Phase 8: CSV + ICS export, print view, MkDocs docs, SBOM + dev-mode auth

Auth (Test-Mode):
  - middleware.AuthMiddleware now takes a devMode flag. In dev,
    requests without Authorization fall back to a deterministic dev
    UUID (00000000-...-001) and role=teacher. ENVIRONMENT=production
    re-enables the strict 401 path.
  - main.go wires devMode = cfg.Environment != "production".
  - page.tsx replaces the red 'Anmeldung noch nicht integriert' banner
    with a softer Testumgebung notice; the manual-token form moves
    behind a nested details block.

Export endpoints (school-service):
  - LoadExportLessons joins tt_lesson with tt_period for wall-clock
    times; one query feeds both CSV and ICS.
  - WriteCSV streams 10 columns including pinned flag.
  - WriteICS emits one VEVENT per lesson anchored to a Monday — caller
    overridable via ?start=YYYY-MM-DD. RFC 5545 escapes for ',', ';',
    '\n' in icsEscape().
  - NextMonday helper for the default anchor.
  - GET /timetable/solutions/:id/export.{csv,ics} handlers attach
    Content-Disposition: attachment so browsers download instead of
    rendering.

Frontend:
  - lib/stundenplan/api.ts downloadSolutionExport() fetches as blob,
    triggers a synthetic <a download> click, and forwards the JWT when
    present.
  - PlanView gains CSV / ICS / Drucken buttons next to the perspective
    selector. The toolbar carries class 'no-print' so window.print()
    yields only the grid.
  - globals.css @media print rule hides chrome, forces white
    background, gives the table proper borders for A4.

Docs:
  - docs-src/services/stundenplan/{index,architecture,constraints,
    solver-tuning,export}.md with nav entry in mkdocs.yml under
    Services → Stundenplaner.
  - sbom/stundenplan/README.md lists manually-verified key dependencies
    and the policy reference. scripts/stundenplan-sbom.sh generates
    full machine-readable inventories via go-licenses + pip-licenses
    + license-checker when those tools are available.

Tests:
  - internal/services/timetable_exports_test.go: 4 unit tests covering
    CSV column layout + quoting, ICS structure + DTSTART formatting,
    icsEscape special chars, NextMonday weekday math.
  - studio-v2/e2e/stundenplan-export.spec.ts split out of the main spec
    file (LOC budget) — 3 tests for button render, CSV download,
    ICS download.
  - mockSchoolApi extended with export.csv + export.ics routes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

studio-v2/app/globals.css

@@ -44,3 +44,28 @@ body {
 ::-webkit-scrollbar-thumb:hover {
   background: #94a3b8;
 }
+
+/* Stundenplan print view — hide chrome, force the Wochengrid full-width
+   on white background so window.print() yields a clean A4 page. */
+@media print {
+  .no-print,
+  aside,
+  header button,
+  details {
+    display: none !important;
+  }
+  body,
+  main {
+    background: white !important;
+    color: black !important;
+  }
+  [data-testid="plan-view"] table {
+    width: 100%;
+    border-collapse: collapse;
+  }
+  [data-testid="plan-view"] td,
+  [data-testid="plan-view"] th {
+    border: 1px solid #ccc;
+    color: black !important;
+  }
+}

studio-v2/app/stundenplan/_components/plan/PlanView.tsx

@@ -2,7 +2,7 @@
 
 import { useState, useEffect, useCallback, useMemo } from 'react'
 import { useTheme } from '@/lib/ThemeContext'
-import { solutionsApi, subjectsApi, lessonsApi } from '@/lib/stundenplan/api'
+import { solutionsApi, subjectsApi, lessonsApi, downloadSolutionExport } from '@/lib/stundenplan/api'
 import type { TimetableLesson, TimetableSubject } from '@/app/stundenplan/types'
 
 interface PlanViewProps {
@@ -125,9 +125,15 @@ export function PlanView({ solutionId }: PlanViewProps) {
   const cardClass = isDark ? 'bg-white/10 border-white/20 text-white' : 'bg-white/80 border-black/10 text-slate-900'
   const selectClass = isDark ? 'bg-white/10 border-white/20 text-white' : 'bg-white border-slate-300 text-slate-900'
 
