Feature: ORS-Wochenlimit (20/Woche), Tages-Cache, Privilegien-Bypass, Datenschutz-Update — SW by-v480, APP_VER 457

backend/routes/routen.py

@@ -1,5 +1,6 @@
 """BAN YARO — Gassi-Routen"""
 
+import datetime as _dt
 import json, math, os, uuid
 import httpx
 import polyline as _polyline
@@ -184,6 +185,8 @@ class SuggestRequest(BaseModel):
     distance_km: float   # Zieldistanz in km (z.B. 2.0, 4.0, 6.0)
     seed:        int = 0  # 0-4: verschiedene Routenvarianten
 
+WEEKLY_LIMIT = 20
+
 @router.post("/suggest")
 async def suggest_route(data: SuggestRequest, user=Depends(get_current_user)):
     if not (0.5 <= data.distance_km <= 15):
@@ -192,6 +195,27 @@ async def suggest_route(data: SuggestRequest, user=Depends(get_current_user)):
     if not ORS_API_KEY:
         raise HTTPException(503, "ORS nicht konfiguriert")
 
+    is_privileged = (
+        user.get("rolle") in ("admin", "moderator") or
+        user.get("is_moderator") or
+        user.get("is_social_media") or
+        user.get("breeder_status") == "approved"
+    )
+
+    today = _dt.date.today()
+    week_start = (today - _dt.timedelta(days=today.weekday())).isoformat()
+
+    if not is_privileged:
+        with db() as conn:
+            row = conn.execute(
+                "SELECT count FROM route_suggest_usage WHERE user_id=? AND week=?",
+                (user["id"], week_start)
+            ).fetchone()
+            current_count = row["count"] if row else 0
+
+        if current_count >= WEEKLY_LIMIT:
+            raise HTTPException(429, f"Wochenlimit von {WEEKLY_LIMIT} Routenvorschlägen erreicht.")
+
     payload = {
         "coordinates": [[data.lon, data.lat]],
         "options": {
@@ -251,12 +275,23 @@ async def suggest_route(data: SuggestRequest, user=Depends(get_current_user)):
     else:
         schwierigkeit = "anspruchsvoll"
 
+    if not is_privileged:
+        with db() as conn:
+            conn.execute("""
+                INSERT INTO route_suggest_usage (user_id, week, count) VALUES (?, ?, 1)
+                ON CONFLICT(user_id, week) DO UPDATE SET count = count + 1
+            """, (user["id"], week_start))
+        current_count += 1
+
+    weekly_remaining = None if is_privileged else max(0, WEEKLY_LIMIT - current_count)
+
     return {
-        "name":          f"Rundweg {distanz_km:.0f} km",
-        "gps_track":     gps_track,
-        "distanz_km":    distanz_km,
-        "dauer_min":     dauer_min,
-        "schwierigkeit": schwierigkeit,
+        "name":             f"Rundweg {distanz_km:.0f} km",
+        "gps_track":        gps_track,
+        "distanz_km":       distanz_km,
+        "dauer_min":        dauer_min,
+        "schwierigkeit":    schwierigkeit,
+        "weekly_remaining": weekly_remaining,
     }