From 0166024f48a0fa6a9b91e20b3bf1e8643751e4e8 Mon Sep 17 00:00:00 2001
From: david-loe <56305409+david-loe@users.noreply.github.com>
Date: Sat, 28 Sep 2024 10:12:55 +0200
Subject: [PATCH 1/8] adding supervisedProjects to user

---
 backend/controller/projectController.ts       |  3 ++-
 backend/data/settings.json                    |  2 +-
 backend/migrations.ts                         |  4 +++
 backend/models/user.ts                        | 26 ++++++++++++++-----
 common/forms/user.json                        |  2 +-
 common/locales/de.json                        |  2 ++
 common/locales/en.json                        |  2 ++
 common/types.ts                               |  5 +++-
 .../components/elements/ProjectSelector.vue   |  4 +--
 .../src/components/settings/SettingsPage.vue  |  4 +--
 .../components/settings/elements/UserList.vue |  8 +++---
 11 files changed, 44 insertions(+), 18 deletions(-)

diff --git a/backend/controller/projectController.ts b/backend/controller/projectController.ts
index fcb5b7f..d1545a0 100644
--- a/backend/controller/projectController.ts
+++ b/backend/controller/projectController.ts
@@ -22,7 +22,8 @@ export class ProjectController extends Controller {
       request.user?.access['examine/travel'] ||
       request.user?.access['examine/expenseReport'] ||
       request.user?.access['examine/healthCareCost'] ||
-      request.user?.access['confirm/healthCareCost']
+      request.user?.access['confirm/healthCareCost'] ||
+      request.user?.access['admin']
     ) {
       return await this.getter(Project, { query, projection: { identifier: 1, organisation: 1 } })
     } else {
diff --git a/backend/data/settings.json b/backend/data/settings.json
index a60f1f3..b556eed 100644
--- a/backend/data/settings.json
+++ b/backend/data/settings.json
@@ -94,5 +94,5 @@
   },
   "uploadTokenExpireAfterSeconds": 600,
   "userCanSeeAllProjects": true,
-  "version": "1.2.3"
+  "version": "1.2.4"
 }
diff --git a/backend/migrations.ts b/backend/migrations.ts
index ffb3134..460ba6f 100644
--- a/backend/migrations.ts
+++ b/backend/migrations.ts
@@ -55,6 +55,10 @@ export async function checkForMigrations() {
           throw Error("Couldn't find settings")
         }
       }
+      case '1.2.3': {
+        console.log('Apply migration from v1.2.3: Move projects from settings.projects to projects.assigned')
+        await mongoose.connection.collection('users').updateMany({}, { $rename: { 'settings.projects': 'projects.assigned' } })
+      }
       default:
         if (settings) {
           settings.migrateFrom = undefined
diff --git a/backend/models/user.ts b/backend/models/user.ts
index 3f33060..f267491 100644
--- a/backend/models/user.ts
+++ b/backend/models/user.ts
@@ -53,13 +53,20 @@ export const userSchema = new Schema<User, UserModel, Methods>({
     required: true
   },
   access: { type: accessObject, default: () => ({}) },
+  projects: {
+    type: {
+      assigned: { type: [{ type: Schema.Types.ObjectId, ref: 'Project' }], required: true, label: 'labels.assignedProjects' },
+      supervised: { type: [{ type: Schema.Types.ObjectId, ref: 'Project' }], required: true, label: 'labels.supervisedProjects' }
+    },
+    required: true
+  },
+
   loseAccessAt: { type: Date, info: 'info.loseAccessAt' },
   settings: {
     type: {
       language: { type: String, default: process.env.VITE_I18N_LOCALE, enum: locales },
       lastCurrencies: { type: [{ type: String, ref: 'Currency' }], required: true },
       lastCountries: { type: [{ type: String, ref: 'Country' }], required: true },
-      projects: { type: [{ type: Schema.Types.ObjectId, ref: 'Project' }], required: true },
       insurance: { type: Schema.Types.ObjectId, ref: 'HealthInsurance' },
       organisation: { type: Schema.Types.ObjectId, ref: 'Organisation' }
     },
@@ -76,7 +83,7 @@ function populate(doc: Document) {
     doc.populate({ path: 'settings.organisation', select: { name: 1 } }),
     doc.populate({ path: 'settings.lastCurrencies' }),
     doc.populate({ path: 'settings.lastCountries', select: { name: 1, flag: 1, currency: 1 } }),
-    doc.populate({ path: 'settings.projects' }),
+    doc.populate({ path: 'projects.assigned' }),
     doc.populate({ path: 'vehicleRegistration', select: { name: 1, type: 1 } }),
     doc.populate<{ token: Token }>({ path: 'token', populate: { path: 'files', select: { name: 1, type: 1 } } })
   ])
@@ -161,12 +168,19 @@ userSchema.methods.merge = async function (this: UserDoc, userToOverwrite: Parti
   }
   delete userToOverwrite.access
 
-  Object.assign(this.settings, userToOverwrite.settings, thisPojo.settings)
-  for (const p of userToOverwrite.settings!.projects) {
-    if (!this.settings.projects.some((tp) => tp._id.equals(p._id))) {
-      this.settings.projects.push(p)
+  for (const p of userToOverwrite.projects!.assigned) {
+    if (!this.projects.assigned.some((tp) => tp._id.equals(p._id))) {
+      this.projects.assigned.push(p)
     }
   }
+
+  for (const p of userToOverwrite.projects!.supervised) {
+    if (!this.projects.supervised.some((tp) => tp._id.equals(p._id))) {
+      this.projects.supervised.push(p)
+    }
+  }
+
+  Object.assign(this.settings, userToOverwrite.settings, thisPojo.settings)
   delete userToOverwrite.settings
 
