Repository: it-at-m/Wahllokalsystem
Pull request #1201: 906 845 Update Stack um AdminGui entsprechend Zielarchitektur
Author: login: MrSebastian
Labels: name: documentation
description: Improvements or additions to documentation
name: service-auth
name: wls-gui-wahllokalsystem
description: frontend related issues for Wahllokalsystem
name: wls-gui-admin
description: frontend related issues for Admintool
Created: 2025-04-16T07:54:57Z | Merged: 2025-04-23T08:25:55Z

# Beschreibung:
- die Frontends werden über ein separates Gateway angeboten wie es auch in der aktuellen Architektur ist und in Zukunft weiter sein wird
- Die Doku wurde entsprechend angepasst, daher auch zusätzlich das Issue #845
- Für eine Anmeldung mit dem client für das Gateway müssen die Benutzer eine spezielle Rolle haben. Das wurde in die Doku mit aufgenommen

# Vorgänger
- #1102 
- #1222

<!-- Backend -->
### Backend ###
- [X] Doku aktualisiert

<!-- Dokumentation -->
### Dokumentation
- [x] Links geprüft

<!-- Frontend -->
### Frontend
- [x] Doku aktualisiert

# Referenzen[^1]:

Verwandt mit Issue #

Closes #906
Closes #845

> [^1]: _Nicht zutreffende Referenzen vor dem Speichern entfernen_

[naming-conventions-link]: https://it-at-m.github.io/Wahllokalsystem/technik/naming_conventions/


<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit

## Summary by CodeRabbit

- **New Features**
  - Introduced a new admin tool service and gateway for administration tasks, with dedicated OAuth2 client configuration.
  - Added MONITORING_HELPDESK as a new user role and linked it to specific users.

- **Bug Fixes**
  - Clarified documentation regarding required user roles for logging into different systems.

- **Documentation**
  - Added detailed system architecture diagrams and explanations to the technical documentation.
  - Updated user documentation to specify login role requirements.

- **Chores**
  - Updated environment variables and service configurations to support new admin tool and gateway.
  - Added and updated database migration and dummy data scripts for new roles and OAuth2 clients.

- **Refactor**
  - Renamed and restructured gateway services and configuration files for clarity and separation of admin and standard gateways.
  - Adjusted route configurations to reflect service changes.

- **Style**
  - Removed unused base path from admin tool frontend configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Linked issue #906: Die Admin-Gui ist Teil des Stacks
- Als Entwickler kann ich den letzten Released Stand der Admin-Gui über Docker starten um zu sehen wie meine Änderungen an den Service damit zusammenspielen.
- Als Interessent für das WLS kann ich auch die Admin-GUI über Docker starten um mir ein Gesamtbild von der Anwendung zu machen ohne spezielle Schritte unternehmen zu müssen um die Anwendung zum starten zu bekommen
 
# Akzeptanzkriterien
- [ ] Über den Stack in `docker-compose.yml` wird die `latest` Version des Images der Admin-Gui zur Verfügung gestellt.

---

# Begründung Referenzstory

- Ergänzung eines neues Container analog zu den vorhanden

Diff:
diff --git a/docs/src/technik/get_started/index.md b/docs/src/technik/get_started/index.md
index 3597b52af3..253a08531a 100644
--- a/docs/src/technik/get_started/index.md
+++ b/docs/src/technik/get_started/index.md
@@ -85,6 +85,10 @@ flowchart LR
 | wls_all_bwb | test     | Ein Benutzer mit allen Rechten mit der WahlbezirksArt BWB (Briefwahl) |
 | wls_all_uwb | test     | Ein Benutzer mit allen Rechten mit der WahlbezirksArt UWB (Urnenwahl) |
 
+> [!CAUTION]
+> Für die Anmeldung am WLS muss der User die Rolle `WLS_WAHLVORSTAND` haben.
+> Für die Anmeldung am Admintool muss der User die Rolle `MONITORING_HELPDESK` haben.
+
 ## Datenbank
 
 Der Zugriff auf die Oracle-Datenbank über die IDE ist gemäß [dieser Anleitung](/technik/guides/db-access) einzurichten.
diff --git a/docs/src/technik/systemspecification/index.md b/docs/src/technik/systemspecification/index.md
index 81903eb857..30ea7d61ae 100644
--- a/docs/src/technik/systemspecification/index.md
+++ b/docs/src/technik/systemspecification/index.md
@@ -1,3 +1,64 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> electionManagementSystem[System zur Wahlverwaltung]
+    Wahllokalsystem --> LDAP
+```
+
+Damit das Wahllokalsystem betrieben werden kann, wird ein externes System benötigt. Dieses stellt Informationen
+zu den Wahlen bereit, welche durch das WLS unterstützt werden sollen.
+
+LDAP wird zur [Authentifizierung](security#authentifizierung) der Benutzer verwendet,
+
+### Komponenten des WLS
+
+```mermaid
+
+flowchart TD
+
+    subgraph Wahllokalsystem    
+        subgraph Frontends
+            wls[Wahllokalsystem UI]
+            admin[Admin UI]
+        end
+    
+        subgraph Apigateways
+            apiGwWls[ApiGatewayWls]
+            apiGwAdmin[ApiGatewayAdminTool]
+        end
+    
+        subgraph Backendservices
+            ms1[Microservice 1]
+            ms2[Microservice 2]
+            ms3[Microservice 3]
+            ms4[Microservice 4]
+            msn[Microservice N]
+        end
+    end
+
+    wls --> apiGwWls
+    admin --> apiGwAdmin
+
+    apiGwWls --> ms1
+    apiGwWls --> ms2
+    apiGwWls --> ms3
+    
+    apiGwAdmin --> ms3
+    apiGwAdmin --> ms4
+    ms2 --> msn
+    ms3 --> msn
+    ms4 --> msn
+```
+
+Das WLS besteht aus 3 Arten von Komponenten. Die **Frontends** stellen das Userinterface für die Benutzer dar.
+Über die **Apigateways** wird der Zugriff auf die **Backendservices** ermöglicht, welche die Anwendungslogik
+umsetzen und sich um die Datenhaltung kümmern.
diff --git a/stack/.env b/stack/.env
index d7fc3de3a7..f9108ba39f 100644
--- a/stack/.env
+++ b/stack/.env
@@ -1,4 +1,5 @@
-SSO_CLIENT_ID=wls
+SSO_CLIENT_ID_WLS=wls
+SSO_CLIENT_ID_ADMIN=admingui
 SSO_CLIENT_SECRET=top-secret
 SSO_JWK_URI=http://kubernetes.docker.internal:8100/oauth2/jwks
 SSO_USER_INFO_URI=http://kubernetes.docker.internal:8100/user
diff --git a/stack/docker-compose.yml b/stack/docker-compose.yml
index e98434149f..9cfc01c648 100644
--- a/stack/docker-compose.yml
+++ b/stack/docker-compose.yml
@@ -253,7 +253,8 @@ services:
     networks:
       - services
 
-  refarch-gateway:
+  refarch-gateway-wls:
+    container_name: wls-refarch-gateway-wls
     image: ghcr.io/it-at-m/refarch/refarch-gateway:1.4.5@sha256:7aa12dd012ab96da2053c509c9c957bc1a1548bcba295a563dc2f0d5bab985f0
     env_file:
       - .env
@@ -267,11 +268,44 @@ services:
       - SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUERURI=${SSO_USER_INFO_URI}
       - SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_SSO_ISSUERURI=http://kubernetes.docker.internal:8100
       - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_PROVIDER=sso
-      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_CLIENTID=${SSO_CLIENT_ID}
+      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_CLIENTID=${SSO_CLIENT_ID_WLS}
       - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_CLIENTSECRET=${SSO_CLIENT_SECRET}
       - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_SCOPE=openid
     volumes:
-      - './gateway_config:/config'
+      - './gateway_config_wls:/config'
+    networks:
+      - services
+    extra_hosts:
+      - "kubernetes.docker.internal:host-gateway"
+    healthcheck:
+      interval: 30s
+      timeout: 60s
+      retries: 3
+      start_period: 60s
+      test: [ "CMD-SHELL", "curl http://localhost:8080/actuator/health/liveness" ]
+    security_opt:
+      - no-new-privileges:true
+
+  refarch-gateway-admin:
+    container_name: wls-refarch-gateway-admin
+    image: ghcr.io/it-at-m/refarch/refarch-gateway:1.4.5@sha256:7aa12dd012ab96da2053c509c9c957bc1a1548bcba295a563dc2f0d5bab985f0
+    env_file:
+      - .env
+    ports:
+      - "8084:8080"
+    environment:
+      - ALLOWED_ORIGINS_PUBLIC=http://localhost:*
+      - ALLOWED_ORIGINS_CLIENTS=http://localhost:*
+      - SPRING_CONFIG_ADDITIONAL_LOCATION=/config/application-routes.yml
+      - SPRING_PROFILES_ACTIVE=hazelcast-local
+      - SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUERURI=${SSO_USER_INFO_URI}
+      - SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_SSO_ISSUERURI=http://kubernetes.docker.internal:8100
+      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_PROVIDER=sso
+      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_CLIENTID=${SSO_CLIENT_ID_ADMIN}
+      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_CLIENTSECRET=${SSO_CLIENT_SECRET}
+      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_SCOPE=openid
+    volumes:
+      - './gateway_config_admin:/config'
     networks:
       - services
     extra_hosts:
@@ -294,7 +328,7 @@ services:
       - .env
     environment:
       SERVICE_CONFIG_CRYPTO_KEY: please change me
-      SERVICE_CONFIG_OAUTH2_CLIENTS_WAHLLOKALGUI_ID: ${SSO_CLIENT_ID}
+      SERVICE_CONFIG_OAUTH2_CLIENTS_WAHLLOKALGUI_ID: ${SSO_CLIENT_ID_WLS}
       SERVICE_CONFIG_OAUTH2_JWK_RSA_INIT_SEED: change_me
       SPRING_PROFILES_ACTIVE: db-oracle,db-dummydata,dummy.ldap,plainTextLogging
       SPRING_DATASOURCE_URL: ${WLS_SERVICE_DB_URL}
@@ -355,6 +389,16 @@ services:
     networks:
       - services
 
+  wls-gui-admintool:
+    container_name: wls-gui-admintool
+    image: ghcr.io/it-at-m/wahllokalsystem-wls-gui-admintool:latest
+    ports:
+      - 8401:8080
+    extra_hosts:
+      - "kubernetes.docker.internal:host-gateway"
+    networks:
+      - services
+
 networks:
   internal:
   services:
\ No newline at end of file
diff --git a/stack/docker-compose_latest-dev.yml b/stack/docker-compose_latest-dev.yml
index 2e0a05c733..7296a6586e 100644
--- a/stack/docker-compose_latest-dev.yml
+++ b/stack/docker-compose_latest-dev.yml
@@ -253,7 +253,8 @@ services:
     networks:
       - services
 