+  const handleExport = (fmt: 'csv' | 'ics') => {
+    downloadSolutionExport(solutionId, fmt).catch(e =>
+      setError(e instanceof Error ? e.message : 'Export fehlgeschlagen'),
+    )
+  }
+
   return (
     <div className="space-y-4" data-testid="plan-view">
-      <div className={`p-4 rounded-2xl border backdrop-blur-xl ${cardClass}`}>
+      <div className={`p-4 rounded-2xl border backdrop-blur-xl no-print ${cardClass}`}>
         <div className="flex flex-wrap items-center gap-3">
           <div>
             <label className="block text-xs mb-1 opacity-70">Perspektive</label>
@@ -155,6 +161,32 @@ export function PlanView({ solutionId }: PlanViewProps) {
               {resources.map(r => <option key={r.id} value={r.id}>{r.label}</option>)}
             </select>
           </div>
+          <div>
+            <label className="block text-xs mb-1 opacity-70">Export</label>
+            <div className="flex gap-1">
+              <button
+                onClick={() => handleExport('csv')}
+                data-testid="export-csv"
+                className={`px-3 py-1.5 rounded-lg text-sm font-medium transition-colors ${isDark ? 'bg-white/10 text-white/80 hover:bg-white/20' : 'bg-slate-100 text-slate-700 hover:bg-slate-200'}`}
+              >
+                CSV
+              </button>
+              <button
+                onClick={() => handleExport('ics')}
+                data-testid="export-ics"
+                className={`px-3 py-1.5 rounded-lg text-sm font-medium transition-colors ${isDark ? 'bg-white/10 text-white/80 hover:bg-white/20' : 'bg-slate-100 text-slate-700 hover:bg-slate-200'}`}
+              >
+                ICS
+              </button>
+              <button
+                onClick={() => window.print()}
+                data-testid="export-print"
+                className={`px-3 py-1.5 rounded-lg text-sm font-medium transition-colors ${isDark ? 'bg-white/10 text-white/80 hover:bg-white/20' : 'bg-slate-100 text-slate-700 hover:bg-slate-200'}`}
+              >
+                Drucken
+              </button>
+            </div>
+          </div>
         </div>
       </div>
 

studio-v2/app/stundenplan/page.tsx

@@ -76,48 +76,47 @@ export default function StundenplanPage() {
           <HelpPanel />
 