   Object.assign(this, userToOverwrite, this.toObject())
diff --git a/common/forms/user.json b/common/forms/user.json
index 73a7ced..226955a 100755
--- a/common/forms/user.json
+++ b/common/forms/user.json
@@ -1 +1 @@
-{"fk":{"rules":["required"],"label":{"de":"Authentifizierung","en":"Authentication"},"type":"object","schema":{"microsoft":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"placeholder":{"de":"Microsoft ID","en":"Microsoft ID"},"type":"text"},"ldapauth":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"placeholder":{"de":"LDAP UID","en":"LDAP UID"},"type":"text"},"magiclogin":{"rules":["nullable","email"],"columns":{"lg":{"container":4},"sm":{"container":6}},"placeholder":{"de":"Magic Login Email","en":"Magic Login Email"},"type":"text"}}},"email":{"rules":["required","email"],"placeholder":{"de":"Email Adresse","en":"Email address"},"type":"text"},"name":{"rules":["required"],"label":{"de":"Name","en":"Name"},"type":"object","schema":{"givenName":{"rules":["required"],"columns":{"lg":{"container":6},"sm":{"container":6}},"placeholder":{"de":"Vorname","en":"Given name"},"type":"text"},"familyName":{"rules":["required"],"columns":{"lg":{"container":6},"sm":{"container":6}},"placeholder":{"de":"Nachname","en":"Family name"},"type":"text"}}},"access":{"rules":["nullable"],"label":{"de":"Zugriffsrechte","en":"Access"},"type":"object","schema":{"user":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Home","en":"Home"}},"inWork:expenseReport":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Auslagenabrechnung initiieren","en":"Initiate Expenses"}},"inWork:healthCareCost":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Krankenkostenabrechnung initiieren","en":"Initiate Health Care Costs"}},"appliedFor:travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Reisekostenabrechnung beantragen","en":"Apply For Travels"}},"approved:travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Reisekostenabrechnung ohne Genehmigung initiieren","en":"Initiate Travel Expenses Without Approval"}},"approve/travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Reisen genehmigen","en":"Approve Travels"}},"examine/travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Reisen prüfen","en":"Examine Travels"}},"examine/expenseReport":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Auslagen prüfen","en":"Examine Expenses"}},"examine/healthCareCost":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Krankenkosten prüfen","en":"Examine Health Care Costs"}},"confirm/healthCareCost":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Krankenkosten bestätigen","en":"Confirm Health Care Costs"}},"admin":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Administrator","en":"Administrator"}}}},"loseAccessAt":{"rules":["nullable"],"info":{"de":"Stelle hier ein Datum ein, ab dem der Nutzer keinen Zugriff mehr zu abrechnung🧾 haben soll.","en":"Set a date here from which the user should no longer have access to abrechnung🧾"},"type":"date","time":false,"placeholder":{"de":"Ablaufdatum","en":"Expiration date"}},"settings":{"rules":["required"],"label":{"de":"Einstellungen","en":"Settings"},"type":"object","schema":{"language":{"rules":["nullable"],"default":"de","placeholder":{"de":"Sprache","en":"Language"},"type":"select","items":{"de":{"de":"Deutsch 🇩🇪","en":"German 🇩🇪"},"en":{"de":"Englisch 🇬🇧","en":"English 🇬🇧"}}},"lastCurrencies":{"rules":["min:0"],"type":"currency","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Letzte Währungen","en":"Last currencies"}},"lastCountries":{"rules":["min:0"],"type":"country","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Letzte Länder","en":"Last countries"}},"projects":{"rules":["min:0"],"type":"project","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Projekte","en":"Projects"}},"insurance":{"rules":["nullable"],"type":"healthinsurance","placeholder":{"de":"Versicherung","en":"Health insurance"}},"organisation":{"rules":["nullable"],"type":"organisation","placeholder":{"de":"Organisation","en":"Organisation"}}}},"token":{"rules":["nullable"],"type":"token","placeholder":{"de":"labels.token","en":"labels.token"}}}
\ No newline at end of file
+{"fk":{"rules":["required"],"label":{"de":"Authentifizierung","en":"Authentication"},"type":"object","schema":{"microsoft":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"placeholder":{"de":"Microsoft ID","en":"Microsoft ID"},"type":"text"},"ldapauth":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"placeholder":{"de":"LDAP UID","en":"LDAP UID"},"type":"text"},"magiclogin":{"rules":["nullable","email"],"columns":{"lg":{"container":4},"sm":{"container":6}},"placeholder":{"de":"Magic Login Email","en":"Magic Login Email"},"type":"text"}}},"email":{"rules":["required","email"],"placeholder":{"de":"Email Adresse","en":"Email address"},"type":"text"},"name":{"rules":["required"],"label":{"de":"Name","en":"Name"},"type":"object","schema":{"givenName":{"rules":["required"],"columns":{"lg":{"container":6},"sm":{"container":6}},"placeholder":{"de":"Vorname","en":"Given name"},"type":"text"},"familyName":{"rules":["required"],"columns":{"lg":{"container":6},"sm":{"container":6}},"placeholder":{"de":"Nachname","en":"Family name"},"type":"text"}}},"access":{"rules":["nullable"],"label":{"de":"Zugriffsrechte","en":"Access"},"type":"object","schema":{"user":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Home","en":"Home"}},"inWork:expenseReport":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Auslagenabrechnung initiieren","en":"Initiate Expenses"}},"inWork:healthCareCost":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Krankenkostenabrechnung initiieren","en":"Initiate Health Care Costs"}},"appliedFor:travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Reisekostenabrechnung beantragen","en":"Apply For Travels"}},"approved:travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Reisekostenabrechnung ohne Genehmigung initiieren","en":"Initiate Travel Expenses Without Approval"}},"approve/travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Reisen genehmigen","en":"Approve Travels"}},"examine/travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Reisen prüfen","en":"Examine Travels"}},"examine/expenseReport":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Auslagen prüfen","en":"Examine Expenses"}},"examine/healthCareCost":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Krankenkosten prüfen","en":"Examine Health Care Costs"}},"confirm/healthCareCost":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Krankenkosten bestätigen","en":"Confirm Health Care Costs"}},"admin":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Administrator","en":"Administrator"}}}},"projects":{"rules":["required"],"label":{"de":"Projekte","en":"Projects"},"type":"object","schema":{"assigned":{"rules":["min:0"],"columns":{"lg":{"container":6},"sm":{"container":6}},"type":"project","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Zugewiesene Projekte","en":"Assigned Projects"}},"supervised":{"rules":["min:0"],"columns":{"lg":{"container":6},"sm":{"container":6}},"type":"project","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Betreute Projekte","en":"Supervised Projects"}}}},"loseAccessAt":{"rules":["nullable"],"info":{"de":"Stelle hier ein Datum ein, ab dem der Nutzer keinen Zugriff mehr zu abrechnung🧾 haben soll.","en":"Set a date here from which the user should no longer have access to abrechnung🧾"},"type":"date","time":false,"placeholder":{"de":"Ablaufdatum","en":"Expiration date"}},"settings":{"rules":["required"],"label":{"de":"Einstellungen","en":"Settings"},"type":"object","schema":{"language":{"rules":["nullable"],"default":"de","placeholder":{"de":"Sprache","en":"Language"},"type":"select","items":{"de":{"de":"Deutsch 🇩🇪","en":"German 🇩🇪"},"en":{"de":"Englisch 🇬🇧","en":"English 🇬🇧"}}},"lastCurrencies":{"rules":["min:0"],"type":"currency","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Letzte Währungen","en":"Last currencies"}},"lastCountries":{"rules":["min:0"],"type":"country","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Letzte Länder","en":"Last countries"}},"insurance":{"rules":["nullable"],"type":"healthinsurance","placeholder":{"de":"Versicherung","en":"Health insurance"}},"organisation":{"rules":["nullable"],"type":"organisation","placeholder":{"de":"Organisation","en":"Organisation"}}}},"token":{"rules":["nullable"],"type":"token","placeholder":{"de":"labels.token","en":"labels.token"}}}
\ No newline at end of file
diff --git a/common/locales/de.json b/common/locales/de.json
index baa7620..fe29eb1 100755
--- a/common/locales/de.json
+++ b/common/locales/de.json
@@ -100,6 +100,8 @@
     "vehicleRegistration": "Lade hier den Fahrzeugschein deines Autos hoch."
   },
   "labels": {
+    "assignedProjects": "Zugewiesene Projekte",
+    "supervisedProjects": "Betreute Projekte",
     "access": "Zugriffsrechte",
     "accessIcons": "Icons für Zugriffsrechte",
     "add": "Hinzufügen",
diff --git a/common/locales/en.json b/common/locales/en.json
index fa58335..0e55f56 100755
--- a/common/locales/en.json
+++ b/common/locales/en.json
@@ -100,6 +100,8 @@
     "vehicleRegistration": "Upload the vehicle registration of your car here."
   },
   "labels": {
+    "assignedProjects": "Assigned Projects",
+    "supervisedProjects": "Supervised Projects",
     "access": "Access",
     "accessIcons": "Icons for access rights",
     "add": "Add",
diff --git a/common/types.ts b/common/types.ts
index 33d2b3b..a71221c 100644
--- a/common/types.ts
+++ b/common/types.ts
@@ -166,12 +166,15 @@ export interface User extends UserSimple {
   access: {
     [key in Access]: boolean
   }
+  projects: {
+    assigned: Project[]
+    supervised: _id[]
+  }
   loseAccessAt?: null | Date | string
   settings: {
     language: Locale
     lastCurrencies: Currency[]
     lastCountries: CountrySimple[]
-    projects: Project[]
     insurance?: HealthInsurance | null
     organisation?: OrganisationSimple | null
   }
diff --git a/frontend/src/components/elements/ProjectSelector.vue b/frontend/src/components/elements/ProjectSelector.vue
index 769aa67..a483f44 100644
--- a/frontend/src/components/elements/ProjectSelector.vue
+++ b/frontend/src/components/elements/ProjectSelector.vue
@@ -65,7 +65,7 @@ export default defineComponent({
     },
     getProjects(orgaId?: string) {
       const projects: ProjectSimple[] = []
-      for (const project of this.$root.user.settings.projects) {
+      for (const project of this.$root.user.projects.assigned) {
         if (!orgaId || project.organisation === orgaId) {
           projects.push(project)
         }
@@ -73,7 +73,7 @@ export default defineComponent({
 
       for (const project of this.$root.projects) {
         let alreadyIn = false
-        for (const userProject of this.$root.user.settings.projects) {
+        for (const userProject of this.$root.user.projects.assigned) {
           if (project._id === userProject._id) {
             alreadyIn = true
             break
diff --git a/frontend/src/components/settings/SettingsPage.vue b/frontend/src/components/settings/SettingsPage.vue
index 56d51c8..7b05f7f 100644
--- a/frontend/src/components/settings/SettingsPage.vue
+++ b/frontend/src/components/settings/SettingsPage.vue
@@ -26,7 +26,7 @@
             class="mb-5"
             endpoint="admin/user/bulk"
             :transformers="[
-              { path: 'settings.projects', key: 'identifier', array: $root.projects },
+              { path: 'projects.assigned', key: 'identifier', array: $root.projects },
               { path: 'settings.organisation', key: 'name', array: $root.organisations },
               {path: 'loseAccessAt', fn: (val:string|undefined) => {
                 if(val){
@@ -44,7 +44,7 @@
               'email',
               'fk.magiclogin',
               'loseAccessAt',
-              'settings.projects',
+              'projects.assigned',
               'settings.organisation'
             ]"
             @imported=";($refs.userList as any).getUsers()" />
diff --git a/frontend/src/components/settings/elements/UserList.vue b/frontend/src/components/settings/elements/UserList.vue
index c8bed78..aa55b42 100644
--- a/frontend/src/components/settings/elements/UserList.vue
+++ b/frontend/src/components/settings/elements/UserList.vue
@@ -22,7 +22,7 @@
       :headers="[
         { text: $t('labels.name'), value: 'name' },
         { text: 'E-Mail', value: 'email' },
-        { text: $t('labels.projects'), value: 'settings.projects', sortable: true },
+        { text: $t('labels.projects'), value: 'projects.assigned', sortable: true },
         { text: $t('labels.access'), value: 'access' },
         { value: 'buttons' }
       ]">
@@ -53,8 +53,8 @@
       <template #item-name="{ name }">
         {{ name.givenName + ' ' + name.familyName }}
       </template>
-      <template #item-settings.projects="{ settings }">
-        <span class="me-1" v-for="p in settings.projects">{{ p.identifier }}</span>
+      <template #item-projects.assigned="{ projects }">
+        <span class="me-1" v-for="p in projects.assigned">{{ p.identifier }}</span>
       </template>
       <template #item-access="user">
         <template v-for="access of accesses">
@@ -143,7 +143,7 @@ export default defineComponent({
         formUser = Object.assign({}, formUser, { settings: formUserSettings })
         formUser.settings.lastCurrencies = user!.settings.lastCurrencies.map((c) => c._id)
         formUser.settings.lastCountries = user!.settings.lastCountries.map((c) => c._id)
-        formUser.settings.projects = user!.settings.projects.map((p) => p._id)
+        formUser.projects.assigned = user!.projects.assigned.map((p) => p._id)
         formUser.settings.organisation = user!.settings.organisation?._id
         formUser.settings.insurance = user!.settings.insurance?._id
       }

From c06c940f0d9dfc7a87c687c4dd43bc38a4b2ed2f Mon Sep 17 00:00:00 2001
From: david-loe <56305409+david-loe@users.noreply.github.com>
Date: Sat, 28 Sep 2024 14:02:09 +0200
Subject: [PATCH 2/8] adding to forms

---
 backend/controller/projectController.ts       |  19 ++-
 backend/models/project.ts                     |   7 +-
 backend/models/user.ts                        |  40 +++++-
 backend/models/vueformGenerator.ts            |   4 +
 backend/server.ts                             |   4 +-
 common/forms/project.json                     |   2 +-
 common/forms/user.json                        |   2 +-
 common/locales/de.json                        |   2 +
 common/locales/en.json                        |   2 +
 common/types.ts                               |   7 ++
 .../elements/vueform/UserElement.vue          | 117 ++++++++++++++++++
 frontend/src/vueform.config.ts                |  11 +-
 12 files changed, 207 insertions(+), 10 deletions(-)
 create mode 100644 frontend/src/components/elements/vueform/UserElement.vue

diff --git a/backend/controller/projectController.ts b/backend/controller/projectController.ts
index d1545a0..27a0b8d 100644
--- a/backend/controller/projectController.ts
+++ b/backend/controller/projectController.ts
@@ -1,11 +1,12 @@
 import { Request as ExRequest } from 'express'
 import { Body, Delete, Get, Post, Queries, Query, Request, Route, Security, Tags } from 'tsoa'
-import { Project as IProject, ProjectSimple, _id } from '../../common/types.js'
+import { Project as IProject, ProjectSimple, ProjectWithUsers, _id } from '../../common/types.js'
 import { getSettings } from '../helper.js'
 import ExpenseReport from '../models/expenseReport.js'
 import HealthCareCost from '../models/healthCareCost.js'
 import Project from '../models/project.js'
 import Travel from '../models/travel.js'
+import User from '../models/user.js'
 import { Controller, GetterQuery, SetterBody } from './controller.js'
 import { AuthorizationError } from './error.js'
 
