Merge pull request 'split_css' (#15) from split_css into master

Reviewed-on: #15

.env.example

@@ -1,3 +1,8 @@
+# UWAGA:
+# Po zmianie pliku .env samo `docker compose restart` może nie wystarczyć.
+# Aby nowe wartości zostały na pewno wczytane do kontenerów, użyj:
+# docker compose up -d --force-recreate
+
 # APP_PORT:
 # Domyślny port, na którym uruchamiana jest aplikacja Flask
 # Domyślnie: 8000
@@ -6,27 +11,30 @@ APP_PORT=8000
 # SECRET_KEY:
 # Klucz używany przez Flask do zabezpieczenia sesji, tokenów i formularzy
 # Powinien być długi i trudny do odgadnięcia
-SECRET_KEY=supersekretnyklucz123
+# Może zawierać znaki specjalne
+SECRET_KEY="supersekretnyklucz123"
 
 # SYSTEM_PASSWORD:
 # Hasło główne administratora systemowego, używane np. przy inicjalizacji
 # Domyślnie: admin
-SYSTEM_PASSWORD=admin
+# Może zawierać znaki specjalne
+SYSTEM_PASSWORD="admin"
 
 # DEFAULT_ADMIN_USERNAME:
 # Domyślna nazwa użytkownika administratora (tworzona przy starcie)
 # Domyślnie: admin
-DEFAULT_ADMIN_USERNAME=admin
+DEFAULT_ADMIN_USERNAME="admin"
 
 # DEFAULT_ADMIN_PASSWORD:
 # Domyślne hasło administratora
 # Domyślnie: admin123
-DEFAULT_ADMIN_PASSWORD=admin123
+# Może zawierać znaki specjalne
+DEFAULT_ADMIN_PASSWORD="admin123"
 
 # UPLOAD_FOLDER:
 # Ścieżka (względna) do katalogu, gdzie zapisywane są wgrywane pliki
 # Domyślnie: uploads
-UPLOAD_FOLDER=uploads
+UPLOAD_FOLDER="uploads"
 
 # SESSION_TIMEOUT_MINUTES:
 # Czas bezczynności użytkownika (w minutach), po którym sesja wygasa
@@ -41,8 +49,12 @@ AUTH_COOKIE_MAX_AGE=86400
 # AUTHORIZED_COOKIE_VALUE:
 # Wartość ciasteczka uprawniającego do dostępu (np. do zasobów zabezpieczonych)
 # Powinna być trudna do przewidzenia
-# Chodzi to o zabezpieczenie strony "hasłęm głównym czyli endpointem /system-auth"
-AUTHORIZED_COOKIE_VALUE=twoj_wlasny_hash
+# Chodzi o zabezpieczenie strony "hasłem głównym", czyli endpointem /system-auth
+# Może zawierać znaki specjalne
+# UWAGA: zmiana SYSTEM_PASSWORD nie unieważnia automatycznie wcześniej wydanych ciasteczek.
+# Aby wymusić ponowną autoryzację, zmień także AUTHORIZED_COOKIE_VALUE
+# lub wyczyść ciasteczka w przeglądarce.
+AUTHORIZED_COOKIE_VALUE="twoj_wlasny_hash"
 
 # SESSION_COOKIE_SECURE:
 # Określa, czy ciasteczko sesyjne (Flask session) ma mieć ustawiony atrybut "Secure".
@@ -54,39 +66,54 @@ SESSION_COOKIE_SECURE=0
 # BCRYPT_PEPPER:
 # Dodatkowy „sekretny klucz” (pepper) dodawany do hasła przed zahashowaniem
 # Zwiększa bezpieczeństwo przechowywanych haseł
-BCRYPT_PEPPER=sekretnyKluczbcrypt
+# Może zawierać znaki specjalne
+BCRYPT_PEPPER="sekretnyKluczbcrypt"
 
 # HEALTHCHECK_TOKEN:
 # Token wykorzystywany do sprawdzania stanu aplikacji (np. w Docker Compose)
 # Domyślnie: alamapsaikota123
-HEALTHCHECK_TOKEN=alamapsaikota123
+# Może zawierać znaki specjalne
+HEALTHCHECK_TOKEN="alamapsaikota123"
 
 # Rodzaj bazy: sqlite, pgsql, mysql
-# Mozliwe wartosci: sqlite / pgsql / mysql
-DB_ENGINE=sqlite
+# Możliwe wartości: sqlite / pgsql / mysql
+DB_ENGINE="sqlite"
 
 # --- Konfiguracja dla sqlite ---
-# Plik bazy bedzie utworzony automatycznie w katalogu ./instance
-# Pozostale zmienne sa ignorowane przy DB_ENGINE=sqlite
+# Plik bazy będzie utworzony automatycznie w katalogu ./instance
+# Pozostałe zmienne są ignorowane przy DB_ENGINE=sqlite
 
 # --- Konfiguracja dla pgsql ---
 # Ustaw DB_ENGINE=pgsql
-# Domyslny port PostgreSQL to 5432
-# Wymaga dzialajacego serwera PostgreSQL (np. kontener `postgres`)
+# Domyślny port PostgreSQL to 5432
+# Wymaga działającego serwera PostgreSQL (np. kontener `postgres`)
 
 # --- Konfiguracja dla mysql ---
 # Ustaw DB_ENGINE=mysql
-# Domyslny port MySQL to 3306
-# Wymaga kontenera z MySQL i uzytkownika z dostepem do bazy
+# Domyślny port MySQL to 3306
+# Wymaga kontenera z MySQL i użytkownika z dostępem do bazy
 
-# Wspolne zmienne (dla pgsql, mysql)
+# Wspólne zmienne (dla pgsql, mysql)
 # DB_HOST = pgsql lub mysql zgodnie z deployem (profil w docker-compose.yml)
 
-DB_HOST=pgsql 
+DB_HOST="pgsql"
 DB_PORT=5432
-DB_NAME=myapp
-DB_USER=user
-DB_PASSWORD=pass
+
+# DB_NAME:
+# Nazwa bazy danych
+# Może zawierać znaki specjalne, ale zalecane są proste nazwy
+DB_NAME="myapp"
+
+# DB_USER:
+# Użytkownik bazy danych
+# Może zawierać znaki specjalne
+DB_USER="user"
+
+# DB_PASSWORD:
+# Hasło do bazy danych
+# Może zawierać znaki specjalne
+# Zalecane jest używanie wartości w cudzysłowach
+DB_PASSWORD="pass"
 
 # ========================
 # Nagłówki bezpieczeństwa
@@ -153,19 +180,19 @@ LIB_JS_CACHE_CONTROL="max-age=86400"
 # LIB_CSS_CACHE_CONTROL:
 # Nagłówki Cache-Control dla bibliotek CSS (/static/lib/css/)
 # Domyślnie: "max-age=86400"
-LIB_CSS_CACHE_CONTROL="max-age=86400"
+LIB_CSS_CACHE_CONTROL="max-age=3600"
 
 # UPLOADS_CACHE_CONTROL:
 # Nagłówki Cache-Control dla wgrywanych plików (/uploads/)
 # Domyślnie: "max-age=2592000, immutable"
-UPLOADS_CACHE_CONTROL="max-age=2592000, immutable"
+UPLOADS_CACHE_CONTROL="max-age=3600, immutable"
 
 # DEFAULT_CATEGORIES:
 # Lista domyślnych kategorii tworzonych automatycznie przy starcie aplikacji,
 # jeśli nie istnieją w bazie danych.
 # Podaj w formacie CSV (oddzielone przecinkami) – kolejność zostanie zachowana.
-# Możesz dodać własne kategorie
-# UWAGA: Wielkość liter w nazwach jest zachowywana, ale porównywanie odbywa się
+# Możesz dodać własne kategorie.
+# UWAGA: wielkość liter w nazwach jest zachowywana, ale porównywanie odbywa się
 # bez rozróżniania wielkości liter (case-insensitive).
 # Domyślnie: poniższa lista
-DEFAULT_CATEGORIES="Spożywcze,Budowlane,Zabawki,Chemia,Inne,Elektronika,Odzież i obuwie,Artykuły biurowe,Kosmetyki i higiena,Motoryzacja,Ogród i rośliny,Zwierzęta,Sprzęt sportowy,Książki i prasa,Narzędzia i majsterkowanie,RTV / AGD,Apteka i suplementy,Artykuły dekoracyjne,Gry i hobby,Usługi,Pieczywo"
+DEFAULT_CATEGORIES="Spożywcze,Budowlane,Zabawki,Chemia,Inne,Elektronika,Odzież i obuwie,Artykuły biurowe,Kosmetyki i higiena,Motoryzacja,Ogród i rośliny,Zwierzęta,Sprzęt sportowy,Książki i prasa,Narzędzia i majsterkowanie,RTV / AGD,Apteka i suplementy,Artykuły dekoracyjne,Gry i hobby,Usługi,Pieczywo"

API_OPIS.txt

@@ -0,0 +1,33 @@
+API aplikacji Lista Zakupów
+
+Autoryzacja:
+- Authorization: Bearer TWOJ_TOKEN
+- albo X-API-Token: TWOJ_TOKEN
+
+Token ma jednocześnie dwa ograniczenia:
+1. zakresy (scopes), np. expenses:read, lists:read, templates:read
+2. dozwolone endpointy
+
+Dostępne endpointy:
+- GET /api/ping
+  Test poprawności tokenu.
+
+- GET /api/expenses/latest?start_date=YYYY-MM-DD&end_date=YYYY-MM-DD&list_id=ID&owner_id=ID&limit=50
+  Zwraca ostatnie wydatki wraz z metadanymi listy i właściciela.
+
+- GET /api/expenses/summary?start_date=YYYY-MM-DD&end_date=YYYY-MM-DD&list_id=ID&owner_id=ID
+  Zwraca sumę wydatków, liczbę rekordów i agregację po listach.
+
+- GET /api/lists?owner_id=ID&limit=50
+  Zwraca listy z podstawowymi metadanymi.
+
+- GET /api/lists/<id>/expenses?limit=50
+  Zwraca wydatki przypisane do konkretnej listy.
+
+- GET /api/templates?owner_id=ID
+  Zwraca aktywne szablony.
+
+Uwagi:
+- limit odpowiedzi jest przycinany do max_limit ustawionego na tokenie
+- daty przekazuj w formacie YYYY-MM-DD
+- endpoint musi być zaznaczony na tokenie, samo posiadanie zakresu nie wystarczy

CLI_OPIS.txt

@@ -0,0 +1,61 @@
+Komendy CLI
+===========
+
+Admini
+-------
+flask admins list
+flask admins create <username> <password> [--admin/--user]
+flask admins promote <username|id>
+flask admins demote <username|id>
+flask admins set-password <username|id> <password>
+
+Opis:
+- list: pokazuje wszystkich uzytkownikow wraz z ID i rola
+- create: tworzy konto admina lub zwyklego uzytkownika
+- promote: nadaje uprawnienia administratora
+- demote: odbiera uprawnienia administratora
+- set-password: ustawia nowe haslo dla wskazanego konta
+
+Listy
+-----
+flask lists copy-schedule --source-list-id 12 --when "2026-03-20 18:30"
+flask lists copy-schedule --source-list-id 12 --when "2026-03-20 18:30" --owner admin
+flask lists copy-schedule --source-list-id 12 --when "2026-03-20 18:30" --title "Zakupy piatkowe"
+flask lists move --list-id 12 --when "2026-03-21 09:00"
+flask lists move --list-id 12 --when "2026-03-21 09:00" --keep-item-times --keep-expiry
+flask lists archive --list-id 12
+flask lists unarchive --list-id 12
+flask lists assign-owner --list-id 12 --owner admin
+flask lists create-from-template --template-id 5 --owner admin --when "2026-03-22 08:00"
+flask lists create-from-template --template-id 5 --owner admin --title "Weekend"
+flask lists delete --list-id 12
+flask lists rename --list-id 12 --title "Nowa nazwa listy"
+flask lists duplicate-many --source-list-id 12 --when-list "2026-03-23 08:00,2026-03-24 08:00,2026-03-25 08:00"
+flask lists duplicate-many --source-list-id 12 --when-list "2026-03-23 08:00,2026-03-24 08:00" --owner admin --title-prefix "Sklep"
+
+Zasady dzialania
+----------------
+- copy-schedule tworzy nowa liste na podstawie istniejacej
+- copy-schedule kopiuje pozycje i przypisane kategorie
+- copy-schedule ustawia nowy created_at na wartosc z parametru --when
+- gdy lista byla tymczasowa i miala expires_at, termin wygasniecia jest przesuwany o ten sam odstep czasu
+- wydatki i paragony nie sa kopiowane
+- move przenosi istniejaca liste na wskazany dzien/godzine
+- move domyslnie przesuwa rowniez czasy pozycji i expires_at o ten sam offset czasu
+- move z opcja --keep-item-times zostawia added_at i purchased_at bez zmian
+- move z opcja --keep-expiry zostawia expires_at bez zmian
+- archive oznacza liste jako archiwalna
+- unarchive przywraca liste z archiwum
+- assign-owner zmienia wlasciciela listy
+- create-from-template tworzy nowa liste z szablonu dla wskazanego wlasciciela
+- create-from-template bez --when ustawia biezacy czas UTC
+- delete usuwa liste wraz z powiazanymi pozycjami, historią i paragonami zaleznymi od relacji bazy
+- rename zmienia tytul listy
+- duplicate-many tworzy wiele kopii tej samej listy dla wielu terminow przekazanych w --when-list
+- duplicate-many opcjonalnie pozwala zmienic wlasciciela i nadac prefiks nazwy nowym listom
+
+SZABLONY I HISTORIA:
+- Historia zmian listy jest widoczna w widoku listy wlasciciela.
+- Szablon mozna utworzyc z panelu admina lub z poziomu listy wlasciciela.
+- Admin moze szybko utworzyc liste z szablonu i zduplikowac liste jednym kliknieciem.
+- Operacje CLI takie jak copy-schedule, move, archive, unarchive, assign-owner, rename i create-from-template sa zapisywane w historii listy.

Dockerfile

@@ -1 +0,0 @@
-deploy/app/Dockerfile

Dockerfile_alpine

@@ -1,66 +0,0 @@
-# =========================
-#  Stage 1 – Build
-# =========================
-FROM python:3.13-alpine AS builder
-
-WORKDIR /app
-
-# Instalacja bibliotek do kompilacji + zależności runtime
-RUN apk add --no-cache \
-    tesseract-ocr \
-    tesseract-ocr-data-pol \
-    poppler-utils \
-    libjpeg-turbo \
-    zlib \
-    libpng \
-    libwebp \
-    libffi \
-    libmagic \
-    && apk add --no-cache --virtual .build-deps \
-    build-base \
-    jpeg-dev \
-    zlib-dev \
-    libpng-dev \
-    libwebp-dev \
-    libffi-dev
-
-# Kopiujemy plik wymagań
-COPY requirements.txt .
-
-# Instalujemy zależności Pythona do folderu tymczasowego
-RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
-
-
-# =========================
-#  Stage 2 – Final image
-# =========================
-FROM python:3.13-alpine
-
-WORKDIR /app
-
-# Instalacja tylko bibliotek runtime (bez dev)
-RUN apk add --no-cache \
-    tesseract-ocr \
-    tesseract-ocr-data-pol \
-    poppler-utils \
-    libjpeg-turbo \
-    zlib \
-    libpng \
-    libwebp \
-    libffi \
-    libmagic
-
-# Kopiujemy zbudowane biblioteki z buildera
-COPY --from=builder /install /usr/local
-
-# Kopiujemy kod aplikacji
-COPY . .
-
-# Ustawiamy entrypoint
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-
-# Otwieramy port aplikacji
-EXPOSE 8000
-
-ENTRYPOINT ["/entrypoint.sh"]

README.md

@@ -1,59 +1,50 @@
 # Aplikacja List Zakupów
 
-Prosta aplikacja webowa do zarządzania listami zakupów z obsługą użytkowników, OCR paragonów, statystykami i trybem współdzielenia.
-
-## Główne funkcje
-
-- Logowanie i zarządzanie użytkownikami (admin/user)
-- Tworzenie list zakupów z pozycjami i ilością
-- Wgrywanie paragonów (podstawowa obsługa OCR)
-- Archiwizacja i udostępnianie list (publiczne/prywatne)
-- Statystyki wydatków z podziałem na okresy, statystyki dla użytkowników
-- Panel administracyjny (statystyki, produkty, paragony, zarządzanie, użytkowmicy)
+Aplikacja webowa do zarządzania listami zakupów z obsługą użytkowników, OCR paragonów, statystykami i trybem współdzielenia.
 
