From 5664616a2acf4315b62077bc8d07ac3c1632aaa7 Mon Sep 17 00:00:00 2001
From: rene <mail@motocamp.de>
Date: Fri, 8 May 2026 15:27:03 +0200
Subject: [PATCH] =?UTF-8?q?Fix:=20Welten-Config=20=E2=80=94=20Sicherheitsn?=
 =?UTF-8?q?etz=20entfernt=20(Rolle-Chips=20ausblendbar),=20Duplikat-Schutz?=
 =?UTF-8?q?=20(SW=20by-v778)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/main.py             |  2 +-
 backend/static/index.html   |  2 +-
 backend/static/js/app.js    |  2 +-
 backend/static/js/worlds.js | 20 ++++++++------------
 backend/static/sw.js        |  2 +-
 5 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/backend/main.py b/backend/main.py
index dcf19f7..b78faae 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -327,7 +327,7 @@ MEDIA_DIR = os.getenv("MEDIA_DIR", "/data/media")
 os.makedirs(MEDIA_DIR, exist_ok=True)
 app.mount("/media", StaticFiles(directory=MEDIA_DIR), name="media")
 
-APP_VER = "777"  # muss mit APP_VER in app.js übereinstimmen
+APP_VER = "778"  # muss mit APP_VER in app.js übereinstimmen
 
 @app.get("/.well-known/assetlinks.json")
 async def assetlinks():
diff --git a/backend/static/index.html b/backend/static/index.html
index 4b0cf7d..7c67a3b 100644
--- a/backend/static/index.html
+++ b/backend/static/index.html
@@ -578,7 +578,7 @@
 <script src="/js/api.js?v=94"></script>
 <script src="/js/ui.js?v=94"></script>
 <script src="/js/app.js?v=94"></script>
-<script src="/js/worlds.js?v=777"></script>
+<script src="/js/worlds.js?v=778"></script>
 
 <!-- Feature-Seiten werden lazy geladen -->
 
diff --git a/backend/static/js/app.js b/backend/static/js/app.js
index b3d9d01..3d76576 100644
--- a/backend/static/js/app.js
+++ b/backend/static/js/app.js
@@ -3,7 +3,7 @@
    Router, State-Management, Navigation, Initialisierung.
    ============================================================ */
 
-const APP_VER     = '777'; // ← bei jedem Deploy mit Frontend-Änderungen erhöhen
+const APP_VER     = '778'; // ← bei jedem Deploy mit Frontend-Änderungen erhöhen
 const APP_VERSION = '1.5.0'; // ← semantische Version, wird bei make release gesetzt
 const IS_STAGING  = location.hostname === 'staging.banyaro.app';
 // Cache-Bust-Parameter nach Update-Reload sofort entfernen
diff --git a/backend/static/js/worlds.js b/backend/static/js/worlds.js
index 25a824b..6daaaf4 100644
--- a/backend/static/js/worlds.js
+++ b/backend/static/js/worlds.js
@@ -640,18 +640,14 @@ window.Worlds = (() => {
   }
 
   function _chipsForWorld(world) {
-    const pages = _getConfig()[world] || _DEFAULT_CONFIG[world];
-    // Alle Chips filtern — _chipAllowed entscheidet ob angezeigt
-    const chips = pages.map(_chipMeta).filter(c => c && _chipAllowed(c));
-    // Sicherheitsnetz: Rolle-gebundene Chips aus Default einfügen wenn berechtigt
-    // (aber noch nicht in persönlicher Config) — _chipAllowed() entscheidet für alle
-    const alreadyIn = new Set(chips.map(c => c.page));
-    for (const page of (_DEFAULT_CONFIG[world] || [])) {
-      if (alreadyIn.has(page)) continue;
-      const meta = _chipMeta(page);
-      if (!meta?.role) continue; // nur role-gebundene Chips
-      if (_chipAllowed(meta)) { chips.push(meta); alreadyIn.add(page); }
-    }
+    const cfg = _getConfig();
+    const pages = cfg[world] || _DEFAULT_CONFIG[world];
+    // Deduplizieren + filtern — _chipAllowed entscheidet ob angezeigt
+    const seen = new Set();
+    const chips = pages
+      .filter(p => { if (seen.has(p)) return false; seen.add(p); return true; })
+      .map(_chipMeta)
+      .filter(c => c && _chipAllowed(c));
     return chips;
   }
 
diff --git a/backend/static/sw.js b/backend/static/sw.js
index 58e5d1b..e4c6c1f 100644
--- a/backend/static/sw.js
+++ b/backend/static/sw.js
@@ -3,7 +3,7 @@
    Offline-Cache + Push Notifications + Tile-Cache
    ============================================================ */
 
-const CACHE_VERSION = 'by-v777';
+const CACHE_VERSION = 'by-v778';
 const CACHE_STATIC  = `${CACHE_VERSION}-static`;
 const CACHE_TILES   = 'ban-yaro-tiles-v1';  // bleibt über SW-Updates erhalten
 const CACHE_API     = 'ban-yaro-api-v1';    // API-Response-Cache