@@ -41,8 +42,20 @@ export class ProjectAdminController extends Controller {
     return await this.getter(Project, { query })
   }
   @Post()
-  public async postProject(@Body() requestBody: SetterBody<IProject>) {
-    return await this.setter(Project, { requestBody: requestBody, allowNew: true })
+  public async postProject(@Body() requestBody: SetterBody<ProjectWithUsers>) {
+    async function cb(project: IProject) {
+      if (requestBody.assignees) {
+        for (const userId of requestBody.assignees) {
+          await (await User.findOne({ _id: userId }))?.addProjects({ assigned: [project._id] })
+        }
+      }
+      if (requestBody.supervisors) {
+        for (const userId of requestBody.supervisors) {
+          await (await User.findOne({ _id: userId }))?.addProjects({ supervised: [project._id] })
+        }
+      }
+    }
+    return await this.setter(Project, { requestBody: requestBody, allowNew: true, cb })
   }
   @Post('bulk')
   public async postManyProjects(@Body() requestBody: SetterBody<IProject>[]) {
diff --git a/backend/models/project.ts b/backend/models/project.ts
index c7c56f9..e049397 100644
--- a/backend/models/project.ts
+++ b/backend/models/project.ts
@@ -1,6 +1,6 @@
 import mongoose, { HydratedDocument, InferSchemaType, Model, Schema, model } from 'mongoose'
 import { addUp } from '../../common/scripts.js'
-import { ExpenseReport, HealthCareCost, Project, Travel, _id } from '../../common/types.js'
+import { ExpenseReport, HealthCareCost, Project, ProjectUsers, Travel, _id } from '../../common/types.js'
 import { costObject } from './helper.js'
 
 interface Methods {
@@ -53,3 +53,8 @@ export type IProject = ProjectSchema & { _id: _id }
 export default model<Project, ProjectModel>('Project', projectSchema)
 
 export interface ProjectDoc extends Methods, HydratedDocument<Project> {}
+
+export const projectUsersSchema = new Schema<ProjectUsers>({
+  assignees: { type: [{ type: Schema.Types.ObjectId, ref: 'User' }], required: true, label: 'labels.addAssignees' },
+  supervisors: { type: [{ type: Schema.Types.ObjectId, ref: 'User' }], required: true, label: 'labels.addSupervisors' }
+})
diff --git a/backend/models/user.ts b/backend/models/user.ts
index f267491..9739a09 100644
--- a/backend/models/user.ts
+++ b/backend/models/user.ts
@@ -4,6 +4,7 @@ import {
   Token,
   User,
   UserReplaceReferencesResult,
+  _id,
   accesses,
   emailRegex,
   locales,
@@ -26,6 +27,7 @@ interface Methods {
   isActive(): Promise<boolean>
   replaceReferences(userIdToOverwrite: Types.ObjectId): Promise<UserReplaceReferencesResult>
   merge(userToOverwrite: Partial<User>, mergeFk: boolean): Promise<User>
+  addProjects(projects: { assigned?: _id[]; supervised?: _id[] }): Promise<void>
 }
 
 type UserModel = Model<User, {}, Methods>
@@ -56,7 +58,20 @@ export const userSchema = new Schema<User, UserModel, Methods>({
   projects: {
     type: {
       assigned: { type: [{ type: Schema.Types.ObjectId, ref: 'Project' }], required: true, label: 'labels.assignedProjects' },
-      supervised: { type: [{ type: Schema.Types.ObjectId, ref: 'Project' }], required: true, label: 'labels.supervisedProjects' }
+      supervised: {
+        type: [{ type: Schema.Types.ObjectId, ref: 'Project' }],
+        required: true,
+        label: 'labels.supervisedProjects',
+        conditions: [
+          [
+            ['access.approve/travel', true],
+            ['access.examine/travel', true],
+            ['access.examine/expenseReport', true],
+            ['access.examine/healthCareCost', true],
+            ['access.confirm/healthCareCost', true]
+          ]
+        ]
+      }
     },
     required: true
   },
@@ -188,6 +203,29 @@ userSchema.methods.merge = async function (this: UserDoc, userToOverwrite: Parti
   return this.toObject()
 }
 
+userSchema.methods.addProjects = async function addProjects(projects: { assigned?: _id[]; supervised?: _id[] }) {
+  let changed = false
+  if (projects.assigned) {
+    for (const newProjectId of projects.assigned) {
+      if (!this.projects.assigned.some((p) => p._id.equals(newProjectId))) {
+        changed = true
+        this.projects.assigned.push(newProjectId as any)
+      }
+    }
+  }
+  if (projects.supervised) {
+    for (const newProjectId of projects.supervised) {
+      if (!this.projects.supervised.some((p) => p._id.equals(newProjectId))) {
+        changed = true
+        this.projects.supervised.push(newProjectId)
+      }
+    }
+  }
+  if (changed) {
+    this.save()
+  }
+}
+
 export default model<User, UserModel>('User', userSchema)
 
 export interface UserDoc extends Methods, HydratedDocument<User> {}
diff --git a/backend/models/vueformGenerator.ts b/backend/models/vueformGenerator.ts
index b613722..91f624f 100644
--- a/backend/models/vueformGenerator.ts
+++ b/backend/models/vueformGenerator.ts
@@ -56,6 +56,10 @@ function mapSchemaTypeToVueformElement(
     vueformElement['description'] = translate(schemaType.description, language)
   }
 
