- Reworked the tenant admin login page

- Updated the User model to implement Filament’s tenancy contracts
- Seeded a ready-to-use demo tenant (user, tenant, active package, purchase)
- Introduced a branded, translated 403 error page to replace the generic forbidden message for unauthorised admin hits
- Removed the public “Register” links from the marketing header
- hardened join event logic and improved error handling in the guest pwa.

resources/js/admin/pages/EventDetailPage.tsx

@@ -1,6 +1,6 @@
 import React from 'react';
 import { useNavigate, useParams, useSearchParams } from 'react-router-dom';
-import { ArrowLeft, Camera, Heart, Loader2, RefreshCw, Share2, Sparkles } from 'lucide-react';
+import { ArrowLeft, Camera, Download, Heart, Loader2, RefreshCw, Share2, Sparkles } from 'lucide-react';
 
 import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert';
 import { Button } from '@/components/ui/button';
@@ -260,25 +260,41 @@ export default function EventDetailPage() {
             </CardContent>
           </Card>
 
-          <Card className="border-0 bg-white/90 shadow-xl shadow-amber-100/60">
+          <Card id="join-invites" className="border-0 bg-white/90 shadow-xl shadow-amber-100/60">
             <CardHeader className="space-y-2">
               <CardTitle className="flex items-center gap-2 text-xl text-slate-900">
-                <Share2 className="h-5 w-5 text-amber-500" /> Einladungen
+                <Share2 className="h-5 w-5 text-amber-500" /> Einladungen & Drucklayouts
               </CardTitle>
               <CardDescription className="text-sm text-slate-600">
-                Generiere Links um Gaeste direkt in das Event zu fuehren.
+                Verwalte Join-Tokens fuer dein Event. Jede Einladung enthaelt einen eindeutigen Token, QR-Code und
+                downloadbare PDF/SVG-Layouts.
               </CardDescription>
             </CardHeader>
-            <CardContent className="space-y-3 text-sm text-slate-700">
+            <CardContent className="space-y-4 text-sm text-slate-700">
+              <div className="space-y-2 rounded-xl border border-amber-100 bg-amber-50/70 p-3 text-xs text-amber-800">
+                <p>
+                  Teile den generierten Link oder drucke die Layouts aus, um Gaeste sicher ins Event zu leiten. Tokens lassen
+                  sich jederzeit rotieren oder deaktivieren.
+                </p>
+                {tokens.length > 0 && (
+                  <p className="flex items-center gap-2 text-[11px] uppercase tracking-wide text-amber-600">
+                    Aktive Tokens: {tokens.filter((token) => token.is_active && !token.revoked_at).length} · Gesamt:{' '}
+                    {tokens.length}
+                  </p>
+                )}
+              </div>
+
               <Button onClick={handleInvite} disabled={creatingToken} className="w-full">
                 {creatingToken ? <Loader2 className="h-4 w-4 animate-spin" /> : <Share2 className="h-4 w-4" />}
-                Einladungslink erzeugen
+                Join-Token erzeugen
               </Button>
+
               {inviteLink && (
                 <p className="rounded-lg border border-amber-200 bg-amber-50 px-3 py-2 font-mono text-xs text-amber-800">
                   {inviteLink}
                 </p>
               )}
+
               <div className="space-y-3">
                 {tokens.length > 0 ? (
                   tokens.map((token) => (
@@ -291,9 +307,10 @@ export default function EventDetailPage() {
                     />
                   ))
                 ) : (
-                  <p className="text-xs text-slate-500">
-                    Noch keine Einladungen erstellt. Nutze den Button, um einen neuen QR-Link zu generieren.
-                  </p>
+                  <div className="rounded-lg border border-slate-200 bg-white/80 p-4 text-xs text-slate-500">
+                    Noch keine Tokens vorhanden. Erzeuge jetzt den ersten Token, um QR-Codes und Drucklayouts
+                    herunterzuladen.
+                  </div>
                 )}
               </div>
             </CardContent>
@@ -366,9 +383,11 @@ function JoinTokenRow({
   revoking: boolean;
 }) {
   const status = getTokenStatus(token);
+  const availableLayouts = Array.isArray(token.layouts) ? token.layouts : [];
+
   return (
-    <div className="flex flex-col gap-3 rounded-xl border border-amber-100 bg-amber-50/60 p-3 md:flex-row md:items-center md:justify-between">
-      <div className="space-y-2">
+    <div className="flex flex-col gap-3 rounded-xl border border-amber-100 bg-amber-50/60 p-3">
+      <div className="space-y-3">
         <div className="flex items-center gap-2">
           <span className="text-sm font-semibold text-slate-800">{token.label || `Einladung #${token.id}`}</span>
           <span
@@ -392,8 +411,81 @@ function JoinTokenRow({
           {token.expires_at && <span>Gültig bis {formatDateTime(token.expires_at)}</span>}
           {token.created_at && <span>Erstellt {formatDateTime(token.created_at)}</span>}
         </div>
+        {availableLayouts.length > 0 && (
+          <div className="space-y-3 rounded-xl border border-amber-100 bg-white/80 p-3">
+            <div className="text-xs font-semibold uppercase tracking-wide text-amber-600">Drucklayouts</div>
+            <div className="grid gap-3 sm:grid-cols-2">
+              {availableLayouts.map((layout) => {
+                const formatEntries = Array.isArray(layout.formats)
+                  ? layout.formats
+                      .map((format) => {
+                        const normalized = String(format ?? '').toLowerCase();
+                        const href =
+                          layout.download_urls?.[normalized] ??
+                          layout.download_urls?.[String(format ?? '')] ??
+                          null;
+
+                        return {
+                          format: normalized,
+                          label: String(format ?? '').toUpperCase(),
+                          href,
+                        };
+                      })
+                      .filter((entry) => Boolean(entry.href))
+                  : [];
+
+                if (formatEntries.length === 0) {
+                  return null;
+                }
+
+                return (
+                  <div key={layout.id} className="flex flex-col gap-2 rounded-lg border border-amber-200 bg-white p-3 shadow-sm">
+                    <div>
+                      <div className="text-sm font-semibold text-slate-800">{layout.name}</div>
+                      {layout.subtitle && <div className="text-xs text-slate-500">{layout.subtitle}</div>}
+                    </div>
+                    <div className="flex flex-wrap gap-2">
+                      {formatEntries.map((entry) => (
+                        <Button
+                          asChild
+                          key={`${layout.id}-${entry.format}`}
+                          size="sm"
+                          variant="outline"
+                          className="border-amber-200 text-amber-700 hover:bg-amber-100"
+                        >
+                          <a href={entry.href as string} target="_blank" rel="noreferrer">
+                            <Download className="mr-1 h-3 w-3" />
+                            {entry.label}
+                          </a>
+                        </Button>
+                      ))}
+                    </div>
+                  </div>
+                );
+              })}
+            </div>
+          </div>
+        )}
+        {!availableLayouts.length && token.layouts_url && (
+          <div className="rounded-xl border border-amber-100 bg-white/70 p-3 text-xs text-slate-600">
+            Drucklayouts stehen für diesen Token bereit. Öffne den Layout-Link, um PDF- oder SVG-Versionen zu laden.
+          </div>
+        )}
       </div>
-      <div className="flex gap-2">
+      <div className="flex flex-wrap gap-2 md:items-center md:justify-start">
+        {token.layouts_url && (
+          <Button
+            asChild
+            size="sm"
+            variant="outline"
+            className="border-amber-200 text-amber-700 hover:bg-amber-100"
+          >
+            <a href={token.layouts_url} target="_blank" rel="noreferrer">
+              <Download className="h-3 w-3" />
+              <span className="ml-1">Layouts</span>
+            </a>
+          </Button>
+        )}
         <Button variant="outline" size="sm" onClick={onCopy} className="border-amber-200 text-amber-700 hover:bg-amber-100">
           Kopieren
         </Button>