 ## Wymagania
 
-- Python 3.9+
-- Docker (opcjonalnie dla produkcji)
+- Docker
 
-## Instalacja lokalna
+## Instalacja
 
 1. Sklonuj repozytorium:
 
    ```bash
-   git https://gitea.linuxiarz.pl/gru/lista_zakupowa_live.git
+   git pull https://git.linuxiarz.pl/gru/lista_zakupowa_live.git
    cd lista_zakupowa_live
    ```
 
-2. Utwórz i uzupełnij plik `.env` (zobacz `.env example`).
+1. Skonfiguruj `.env` z pliku `.env.example` 
 
-3. Utwórz środowisko i zainstaluj zależności:
+2.1 Uruchom: (pgsql)
 
    ```bash
-   python -m venv venv
-   source venv/bin/activate
-   pip install -r requirements.txt
+   bash deploy_docker.sh pgsql
    ```
 
-4. Uruchom aplikację:
+2.2 Uruchom: (mysql)
 
    ```bash
-   flask --app app.py run
+   bash deploy_docker.sh mysql
    ```
 
-## Deploy z Docker Compose
-
-1. Skonfiguruj `.env`.
-
-2. Uruchom:
+2.3 Uruchom: (sqlite)
 
    ```bash
-   docker-compose up --build
+   bash deploy_docker.sh sqlite
+   ```
+
+2.3 Restart: 
+   ```bash
+   bash deploy_docker.sh pgsql restart
+   lub
+   bash deploy_docker.sh sqlite restart
    ```
 
 Aplikacja będzie dostępna pod `http://localhost:8000`.
 
-## Domyślne dane logowania
+## Domyślne dane logowania - konfigurowane z pliku `.env`
 
 - Główne hasło systemowe: `admin`
 - Admin: `admin` / `admin123`
@@ -66,11 +57,35 @@ Ustaw `DB_ENGINE` oraz odpowiednie zmienne w `.env`:
 
 Przykład dla PostgreSQL:
 
-```env
-DB_ENGINE=pgsql
-DB_HOST=db
-DB_PORT=5432
-DB_NAME=myapp
-DB_USER=user
-DB_PASSWORD=pass
-```
+   ```bash
+   DB_ENGINE=pgsql
+   DB_HOST=db
+   DB_PORT=5432
+   DB_NAME=myapp
+   DB_USER=user
+   DB_PASSWORD=pass
+   ```
+
+## CLI
+
+Opis komend administracyjnych znajduje sie w pliku `KOMENDY_CLI.txt`.
+
+Komendy CLI uruchamiamy wewnatrz kontenera aplikacji. Najwygodniej wejsc do katalogu projektu i wykonac polecenie przez `docker compose exec app`.
+
+Przykladowe:
+
+   ```bash
+   cd /opt/lista_zakupowa_live
+   docker compose -f docker/compose.yml exec app sh -c 'flask lists copy-schedule --source-list-id 393 --when "2026-03-22 11:30" --owner admin'
+   ```
+
+Dodatkowe przyklady:
+
+   ```bash
+   docker compose -f docker/compose.yml exec app sh -c 'flask lists move --list-id 393 --when "2026-03-23 08:00"'
+
+   docker compose -f docker/compose.yml exec app sh -c 'flask lists rename --list-id 393 --title "Zakupy na poniedzialek"'
+
+   docker compose -f docker/compose.yml exec app sh -c 'flask lists create-from-template --template-id 7 --owner admin --when "2026-03-24 09:15" --title "Poranna lista"'
+   ```
+

config.py

@@ -1,85 +1,113 @@
 import os
+from urllib.parse import quote_plus
 
 basedir = os.path.abspath(os.path.dirname(__file__))
 
 
+def env_str(name, default=None):
+    value = os.environ.get(name)
+    return default if value is None else value
+
+
+def env_int(name, default):
+    value = os.environ.get(name)
+    if value is None or value == "":
+        return default
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return default
+
+
+def env_bool(name, default=False):
+    value = os.environ.get(name)
+    if value is None:
+        return default
+    return str(value).strip().lower() in ("1", "true", "yes", "on")
+
+
 class Config:
-
     SESSION_COOKIE_HTTPONLY = True
-    SESSION_COOKIE_SAMESITE = "Lax"  # działa w HTTP i HTTPS
-    
-    SECRET_KEY = os.environ.get("SECRET_KEY", "D8pceNZ8q%YR7^7F&9wAC2")
+    SESSION_COOKIE_SAMESITE = "Lax"
 
-    APP_PORT = int(os.environ.get("APP_PORT", "8000") or "8000")
+    SECRET_KEY = env_str("SECRET_KEY", "D8pceNZ8q%YR7^7F&9wAC2")
+
+    APP_PORT = env_int("APP_PORT", 8000)
+
+    DB_ENGINE = env_str("DB_ENGINE", "sqlite").lower()
 
-    DB_ENGINE = os.environ.get("DB_ENGINE", "sqlite").lower()
     if DB_ENGINE == "sqlite":
         SQLALCHEMY_DATABASE_URI = (
             f"sqlite:///{os.path.join(basedir, 'db', 'shopping.db')}"
         )
+
     elif DB_ENGINE == "pgsql":
-        SQLALCHEMY_DATABASE_URI = f"postgresql://{os.environ['DB_USER']}:{os.environ['DB_PASSWORD']}@{os.environ['DB_HOST']}:{os.environ.get('DB_PORT', 5432)}/{os.environ['DB_NAME']}"
+        db_user = quote_plus(env_str("DB_USER", "user"))
+        db_password = quote_plus(env_str("DB_PASSWORD", "pass"))
+        db_host = env_str("DB_HOST", "pgsql")
+        db_port = env_str("DB_PORT", "5432")
+        db_name = quote_plus(env_str("DB_NAME", "myapp"))
+
+        SQLALCHEMY_DATABASE_URI = (
+            f"postgresql://{db_user}:{db_password}@{db_host}:{db_port}/{db_name}"
+        )
+
     elif DB_ENGINE == "mysql":
-        SQLALCHEMY_DATABASE_URI = f"mysql+pymysql://{os.environ['DB_USER']}:{os.environ['DB_PASSWORD']}@{os.environ['DB_HOST']}:{os.environ.get('DB_PORT', 3306)}/{os.environ['DB_NAME']}"
+        db_user = quote_plus(env_str("DB_USER", "user"))
+        db_password = quote_plus(env_str("DB_PASSWORD", "pass"))
+        db_host = env_str("DB_HOST", "mysql")
+        db_port = env_str("DB_PORT", "3306")
+        db_name = quote_plus(env_str("DB_NAME", "myapp"))
+
+        SQLALCHEMY_DATABASE_URI = (
+            f"mysql+pymysql://{db_user}:{db_password}@{db_host}:{db_port}/{db_name}"
+        )
+
     else:
         raise ValueError("Nieobsługiwany typ bazy danych.")
 
     SQLALCHEMY_TRACK_MODIFICATIONS = False
-    SYSTEM_PASSWORD = os.environ.get("SYSTEM_PASSWORD", "admin")
-    DEFAULT_ADMIN_USERNAME = os.environ.get("DEFAULT_ADMIN_USERNAME", "admin")
-    DEFAULT_ADMIN_PASSWORD = os.environ.get("DEFAULT_ADMIN_PASSWORD", "admin123")
-    UPLOAD_FOLDER = os.environ.get("UPLOAD_FOLDER", "uploads")
-    AUTHORIZED_COOKIE_VALUE = os.environ.get("AUTHORIZED_COOKIE_VALUE", "cookievalue")
-    BCRYPT_PEPPER = os.environ.get("BCRYPT_PEPPER", "sekretnyKluczBcrypt")
-    SESSION_COOKIE_SECURE = os.environ.get("SESSION_COOKIE_SECURE", "0") == "1"
-    HEALTHCHECK_TOKEN = os.environ.get("HEALTHCHECK_TOKEN", "alamapsaikota1234")
 
-    try:
-        AUTH_COOKIE_MAX_AGE = int(
-            os.environ.get("AUTH_COOKIE_MAX_AGE", "86400") or "86400"
-        )
-    except ValueError:
-        AUTH_COOKIE_MAX_AGE = 86400
+    SYSTEM_PASSWORD = env_str("SYSTEM_PASSWORD", "admin")
+    DEFAULT_ADMIN_USERNAME = env_str("DEFAULT_ADMIN_USERNAME", "admin")
+    DEFAULT_ADMIN_PASSWORD = env_str("DEFAULT_ADMIN_PASSWORD", "admin123")
+    UPLOAD_FOLDER = env_str("UPLOAD_FOLDER", "uploads")
+    AUTHORIZED_COOKIE_VALUE = env_str("AUTHORIZED_COOKIE_VALUE", "cookievalue")
+    BCRYPT_PEPPER = env_str("BCRYPT_PEPPER", "sekretnyKluczBcrypt")
+    SESSION_COOKIE_SECURE = env_bool("SESSION_COOKIE_SECURE", False)
+    HEALTHCHECK_TOKEN = env_str("HEALTHCHECK_TOKEN", "alamapsaikota1234")
 
-    try:
-        SESSION_TIMEOUT_MINUTES = int(
-            os.environ.get("SESSION_TIMEOUT_MINUTES", "10080") or "10080"
-        )
-    except ValueError:
-        SESSION_TIMEOUT_MINUTES = 10080
+    AUTH_COOKIE_MAX_AGE = env_int("AUTH_COOKIE_MAX_AGE", 86400)
+    SESSION_TIMEOUT_MINUTES = env_int("SESSION_TIMEOUT_MINUTES", 10080)
 
-    ENABLE_HSTS = os.environ.get("ENABLE_HSTS", "0") == "1"
-    ENABLE_XFO = os.environ.get("ENABLE_XFO", "0") == "1"
-    ENABLE_XCTO = os.environ.get("ENABLE_XCTO", "0") == "1"
-    ENABLE_CSP = os.environ.get("ENABLE_CSP", "0") == "1"
-    ENABLE_PP = os.environ.get("ENABLE_PP", "0") == "1"
-    REFERRER_POLICY = os.environ.get("REFERRER_POLICY") or None
+    ENABLE_HSTS = env_bool("ENABLE_HSTS", False)
+    ENABLE_XFO = env_bool("ENABLE_XFO", False)
+    ENABLE_XCTO = env_bool("ENABLE_XCTO", False)
+    ENABLE_CSP = env_bool("ENABLE_CSP", False)
+    ENABLE_PP = env_bool("ENABLE_PP", False)
 
-    DEBUG_MODE = os.environ.get("DEBUG_MODE", "1") == "1"
-    DISABLE_ROBOTS = os.environ.get("DISABLE_ROBOTS", "0") == "1"
+    REFERRER_POLICY = env_str("REFERRER_POLICY") or None
 
-    JS_CACHE_CONTROL = os.environ.get(
-        "JS_CACHE_CONTROL", "no-cache"
-    )
-    CSS_CACHE_CONTROL = os.environ.get(
-        "CSS_CACHE_CONTROL", "no-cache"
-    )
-    LIB_JS_CACHE_CONTROL = os.environ.get(
-        "LIB_JS_CACHE_CONTROL", "max-age=604800"
-    )
-    LIB_CSS_CACHE_CONTROL = os.environ.get(
-        "LIB_CSS_CACHE_CONTROL", "max-age=604800"
-    )
-    UPLOADS_CACHE_CONTROL = os.environ.get(
-        "UPLOADS_CACHE_CONTROL", "public, max-age=2592000, immutable"
+    DEBUG_MODE = env_bool("DEBUG_MODE", True)
+    DISABLE_ROBOTS = env_bool("DISABLE_ROBOTS", False)
+
+    JS_CACHE_CONTROL = env_str("JS_CACHE_CONTROL", "no-cache")
+    CSS_CACHE_CONTROL = env_str("CSS_CACHE_CONTROL", "no-cache")
+    LIB_JS_CACHE_CONTROL = env_str("LIB_JS_CACHE_CONTROL", "max-age=604800")
+    LIB_CSS_CACHE_CONTROL = env_str("LIB_CSS_CACHE_CONTROL", "max-age=604800")
+    UPLOADS_CACHE_CONTROL = env_str(
+        "UPLOADS_CACHE_CONTROL",
+        "public, max-age=2592000, immutable",
     )
 
     DEFAULT_CATEGORIES = [
-        c.strip() for c in os.environ.get(
+        c.strip()
+        for c in env_str(
             "DEFAULT_CATEGORIES",
-            "Spożywcze,Budowlane,Zabawki,Chemia,Inne,Elektronika,Odzież i obuwie,"
+            "Spożywcze,Budowlane,Zabawki,Chemia,Inne,Elektronika,Odzież i obuwie,Jedzenie poza domem,"
             "Artykuły biurowe,Kosmetyki i higiena,Motoryzacja,Ogród i rośliny,"
             "Zwierzęta,Sprzęt sportowy,Książki i prasa,Narzędzia i majsterkowanie,"
-            "RTV / AGD,Apteka i suplementy,Artykuły dekoracyjne,Gry i hobby,Usługi,Pieczywo,Różne,Chiny,Dom,Leki,Odzież,Samochód"
-        ).split(",") if c.strip()
+            "RTV / AGD,Apteka i suplementy,Artykuły dekoracyjne,Gry i hobby,Usługi,Pieczywo,Różne,Chiny,Dom,Leki,Odzież,Samochód,Dzieci",
+        ).split(",")
+        if c.strip()
     ]

deploy/app/Dockerfile

@@ -1,5 +1,4 @@
-
-FROM python:3.14-rc-trixie
+FROM python:3.14-trixie
 #FROM python:3.13-slim
 WORKDIR /app
 

deploy/varnish/default.vcl.template

@@ -65,7 +65,7 @@ sub vcl_recv {
   # }
 
   # ---- STATYCZNE – agresywny cache + ignorujemy sesję ----
-  if (req.url ~ "^/static/" || req.url ~ "\.(css|js|png|jpe?g|webp|svg|ico|woff2?)$") {
+  if (req.url ~ "^/static/" || req.url ~ "^/uploads/" || req.url ~ "\.(css|js|png|jpe?g|webp|svg|ico|woff2?)$") {
     unset req.http.Cookie;
     unset req.http.Authorization;
     return (hash);
@@ -75,6 +75,27 @@ sub vcl_recv {
     set req.http.X-Forwarded-Proto = "https";
   }
 
+  if (req.url == "/healthcheck" || req.http.X-Internal-Check) {
+    set req.http.X-Pass-Reason = "internal";
+    return (pass);
+  }
+
+  if (req.method != "GET" && req.method != "HEAD") {
+    set req.http.X-Pass-Reason = "method";
+    return (pass);
+  }
+
+  if (req.http.Authorization) {
+    set req.http.X-Pass-Reason = "auth";
+    return (pass);
+  }
+
+  # jeśli chcesz PASS przy cookie:
+  # if (req.http.Cookie) {
+  #   set req.http.X-Pass-Reason = "cookie";
+  #   return (pass);
+  # }
+
   return (hash);
 }
 
@@ -107,6 +128,7 @@ sub vcl_backend_response {
   if (beresp.http.Cache-Control ~ "(?i)no-store|private") {
     set beresp.uncacheable = true;
     set beresp.ttl = 0s;
+    set beresp.http.X-Pass-Reason = "no-store";
     return (deliver);
   }
 
@@ -114,12 +136,12 @@ sub vcl_backend_response {
   if (beresp.status >= 300 && beresp.status < 400) {
     set beresp.uncacheable = true;
     set beresp.ttl = 0s;
+    set beresp.http.X-Pass-Reason = "redirect";
     return (deliver);
   }
 
   # Nie cache'uj statyków, jeśli status ≠ 200
-  if (bereq.url ~ "^/static/" ||
-      bereq.url ~ "\.(css|js|png|jpe?g|webp|svg|ico|woff2?)($|\?)") {
+  if (bereq.url ~ "^/static/" || bereq.url ~ "^/uploads/" || bereq.url ~ "\.(css|js|png|jpe?g|webp|svg|ico|woff2?)($|\?)") {
     if (beresp.status != 200) {
       set beresp.uncacheable = true;
       set beresp.ttl = 0s;
@@ -147,7 +169,7 @@ sub vcl_backend_response {
   }
 
   # ---- STATYCZNE: zdejmij Set-Cookie i Vary: Cookie, zapewnij TTL ----
-  if (bereq.url ~ "^/static/" || bereq.url ~ "\.(css|js|png|jpe?g|webp|svg|ico|woff2?)$") {
+  if (bereq.url ~ "^/static/" || bereq.url ~ "^/uploads/" || bereq.url ~ "\.(css|js|png|jpe?g|webp|svg|ico|woff2?)$") {
     unset beresp.http.Set-Cookie;
 
