type="button"
@@ -132,7 +133,7 @@ export function EntryActions({
           }}
           className="font-condensed text-text-dim"
         >
-          {de.entry.cancel}
+          {entryText.cancel}
         </button>
         {error ? <span className="text-stamp-4">{error}</span> : null}
       </div>

web/app/(app)/faelle/[caseNumber]/EntryComposer.tsx

@@ -2,7 +2,7 @@
 
 import { useOptimistic, useRef, useState, useTransition } from 'react'
 import { uuidv7 } from 'uuidv7'
-import { de } from '@/lib/i18n/de'
+import { caseText, entryText } from '@/lib/i18n/cases'
 import { addEntryAction } from '../actions'
 
 type Pending = { id: string; body: string; failed: boolean }
@@ -52,7 +52,7 @@ export function EntryComposer({ caseNumber }: { caseNumber: string }) {
         className="max-w-(--container-measure)"
       >
         <label htmlFor="vermerk" className="font-condensed text-xs text-text-dim">
-          {de.case.newEntry}
+          {caseText.newEntry}
         </label>
         <textarea
           id="vermerk"
@@ -66,7 +66,7 @@ export function EntryComposer({ caseNumber }: { caseNumber: string }) {
             }
           }}
           rows={3}
-          placeholder={de.case.entryPlaceholder}
+          placeholder={caseText.entryPlaceholder}
           className="mt-1.5 block w-full border border-line bg-raised px-3 py-2 text-sm"
         />
         <button
@@ -74,7 +74,7 @@ export function EntryComposer({ caseNumber }: { caseNumber: string }) {
           disabled={pending || draft.trim().length === 0}
           className="mt-2 border border-line bg-raised px-3 py-1.5 font-condensed text-xs text-accent disabled:text-text-dim"
         >
-          {pending ? de.case.saving : de.entry.create}
+          {pending ? caseText.saving : entryText.create}
         </button>
       </form>
 
@@ -92,7 +92,7 @@ export function EntryComposer({ caseNumber }: { caseNumber: string }) {
                 {entry.body}
               </p>
               {entry.failed ? (
-                <p className="mt-1 font-condensed text-2xs text-stamp-4">{de.case.unsaved}</p>
+                <p className="mt-1 font-condensed text-2xs text-stamp-4">{caseText.unsaved}</p>
               ) : null}
             </li>
           ))}

web/app/(app)/faelle/[caseNumber]/Participants.tsx

@@ -2,7 +2,8 @@
 
 import { useState, useTransition } from 'react'
 import Link from 'next/link'
-import { de } from '@/lib/i18n/de'
+import { participantText } from '@/lib/i18n/cases'
+import { commonText } from '@/lib/i18n/common'
 import { PARTICIPANT_ROLES } from '@/lib/cases/terms'
 import { addParticipantAction, removeParticipantAction } from '../actions'
 
@@ -62,7 +63,7 @@ export function Participants({
   return (
     <div>
       {participants.length === 0 ? (
-        <p className="text-text-dim">{de.participant.empty}</p>
+        <p className="text-text-dim">{participantText.empty}</p>
       ) : (
         <ul className="border-t border-line">
           {participants.map((person) => (
@@ -71,15 +72,15 @@ export function Participants({
               className="flex flex-wrap items-baseline gap-x-4 gap-y-1 border-b border-line py-2"
             >
               <span className="font-condensed text-2xs text-text-dim">
-                {de.participant.roles[person.role] ?? person.role}
+                {participantText.roles[person.role] ?? person.role}
               </span>
               <span className="grow text-sm">
                 {person.personnelFileId ? (
                   <Link href={`/personalakten/${person.personnelFileId}`}>
-                    {person.displayName ?? de.common.unknown}
+                    {person.displayName ?? commonText.unknown}
                   </Link>
                 ) : (
-                  (person.displayName ?? de.common.unknown)
+                  (person.displayName ?? commonText.unknown)
                 )}
               </span>
               {canEdit ? (
@@ -97,7 +98,7 @@ export function Participants({
                   }
                   className="font-condensed text-2xs text-text-dim"
                 >
-                  {de.participant.remove}
+                  {participantText.remove}
                 </button>
               ) : null}
             </li>
@@ -111,36 +112,36 @@ export function Participants({
         open ? (
           <div className="mt-4 border border-line p-3">
             <p className="max-w-(--container-measure) text-2xs text-text-dim">
-              {de.participant.hint}
+              {participantText.hint}
             </p>
             <div className="mt-3 flex flex-wrap items-center gap-2">
               <select
                 value={role}
                 onChange={(event) => setRole(event.target.value)}
-                aria-label={de.participant.role}
+                aria-label={participantText.role}
                 className="border border-line bg-raised px-2 py-1 text-2xs"
               >
                 {PARTICIPANT_ROLES.map((value) => (
                   <option key={value} value={value}>
-                    {de.participant.roles[value] ?? value}
+                    {participantText.roles[value] ?? value}
                   </option>
                 ))}
               </select>
               <select
                 value={target}
                 onChange={(event) => setTarget(event.target.value)}
-                aria-label={de.participant.person}
+                aria-label={participantText.person}
                 className="border border-line bg-raised px-2 py-1 text-2xs"
               >
                 <option value="">—</option>
-                <optgroup label={de.participant.pickUser}>
+                <optgroup label={participantText.pickUser}>
                   {members.map((member) => (
                     <option key={member.id} value={`user:${member.id}`}>
                       {member.displayName}
                     </option>
                   ))}
                 </optgroup>
-                <optgroup label={de.participant.pickPersonnel}>
+                <optgroup label={participantText.pickPersonnel}>
                   {files.map((file) => (
                     <option key={file.id} value={`file:${file.id}`}>
                       {file.displayName}
@@ -154,14 +155,14 @@ export function Participants({
                 onClick={add}
                 className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent disabled:text-text-dim"
               >
-                {de.participant.add}
+                {participantText.add}
               </button>
               <button
                 type="button"
                 onClick={() => setOpen(false)}
                 className="font-condensed text-2xs text-text-dim"
               >
-                {de.common.cancel}
+                {commonText.cancel}
               </button>
             </div>
           </div>
@@ -171,7 +172,7 @@ export function Participants({
             onClick={() => setOpen(true)}
             className="mt-4 border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent"
           >
-            {de.participant.add}
+            {participantText.add}
           </button>
         )
       ) : null}