-  refarch-gateway:
+  refarch-gateway-wls:
+    container_name: wls-refarch-gateway-wls
     image: ghcr.io/it-at-m/refarch/refarch-gateway:1.4.5@sha256:7aa12dd012ab96da2053c509c9c957bc1a1548bcba295a563dc2f0d5bab985f0
     env_file:
       - .env
@@ -267,11 +268,44 @@ services:
       - SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUERURI=${SSO_USER_INFO_URI}
       - SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_SSO_ISSUERURI=http://kubernetes.docker.internal:8100
       - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_PROVIDER=sso
-      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_CLIENTID=${SSO_CLIENT_ID}
+      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_CLIENTID=${SSO_CLIENT_ID_WLS}
       - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_CLIENTSECRET=${SSO_CLIENT_SECRET}
       - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_SCOPE=openid
     volumes:
-      - './gateway_config:/config'
+      - './gateway_config_wls:/config'
+    networks:
+      - services
+    extra_hosts:
+      - "kubernetes.docker.internal:host-gateway"
+    healthcheck:
+      interval: 30s
+      timeout: 60s
+      retries: 3
+      start_period: 60s
+      test: [ "CMD-SHELL", "curl http://localhost:8080/actuator/health/liveness" ]
+    security_opt:
+      - no-new-privileges:true
+
+  refarch-gateway-admin:
+    container_name: wls-refarch-gateway-admin
+    image: ghcr.io/it-at-m/refarch/refarch-gateway:1.4.5@sha256:7aa12dd012ab96da2053c509c9c957bc1a1548bcba295a563dc2f0d5bab985f0
+    env_file:
+      - .env
+    ports:
+      - "8084:8080"
+    environment:
+      - ALLOWED_ORIGINS_PUBLIC=http://localhost:*
+      - ALLOWED_ORIGINS_CLIENTS=http://localhost:*
+      - SPRING_CONFIG_ADDITIONAL_LOCATION=/config/application-routes.yml
+      - SPRING_PROFILES_ACTIVE=hazelcast-local
+      - SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUERURI=${SSO_USER_INFO_URI}
+      - SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_SSO_ISSUERURI=http://kubernetes.docker.internal:8100
+      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_PROVIDER=sso
+      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_CLIENTID=${SSO_CLIENT_ID_ADMIN}
+      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_CLIENTSECRET=${SSO_CLIENT_SECRET}
+      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_SCOPE=openid
+    volumes:
+      - './gateway_config_admin:/config'
     networks:
       - services
     extra_hosts:
@@ -294,7 +328,7 @@ services:
       - .env
     environment:
       SERVICE_CONFIG_CRYPTO_KEY: please change me
-      SERVICE_CONFIG_OAUTH2_CLIENTS_WAHLLOKALGUI_ID: ${SSO_CLIENT_ID}
+      SERVICE_CONFIG_OAUTH2_CLIENTS_WAHLLOKALGUI_ID: ${SSO_CLIENT_ID_WLS}
       SERVICE_CONFIG_OAUTH2_JWK_RSA_INIT_SEED: change_me
       SPRING_PROFILES_ACTIVE: db-oracle,db-dummydata,dummy.ldap,plainTextLogging
       SPRING_DATASOURCE_URL: ${WLS_SERVICE_DB_URL}
@@ -355,6 +389,16 @@ services:
     networks:
       - services
 
+  wls-gui-admintool:
+    container_name: wls-gui-admintool
+    image: ghcr.io/it-at-m/wahllokalsystem-wls-gui-admintool:latest-dev
+    ports:
+      - 8401:8080
+    extra_hosts:
+      - "kubernetes.docker.internal:host-gateway"
+    networks:
+      - services
+
 networks:
   internal:
   services:
\ No newline at end of file
diff --git a/stack/gateway_config_admin/application-routes.yml b/stack/gateway_config_admin/application-routes.yml
new file mode 100644
index 0000000000..cb6f3bd2ab
--- /dev/null
+++ b/stack/gateway_config_admin/application-routes.yml
@@ -0,0 +1,54 @@
+spring:
+  cloud:
+    gateway:
+      routes:
+        - id: sso
+          uri: http://kubernetes.docker.internal:8100/
+          predicates:
+            - Path=/api/sso/userinfo
+          filters:
+            - RewritePath=/api/sso/userinfo, /user
+            - RemoveRequestHeader=Cookie
+            - RemoveResponseHeader=Set-Cookie
+        - id: admin-service
+          uri: http://kubernetes.docker.internal:8209/
+          predicates:
+            - Path=/api/admin-service/**
+          filters:
+            - RewritePath=/api/admin-service/(?<urlsegments>.*), /$\{urlsegments}
+        - id: auth-service
+          uri: http://kubernetes.docker.internal:8100/
+          predicates:
+            - Path=/api/auth-service/**
+          filters:
+            - RewritePath=/api/auth-service/(?<urlsegments>.*), /$\{urlsegments}
+            - RemoveRequestHeader=Cookie
+            - RemoveResponseHeader=Set-Cookie
+        - id: basisdaten-service
+          uri: http://kubernetes.docker.internal:8205/
+          predicates:
+            - Path=/api/basisdaten-service/**
+          filters:
+            - RewritePath=/api/basisdaten-service/(?<urlsegments>.*), /$\{urlsegments}
+        - id: broadcast-service
+          uri: http://kubernetes.docker.internal:8200/
+          predicates:
+            - Path=/api/broadcast-service/**
+          filters:
+            - RewritePath=/api/broadcast-service/(?<urlsegments>.*), /$\{urlsegments}
+        - id: ergebnismeldung-service
+          uri: http://kubernetes.docker.internal:8208/
+          predicates:
+            - Path=/api/ergebnismeldung-service/**
+          filters:
+            - RewritePath=/api/ergebnismeldung-service/(?<urlsegments>.*), /$\{urlsegments}
+        - id: infomanagement-service
+          uri: http://kubernetes.docker.internal:8201/
+          predicates:
+            - Path=/api/infomanagement-service/**
+          filters:
+            - RewritePath=/api/infomanagement-service/(?<urlsegments>.*), /$\{urlsegments}
+        - id: frontend-admintool
+          uri: http://kubernetes.docker.internal:8401/
+          predicates:
+            - Path=/**
\ No newline at end of file
diff --git a/stack/gateway_config/application-routes.yml b/stack/gateway_config_wls/application-routes.yml
similarity index 84%
rename from stack/gateway_config/application-routes.yml
rename to stack/gateway_config_wls/application-routes.yml
index f47990033f..9bee5541a9 100644
--- a/stack/gateway_config/application-routes.yml
+++ b/stack/gateway_config_wls/application-routes.yml
@@ -10,12 +10,6 @@ spring:
             - RewritePath=/api/sso/userinfo, /user
             - RemoveRequestHeader=Cookie
             - RemoveResponseHeader=Set-Cookie
-        - id: admin-service
-          uri: http://kubernetes.docker.internal:8209/
-          predicates:
-            - Path=/api/admin-service/**
-          filters:
-            - RewritePath=/api/admin-service/(?<urlsegments>.*), /$\{urlsegments}
         - id: auth-service
           uri: http://kubernetes.docker.internal:8100/
           predicates:
@@ -42,12 +36,6 @@ spring:
             - Path=/api/broadcast-service/**
           filters:
             - RewritePath=/api/broadcast-service/(?<urlsegments>.*), /$\{urlsegments}
-        - id: eai-service
-          uri: http://kubernetes.docker.internal:8300/
-          predicates:
-            - Path=/api/eai-service/**
-          filters:
-            - RewritePath=/api/eai-service/(?<urlsegments>.*), /$\{urlsegments}
         - id: ergebnismeldung-service
           uri: http://kubernetes.docker.internal:8208/
           predicates:
@@ -84,10 +72,6 @@ spring:
             - Path=/api/wahlvorstand-service/**
           filters:
             - RewritePath=/api/wahlvorstand-service/(?<urlsegments>.*), /$\{urlsegments}
-        - id: admintool
-          uri: http://kubernetes.docker.internal:8401/
-          predicates:
-            - Path=/admintool/**
         # frontend has to be the last route to be sure it does not override other routes with path=/**
         - id: frontend
           uri: http://kubernetes.docker.internal:8400/
diff --git a/wls-auth-service/src/main/resources/db/dummydata/h2/V15_1__insertDummyAdminClient.sql b/wls-auth-service/src/main/resources/db/dummydata/h2/V15_1__insertDummyAdminClient.sql
new file mode 100644
index 0000000000..808d967938
--- /dev/null
+++ b/wls-auth-service/src/main/resources/db/dummydata/h2/V15_1__insertDummyAdminClient.sql
@@ -0,0 +1,12 @@
+INSERT INTO OAUTH2_REGISTERED_CLIENT (ID, CLIENT_ID, CLIENT_ID_ISSUED_AT, CLIENT_SECRET,
+                                      CLIENT_SECRET_EXPIRES_AT, CLIENT_NAME,
+                                      CLIENT_AUTHENTICATION_METHODS, AUTHORIZATION_GRANT_TYPES,
+                                      REDIRECT_URIS, POST_LOGOUT_REDIRECT_URIS, SCOPES,
+                                      CLIENT_SETTINGS, TOKEN_SETTINGS)
+VALUES ('48d5545c-7338-41a0-9d90-54becc84d473', 'admingui', TIMESTAMP '2025-04-16 08:20:00.000000',
+        '{bcrypt}$2a$10$zCvSE.rK0Hb6MqkeKHwHzOMhCB5FW12XHOWEyRgiwDsj6i2CfvDj2', null, 'admin-gui-wahllokal',
+        'client_secret_basic', 'refresh_token,client_credentials,authorization_code',
+        'http://127.0.0.1:8080/oauth2/authorized,http://localhost:8084/login/oauth2/code/sso',
+        'http://localhost:39152/', 'openid',
+        '{"@class":"java.util.Collections$UnmodifiableMap","settings.client.require-proof-key":false,"settings.client.require-authorization-consent":true}',
+        '{"@class":"java.util.Collections$UnmodifiableMap","settings.token.reuse-refresh-tokens":true,"settings.token.x509-certificate-bound-access-tokens":false,"settings.token.id-token-signature-algorithm":["org.springframework.security.oauth2.jose.jws.SignatureAlgorithm","RS256"],"settings.token.access-token-time-to-live":["java.time.Duration",300.000000000],"settings.token.access-token-format":{"@class":"org.springframework.security.oauth2.server.authorization.settings.OAuth2TokenFormat","value":"self-contained"},"settings.token.refresh-token-time-to-live":["java.time.Duration",3600.000000000],"settings.token.authorization-code-time-to-live":["java.time.Duration",300.000000000],"settings.token.device-code-time-to-live":["java.time.Duration",300.000000000]}');
diff --git a/wls-auth-service/src/main/resources/db/dummydata/h2/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql b/wls-auth-service/src/main/resources/db/dummydata/h2/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql
new file mode 100644
index 0000000000..8a51aa6a2d
--- /dev/null
+++ b/wls-auth-service/src/main/resources/db/dummydata/h2/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql
@@ -0,0 +1,5 @@
+-- link MONITORING_HELPDESK
+INSERT INTO SECUSERS_SECAUTHORITIES (USER_OID, AUTHORITY_OID)
+SELECT id, '00000000-0000-0000-0003-000000000001'
+FROM WLSUSER
+WHERE wahlbezirkid is not null;
\ No newline at end of file
diff --git a/wls-auth-service/src/main/resources/db/dummydata/oracle/V15_1__insertDummyAdminClient.sql b/wls-auth-service/src/main/resources/db/dummydata/oracle/V15_1__insertDummyAdminClient.sql
new file mode 100644
index 0000000000..808d967938
--- /dev/null
+++ b/wls-auth-service/src/main/resources/db/dummydata/oracle/V15_1__insertDummyAdminClient.sql
@@ -0,0 +1,12 @@
+INSERT INTO OAUTH2_REGISTERED_CLIENT (ID, CLIENT_ID, CLIENT_ID_ISSUED_AT, CLIENT_SECRET,
+                                      CLIENT_SECRET_EXPIRES_AT, CLIENT_NAME,
+                                      CLIENT_AUTHENTICATION_METHODS, AUTHORIZATION_GRANT_TYPES,
+                                      REDIRECT_URIS, POST_LOGOUT_REDIRECT_URIS, SCOPES,
+                                      CLIENT_SETTINGS, TOKEN_SETTINGS)
+VALUES ('48d5545c-7338-41a0-9d90-54becc84d473', 'admingui', TIMESTAMP '2025-04-16 08:20:00.000000',
+        '{bcrypt}$2a$10$zCvSE.rK0Hb6MqkeKHwHzOMhCB5FW12XHOWEyRgiwDsj6i2CfvDj2', null, 'admin-gui-wahllokal',
+        'client_secret_basic', 'refresh_token,client_credentials,authorization_code',
+        'http://127.0.0.1:8080/oauth2/authorized,http://localhost:8084/login/oauth2/code/sso',
+        'http://localhost:39152/', 'openid',
+        '{"@class":"java.util.Collections$UnmodifiableMap","settings.client.require-proof-key":false,"settings.client.require-authorization-consent":true}',
+        '{"@class":"java.util.Collections$UnmodifiableMap","settings.token.reuse-refresh-tokens":true,"settings.token.x509-certificate-bound-access-tokens":false,"settings.token.id-token-signature-algorithm":["org.springframework.security.oauth2.jose.jws.SignatureAlgorithm","RS256"],"settings.token.access-token-time-to-live":["java.time.Duration",300.000000000],"settings.token.access-token-format":{"@class":"org.springframework.security.oauth2.server.authorization.settings.OAuth2TokenFormat","value":"self-contained"},"settings.token.refresh-token-time-to-live":["java.time.Duration",3600.000000000],"settings.token.authorization-code-time-to-live":["java.time.Duration",300.000000000],"settings.token.device-code-time-to-live":["java.time.Duration",300.000000000]}');
diff --git a/wls-auth-service/src/main/resources/db/dummydata/oracle/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql b/wls-auth-service/src/main/resources/db/dummydata/oracle/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql
new file mode 100644
index 0000000000..8a51aa6a2d
--- /dev/null
+++ b/wls-auth-service/src/main/resources/db/dummydata/oracle/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql
@@ -0,0 +1,5 @@
+-- link MONITORING_HELPDESK
+INSERT INTO SECUSERS_SECAUTHORITIES (USER_OID, AUTHORITY_OID)
+SELECT id, '00000000-0000-0000-0003-000000000001'
+FROM WLSUSER
+WHERE wahlbezirkid is not null;
\ No newline at end of file
diff --git a/wls-auth-service/src/main/resources/db/migrations/h2/V15_0__addAuthorityHelpdesk.sql b/wls-auth-service/src/main/resources/db/migrations/h2/V15_0__addAuthorityHelpdesk.sql
new file mode 100644
index 0000000000..3810f270a6
--- /dev/null
+++ b/wls-auth-service/src/main/resources/db/migrations/h2/V15_0__addAuthorityHelpdesk.sql
@@ -0,0 +1,2 @@
+INSERT INTO Authority
+VALUES ('00000000-0000-0000-0003-000000000001', 'MONITORING_HELPDESK');
\ No newline at end of file
diff --git a/wls-auth-service/src/main/resources/db/migrations/oracle/V15_0__addAuthorityHelpdesk.sql b/wls-auth-service/src/main/resources/db/migrations/oracle/V15_0__addAuthorityHelpdesk.sql
new file mode 100644
index 0000000000..3810f270a6
--- /dev/null
+++ b/wls-auth-service/src/main/resources/db/migrations/oracle/V15_0__addAuthorityHelpdesk.sql
@@ -0,0 +1,2 @@
+INSERT INTO Authority
+VALUES ('00000000-0000-0000-0003-000000000001', 'MONITORING_HELPDESK');
\ No newline at end of file
diff --git a/wls-gui-admintool/vite.config.ts b/wls-gui-admintool/vite.config.ts
index 667a7e95f1..4b92f39e47 100644
--- a/wls-gui-admintool/vite.config.ts
+++ b/wls-gui-admintool/vite.config.ts
@@ -34,7 +34,6 @@ export default defineConfig(({ mode }) => {
       }),
       vueDevTools(),
     ],
-    base: "/admintool/",
     server: {
       host: true,
       port: 8401,