+  if (schemaType.conditions) {
+    vueformElement['conditions'] = schemaType.conditions
+  }
+
   if (schemaType.label) {
     vueformElement['label'] = translate(schemaType.label, language)
   } else if (labelStr) {
diff --git a/backend/server.ts b/backend/server.ts
index 488276f..1a8fff4 100644
--- a/backend/server.ts
+++ b/backend/server.ts
@@ -6,7 +6,7 @@ import { countrySchema } from './models/country.js'
 import { currencySchema } from './models/currency.js'
 import { healthInsuranceSchema } from './models/healthInsurance.js'
 import { organisationSchema } from './models/organisation.js'
-import { projectSchema } from './models/project.js'
+import { projectSchema, projectUsersSchema } from './models/project.js'
 import { settingsSchema } from './models/settings.js'
 import { UserDoc, userSchema } from './models/user.js'
 import { generateForms } from './models/vueformGenerator.js'
@@ -68,7 +68,7 @@ if (process.env.NODE_ENV === 'development') {
       user: userSchema.obj,
       country: countrySchema.obj,
       currency: currencySchema.obj,
-      project: projectSchema.obj,
+      project: Object.assign(projectSchema.obj, projectUsersSchema.obj),
       healthInsurance: healthInsuranceSchema.obj,
       organisation: organisationSchema.obj,
       settings: settingsSchema.obj
diff --git a/common/forms/project.json b/common/forms/project.json
index 1f337d2..489f723 100755
--- a/common/forms/project.json
+++ b/common/forms/project.json
@@ -1 +1 @@
-{"identifier":{"rules":["required"],"placeholder":{"de":"Kennung","en":"Identifier"},"type":"text"},"organisation":{"rules":["required"],"type":"organisation","placeholder":{"de":"Organisation","en":"Organisation"}},"name":{"rules":["nullable"],"placeholder":{"de":"Name","en":"Name"},"type":"text"},"budget":{"rules":["nullable"],"label":{"de":"Budget","en":"Budget"},"type":"object","schema":{"amount":{"rules":["nullable","min:0","numeric"],"type":"text","inputType":"number","attrs":{"step":"any"},"forceNumbers":true,"placeholder":{"de":"Betrag","en":"Amount"}}}},"balance":{"rules":["required"],"label":{"de":"Saldo","en":"Balance"},"type":"object","schema":{"amount":{"rules":["required","min:0","numeric"],"default":0,"type":"text","inputType":"number","attrs":{"step":"any"},"forceNumbers":true,"placeholder":{"de":"Betrag","en":"Amount"}}}}}
\ No newline at end of file
+{"identifier":{"rules":["required"],"placeholder":{"de":"Kennung","en":"Identifier"},"type":"text"},"organisation":{"rules":["required"],"type":"organisation","placeholder":{"de":"Organisation","en":"Organisation"}},"name":{"rules":["nullable"],"placeholder":{"de":"Name","en":"Name"},"type":"text"},"budget":{"rules":["nullable"],"label":{"de":"Budget","en":"Budget"},"type":"object","schema":{"amount":{"rules":["nullable","min:0","numeric"],"type":"text","inputType":"number","attrs":{"step":"any"},"forceNumbers":true,"placeholder":{"de":"Betrag","en":"Amount"}}}},"balance":{"rules":["required"],"label":{"de":"Saldo","en":"Balance"},"type":"object","schema":{"amount":{"rules":["required","min:0","numeric"],"default":0,"type":"text","inputType":"number","attrs":{"step":"any"},"forceNumbers":true,"placeholder":{"de":"Betrag","en":"Amount"}}}},"assignees":{"rules":["min:0"],"type":"user","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Zugewiesene hinzufügen","en":"Add Assignees"}},"supervisors":{"rules":["min:0"],"type":"user","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Betreuende hinzufügen","en":"Add Supervisors"}}}
\ No newline at end of file
diff --git a/common/forms/user.json b/common/forms/user.json
index 226955a..76743f1 100755
--- a/common/forms/user.json
+++ b/common/forms/user.json
@@ -1 +1 @@
-{"fk":{"rules":["required"],"label":{"de":"Authentifizierung","en":"Authentication"},"type":"object","schema":{"microsoft":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"placeholder":{"de":"Microsoft ID","en":"Microsoft ID"},"type":"text"},"ldapauth":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"placeholder":{"de":"LDAP UID","en":"LDAP UID"},"type":"text"},"magiclogin":{"rules":["nullable","email"],"columns":{"lg":{"container":4},"sm":{"container":6}},"placeholder":{"de":"Magic Login Email","en":"Magic Login Email"},"type":"text"}}},"email":{"rules":["required","email"],"placeholder":{"de":"Email Adresse","en":"Email address"},"type":"text"},"name":{"rules":["required"],"label":{"de":"Name","en":"Name"},"type":"object","schema":{"givenName":{"rules":["required"],"columns":{"lg":{"container":6},"sm":{"container":6}},"placeholder":{"de":"Vorname","en":"Given name"},"type":"text"},"familyName":{"rules":["required"],"columns":{"lg":{"container":6},"sm":{"container":6}},"placeholder":{"de":"Nachname","en":"Family name"},"type":"text"}}},"access":{"rules":["nullable"],"label":{"de":"Zugriffsrechte","en":"Access"},"type":"object","schema":{"user":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Home","en":"Home"}},"inWork:expenseReport":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Auslagenabrechnung initiieren","en":"Initiate Expenses"}},"inWork:healthCareCost":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Krankenkostenabrechnung initiieren","en":"Initiate Health Care Costs"}},"appliedFor:travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Reisekostenabrechnung beantragen","en":"Apply For Travels"}},"approved:travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Reisekostenabrechnung ohne Genehmigung initiieren","en":"Initiate Travel Expenses Without Approval"}},"approve/travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Reisen genehmigen","en":"Approve Travels"}},"examine/travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Reisen prüfen","en":"Examine Travels"}},"examine/expenseReport":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Auslagen prüfen","en":"Examine Expenses"}},"examine/healthCareCost":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Krankenkosten prüfen","en":"Examine Health Care Costs"}},"confirm/healthCareCost":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Krankenkosten bestätigen","en":"Confirm Health Care Costs"}},"admin":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Administrator","en":"Administrator"}}}},"projects":{"rules":["required"],"label":{"de":"Projekte","en":"Projects"},"type":"object","schema":{"assigned":{"rules":["min:0"],"columns":{"lg":{"container":6},"sm":{"container":6}},"type":"project","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Zugewiesene Projekte","en":"Assigned Projects"}},"supervised":{"rules":["min:0"],"columns":{"lg":{"container":6},"sm":{"container":6}},"type":"project","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Betreute Projekte","en":"Supervised Projects"}}}},"loseAccessAt":{"rules":["nullable"],"info":{"de":"Stelle hier ein Datum ein, ab dem der Nutzer keinen Zugriff mehr zu abrechnung🧾 haben soll.","en":"Set a date here from which the user should no longer have access to abrechnung🧾"},"type":"date","time":false,"placeholder":{"de":"Ablaufdatum","en":"Expiration date"}},"settings":{"rules":["required"],"label":{"de":"Einstellungen","en":"Settings"},"type":"object","schema":{"language":{"rules":["nullable"],"default":"de","placeholder":{"de":"Sprache","en":"Language"},"type":"select","items":{"de":{"de":"Deutsch 🇩🇪","en":"German 🇩🇪"},"en":{"de":"Englisch 🇬🇧","en":"English 🇬🇧"}}},"lastCurrencies":{"rules":["min:0"],"type":"currency","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Letzte Währungen","en":"Last currencies"}},"lastCountries":{"rules":["min:0"],"type":"country","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Letzte Länder","en":"Last countries"}},"insurance":{"rules":["nullable"],"type":"healthinsurance","placeholder":{"de":"Versicherung","en":"Health insurance"}},"organisation":{"rules":["nullable"],"type":"organisation","placeholder":{"de":"Organisation","en":"Organisation"}}}},"token":{"rules":["nullable"],"type":"token","placeholder":{"de":"labels.token","en":"labels.token"}}}
\ No newline at end of file
+{"fk":{"rules":["required"],"label":{"de":"Authentifizierung","en":"Authentication"},"type":"object","schema":{"microsoft":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"placeholder":{"de":"Microsoft ID","en":"Microsoft ID"},"type":"text"},"ldapauth":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"placeholder":{"de":"LDAP UID","en":"LDAP UID"},"type":"text"},"magiclogin":{"rules":["nullable","email"],"columns":{"lg":{"container":4},"sm":{"container":6}},"placeholder":{"de":"Magic Login Email","en":"Magic Login Email"},"type":"text"}}},"email":{"rules":["required","email"],"placeholder":{"de":"Email Adresse","en":"Email address"},"type":"text"},"name":{"rules":["required"],"label":{"de":"Name","en":"Name"},"type":"object","schema":{"givenName":{"rules":["required"],"columns":{"lg":{"container":6},"sm":{"container":6}},"placeholder":{"de":"Vorname","en":"Given name"},"type":"text"},"familyName":{"rules":["required"],"columns":{"lg":{"container":6},"sm":{"container":6}},"placeholder":{"de":"Nachname","en":"Family name"},"type":"text"}}},"access":{"rules":["nullable"],"label":{"de":"Zugriffsrechte","en":"Access"},"type":"object","schema":{"user":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Home","en":"Home"}},"inWork:expenseReport":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Auslagenabrechnung initiieren","en":"Initiate Expenses"}},"inWork:healthCareCost":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Krankenkostenabrechnung initiieren","en":"Initiate Health Care Costs"}},"appliedFor:travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":true,"type":"checkbox","text":{"de":"Reisekostenabrechnung beantragen","en":"Apply For Travels"}},"approved:travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Reisekostenabrechnung ohne Genehmigung initiieren","en":"Initiate Travel Expenses Without Approval"}},"approve/travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Reisen genehmigen","en":"Approve Travels"}},"examine/travel":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Reisen prüfen","en":"Examine Travels"}},"examine/expenseReport":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Auslagen prüfen","en":"Examine Expenses"}},"examine/healthCareCost":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Krankenkosten prüfen","en":"Examine Health Care Costs"}},"confirm/healthCareCost":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Krankenkosten bestätigen","en":"Confirm Health Care Costs"}},"admin":{"rules":["nullable"],"columns":{"lg":{"container":4},"sm":{"container":6}},"default":false,"type":"checkbox","text":{"de":"Administrator","en":"Administrator"}}}},"projects":{"rules":["required"],"label":{"de":"Projekte","en":"Projects"},"type":"object","schema":{"assigned":{"rules":["min:0"],"columns":{"lg":{"container":6},"sm":{"container":6}},"type":"project","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Zugewiesene Projekte","en":"Assigned Projects"}},"supervised":{"rules":["min:0"],"columns":{"lg":{"container":6},"sm":{"container":6}},"conditions":[[["access.approve/travel",true],["access.examine/travel",true],["access.examine/expenseReport",true],["access.examine/healthCareCost",true],["access.confirm/healthCareCost",true]]],"type":"project","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Betreute Projekte","en":"Supervised Projects"}}}},"loseAccessAt":{"rules":["nullable"],"info":{"de":"Stelle hier ein Datum ein, ab dem der Nutzer keinen Zugriff mehr zu abrechnung🧾 haben soll.","en":"Set a date here from which the user should no longer have access to abrechnung🧾"},"type":"date","time":false,"placeholder":{"de":"Ablaufdatum","en":"Expiration date"}},"settings":{"rules":["required"],"label":{"de":"Einstellungen","en":"Settings"},"type":"object","schema":{"language":{"rules":["nullable"],"default":"de","placeholder":{"de":"Sprache","en":"Language"},"type":"select","items":{"de":{"de":"Deutsch 🇩🇪","en":"German 🇩🇪"},"en":{"de":"Englisch 🇬🇧","en":"English 🇬🇧"}}},"lastCurrencies":{"rules":["min:0"],"type":"currency","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Letzte Währungen","en":"Last currencies"}},"lastCountries":{"rules":["min:0"],"type":"country","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Letzte Länder","en":"Last countries"}},"insurance":{"rules":["nullable"],"type":"healthinsurance","placeholder":{"de":"Versicherung","en":"Health insurance"}},"organisation":{"rules":["nullable"],"type":"organisation","placeholder":{"de":"Organisation","en":"Organisation"}}}},"token":{"rules":["nullable"],"type":"token","placeholder":{"de":"labels.token","en":"labels.token"}}}
\ No newline at end of file
diff --git a/common/locales/de.json b/common/locales/de.json
index fe29eb1..afe04e4 100755
--- a/common/locales/de.json
+++ b/common/locales/de.json
@@ -100,6 +100,8 @@
     "vehicleRegistration": "Lade hier den Fahrzeugschein deines Autos hoch."
   },
   "labels": {
+    "addAssignees": "Zugewiesene hinzufügen",
+    "addSupervisors": "Betreuende hinzufügen",
     "assignedProjects": "Zugewiesene Projekte",
     "supervisedProjects": "Betreute Projekte",
     "access": "Zugriffsrechte",
diff --git a/common/locales/en.json b/common/locales/en.json
index 0e55f56..4a09bb2 100755
--- a/common/locales/en.json
+++ b/common/locales/en.json
@@ -100,6 +100,8 @@
     "vehicleRegistration": "Upload the vehicle registration of your car here."
   },
   "labels": {
+    "addAssignees": "Add Assignees",
+    "addSupervisors": "Add Supervisors",
     "assignedProjects": "Assigned Projects",
     "supervisedProjects": "Supervised Projects",
     "access": "Access",
diff --git a/common/types.ts b/common/types.ts
index a71221c..d8cde3f 100644
--- a/common/types.ts
+++ b/common/types.ts
@@ -149,6 +149,13 @@ export interface Project extends ProjectSimple {
   budget?: BaseCurrencyMoney
 }
 