web/app/(app)/faelle/[caseNumber]/page.tsx

@@ -24,6 +24,9 @@ import { listDocuments, listTemplatesFor } from '@/lib/documents/service'
 import { visiblePersonnelWhere } from '@/lib/access/personnelFilter'
 import { DocumentList } from '@/components/documents/DocumentList'
 import { NewDocument } from '@/components/documents/NewDocument'
+import { Attachments } from '@/components/files/Attachments'
+import { listAttachments } from '@/lib/files/service'
+import { toAttachmentViews } from '@/lib/files/view'
 import { allowedTargets, type CaseStatusName } from '@/lib/cases/lifecycle'
 import { evaluateEntryEdit, canRetract } from '@/lib/cases/entryPolicy'
 import Link from 'next/link'
@@ -155,10 +158,12 @@ async function Relations({
   permissions: EffectivePermissions
   canEdit: boolean
 }) {
-  const [participants, links, documents, templates, levels, members, files] = await Promise.all([
+  const [participants, links, documents, anhaenge, templates, levels, members, files] =
+    await Promise.all([
     listParticipants(permissions, akte.id),
     listLinks(permissions, akte.id),
     listDocuments(permissions, { caseId: akte.id }),
+    listAttachments(permissions, { caseId: akte.id }),
     canEdit ? listTemplatesFor('CASE_DOCUMENT') : Promise.resolve([]),
     db.clearanceLevelConfig.findMany({ orderBy: { level: 'asc' } }),
     canEdit
@@ -204,6 +209,18 @@ async function Relations({
         </div>
       </section>
 
+      <section className="md:col-span-2">
+        <h2 className="font-condensed">{de.attachment.heading}</h2>
+        <div className="mt-4">
+          <Attachments
+            target={{ caseNumber: akte.caseNumber }}
+            initial={toAttachmentViews(anhaenge)}
+            canUpload={canEdit}
+            canRelease={permissions.isAdmin}
+          />
+        </div>
+      </section>
+
       <section className="md:col-span-2">
         <h2 className="font-condensed">{de.document.heading}</h2>
         <div className="mt-4 space-y-4">

web/app/(app)/faelle/neu/NewCaseForm.tsx

@@ -1,7 +1,8 @@
 'use client'
 
 import { useActionState } from 'react'
-import { de } from '@/lib/i18n/de'
+import { caseText } from '@/lib/i18n/cases'
+import { clearanceText } from '@/lib/i18n/common'
 import { createCaseAction, type CreateState } from '../actions'
 
 export function NewCaseForm({
@@ -21,7 +22,7 @@ export function NewCaseForm({
     <form action={action} className="mt-6 space-y-5">
       <div>
         <label htmlFor="title" className="font-condensed text-xs text-text-dim">
-          {de.case.title}
+          {caseText.title}
         </label>
         <input
           id="title"
@@ -35,7 +36,7 @@ export function NewCaseForm({
 
       <div>
         <label htmlFor="templateKey" className="font-condensed text-xs text-text-dim">
-          {de.case.type}
+          {caseText.type}
         </label>
         <select
           id="templateKey"
@@ -53,7 +54,7 @@ export function NewCaseForm({
 