Reviews:
user: login: coderabbitai[bot]
body: **Actionable comments posted: 0**

<details>
<summary>🧹 Nitpick comments (1)</summary><blockquote>

<details>
<summary>docs/src/technik/systemspecification/index.md (1)</summary><blockquote>

`62-62`: **Fix incomplete sentence at the end of the section.**

The sentence "Über die Apigateways wird der Zugriff auf die Backendservices." is incomplete. Consider revising it to something like:  
"Über die Apigateways wird der Zugriff auf die Backendservices ermöglicht."  
This will improve clarity and completeness.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: .coderabbit.yaml**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between fa5dd071b82bcee77d36bdf75a041290642555ac and 5e6619ec501b482b8a4a9e32786294b400dbd44a.

</details>

<details>
<summary>📒 Files selected for processing (15)</summary>

* `docs/src/technik/get_started/index.md` (1 hunks)
* `docs/src/technik/systemspecification/index.md` (1 hunks)
* `stack/.env` (1 hunks)
* `stack/docker-compose.yml` (3 hunks)
* `stack/docker-compose_latest-dev.yml` (3 hunks)
* `stack/gateway_config_admin/application-routes.yml` (1 hunks)
* `stack/gateway_config_wls/application-routes.yml` (0 hunks)
* `wls-auth-service/src/main/resources/db/dummydata/h2/V15_1__insertDummyAdminClient.sql` (1 hunks)
* `wls-auth-service/src/main/resources/db/dummydata/h2/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql` (1 hunks)
* `wls-auth-service/src/main/resources/db/dummydata/oracle/V15_1__insertDummyAdminClient.sql` (1 hunks)
* `wls-auth-service/src/main/resources/db/dummydata/oracle/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql` (1 hunks)
* `wls-auth-service/src/main/resources/db/migrations/h2/V15_0__addAuthorityHelpdesk.sql` (1 hunks)
* `wls-auth-service/src/main/resources/db/migrations/oracle/V15_0__addAuthorityHelpdesk.sql` (1 hunks)
* `wls-auth-service/src/main/resources/users.ldif` (1 hunks)
* `wls-gui-admintool/vite.config.ts` (0 hunks)

</details>

<details>
<summary>💤 Files with no reviewable changes (2)</summary>

* wls-gui-admintool/vite.config.ts
* stack/gateway_config_wls/application-routes.yml

</details>

<details>
<summary>🔇 Additional comments (18)</summary><blockquote>

<details>
<summary>stack/.env (1)</summary>

`1-2`: **Environment variable changes are clear and appropriate.**

The introduction of separate client IDs for WLS and Admin GUI is well-aligned with the updated architecture.

</details>
<details>
<summary>wls-auth-service/src/main/resources/db/migrations/oracle/V15_0__addAuthorityHelpdesk.sql (1)</summary>

`1-2`: **Authority migration is correct and safe.**

The script correctly adds the MONITORING_HELPDESK authority with a fixed UUID.

</details>
<details>
<summary>wls-auth-service/src/main/resources/db/migrations/h2/V15_0__addAuthorityHelpdesk.sql (1)</summary>

`1-2`: **H2 authority migration is correct and consistent.**

The script mirrors the Oracle migration and maintains cross-database consistency.

</details>
<details>
<summary>docs/src/technik/get_started/index.md (1)</summary>

`82-91`: **Role requirement documentation is clear and accurate.**

The added caution note clearly communicates the new role requirements for WLS and Admintool logins.

</details>
<details>
<summary>wls-auth-service/src/main/resources/db/dummydata/oracle/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql (1)</summary>

`1-5`: **Role linking script is correct and effective.**

The script efficiently links the MONITORING_HELPDESK authority to all relevant users.

</details>
<details>
<summary>wls-auth-service/src/main/resources/db/dummydata/h2/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql (1)</summary>

`1-5`: **SQL script correctly links MONITORING_HELPDESK role to all relevant users.**

The script is clear, aligns with the intended role assignment, and is safe for dummy data population.

</details>
<details>
<summary>wls-auth-service/src/main/resources/users.ldif (1)</summary>

`51-60`: **LDAP admin user and group membership correctly added.**

The new 'wls_admin' user entry and its inclusion in the 'user' group are correct and consistent with the rest of the file.



Also applies to: 69-69

</details>
<details>
<summary>wls-auth-service/src/main/resources/db/dummydata/h2/V15_1__insertDummyAdminClient.sql (1)</summary>

`1-13`: **Dummy admin OAuth2 client inserted correctly for H2.**

All required fields are present and values are appropriate for a dummy admin client.

</details>
<details>
<summary>stack/gateway_config_admin/application-routes.yml (1)</summary>

`1-54`: **Admin gateway routes are well-defined and follow best practices.**

Route definitions, path rewriting, and header management are correct and align with the intended architecture.

</details>
<details>
<summary>wls-auth-service/src/main/resources/db/dummydata/oracle/V15_1__insertDummyAdminClient.sql (1)</summary>

`1-13`: **Dummy admin OAuth2 client inserted correctly for Oracle.**

The script is correct, consistent with the H2 version, and suitable for dummy admin client registration.

</details>
<details>
<summary>docs/src/technik/systemspecification/index.md (1)</summary>

`5-62`: **Excellent architectural documentation and diagrams.**

The new "Systemarchitektur" section, diagrams, and explanations provide a clear and accurate overview of the system's structure and dependencies. This will be valuable for both developers and stakeholders.

</details>
<details>
<summary>stack/docker-compose.yml (3)</summary>

`240-271`: **Gateway split and configuration updates are correct and follow best practices.**

Renaming the gateway, updating environment variables, and mounting separate config directories improves clarity and maintainability. Healthchecks and security options are well configured.