     # Jeśli backend dodał Vary: Cookie, usuńmy ten element (nie wpływa na statyki)
@@ -210,7 +232,14 @@ sub vcl_backend_error {
 # ===== DELIVER =====
 sub vcl_deliver {
   if (obj.uncacheable) {
-    set resp.http.X-Cache = "PASS";
+    if (req.http.X-Pass-Reason) {
+      set resp.http.X-Cache = "PASS:" + req.http.X-Pass-Reason;
+    } else if (resp.http.X-Pass-Reason) {    # z backendu
+      set resp.http.X-Cache = "PASS:" + resp.http.X-Pass-Reason;
+    } else {
+      set resp.http.X-Cache = "PASS";
+    }
+    unset resp.http.X-Pass-Reason;
     unset resp.http.Age;
   } else if (obj.hits > 0) {
     set resp.http.X-Cache = "HIT";
@@ -222,13 +251,19 @@ sub vcl_deliver {
   unset resp.http.Via;
   unset resp.http.X-Varnish;
   unset resp.http.Server;
+  unset resp.http.Content-Disposition;
 }
 
 sub vcl_synth {
+  set resp.http.Cache-Control = "private, no-store, no-cache";
   set resp.http.X-Cache = "SYNTH";
+  unset resp.http.Via;
+  unset resp.http.X-Varnish;
+  unset resp.http.Server;
+  unset resp.http.Content-Disposition;
 }
 
 # ===== PURGE HANDLER =====
 sub vcl_purge {
   return (synth(200, "Purged"));
-}
+}

deploy_docker.sh

@@ -1,7 +1,8 @@
 #!/bin/bash
-set -e
+set -euo pipefail
+
+COMPOSE_FILE="docker/compose.yml"
 
-# --- Wczytaj zmienne z .env ---
 if [[ -f .env ]]; then
   set -a
   source .env
@@ -9,23 +10,63 @@ if [[ -f .env ]]; then
 fi
 
 APP_PORT="${APP_PORT:-8080}"
+DEFAULT_ENGINE="${DB_ENGINE:-sqlite}"
 
-PROFILE=$1
+print_usage() {
+  echo "Użycie:"
+  echo "  $0 [sqlite|pgsql|mysql] [deploy|restart]"
+  echo
+  echo "Przykłady:"
+  echo "  $0 pgsql deploy"
+  echo "  $0 mysql restart"
+  echo "  $0 sqlite"
+  echo
+  echo "Domyślnie:"
+  echo "  silnik: z DB_ENGINE z .env albo sqlite"
+  echo "  akcja: deploy"
+}
 
-if [[ -z "$PROFILE" ]]; then
-  echo "Użycie: $0 {pgsql|mysql|sqlite}"
-  exit 1
+validate_engine() {
+  local engine="$1"
+  case "$engine" in
+    sqlite|pgsql|mysql)
+      return 0
+      ;;
+    *)
+      echo "Błąd: nieobsługiwany silnik bazy: '$engine'"
+      echo "Dozwolone wartości: sqlite, pgsql, mysql"
+      exit 1
+      ;;
+  esac
+}
+
+validate_action() {
+  local action="$1"
+  case "$action" in
+    deploy|restart)
+      return 0
+      ;;
+    *)
+      echo "Błąd: nieobsługiwana akcja: '$action'"
+      echo "Dozwolone wartości: deploy, restart"
+      exit 1
+      ;;
+  esac
+}
+
+PROFILE="${1:-$DEFAULT_ENGINE}"
+ACTION="${2:-deploy}"
+
+validate_engine "$PROFILE"
+validate_action "$ACTION"
+
+if [[ -n "${DB_ENGINE:-}" && "$DB_ENGINE" != "$PROFILE" ]]; then
+  echo "Uwaga: DB_ENGINE w .env ma wartość '$DB_ENGINE', a uruchamiasz profil '$PROFILE'."
+  echo "Kontynuuję z profilem z argumentu: '$PROFILE'"
 fi
 
-echo "Zatrzymuję kontenery aplikacji i bazy..."
-if [[ "$PROFILE" == "sqlite" ]]; then
-  docker compose stop
-else
-  docker compose --profile "$PROFILE" stop
-fi
-
-echo "Pobieram najnowszy kod z repozytorium..."
-git pull
+echo "Wybrany silnik bazy: $PROFILE"
+echo "Wybrana akcja: $ACTION"
 
 echo "Generowanie default.vcl z APP_PORT=$APP_PORT"
 envsubst < deploy/varnish/default.vcl.template > deploy/varnish/default.vcl
@@ -33,11 +74,34 @@ envsubst < deploy/varnish/default.vcl.template > deploy/varnish/default.vcl
 echo "Zapisuję hash commita do version.txt..."
 git rev-parse --short HEAD > version.txt
 
-echo "Buduję i uruchamiam kontenery..."
-if [[ "$PROFILE" == "sqlite" ]]; then
-  docker compose up -d --build
-else
-  DB_ENGINE="$PROFILE" docker compose --profile "$PROFILE" up -d --build
+if [[ "$ACTION" == "restart" ]]; then
+  echo "Odtwarzam kontenery bez przebudowy obrazu..."
+
+  if [[ "$PROFILE" == "sqlite" ]]; then
+    docker compose -f "$COMPOSE_FILE" up -d --force-recreate
+  else
+    DB_ENGINE="$PROFILE" docker compose -f "$COMPOSE_FILE" --profile "$PROFILE" up -d --force-recreate
+  fi
+
+  echo "Gotowe! Wersja aplikacji: $(cat version.txt)"
+  exit 0
 fi
 
-echo "Gotowe! Wersja aplikacji: $(cat version.txt)"
+echo "Zatrzymuję kontenery aplikacji i bazy..."
+if [[ "$PROFILE" == "sqlite" ]]; then
+  docker compose -f "$COMPOSE_FILE" stop
+else
+  DB_ENGINE="$PROFILE" docker compose -f "$COMPOSE_FILE" --profile "$PROFILE" stop
+fi
+
+echo "Pobieram najnowszy kod z repozytorium..."
+git pull
+
+echo "Uruchamiam kontenery z przebudową obrazu..."
+if [[ "$PROFILE" == "sqlite" ]]; then
+  docker compose -f "$COMPOSE_FILE" up -d --build
+else
+  DB_ENGINE="$PROFILE" docker compose -f "$COMPOSE_FILE" --profile "$PROFILE" up -d --build
+fi
+
+echo "Gotowe! Wersja aplikacji: $(cat version.txt)"

docker/Dockerfile

@@ -0,0 +1,28 @@
+FROM python:3.14-trixie
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    tesseract-ocr \
+    tesseract-ocr-pol \
+    libglib2.0-0 \
+    libsm6 \
+    libxrender1 \
+    libxext6 \
+    poppler-utils \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY docker/requirements.txt /app/requirements.txt
+
+RUN pip install --upgrade pip
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . /app
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+
+#EXPOSE 8000
+
+ENTRYPOINT ["/entrypoint.sh"]

docker/Dockerfile.debian-slim

@@ -0,0 +1,28 @@
+FROM python:3.14-slim-trixie
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    tesseract-ocr \
+    tesseract-ocr-pol \
+    libglib2.0-0 \
+    libsm6 \
+    libxrender1 \
+    libxext6 \
+    poppler-utils \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY docker/requirements.txt /app/requirements.txt
+
+RUN pip install --upgrade pip
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . /app
+
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+#EXPOSE 8000
+
+ENTRYPOINT ["/entrypoint.sh"]

docker/Dockerfile.debian-stable-slim

@@ -0,0 +1,27 @@
+FROM python:3.14-slim-trixie
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    tesseract-ocr \
+    tesseract-ocr-pol \
+    libglib2.0-0 \
+    libsm6 \
+    libxrender1 \
+    libxext6 \
+    poppler-utils \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY docker/requirements-stable.txt /app/requirements.txt
+
+RUN pip install --upgrade pip
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . /app
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+#EXPOSE 8000
+
+ENTRYPOINT ["/entrypoint.sh"]

docker/compose.yml

@@ -1,23 +1,29 @@
 services:
   app:
-    build: .
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.debian-stable-slim
     container_name: lista-zakupow-app
-    #ports:
-    #  - "${APP_PORT:-8000}:8000"
     expose:
       - "${APP_PORT:-8000}"
     healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request; import sys; req = urllib.request.Request('http://localhost:${APP_PORT:-8000}/healthcheck', headers={'X-Internal-Check': '${HEALTHCHECK_TOKEN}'}); sys.exit(0) if urllib.request.urlopen(req).read() == b'OK' else sys.exit(1)"]
+      test:
+        [
+          "CMD",
+          "python",
+          "-c",
+          "import urllib.request; import sys; req = urllib.request.Request('http://localhost:${APP_PORT:-8000}/healthcheck', headers={'X-Internal-Check': '${HEALTHCHECK_TOKEN}'}); sys.exit(0) if urllib.request.urlopen(req).getcode() == 200 else sys.exit(1)",
+        ]
       interval: 30s
       timeout: 10s
       retries: 3
       start_period: 10s
     env_file:
-      - .env
+      - ../.env
     volumes:
-      - .:/app
-      - ./uploads:/app/uploads
-      - ./instance:/app/instance
+      - ../:/app
+      - ../uploads:/app/uploads
+      - ../instance:/app/instance
     networks:
       - lista-zakupow_network
     restart: unless-stopped
@@ -31,16 +37,9 @@ services:
     ports:
       - "${APP_PORT:-8000}:80"
     volumes:
-      - ./deploy/varnish/default.vcl:/etc/varnish/default.vcl:ro
+      - ../deploy/varnish/default.vcl:/etc/varnish/default.vcl:ro
     environment:
       - VARNISH_SIZE=256m
-    healthcheck:
-      test: [ "CMD-SHELL", "curl -fsS -H 'X-Internal-Check=${HEALTHCHECK_TOKEN}' http://localhost/healthcheck | grep -q OK" ]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-    env_file:
-      - .env
     networks:
       - lista-zakupow_network
     restart: unless-stopped
@@ -54,7 +53,7 @@ services:
       MYSQL_PASSWORD: ${DB_PASSWORD}
       MYSQL_ROOT_PASSWORD: 89o38kUX5T4C
     volumes:
-      - ./db/mysql:/var/lib/mysql
+      - ../db/mysql:/var/lib/mysql
     restart: unless-stopped
     networks:
       - lista-zakupow_network
@@ -69,7 +68,7 @@ services:
       POSTGRES_PASSWORD: ${DB_PASSWORD}
       PGDATA: /var/lib/postgresql
     volumes:
-      - ./db/pgsql/:/var/lib/postgresql
+      - ../db/pgsql:/var/lib/postgresql
     networks:
       - lista-zakupow_network
     restart: unless-stopped
@@ -77,4 +76,4 @@ services:
 
 networks:
   lista-zakupow_network:
-    driver: bridge
+    driver: bridge

docker/requirements-stable.txt

@@ -0,0 +1,21 @@
+bcrypt==5.0.0
+cryptography==46.0.5
+Flask==3.1.3
+Flask-Compress==1.23
+Flask-Login==0.6.3
+Flask-Session==0.8.0
+Flask-SocketIO==5.6.1
+Flask-SQLAlchemy==3.1.1
+flask-talisman==1.1.0
+gevent==25.9.1
+gevent-websocket==0.10.1
+opencv-python-headless>=4.12.0.88
+pdf2image==1.17.0
+pillow==12.1.1
+pillow_heif==1.3.0
+psutil==7.2.2
+psycopg2-binary==2.9.11
+PyMySQL==1.1.2
+pytesseract==0.3.13
+SQLAlchemy==2.0.48
+Werkzeug==3.1.6

docker/requirements.txt

@@ -3,7 +3,8 @@ Flask-SQLAlchemy
 Flask-Login
 Flask-SocketIO
 Flask-Compress
-eventlet
+#eventlet
+gevent-websocket
 Werkzeug
 Pillow
 psutil

entrypoint.sh

@@ -1,10 +1,16 @@
 #!/bin/sh
 
-# Czekaj na bazę w Pythonie
-python _tools/wait_for_db.py
+# Jeśli nie przekazano zmiennej środowiskowej DB_ENGINE, ustaw na sqlite
+DB_ENGINE=${DB_ENGINE:-sqlite}
 
-# Jak baza gotowa, to migruj li daj informacje
+echo "Starting app with database engine: $DB_ENGINE"
+
+# Czekaj na bazę, jeśli jest inna niż sqlite (np. PostgreSQL)
+if [ "$DB_ENGINE" != "sqlite" ]; then
+  python _tools/wait_for_db.py --engine "$DB_ENGINE"
+fi
+
+# Migracje i start aplikacji
 flask db upgrade 2>/dev/null || flask db_info
 
-# Start aplikacji
 exec python app.py

shopping_app/__init__.py

@@ -0,0 +1,11 @@
+from .app_setup import app, db, socketio, login_manager, APP_PORT, DEBUG_MODE, static_bp
+from . import models  # noqa: F401
+from . import helpers  # noqa: F401
+app.register_blueprint(static_bp)
+from . import web  # noqa: F401
+from . import routes_main  # noqa: F401
+from . import routes_secondary  # noqa: F401
+from . import routes_admin  # noqa: F401
+from . import sockets  # noqa: F401
+
+__all__ = ["app", "db", "socketio", "login_manager", "APP_PORT", "DEBUG_MODE"]

shopping_app/app_setup.py

@@ -0,0 +1,127 @@
+from .deps import *
+
+app = Flask(__name__)
+app.config.from_object(Config)
+
+csp_policy = (
+    {
+        "default-src": "'self'",
+        "script-src": "'self' 'unsafe-inline'",
+        "style-src": "'self' 'unsafe-inline'",
+        "img-src": "'self' data:",
+        "connect-src": "'self'",
+    }
+    if app.config.get("ENABLE_CSP", True)
+    else None
+)
+
+permissions_policy = {"browsing-topics": "()"} if app.config.get("ENABLE_PP") else None
+
+talisman_kwargs = {
+    "force_https": False,
+    "strict_transport_security": app.config.get("ENABLE_HSTS", True),
+    "frame_options": "DENY" if app.config.get("ENABLE_XFO", True) else None,
+    "permissions_policy": permissions_policy,
+    "content_security_policy": csp_policy,
+    "x_content_type_options": app.config.get("ENABLE_XCTO", True),
+    "strict_transport_security_include_subdomains": False,
+}
+
+referrer_policy = app.config.get("REFERRER_POLICY")
+if referrer_policy:
+    talisman_kwargs["referrer_policy"] = referrer_policy
+
+effective_headers = {
+    k: v
+    for k, v in talisman_kwargs.items()
+    if k != "referrer_policy" and v not in (None, False)
+}
+
+if effective_headers:
+    from flask_talisman import Talisman
+
+    talisman = Talisman(
+        app,
+        session_cookie_secure=app.config.get("SESSION_COOKIE_SECURE", True),
+        **talisman_kwargs,
+    )
+    print("[TALISMAN] Włączony z nagłówkami:", list(effective_headers.keys()))
+else:
+    print("[TALISMAN] Pominięty — wszystkie nagłówki security wyłączone.")
+
+register_heif_opener()
+SQLALCHEMY_ECHO = True
+ALLOWED_EXTENSIONS = {"png", "jpg", "jpeg", "gif", "webp", "heic", "pdf"}
+SYSTEM_PASSWORD = app.config.get("SYSTEM_PASSWORD")
+DEFAULT_ADMIN_USERNAME = app.config.get("DEFAULT_ADMIN_USERNAME")
+DEFAULT_ADMIN_PASSWORD = app.config.get("DEFAULT_ADMIN_PASSWORD")
+UPLOAD_FOLDER = app.config.get("UPLOAD_FOLDER")
+AUTHORIZED_COOKIE_VALUE = app.config.get("AUTHORIZED_COOKIE_VALUE")
+AUTH_COOKIE_MAX_AGE = app.config.get("AUTH_COOKIE_MAX_AGE")
+HEALTHCHECK_TOKEN = app.config.get("HEALTHCHECK_TOKEN")
+SESSION_TIMEOUT_MINUTES = int(app.config.get("SESSION_TIMEOUT_MINUTES"))
+SESSION_COOKIE_SECURE = app.config.get("SESSION_COOKIE_SECURE")
+APP_PORT = int(app.config.get("APP_PORT"))
+app.config["COMPRESS_ALGORITHM"] = ["zstd", "br", "gzip", "deflate"]
+app.config["PERMANENT_SESSION_LIFETIME"] = timedelta(minutes=SESSION_TIMEOUT_MINUTES)
+app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1)
+DEBUG_MODE = app.config.get("DEBUG_MODE", False)
+os.makedirs(UPLOAD_FOLDER, exist_ok=True)
+db_uri = app.config.get("SQLALCHEMY_DATABASE_URI", "")
+if db_uri.startswith("sqlite:///"):
+    sqlite_path = db_uri.replace("sqlite:///", "", 1)
+    sqlite_dir = os.path.dirname(sqlite_path)
+    if sqlite_dir:
+        os.makedirs(sqlite_dir, exist_ok=True)
+failed_login_attempts = defaultdict(deque)
+MAX_ATTEMPTS = 10
+TIME_WINDOW = 60 * 60
+WEBP_SAVE_PARAMS = {
+    "format": "WEBP",
+    "lossless": False,
+    "method": 6,
+    "quality": 95,
+}
+
+def read_commit(filename="version.txt", root_path=None):
+    base = root_path or os.path.dirname(os.path.abspath(__file__))
+    path = os.path.join(base, filename)
+    if not os.path.exists(path):
+        return None
+    try:
+        commit = open(path, "r", encoding="utf-8").read().strip()
+        return commit[:12] if commit else None
+    except Exception:
+        return None
+
+
+def get_file_md5(path):
+    try:
+        digest = hashlib.md5()
+        with open(path, "rb") as f:
+            for chunk in iter(lambda: f.read(8192), b""):
+                digest.update(chunk)
+        return digest.hexdigest()[:12]
+    except Exception:
+        return "dev"
+
+
+commit = read_commit("version.txt", root_path=os.path.dirname(os.path.dirname(__file__))) or "dev"
+APP_VERSION = commit
+app.config["APP_VERSION"] = APP_VERSION
+db = SQLAlchemy(app)
+socketio = SocketIO(app, async_mode="gevent")
+login_manager = LoginManager(app)
+login_manager.login_view = "login"
+app.config["SESSION_TYPE"] = "sqlalchemy"
+app.config["SESSION_SQLALCHEMY"] = db
+Session(app)
+compress = Compress()
+compress.init_app(app)
+static_bp = Blueprint("static_bp", __name__)
+active_users = {}
+
+def utcnow():
+    return datetime.now(timezone.utc)
+
+app_start_time = utcnow()