       <div>
         <label htmlFor="classification" className="font-condensed text-xs text-text-dim">
-          {de.clearance.classification}
+          {clearanceText.classification}
         </label>
         {/* Die Auswahl zeigt nur, was erlaubt ist. Geprüft wird trotzdem serverseitig. */}
         <select
@@ -73,7 +74,7 @@ export function NewCaseForm({
       {people.length > 0 ? (
         <div>
           <label htmlFor="personnelFileId" className="font-condensed text-xs text-text-dim">
-            {de.case.subject}
+            {caseText.subject}
           </label>
           {/* Gleich beim Anlegen verknüpfen erspart den zweiten Schritt, den
               man sonst vergisst. Nachträglich geht es genauso. */}
@@ -83,7 +84,7 @@ export function NewCaseForm({
             defaultValue=""
             className="mt-1.5 block w-full border border-line bg-raised px-3 py-2 text-sm"
           >
-            <option value="">{de.case.subjectNone}</option>
+            <option value="">{caseText.subjectNone}</option>
             {people.map((person) => (
               <option key={person.id} value={person.id}>
                 {person.displayName}
@@ -99,7 +100,7 @@ export function NewCaseForm({
           disabled={pending}
           className="border border-line bg-raised px-4 py-2 font-condensed text-xs text-accent disabled:text-text-dim"
         >
-          {pending ? de.case.saving : de.case.create}
+          {pending ? caseText.saving : caseText.create}
         </button>
         {state.error ? (
           <span className="font-condensed text-2xs text-stamp-4">{state.error}</span>

web/app/(app)/personalakten/[id]/Assignments.tsx

@@ -1,7 +1,9 @@
 'use client'
 
 import { useState, useTransition } from 'react'
-import { de } from '@/lib/i18n/de'
+import { participantText } from '@/lib/i18n/cases'
+import { commonText } from '@/lib/i18n/common'
+import { assignmentText } from '@/lib/i18n/people'
 import { ASSIGNMENT_ROLES } from '@/lib/personnel/terms'
 import { addAssignmentAction, removeAssignmentAction } from '../actions'
 
@@ -37,7 +39,7 @@ export function Assignments({
   return (
     <div>
       {assignments.length === 0 ? (
-        <p className="text-text-dim">{de.assignment.empty}</p>
+        <p className="text-text-dim">{assignmentText.empty}</p>
       ) : (
         <ul className="border-t border-line">
           {assignments.map((zuordnung) => (
@@ -46,7 +48,7 @@ export function Assignments({
               className="flex flex-wrap items-baseline gap-x-4 gap-y-1 border-b border-line py-2"
             >
               <span className="font-condensed text-2xs text-text-dim">
-                {de.assignment.roles[zuordnung.role] ?? zuordnung.role}
+                {assignmentText.roles[zuordnung.role] ?? zuordnung.role}
               </span>
               <span className="grow text-sm">{zuordnung.user.displayName}</span>
               {canEdit ? (
@@ -64,7 +66,7 @@ export function Assignments({
                   }
                   className="font-condensed text-2xs text-text-dim"
                 >
-                  {de.assignment.remove}
+                  {assignmentText.remove}
                 </button>
               ) : null}
             </li>
@@ -78,25 +80,25 @@ export function Assignments({
         open ? (
           <div className="mt-4 border border-line p-3">
             <p className="max-w-(--container-measure) text-2xs text-text-dim">
-              {de.assignment.hint}
+              {assignmentText.hint}
             </p>
             <div className="mt-3 flex flex-wrap items-center gap-2">
               <select
                 value={role}
                 onChange={(event) => setRole(event.target.value)}
-                aria-label={de.participant.role}
+                aria-label={participantText.role}
                 className="border border-line bg-raised px-2 py-1 text-2xs"
               >
                 {ASSIGNMENT_ROLES.map((value) => (
                   <option key={value} value={value}>
-                    {de.assignment.roles[value] ?? value}
+                    {assignmentText.roles[value] ?? value}
                   </option>
                 ))}
               </select>
               <select
                 value={userId}
                 onChange={(event) => setUserId(event.target.value)}
-                aria-label={de.participant.pickUser}
+                aria-label={participantText.pickUser}
                 className="border border-line bg-raised px-2 py-1 text-2xs"
               >
                 <option value="">—</option>
@@ -123,14 +125,14 @@ export function Assignments({
                 }
                 className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent disabled:text-text-dim"
               >
-                {de.assignment.add}
+                {assignmentText.add}
               </button>
               <button
                 type="button"
                 onClick={() => setOpen(false)}
                 className="font-condensed text-2xs text-text-dim"
               >
-                {de.common.cancel}
+                {commonText.cancel}
               </button>
             </div>
           </div>
@@ -140,7 +142,7 @@ export function Assignments({
             onClick={() => setOpen(true)}
             className="mt-4 border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent"
           >
-            {de.assignment.add}
+            {assignmentText.add}
           </button>
         )
       ) : null}

web/app/(app)/personalakten/[id]/LinkCase.tsx

@@ -1,7 +1,9 @@
 'use client'
 
 import { useState, useTransition } from 'react'
-import { de } from '@/lib/i18n/de'
+import { linkText, participantText } from '@/lib/i18n/cases'
+import { commonText } from '@/lib/i18n/common'
+import { personnelText } from '@/lib/i18n/people'
 import { PARTICIPANT_ROLES } from '@/lib/cases/terms'
 import { linkCaseToPersonAction } from '../actions'
 