---

`272-303`: **Addition of admin gateway is well-structured and consistent.**

The new `refarch-gateway-admin` service is correctly configured with its own environment, config, healthcheck, and security settings. This separation supports future scalability and security.

---

`373-382`: **Admin GUI service addition is correct and aligns with architecture.**

The new `wls-gui-admintool` service is properly configured and exposes the correct port. This matches the new frontend component described in the documentation.

</details>
<details>
<summary>stack/docker-compose_latest-dev.yml (4)</summary>

`240-271`: **Gateway split and configuration updates are correct and follow best practices (dev).**

The renamed gateway and updated configuration are consistent with the production setup and support a clean separation of concerns.

---

`272-303`: **Admin gateway addition is correct and supports modular development.**

The new `refarch-gateway-admin` service is properly configured for the development environment, mirroring production.

---

`373-382`: **Admin GUI service addition is correct and supports dev workflows.**

The `wls-gui-admintool` service is properly configured for development.

---

`383-393`: **Build-based admin GUI service is a helpful addition for local development.**

Providing a build-based variant (`wls-gui-admintool-by-build`) allows for rapid iteration and testing of local changes.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-16T07:56:20Z
user: login: vjohnslhm
body: es gibt aktuell über beide apigateways eine route auf das admintool (frontend-admintool und admintool in den application-routes.yml files), ist das beabsichtigt? nach der grafik in der doku sollte nur nur über das admingateway eine route zum admintool existiern.
state: CHANGES_REQUESTED
author_association: COLLABORATOR
submitted_at: 2025-04-22T14:48:07Z
user: login: vjohnslhm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-22T14:52:45Z
user: login: MrSebastian
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-22T14:58:17Z
user: login: MrSebastian
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-22T15:01:03Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 0**

<details>
<summary>🔭 Outside diff range comments (1)</summary><blockquote>

<details>
<summary>stack/docker-compose_latest-dev.yml (1)</summary><blockquote>

`256-288`: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Verify updated OAuth2 client environment variable usage**  
The `refarch-gateway-wls` service now sources its client ID from `${SSO_CLIENT_ID_WLS}` instead of `${SSO_CLIENT_ID}`. Please ensure:
1. `stack/.env` defines `SSO_CLIENT_ID_WLS` (and that there are no lingering references to `SSO_CLIENT_ID`).  
2. The `./gateway_config_wls` directory exists and contains the expected `application-routes.yml`.  


Run this script to confirm:

---

🏁 Script executed:

```shell
#!/bin/bash
# Verify new env var and config directory
grep -R "^SSO_CLIENT_ID_WLS=" stack/.env
test -d stack/gateway_config_wls && test -f stack/gateway_config_wls/application-routes.yml
```

Length of output: 157

---

🏁 Script executed:

```shell
#!/bin/bash
# Check for lingering SSO_CLIENT_ID definitions in .env
grep -R "^SSO_CLIENT_ID=" stack/.env

# Check for any SSO_CLIENT_ID references in the stack directory excluding the new _WLS var
grep -R "SSO_CLIENT_ID" stack | grep -v "SSO_CLIENT_ID_WLS"
```

Length of output: 572

---



</details>

**Address missing SSO_CLIENT_ID usages**  
We’ve confirmed `SSO_CLIENT_ID_WLS` is defined in `stack/.env` and `gateway_config_wls/application-routes.yml` exists, but there are still references to the undefined `SSO_CLIENT_ID` in your compose files. Please update or remove these:

• **stack/docker-compose.yml**  
  - SERVICE_CONFIG_OAUTH2_CLIENTS_WAHLLOKALGUI_ID: `${SSO_CLIENT_ID}`  

• **stack/docker-compose_latest-dev.yml**  
  - SERVICE_CONFIG_OAUTH2_CLIENTS_WAHLLOKALGUI_ID: `${SSO_CLIENT_ID}`  

Either define `SSO_CLIENT_ID=` in `stack/.env` or replace these with the correct variable (e.g. `${SSO_CLIENT_ID_ADMIN}`) so no undefined env vars remain.

</blockquote></details>

</blockquote></details>

<details>
<summary>♻️ Duplicate comments (3)</summary><blockquote>

<details>
<summary>stack/docker-compose.yml (3)</summary><blockquote>

`256-288`: **Duplicate: verify updated OAuth2 client environment variable usage**  
This block mirrors the changes in `docker-compose_latest-dev.yml`. Please refer to the prior comment for verification steps.

---

`289-321`: **Duplicate: validate admin gateway service configuration**  
Same as the development compose. Ensure the admin gateway’s `.env` entry and config files are in place.

---

`392-401`: **Duplicate: ensure admintool GUI service alignment**  
This addition matches the latest-dev compose. Confirm the GUI’s Vite config and docs have been updated accordingly.

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (8)</summary><blockquote>

<details>
<summary>wls-auth-service/src/main/resources/db/migrations/oracle/V15_0__addAuthorityHelpdesk.sql (1)</summary><blockquote>

`1-2`: **Specify target columns in INSERT statement.**

Relying on implicit column order can break migrations if the schema evolves. Explicitly listing the column names (e.g., `OID`, `NAME`) improves clarity and durability.


Apply this diff (replace `OID` and `NAME` with the actual column names):

```diff
-INSERT INTO Authority
-VALUES ('00000000-0000-0000-0003-000000000001', 'MONITORING_HELPDESK');
+INSERT INTO Authority (OID, NAME)
+VALUES ('00000000-0000-0000-0003-000000000001', 'MONITORING_HELPDESK');
```

</blockquote></details>
<details>
<summary>wls-auth-service/src/main/resources/db/migrations/h2/V15_0__addAuthorityHelpdesk.sql (1)</summary><blockquote>

`1-2`: **Specify target columns in INSERT statement for H2.**

As in the Oracle version, explicitly listing columns guards against unintended breakage when the table schema changes.


Apply this diff (replace `OID` and `NAME` with the actual H2 column names):

```diff
-INSERT INTO Authority
-VALUES ('00000000-0000-0000-0003-000000000001', 'MONITORING_HELPDESK');
+INSERT INTO Authority (OID, NAME)
+VALUES ('00000000-0000-0000-0003-000000000001', 'MONITORING_HELPDESK');
```

</blockquote></details>
<details>
<summary>wls-auth-service/src/main/resources/db/dummydata/h2/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql (1)</summary><blockquote>

`1-5`: **Consider making the insert idempotent to avoid duplicate role links**

Currently the statement will insert a new row for every user with a non-NULL `wahlbezirkid`, even if run multiple times. To prevent unique constraint violations or duplicate entries, wrap the `SELECT` in a `NOT EXISTS` check or use a `MERGE` statement. For example:

```diff
 INSERT INTO SECUSERS_SECAUTHORITIES (USER_OID, AUTHORITY_OID)
-SELECT id, '00000000-0000-0000-0003-000000000001'
-FROM WLSUSER
-WHERE wahlbezirkid is not null;
+SELECT w.id, '00000000-0000-0000-0003-000000000001'
+FROM WLSUSER w
+WHERE w.wahlbezirkid IS NOT NULL
+  AND NOT EXISTS (
+    SELECT 1
+    FROM SECUSERS_SECAUTHORITIES sa
+    WHERE sa.USER_OID = w.id
+      AND sa.AUTHORITY_OID = '00000000-0000-0000-0003-000000000001'
+  );
```

</blockquote></details>
<details>
<summary>wls-auth-service/src/main/resources/db/dummydata/h2/V15_1__insertDummyAdminClient.sql (1)</summary><blockquote>

`1-13`: **Make dummy client insertion idempotent to prevent conflicts**

This script always performs a raw `INSERT`, which can fail if it’s ever run more than once or if the record already exists. Consider guarding the insert with a check on `CLIENT_ID` (or using `MERGE`) to avoid duplicate key errors:

```diff
 INSERT INTO OAUTH2_REGISTERED_CLIENT (...)
-VALUES (...);
+SELECT ...
+WHERE NOT EXISTS (
+  SELECT 1
+  FROM OAUTH2_REGISTERED_CLIENT c
+  WHERE c.CLIENT_ID = 'admingui'
+);
```

Alternatively, use a `MERGE` statement on `CLIENT_ID` as the key. This will improve script robustness in development environments.

</blockquote></details>
<details>
<summary>stack/gateway_config_admin/application-routes.yml (1)</summary><blockquote>

`14-25`: **Verify and correct the path rewrite filter syntax**

The `RewritePath` filters use `/$\{urlsegments}`, which may not properly escape the `${...}` placeholder and should be anchored. I recommend switching to explicit arguments or using the correct escape sequence:

```yaml
- id: admin-service
  uri: http://kubernetes.docker.internal:8209/
  predicates:
    - Path=/api/admin-service/**
  filters:
    # Anchor the regex and escape with backslash before $
    - RewritePath=^/api/admin-service/(?<urlsegments>.*), /\${urlsegments}
```

Apply the same anchoring (`^/...`) and `\${...}` pattern to the other services (auth-service, basisdaten-service, etc.) for consistency and correct placeholder resolution.

</blockquote></details>
<details>
<summary>wls-auth-service/src/main/resources/db/dummydata/oracle/V15_1__insertDummyAdminClient.sql (1)</summary><blockquote>

`1-13`: **Add idempotence to the dummy client insert for Oracle**

Similar to the H2 version, this insert can cause errors if rerun. Wrap the `INSERT` in a conditional check or use an upsert strategy (`MERGE` in Oracle) on `CLIENT_ID` to avoid duplicates:

```sql
MERGE INTO OAUTH2_REGISTERED_CLIENT tgt
USING (SELECT 'admingui' AS CLIENT_ID FROM dual) src
ON (tgt.CLIENT_ID = src.CLIENT_ID)
WHEN NOT MATCHED THEN
  INSERT (...)
  VALUES (...);
```

This will ensure the script can run safely multiple times in development/test environments.