+export interface ProjectUsers {
+  assignees: _id[]
+  supervisors: _id[]
+}
+
+export interface ProjectWithUsers extends Project, ProjectUsers {}
+
 export interface Organisation extends OrganisationSimple {
   subfolderPath: string
   bankDetails?: string | null
diff --git a/frontend/src/components/elements/vueform/UserElement.vue b/frontend/src/components/elements/vueform/UserElement.vue
new file mode 100644
index 0000000..0e6090d
--- /dev/null
+++ b/frontend/src/components/elements/vueform/UserElement.vue
@@ -0,0 +1,117 @@
+<template>
+  <component :is="elementLayout" ref="container">
+    <template #element>
+      <ElementLabelFloating v-if="hasFloating && !empty" :visible="!empty" />
+
+      <!-- @vueform/multiselect copmonent -->
+      <Multiselect
+        v-bind="fieldOptions"
+        v-if="$root.users.length > 0"
+        :options="$root.users"
+        valueProp="_id"
+        searchable
+        :searchFilter="customFilterFunction"
+        v-model="value"
+        :classes="classes.select"
+        :id="fieldId"
+        :name="name"
+        :disabled="isDisabled"
+        :placeholder="Placeholder"
+        :attrs="attrs"
+        :aria="aria"
+        :locale="form$.locale$"
+        @select="handleSelect"
+        @deselect="handleDeselect"
+        @search-change="handleSearchChange"
+        @tag="handleTag"
+        @open="handleOpen"
+        @close="handleClose"
+        @clear="handleClear"
+        @paste="handlePaste"
+        ref="input">
+        <template
+          v-for="(slotName, slotKey) in {
+            noresults: 'no-results',
+            nooptions: 'no-options',
+            afterlist: 'after-list',
+            beforelist: 'before-list',
+            placeholder: 'placeholder',
+            grouplabel: 'group-label',
+            caret: 'caret',
+            clear: 'clear',
+            spinner: 'spinner',
+            default: 'default'
+          }"
+          #[slotKey]="props">
+          <slot :name="slotName" v-bind="props" :el$="el$">
+            <component :is="fieldSlots[slotName]" v-bind="props" :el$="el$" />
+          </slot>
+        </template>
+
+        <template v-slot:singlelabel="{ value }">
+          <div class="position-absolute start-0 ms-3">
+            <span>{{ value.name.givenName + ' ' + value.name.familyName }}</span>
+          </div>
+        </template>
+
+        <template v-slot:multiplelabel="{ values }">
+          <div class="position-absolute start-0 ms-3">
+            <span v-for="value of values" class="me-3">
+              <span>{{ value.name.givenName + ' ' + value.name.familyName }}</span>
+            </span>
+          </div>
+        </template>
+
+        <template v-slot:option="{ option }">
+          <div>
+            {{ option.name.givenName + ' ' + option.name.familyName }}
+          </div>
+        </template>
+      </Multiselect>
+    </template>
+
+    <!-- Default element slots -->
+    <template v-for="(component, slot) in elementSlots" #[slot]
+      ><slot :name="slot" :el$="el$"><component :is="component" :el$="el$" /></slot
+    ></template>
+  </component>
+</template>
+
+<script>
+import Multiselect from '@vueform/multiselect/src/Multiselect.vue'
+import { defineElement, SelectElement } from '@vueform/vueform'
+import { SelectElement as SelectElementTemplate } from '@vueform/vueform/dist/vueform'
+import { ref } from 'vue'
+
+export default defineElement({
+  ...SelectElement, // adding props, mixins, emits
+  name: 'UserElement',
+  components: { Multiselect },
+  props: Object.assign(SelectElement.props, {
+    native: { type: Boolean, default: false }
+  }),
+  methods: {
+    customFilterFunction(option, search) {
+      const givenName = option.name.givenName.toLowerCase().indexOf(search.toLowerCase()) > -1
+      if (givenName) {
+        return givenName
+      }
+      const familyName = option.name.familyName.toLowerCase().indexOf(search.toLowerCase()) > -1
+      if (familyName) {
+        return familyName
+      }
+      return (option.name.givenName + ' ' + option.name.familyName).toLowerCase().indexOf(search.toLowerCase()) > -1
+    }
+  },
+  setup(props, context) {
+    const element = SelectElement.setup(props, context)
+    const defaultClasses = ref({
+      ...SelectElementTemplate.data().defaultClasses
+    })
+    return {
+      ...element,
+      defaultClasses
+    }
+  }
+})
+</script>
diff --git a/frontend/src/vueform.config.ts b/frontend/src/vueform.config.ts
index de1641a..5792542 100644
--- a/frontend/src/vueform.config.ts
+++ b/frontend/src/vueform.config.ts
@@ -9,6 +9,7 @@ import DocumentfileElement from './components/elements/vueform/DocumentfileEleme
 import HealthinsuranceElement from './components/elements/vueform/HealthinsuranceElement.vue'
 import OrganisationElement from './components/elements/vueform/OrganisationElement.vue'
 import ProjectElement from './components/elements/vueform/ProjectElement.vue'
+import UserElement from './components/elements/vueform/UserElement.vue'
 
 en.vueform.elements.list.add = '+ Add'
 de.vueform.elements.list.add = '+ Hinzufügen'
@@ -25,7 +26,15 @@ function deepReplace(obj: any, search: any, replacement: any) {
 
 export default defineConfig({
   theme: vueform,
-  elements: [CountryElement, DocumentfileElement, OrganisationElement, CurrencyElement, ProjectElement, HealthinsuranceElement],
+  elements: [
+    CountryElement,
+    DocumentfileElement,
+    OrganisationElement,
+    CurrencyElement,
+    ProjectElement,
+    HealthinsuranceElement,
+    UserElement
+  ],
   locales: { de, en },
   locale: 'de',
   env: import.meta.env.MODE,

From 24b45909fe864934006524e9d080c48aa9299d31 Mon Sep 17 00:00:00 2001
From: david-loe <56305409+david-loe@users.noreply.github.com>
Date: Sat, 28 Sep 2024 14:34:48 +0200
Subject: [PATCH 3/8] notify only supervisors

---
 backend/mail/mail.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/backend/mail/mail.ts b/backend/mail/mail.ts
index b38b925..2869fd5 100644
--- a/backend/mail/mail.ts
+++ b/backend/mail/mail.ts
@@ -84,12 +84,18 @@ export async function sendNotificationMail(report: TravelSimple | ExpenseReportS
     text: '',
     link: ''
   }
+
+  const supervisedProjectsFilter = {
+    $or: [{ 'projects.supervised': [] }, { 'projects.supervised': report.project._id }]
+  }
   const userFilter: any = {}
   if (report.state === 'appliedFor') {
     userFilter[`access.approve/${reportType}`] = true
+    Object.assign(userFilter, supervisedProjectsFilter)
     button.link = `${process.env.VITE_FRONTEND_URL}/approve/${reportType}/${report._id}`
   } else if (report.state === 'underExamination') {
     userFilter[`access.examine/${reportType}`] = true
+    Object.assign(userFilter, supervisedProjectsFilter)
     button.link = `${process.env.VITE_FRONTEND_URL}/examine/${reportType}/${report._id}`
   } else {
     // 'rejected', 'approved', 'refunded', 'underExaminationByInsurance'

From b9cf717e573866257a312afff9d56e24541c435c Mon Sep 17 00:00:00 2001
From: david-loe <56305409+david-loe@users.noreply.github.com>
Date: Sat, 28 Sep 2024 14:35:03 +0200
Subject: [PATCH 4/8] fix empty strings in forms

---
 frontend/src/vueform.config.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/frontend/src/vueform.config.ts b/frontend/src/vueform.config.ts
index 5792542..ad5fd36 100644
--- a/frontend/src/vueform.config.ts
+++ b/frontend/src/vueform.config.ts
@@ -43,5 +43,6 @@ export default defineConfig({
   endpoints: {},
   beforeSend(form$: any) {
     deepReplace(form$.data, null, undefined)
+    deepReplace(form$.data, '', undefined)
   }
 })

From b6094953a8723babcf131dff9aa368c227c27665 Mon Sep 17 00:00:00 2001
From: david-loe <56305409+david-loe@users.noreply.github.com>
Date: Sat, 28 Sep 2024 16:13:58 +0200
Subject: [PATCH 5/8] only get supervised projects