@@ -27,7 +29,7 @@ export function LinkCase({ personnelFileId }: { personnelFileId: string }) {
         onClick={() => setOpen(true)}
         className="mt-4 border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent"
       >
-        {de.personnel.linkCase}
+        {personnelText.linkCase}
       </button>
     )
   }
@@ -35,26 +37,26 @@ export function LinkCase({ personnelFileId }: { personnelFileId: string }) {
   return (
     <div className="mt-4 border border-line p-3">
       <p className="max-w-(--container-measure) text-2xs text-text-dim">
-        {de.personnel.linkCaseHint}
+        {personnelText.linkCaseHint}
       </p>
       <div className="mt-3 flex flex-wrap items-center gap-2">
         <select
           value={role}
           onChange={(event) => setRole(event.target.value)}
-          aria-label={de.participant.role}
+          aria-label={participantText.role}
           className="border border-line bg-raised px-2 py-1 text-2xs"
         >
           {PARTICIPANT_ROLES.map((value) => (
             <option key={value} value={value}>
-              {de.participant.roles[value] ?? value}
+              {participantText.roles[value] ?? value}
             </option>
           ))}
         </select>
         <input
           value={caseNumber}
           onChange={(event) => setCaseNumber(event.target.value)}
-          placeholder={de.link.target}
-          aria-label={de.link.target}
+          placeholder={linkText.target}
+          aria-label={linkText.target}
           className="border border-line bg-raised px-2 py-1 font-mono text-2xs"
         />
         <button
@@ -78,14 +80,14 @@ export function LinkCase({ personnelFileId }: { personnelFileId: string }) {
           }
           className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent disabled:text-text-dim"
         >
-          {de.personnel.linkCase}
+          {personnelText.linkCase}
         </button>
         <button
           type="button"
           onClick={() => setOpen(false)}
           className="font-condensed text-2xs text-text-dim"
         >
-          {de.common.cancel}
+          {commonText.cancel}
         </button>
       </div>
       {error ? <p className="mt-2 font-condensed text-2xs text-stamp-4">{error}</p> : null}

web/app/(app)/personalakten/[id]/PersonnelHead.tsx

@@ -1,7 +1,9 @@
 'use client'
 
 import { useActionState, useState, useTransition } from 'react'
-import { de } from '@/lib/i18n/de'
+import { caseText } from '@/lib/i18n/cases'
+import { clearanceText, commonText } from '@/lib/i18n/common'
+import { personnelText } from '@/lib/i18n/people'
 import { StatusTags } from '@/components/StatusTags'
 import {
   reclassifyPersonnelAction,
@@ -48,21 +50,21 @@ export function PersonnelHead({
     return (
       <div>
         <dl className="grid gap-x-8 gap-y-2 text-sm sm:grid-cols-2">
-          <Zeile label={de.personnel.rank} value={file.rank} />
-          <Zeile label={de.personnel.department} value={file.department} />
+          <Zeile label={personnelText.rank} value={file.rank} />
+          <Zeile label={personnelText.department} value={file.department} />
           <Zeile
-            label={de.personnel.linkedAccount}
-            value={file.userId ? file.userId : de.personnel.noAccount}
+            label={personnelText.linkedAccount}
+            value={file.userId ? file.userId : personnelText.noAccount}
             mono={Boolean(file.userId)}
           />
         </dl>
 
         <div className="mt-3 flex flex-wrap items-baseline gap-3">
-          <span className="font-condensed text-xs text-text-dim">{de.personnel.status}</span>
+          <span className="font-condensed text-xs text-text-dim">{personnelText.status}</span>
           {file.statusTags.length > 0 ? (
             <StatusTags tags={file.statusTags} known={statusTags} />
           ) : (
-            <span className="text-sm text-text-dim">{de.personnel.statusNone}</span>
+            <span className="text-sm text-text-dim">{personnelText.statusNone}</span>
           )}
         </div>
 
@@ -79,7 +81,7 @@ export function PersonnelHead({
               onClick={() => setEditing(true)}
               className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent"
             >
-              {de.personnel.edit}
+              {personnelText.edit}
             </button>
             <Reclassify id={file.id} current={file.classification} levels={levels} />
           </div>
@@ -95,14 +97,14 @@ export function PersonnelHead({
       className="max-w-(--container-measure) space-y-4"
     >
       <input type="hidden" name="id" value={file.id} />
-      <Feld id="displayName" label={de.personnel.name} defaultValue={file.displayName} required />
+      <Feld id="displayName" label={personnelText.name} defaultValue={file.displayName} required />
       <div className="grid gap-4 sm:grid-cols-2">
-        <Feld id="rank" label={de.personnel.rank} defaultValue={file.rank} />
-        <Feld id="department" label={de.personnel.department} defaultValue={file.department} />
+        <Feld id="rank" label={personnelText.rank} defaultValue={file.rank} />
+        <Feld id="department" label={personnelText.department} defaultValue={file.department} />
       </div>
 