</blockquote></details>
<details>
<summary>docs/src/technik/systemspecification/index.md (2)</summary><blockquote>

`3-6`: **Clarify the issue link notation**

The standalone `🚧 -> <https://...>` line is ambiguous. Consider using a descriptive Markdown link:

```markdown
🚧 Siehe [Issue #741](https://github.com/it-at-m/Wahllokalsystem/issues/741) für Details.
```

---

`60-63`: **Use spelled‑out numbers for German prose**

For consistency with German writing conventions, spell out small numbers in text. Replace “3” with “drei”:

```diff
-Das WLS besteht aus 3 Arten von Komponenten.
+Das WLS besteht aus drei Arten von Komponenten.
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: .coderabbit.yaml**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 216b08b1e7e90973a79438ee5e6b73be2148398d and 2818193f572e2fa8426ea9fcfbcb6c7a4d0b28a6.

</details>

<details>
<summary>📒 Files selected for processing (14)</summary>

* `docs/src/technik/get_started/index.md` (1 hunks)
* `docs/src/technik/systemspecification/index.md` (1 hunks)
* `stack/.env` (1 hunks)
* `stack/docker-compose.yml` (3 hunks)
* `stack/docker-compose_latest-dev.yml` (3 hunks)
* `stack/gateway_config_admin/application-routes.yml` (1 hunks)
* `stack/gateway_config_wls/application-routes.yml` (0 hunks)
* `wls-auth-service/src/main/resources/db/dummydata/h2/V15_1__insertDummyAdminClient.sql` (1 hunks)
* `wls-auth-service/src/main/resources/db/dummydata/h2/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql` (1 hunks)
* `wls-auth-service/src/main/resources/db/dummydata/oracle/V15_1__insertDummyAdminClient.sql` (1 hunks)
* `wls-auth-service/src/main/resources/db/dummydata/oracle/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql` (1 hunks)
* `wls-auth-service/src/main/resources/db/migrations/h2/V15_0__addAuthorityHelpdesk.sql` (1 hunks)
* `wls-auth-service/src/main/resources/db/migrations/oracle/V15_0__addAuthorityHelpdesk.sql` (1 hunks)
* `wls-gui-admintool/vite.config.ts` (0 hunks)

</details>

<details>
<summary>💤 Files with no reviewable changes (2)</summary>

* wls-gui-admintool/vite.config.ts
* stack/gateway_config_wls/application-routes.yml

</details>

<details>
<summary>🔇 Additional comments (5)</summary><blockquote>

<details>
<summary>docs/src/technik/get_started/index.md (1)</summary>

`88-90`: **Documentation aligns with new role requirements.**

The added caution clearly indicates that `WLS_WAHLVORSTAND` is required for the WLS login and `MONITORING_HELPDESK` for the Admintool. Anchors and formatting look correct.

</details>
<details>
<summary>stack/.env (1)</summary>

`1-2`: **Confirm environment variable handling for multiple OAuth2 clients.**

You’ve separated client IDs into `SSO_CLIENT_ID_WLS` and `SSO_CLIENT_ID_ADMIN`, which is great. However, there’s only one `SSO_CLIENT_SECRET`. Please verify whether both clients share the same secret or if you need distinct secrets (e.g., `SSO_CLIENT_SECRET_WLS` and `SSO_CLIENT_SECRET_ADMIN`) to avoid ambiguity and potential security risks.

</details>
<details>
<summary>wls-auth-service/src/main/resources/db/dummydata/oracle/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql (1)</summary>

`1-5`: **Ensure H2 dummy data script is also provided.**

This Oracle script correctly links the `MONITORING_HELPDESK` authority to WLS users. To keep environments in sync, please confirm that you’ve added an equivalent H2 dummydata script at `src/main/resources/db/dummydata/h2/V15_2__linkMonitoringHelpdeskRoleToWlsAllUsers.sql`.

</details>
<details>
<summary>stack/docker-compose_latest-dev.yml (2)</summary>

`392-401`: **Ensure admintool GUI service alignment**  
The `wls-gui-admintool` service is exposed on port `8401`. Confirm that:
- The Vite config in `wls-gui-admintool/vite.config.ts` has removed any `base` path (per PR summary).  
- Documentation (e.g., README, get_started guide) has been updated to reference `http://localhost:8401` and the new service name.

---

`289-321`: <details>
<summary>✅ Verification successful</summary>

**Validate admin gateway service configuration**  
The new `refarch-gateway-admin` service uses `${SSO_CLIENT_ID_ADMIN}` and mounts `./gateway_config_admin`. Please verify that:
1. `stack/.env` includes `SSO_CLIENT_ID_ADMIN` with the correct value (e.g., `admingui`).  
2. `stack/gateway_config_admin/application-routes.yml` is present and properly defines admin routes.  


You can run:

---

🏁 Script executed:

```shell
#!/bin/bash
# Check for admin OAuth2 client and routes file
grep -R "^SSO_CLIENT_ID_ADMIN=" stack/.env
test -d stack/gateway_config_admin && test -f stack/gateway_config_admin/application-routes.yml
```

Length of output: 170

---



</details>

**Admin gateway configuration verified**  
Both required checks passed:  
- `SSO_CLIENT_ID_ADMIN` is defined in `stack/.env` (`admingui`).  
- `stack/gateway_config_admin/application-routes.yml` exists and provides the admin routes.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-22T15:04:33Z
user: login: vjohnslhm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-22T15:05:46Z
user: login: vjohnslhm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-22T15:05:49Z
user: login: MrSebastian
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-22T15:39:03Z
user: login: MrSebastian
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-22T15:40:11Z
user: login: MrSebastian
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-22T15:48:59Z
user: login: MrSebastian
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-22T15:51:33Z
user: login: MrSebastian
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-22T15:53:47Z
user: login: vjohnslhm
state: CHANGES_REQUESTED
author_association: COLLABORATOR
submitted_at: 2025-04-23T07:25:02Z
user: login: MrSebastian
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-23T07:43:12Z
user: login: vjohnslhm
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-04-23T08:21:17Z

Review comments:
diff_hunk: @@ -85,6 +85,10 @@ flowchart LR
 | wls_all_bwb | test     | Ein Benutzer mit allen Rechten mit der WahlbezirksArt BWB (Briefwahl) |
 | wls_all_uwb | test     | Ein Benutzer mit allen Rechten mit der WahlbezirksArt UWB (Urnenwahl) |
 
+> [!CAUTION]
+> Für die Anmeldung am WLS muss der User die Rolle `WLS_WAHLVORSTAND` haben.
+> Für die Anmeldung am Admintool muss der User die Rolle `MONITORING_HELPDESK` haben.
path: docs/src/technik/get_started/index.md
user: login: vjohnslhm
body: gibt es irgendwo eine übersicht, welche rollen es alles gibt und welche berechtigungen welchen rollen zugeteilt sind?
created_at: 2025-04-22T13:18:29Z
author_association: COLLABORATOR
diff_hunk: @@ -1,3 +1,62 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> external[System zur Wahlverwaltung]
path: docs/src/technik/systemspecification/index.md
user: login: vjohnslhm
body: ```suggestion
    Wahllokalsystem --> external[externes System zur Wahlverwaltung]
```
für mich sehen die beiden pfeile gleich aus, wodurch macht sich das `external` für das System zur Wahlverwaltung bemerkbar?

![grafik](https://github.com/user-attachments/assets/8c36177c-6aaa-4206-b3c2-52eee449e607)

created_at: 2025-04-22T14:08:42Z
author_association: COLLABORATOR
diff_hunk: @@ -1,3 +1,62 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> external[System zur Wahlverwaltung]
+    Wahllokalsystem --> LDAP
+```
+
+Damit das Wahllokalsystem betrieben werden kann, wird ein externes System benötigt. Dieses stellt Informationen
+zu den Wahlen bereit, welche durch das WLS unterstützt werden sollen.
+
+LDAP wird zur [Authentifizierung](security#authentifizierung) der Benutzer verwendet,
+
+### Komponenten des WLS
path: docs/src/technik/systemspecification/index.md
user: login: vjohnslhm
body: gibt es irgend eine möglichkeit bei diesem graph zu verhindern dass die pfeile und beschreibungen überlagert werden? 
![grafik](https://github.com/user-attachments/assets/c4dbd13e-d5d8-4950-9aa2-2f6049c7e0f8)