resources/js/admin/pages/EventFormPage.tsx

@@ -197,14 +197,17 @@ export default function EventFormPage() {
                   />
                 </div>
                 <div className="space-y-2">
-                  <Label htmlFor="event-slug">Slug / URL-Endung</Label>
+                  <Label htmlFor="event-slug">Slug / interne Kennung</Label>
                   <Input
                     id="event-slug"
                     placeholder="sommerfest-2025"
                     value={form.slug}
                     onChange={(e) => handleSlugChange(e.target.value)}
                   />
-                  <p className="text-xs text-slate-500">Das Event ist spaeter unter /e/{form.slug || 'dein-event'} erreichbar.</p>
+                  <p className="text-xs text-slate-500">
+                    Diese Kennung wird intern verwendet. Gaeste erhalten Zugriff ausschliesslich ueber Join-Tokens und deren
+                    QR-/Layout-Downloads.
+                  </p>
                 </div>
                 <div className="space-y-2">
                   <Label htmlFor="event-date">Datum</Label>

resources/js/admin/pages/EventsPage.tsx

@@ -1,6 +1,6 @@
 import React from 'react';
 import { Link, useNavigate } from 'react-router-dom';
-import { ArrowRight, CalendarDays, Plus, Settings, Sparkles } from 'lucide-react';
+import { ArrowRight, CalendarDays, Plus, Settings, Sparkles, Share2 } from 'lucide-react';
 
 import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert';
 import { Badge } from '@/components/ui/badge';
@@ -156,9 +156,9 @@ function EventCard({ event }: { event: TenantEvent }) {
           <Link to={ADMIN_EVENT_TASKS_PATH(slug)}>Tasks</Link>
         </Button>
         <Button asChild variant="outline" className="border-slate-200 text-slate-700 hover:bg-slate-50">
-          <a href={`/e/${slug}`} target="_blank" rel="noreferrer">
-            Oeffnen im Gastportal
-          </a>
+          <Link to={`${ADMIN_EVENT_VIEW_PATH(slug)}#join-invites`}>
+            <Share2 className="h-3.5 w-3.5" /> Einladungen
+          </Link>
         </Button>
       </div>
     </div>