       <fieldset>
-        <legend className="font-condensed text-2xs text-text-dim">{de.personnel.status}</legend>
+        <legend className="font-condensed text-2xs text-text-dim">{personnelText.status}</legend>
         <div className="mt-2 flex flex-wrap gap-x-6 gap-y-2">
           {statusTags.map((tag) => (
             <label key={tag.key} className="flex items-center gap-2 text-sm">
@@ -116,11 +118,11 @@ export function PersonnelHead({
             </label>
           ))}
         </div>
-        <p className="mt-1 text-2xs text-text-dim">{de.personnel.statusHint}</p>
+        <p className="mt-1 text-2xs text-text-dim">{personnelText.statusHint}</p>
       </fieldset>
       <div>
         <label htmlFor="note" className="font-condensed text-2xs text-text-dim">
-          {de.personnel.note}
+          {personnelText.note}
         </label>
         <textarea
           id="note"
@@ -141,14 +143,14 @@ export function PersonnelHead({
           disabled={pending}
           className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent disabled:text-text-dim"
         >
-          {pending ? de.common.loading : de.common.save}
+          {pending ? commonText.loading : commonText.save}
         </button>
         <button
           type="button"
           onClick={() => setEditing(false)}
           className="font-condensed text-2xs text-text-dim"
         >
-          {de.common.cancel}
+          {commonText.cancel}
         </button>
       </div>
     </form>
@@ -179,7 +181,7 @@ function Reclassify({
         onClick={() => setOpen(true)}
         className="font-condensed text-2xs text-text-dim"
       >
-        {de.personnel.reclassify}
+        {personnelText.reclassify}
       </button>
     )
   }
@@ -190,7 +192,7 @@ function Reclassify({
         <select
           value={to}
           onChange={(event) => setTo(Number(event.target.value))}
-          aria-label={de.clearance.classification}
+          aria-label={clearanceText.classification}
           className="border border-line bg-raised px-2 py-1 text-2xs"
         >
           {levels.map((level) => (
@@ -211,14 +213,14 @@ function Reclassify({
           }
           className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent disabled:text-text-dim"
         >
-          {de.common.save}
+          {commonText.save}
         </button>
         <button
           type="button"
           onClick={() => setOpen(false)}
           className="font-condensed text-2xs text-text-dim"
         >
-          {de.common.cancel}
+          {commonText.cancel}
         </button>
       </div>
 
@@ -229,8 +231,8 @@ function Reclassify({
           value={reason}
           onChange={(event) => setReason(event.target.value)}
           rows={2}
-          placeholder={de.case.reclassifyReason}
-          aria-label={de.case.reclassifyReason}
+          placeholder={caseText.reclassifyReason}
+          aria-label={caseText.reclassifyReason}
           className="mt-2 block w-full border border-line bg-raised px-3 py-2 text-2xs"
         />
       ) : null}

web/app/(app)/personalakten/neu/NewPersonnelForm.tsx

@@ -1,7 +1,8 @@
 'use client'
 
 import { useActionState } from 'react'
-import { de } from '@/lib/i18n/de'
+import { clearanceText, commonText } from '@/lib/i18n/common'
+import { personnelText } from '@/lib/i18n/people'
 import { createPersonnelAction, type ActionResult } from '../actions'
 
 /**
@@ -29,11 +30,11 @@ export function NewPersonnelForm({
 
   return (
     <form action={action} className="mt-6 space-y-5">
-      <Feld id="displayName" label={de.personnel.name} required minLength={2} />
+      <Feld id="displayName" label={personnelText.name} required minLength={2} />
 
       <div>
         <label htmlFor="userId" className="font-condensed text-xs text-text-dim">
-          {de.personnel.linkedAccount}
+          {personnelText.linkedAccount}
         </label>
         <select
           id="userId"
@@ -41,7 +42,7 @@ export function NewPersonnelForm({
           defaultValue=""
           className="mt-1.5 block w-full border border-line bg-raised px-3 py-2 text-sm"
         >
-          <option value="">{de.personnel.noAccount}</option>
+          <option value="">{personnelText.noAccount}</option>
           {members.map((member) => (
             <option key={member.id} value={member.id}>
               {member.displayName}
@@ -51,12 +52,12 @@ export function NewPersonnelForm({
       </div>
 
       <div className="grid gap-5 sm:grid-cols-2">
-        <Feld id="rank" label={de.personnel.rank} />
-        <Feld id="department" label={de.personnel.department} />
+        <Feld id="rank" label={personnelText.rank} />
+        <Feld id="department" label={personnelText.department} />
       </div>
 