shopping_app/deps.py

@@ -0,0 +1,39 @@
+import os
+import secrets
+import time
+import mimetypes
+import sys
+import platform
+import psutil
+import hashlib
+import re
+import traceback
+import bcrypt
+import colorsys
+from pillow_heif import register_heif_opener
+from datetime import datetime, timedelta, UTC, timezone
+from urllib.parse import urlparse, urlunparse, urlencode
+from flask import (
+    Flask, render_template, redirect, url_for, request, flash, Blueprint,
+    send_from_directory, abort, session, jsonify, g, render_template_string
+)
+from flask_sqlalchemy import SQLAlchemy
+from flask_login import (
+    LoginManager, UserMixin, login_user, login_required, logout_user, current_user
+)
+from flask_compress import Compress
+from flask_socketio import SocketIO, emit, join_room
+from config import Config
+from PIL import Image, ExifTags, ImageFilter, ImageOps
+from werkzeug.middleware.proxy_fix import ProxyFix
+from sqlalchemy import func, extract, inspect, or_, case, text, and_, literal
+from sqlalchemy.orm import joinedload, load_only, aliased
+from collections import defaultdict, deque
+from functools import wraps
+from flask_session import Session
+from types import SimpleNamespace
+from pdf2image import convert_from_bytes
+from typing import Sequence, Any
+import pytesseract
+from pytesseract import Output
+import logging

shopping_app/models.py

@@ -0,0 +1,216 @@
+from .deps import *
+from .app_setup import db, utcnow
+
+class User(UserMixin, db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    username = db.Column(db.String(150), unique=True, nullable=False)
+    password_hash = db.Column(db.String(512), nullable=False)
+    is_admin = db.Column(db.Boolean, default=False)
+
+
+# Tabela pośrednia
+shopping_list_category = db.Table(
+    "shopping_list_category",
+    db.Column(
+        "shopping_list_id",
+        db.Integer,
+        db.ForeignKey("shopping_list.id"),
+        primary_key=True,
+    ),
+    db.Column(
+        "category_id", db.Integer, db.ForeignKey("category.id"), primary_key=True
+    ),
+)
+
+
+class Category(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    name = db.Column(db.String(100), unique=True, nullable=False)
+
+
+class ShoppingList(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    title = db.Column(db.String(150), nullable=False)
+    created_at = db.Column(db.DateTime, default=datetime.utcnow)
+
+    owner_id = db.Column(db.Integer, db.ForeignKey("user.id"))
+    owner = db.relationship("User", backref="lists", foreign_keys=[owner_id])
+
+    is_temporary = db.Column(db.Boolean, default=False)
+    share_token = db.Column(db.String(64), unique=True, nullable=True)
+    expires_at = db.Column(db.DateTime(timezone=True), nullable=True)
+    owner = db.relationship("User", backref="lists", lazy=True)
+    is_archived = db.Column(db.Boolean, default=False)
+    is_public = db.Column(db.Boolean, default=False)
+
+    # Relacje
+    items = db.relationship("Item", back_populates="shopping_list", lazy="select")
+    receipts = db.relationship(
+        "Receipt",
+        back_populates="shopping_list",
+        cascade="all, delete-orphan",
+        lazy="select",
+    )
+    expenses = db.relationship("Expense", back_populates="shopping_list", lazy="select")
+    categories = db.relationship(
+        "Category",
+        secondary=shopping_list_category,
+        backref=db.backref("shopping_lists", lazy="dynamic"),
+    )
+
+
+class Item(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    list_id = db.Column(db.Integer, db.ForeignKey("shopping_list.id"))
+    name = db.Column(db.String(150), nullable=False)
+    # added_at = db.Column(db.DateTime, default=datetime.utcnow)
+    added_at = db.Column(db.DateTime, default=utcnow)
+    added_by = db.Column(db.Integer, db.ForeignKey("user.id"), nullable=True)
+    added_by_user = db.relationship(
+        "User", backref="added_items", lazy="joined", foreign_keys=[added_by]
+    )
+
+    purchased = db.Column(db.Boolean, default=False)
+    purchased_at = db.Column(db.DateTime, nullable=True)
+    quantity = db.Column(db.Integer, default=1)
+    note = db.Column(db.Text, nullable=True)
+    not_purchased = db.Column(db.Boolean, default=False)
+    not_purchased_reason = db.Column(db.Text, nullable=True)
+    position = db.Column(db.Integer, default=0)
+
+    shopping_list = db.relationship("ShoppingList", back_populates="items")
+
+
+class SuggestedProduct(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    name = db.Column(db.String(150), unique=True, nullable=False)
+    usage_count = db.Column(db.Integer, default=0)
+
+
+class Expense(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    list_id = db.Column(db.Integer, db.ForeignKey("shopping_list.id"))
+    amount = db.Column(db.Float, nullable=False)
+    added_at = db.Column(db.DateTime, default=datetime.utcnow)
+    receipt_filename = db.Column(db.String(255), nullable=True)
+
+    shopping_list = db.relationship("ShoppingList", back_populates="expenses")
+
+
+class Receipt(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    list_id = db.Column(
+        db.Integer,
+        db.ForeignKey("shopping_list.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    filename = db.Column(db.String(255), nullable=False)
+    uploaded_at = db.Column(db.DateTime, default=datetime.utcnow)
+    filesize = db.Column(db.Integer, nullable=True)
+    file_hash = db.Column(db.String(64), nullable=True, unique=True)
+    uploaded_by = db.Column(db.Integer, db.ForeignKey("user.id"))
+    version_token = db.Column(db.String(32), nullable=True)
+
+    shopping_list = db.relationship("ShoppingList", back_populates="receipts")
+    uploaded_by_user = db.relationship("User", backref="uploaded_receipts")
+
+
+class ListPermission(db.Model):
+    __tablename__ = "list_permission"
+    id = db.Column(db.Integer, primary_key=True)
+    list_id = db.Column(
+        db.Integer,
+        db.ForeignKey("shopping_list.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    user_id = db.Column(
+        db.Integer,
+        db.ForeignKey("user.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    created_at = db.Column(db.DateTime, default=datetime.utcnow)
+    __table_args__ = (db.UniqueConstraint("list_id", "user_id", name="uq_list_user"),)
+
+
+ShoppingList.permitted_users = db.relationship(
+    "User",
+    secondary="list_permission",
+    backref=db.backref("permitted_lists", lazy="dynamic"),
+    lazy="dynamic",
+)
+
+
+class AppSetting(db.Model):
+    key = db.Column(db.String(64), primary_key=True)
+    value = db.Column(db.Text, nullable=True)
+
+
+class ApiToken(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    name = db.Column(db.String(120), nullable=False)
+    token_hash = db.Column(db.String(64), unique=True, nullable=False, index=True)
+    token_prefix = db.Column(db.String(18), nullable=False)
+    created_at = db.Column(db.DateTime, default=utcnow, nullable=False)
+    last_used_at = db.Column(db.DateTime, nullable=True)
+    is_active = db.Column(db.Boolean, default=True, nullable=False)
+    created_by = db.Column(db.Integer, db.ForeignKey("user.id"), nullable=True)
+    scopes = db.Column(db.String(255), nullable=False, default="expenses:read")
+    allowed_endpoints = db.Column(db.String(255), nullable=False, default="/api/expenses/latest")
+    max_limit = db.Column(db.Integer, nullable=False, default=100)
+
+    creator = db.relationship(
+        "User", backref="created_api_tokens", lazy="joined", foreign_keys=[created_by]
+    )
+
+
+class ListTemplate(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    name = db.Column(db.String(150), nullable=False)
+    description = db.Column(db.Text, nullable=True)
+    created_at = db.Column(db.DateTime, default=utcnow, nullable=False)
+    created_by = db.Column(db.Integer, db.ForeignKey("user.id"), nullable=True)
+    is_active = db.Column(db.Boolean, default=True, nullable=False)
+
+    creator = db.relationship("User", backref="list_templates", lazy="joined")
+    items = db.relationship(
+        "ListTemplateItem",
+        back_populates="template",
+        cascade="all, delete-orphan",
+        lazy="select",
+        order_by="ListTemplateItem.position.asc()",
+    )
+
+
+class ListTemplateItem(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    template_id = db.Column(db.Integer, db.ForeignKey("list_template.id", ondelete="CASCADE"), nullable=False)
+    name = db.Column(db.String(150), nullable=False)
+    quantity = db.Column(db.Integer, default=1)
+    note = db.Column(db.Text, nullable=True)
+    position = db.Column(db.Integer, default=0)
+
+    template = db.relationship("ListTemplate", back_populates="items")
+
+
+class ListActivityLog(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    list_id = db.Column(db.Integer, db.ForeignKey("shopping_list.id", ondelete="CASCADE"), nullable=False, index=True)
+    actor_id = db.Column(db.Integer, db.ForeignKey("user.id"), nullable=True)
+    actor_name = db.Column(db.String(150), nullable=False, default="System")
+    action = db.Column(db.String(64), nullable=False)
+    item_name = db.Column(db.String(150), nullable=True)
+    details = db.Column(db.Text, nullable=True)
+    created_at = db.Column(db.DateTime, default=utcnow, nullable=False, index=True)
+
+    shopping_list = db.relationship("ShoppingList", backref=db.backref("activity_logs", lazy="dynamic", cascade="all, delete-orphan"))
+    actor = db.relationship("User", backref="list_activity_logs", lazy="joined")
+
+
+class CategoryColorOverride(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    category_id = db.Column(
+        db.Integer, db.ForeignKey("category.id"), unique=True, nullable=False
+    )
+    color_hex = db.Column(db.String(7), nullable=False)  # "#rrggbb"
+
+