           <div
-            className={`mb-4 p-3 rounded-xl border backdrop-blur-xl ${
-              isDark ? 'bg-amber-500/10 border-amber-500/30 text-amber-200' : 'bg-amber-50 border-amber-200 text-amber-900'
+            className={`mb-4 p-3 rounded-xl border backdrop-blur-xl text-sm ${
+              isDark ? 'bg-emerald-500/10 border-emerald-500/30 text-emerald-200' : 'bg-emerald-50 border-emerald-200 text-emerald-900'
             }`}
           >
             <details>
-              <summary className="cursor-pointer text-sm font-medium">
-                Anmeldung noch nicht integriert — Dev-Token setzen
+              <summary className="cursor-pointer font-medium">
+                Testumgebung — Anmeldung deaktiviert
               </summary>
-              <div className="mt-3 space-y-2 text-sm">
+              <div className="mt-2 space-y-2">
                 <p>
-                  Bis die volle BreakPilot-Anmeldung an dieses Modul angebunden ist, muss
-                  ein gueltiger JWT-Token manuell hinterlegt werden. Ohne Token antwortet
-                  die API mit <code className={`px-1 rounded ${isDark ? 'bg-white/10' : 'bg-amber-100'}`}>Authorization header required</code>.
+                  Der school-service laeuft im Development-Mode und akzeptiert Requests
+                  ohne JWT. Alle Aktionen werden einem festen Dev-User
+                  zugeordnet (<code className={`px-1 rounded ${isDark ? 'bg-white/10' : 'bg-emerald-100'}`}>00000000-0000-0000-0000-000000000001</code>).
                 </p>
-                <ol className="list-decimal list-inside space-y-1 opacity-90">
-                  <li>An BreakPilot anmelden (z.B. ueber das Lehrer-Login)</li>
-                  <li>Im Browser DevTools → Application/Storage → Cookies oder localStorage den
-                      JWT-Token kopieren (Feldname kann je nach Login-Flow variieren)</li>
-                  <li>Token unten einfuegen, Speichern, Seite neu laden</li>
-                </ol>
-                <div className="mt-2 flex gap-2">
-                  <input
-                    type="password"
-                    value={token}
-                    onChange={e => setToken(e.target.value)}
-                    placeholder="Bearer-Token (ohne 'Bearer '-Prefix)"
-                    className={`flex-1 px-3 py-1.5 rounded-lg text-sm ${
-                      isDark ? 'bg-white/10 border border-white/20 text-white' : 'bg-white border border-slate-300 text-slate-900'
-                    }`}
-                  />
-                  <button
-                    onClick={handleSaveToken}
-                    className="px-3 py-1.5 rounded-lg bg-amber-500 hover:bg-amber-600 text-white text-sm font-medium"
-                  >
-                    Speichern
-                  </button>
-                </div>
-                {tokenSaved && (
-                  <p className={`text-xs ${isDark ? 'text-emerald-300' : 'text-emerald-700'}`}>
-                    Token gespeichert. Seite neu laden, um die Aenderung zu uebernehmen.
-                  </p>
-                )}
+                <p>
+                  Fuer Production muss <code className={`px-1 rounded ${isDark ? 'bg-white/10' : 'bg-emerald-100'}`}>ENVIRONMENT=production</code> gesetzt werden — dann ist ein gueltiger
+                  JWT in jedem Request Pflicht.
+                </p>
+                <details className="opacity-70">
+                  <summary className="cursor-pointer text-xs">Manueller Token (falls noetig)</summary>
+                  <div className="mt-2 flex gap-2">
+                    <input
+                      type="password"
+                      value={token}
+                      onChange={e => setToken(e.target.value)}
+                      placeholder="Bearer-Token (optional)"
+                      className={`flex-1 px-3 py-1.5 rounded-lg text-sm ${
+                        isDark ? 'bg-white/10 border border-white/20 text-white' : 'bg-white border border-slate-300 text-slate-900'
+                      }`}
+                    />
+                    <button
+                      onClick={handleSaveToken}
+                      className="px-3 py-1.5 rounded-lg bg-emerald-500 hover:bg-emerald-600 text-white text-sm font-medium"
+                    >
+                      Speichern
+                    </button>
+                  </div>
+                  {tokenSaved && (
+                    <p className="mt-1 text-xs opacity-90">Token gespeichert. Seite neu laden.</p>
+                  )}
+                </details>
               </div>
             </details>
           </div>

studio-v2/e2e/_helpers.ts

@@ -128,6 +128,21 @@ export async function mockSchoolApi(page: Page, opts: MockOpts = {}) {
       body: JSON.stringify({ message: 'ok', pinned: body.pinned ?? false }),
     })
   })
+  // Phase 8: CSV + ICS exports. Routed BEFORE the generic /solutions/:id
+  // catch-all so the .csv / .ics suffix path is matched first.
+  await page.route(/\/api\/school\/timetable\/solutions\/[^/]+\/export\.csv$/, async (route) => {
+    return route.fulfill({
+      status: 200, contentType: 'text/csv',
+      body: 'day_of_week,period_index,start_time,end_time,class,subject,subject_code,teacher,room,pinned\n1,1,08:00,08:45,5a,Mathe,M,"Schmidt, Anna",A101,false\n',
+    })
+  })
+  await page.route(/\/api\/school\/timetable\/solutions\/[^/]+\/export\.ics(\?.*)?$/, async (route) => {
+    return route.fulfill({
+      status: 200, contentType: 'text/calendar',
+      body: 'BEGIN:VCALENDAR\r\nVERSION:2.0\r\nEND:VCALENDAR\r\n',
+    })
+  })
+
   await page.route(/\/api\/school\/timetable\/solutions\/[^/]+$/, async (route) => {
     if (route.request().method() === 'DELETE') {
       return route.fulfill({ status: 200, contentType: 'application/json', body: '{"message":"deleted"}' })