       <fieldset>
-        <legend className="font-condensed text-xs text-text-dim">{de.personnel.status}</legend>
+        <legend className="font-condensed text-xs text-text-dim">{personnelText.status}</legend>
         {/* Kästchen statt Auswahlliste: mehrere Etiketten sind der Normalfall,
             und eine Mehrfachauswahl mit Strg-Klick findet niemand. */}
         <div className="mt-2 flex flex-wrap gap-x-6 gap-y-2">
@@ -67,12 +68,12 @@ export function NewPersonnelForm({
             </label>
           ))}
         </div>
-        <p className="mt-1 text-2xs text-text-dim">{de.personnel.statusHint}</p>
+        <p className="mt-1 text-2xs text-text-dim">{personnelText.statusHint}</p>
       </fieldset>
 
       <div>
         <label htmlFor="note" className="font-condensed text-xs text-text-dim">
-          {de.personnel.note}
+          {personnelText.note}
         </label>
         <textarea
           id="note"
@@ -80,12 +81,12 @@ export function NewPersonnelForm({
           rows={3}
           className="mt-1.5 block w-full border border-line bg-raised px-3 py-2 text-sm"
         />
-        <p className="mt-1 text-2xs text-text-dim">{de.personnel.noteHelp}</p>
+        <p className="mt-1 text-2xs text-text-dim">{personnelText.noteHelp}</p>
       </div>
 
       <div>
         <label htmlFor="classification" className="font-condensed text-xs text-text-dim">
-          {de.clearance.classification}
+          {clearanceText.classification}
         </label>
         {/* Die Auswahl zeigt nur, was erlaubt ist. Geprüft wird trotzdem serverseitig. */}
         <select
@@ -111,7 +112,7 @@ export function NewPersonnelForm({
         disabled={pending}
         className="border border-line bg-raised px-4 py-2 font-condensed text-sm text-accent disabled:text-text-dim"
       >
-        {pending ? de.common.loading : de.personnel.create}
+        {pending ? commonText.loading : personnelText.create}
       </button>
     </form>
   )

web/app/api/events/route.ts

@@ -0,0 +1,111 @@
+import { getCurrentUser } from '@/lib/auth/current'
+import { db } from '@/lib/db'
+import { visibleAttachmentWhere } from '@/lib/access/attachmentFilter'
+import { ensureListening, subscribe } from '@/lib/realtime/listener'
+import { ATTACHMENT_CHANNEL } from '@/lib/realtime/publish'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+/** Damit Zwischenspeicher und Tunnel die Verbindung nicht für tot halten. */
+const HEARTBEAT_MS = 25_000
+
+/**
+ * Ereignisstrom für offene Ansichten.
+ *
+ * Nur `attachment.scanned` bislang; der Aktenchat kommt in Phase 6 dazu und
+ * benutzt denselben Weg. Server-Sent Events und kein WebSocket: die Richtung
+ * ist einseitig, es geht durch jeden Tunnel, und der Browser baut die
+ * Verbindung von selbst wieder auf.
+ *
+ * **Die Sichtbarkeitsprüfung läuft je Ereignis.** Ein Ereignis über einen
+ * Anhang, dessen Akte der Empfänger nicht sehen darf, wird nicht zugestellt —
+ * sonst verriete schon die Kennung die Existenz.
+ */
+export async function GET(request: Request): Promise<Response> {
+  const user = await getCurrentUser()
+  if (!user) return new Response(null, { status: 404 })
+
+  await ensureListening()
+
+  const encoder = new TextEncoder()
+  let heartbeat: ReturnType<typeof setInterval> | null = null
+  let unsubscribe: (() => void) | null = null
+
+  const stream = new ReadableStream({
+    start(controller) {
+      const send = (event: string, data: unknown) => {
+        try {
+          controller.enqueue(
+            encoder.encode(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`),
+          )
+        } catch {
+          // Verbindung schon zu; das Aufräumen übernimmt cancel().
+        }
+      }
+
+      send('ready', { at: new Date().toISOString() })
+      heartbeat = setInterval(() => {
+        try {
+          controller.enqueue(encoder.encode(': ping\n\n'))
+        } catch {
+          // s. o.
+        }
+      }, HEARTBEAT_MS)
+
+      unsubscribe = subscribe((event) => {
+        if (event.channel !== ATTACHMENT_CHANNEL) return
+        void zustellen(event.payload, user.permissions, send)
+      })
+
+      request.signal.addEventListener('abort', () => {
+        controller.close()
+      })
+    },
+    cancel() {
+      if (heartbeat) clearInterval(heartbeat)
+      unsubscribe?.()
+    },
+  })
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'text/event-stream; charset=utf-8',
+      'Cache-Control': 'no-cache, no-transform',
+      Connection: 'keep-alive',
+      // Der Tunnel darf nicht puffern, sonst kommt alles am Stück.
+      'X-Accel-Buffering': 'no',
+    },
+  })
+}
+
+async function zustellen(
+  attachmentId: string,
+  permissions: Awaited<ReturnType<typeof getCurrentUser>> extends infer U
+    ? U extends { permissions: infer P }
+      ? P
+      : never
+    : never,
+  send: (event: string, data: unknown) => void,
+): Promise<void> {
+  try {
+    const anhang = await db.attachment.findFirst({
+      where: { AND: [visibleAttachmentWhere(permissions), { id: attachmentId }] },
+      select: {
+        id: true,
+        scanStatus: true,
+        scanMessage: true,
+        mimeType: true,
+        sizeBytes: true,
+        thumbKey: true,
+        blurhash: true,
+        width: true,
+        height: true,
+      },
+    })
+    if (!anhang) return
+    send('attachment.scanned', { ...anhang, hasThumb: anhang.thumbKey !== null, thumbKey: undefined })
+  } catch (error) {
+    console.error('[events] Ereignis nicht zugestellt', error)
+  }
+}