created_at: 2025-04-22T14:12:29Z
author_association: COLLABORATOR
diff_hunk: @@ -1,3 +1,62 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> external[System zur Wahlverwaltung]
+    Wahllokalsystem --> LDAP
+```
+
+Damit das Wahllokalsystem betrieben werden kann, wird ein externes System benötigt. Dieses stellt Informationen
+zu den Wahlen bereit, welche durch das WLS unterstützt werden sollen.
+
+LDAP wird zur [Authentifizierung](security#authentifizierung) der Benutzer verwendet,
+
+### Komponenten des WLS
+
+```mermaid
+
+flowchart TD
+
+    subgraph Wahllokalsystem    
+        subgraph Frontends
+            wls[Wahllokalsystem UI]
+            admin[Admin UI]
+        end
+    
+        subgraph Apigateways
+            apiGwWls[ApiGatewayWls]
+            apiGwAdmin[ApiGatewayAdminTool]
+        end
+    
+        subgraph Backendservices
+            ms1[Microservice 1]
+            ms2[Microservice 2]
+            ms3[Microservice 3]
+            msn[Microservice N]
+        end
+    end
+
+    wls --> apiGwWls
+    admin --> apiGwAdmin
+
+    apiGwWls --> ms1
+    apiGwWls --> ms2
+
+    apiGwAdmin --> ms2
+    apiGwAdmin --> ms3
+
+    ms2 --> msn
+    ms3 --> msn
+```
+
+Das WLS besteht aus 3 Arten von Komponenten. Die Frontends stellen das Userinterface für die Benutzer.
+Die Backendservice setzen die Anwendungslogik um und kümmern sich um die Datenhaltung. Über die Apigateways
+wird der Zugriff auf die Backendservices ermöglicht.
path: docs/src/technik/systemspecification/index.md
user: login: vjohnslhm
body: ```suggestion
Das WLS besteht aus 3 Arten von Komponenten. Die **Frontends** stellen das Userinterface für die Benutzer dar.
Über die **Apigateways** wird der Zugriff auf die **Backendservices** ermöglicht, welche die Anwendungslogik 
umsetzen und sich um die Datenhaltung kümmern.
```
created_at: 2025-04-22T14:16:43Z
author_association: COLLABORATOR
diff_hunk: @@ -1,3 +1,62 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> external[System zur Wahlverwaltung]
+    Wahllokalsystem --> LDAP
+```
+
+Damit das Wahllokalsystem betrieben werden kann, wird ein externes System benötigt. Dieses stellt Informationen
+zu den Wahlen bereit, welche durch das WLS unterstützt werden sollen.
+
+LDAP wird zur [Authentifizierung](security#authentifizierung) der Benutzer verwendet,
+
+### Komponenten des WLS
+
+```mermaid
path: docs/src/technik/systemspecification/index.md
user: login: vjohnslhm
body: ich würde die verbindung von backend service zu datenbank noch darstellen
created_at: 2025-04-22T14:52:45Z
author_association: COLLABORATOR
diff_hunk: @@ -1,3 +1,62 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> external[System zur Wahlverwaltung]
path: docs/src/technik/systemspecification/index.md
user: login: MrSebastian
body: Es definiert welche Wahlen, Wahlvorschlaege, Wahlbezirke usw. es gibt.

Aus des WLS sind beide außerhalb da sie nicht zum Anfang des WLS gehören. Ich könnte ein `depends on`, `uses` oder `require` auf den Pfeil schreiben.
created_at: 2025-04-22T14:58:17Z
author_association: MEMBER
diff_hunk: @@ -1,3 +1,62 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> external[System zur Wahlverwaltung]
+    Wahllokalsystem --> LDAP
+```
+
+Damit das Wahllokalsystem betrieben werden kann, wird ein externes System benötigt. Dieses stellt Informationen
+zu den Wahlen bereit, welche durch das WLS unterstützt werden sollen.
+
+LDAP wird zur [Authentifizierung](security#authentifizierung) der Benutzer verwendet,
+
+### Komponenten des WLS
+
+```mermaid
path: docs/src/technik/systemspecification/index.md
user: login: MrSebastian
body: Das hätte ich eher in #848 gesehen. Ich kann dies gerne noch explizit in das Issue aufnehmen.
created_at: 2025-04-22T15:01:02Z
author_association: MEMBER
diff_hunk: @@ -1,3 +1,62 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> external[System zur Wahlverwaltung]
path: docs/src/technik/systemspecification/index.md
user: login: vjohnslhm
body: wenn beide gleich als externe Systeme behandelt werden, würde ich das `external[...]` im mermaid code entweder weg lassen, oder bei beiden dazu schreiben. eine extra beschriftung der pfeile wird denke ich nicht benötigt.
created_at: 2025-04-22T15:05:46Z
author_association: COLLABORATOR
diff_hunk: @@ -1,3 +1,62 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> external[System zur Wahlverwaltung]
+    Wahllokalsystem --> LDAP
+```
+
+Damit das Wahllokalsystem betrieben werden kann, wird ein externes System benötigt. Dieses stellt Informationen
+zu den Wahlen bereit, welche durch das WLS unterstützt werden sollen.
+
+LDAP wird zur [Authentifizierung](security#authentifizierung) der Benutzer verwendet,
+
+### Komponenten des WLS
+
+```mermaid
path: docs/src/technik/systemspecification/index.md
user: login: vjohnslhm
body: ja gerne 👍🏽 
created_at: 2025-04-22T15:05:49Z
author_association: COLLABORATOR
diff_hunk: @@ -1,3 +1,62 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> external[System zur Wahlverwaltung]
+    Wahllokalsystem --> LDAP
+```
+
+Damit das Wahllokalsystem betrieben werden kann, wird ein externes System benötigt. Dieses stellt Informationen
+zu den Wahlen bereit, welche durch das WLS unterstützt werden sollen.
+
+LDAP wird zur [Authentifizierung](security#authentifizierung) der Benutzer verwendet,
+
+### Komponenten des WLS
path: docs/src/technik/systemspecification/index.md
user: login: MrSebastian
body: Ich habe nichts gefunden was wirklich gut funktioniert. Man könnte an den Farben und somit an der Transparenz etwas machen. Ich denke aber wenn ich ein 4. Element einfüge hilft das auch:

![grafik](https://github.com/user-attachments/assets/24ebede1-dc61-44c2-9bc7-49b84039e7a1)

created_at: 2025-04-22T15:39:03Z
author_association: MEMBER
diff_hunk: @@ -1,3 +1,62 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> external[System zur Wahlverwaltung]
+    Wahllokalsystem --> LDAP
+```
+
+Damit das Wahllokalsystem betrieben werden kann, wird ein externes System benötigt. Dieses stellt Informationen
+zu den Wahlen bereit, welche durch das WLS unterstützt werden sollen.
+
+LDAP wird zur [Authentifizierung](security#authentifizierung) der Benutzer verwendet,
+
+### Komponenten des WLS
+
+```mermaid
path: docs/src/technik/systemspecification/index.md
user: login: MrSebastian
body: ist mit aufgenommen
created_at: 2025-04-22T15:40:11Z
author_association: MEMBER
diff_hunk: @@ -85,6 +85,10 @@ flowchart LR
 | wls_all_bwb | test     | Ein Benutzer mit allen Rechten mit der WahlbezirksArt BWB (Briefwahl) |
 | wls_all_uwb | test     | Ein Benutzer mit allen Rechten mit der WahlbezirksArt UWB (Urnenwahl) |
 
+> [!CAUTION]
+> Für die Anmeldung am WLS muss der User die Rolle `WLS_WAHLVORSTAND` haben.
+> Für die Anmeldung am Admintool muss der User die Rolle `MONITORING_HELPDESK` haben.
path: docs/src/technik/get_started/index.md
user: login: MrSebastian
body: Es gibt ein Issue in der Icebox wo es drunter fallen könnte: #329 
created_at: 2025-04-22T15:48:59Z
author_association: MEMBER
diff_hunk: @@ -1,3 +1,62 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> external[System zur Wahlverwaltung]
+    Wahllokalsystem --> LDAP
+```
+
+Damit das Wahllokalsystem betrieben werden kann, wird ein externes System benötigt. Dieses stellt Informationen
+zu den Wahlen bereit, welche durch das WLS unterstützt werden sollen.
+
+LDAP wird zur [Authentifizierung](security#authentifizierung) der Benutzer verwendet,
+
+### Komponenten des WLS
path: docs/src/technik/systemspecification/index.md
user: login: MrSebastian
body: fixed mit 43859c0f5c7449b2def9bef08f81177e0e455a21
created_at: 2025-04-22T15:51:33Z
author_association: MEMBER
diff_hunk: @@ -1,3 +1,62 @@
 # Systemspezifikation vom Wahllokalsystem
 
 🚧 -> <https://github.com/it-at-m/Wahllokalsystem/issues/741>
+
+## Systemarchitektur
+
+### Übersicht der Systeme
+
+```mermaid
+
+flowchart LR
+
+    Wahllokalsystem --> external[System zur Wahlverwaltung]
