Updates

timetracker.Server/Data/AuthService.cs

@@ -14,6 +14,8 @@ public class AuthService(
     UserNotificationService notifier,
     ITenantProvider tenantProvider) : IAuthService
 {
+    private const string ReservedSuperAdminUsername = "marc";
+
     public async Task<User?> LoginAsync(string username, string password)
     {
         await using var db = await factory.CreateDbContextAsync();
@@ -58,6 +60,9 @@ public class AuthService(
         var user = await db.Users.IgnoreQueryFilters().FirstOrDefaultAsync(u => u.Id == userId);
         if (user == null) return "Benutzer nicht gefunden.";
 
+        if (!CanUseReservedUsername(user.TenantId, newUsername, allowExistingReservedUser: user.TenantId == null && user.Username.Equals(ReservedSuperAdminUsername, StringComparison.OrdinalIgnoreCase)))
+            return "Dieser Benutzername ist reserviert.";
+
         // Check if name is taken within the same tenant context
         var isTaken = await db.Users.AnyAsync(u => u.Username == newUsername && u.Id != userId && u.TenantId == user.TenantId);
         if (isTaken)
@@ -97,7 +102,7 @@ public class AuthService(
             return (null, "Passwort muss mindestens 6 Zeichen lang sein.");
 
         var tenantId = tenantProvider.TenantId;
-        if (tenantId == null && username.Equals("marc", StringComparison.OrdinalIgnoreCase))
+        if (!CanUseReservedUsername(tenantId, username))
         {
             return (null, "Dieser Benutzername ist reserviert.");
         }
@@ -132,6 +137,9 @@ public class AuthService(
         if (string.IsNullOrWhiteSpace(req.AdminPassword) || req.AdminPassword.Length < 6)
             return (null, "Passwort muss mindestens 6 Zeichen lang sein.");
 
+        if (!CanUseReservedUsername(tenantId: 0, req.AdminUsername))
+            return (null, "Dieser Benutzername ist reserviert.");
+
         var subdomain = req.Subdomain.ToLower().Trim();
         if (!subdomain.All(c => char.IsLetterOrDigit(c) || c == '-'))
         {
@@ -258,6 +266,14 @@ public class AuthService(
     private static bool VerifyPassword(string password, string hash, string salt)
         => ComputeHash(password, salt) == hash;
 
+    private static bool CanUseReservedUsername(int? tenantId, string username, bool allowExistingReservedUser = false)
+    {
+        if (!username.Equals(ReservedSuperAdminUsername, StringComparison.OrdinalIgnoreCase))
+            return true;
+
+        return allowExistingReservedUser || tenantId == null;
+    }
+
     private static string ComputeHash(string password, string salt)
     {
         var hash = Rfc2898DeriveBytes.Pbkdf2(