web/app/api/files/[id]/route.ts

@@ -0,0 +1,108 @@
+import { createReadStream } from 'node:fs'
+import { stat } from 'node:fs/promises'
+import { Readable } from 'node:stream'
+import { NextResponse } from 'next/server'
+import { db } from '@/lib/db'
+import { getCurrentUser } from '@/lib/auth/current'
+import { recordRead, READ_AUDIT_FROM_LEVEL } from '@/lib/audit'
+import { loadDeliverable } from '@/lib/files/service'
+import { absolutePath } from '@/lib/files/paths'
+import { deliveryFileName } from '@/lib/files/delivery'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+/**
+ * Auslieferung. **Niemals als statische Datei** — jeder Abruf läuft durch die
+ * Sichtbarkeitsprüfung der zugehörigen Akte und wird ab Stufe 3 protokolliert.
+ * Siehe docs/07-dateien-und-sicherheit.md.
+ *
+ * Die Kopfzeilen sind der zweite Schutzwall hinter der Neukodierung: selbst
+ * eine durchgerutschte Datei kann im Browser nichts ausführen. `sandbox` ohne
+ * Wert verbietet Skripte, Formulare und eigene Herkunft zugleich.
+ */
+export async function GET(
+  request: Request,
+  context: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  const user = await getCurrentUser()
+  // Nicht angemeldet ist hier 404 und nicht 401: die Existenz einer Datei ist
+  // selbst eine Information.
+  if (!user) return new NextResponse(null, { status: 404 })
+
+  const { id } = await context.params
+  const anhang = await loadDeliverable(user.permissions, id)
+  if (!anhang) return new NextResponse(null, { status: 404 })
+
+  const variante = new URL(request.url).searchParams.get('variant')
+  const vorschau = variante === 'thumb' && anhang.thumbKey !== null
+  const key = vorschau ? anhang.thumbKey! : anhang.storageKey
+
+  let groesse: number
+  try {
+    groesse = (await stat(absolutePath(key))).size
+  } catch {
+    return new NextResponse(null, { status: 404 })
+  }
+
+  await protokolliereAbruf(user.id, user.permissions.clearanceLevel, anhang)
+
+  // Die Endung folgt dem erkannten Typ, nicht dem hochgeladenen Namen.
+  const name = deliveryFileName(anhang.originalName, anhang.mimeType)
+
+  const headers = new Headers({
+    'Content-Type': vorschau ? 'image/webp' : anhang.mimeType,
+    'Content-Length': String(groesse),
+    'X-Content-Type-Options': 'nosniff',
+    'Cache-Control': 'private, max-age=31536000, immutable',
+    'Content-Security-Policy': "default-src 'none'; sandbox",
+    // Vorschaubilder dürfen inline, sie sind serverseitig neu kodiert worden
+    // und immer WebP. Alles andere wird heruntergeladen, nie angezeigt.
+    'Content-Disposition': vorschau
+      ? 'inline'
+      : `attachment; filename="${name}"; filename*=UTF-8''${encodeURIComponent(name)}`,
+  })
+
+  const stream = Readable.toWeb(createReadStream(absolutePath(key))) as ReadableStream
+  return new NextResponse(stream, { headers })
+}
+
+/**
+ * Ein Anhang erbt die Stufe seines Besitzers. Für die Protokollpflicht ab
+ * Stufe 3 muss sie deshalb nachgeschlagen werden.
+ */
+async function protokolliereAbruf(
+  userId: string,
+  clearanceLevel: number,
+  anhang: { id: string; caseId: string | null; entryId: string | null; documentId: string | null },
+): Promise<void> {
+  const stufe = anhang.caseId
+    ? (await db.case.findUnique({ where: { id: anhang.caseId }, select: { classification: true } }))
+        ?.classification
+    : anhang.entryId
+      ? (
+          await db.caseEntry.findUnique({
+            where: { id: anhang.entryId },
+            select: { case: { select: { classification: true } } },
+          })
+        )?.case.classification
+      : anhang.documentId
+        ? (
+            await db.document.findUnique({
+              where: { id: anhang.documentId },
+              select: { classification: true },
+            })
+          )?.classification
+        : 0
+
+  if ((stufe ?? 0) >= READ_AUDIT_FROM_LEVEL) {
+    recordRead({
+      actorId: userId,
+      action: 'attachment.read',
+      targetType: 'Attachment',
+      targetId: anhang.id,
+      clearanceAtTime: clearanceLevel,
+      meta: { classification: stufe },
+    })
+  }
+}