shopping_app/routes_main.py

@@ -0,0 +1,878 @@
+from .deps import *
+from .app_setup import *
+from .models import *
+from .helpers import *
+
+@app.route("/")
+def main_page():
+    perm_subq = (
+        user_permission_subq(current_user.id) if current_user.is_authenticated else None
+    )
+
+    now = datetime.now(timezone.utc)
+
+    month_param = request.args.get("m", None)
+    start = end = None
+
+    if month_param in (None, ""):
+        # domyślnie: bieżący miesiąc
+        month_str = now.strftime("%Y-%m")
+        start = datetime(now.year, now.month, 1, tzinfo=timezone.utc)
+        end = (start + timedelta(days=31)).replace(day=1)
+    elif month_param == "all":
+        month_str = "all"
+        start = end = None
+    else:
+        month_str = month_param
+        try:
+            year, month = map(int, month_str.split("-"))
+            start = datetime(year, month, 1, tzinfo=timezone.utc)
+            end = (start + timedelta(days=31)).replace(day=1)
+        except ValueError:
+            # jeśli m ma zły format – pokaż wszystko
+            month_str = "all"
+            start = end = None
+
+    def date_filter(query):
+        if start and end:
+            query = query.filter(
+                ShoppingList.created_at >= start, ShoppingList.created_at < end
+            )
+        return query
+
+    if current_user.is_authenticated:
+        user_lists = (
+            date_filter(
+                ShoppingList.query.filter(
+                    ShoppingList.owner_id == current_user.id,
+                    ShoppingList.is_archived == False,
+                    (ShoppingList.expires_at == None) | (ShoppingList.expires_at > now),
+                )
+            )
+            .order_by(ShoppingList.created_at.desc())
+            .all()
+        )
+
+        archived_lists = (
+            ShoppingList.query.filter_by(owner_id=current_user.id, is_archived=True)
+            .order_by(ShoppingList.created_at.desc())
+            .all()
+        )
+
+        # publiczne cudze + udzielone mi (po list_permission)
+        public_lists = (
+            date_filter(
+                ShoppingList.query.filter(
+                    ShoppingList.owner_id != current_user.id,
+                    ShoppingList.is_archived == False,
+                    (ShoppingList.expires_at == None) | (ShoppingList.expires_at > now),
+                    or_(
+                        ShoppingList.is_public == True,
+                        ShoppingList.id.in_(perm_subq),
+                    ),
+                )
+            )
+            .order_by(ShoppingList.created_at.desc())
+            .all()
+        )
+        accessible_lists = public_lists  # alias do szablonu: publiczne + udostępnione
+    else:
+        user_lists = []
+        archived_lists = []
+        public_lists = (
+            date_filter(
+                ShoppingList.query.filter(
+                    ShoppingList.is_public == True,
+                    (ShoppingList.expires_at == None) | (ShoppingList.expires_at > now),
+                    ShoppingList.is_archived == False,
+                )
+            )
+            .order_by(ShoppingList.created_at.desc())
+            .all()
+        )
+        accessible_lists = public_lists  # dla gościa = tylko publiczne
+
+    # Zakres miesięcy do selektora
+    if current_user.is_authenticated:
+        visible_lists_query = ShoppingList.query.filter(
+            or_(
+                ShoppingList.owner_id == current_user.id,
+                ShoppingList.is_public == True,
+                ShoppingList.id.in_(perm_subq),
+            )
+        )
+    else:
+        visible_lists_query = ShoppingList.query.filter(ShoppingList.is_public == True)
+
+    month_options = get_active_months_query(visible_lists_query)
+
+    # Statystyki dla wszystkich widocznych sekcji
+    all_lists = user_lists + accessible_lists + archived_lists
+    all_ids = [l.id for l in all_lists]
+
+    if all_ids:
+        stats = (
+            db.session.query(
+                Item.list_id,
+                func.count(Item.id).label("total_count"),
+                func.sum(case((((Item.purchased == True) & (Item.not_purchased == False)), 1), else_=0)).label(
+                    "purchased_count"
+                ),
+                func.sum(case((Item.not_purchased == True, 1), else_=0)).label(
+                    "not_purchased_count"
+                ),
+            )
+            .filter(Item.list_id.in_(all_ids))
+            .group_by(Item.list_id)
+            .all()
+        )
+        stats_map = {
+            s.list_id: (
+                s.total_count or 0,
+                s.purchased_count or 0,
+                s.not_purchased_count or 0,
+            )
+            for s in stats
+        }
+
+        latest_expenses_map = dict(
+            db.session.query(
+                Expense.list_id, func.coalesce(func.sum(Expense.amount), 0)
+            )
+            .filter(Expense.list_id.in_(all_ids))
+            .group_by(Expense.list_id)
+            .all()
+        )
+
+        for l in all_lists:
+            total_count, purchased_count, not_purchased_count = stats_map.get(
+                l.id, (0, 0, 0)
+            )
+            l.total_count = total_count
+            l.purchased_count = purchased_count
+            l.not_purchased_count = not_purchased_count
+            l.total_expense = latest_expenses_map.get(l.id, 0)
+            l.category_badges = [
+                {"name": c.name, "color": category_color_for(c)} for c in l.categories
+            ]
+    else:
+        for l in all_lists:
+            l.total_count = 0
+            l.purchased_count = 0
+            l.not_purchased_count = 0
+            l.total_expense = 0
+            l.category_badges = []
+
+    def build_progress_summary(lists_):
+        total_lists = len(lists_)
+        total_products = sum(getattr(l, "total_count", 0) or 0 for l in lists_)
+        purchased_products = sum(getattr(l, "purchased_count", 0) or 0 for l in lists_)
+        not_purchased_products = sum(getattr(l, "not_purchased_count", 0) or 0 for l in lists_)
+        total_expense = float(sum((getattr(l, "total_expense", 0) or 0) for l in lists_))
+        completion_percent = (
+            (purchased_products / total_products) * 100 if total_products > 0 else 0
+        )
+        return {
+            "list_count": total_lists,
+            "total_products": total_products,
+            "purchased_products": purchased_products,
+            "not_purchased_products": not_purchased_products,
+            "remaining_products": max(total_products - purchased_products - not_purchased_products, 0),
+            "total_expense": round(total_expense, 2),
+            "completion_percent": completion_percent,
+        }
+
+    user_lists_summary = build_progress_summary(user_lists)
+    accessible_lists_summary = build_progress_summary(accessible_lists)
+
+    expiring_lists = get_expiring_lists_for_user(current_user.id) if current_user.is_authenticated else []
+    templates = (ListTemplate.query.filter_by(is_active=True, created_by=current_user.id).order_by(ListTemplate.name.asc()).all() if current_user.is_authenticated else [])
+
+    return render_template(
+        "main.html",
+        user_lists=user_lists,
+        public_lists=public_lists,
+        accessible_lists=accessible_lists,
+        archived_lists=archived_lists,
+        now=now,
+        timedelta=timedelta,
+        month_options=month_options,
+        selected_month=month_str,
+        expiring_lists=expiring_lists,
+        templates=templates,
+        user_lists_summary=user_lists_summary,
+        accessible_lists_summary=accessible_lists_summary,
+    )
+
+
+@app.route("/system-auth", methods=["GET", "POST"])
+def system_auth():
+    
+    if request.cookies.get("authorized") == AUTHORIZED_COOKIE_VALUE:
+        flash("Jesteś już autoryzowany.", "info")
+        return redirect(url_for("main_page"))
+
+    ip = request.access_route[0]
+    next_page = request.args.get("next") or url_for("main_page")
+
+    if is_ip_blocked(ip):
+        flash(
+            "Przekroczono limit prób logowania. Dostęp zablokowany na 1 godzinę.",
+            "danger",
+        )
+        return render_template("system_auth.html"), 403
+
+    if request.method == "POST":
+        if request.form["password"] == SYSTEM_PASSWORD:
+            reset_failed_attempts(ip)
+            resp = redirect(next_page)
+            return set_authorized_cookie(resp)
+        else:
+            register_failed_attempt(ip)
+            if is_ip_blocked(ip):
+                flash(
+                    "Przekroczono limit prób logowania. Dostęp zablokowany na 1 godzinę.",
+                    "danger",
+                )
+                return render_template("system_auth.html"), 403
+            remaining = attempts_remaining(ip)
+            flash(f"Nieprawidłowe hasło. Pozostało {remaining} prób.", "warning")
+
+    return render_template("system_auth.html")
+
+
+@app.route("/edit_my_list/<int:list_id>", methods=["GET", "POST"])
+@login_required
+def edit_my_list(list_id):
+    # --- Pobranie listy i weryfikacja właściciela ---
+    l = db.session.get(ShoppingList, list_id)
+    if l is None:
+        abort(404)
+    if l.owner_id != current_user.id:
+        abort(403, description="Nie jesteś właścicielem tej listy.")
+
+    # Dane do widoku
+    receipts = (
+        Receipt.query.filter_by(list_id=list_id)
+        .order_by(Receipt.uploaded_at.desc())
+        .all()
+    )
+    categories = Category.query.order_by(Category.name.asc()).all()
+    selected_categories_ids = {c.id for c in l.categories}
+
+    next_page = request.args.get("next") or request.referrer
+    wants_json = (
+        "application/json" in (request.headers.get("Accept") or "")
+        or request.headers.get("X-Requested-With") == "fetch"
+    )
+
+    if request.method == "POST":
+        action = request.form.get("action")
+
+        # --- Nadanie dostępu (grant) ---
+        if action == "grant":
+            grant_username = (request.form.get("grant_username") or "").strip().lower()
+            if not grant_username:
+                if wants_json:
+                    return jsonify(ok=False, error="empty"), 400
+                flash("Podaj nazwę użytkownika do nadania dostępu.", "danger")
+                return redirect(next_page or request.url)
+
+            u = User.query.filter(func.lower(User.username) == grant_username).first()
+            if not u:
+                if wants_json:
+                    return jsonify(ok=False, error="not_found"), 404
+                flash("Użytkownik nie istnieje.", "danger")
+                return redirect(next_page or request.url)
+            if u.id == current_user.id:
+                if wants_json:
+                    return jsonify(ok=False, error="owner"), 409
+                flash("Jesteś właścicielem tej listy.", "info")
+                return redirect(next_page or request.url)
+
+            exists = (
+                db.session.query(ListPermission.id)
+                .filter(
+                    ListPermission.list_id == l.id,
+                    ListPermission.user_id == u.id,
+                )
+                .first()
+            )
+            if not exists:
+                db.session.add(ListPermission(list_id=l.id, user_id=u.id))
+                db.session.commit()
+                if wants_json:
+                    return jsonify(ok=True, user={"id": u.id, "username": u.username})
+                flash(f"Nadano dostęp użytkownikowi „{u.username}”.", "success")
+            else:
+                if wants_json:
+                    return jsonify(ok=False, error="exists"), 409
+                flash("Ten użytkownik już ma dostęp.", "info")
+            return redirect(next_page or request.url)
+
+        # --- Odebranie dostępu (revoke) ---
+        revoke_user_id = request.form.get("revoke_user_id")
+        if revoke_user_id:
+            try:
+                uid = int(revoke_user_id)
+            except ValueError:
+                if wants_json:
+                    return jsonify(ok=False, error="bad_id"), 400
+                flash("Błędny identyfikator użytkownika.", "danger")
+                return redirect(next_page or request.url)
+
+            ListPermission.query.filter_by(list_id=l.id, user_id=uid).delete()
+            db.session.commit()
+            if wants_json:
+                return jsonify(ok=True, removed_user_id=uid)
+            flash("Odebrano dostęp użytkownikowi.", "success")
+            return redirect(next_page or request.url)
+
+        # --- Przywracanie z archiwum ---
+        if "unarchive" in request.form:
+            l.is_archived = False
+            db.session.commit()
+            if wants_json:
+                return jsonify(ok=True, unarchived=True)
+            flash(f"Lista „{l.title}” została przywrócona.", "success")
+            return redirect(next_page or request.url)
+
+        # --- Główny zapis pól formularza ---
+        move_to_month = request.form.get("move_to_month")
+        if move_to_month:
+            try:
+                year, month = map(int, move_to_month.split("-"))
+                l.created_at = datetime(year, month, 1, tzinfo=timezone.utc)
+                if not wants_json:
+                    flash(
+                        f"Zmieniono datę utworzenia listy na {l.created_at.strftime('%Y-%m-%d')}",
+                        "success",
+                    )
+            except ValueError:
+                if not wants_json:
+                    flash(
+                        "Nieprawidłowy format miesiąca — zignorowano zmianę miesiąca.",
+                        "danger",
+                    )
+
+        new_title = (request.form.get("title") or "").strip()
+        is_public = "is_public" in request.form
+        is_temporary = "is_temporary" in request.form
+        is_archived = "is_archived" in request.form
+        expires_date = request.form.get("expires_date")
+        expires_time = request.form.get("expires_time")
+
+        if not new_title:
+            if wants_json:
+                return jsonify(ok=False, error="title_empty"), 400
+            flash("Podaj poprawny tytuł", "danger")
+            return redirect(next_page or request.url)
+
+        l.title = new_title
+        l.is_public = is_public
+        l.is_temporary = is_temporary
+        l.is_archived = is_archived
+
+        if expires_date and expires_time:
+            try:
+                combined = f"{expires_date} {expires_time}"
+                expires_dt = datetime.strptime(combined, "%Y-%m-%d %H:%M")
+                l.expires_at = expires_dt.replace(tzinfo=timezone.utc)
+            except ValueError:
+                if wants_json:
+                    return jsonify(ok=False, error="bad_expiry"), 400
+                flash("Błędna data lub godzina wygasania", "danger")
+                return redirect(next_page or request.url)
+        else:
+            l.expires_at = None
+
+        # Kategorie (używa Twojej pomocniczej funkcji)
+        update_list_categories_from_form(l, request.form)
+
+        db.session.commit()
+        if wants_json:
+            return jsonify(ok=True, saved=True)
+        flash("Zaktualizowano dane listy", "success")
+        return redirect(next_page or request.url)
+
+    # GET: użytkownicy z dostępem
+    permitted_users = (
+        db.session.query(User)
+        .join(ListPermission, ListPermission.user_id == User.id)
+        .where(ListPermission.list_id == l.id)
+        .order_by(User.username.asc())
+        .all()
+    )
+
+    all_usernames = [
+        u.username
+        for u in User.query.filter(User.id != current_user.id)
+        .order_by(func.lower(User.username).asc())
+        .limit(300)
+        .all()
+    ]
+
+    return render_template(
+        "edit_my_list.html",
+        list=l,
+        receipts=receipts,
+        categories=categories,
+        selected_categories=selected_categories_ids,
+        permitted_users=permitted_users,
+        all_usernames=all_usernames,
+    )
+
+
+@app.route("/edit_my_list/<int:list_id>/suggestions", methods=["GET"])
+@login_required
+def edit_my_list_suggestions(list_id: int):
+    # Weryfikacja listy i właściciela (prywatność)
+    l = db.session.get(ShoppingList, list_id)
+    if l is None:
+        abort(404)
+    if l.owner_id != current_user.id:
+        abort(403, description="Nie jesteś właścicielem tej listy.")
+
+    q = (request.args.get("q") or "").strip().lower()
+
+    # Historia nadawań uprawnień przez tego właściciela (po wszystkich jego listach)
+    subq = (
+        db.session.query(