---
 backend/controller/expenseReportController.ts | 11 ++++++++--
 .../controller/healthCareCostController.ts    | 21 +++++++++++++++----
 backend/controller/travelController.ts        | 17 +++++++++++----
 3 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/backend/controller/expenseReportController.ts b/backend/controller/expenseReportController.ts
index 39adae3..6844070 100644
--- a/backend/controller/expenseReportController.ts
+++ b/backend/controller/expenseReportController.ts
@@ -1,4 +1,5 @@
 import { Request as ExRequest } from 'express'
+import { Condition } from 'mongoose'
 import multer from 'multer'
 import { Body, Delete, Get, Middlewares, Post, Produces, Queries, Query, Request, Route, Security, Tags } from 'tsoa'
 import { Expense, ExpenseReportState, ExpenseReport as IExpenseReport, Locale, _id } from '../../common/types.js'
@@ -168,11 +169,17 @@ export class ExpenseReportController extends Controller {
 @Security('cookieAuth', ['examine/expenseReport'])
 export class ExpenseReportExamineController extends Controller {
   @Get()
-  public async getExpenseReport(@Queries() query: GetterQuery<IExpenseReport>) {
+  public async getExpenseReport(@Queries() query: GetterQuery<IExpenseReport>, @Request() request: ExRequest) {
+    const filter: Condition<IExpenseReport> = {
+      $and: [{ historic: false }, { $or: [{ state: 'underExamination' }, { state: 'refunded' }] }]
+    }
+    if (request.user!.projects.supervised.length > 0) {
+      filter.$and.push({ project: { $in: request.user!.projects.supervised } })
+    }
     const sortFn = (a: IExpenseReport, b: IExpenseReport) => (b.updatedAt as Date).valueOf() - (a.updatedAt as Date).valueOf()
     return await this.getter(ExpenseReport, {
       query,
-      filter: { $and: [{ historic: false }, { $or: [{ state: 'underExamination' }, { state: 'refunded' }] }] },
+      filter,
       projection: { history: 0, historic: 0, expenses: 0 },
       allowedAdditionalFields: ['expenses'],
       sortFn
diff --git a/backend/controller/healthCareCostController.ts b/backend/controller/healthCareCostController.ts
index 27a90da..69d4cfe 100644
--- a/backend/controller/healthCareCostController.ts
+++ b/backend/controller/healthCareCostController.ts
@@ -1,4 +1,5 @@
 import { Request as ExRequest } from 'express'
+import { Condition } from 'mongoose'
 import multer from 'multer'
 import { Body, Delete, Get, Middlewares, Post, Produces, Queries, Query, Request, Route, Security, Tags } from 'tsoa'
 import {
@@ -175,11 +176,17 @@ export class HealthCareCostController extends Controller {
 @Security('cookieAuth', ['examine/healthCareCost'])
 export class HealthCareCostExamineController extends Controller {
   @Get()
-  public async getHealthCareCost(@Queries() query: GetterQuery<IHealthCareCost>) {
+  public async getHealthCareCost(@Queries() query: GetterQuery<IHealthCareCost>, @Request() request: ExRequest) {
+    const filter: Condition<IHealthCareCost> = {
+      $and: [{ historic: false }, { $or: [{ state: 'underExamination' }, { state: 'underExaminationByInsurance' }] }]
+    }
+    if (request.user!.projects.supervised.length > 0) {
+      filter.$and.push({ project: { $in: request.user!.projects.supervised } })
+    }
     const sortFn = (a: IHealthCareCost, b: IHealthCareCost) => (b.updatedAt as Date).valueOf() - (a.updatedAt as Date).valueOf()
     return await this.getter(HealthCareCost, {
       query,
-      filter: { $and: [{ historic: false }, { $or: [{ state: 'underExamination' }, { state: 'underExaminationByInsurance' }] }] },
+      filter,
       projection: { history: 0, historic: 0, expenses: 0 },
       allowedAdditionalFields: ['expenses'],
       sortFn
@@ -326,11 +333,17 @@ export class HealthCareCostExamineController extends Controller {
 @Security('cookieAuth', ['confirm/healthCareCost'])
 export class HealthCareCostConfirmController extends Controller {
   @Get()
-  public async getHealthCareCost(@Queries() query: GetterQuery<IHealthCareCost>) {
+  public async getHealthCareCost(@Queries() query: GetterQuery<IHealthCareCost>, @Request() request: ExRequest) {
+    const filter: Condition<IHealthCareCost> = {
+      $and: [{ historic: false }, { $or: [{ state: 'underExaminationByInsurance' }, { state: 'refunded' }] }]
+    }
+    if (request.user!.projects.supervised.length > 0) {
+      filter.$and.push({ project: { $in: request.user!.projects.supervised } })
+    }
     const sortFn = (a: IHealthCareCost, b: IHealthCareCost) => (b.updatedAt as Date).valueOf() - (a.updatedAt as Date).valueOf()
     return await this.getter(HealthCareCost, {
       query,
-      filter: { $and: [{ historic: false }, { $or: [{ state: 'underExaminationByInsurance' }, { state: 'refunded' }] }] },
+      filter,
       projection: { history: 0, historic: 0, expenses: 0 },
       allowedAdditionalFields: ['expenses'],
       sortFn
diff --git a/backend/controller/travelController.ts b/backend/controller/travelController.ts
index ae65d6e..b801793 100644
--- a/backend/controller/travelController.ts
+++ b/backend/controller/travelController.ts
@@ -1,4 +1,5 @@
 import { Request as ExRequest } from 'express'
+import { Condition } from 'mongoose'
 import multer from 'multer'
 import { Body, Delete, Get, Middlewares, Post, Produces, Queries, Query, Request, Route, Security, Tags } from 'tsoa'
 import { Travel as ITravel, Locale, Stage, TravelExpense, TravelState, _id } from '../../common/types.js'
@@ -248,11 +249,15 @@ export class TravelController extends Controller {
 @Security('cookieAuth', ['approve/travel'])
 export class TravelApproveController extends Controller {
   @Get()
-  public async getTravel(@Queries() query: GetterQuery<ITravel>) {
+  public async getTravel(@Queries() query: GetterQuery<ITravel>, @Request() request: ExRequest) {
+    const filter: Condition<ITravel> = { $and: [{ historic: false }, { $or: [{ state: 'appliedFor' }, { state: 'approved' }] }] }
+    if (request.user!.projects.supervised.length > 0) {
+      filter.$and.push({ project: { $in: request.user!.projects.supervised } })
+    }
     const sortFn = (a: ITravel, b: ITravel) => (b.updatedAt as Date).valueOf() - (a.updatedAt as Date).valueOf()
     return await this.getter(Travel, {
       query,
-      filter: { $and: [{ historic: false }, { $or: [{ state: 'appliedFor' }, { state: 'approved' }] }] },
+      filter,
       projection: { history: 0, historic: 0, expenses: 0, stages: 0, days: 0 },
       sortFn
     })
@@ -321,11 +326,15 @@ export class TravelApproveController extends Controller {
 @Security('cookieAuth', ['examine/travel'])
 export class TravelExamineController extends Controller {
   @Get()
-  public async getTravel(@Queries() query: GetterQuery<ITravel>) {
+  public async getTravel(@Queries() query: GetterQuery<ITravel>, @Request() request: ExRequest) {
+    const filter: Condition<ITravel> = { $and: [{ historic: false }, { $or: [{ state: 'underExamination' }, { state: 'refunded' }] }] }
+    if (request.user!.projects.supervised.length > 0) {
+      filter.$and.push({ project: { $in: request.user!.projects.supervised } })
+    }
     const sortFn = (a: ITravel, b: ITravel) => (b.updatedAt as Date).valueOf() - (a.updatedAt as Date).valueOf()
     return await this.getter(Travel, {
       query,
-      filter: { $and: [{ historic: false }, { $or: [{ state: 'underExamination' }, { state: 'refunded' }] }] },
+      filter,
       projection: { history: 0, historic: 0, expenses: 0, stages: 0, days: 0 },
       allowedAdditionalFields: ['expenses', 'stages', 'days'],
       sortFn

From 38fa87b82fc5160a0e5666e84bf92bfe618842d5 Mon Sep 17 00:00:00 2001
From: david-loe <56305409+david-loe@users.noreply.github.com>
Date: Sat, 28 Sep 2024 20:33:50 +0200
Subject: [PATCH 6/8] only allow supervisors to post changes

---
 backend/controller/expenseReportController.ts | 37 ++++++++---
 .../controller/healthCareCostController.ts    | 54 +++++++++++----
 backend/controller/travelController.ts        | 65 ++++++++++++++-----
 backend/helper.ts                             |  9 +++
 4 files changed, 126 insertions(+), 39 deletions(-)

diff --git a/backend/controller/expenseReportController.ts b/backend/controller/expenseReportController.ts
index 6844070..9dd92ed 100644
--- a/backend/controller/expenseReportController.ts
+++ b/backend/controller/expenseReportController.ts
@@ -3,7 +3,7 @@ import { Condition } from 'mongoose'
 import multer from 'multer'
 import { Body, Delete, Get, Middlewares, Post, Produces, Queries, Query, Request, Route, Security, Tags } from 'tsoa'
 import { Expense, ExpenseReportState, ExpenseReport as IExpenseReport, Locale, _id } from '../../common/types.js'
-import { documentFileHandler, writeToDisk } from '../helper.js'
+import { checkIfUserIsProjectSupervisor, documentFileHandler, writeToDisk } from '../helper.js'
 import i18n from '../i18n.js'
 import { sendNotificationMail } from '../mail/mail.js'
 import ExpenseReport, { ExpenseReportDoc } from '../models/expenseReport.js'
@@ -187,8 +187,13 @@ export class ExpenseReportExamineController extends Controller {
   }
 
   @Delete()
-  public async deleteExpenseReport(@Query() _id: _id) {
-    return await this.deleter(ExpenseReport, { _id: _id })
+  public async deleteExpenseReport(@Query() _id: _id, @Request() request: ExRequest) {
+    return await this.deleter(ExpenseReport, {
+      _id: _id,
+      async checkOldObject(oldObject: IExpenseReport) {
+        return checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+      }
+    })
   }
 
   @Post('expense')
@@ -199,8 +204,12 @@ export class ExpenseReportExamineController extends Controller {
       parentId,
       arrayElementKey: 'expenses',
       allowNew: true,
-      async checkOldObject(oldObject) {
-        if (!oldObject.historic && oldObject.state === 'underExamination') {
+      async checkOldObject(oldObject: IExpenseReport) {
+        if (
+          !oldObject.historic &&
+          oldObject.state === 'underExamination' &&
+          checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+        ) {
           await documentFileHandler(['cost', 'receipts'], { owner: oldObject.owner._id })(request)
           return true
         } else {
@@ -212,13 +221,17 @@ export class ExpenseReportExamineController extends Controller {
   }
 
   @Delete('expense')
-  public async deleteExpenese(@Query() _id: _id, @Query() parentId: _id) {
+  public async deleteExpenese(@Query() _id: _id, @Query() parentId: _id, @Request() request: ExRequest) {
     return await this.deleterForArrayElement(ExpenseReport, {
       _id,
       parentId,
       arrayElementKey: 'expenses',
       async checkOldObject(oldObject) {
-        if (!oldObject.historic && oldObject.state === 'underExamination') {
+        if (
+          !oldObject.historic &&
+          oldObject.state === 'underExamination' &&
+          checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+        ) {
           return true
         } else {
           return false
@@ -248,7 +261,7 @@ export class ExpenseReportExamineController extends Controller {
       cb: (e: IExpenseReport) => sendNotificationMail(e, extendedBody._id ? 'backToInWork' : undefined),
       allowNew: true,
       async checkOldObject(oldObject: ExpenseReportDoc) {
-        if (oldObject.state === 'underExamination') {
+        if (oldObject.state === 'underExamination' && checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)) {
           await oldObject.saveToHistory()
           await oldObject.save()
           return true
@@ -278,7 +291,7 @@ export class ExpenseReportExamineController extends Controller {
       cb,
       allowNew: false,
       async checkOldObject(oldObject: ExpenseReportDoc) {
-        if (oldObject.state === 'underExamination') {
+        if (oldObject.state === 'underExamination' && checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)) {
           await oldObject.saveToHistory()
           await oldObject.save()
           return true
@@ -292,7 +305,11 @@ export class ExpenseReportExamineController extends Controller {
   @Get('report')
   @Produces('application/pdf')
   public async getReport(@Query() _id: _id, @Request() request: ExRequest) {
-    const expenseReport = await ExpenseReport.findOne({ _id, historic: false, state: 'refunded' }).lean()
+    const filter: Condition<IExpenseReport> = { _id, historic: false, state: 'refunded' }
+    if (request.user!.projects.supervised.length > 0) {
+      filter.project = { $in: request.user!.projects.supervised }
+    }
+    const expenseReport = await ExpenseReport.findOne(filter).lean()
     if (expenseReport) {
       const report = await generateExpenseReportReport(expenseReport, request.user!.settings.language)
       request.res?.setHeader('Content-disposition', 'attachment; filename=' + expenseReport.name + '.pdf')
diff --git a/backend/controller/healthCareCostController.ts b/backend/controller/healthCareCostController.ts
index 69d4cfe..7394a10 100644
--- a/backend/controller/healthCareCostController.ts
+++ b/backend/controller/healthCareCostController.ts
@@ -10,7 +10,7 @@ import {
   Locale,
   _id
 } from '../../common/types.js'
-import { documentFileHandler, writeToDisk } from '../helper.js'
+import { checkIfUserIsProjectSupervisor, documentFileHandler, writeToDisk } from '../helper.js'
 import i18n from '../i18n.js'
 import { sendNotificationMail } from '../mail/mail.js'
 import HealthCareCost, { HealthCareCostDoc } from '../models/healthCareCost.js'
@@ -194,8 +194,13 @@ export class HealthCareCostExamineController extends Controller {
   }
 