resources/js/admin/pages/LoginPage.tsx

@@ -4,6 +4,7 @@ import { Button } from '@/components/ui/button';
 import AppearanceToggleDropdown from '@/components/appearance-dropdown';
 import { useAuth } from '../auth/context';
 import { ADMIN_HOME_PATH } from '../constants';
+import { useTranslation } from 'react-i18next';
 
 interface LocationState {
   from?: Location;
@@ -11,6 +12,7 @@ interface LocationState {
 
 export default function LoginPage() {
   const { status, login } = useAuth();
+  const { t } = useTranslation('auth');
   const location = useLocation();
   const navigate = useNavigate();
   const searchParams = React.useMemo(() => new URLSearchParams(location.search), [location.search]);
@@ -36,17 +38,14 @@ export default function LoginPage() {
   return (
     <div className="mx-auto flex min-h-screen max-w-sm flex-col justify-center p-6">
       <div className="mb-6 flex items-center justify-between">
-        <h1 className="text-lg font-semibold">Tenant Admin</h1>
+        <h1 className="text-lg font-semibold">{t('login.title')}</h1>
         <AppearanceToggleDropdown />
       </div>
       <div className="space-y-4 text-sm text-muted-foreground">
-        <p>
-          Melde dich mit deinem Fotospiel-Account an. Du wirst zur sicheren OAuth-Anmeldung weitergeleitet und danach
-          wieder zur Admin-Oberflaeche gebracht.
-        </p>
+        <p>{t('login.lead')}</p>
         {oauthError && (
           <div className="rounded border border-red-300 bg-red-50 p-2 text-sm text-red-700">
-            Anmeldung fehlgeschlagen: {oauthError}
+            {t('login.oauth_error', { message: oauthError })}
           </div>
         )}
         <Button
@@ -54,7 +53,7 @@ export default function LoginPage() {
           disabled={status === 'loading'}
           onClick={() => login(redirectTarget)}
         >
-          {status === 'loading' ? 'Bitte warten ...' : 'Mit Tenant-Account anmelden'}
+          {status === 'loading' ? t('login.loading') : t('login.cta')}
         </Button>
       </div>
     </div>

resources/js/admin/pages/__tests__/DashboardPage.guard.test.tsx

@@ -0,0 +1,63 @@
+import React from 'react';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { render, waitFor } from '@testing-library/react';
+import DashboardPage from '../DashboardPage';
+import { ADMIN_WELCOME_BASE_PATH } from '../../constants';
+
+const navigateMock = vi.fn();
+const markStepMock = vi.fn();
+
+vi.mock('react-router-dom', async () => {
+  const actual = await vi.importActual<typeof import('react-router-dom')>('react-router-dom');
+  return {
+    ...actual,
+    useNavigate: () => navigateMock,
+    useLocation: () => ({ pathname: '/event-admin', search: '', hash: '', state: null, key: 'test' }),
+  };
+});
+
+vi.mock('../../components/AdminLayout', () => ({
+  AdminLayout: ({ children }: { children: React.ReactNode }) => <div data-testid="admin-layout">{children}</div>,
+}));
+
+vi.mock('../../auth/context', () => ({
+  useAuth: () => ({ status: 'authenticated', user: { name: 'Test Tenant' } }),
+}));
+
+vi.mock('../../onboarding', () => ({
+  useOnboardingProgress: () => ({
+    progress: {
+      welcomeSeen: false,
+      packageSelected: false,
+      eventCreated: false,
+      lastStep: null,
+      selectedPackage: null,
+    },
+    setProgress: vi.fn(),
+    markStep: markStepMock,
+    reset: vi.fn(),
+  }),
+}));
+
+vi.mock('../../api', () => ({
+  getDashboardSummary: vi.fn().mockResolvedValue(null),
+  getEvents: vi.fn().mockResolvedValue([]),
+  getCreditBalance: vi.fn().mockResolvedValue({ balance: 0 }),
+  getTenantPackagesOverview: vi.fn().mockResolvedValue({ packages: [], activePackage: null }),
+}));
+
+describe('DashboardPage onboarding guard', () => {
+  beforeEach(() => {
+    navigateMock.mockReset();
+    markStepMock.mockReset();
+  });
+
+  it('redirects to the welcome flow when no events exist and onboarding is incomplete', async () => {
+    render(<DashboardPage />);
+
+    await waitFor(() => {
+      expect(navigateMock).toHaveBeenCalledWith(ADMIN_WELCOME_BASE_PATH, { replace: true });
+    });
+    expect(markStepMock).not.toHaveBeenCalled();
+  });
+});