+            ListPermission.user_id.label("uid"),
+            func.count(ListPermission.id).label("grant_count"),
+            func.max(ListPermission.id).label("last_grant_id"),
+        )
+        .join(ShoppingList, ShoppingList.id == ListPermission.list_id)
+        .filter(ShoppingList.owner_id == current_user.id)
+        .group_by(ListPermission.user_id)
+        .subquery()
+    )
+
+    query = (
+        db.session.query(User.username, subq.c.grant_count, subq.c.last_grant_id)
+        .outerjoin(subq, subq.c.uid == User.id)
+        .filter(User.id != current_user.id)
+    )
+    if q:
+        query = query.filter(func.lower(User.username).like(f"{q}%"))
+
+    rows = (
+        query.order_by(
+            func.coalesce(subq.c.grant_count, 0).desc(),
+            func.coalesce(subq.c.last_grant_id, 0).desc(),
+            func.lower(User.username).asc(),
+        )
+        .limit(20)
+        .all()
+    )
+
+    return jsonify({"users": [r.username for r in rows]})
+
+
+@app.route("/delete_user_list/<int:list_id>", methods=["POST"])
+@login_required
+def delete_user_list(list_id):
+
+    l = db.session.get(ShoppingList, list_id)
+    if l is None or l.owner_id != current_user.id:
+        abort(403, description="Nie jesteś właścicielem tej listy.")
+
+    l = db.session.get(ShoppingList, list_id)
+    if l is None or l.owner_id != current_user.id:
+        abort(403)
+    delete_receipts_for_list(list_id)
+    Item.query.filter_by(list_id=list_id).delete()
+    Expense.query.filter_by(list_id=list_id).delete()
+    db.session.delete(l)
+    db.session.commit()
+    flash("Lista została usunięta", "success")
+    return redirect(url_for("main_page"))
+
+
+@app.route("/toggle_visibility/<int:list_id>", methods=["GET", "POST"])
+@login_required
+def toggle_visibility(list_id):
+    l = db.session.get(ShoppingList, list_id)
+    if l is None:
+        abort(404)
+
+    if l.owner_id != current_user.id:
+        if request.is_json or request.method == "POST":
+            return {"error": "Unauthorized"}, 403
+        flash("Nie masz uprawnień do tej listy", "danger")
+        return redirect(url_for("main_page"))
+
+    l.is_public = not l.is_public
+    db.session.commit()
+
+    share_url = f"{request.url_root}share/{l.share_token}"
+
+    if request.is_json or request.method == "POST":
+        return {"is_public": l.is_public, "share_url": share_url}
+
+    if l.is_public:
+        flash("Lista została udostępniona publicznie", "success")
+    else:
+        flash("Lista została ukryta przed gośćmi", "info")
+
+    return redirect(url_for("main_page"))
+
+
+@app.route("/login", methods=["GET", "POST"])
+def login():
+    if request.method == "POST":
+        username_input = request.form["username"].lower()
+        user = User.query.filter(func.lower(User.username) == username_input).first()
+        if user and check_password(user.password_hash, request.form["password"]):
+            session.permanent = True
+            login_user(user)
+            session.modified = True
+            flash("Zalogowano pomyślnie", "success")
+            return redirect(url_for("main_page"))
+        flash("Nieprawidłowy login lub hasło", "danger")
+    return render_template("login.html")
+
+
+@app.route("/logout")
+@login_required
+def logout():
+    logout_user()
+    flash("Wylogowano pomyślnie", "success")
+    return redirect(url_for("main_page"))
+
+
+@app.route("/create", methods=["POST"])
+@login_required
+def create_list():
+    title = request.form.get("title")
+    is_temporary = request.form.get("temporary") == "1"
+    token = generate_share_token(8)
+
+    expires_at = (
+        datetime.now(timezone.utc) + timedelta(days=7) if is_temporary else None
+    )
+
+    new_list = ShoppingList(
+        title=title,
+        owner_id=current_user.id,
+        is_temporary=is_temporary,
+        share_token=token,
+        expires_at=expires_at,
+    )
+    db.session.add(new_list)
+    db.session.commit()
+    log_list_activity(new_list.id, 'list_created', actor=current_user, actor_name=current_user.username, details='Utworzono listę ręcznie')
+    db.session.commit()
+    flash("Utworzono nową listę", "success")
+    return redirect(url_for("view_list", list_id=new_list.id))
+
+
+@app.route("/list/<int:list_id>")
+@login_required
+def view_list(list_id):
+    shopping_list = db.session.get(ShoppingList, list_id)
+    if not shopping_list:
+        abort(404)
+
+    is_owner = current_user.id == shopping_list.owner_id
+    if not is_owner:
+        flash(
+            "Nie jesteś właścicielem listy, przekierowano do widoku publicznego.",
+            "warning",
+        )
+        if current_user.is_admin:
+            flash(
+                "W celu modyfikacji listy, przejdź do panelu administracyjnego.", "info"
+            )
+        return redirect(url_for("shared_list", token=shopping_list.share_token))
+
+    shopping_list, items, receipts, expenses, total_expense = get_list_details(list_id)
+    total_count = len(items)
+    purchased_count = len([i for i in items if i.purchased])
+    percent = (purchased_count / total_count * 100) if total_count > 0 else 0
+
+    for item in items:
+        if item.added_by and item.added_by != shopping_list.owner_id:
+            item.added_by_display = (
+                item.added_by_user.username if item.added_by_user else None
+            )
+        else:
+            item.added_by_display = None
+
+    shopping_list.category_badges = [
+        {"name": c.name, "color": category_color_for(c)}
+        for c in shopping_list.categories
+    ]
+
+    # Wszystkie kategorie (do selecta)
+    categories = Category.query.order_by(Category.name.asc()).all()
+    selected_categories_ids = {c.id for c in shopping_list.categories}
+
+    # Najczęściej używane kategorie właściciela (top N)
+    popular_categories = (
+        db.session.query(Category)
+        .join(
+            shopping_list_category,
+            shopping_list_category.c.category_id == Category.id,
+        )
+        .join(
+            ShoppingList,
+            ShoppingList.id == shopping_list_category.c.shopping_list_id,
+        )
+        .filter(ShoppingList.owner_id == current_user.id)
+        .group_by(Category.id)
+        .order_by(func.count(ShoppingList.id).desc(), func.lower(Category.name).asc())
+        .limit(6)
+        .all()
+    )
+
+    # Użytkownicy z uprawnieniami do listy
+    permitted_users = (
+        db.session.query(User)
+        .join(ListPermission, ListPermission.user_id == User.id)
+        .filter(ListPermission.list_id == shopping_list.id)
+        .order_by(User.username.asc())
+        .all()
+    )
+
+    activity_logs = (
+        ListActivityLog.query.filter_by(list_id=list_id)
+        .order_by(ListActivityLog.created_at.desc(), ListActivityLog.id.desc())
+        .limit(20)
+        .all()
+    )
+
+    all_usernames = [
+        u.username
+        for u in User.query.filter(User.id != current_user.id)
+        .order_by(func.lower(User.username).asc())
+        .limit(300)
+        .all()
+    ]
+
+    return render_template(
+        "list.html",
+        list=shopping_list,
+        items=items,
+        receipts=receipts,
+        total_count=total_count,
+        purchased_count=purchased_count,
+        percent=percent,
+        expenses=expenses,
+        total_expense=total_expense,
+        is_share=False,
+        is_owner=is_owner,
+        categories=categories,
+        selected_categories=selected_categories_ids,
+        permitted_users=permitted_users,
+        popular_categories=popular_categories,
+        activity_logs=activity_logs,
+        action_label=action_label,
+        all_usernames=all_usernames,
+    )
+
+
+@app.route("/list/<int:list_id>/settings", methods=["POST"])
+@login_required
+def list_settings(list_id):
+    # Uprawnienia: właściciel
+    l = db.session.get(ShoppingList, list_id)
+    if l is None:
+        abort(404)
+    if l.owner_id != current_user.id:
+        abort(403, description="Brak uprawnień do ustawień tej listy.")
+
+    next_page = request.form.get("next") or url_for("view_list", list_id=list_id)
+    wants_json = (
+        "application/json" in (request.headers.get("Accept") or "")
+        or request.headers.get("X-Requested-With") == "fetch"
+    )
+
+    action = request.form.get("action")
+
+    # 1) Ustawienie kategorii (pojedynczy wybór z list.html -> modal kategorii)
+    if action == "set_category":
+        cid = request.form.get("category_id")
+        if cid in (None, "", "none"):
+            # usunięcie kategorii lub brak zmiany – w zależności od Twojej logiki
+            l.categories = []
+            db.session.commit()
+            if wants_json:
+                return jsonify(ok=True, saved=True)
+            flash("Zapisano kategorię.", "success")
+            return redirect(next_page)
+
+        try:
+            cid = int(cid)
+        except (TypeError, ValueError):
+            if wants_json:
+                return jsonify(ok=False, error="bad_category"), 400
+            flash("Błędna kategoria.", "danger")
+            return redirect(next_page)
+
+        c = db.session.get(Category, cid)
+        if not c:
+            if wants_json:
+                return jsonify(ok=False, error="bad_category"), 400
+            flash("Błędna kategoria.", "danger")
+            return redirect(next_page)
+
+        # Jeśli jeden wybór – zastąp listę kategorii jedną:
+        l.categories = [c]
+        db.session.commit()
+        if wants_json:
+            return jsonify(ok=True, saved=True)
+        flash("Zapisano kategorię.", "success")
+        return redirect(next_page)
+
+    # 2) Nadanie dostępu (akceptuj 'grant_access' i 'grant')
+    if action in ("grant_access", "grant"):
+        grant_username = (request.form.get("grant_username") or "").strip().lower()
+
+        if not grant_username:
+            if wants_json:
+                return jsonify(ok=False, error="empty_username"), 400
+            flash("Podaj nazwę użytkownika.", "danger")
+            return redirect(next_page)
+
+        # Szukamy użytkownika po username (case-insensitive)
+        u = User.query.filter(func.lower(User.username) == grant_username).first()
+        if not u:
+            if wants_json:
+                return jsonify(ok=False, error="not_found"), 404
+            flash("Użytkownik nie istnieje.", "danger")
+            return redirect(next_page)
+
+        # Właściciel już ma dostęp
+        if u.id == l.owner_id:
+            if wants_json:
+                return jsonify(ok=False, error="owner"), 409
+            flash("Jesteś właścicielem tej listy.", "info")
+            return redirect(next_page)
+
+        # Czy już ma dostęp?
+        exists = (
+            db.session.query(ListPermission.id)
+            .filter(ListPermission.list_id == l.id, ListPermission.user_id == u.id)
+            .first()
+        )
+        if exists:
+            if wants_json:
+                return jsonify(ok=False, error="exists"), 409
+            flash("Ten użytkownik już ma dostęp.", "info")
+            return redirect(next_page)
+
+        # Zapis uprawnienia
+        db.session.add(ListPermission(list_id=l.id, user_id=u.id))
+        db.session.commit()
+
+        if wants_json:
+            # Zwracamy usera, żeby JS mógł dokleić token bez odświeżania
+            return jsonify(ok=True, user={"id": u.id, "username": u.username})
+        flash(f"Nadano dostęp użytkownikowi „{u.username}”.", "success")
+        return redirect(next_page)
+
+    # 3) Odebranie dostępu (po polu revoke_user_id, nie po action)
+    revoke_uid = request.form.get("revoke_user_id")
+    if revoke_uid:
+        try:
+            uid = int(revoke_uid)
+        except (TypeError, ValueError):
+            if wants_json:
+                return jsonify(ok=False, error="bad_user_id"), 400
+            flash("Błędny identyfikator użytkownika.", "danger")
+            return redirect(next_page)
+
+        # Nie pozwalaj usunąć właściciela
+        if uid == l.owner_id:
+            if wants_json:
+                return jsonify(ok=False, error="cannot_revoke_owner"), 400
+            flash("Nie można odebrać dostępu właścicielowi.", "danger")
+            return redirect(next_page)
+
+        ListPermission.query.filter_by(list_id=l.id, user_id=uid).delete()
+        db.session.commit()
+
+        if wants_json:
+            return jsonify(ok=True, removed_user_id=uid)
+        flash("Odebrano dostęp użytkownikowi.", "success")
+        return redirect(next_page)
+
+    # 4) Nieznana akcja
+    if wants_json:
+        return jsonify(ok=False, error="unknown_action"), 400
+    flash("Nieznana akcja.", "danger")
+    return redirect(next_page)
+
+
+@app.route('/my-templates', methods=['GET', 'POST'])
+@login_required
+def my_templates():
+    if request.method == 'POST':
+        action = (request.form.get('action') or 'create_manual').strip()
+        if action == 'create_manual':
+            name = (request.form.get('name') or '').strip()
+            description = (request.form.get('description') or '').strip()
+            raw_items = (request.form.get('items_text') or '').splitlines()
+            if not name:
+                flash('Podaj nazwę szablonu.', 'danger')
+                return redirect(url_for('my_templates'))
+            template = ListTemplate(name=name, description=description, created_by=current_user.id, is_active=True)
+            db.session.add(template)
+            db.session.flush()
+            pos = 1
+            for line in raw_items:
+                line = line.strip()
+                if not line:
+                    continue
+                qty = 1
+                item_name = line
+                match = re.match(r'^(.*?)(?:\s+[xX](\d+))?$', line)
+                if match:
+                    item_name = (match.group(1) or '').strip() or line
+                    if match.group(2):
+                        qty = max(1, int(match.group(2)))
+                db.session.add(ListTemplateItem(template_id=template.id, name=item_name, quantity=qty, position=pos))
+                pos += 1
+            db.session.commit()
+            flash(f'Utworzono szablon „{template.name}”.', 'success')
+            return redirect(url_for('my_templates'))
+        elif action == 'delete':
+            template = ListTemplate.query.options(joinedload(ListTemplate.items)).get_or_404(request.form.get('template_id', type=int))
+            if template.created_by != current_user.id and not current_user.is_admin:
+                abort(403)
+            db.session.delete(template)
+            db.session.commit()
+            flash(f'Usunięto szablon „{template.name}”.', 'warning')
+            return redirect(url_for('my_templates'))
+
+    templates = ListTemplate.query.options(joinedload(ListTemplate.items)).filter_by(created_by=current_user.id, is_active=True).order_by(ListTemplate.created_at.desc(), ListTemplate.id.desc()).all()
+    source_lists = ShoppingList.query.filter_by(owner_id=current_user.id, is_archived=False).order_by(ShoppingList.created_at.desc()).limit(100).all()
+    return render_template('my_templates.html', templates=templates, source_lists=source_lists)
+
+
+@app.route('/templates/<int:template_id>/instantiate', methods=['POST'])
+@login_required
+def instantiate_template(template_id):
+    template = ListTemplate.query.get_or_404(template_id)
+    if not template_is_accessible_to_user(template, current_user):
+        abort(403)
+    title = (request.form.get('title') or '').strip() or None
+    new_list = create_list_from_template(template, owner=current_user, title=title)
+    log_list_activity(new_list.id, 'template_created', actor=current_user, details=f'Utworzono z szablonu: {template.name}')
+    db.session.commit()
+    flash(f'Utworzono listę z szablonu „{template.name}”.', 'success')
+    return redirect(url_for('view_list', list_id=new_list.id))
+
+
+@app.route('/templates/create-from-list/<int:list_id>', methods=['POST'])
+@login_required
+def create_template_from_user_list(list_id):
+    source_list = ShoppingList.query.options(joinedload(ShoppingList.items)).get_or_404(list_id)
+    if source_list.owner_id != current_user.id and not current_user.is_admin:
+        abort(403)
+    name = (request.form.get('template_name') or '').strip() or f'{source_list.title} - szablon'
+    description = (request.form.get('description') or '').strip() or f'Szablon utworzony z listy {source_list.title}'
+    template = create_template_from_list(source_list, created_by=current_user.id, name=name, description=description)
+    flash(f'Utworzono szablon „{template.name}”.', 'success')
+    return redirect(url_for('my_templates'))