   @Delete()
-  public async deleteHealthCareCost(@Query() _id: _id) {
-    return await this.deleter(HealthCareCost, { _id: _id })
+  public async deleteHealthCareCost(@Query() _id: _id, @Request() request: ExRequest) {
+    return await this.deleter(HealthCareCost, {
+      _id: _id,
+      async checkOldObject(oldObject: IHealthCareCost) {
+        return checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+      }
+    })
   }
 
   @Post('expense')
@@ -207,7 +212,11 @@ export class HealthCareCostExamineController extends Controller {
       arrayElementKey: 'expenses',
       allowNew: true,
       async checkOldObject(oldObject) {
-        if (!oldObject.historic && oldObject.state === 'underExamination') {
+        if (
+          !oldObject.historic &&
+          oldObject.state === 'underExamination' &&
+          checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+        ) {
           await documentFileHandler(['cost', 'receipts'], { owner: oldObject.owner._id })(request)
           return true
         } else {
@@ -219,13 +228,17 @@ export class HealthCareCostExamineController extends Controller {
   }
 
   @Delete('expense')
-  public async deleteExpenese(@Query() _id: _id, @Query() parentId: _id) {
+  public async deleteExpenese(@Query() _id: _id, @Query() parentId: _id, @Request() request: ExRequest) {
     return await this.deleterForArrayElement(HealthCareCost, {
       _id,
       parentId,
       arrayElementKey: 'expenses',
       async checkOldObject(oldObject) {
-        if (!oldObject.historic && oldObject.state === 'underExamination') {
+        if (
+          !oldObject.historic &&
+          oldObject.state === 'underExamination' &&
+          checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+        ) {
           return true
         } else {
           return false
@@ -256,7 +269,7 @@ export class HealthCareCostExamineController extends Controller {
       cb,
       allowNew: false,
       async checkOldObject(oldObject: HealthCareCostDoc) {
-        if (oldObject.state === 'underExamination') {
+        if (oldObject.state === 'underExamination' && checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)) {
           await oldObject.saveToHistory()
           await oldObject.save()
           return true
@@ -296,7 +309,7 @@ export class HealthCareCostExamineController extends Controller {
       cb: (e: IHealthCareCost) => sendNotificationMail(e, extendedBody._id ? 'backToInWork' : undefined),
       allowNew: true,
       async checkOldObject(oldObject: HealthCareCostDoc) {
-        if (oldObject.state === 'underExamination') {
+        if (oldObject.state === 'underExamination' && checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)) {
           await oldObject.saveToHistory()
           await oldObject.save()
           return true
@@ -310,7 +323,11 @@ export class HealthCareCostExamineController extends Controller {
   @Get('report')
   @Produces('application/pdf')
   public async getReport(@Query() _id: _id, @Request() request: ExRequest) {
-    const healthCareCost = await HealthCareCost.findOne({ _id, historic: false, state: 'underExaminationByInsurance' }).lean()
+    const filter: Condition<IHealthCareCost> = { _id, historic: false, state: 'underExaminationByInsurance' }
+    if (request.user!.projects.supervised.length > 0) {
+      filter.project = { $in: request.user!.projects.supervised }
+    }
+    const healthCareCost = await HealthCareCost.findOne(filter).lean()
     if (healthCareCost) {
       const report = await generateHealthCareCostReport(healthCareCost, request.user!.settings.language)
       request.res?.setHeader('Content-disposition', 'attachment; filename=' + healthCareCost.name + '.pdf')
@@ -373,7 +390,7 @@ export class HealthCareCostConfirmController extends Controller {
       cb,
       allowNew: false,
       async checkOldObject(oldObject: HealthCareCostDoc) {
-        if (oldObject.state === 'underExaminationByInsurance') {
+        if (oldObject.state === 'underExaminationByInsurance' && checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)) {
           await documentFileHandler(['refundSum', 'receipts'], { owner: oldObject.owner._id })(request)
           await oldObject.saveToHistory()
           await oldObject.save()
@@ -385,16 +402,25 @@ export class HealthCareCostConfirmController extends Controller {
     })
   }
   @Delete()
-  public async deleteHealthCareCost(@Query() _id: _id) {
-    return await this.deleter(HealthCareCost, { _id: _id })
+  public async deleteHealthCareCost(@Query() _id: _id, @Request() request: ExRequest) {
+    return await this.deleter(HealthCareCost, {
+      _id: _id,
+      async checkOldObject(oldObject: IHealthCareCost) {
+        return checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+      }
+    })
   }
 
   @Get('report')
   @Produces('application/pdf')
   public async getReport(@Query() _id: _id, @Request() request: ExRequest) {
-    const healthCareCost = await HealthCareCost.findOne({
+    const filter: Condition<IHealthCareCost> = {
       $and: [{ _id, historic: false }, { $or: [{ state: 'refunded' }, { state: 'underExaminationByInsurance' }] }]
-    }).lean()
+    }
+    if (request.user!.projects.supervised.length > 0) {
+      filter.$and.push({ project: { $in: request.user!.projects.supervised } })
+    }
+    const healthCareCost = await HealthCareCost.findOne(filter).lean()
     if (healthCareCost) {
       const report = await generateHealthCareCostReport(healthCareCost, request.user!.settings.language)
       request.res?.setHeader('Content-disposition', 'attachment; filename=' + healthCareCost.name + '.pdf')
diff --git a/backend/controller/travelController.ts b/backend/controller/travelController.ts
index b801793..554a289 100644
--- a/backend/controller/travelController.ts
+++ b/backend/controller/travelController.ts
@@ -3,7 +3,7 @@ import { Condition } from 'mongoose'
 import multer from 'multer'
 import { Body, Delete, Get, Middlewares, Post, Produces, Queries, Query, Request, Route, Security, Tags } from 'tsoa'
 import { Travel as ITravel, Locale, Stage, TravelExpense, TravelState, _id } from '../../common/types.js'
-import { documentFileHandler, writeToDisk } from '../helper.js'
+import { checkIfUserIsProjectSupervisor, documentFileHandler, writeToDisk } from '../helper.js'
 import i18n from '../i18n.js'
 import { sendNotificationMail } from '../mail/mail.js'
 import Travel, { TravelDoc } from '../models/travel.js'
@@ -297,7 +297,7 @@ export class TravelApproveController extends Controller {
       cb,
       allowNew: true,
       async checkOldObject(oldObject: TravelDoc) {
-        if (oldObject.state === 'appliedFor') {
+        if (oldObject.state === 'appliedFor' && checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)) {
           await oldObject.saveToHistory()
           await oldObject.save()
           return true
@@ -316,7 +316,8 @@ export class TravelApproveController extends Controller {
       requestBody: extendedBody,
       cb: sendNotificationMail,
       allowNew: false,
-      checkOldObject: async (oldObject: TravelDoc) => oldObject.state === 'appliedFor'
+      checkOldObject: async (oldObject: TravelDoc) =>
+        oldObject.state === 'appliedFor' && checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
     })
   }
 }
@@ -348,13 +349,19 @@ export class TravelExamineController extends Controller {
     return await this.setter(Travel, {
       requestBody: extendedBody,
       allowNew: false,
-      checkOldObject: async (oldObject: TravelDoc) => !oldObject.historic && oldObject.state !== 'refunded'
+      checkOldObject: async (oldObject: TravelDoc) =>
+        !oldObject.historic && oldObject.state !== 'refunded' && checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
     })
   }
 
   @Delete()
-  public async deleteTravel(@Query() _id: _id) {
-    return await this.deleter(Travel, { _id: _id })
+  public async deleteTravel(@Query() _id: _id, @Request() request: ExRequest) {
+    return await this.deleter(Travel, {
+      _id: _id,
+      async checkOldObject(oldObject: TravelDoc) {
+        return checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+      }
+    })
   }
 
   @Post('expense')
@@ -370,7 +377,11 @@ export class TravelExamineController extends Controller {
       arrayElementKey: 'expenses',
       allowNew: true,
       async checkOldObject(oldObject) {
-        if (!oldObject.historic && oldObject.state === 'underExamination') {
+        if (
+          !oldObject.historic &&
+          oldObject.state === 'underExamination' &&
+          checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+        ) {
           await documentFileHandler(['cost', 'receipts'], { owner: oldObject.owner._id })(request)
           return true
         } else {
@@ -390,7 +401,11 @@ export class TravelExamineController extends Controller {
       arrayElementKey: 'stages',
       allowNew: true,
       async checkOldObject(oldObject) {
-        if (!oldObject.historic && oldObject.state === 'underExamination') {
+        if (
+          !oldObject.historic &&
+          oldObject.state === 'underExamination' &&
+          checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+        ) {
           await documentFileHandler(['cost', 'receipts'], { owner: oldObject.owner._id })(request)
           return true
         } else {
@@ -402,22 +417,34 @@ export class TravelExamineController extends Controller {
   }
 
   @Delete('expense')
-  public async deleteExpenese(@Query() _id: _id, @Query() parentId: _id) {
+  public async deleteExpenese(@Query() _id: _id, @Query() parentId: _id, @Request() request: ExRequest) {
     return await this.deleterForArrayElement(Travel, {
       _id,
       parentId,
       arrayElementKey: 'expenses',
-      checkOldObject: async (oldObject: TravelDoc) => !oldObject.historic && oldObject.state === 'underExamination'
+      async checkOldObject(oldObject: TravelDoc) {
+        return (
+          !oldObject.historic &&
+          oldObject.state === 'underExamination' &&
+          checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+        )
+      }
     })
   }
 
   @Delete('stage')
-  public async deleteStage(@Query() _id: _id, @Query() parentId: _id) {
+  public async deleteStage(@Query() _id: _id, @Query() parentId: _id, @Request() request: ExRequest) {
     return await this.deleterForArrayElement(Travel, {
       _id,
       parentId,
       arrayElementKey: 'stages',
-      checkOldObject: async (oldObject: TravelDoc) => !oldObject.historic && oldObject.state === 'underExamination'
+      async checkOldObject(oldObject: TravelDoc) {
+        return (
+          !oldObject.historic &&
+          oldObject.state === 'underExamination' &&
+          checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+        )
+      }
     })
   }
 