web/app/api/files/route.ts

@@ -0,0 +1,86 @@
+import { NextResponse } from 'next/server'
+import { getCurrentUser } from '@/lib/auth/current'
+import { AccessError } from '@/lib/errors'
+import { acceptUpload, type AttachmentOwner } from '@/lib/files/service'
+import { runCheckChain } from '@/lib/files/process'
+import { MAX_FILE_BYTES } from '@/lib/files/limits'
+import { de } from '@/lib/i18n/de'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+/**
+ * Upload.
+ *
+ * Ein Route Handler und keine Server Action: nur so bekommt der Browser einen
+ * Fortschrittsbalken, und 25 MB sind mehr, als eine Server Action annimmt.
+ *
+ * Die Antwort kommt, sobald die Datei in der Quarantäne liegt. Die Prüfkette
+ * läuft danach weiter und meldet sich über `/api/events` — niemand wartet mit
+ * laufendem Balken auf einen Virenscanner. Siehe docs/09.
+ */
+export async function POST(request: Request): Promise<Response> {
+  const user = await getCurrentUser()
+  if (!user) return NextResponse.json({ error: 'Nicht angemeldet' }, { status: 401 })
+
+  const laenge = Number(request.headers.get('content-length') ?? 0)
+  if (laenge > MAX_FILE_BYTES * 1.1) {
+    return NextResponse.json({ error: de.attachment.errors['file-too-large'] }, { status: 413 })
+  }
+
+  let form: FormData
+  try {
+    form = await request.formData()
+  } catch {
+    return NextResponse.json({ error: de.actionErrors.default }, { status: 400 })
+  }
+
+  const datei = form.get('file')
+  if (!(datei instanceof File)) {
+    return NextResponse.json({ error: de.actionErrors.default }, { status: 400 })
+  }
+
+  const owner = ownerAusForm(form)
+  if (!owner) return NextResponse.json({ error: de.actionErrors.default }, { status: 400 })
+
+  try {
+    const angelegt = await acceptUpload(user.permissions, {
+      owner,
+      fileName: datei.name || 'unbenannt',
+      declaredType: datei.type || null,
+      content: new Uint8Array(await datei.arrayBuffer()),
+    })
+
+    // Bewusst nicht abgewartet: die Antwort soll sofort raus, damit die
+    // Oberfläche den Anhang mit "Wird geprüft" zeigen kann.
+    void runCheckChain(angelegt.id).catch((error: unknown) => {
+      console.error('[dateien] Prüfkette abgebrochen', error)
+    })
+
+    return NextResponse.json({ id: angelegt.id }, { status: 201 })
+  } catch (error) {
+    if (error instanceof AccessError) {
+      const status = error.code === 'rate-limited' ? 429 : error.code === 'not-found' ? 404 : 400
+      return NextResponse.json(
+        { error: de.attachment.errors[error.code] ?? de.actionErrors[error.code] ?? de.actionErrors.default },
+        { status },
+      )
+    }
+    console.error('[dateien] Upload fehlgeschlagen', error)
+    return NextResponse.json({ error: de.actionErrors.default }, { status: 500 })
+  }
+}
+
+function ownerAusForm(form: FormData): AttachmentOwner | null {
+  const caseNumber = form.get('caseNumber')
+  if (typeof caseNumber === 'string' && caseNumber) return { kind: 'case', caseNumber }
+
+  const entryId = form.get('entryId')
+  if (typeof entryId === 'string' && entryId) return { kind: 'entry', entryId }
+
+  const documentNumber = form.get('documentNumber')
+  if (typeof documentNumber === 'string' && documentNumber) {
+    return { kind: 'document', documentNumber }
+  }
+  return null
+}

web/app/error.tsx

@@ -1,18 +1,18 @@
 'use client'
 
-import { de } from '@/lib/i18n/de'
+import { commonText, errorsText } from '@/lib/i18n/common'
 
 export default function Error({ reset }: { error: Error; reset: () => void }) {
   return (
     <main id="inhalt" className="mx-auto max-w-(--container-measure) px-6 py-12">
-      <h1 className="font-condensed">{de.errors.unexpected.title}</h1>
-      <p className="mt-2 text-text-dim">{de.errors.unexpected.body}</p>
+      <h1 className="font-condensed">{errorsText.unexpected.title}</h1>
+      <p className="mt-2 text-text-dim">{errorsText.unexpected.body}</p>
       <button
         type="button"
         onClick={reset}
         className="mt-4 border border-line bg-raised px-3 py-1.5 font-condensed text-xs"
       >
-        {de.common.retry}
+        {commonText.retry}
       </button>
     </main>
   )