shopping_app/routes_secondary.py

@@ -0,0 +1,740 @@
+from .deps import *
+from .app_setup import *
+from .models import *
+from .helpers import *
+
+@app.route("/expenses")
+@login_required
+def expenses():
+    start_date_str = request.args.get("start_date")
+    end_date_str = request.args.get("end_date")
+    category_id = request.args.get("category_id", type=str)
+    show_all = request.args.get("show_all", "true").lower() == "true"
+
+    now = datetime.now(timezone.utc)
+
+    visible_clause = visible_lists_clause_for_expenses(
+        user_id=current_user.id, include_shared=show_all, now_dt=now
+    )
+
+    lists_q = ShoppingList.query.filter(*visible_clause)
+
+    if start_date_str and end_date_str:
+        try:
+            start = datetime.strptime(start_date_str, "%Y-%m-%d")
+            end = datetime.strptime(end_date_str, "%Y-%m-%d") + timedelta(days=1)
+            lists_q = lists_q.filter(
+                ShoppingList.created_at >= start,
+                ShoppingList.created_at < end,
+            )
+        except ValueError:
+            flash("Błędny zakres dat", "danger")
+
+    if category_id:
+        if category_id == "none":
+            lists_q = lists_q.filter(~ShoppingList.categories.any())
+        else:
+            try:
+                cid = int(category_id)
+                lists_q = lists_q.join(
+                    shopping_list_category,
+                    shopping_list_category.c.shopping_list_id == ShoppingList.id,
+                ).filter(shopping_list_category.c.category_id == cid)
+            except (TypeError, ValueError):
+                pass
+
+    lists_filtered = (
+        lists_q.options(
+            joinedload(ShoppingList.owner), joinedload(ShoppingList.categories)
+        )
+        .order_by(ShoppingList.created_at.desc())
+        .all()
+    )
+    list_ids = [l.id for l in lists_filtered] or [-1]
+
+    expenses = (
+        Expense.query.options(
+            joinedload(Expense.shopping_list).joinedload(ShoppingList.owner),
+            joinedload(Expense.shopping_list).joinedload(ShoppingList.categories),
+        )
+        .filter(Expense.list_id.in_(list_ids))
+        .order_by(Expense.added_at.desc())
+        .all()
+    )
+
+    totals_rows = (
+        db.session.query(
+            ShoppingList.id.label("lid"),
+            func.coalesce(func.sum(Expense.amount), 0).label("total_expense"),
+        )
+        .select_from(ShoppingList)
+        .filter(ShoppingList.id.in_(list_ids))
+        .outerjoin(Expense, Expense.list_id == ShoppingList.id)
+        .group_by(ShoppingList.id)
+        .all()
+    )
+    totals_map = {row.lid: float(row.total_expense or 0) for row in totals_rows}
+
+    categories = (
+        Category.query.join(
+            shopping_list_category, shopping_list_category.c.category_id == Category.id
+        )
+        .join(
+            ShoppingList, ShoppingList.id == shopping_list_category.c.shopping_list_id
+        )
+        .filter(ShoppingList.id.in_(list_ids))
+        .distinct()
+        .order_by(Category.name.asc())
+        .all()
+    )
+    categories.append(SimpleNamespace(id="none", name="Bez kategorii"))
+
+    expense_table = [
+        {
+            "title": (e.shopping_list.title if e.shopping_list else "Nieznana"),
+            "amount": e.amount,
+            "added_at": e.added_at,
+        }
+        for e in expenses
+    ]
+
+    lists_data = [
+        {
+            "id": l.id,
+            "title": l.title,
+            "created_at": l.created_at,
+            "total_expense": totals_map.get(l.id, 0.0),
+            "owner_username": l.owner.username if l.owner else "?",
+            "categories": [c.id for c in l.categories],
+        }
+        for l in lists_filtered
+    ]
+
+    return render_template(
+        "expenses.html",
+        expense_table=expense_table,
+        lists_data=lists_data,
+        categories=categories,
+        selected_category=category_id,
+        show_all=show_all,
+    )
+
+
+@app.route("/expenses_data")
+@login_required
+def expenses_data():
+    range_type = request.args.get("range", "monthly")
+    start_date = request.args.get("start_date")
+    end_date = request.args.get("end_date")
+    show_all = request.args.get("show_all", "true").lower() == "true"
+    category_id = request.args.get("category_id")
+    by_category = request.args.get("by_category", "false").lower() == "true"
+
+    if not start_date or not end_date:
+        sd, ed, bucket = resolve_range(range_type)
+        if sd and ed:
+            start_date = sd
+            end_date = ed
+            range_type = bucket
+
+    if by_category:
+        result = get_total_expenses_grouped_by_category(
+            show_all=show_all,
+            range_type=range_type,
+            start_date=start_date,
+            end_date=end_date,
+            user_id=current_user.id,
+            category_id=category_id,
+        )
+    else:
+        result = get_total_expenses_grouped_by_list_created_at(
+            user_only=False,
+            admin=False,
+            show_all=show_all,
+            range_type=range_type,
+            start_date=start_date,
+            end_date=end_date,
+            user_id=current_user.id,
+            category_id=category_id,
+        )
+
+    if "error" in result:
+        return jsonify({"error": result["error"]}), 400
+    return jsonify(result)
+
+
+@app.route("/api/expenses/latest")
+@api_token_required
+@require_api_scope('expenses:read')
+def api_latest_expenses():
+    start_date_str = (request.args.get("start_date") or "").strip() or None
+    end_date_str = (request.args.get("end_date") or "").strip() or None
+    list_id = request.args.get("list_id", type=int)
+    owner_id = request.args.get("owner_id", type=int)
+    limit = request.args.get("limit", default=50, type=int) or 50
+    token_limit = getattr(g, 'api_token', None).max_limit if getattr(g, 'api_token', None) else 500
+    limit = max(1, min(limit, int(token_limit or 500), 500))
+
+    try:
+        start_date, end_date = parse_api_date_range(start_date_str, end_date_str)
+    except ValueError as exc:
+        return jsonify({"ok": False, "error": "bad_request", "message": str(exc)}), 400
+
+    filter_query = Expense.query.join(ShoppingList, ShoppingList.id == Expense.list_id)
+
+    if start_date:
+        filter_query = filter_query.filter(Expense.added_at >= start_date)
+    if end_date:
+        filter_query = filter_query.filter(Expense.added_at < end_date)
+    if list_id:
+        filter_query = filter_query.filter(Expense.list_id == list_id)
+    if owner_id:
+        filter_query = filter_query.filter(ShoppingList.owner_id == owner_id)
+
+    total_count = filter_query.with_entities(func.count(Expense.id)).scalar() or 0
+    total_amount = float(filter_query.with_entities(func.coalesce(func.sum(Expense.amount), 0)).scalar() or 0)
+
+    expenses = (
+        filter_query.options(
+            joinedload(Expense.shopping_list).joinedload(ShoppingList.owner),
+            joinedload(Expense.shopping_list).joinedload(ShoppingList.categories),
+        )
+        .order_by(Expense.added_at.desc(), Expense.id.desc())
+        .limit(limit)
+        .all()
+    )
+
+    items = []
+    for expense in expenses:
+        shopping_list = expense.shopping_list
+        owner = shopping_list.owner if shopping_list else None
+        items.append(
+            {
+                "expense_id": expense.id,
+                "amount": round(float(expense.amount or 0), 2),
+                "added_at": format_dt_for_api(expense.added_at),
+                "receipt_filename": expense.receipt_filename,
+                "list": {
+                    "id": shopping_list.id if shopping_list else None,
+                    "title": shopping_list.title if shopping_list else None,
+                    "created_at": format_dt_for_api(shopping_list.created_at if shopping_list else None),
+                    "is_archived": bool(shopping_list.is_archived) if shopping_list else None,
+                    "is_public": bool(shopping_list.is_public) if shopping_list else None,
+                    "categories": [c.name for c in shopping_list.categories] if shopping_list else [],
+                },
+                "owner": {
+                    "id": owner.id if owner else None,
+                    "username": owner.username if owner else None,
+                },
+            }
+        )
+
+    return jsonify(
+        {
+            "ok": True,
+            "filters": {
+                "start_date": start_date_str,
+                "end_date": end_date_str,
+                "list_id": list_id,
+                "owner_id": owner_id,
+                "limit": limit,
+            },
+            "meta": {
+                "returned_count": len(items),
+                "total_count": int(total_count),
+                "total_amount": round(total_amount, 2),
+                "token_name": g.api_token.name,
+                "token_prefix": g.api_token.token_prefix,
+            },
+            "items": items,
+        }
+    )
+
+
+@app.route("/api/ping")
+@api_token_required
+def api_ping():
+    return jsonify({"ok": True, "message": "token accepted", "token_name": g.api_token.name, "token_prefix": g.api_token.token_prefix})
+
+
+@app.route("/api/expenses/summary")
+@api_token_required
+@require_api_scope('expenses:read')
+def api_expenses_summary():
+    start_date_str = (request.args.get("start_date") or "").strip() or None
+    end_date_str = (request.args.get("end_date") or "").strip() or None
+    list_id = request.args.get("list_id", type=int)
+    owner_id = request.args.get("owner_id", type=int)
+
+    try:
+        start_date, end_date = parse_api_date_range(start_date_str, end_date_str)
+    except ValueError as exc:
+        return jsonify({"ok": False, "error": "bad_request", "message": str(exc)}), 400
+
+    query = Expense.query.join(ShoppingList, ShoppingList.id == Expense.list_id)
+    if start_date:
+        query = query.filter(Expense.added_at >= start_date)
+    if end_date:
+        query = query.filter(Expense.added_at < end_date)
+    if list_id:
+        query = query.filter(Expense.list_id == list_id)
+    if owner_id:
+        query = query.filter(ShoppingList.owner_id == owner_id)
+
+    total_count = int(query.with_entities(func.count(Expense.id)).scalar() or 0)
+    total_amount = float(query.with_entities(func.coalesce(func.sum(Expense.amount), 0)).scalar() or 0)
+    by_list = (
+        query.with_entities(ShoppingList.id, ShoppingList.title, func.count(Expense.id), func.coalesce(func.sum(Expense.amount), 0))
+        .group_by(ShoppingList.id, ShoppingList.title)
+        .order_by(func.coalesce(func.sum(Expense.amount), 0).desc(), ShoppingList.id.desc())
+        .limit(100)
+        .all()
+    )
+    return jsonify({
+        "ok": True,
+        "filters": {"start_date": start_date_str, "end_date": end_date_str, "list_id": list_id, "owner_id": owner_id},
+        "meta": {"total_count": total_count, "total_amount": round(total_amount, 2)},
+        "lists": [{"id": row[0], "title": row[1], "expense_count": int(row[2] or 0), "total_amount": round(float(row[3] or 0), 2)} for row in by_list],
+    })
+
+
+@app.route("/api/lists")
+@api_token_required
+@require_api_scope('lists:read')
+def api_lists():
+    owner_id = request.args.get("owner_id", type=int)
+    limit = request.args.get("limit", default=50, type=int) or 50
+    token_limit = getattr(g, 'api_token', None).max_limit if getattr(g, 'api_token', None) else 500
+    limit = max(1, min(limit, int(token_limit or 500), 500))
+
+    query = ShoppingList.query.options(joinedload(ShoppingList.owner), joinedload(ShoppingList.categories)).order_by(ShoppingList.created_at.desc(), ShoppingList.id.desc())
+    if owner_id:
+        query = query.filter(ShoppingList.owner_id == owner_id)
+    rows = query.limit(limit).all()
+    return jsonify({
+        "ok": True,
+        "items": [{
+            "id": row.id,
+            "title": row.title,
+            "created_at": format_dt_for_api(row.created_at),
+            "owner": {"id": row.owner.id if row.owner else None, "username": row.owner.username if row.owner else None},
+            "is_temporary": bool(row.is_temporary),
+            "expires_at": format_dt_for_api(row.expires_at),
+            "is_archived": bool(row.is_archived),
+            "is_public": bool(row.is_public),
+            "categories": [c.name for c in row.categories],
+        } for row in rows],
+    })
+
+
+@app.route("/api/lists/<int:list_id>/expenses")
+@api_token_required
+@require_api_scope('lists:read')
+def api_list_expenses(list_id):
+    limit = request.args.get("limit", default=50, type=int) or 50
+    token_limit = getattr(g, 'api_token', None).max_limit if getattr(g, 'api_token', None) else 500
+    limit = max(1, min(limit, int(token_limit or 500), 500))
+    shopping_list = ShoppingList.query.options(joinedload(ShoppingList.owner), joinedload(ShoppingList.categories)).get_or_404(list_id)
+    rows = Expense.query.filter_by(list_id=list_id).order_by(Expense.added_at.desc(), Expense.id.desc()).limit(limit).all()
+    return jsonify({
+        "ok": True,
+        "list": {
+            "id": shopping_list.id,
+            "title": shopping_list.title,
+            "owner": {"id": shopping_list.owner.id if shopping_list.owner else None, "username": shopping_list.owner.username if shopping_list.owner else None},
+            "categories": [c.name for c in shopping_list.categories],
+        },
+        "items": [{"expense_id": row.id, "amount": round(float(row.amount or 0), 2), "added_at": format_dt_for_api(row.added_at), "receipt_filename": row.receipt_filename} for row in rows],
+    })
+
+
+@app.route("/api/templates")
+@api_token_required
+@require_api_scope('templates:read')
+def api_templates():
+    query = ListTemplate.query.options(joinedload(ListTemplate.creator), joinedload(ListTemplate.items)).filter_by(is_active=True)
+    owner_id = request.args.get("owner_id", type=int)
+    if owner_id:
+        query = query.filter(ListTemplate.created_by == owner_id)
+    rows = query.order_by(ListTemplate.created_at.desc(), ListTemplate.id.desc()).limit(100).all()
+    return jsonify({
+        "ok": True,
+        "items": [{
+            "id": row.id,
+            "name": row.name,
+            "description": row.description,
+            "created_at": format_dt_for_api(row.created_at),
+            "owner": {"id": row.creator.id if row.creator else None, "username": row.creator.username if row.creator else None},
+            "items_count": len(row.items),
+            "items": [{"name": item.name, "quantity": item.quantity, "note": item.note} for item in row.items],
+        } for row in rows],
+    })
+
+
+@app.route("/share/<token>")
+# @app.route("/guest-list/<int:list_id>")
+@app.route("/shared/<int:list_id>")
+def shared_list(token=None, list_id=None):
+    now = datetime.now(timezone.utc)
+
+    if token:
+        shopping_list = ShoppingList.query.filter_by(share_token=token).first_or_404()
+
+        expires_at = shopping_list.expires_at
+        if expires_at and expires_at.tzinfo is None:
+            expires_at = expires_at.replace(tzinfo=timezone.utc)
+
+        # jeśli lista wygasła – zablokuj (spójne z resztą aplikacji)
+        if shopping_list.is_temporary and expires_at and expires_at <= now:
+            flash("Link wygasł.", "warning")
+            return redirect(url_for("main_page"))
+
+        list_id = shopping_list.id
+
+        # jeśli zalogowany i nie jest właścicielem — auto-przypisz stałe uprawnienie
+        if current_user.is_authenticated and current_user.id != shopping_list.owner_id:
+            exists = (
+                db.session.query(ListPermission.id)
+                .filter(
+                    ListPermission.list_id == shopping_list.id,
+                    ListPermission.user_id == current_user.id,
+                )
+                .first()
+            )
+            if not exists:
+                db.session.add(
+                    ListPermission(list_id=shopping_list.id, user_id=current_user.id)
+                )
+                db.session.commit()
+    else:
+        shopping_list = ShoppingList.query.get_or_404(list_id)
+        expires_at = shopping_list.expires_at
+        if expires_at and expires_at.tzinfo is None:
+            expires_at = expires_at.replace(tzinfo=timezone.utc)
+
+        if shopping_list.is_temporary and expires_at and expires_at <= now:
+            flash("Ta lista wygasła.", "warning")
+            return redirect(url_for("main_page"))
+
+        is_allowed = shopping_list.is_public
+        if current_user.is_authenticated:
+            is_allowed = is_allowed or shopping_list.owner_id == current_user.id or (
+                db.session.query(ListPermission.id)
+                .filter(
+                    ListPermission.list_id == shopping_list.id,
+                    ListPermission.user_id == current_user.id,
+                )
+                .first()
+                is not None
+            )
+
+        if not is_allowed:
+            flash("Ta lista nie jest publicznie dostępna.", "warning")
+            return redirect(url_for("main_page"))
+
+    total_expense = get_total_expense_for_list(list_id)
+    shopping_list, items, receipts, expenses, total_expense = get_list_details(list_id)
+
+    shopping_list.category_badges = [
+        {"name": c.name, "color": category_color_for(c)}
+        for c in shopping_list.categories
+    ]
+
+    for item in items:
+        if item.added_by and item.added_by != shopping_list.owner_id:
+            item.added_by_display = (
+                item.added_by_user.username if item.added_by_user else None
+            )
+        else:
+            item.added_by_display = None
+
+    return render_template(
+        "list_share.html",
+        list=shopping_list,
+        items=items,
+        receipts=receipts,
+        expenses=expenses,
+        total_expense=total_expense,
+        is_share=True,
+    )
+
+
+@app.route("/copy/<int:list_id>")
+@login_required
+def copy_list(list_id):
+    original = ShoppingList.query.get_or_404(list_id)
+    token = generate_share_token(8)
+    new_list = ShoppingList(
+        title=original.title + " (Kopia)", owner_id=current_user.id, share_token=token
+    )
+    db.session.add(new_list)
+    db.session.commit()
+    original_items = Item.query.filter_by(list_id=original.id).all()
+    for item in original_items:
+        copy_item = Item(list_id=new_list.id, name=item.name)
+        db.session.add(copy_item)
+    db.session.commit()
+    flash("Skopiowano listę", "success")
+    return redirect(url_for("view_list", list_id=new_list.id))
+
+
+@app.route("/suggest_products")
+def suggest_products():
+    query = request.args.get("q", "")
+    suggestions = []
+    if query:
+        suggestions = (
+            SuggestedProduct.query.filter(SuggestedProduct.name.ilike(f"%{query}%"))
+            .limit(5)
+            .all()
+        )
+    return {"suggestions": [s.name for s in suggestions]}
+
+
+@app.route("/all_products")
+def all_products():
+    sort = request.args.get("sort", "popularity")
+    limit = request.args.get("limit", type=int) or 100
+    offset = request.args.get("offset", type=int) or 0
+
+    products_from_items = db.session.query(
+        func.lower(func.trim(Item.name)).label("normalized_name"),
+        func.min(Item.name).label("display_name"),
+        func.count(func.distinct(Item.list_id)).label("count"),
+    ).group_by(func.lower(func.trim(Item.name)))
+
+    products_from_suggested = (
+        db.session.query(
+            func.lower(func.trim(SuggestedProduct.name)).label("normalized_name"),
+            func.min(SuggestedProduct.name).label("display_name"),
+            db.literal(1).label("count"),
+        )
+        .filter(
+            ~func.lower(func.trim(SuggestedProduct.name)).in_(
+                db.session.query(func.lower(func.trim(Item.name)))
+            )
+        )
+        .group_by(func.lower(func.trim(SuggestedProduct.name)))
+    )
+
+    union_q = products_from_items.union_all(products_from_suggested).subquery()
+
+    final_q = db.session.query(
+        union_q.c.normalized_name,
+        union_q.c.display_name,
+        func.sum(union_q.c.count).label("count"),
+    ).group_by(union_q.c.normalized_name, union_q.c.display_name)
+
+    if sort == "alphabetical":
+        final_q = final_q.order_by(func.lower(union_q.c.display_name).asc())
+    else:
+        final_q = final_q.order_by(
+            func.sum(union_q.c.count).desc(), func.lower(union_q.c.display_name).asc()
+        )
+
+    total_count = (
+        db.session.query(func.count()).select_from(final_q.subquery()).scalar()
+    )
+    products = final_q.offset(offset).limit(limit).all()
+
+    out = [{"name": row.display_name, "count": row.count} for row in products]
+
+    return jsonify({"products": out, "total_count": total_count})
+
+
+@app.route("/upload_receipt/<int:list_id>", methods=["POST"])
+@login_required
+def upload_receipt(list_id):
+    l = db.session.get(ShoppingList, list_id)
+
+    file = request.files.get("receipt")
+    if not file or file.filename == "":
+        return receipt_error("Nie wybrano pliku")
+
+    if not allowed_file(file.filename):
+        return receipt_error("Niedozwolony format pliku")
+
+    file_bytes = file.read()
+    file.seek(0)
+    file_hash = hashlib.sha256(file_bytes).hexdigest()
+
+    existing = Receipt.query.filter_by(file_hash=file_hash).first()
+    if existing:
+        return receipt_error("Taki plik już istnieje")
+
+    now = datetime.now(timezone.utc)
+    timestamp = now.strftime("%Y%m%d_%H%M")
+    random_part = secrets.token_hex(3)
+    webp_filename = f"list_{list_id}_{timestamp}_{random_part}.webp"
+    file_path = os.path.join(app.config["UPLOAD_FOLDER"], webp_filename)
+
+    try:
+        if file.filename.lower().endswith(".pdf"):
+            file.seek(0)
+            save_pdf_as_webp(file, file_path)
+        else:
+            save_resized_image(file, file_path)
+    except ValueError as e:
+        return receipt_error(str(e))
+
+    try:
+        new_receipt = Receipt(
+            list_id=list_id,
+            filename=webp_filename,
+            filesize=os.path.getsize(file_path),
+            uploaded_at=now,
+            file_hash=file_hash,
+            uploaded_by=current_user.id,
+            version_token=generate_version_token(),
+        )
+        db.session.add(new_receipt)
+        db.session.commit()
+    except Exception as e:
+        return receipt_error(f"Błąd zapisu do bazy: {str(e)}")
+
+    if request.is_json or request.headers.get("X-Requested-With") == "XMLHttpRequest":
+        url = (
+            url_for("uploaded_file", filename=webp_filename)
+            + f"?v={new_receipt.version_token or '0'}"
+        )
+        socketio.emit("receipt_added", {"url": url}, to=str(list_id))
+        return jsonify({"success": True, "url": url})
+
+    flash("Wgrano paragon", "success")
+    return redirect(request.referrer or url_for("main_page"))
+
+
+@app.route("/uploads/<filename>")
+def uploaded_file(filename):
+    response = send_from_directory(app.config["UPLOAD_FOLDER"], filename)
+    response.headers["Cache-Control"] = app.config["UPLOADS_CACHE_CONTROL"]
+    response.headers.pop("Content-Disposition", None)
+    mime, _ = mimetypes.guess_type(filename)
+    if mime:
+        response.headers["Content-Type"] = mime
+    return response
+
+
+@app.route("/reorder_items", methods=["POST"])
+@login_required
+def reorder_items():
+    data = request.get_json()
+    list_id = data.get("list_id")
+    order = data.get("order")
+
+    for index, item_id in enumerate(order):
+        item = db.session.get(Item, item_id)
+        if item and item.list_id == list_id:
+            item.position = index
+    db.session.commit()
+
+    socketio.emit(
+        "items_reordered", {"list_id": list_id, "order": order}, to=str(list_id)
+    )
+
+    return jsonify(success=True)
+
+
+@app.route("/rotate_receipt/<int:receipt_id>")
+@login_required
+def rotate_receipt_user(receipt_id):
+    receipt = Receipt.query.get_or_404(receipt_id)
+    list_obj = ShoppingList.query.get_or_404(receipt.list_id)
+
+    if not (current_user.is_admin or current_user.id == list_obj.owner_id):
+        flash("Brak uprawnień do tej operacji", "danger")
+        return redirect(url_for("main_page"))
+
+    try:
+        rotate_receipt_by_id(receipt_id)
+        recalculate_filesizes(receipt_id)
+        flash("Obrócono paragon", "success")
+    except FileNotFoundError:
+        flash("Plik nie istnieje", "danger")
+    except Exception as e:
+        flash(f"Błąd przy obracaniu: {str(e)}", "danger")
+
+    return redirect(request.referrer or url_for("main_page"))
+
+
+@app.route("/delete_receipt/<int:receipt_id>")
+@login_required
+def delete_receipt_user(receipt_id):
+    receipt = Receipt.query.get_or_404(receipt_id)
+    list_obj = ShoppingList.query.get_or_404(receipt.list_id)
+
+    if not (current_user.is_admin or current_user.id == list_obj.owner_id):
+        flash("Brak uprawnień do tej operacji", "danger")
+        return redirect(url_for("main_page"))
+
+    try:
+        delete_receipt_by_id(receipt_id)
+        flash("Paragon usunięty", "success")
+    except Exception as e:
+        flash(f"Błąd przy usuwaniu pliku: {str(e)}", "danger")
+
+    return redirect(request.referrer or url_for("main_page"))
+
+
+# OCR
+@app.route("/lists/<int:list_id>/analyze", methods=["POST"])
+@login_required
+def analyze_receipts_for_list(list_id):
+    receipt_objs = Receipt.query.filter_by(list_id=list_id).all()
+    existing_expenses = {
+        e.receipt_filename
+        for e in Expense.query.filter_by(list_id=list_id).all()
+        if e.receipt_filename
+    }
+
+    results = []
+    total = 0.0
+
+    for receipt in receipt_objs:
+        filepath = os.path.join(app.config["UPLOAD_FOLDER"], receipt.filename)
+        if not os.path.exists(filepath):
+            continue
+
+        try:
+            raw_image = Image.open(filepath).convert("RGB")
+            image = preprocess_image_for_tesseract(raw_image)
+            value, lines = extract_total_tesseract(image)
+
+        except Exception as e:
+            print(f"OCR error for {receipt.filename}:\n{traceback.format_exc()}")
+            value = 0.0
+            lines = []
+
+        already_added = receipt.filename in existing_expenses
+
+        results.append(
+            {
+                "id": receipt.id,
+                "filename": receipt.filename,
+                "amount": round(value, 2),
+                "debug_text": lines,
+                "already_added": already_added,
+            }
+        )
+
+        # if not already_added:
+        total += value
+
+    return jsonify({"results": results, "total": round(total, 2)})
+
+
+@app.route("/user_crop_receipt", methods=["POST"])
+@login_required
+def crop_receipt_user():
+    receipt_id = request.form.get("receipt_id")
+    file = request.files.get("cropped_image")
+
+    receipt = Receipt.query.get_or_404(receipt_id)
+    list_obj = ShoppingList.query.get_or_404(receipt.list_id)
+
+    if list_obj.owner_id != current_user.id and not current_user.is_admin:
+        return jsonify(success=False, error="Brak dostępu"), 403
+
+    result = handle_crop_receipt(receipt_id, file)
+    return jsonify(result)
+