@@ -437,7 +464,11 @@ export class TravelExamineController extends Controller {
       cb,
       allowNew: false,
       async checkOldObject(oldObject: TravelDoc) {
-        if (!oldObject.historic && oldObject.state === 'underExamination') {
+        if (
+          !oldObject.historic &&
+          oldObject.state === 'underExamination' &&
+          checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)
+        ) {
           await oldObject.saveToHistory()
           await oldObject.save()
           return true
@@ -457,7 +488,7 @@ export class TravelExamineController extends Controller {
       allowNew: false,
       cb: (e: ITravel) => sendNotificationMail(e, 'backToApproved'),
       async checkOldObject(oldObject: TravelDoc) {
-        if (oldObject.state === 'underExamination') {
+        if (oldObject.state === 'underExamination' && checkIfUserIsProjectSupervisor(request.user!, oldObject.project._id)) {
           await oldObject.saveToHistory()
           await oldObject.save()
           return true
@@ -471,7 +502,11 @@ export class TravelExamineController extends Controller {
   @Get('report')
   @Produces('application/pdf')
   public async getReport(@Query() _id: _id, @Request() request: ExRequest) {
-    const travel = await Travel.findOne({ _id, historic: false, state: 'refunded' }).lean()
+    const filter: Condition<ITravel> = { _id, historic: false, state: 'refunded' }
+    if (request.user!.projects.supervised.length > 0) {
+      filter.project = { $in: request.user!.projects.supervised }
+    }
+    const travel = await Travel.findOne(filter).lean()
     if (travel) {
       const report = await generateTravelReport(travel, request.user!.settings.language)
       request.res?.setHeader('Content-disposition', 'attachment; filename=' + travel.name + '.pdf')
diff --git a/backend/helper.ts b/backend/helper.ts
index 0f93c15..5747d01 100644
--- a/backend/helper.ts
+++ b/backend/helper.ts
@@ -2,11 +2,13 @@ import { NextFunction, Request, Response } from 'express'
 import fs from 'fs/promises'
 import mongoose, { Model, Types } from 'mongoose'
 import {
+  _id,
   AnyState,
   DocumentFile as IDocumentFile,
   ExpenseReport as IExpenseReport,
   HealthCareCost as IHealthCareCost,
   Travel as ITravel,
+  User as IUser,
   reportIsHealthCareCost,
   reportIsTravel,
   Settings
@@ -186,3 +188,10 @@ export async function getSettings(): Promise<Settings> {
     throw Error('Settings not found')
   }
 }
+
+export function checkIfUserIsProjectSupervisor(user: IUser, projectId: _id): boolean {
+  if (user.projects.supervised.length === 0) {
+    return true
+  }
+  return user.projects.supervised.some((p) => p._id.equals(projectId))
+}

From 4fda2dc0c1e285d91ca13ac941dc280b7454b0a2 Mon Sep 17 00:00:00 2001
From: david-loe <56305409+david-loe@users.noreply.github.com>
Date: Sat, 28 Sep 2024 20:38:46 +0200
Subject: [PATCH 7/8] fix: Path `projects` is required

---
 backend/models/user.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/backend/models/user.ts b/backend/models/user.ts
index 9739a09..1bfa97b 100644
--- a/backend/models/user.ts
+++ b/backend/models/user.ts
@@ -73,7 +73,8 @@ export const userSchema = new Schema<User, UserModel, Methods>({
         ]
       }
     },
-    required: true
+    required: true,
+    default: () => ({})
   },
 
   loseAccessAt: { type: Date, info: 'info.loseAccessAt' },

From 12d56c1705e3d114f7fa3cc55723af872b88b751 Mon Sep 17 00:00:00 2001
From: david-loe <56305409+david-loe@users.noreply.github.com>
Date: Sat, 28 Sep 2024 20:55:48 +0200
Subject: [PATCH 8/8] minor locales

---
 common/forms/project.json                              | 2 +-
 common/locales/de.json                                 | 8 ++++----
 common/locales/en.json                                 | 8 ++++----
 frontend/src/components/settings/elements/UserList.vue | 5 +++--
 4 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/common/forms/project.json b/common/forms/project.json
index 489f723..e6c9074 100755
--- a/common/forms/project.json
+++ b/common/forms/project.json
@@ -1 +1 @@
-{"identifier":{"rules":["required"],"placeholder":{"de":"Kennung","en":"Identifier"},"type":"text"},"organisation":{"rules":["required"],"type":"organisation","placeholder":{"de":"Organisation","en":"Organisation"}},"name":{"rules":["nullable"],"placeholder":{"de":"Name","en":"Name"},"type":"text"},"budget":{"rules":["nullable"],"label":{"de":"Budget","en":"Budget"},"type":"object","schema":{"amount":{"rules":["nullable","min:0","numeric"],"type":"text","inputType":"number","attrs":{"step":"any"},"forceNumbers":true,"placeholder":{"de":"Betrag","en":"Amount"}}}},"balance":{"rules":["required"],"label":{"de":"Saldo","en":"Balance"},"type":"object","schema":{"amount":{"rules":["required","min:0","numeric"],"default":0,"type":"text","inputType":"number","attrs":{"step":"any"},"forceNumbers":true,"placeholder":{"de":"Betrag","en":"Amount"}}}},"assignees":{"rules":["min:0"],"type":"user","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Zugewiesene hinzufügen","en":"Add Assignees"}},"supervisors":{"rules":["min:0"],"type":"user","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Betreuende hinzufügen","en":"Add Supervisors"}}}
\ No newline at end of file
+{"identifier":{"rules":["required"],"placeholder":{"de":"Kennung","en":"Identifier"},"type":"text"},"organisation":{"rules":["required"],"type":"organisation","placeholder":{"de":"Organisation","en":"Organisation"}},"name":{"rules":["nullable"],"placeholder":{"de":"Name","en":"Name"},"type":"text"},"budget":{"rules":["nullable"],"label":{"de":"Budget","en":"Budget"},"type":"object","schema":{"amount":{"rules":["nullable","min:0","numeric"],"type":"text","inputType":"number","attrs":{"step":"any"},"forceNumbers":true,"placeholder":{"de":"Betrag","en":"Amount"}}}},"balance":{"rules":["required"],"label":{"de":"Saldo","en":"Balance"},"type":"object","schema":{"amount":{"rules":["required","min:0","numeric"],"default":0,"type":"text","inputType":"number","attrs":{"step":"any"},"forceNumbers":true,"placeholder":{"de":"Betrag","en":"Amount"}}}},"assignees":{"rules":["min:0"],"type":"user","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Zugewiesenen hinzufügen","en":"Add Assignees"}},"supervisors":{"rules":["min:0"],"type":"user","extendOptions":{"mode":"multiple"},"placeholder":{"de":"Betreuenden hinzufügen","en":"Add Supervisors"}}}
\ No newline at end of file
diff --git a/common/locales/de.json b/common/locales/de.json
index afe04e4..520f7a5 100755
--- a/common/locales/de.json
+++ b/common/locales/de.json
@@ -100,13 +100,11 @@
     "vehicleRegistration": "Lade hier den Fahrzeugschein deines Autos hoch."
   },
   "labels": {
-    "addAssignees": "Zugewiesene hinzufügen",
-    "addSupervisors": "Betreuende hinzufügen",
-    "assignedProjects": "Zugewiesene Projekte",
-    "supervisedProjects": "Betreute Projekte",
     "access": "Zugriffsrechte",
     "accessIcons": "Icons für Zugriffsrechte",
     "add": "Hinzufügen",
+    "addAssignees": "Zugewiesenen hinzufügen",
+    "addSupervisors": "Betreuenden hinzufügen",
     "addX": "{X} hinzufügen",
     "advance": "Vorschuss",
     "airplane": "Flugzeug ✈",
@@ -121,6 +119,7 @@
     "approvedOn": "Genehmigt am",
     "approvedTravels": "Genehmigte Reisen",
     "arrival": "Ankunft",
+    "assignedProjects": "Zugewiesene Projekte",
     "backToApplicant": "Zurück zum Antragsteller",
     "balance": "Saldo",
     "bankDetails": "Bankverbindung",
@@ -298,6 +297,7 @@
     "subunit": "Teileinheit",
     "success": "Erfolgreich ✅",
     "summary": "Zusammenfassung",
+    "supervisedProjects": "Betreute Projekte",
     "symbol": "Symbol",
     "tapToUpload": "Zum Hochladen hier tippen 👆",
     "text": "Text",
diff --git a/common/locales/en.json b/common/locales/en.json
index 4a09bb2..40165a7 100755
--- a/common/locales/en.json
+++ b/common/locales/en.json
@@ -100,13 +100,11 @@
     "vehicleRegistration": "Upload the vehicle registration of your car here."
   },
   "labels": {
-    "addAssignees": "Add Assignees",
-    "addSupervisors": "Add Supervisors",
-    "assignedProjects": "Assigned Projects",
-    "supervisedProjects": "Supervised Projects",
     "access": "Access",
     "accessIcons": "Icons for access rights",
     "add": "Add",
+    "addAssignees": "Add Assignees",
+    "addSupervisors": "Add Supervisors",
     "addX": "Add {X}",
     "advance": "Advance",
     "airplane": "Airplane ✈",
@@ -121,6 +119,7 @@
     "approvedOn": "Approved on",
     "approvedTravels": "approved travels",
     "arrival": "Arrival",
+    "assignedProjects": "Assigned Projects",
     "backToApplicant": "Back to applicant",
     "balance": "Balance",
     "bankDetails": "Bank details",
@@ -298,6 +297,7 @@
     "subunit": "Subunit",
     "success": "Sucess ✅",
     "summary": "Summary",
+    "supervisedProjects": "Supervised Projects",
     "symbol": "Symbol",
     "tapToUpload": "Tap here to upload 👆",
     "text": "Text",
diff --git a/frontend/src/components/settings/elements/UserList.vue b/frontend/src/components/settings/elements/UserList.vue
index aa55b42..ec65dfe 100644
--- a/frontend/src/components/settings/elements/UserList.vue
+++ b/frontend/src/components/settings/elements/UserList.vue
@@ -140,7 +140,8 @@ export default defineComponent({
       if (formUser) {
         // reduce arrays of objects to arrays of _ids for vueform select elements
         const formUserSettings = Object.assign({}, formUser.settings)
-        formUser = Object.assign({}, formUser, { settings: formUserSettings })
+        const formUserProjects = Object.assign({}, formUser.projects)
+        formUser = Object.assign({}, formUser, { settings: formUserSettings, projects: formUserProjects })
         formUser.settings.lastCurrencies = user!.settings.lastCurrencies.map((c) => c._id)
         formUser.settings.lastCountries = user!.settings.lastCountries.map((c) => c._id)
         formUser.projects.assigned = user!.projects.assigned.map((p) => p._id)
@@ -183,7 +184,7 @@ export default defineComponent({
       }
     }
   },
-  async created() {
+  async beforeMount() {
     await this.$root.load()
     this.getUsers()
   }