studio-v2/e2e/stundenplan-export.spec.ts

@@ -0,0 +1,51 @@
+import { test, expect } from '@playwright/test'
+import { mockSchoolApi } from './_helpers'
+
+/**
+ * E2E tests for the Phase 8 export functionality on /stundenplan.
+ * Split into its own file so stundenplan.spec.ts stays under the 500 LOC
+ * budget enforced by the pre-commit hook.
+ */
+
+const exportOpts = () => ({
+  solutions: [
+    { id: 's1', created_by_user_id: 'u', name: 'Plan A', status: 'completed', hard_score: 0, soft_score: 0, created_at: '2026-05-22T10:00:00Z' },
+  ],
+  lessons: [
+    { id: 'l1', solution_id: 's1', class_id: 'c1', subject_id: 'sub1', teacher_id: 't1', room_id: 'r1', day_of_week: 1, period_index: 1, pinned: false, created_at: '', class_name: '5a', subject_name: 'Mathe', teacher_name: 'Schmidt, Anna', room_name: 'A101' },
+  ],
+})
+
+test.describe('Stundenplan — Export buttons', () => {
+  test('export buttons are rendered on the PlanView', async ({ page }) => {
+    await mockSchoolApi(page, exportOpts())
+    await page.goto('/stundenplan')
+    await page.waitForLoadState('networkidle')
+    await page.getByRole('button', { name: 'Anzeigen' }).click()
+    await expect(page.getByTestId('export-csv')).toBeVisible()
+    await expect(page.getByTestId('export-ics')).toBeVisible()
+    await expect(page.getByTestId('export-print')).toBeVisible()
+  })
+
+  test('CSV download triggers a fetch to export.csv', async ({ page }) => {
+    await mockSchoolApi(page, exportOpts())
+    await page.goto('/stundenplan')
+    await page.waitForLoadState('networkidle')
+    await page.getByRole('button', { name: 'Anzeigen' }).click()
+    const downloadPromise = page.waitForEvent('download')
+    await page.getByTestId('export-csv').click()
+    const download = await downloadPromise
+    expect(download.suggestedFilename()).toContain('.csv')
+  })
+
+  test('ICS download triggers a fetch to export.ics', async ({ page }) => {
+    await mockSchoolApi(page, exportOpts())
+    await page.goto('/stundenplan')
+    await page.waitForLoadState('networkidle')
+    await page.getByRole('button', { name: 'Anzeigen' }).click()
+    const downloadPromise = page.waitForEvent('download')
+    await page.getByTestId('export-ics').click()
+    const download = await downloadPromise
+    expect(download.suggestedFilename()).toContain('.ics')
+  })
+})

studio-v2/e2e/stundenplan.spec.ts

@@ -41,8 +41,9 @@ test.describe('Stundenplan — Page Shell', () => {
     await expect(page.getByTestId('plan-hub')).toBeVisible()
   })
 
-  test('JWT dev field exists and persists into localStorage', async ({ page }) => {
-    await page.getByText('Anmeldung noch nicht integriert').click()
+  test('Dev mode banner is collapsed by default; manual token still available', async ({ page }) => {
+    await page.getByText('Testumgebung — Anmeldung deaktiviert').click()
+    await page.getByText('Manueller Token').click()
     await page.getByPlaceholder(/Bearer-Token/).fill('test-jwt-abc')
     await page.getByRole('button', { name: 'Speichern' }).click()
     const stored = await page.evaluate(() => localStorage.getItem('bp_stundenplan_jwt'))

studio-v2/lib/stundenplan/api.ts

@@ -160,3 +160,30 @@ export const lessonsApi = {
       body: JSON.stringify({ pinned }),
     }),
 }
+
+// Phase 8: exports. Fetched as blobs through the proxy so the JWT (when
+// set) is forwarded; download is triggered by creating an object URL.
+export async function downloadSolutionExport(
+  solutionId: string,
+  format: 'csv' | 'ics',
+  options: { startDate?: string } = {},
+): Promise<void> {
+  const token = getStundenplanToken()
+  const headers: Record<string, string> = {}
+  if (token) headers['Authorization'] = `Bearer ${token}`
+
+  const qs = format === 'ics' && options.startDate ? `?start=${options.startDate}` : ''
+  const res = await fetch(`/api/school/timetable/solutions/${solutionId}/export.${format}${qs}`, { headers })
+  if (!res.ok) {
+    throw new Error(`Export fehlgeschlagen (HTTP ${res.status})`)
+  }
+  const blob = await res.blob()
+  const url = URL.createObjectURL(blob)
+  const a = document.createElement('a')
+  a.href = url
+  a.download = `stundenplan-${solutionId.slice(0, 8)}.${format}`
+  document.body.appendChild(a)
+  a.click()
+  a.remove()
+  URL.revokeObjectURL(url)
+}