path: docs/src/technik/systemspecification/index.md
user: login: MrSebastian
body: wie wäre es mit `electionManagementSystem`: 10007584d6b35e639ccdc3d8512074b7aa402b74
created_at: 2025-04-22T15:53:47Z
author_association: MEMBER
diff_hunk: @@ -1,4 +1,5 @@
-SSO_CLIENT_ID=wls
path: stack/.env
user: login: vjohnslhm
body: `${SSO_CLIENT_ID}` kommt in beiden docker-compose files noch beim auth service vor
created_at: 2025-04-23T06:50:36Z
author_association: COLLABORATOR
diff_hunk: @@ -1,4 +1,5 @@
-SSO_CLIENT_ID=wls
path: stack/.env
user: login: MrSebastian
body: die var wurde mit c77aa0fffd6b381652b2323013291292c55d95a4 in `SSO_CLIENT_ID_WLS` angepasst
created_at: 2025-04-23T07:43:12Z
author_association: MEMBER

PR comments:
user: login: coderabbitai[bot]
created_at: 2025-04-16T07:55:04Z
body: <!-- This is an auto-generated comment: summarize by coderabbit.ai -->
<!-- This is an auto-generated comment: skip review by coderabbit.ai -->

> [!IMPORTANT]
> ## Review skipped
> 
> Auto incremental reviews are disabled on this repository.
> 
> Please check the settings in the CodeRabbit UI or the `.coderabbit.yaml` file in this repository. To trigger a single review, invoke the `@coderabbitai review` command.
> 
> You can disable this status message by setting the `reviews.review_status` to `false` in the CodeRabbit configuration file.

<!-- end of auto-generated comment: skip review by coderabbit.ai -->
<!-- walkthrough_start -->

## Walkthrough

This update introduces several changes across documentation, configuration, and database migration files. In the documentation, new sections and caution notes have been added to clarify system architecture and user role requirements. Environment variables for OAuth2 client IDs are now split into `SSO_CLIENT_ID_WLS` and `SSO_CLIENT_ID_ADMIN`, with corresponding updates in the `.env` file. The Docker Compose configurations have been expanded: the gateway service is renamed to `refarch-gateway-wls`, a new `refarch-gateway-admin` service is introduced, and services for the WLS admin tool GUI are added. Gateway route configurations are separated for WLS and admin, with new routing and path rewriting rules. Database migration scripts introduce the `MONITORING_HELPDESK` authority, assign it to specific users, and add a dummy OAuth2 admin client for both H2 and Oracle databases. Lastly, the Vite configuration for the admin tool GUI removes the base path setting. No changes were made to exported or public code entities.

## Assessment against linked issues

| Objective                                                                                          | Addressed | Explanation                                                                                  |
|--------------------------------------------------------------------------------------------------|-----------|----------------------------------------------------------------------------------------------|
| Provide the overall system architecture showing interaction of GUI, API Gateway, Backend, DB, LDAP (#845) | ✅         | New "Systemarchitektur" documentation section with detailed component diagrams and descriptions added. |
| Include the Admin-GUI as part of the stack with a Docker container running the latest image (#906) | ✅         | New `wls-gui-admintool` service added in `docker-compose.yml` and `docker-compose_latest-dev.yml` using the latest image. |

<!-- walkthrough_end -->
<!-- internal state start -->


<!-- DwQgtGAEAqAWCWBnSTIEMB26CuAXA9mAOYCmGJATmriQCaQDG+Ats2bgFyQAOFk+AIwBWJBrngA3EsgEBPRvlqU0AgfFwA6NPEgQAfACgjoCEYDEZyAAUASpETZWaCrKNwSPbABsvkCiQBHbGlcSHFcLzpIACIATgAGADZIAA4AFgBWSABVblpqDwBlXDQGAGtIR0gAQVpmeAwAcWwddkReUVgyegAteBIvZwYEGjLcbApoyDlKxEpIAFkKQpIBNERxTAAaSAxHAUoogEYAJnijnew8guRcLvtZDZJmdAph9VFx/3QMelp8BiOdjUeD4DAaGD3ABmFDBNF+yGcHgw+AA7jxYRJ4Ep6HdYdgiLB0PYSNxnAVIEQCqi0LIdmgvPAiBgGkRIKj1ES7h5ARR/BhQph6FC8BMPEMRp8xRD3JB/oC2AKQWDILB1tMSGRKtcaPRSkwKLRWV46SgMAwvNgjRg2WhaEJsBtFbhkP5BrqwvgUIgHB4zOkMhCAJKhdqieBQ/q3NWhR2UZDMR2hNVSYlhhjwBl+fCRT2QLz4NkNdmcsL3C39AWQKH4PjcynU2ky+5rcrdOUAoFK8QqtUyTVYK75XU7GFw9vyrslHtYRkYMrIFMeA5a4aiMp0em/auwgUTzvO5VYPvoLyIL0rwc6ujN1Dcby+fxBEKMAtzZBIX3IMwJZJCyD+pkzYeLY3roBI2iDAIuY1nw/hYiQ6LUKquC4NwiAcAA9JhRCctgAgaEwzCYeoYDUGAxEAOpoLAPj4GUDKII8NDEfePiYac5waEY+jGOAUDtvgUI4AQxBkMoHpEc6XC8PwwifJI0jTPITBKFQqjqFoOi8SYUBwKgqCYCJhCkOQVCSSw0l+Gg6IOE4LjKQoakqGomjaLoYCGHxpgGPKiCYYgbyYTQwwsmUOEkLgAD6GzOLqJG/CQAAeGjMLQHAGNEWUGBYNRBmJZkFPQdnMM48hCYwao2tIRjVIwaB4KCWAojQ7LqnaOIagW6L1nGdYqLmxb1tEABCZB4AAXpQUwABTZHMFCIAAlCSYhNfY3DhlCsistmuZPi0/jOsgsH5oWDRcH1CZJqqaCpvWsK5gABpRAAyhRRZR1QABKvQAagA8jYhTQNUAByAAiT15gWRYCl69ZvYUDxPC8/4PTmHhPQsANg0G0BA0GYONFF30AKKvVYENk4UADS0MEGdcOM/WtT1PDOYQmDXr4NyfDDJgpC3Aj9x9fmSChLW9gTPivy7Uwe5VqihyQKVSjcUYOWWNUXg0OZTXC2WHhKBa5IzsgFXJdwtYelL97QfADCQOw6hRkY3PkNxWXRDxPl+QFQUhbAYUBcxzzphGjtHglSgpWlGXe1reUFRJUQlWV/DCQL1WILVuyITEhRh6VbySmMExTHMa0qjSiK0J1LP3NRtEFgxZ7Fx2CrAjOt7IFXM4KEqDS3KiXoOAI/cG1w0QADsHItjuwKEamQEXqMkFM/7RLTLDW+QitykpSMaFMsqRotob4ZPKoNBaVpKWgiyUKV2LVt1AsUKGsBortiM0XRbcmKowAOTICUJtRK5ooz8CwEZZKesMBZgGApFUpVEGkGdCjFiPx6CvQhtUKw1YpZiwatyAUUce6Qg8DQJKoRTYUEjkpO4yF6zwMoIg3wQDsG8HwFiJQyBkHVywMOR+/48EELAnGYUUtSFdHIQwEENpZjxmAqtMExUr4oKwB0OYApEQtS6HwBYz9tDCnfmqT+KAfBJn1ko+sDQEFZg2BQbAYgxSZyNpAZuADGLFx2EaPhu11Bmkbv4Hku8wTsEpPidCXAABiu54S0GQDNbxrdfGoxyEGHBNQ6jFmyEGJaOxqjcCZI2R4kAZolPgI0cplEzw5OqbUmgNJZBswaNAfAOYik5JGqUDcCJKBYgYEpGaiZdbwG4LmeoDBYQLWGdIJaqioTmLiofUpYgPx7ioEIng1BYDIFRIYjwY5FbJMHuQMQeZuTwDgtITaa1UwEOyVSFptJEA7COYvbMeAPAHRCIbVsAz6AzLmUMx20hPmlnPGwVWjswUUAWSdWsNJDS7X+RsQ2vNDGIFUfqXemAdp2PgYfRAsz4AHGjH8zGFthLcjmAoZge82hcFOUk5APC+EeDFg4ygUJSiQumP09s8yIUfiZZETBAhHQNGkMgWGjsckiNVpgNAGD2BbnoM8hsbyKlsCNBSfUcq8xApFeCkZuLNZJx1nrI8ht6wm0GPrMEtLnZJWtp/KIdt8KMidi7cQNUDAexIKo7OQtXgeHvG6eQk5DwDw6q7F1JY7j4DwKrRQkcFHmzzKpDw3qHZO21Y6s2BsvbZQMBAMARhYrlEwhoMgEgE7ZVytUfKplU4aPsuVLOVUhZuHuA225YJMEQQYQNLGhRCgAyigAYVekGMmYNoBRSDFDNqroyBoH1XmJ6k7p1zoXUuldENPrvWhv+R+5B0SDt3CO5wmZoITqnbO+di7l2rqitUCGCwibQ1rugeuUQOR3E8RBS0WM7TsyIC0J6EIAZ82dhgLEt6omjofZEDdL9Bzml7Tecw2tdYSQNtc+4xbnUYFdVbG2Xq+D219Yh8IbsK2QDJkhodGA71jsfX4Td+quC7ufQet9x7oaACTCSAAn92vqPR+pG0NixPRreFetSGnrMdY8h4dqH73joAzifje6X2HvfSer9P6wbyawIpkotaVMSDU4nCtPklOYXlBuCgYAiLWzmBoWQzAvBNp9i2tt4lzJp0cCXbtlVBaBtlMlCWu1RUjIk/4flpdiDlL/eqfkW6oiMyeqliUGXdVgFRGeP9pY4Hut9cEhWJRZV8EQbCp6ZXEBgEK+l15iFaSlfK8GF0kAAbVDwLAE4r5KyhFXYhzTHHtNcdzP+sNUQxwvCegAEgAN6GaEzJiGABfBmXp1tbcE9Jkzp7CgHc1Z45gqa9z0AVpGaD5HIASBzECPZIH/1DiKjuFgEmNA4XKVFR7TJDsA6B7qkHYIntRVa7B3JRoZxOMiuIG0hyVYdTyyLVAOXt1JZIFwYJKJr3VcduoE06BUKlC6Pa+4inzXSGhuQXAo8KBlB2LfS0/CfhutwFQVU+ANgqu4KUpRp0nplHwuwyK0gNBucoBoXlFAOHg6et/DYxXuuyCev4kgkZyCIlVCQBkdw1zlGTUSZXYGdjiDYKm3AOx/D86jDsWKljNoMMUNdx+vJfBSXRl6KQDDtriykIbj5OS0Ci8ZA/VaEx1DlW4APRmRpEAMm6vndEvBJDwEiELDWdUr0kkRRClL+uitddaWRPJGAstbP54oVxQHSx1e0GZXYuWJOtfaxXzr5Sa/s117MX+9x0+wvgKVUg6AqU6u1yXhZ/W3XeaUh60IKR4jpBF5tXEXoN8b7d5FARbGUNVjQ+Ovuk+8/OBI383jUQq+0mmGmuMyBjvbbO8ez936iYHaIXWe4IbEbMbCsKJVda7W7bAPRNMUkM2cJDAJ7CYI8V7d7ZrQHR/WQaHBApkKKSDBoBHEMU8c8KnGzWnW/CTAnRAZnSKNnDnM0O+HnescfDweBAXDXUIUqUXVkHYLoU3WAc3Og/8KuBPXAJPbNdUB6e/egDAhfCFQveuRNDhE0ekLPSARoApWQ5LFrM8YgFoQfBxLpLwevPTFvEDNvBrTvZrHvaDeAfQjmIwp3KAlkOxe4SfNVLGGkFueiDJFiXrNrGwuwggHMDgd0EIYfKjRAXaNfVINIc4bfbHVITfeIa7UHZ7UwrkMfLvVgx+dgnJFnWgkkVCVkREC2BDdQ7JSgjWbmfgBDSg/gfmGHJkJA7NZWb4W7I0SMPDTWFtQjcjOnY2UQJ1O1DxKjT1egfNejf1JjKAFYUvZLPHOgfjDrYYLXVpMTcvNLFYjAvwyzCgmzcKBXDzLzIXENPzIw5jWYhZEw9KDYyvAfPAuvM0PY/pVzAEdzTzCJHzM4tTGYxna4/jawvQh4oIowp46zF4w4j4plE43zfzBzctStatfY14tsI4z4kgKKUIzXJQCQWEgLTKZtbWELQqD0dOByCqJbXOAwOLJKBLJRAnW4/vXVYwhY3fRkrYgfeHS3XnK2GrOhOEdveYJrDwnQ5Y2AVYnreHfrZAIAu4EA2PKsKbG9LTM/HTbjRbXDYUWEVbTbD/YzY9P/fLXU07fU2Td6K7HJesSA+7QeRAl7I0fwMQWseQb7a8LU/7WDSHbXLAp7NXdA4HVIuHPrRHRQrMVI5o9af9LHNku4XHKQzQkgTnc0bnXaXk8nUIfI2sCodYSI5kTBGaBnOYpnHpKrfnHIoXDg6PMXNkCXKXeeFnOXQ4pXbZVXHddgiUnXFQ3g3WfgroC3YDIkJQA3KIa3BkW3SfEgB3J3SKBhQVd3UIT3UEWgH3RgCYf3SydGEIUfDwRkcPY1boa2BxFc4QhhUQ/gZPdaVPJADPNEVQnPLEfPOXPOYvBkgrPvDkkrB44whxWEWgZvegGVFwjwZglAKfcUWfGQgnKFMwgUiw4U7vUU988U7Yr8pfCI1fG2RI9IQ/AbZU2bVU+bJSSI+oJ1cgmQ6VWMd8CTY0qTU00zH/MGP/U6esWU0bcbMAiGCAu7AbT0jAn0nAr8mfFAAbcM+025T4Z0pfRiL0Lne+WfECzM9nHYbIwXTFHgk3HsgQ67E8xPc88Q2fVkufVpBMwvVQ18wE2w4Eww4w6M6CokcwjveC7Q/woE2vEE4fNiOcNkesLE3AMAHE0C9wnJCIqIzC9ILiSAQg2SxggdWhNgis7fXaf8VABWS5D0RuLGSg6g1nLMqonmWoxnC2Bo7A57YY1ojwdoxhWgDWfDGoXo4YjKw+ehYYy2d1ajcY2jH1RVKYwNX4osnjYUm4t8zY5CzLSAcTYau4krLkhTFzSE44uYTEm4PynEvEn41eP46MpYpCjsuw3Y8E2tea9EpamgbEkgXE74i4zawDIaiywI6ysEuat4ygKElfE6kIfy86tagkn2JzKtAwFzPiwMh4zCKs31I8drB3OXM4wLa1YkjtaWLtDxSk58guQoHPJRGdAsK0NQ8pW0pol7SMQaOuTqIchoXacZcQKZalX5RK9Hf/XnbVDAiEMmGnH5VqE8R+KA+AZ8SKzi4kEoCgUgUIbIGwbJQ88hOxGSlsrMWmaXFXWXZACGZ6vgOolUCOSMJ2NfSPf8DoI0LNJSUqXAd4JRW+FgdFQIYIYXMkO4XFKhdmpSaK4C88ekWvMAKCkScUj2tYSIxAYcMgd2xnHYAQWEO0BRTXD2ygUgAQFkRANgLwP8m0QOospMmsNBdw50ZOhZa7Nlboe6zmSAOJGRHwB2gRJKEZZPP7M5fOrwUcPPPWDdVEU86he4DFBc/ZRyI6XhbchMjEfXeAJKHJWCVFa0by1u54dvKIjuuYIgY6cg01bcAnVRH0L0C9EbLOsvfEU6vTUMnweQLu1MNunJfwdoF1cJeifoY3O0eMPMDocPfki+k5FFZwUe5ZRJPOqynMB2lVY2sgjPT7A5S3B3H4eQImhu9AGPfoaqyEFKxo0qgeTdR9V0B3JK7cG2okfwJu12cXKWSmyZXMBekFeFE4os6MfEQkYkbmzorVKwF5cpGq61eq7NRqsjFq4SUY22TqgtBjV2XqyAMGAuIm8UG6/jQGgMuB3A2vUGyBrNJqSG35XFb4weerZwtkdGhhTG7G+gZpefLegYg3RQw5UsPRvmyPUWoMSPPWihQVf8MBlRH632f6sRqHQM1raRqZChORvRxR/zWG4LFOMLTtSLZG3DKk2UEx0S4Y5i0eBMyPJ6B4jekZc9bcJ6E3WwgnYfJcDULUA+5bbUzxeJmRiG7xta6sPPENGBrZBgphLoW5b+p6bEYfJ6BPJpqxg2qgn+k2tkdB5AKAleJ6aR+AUGt2gnTCAAKjGeSfoAGejyGbScSZIHGcmeu3rBzIBEzA9CehsEQmbqsH2WhjscWjLGQkwdhFakkOfGtv2RkHkGcUmWrM8QZI6EjBSn4fysMW/siezSlkOYx2+CW2qtqptSIyTRYcGJLSTVarXxo08G4Z6qpODTLV+sRIMB71kQWYDgYEwiw0whPtTTeGkFcwEFcwi1kBEUwlG0wj+iOAyCiiOCiiimHkoFwAhlJfaQwCxomw0EQACHxMTn8fbUCcRuCYpNCdRvREKAAEVXp7ByVK7DIbq8wmXLFH4/zWB5BWKxt/BcInh/AHsFTQhHTax6ADCCmhtshoBvoTgoobAyZGggwQYyZbWT0dtoAGZx1VFlXJIDXbojcXmohsgCkIYhL1BkAptkqPwlByFqHHJ6xQDFTg3ogHibDohQ0fWq5ncwINhawoh2pphZlZBK6+xYA02JtpZRcbZroJlqbPaXZZHUFIpv5zk16U0GEJpkCiAqAqxRDNpI9oqLaYRpAuR6IyAdh426E9WXZGIfcRtax4B22B5c0l8NboE9XxKrlzH9F6BvM/LYZgG13HSRaxbkU+BNW340Q7bZRx2wJRL0jPFoh8AIFsRK4mBNocknawFIpIIohr3A8BlCi0ciA+5KBMxGQpo9RkAAApKdMGMARkDcewF3dHYCBlOYIo+mpgYPHjIIcSuehwYYIStPAaKI2ECqDcfey23DjVRDYjpRWROdhd9aBWXRR3T0f9/wOMHgHMcnOcpkRBL4cULwIgOdu4ZgSPAgf9u3EgMAUSXc42CMl1FZkdrAWCI2y9+4KT2KJlBm69qbT8bATAZLVANDvMEpBhXwI4RIHYM4E4DIHYTfDgM4DgeIeIDWHo21ZhkWAY5q759htqsY+o2FyY8hANKkqAYNSpON3DGBSnDqI3YvKVmV5VL19aMlBhSu/8f4JSFqdNDo+QQlZfdqwLujRVXNHh0LpZBxv6owNF9e0ZwKLFnFvFiYC1Ilkl9V8lyl6l2l61zEhoMoBYMEdQOdm0b6AYPIaQMoGwTGTpepRAHWLweaFRHlvlwk5OQV37MkqLFGgwIvNG6V2V9L5MdUS8a4pVijZlnjA0c5U1+sXdMmGdbIQoJ1j6Z7mdaoC176QmaABdQod1x9XuQ7yZUIOcBcTxej08l00sAGKbJ6YBFzhHhHsARH5HpHhHgAZlR8R+x6OGAWhhmh0UcAGgo50RdiAsWFxnxkJmJlJgpiphplpj2hIBWkZn/quieLu6Rie6df+4Ww1w8P/gOAmluTKEabKYGBNeQBy72B8E9Yu8/nWjvD5VrG3RmDmEiDWnJ4adoGhgqnpW5QWi3b2VuSCVCAHM8X9b1Fnch8G1XUB7S+B7Al5USjZJCGI8QAwcxhn1zPwoG1OkfhXadnHhM4qnZ59q9SwHrFJ/NDzWEkvTBDABl98Ba0F5IGF/Z0abc4Iw8+IzBZ8+IyhaK4mO6pC6Y0Raq5Rdq7uAxYa+xfb1xekHxda9oGJbVeYDJeoDQEwlrFKEiCpZpbpYZa9dZfVfZc5fYG5d5b8aJICc24iwzlFZiypL24lYO69cQ4KEwQVYbi9GtjYgpDu/NctetdtftcdedaMzfV548HN9VdJYA3ZnYqrHYBcDl4Wg9CNcNHoO5zj25t5vAKf6TZE2ybFoNEBXICAC2yeMAMWx/bptRAzuUtlElgYlUxQ9Ac3iiFWiZsrYtyI8CoX4RytxAqYa9sKWuyv57247GKPAMihRQfajsTeCNjrbIE2AKaaBoQQcAVtP4VbKmrmAh7zsO2XbUID22kBcBUsJ9YdgMjHY+tZkdAKdmeBnats+Bi7RQBU3CaiBjWG0LaKuzoDrsj2FjKPFx01x7s00B7T4DkDFrL1X2HgYzpFDzAPsn2tAVNpAHH5Vg0OgHMBNeW4w8IyOJACjjhyOhRIKK2HQ6OKGt6KCmOZ9AUDKGU4AdiiNHbjKIKHZsccmJAOMP4g8G5gAAGhoAyDxBYgjAZlpmgpBqA5YODPgEah9BJCKMbuB5BGHkDAxbOf4WfFNgk5agfe1AdxAyGE6nlYAzAa7GTXIBhAJyMnQgHJzlAKcKMDNcocLAGSR4EhHvSoTrVCGMcVQuaHWtuBxJl5VheKBgBammFahVOyEawYIK9DRB1eUID4kPHIAODAe6/TlNiDjwig96+NNIvQDPbasJYhwfVmW2YpbklEUsHEgMEfaYIo0K+S1Iwxz6gsvOTVIYr50K4Bdi+fqUvnwwi4zQouMWGLvl3rjxd9uMrdfrFBYhRJTobfGNJ3wADcuwL0BwxhYlcnYZXeFhGly5VVKujmSvjoXRb1cgoTXRvi10JYt92u7fclj3wtCLNuuUUXrqD0G4sgCAGjIgGNy8ATdEAU3GbvgDm4Lclui0SfqtyCwz8NupJefuSR7RL9xWq8A7g73lYk0EiOZPjp4hxh4wCYYtGnuTEpjUw6YntETvIEZjs8hoTcd6NzzsAlB1S38W6KmHj4YBE+D4V7AyGCAc8m4P0V6CNDJg9AgwNgWmFNiYCWhmA4Ie2maNCBetj8LuR2vDE8Rvc/Rr3B7h90tbfdfuYQXTGr0ESAdPEYsVdCdHyZc9nudgI5CrC+i/QExSYlMXpyl68xdgD4PFKELPIw9g2XrEcn6wHoBsg2kAeHtjxc5Y94gK4rHpjyXE49gEgPR9iC1nD9d5KNQmNrwLPKs8S6QQBkLUN2hejYE9gY0MuGoAEcvWWfOqhCImF58YRBfPztCw6pBcS+jGQNOXxZE+Qq+XtRnJizr4NAG+54Hkf5D5H1BO2dqClicH760t4gDLDqMNgUGiE5RCosoJqOn7rdQsc/JGovxzjGjEucKRCQPBzEM16wVrOUJ33D6+tsmsCG6vbwIFmh3+RuSIjaFzDF5P+JrIsXdywnfxIe1/bko/Et45B5xcPTcauJR6KSXOG4+SS51x5TNweY4+QE5WAS2iqeDokmE6Pp50w8eXMVegoWRy+AFUDAZSnyClhVRaAXlHYFLDqyPRz26IO8CfSQGR8EAfcAgQw3c57j+i0IiFhMML7wiuGwXACQi0iRItHGNXNkXV3Am18uRMEglnBOJYIS+i3fHZH31FHoTJGtAUSe6Nwn8J8JK3Qia2ln56jSJho8ibt1UKUSspyBWiadABi5SrBFo3EDGC4nMseJ94q7uoNu705ip4kmsQD3tpTj6AgkliVJNnH0BA2U2MDNGIqiLilxa4pSfEBUmqTceUeWBFpMsKx8Fxek+0UTEMl08XRtMbcW8xqIfNKSgXSgLCD4AOSvKDIp2kJLLDGd/JQLJhrnyhGsNYRVI38TSPK5l9YpFfECToQCKf0vAmELEDQEIhwMNALoSqfDSFZbcQmRo6kuWDgbjC9K60J6OH2njDN2YIJTCNEBZLPBeEeTf7PWD+gfBnhZTSIGZNunzB7pjMKZASGHiH5EU8wVwcUWcllDGQ6wJSOVRVTqwrUgUvouQQBlfi4RnDP8YiOinuxIkEMryLpEQzjE4+eAEyMRIsisB2AIgmyMKwzgzBc06kVyFpA8iGANZUkdQIy2SRRR4I/QZWLQBiiC1QgvEAwBrJOApAjgfs2IOjyhAZAAA7CcBIAnB+U6QE4IkBNyxAoQDAKEBAIECJAGAIctAGkFoDxABAvstAMkC9m2zLI9s7EIgCdnnUXZdAKKO2H0BAA= -->

<!-- internal state end -->
<!-- tips_start -->

---



<details>
<summary>🪧 Tips</summary>

### Chat

There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=it-at-m/Wahllokalsystem&utm_content=1201):

> ‼️ **IMPORTANT**
> Auto-reply has been disabled for this repository in the CodeRabbit settings. The CodeRabbit bot will not respond to your replies unless it is explicitly tagged.
- Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples:
  - `@coderabbitai generate unit testing code for this file.`
  -	`@coderabbitai modularize this function.`
- PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  - `@coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.`
  - `@coderabbitai read src/utils.ts and generate unit testing code.`
  - `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.`
  - `@coderabbitai help me debug CodeRabbit configuration file.`

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

### CodeRabbit Commands (Invoked using PR comments)

- `@coderabbitai pause` to pause the reviews on a PR.
- `@coderabbitai resume` to resume the paused reviews.
- `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
- `@coderabbitai full review` to do a full review from scratch and review all the files again.
- `@coderabbitai summary` to regenerate the summary of the PR.
- `@coderabbitai generate docstrings` to [generate docstrings](https://docs.coderabbit.ai/finishing-touches/docstrings) for this PR.
- `@coderabbitai generate sequence diagram` to generate a sequence diagram of the changes in this PR.
- `@coderabbitai resolve` resolve all the CodeRabbit review comments.
- `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository.
- `@coderabbitai help` to get help.

### Other keywords and placeholders

- Add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed.
- Add `@coderabbitai summary` or `` to generate the high-level summary at a specific location in the PR description.
- Add `@coderabbitai` or `` anywhere in the PR title to generate the title automatically.

### Documentation and Community

- Visit our [Documentation](https://docs.coderabbit.ai) for detailed information on how to use CodeRabbit.
- Join our [Discord Community](http://discord.gg/coderabbit) to get help, request features, and share feedback.
- Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.

</details>

<!-- tips_end -->
author_association: CONTRIBUTOR
user: login: MrSebastian
created_at: 2025-04-22T15:54:00Z
body: > es gibt aktuell über beide apigateways eine route auf das admintool (frontend-admintool und admintool in den application-routes.yml files), ist das beabsichtigt? nach der grafik in der doku sollte nur nur über das admingateway eine route zum admintool existiern.

Wurde in den Routes für die wls-gui entfernt: fc721cc60177450008f075ac4f9cdc1fa31ca34c
author_association: MEMBER