shopping_app/sockets.py

@@ -0,0 +1,785 @@
+import click
+from .deps import *
+from .app_setup import *
+from .models import *
+from .helpers import *
+
+from flask import render_template_string
+
+@app.route('/admin/debug-socket')
+@login_required
+@admin_required
+def debug_socket():  
+    return render_template_string('''
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Socket Debug</title>
+    <script src="{{ url_for('static_bp.serve_js_lib', filename='socket.io.min.js') }}?v={{ APP_VERSION }}"></script>
+    <style>
+        body { font-family: monospace; background: #1e1e1e; color: #fff; padding: 20px; }
+        #log { height: 400px; overflow-y: scroll; background: #2d2d2d; padding: 15px; border-radius: 8px; margin: 10px 0; white-space: pre-wrap; }
+        button { background: #007bff; color: white; border: none; padding: 10px 20px; margin: 5px; border-radius: 5px; cursor: pointer; }
+        button:hover { background: #0056b3; }
+        .status { font-size: 18px; font-weight: bold; margin: 10px 0; }
+        .connected { color: #28a745; }
+        .disconnected { color: #dc3545; }
+    </style>
+</head>
+<body>
+    <h1>Socket.IO Debug Tool</h1>
+    
+    <div id="status" class="status disconnected">Rozlaczony</div>
+    <div id="info">
+        Transport: <span id="transport">-</span> | 
+        Ping: <span id="ping">-</span>ms | 
+        SID: <span id="sid">-</span>
+    </div>
+    
+    <button onclick="connect()">Polacz</button>
+    <button onclick="disconnect()">Rozlacz</button>
+    <button onclick="emitTest()">Emit Test</button>
+    <button onclick="forcePolling()">Force Polling</button>
+    
+    <h3>Logi:</h3>
+    <div id="log"></div>
+
+    <script>
+        let socket;
+        let logLines = 0;
+        let isPollingOnly = true;
+        
+        function log(msg, color = '#fff') {
+            const logEl = document.getElementById('log');
+            const time = new Date().toLocaleTimeString();
+            logEl.innerHTML += `[${time}] ${msg}\n`;
+            logEl.scrollTop = logEl.scrollHeight;
+            logLines++;
+            if (logLines > 200) {
+                const lines = logEl.innerHTML.split('\\n');
+                logEl.innerHTML = lines.slice(-200).join('\\n');
+                logLines = 200;
+            }
+        }
+        
+        function updateStatus(connected) {
+            const status = document.getElementById('status');
+            status.textContent = connected ? 'Polaczony' : 'Rozlaczony';
+            status.className = `status ${connected ? 'connected' : 'disconnected'}`;
+        }
+        
+        function connect() {
+            if (socket) {
+                socket.disconnect();
+                socket = null;
+            }
+            
+            const transports = isPollingOnly ? ['polling'] : ['polling', 'websocket'];
+            log(`Polaczenie z: ${transports.join(', ')}`);
+            
+            socket = io('', {
+                transports: transports,
+                timeout: 20000,
+                autoConnect: false,
+                forceNew: true
+            });
+            
+            socket.on('connect', function() {
+                log('CONNECTED OK');
+                updateStatus(true);
+                try {
+                    const transport = socket.io.engine.transport.name;
+                    document.getElementById('transport').textContent = transport;
+                    document.getElementById('sid').textContent = socket.id.substring(0,8) + '...';
+                } catch(e) {
+                    log('Transport info error: ' + e.message);
+                }
+                socket.emit('requestfulllist', {listid: 1});
+            });
+            
+            socket.on('disconnect', function(reason) {
+                log('DISCONNECTED: ' + reason);
+                updateStatus(false);
+            });
+            
+            socket.on('connect_error', function(err) {
+                log('CONNECT ERROR: ' + err.message + ' (' + (err.type || 'unknown') + ')');
+            });
+            
+            socket.onAny(function(event, ...args) {
+                log('RECV ' + event + ': ' + JSON.stringify(args).substring(0,100));
+            });
+            
+            socket.connect();
+        }
+        
+        function disconnect() {
+            if (socket) {
+                socket.disconnect();
+                socket = null;
+            }
+        }
+        
+        function emitTest() {
+            if (!socket || !socket.connected) {
+                log('Niepolaczony!');
+                return;
+            }
+            const now = Date.now();
+            socket.emit('pingtest', now);
+            log('SENT pingtest ' + now);
+        }
+        
+        function forcePolling() {
+            isPollingOnly = !isPollingOnly;
+            log('Polling only: ' + isPollingOnly);
+            connect();
+        }
+        
+        // STATUS check co 30s
+        setInterval(function() {
+            if (socket && socket.connected) {
+                const transport = socket.io.engine ? socket.io.engine.transport.name : 'unknown';
+                log('STATUS OK: ' + transport + ' | SID: ' + (socket.id ? socket.id.substring(0,8) : 'none'));
+                emitTest();
+            } else {
+                log('STATUS: Offline');
+            }
+        }, 30000);
+        
+        // Start
+        connect();
+    </script>
+</body>
+</html>
+    ''')
+
+
+
+# =========================================================================================
+# SOCKET.IO
+# =========================================================================================
+
+
+@socketio.on("delete_item")
+def handle_delete_item(data):
+    # item = Item.query.get(data["item_id"])
+    item = db.session.get(Item, data["item_id"])
+
+    if item:
+        list_id = item.list_id
+        log_list_activity(list_id, 'item_deleted', item_name=item.name, actor=current_user if current_user.is_authenticated else None, actor_name=current_user.username if current_user.is_authenticated else 'Gość')
+        db.session.delete(item)
+        db.session.commit()
+        emit("item_deleted", {"item_id": item.id}, to=str(item.list_id))
+
+        purchased_count, total_count, percent = get_progress(list_id)
+
+        emit(
+            "progress_updated",
+            {
+                "purchased_count": purchased_count,
+                "total_count": total_count,
+                "percent": percent,
+            },
+            to=str(list_id),
+        )
+
+
+@socketio.on("edit_item")
+def handle_edit_item(data):
+    item = db.session.get(Item, data["item_id"])
+
+    new_name = data["new_name"]
+    new_quantity = data.get("new_quantity", item.quantity)
+
+    if item and new_name.strip():
+        item.name = new_name.strip()
+
+        try:
+            new_quantity = int(new_quantity)
+            if new_quantity < 1:
+                new_quantity = 1
+        except:
+            new_quantity = 1
+
+        item.quantity = new_quantity
+
+        db.session.commit()
+
+        emit(
+            "item_edited",
+            {"item_id": item.id, "new_name": item.name, "new_quantity": item.quantity},
+            to=str(item.list_id),
+        )
+
+
+@socketio.on("join_list")
+def handle_join(data):
+    global active_users
+    room = str(data["room"])
+    username = data.get("username", "Gość")
+    join_room(room)
+
+    if room not in active_users:
+        active_users[room] = set()
+    active_users[room].add(username)
+
+    shopping_list = db.session.get(ShoppingList, int(data["room"]))
+
+    list_title = shopping_list.title if shopping_list else "Twoja lista"
+
+    emit("user_joined", {"username": username}, to=room)
+    emit("user_list", {"users": list(active_users[room])}, to=room)
+    emit("joined_confirmation", {"room": room, "list_title": list_title})
+
+
+@socketio.on("disconnect")
+def handle_disconnect(sid):
+    global active_users
+    username = current_user.username if current_user.is_authenticated else "Gość"
+    for room, users in active_users.items():
+        if username in users:
+            users.remove(username)
+            emit("user_left", {"username": username}, to=room)
+            emit("user_list", {"users": list(users)}, to=room)
+
+
+@socketio.on("add_item")
+def handle_add_item(data):
+    list_id = data["list_id"]
+    name = data["name"].strip()
+    quantity = data.get("quantity", 1)
+
+    list_obj = db.session.get(ShoppingList, list_id)
+    if not list_obj:
+        return
+
+    try:
+        quantity = int(quantity)
+        if quantity < 1:
+            quantity = 1
+    except:
+        quantity = 1
+
+    existing_item = Item.query.filter(
+        Item.list_id == list_id,
+        func.lower(Item.name) == name.lower(),
+        Item.not_purchased == False,
+    ).first()
+
+    if existing_item:
+        existing_item.quantity += quantity
+        db.session.commit()
+
+        emit(
+            "item_edited",
+            {
+                "item_id": existing_item.id,
+                "new_name": existing_item.name,
+                "new_quantity": existing_item.quantity,
+            },
+            to=str(list_id),
+        )
+    else:
+        max_position = (
+            db.session.query(func.max(Item.position))
+            .filter_by(list_id=list_id)
+            .scalar()
+        )
+        if max_position is None:
+            max_position = 0
+
+        user_id = current_user.id if current_user.is_authenticated else None
+        user_name = current_user.username if current_user.is_authenticated else "Gość"
+
+        new_item = Item(
+            list_id=list_id,
+            name=name,
+            quantity=quantity,
+            position=max_position + 1,
+            added_by=user_id,
+        )
+        db.session.add(new_item)
+
+        if not SuggestedProduct.query.filter(
+            func.lower(SuggestedProduct.name) == name.lower()
+        ).first():
+            new_suggestion = SuggestedProduct(name=name)
+            db.session.add(new_suggestion)
+
+        log_list_activity(list_id, 'item_added', item_name=new_item.name, actor=current_user if current_user.is_authenticated else None, actor_name=user_name, details=f'ilość: {new_item.quantity}')
+        db.session.commit()
+
+        emit(
+            "item_added",
+            {
+                "id": new_item.id,
+                "name": new_item.name,
+                "quantity": new_item.quantity,
+                "added_by": user_name,
+                "added_by_id": user_id,
+                "owner_id": list_obj.owner_id,
+            },
+            to=str(list_id),
+            include_self=True,
+        )
+
+    purchased_count, total_count, percent = get_progress(list_id)
+
+    emit(
+        "progress_updated",
+        {
+            "purchased_count": purchased_count,
+            "total_count": total_count,
+            "percent": percent,
+        },
+        to=str(list_id),
+    )
+
+
+@socketio.on("check_item")
+def handle_check_item(data):
+    item = db.session.get(Item, data["item_id"])
+
+    if item:
+        item.purchased = True
+        item.purchased_at = datetime.now(UTC)
+        item.not_purchased = False
+        item.not_purchased_reason = None
+        log_list_activity(item.list_id, 'item_checked', item_name=item.name, actor=current_user if current_user.is_authenticated else None, actor_name=current_user.username if current_user.is_authenticated else 'Gość')
+        db.session.commit()
+
+        purchased_count, total_count, percent = get_progress(item.list_id)
+
+        emit("item_checked", {"item_id": item.id}, to=str(item.list_id))
+        emit(
+            "progress_updated",
+            {
+                "purchased_count": purchased_count,
+                "total_count": total_count,
+                "percent": percent,
+            },
+            to=str(item.list_id),
+        )
+
+
+@socketio.on("uncheck_item")
+def handle_uncheck_item(data):
+    item = db.session.get(Item, data["item_id"])
+
+    if item:
+        item.purchased = False
+        item.purchased_at = None
+        log_list_activity(item.list_id, 'item_unchecked', item_name=item.name, actor=current_user if current_user.is_authenticated else None, actor_name=current_user.username if current_user.is_authenticated else 'Gość')
+        db.session.commit()
+
+        purchased_count, total_count, percent = get_progress(item.list_id)
+
+        emit("item_unchecked", {"item_id": item.id}, to=str(item.list_id))
+        emit(
+            "progress_updated",
+            {
+                "purchased_count": purchased_count,
+                "total_count": total_count,
+                "percent": percent,
+            },
+            to=str(item.list_id),
+        )
+
+
+@socketio.on("request_full_list")
+def handle_request_full_list(data):
+    list_id = data["list_id"]
+
+    shopping_list = db.session.get(ShoppingList, list_id)
+    if not shopping_list:
+        return
+
+    owner_id = shopping_list.owner_id
+
+    items = (
+        Item.query.options(joinedload(Item.added_by_user))
+        .filter_by(list_id=list_id)
+        .order_by(Item.position.asc())
+        .all()
+    )
+
+    items_data = []
+    for item in items:
+        items_data.append(
+            {
+                "id": item.id,
+                "name": item.name,
+                "quantity": item.quantity,
+                "purchased": item.purchased if not item.not_purchased else False,
+                "not_purchased": item.not_purchased,
+                "not_purchased_reason": item.not_purchased_reason,
+                "note": item.note or "",
+                "added_by": item.added_by_user.username if item.added_by_user else None,
+                "added_by_id": item.added_by_user.id if item.added_by_user else None,
+                "owner_id": owner_id,
+            }
+        )
+
+    emit("full_list", {"items": items_data}, to=request.sid)
+
+
+@socketio.on("update_note")
+def handle_update_note(data):
+    item_id = data["item_id"]
+    note = data["note"]
+    item = Item.query.get(item_id)
+    if item:
+        item.note = note
+        db.session.commit()
+        emit("note_updated", {"item_id": item_id, "note": note}, to=str(item.list_id))
+
+
+@socketio.on("add_expense")
+def handle_add_expense(data):
+    list_id = data["list_id"]
+    amount = data["amount"]
+    receipt_filename = data.get("receipt_filename")
+
+    if receipt_filename:
+        existing = Expense.query.filter_by(
+            list_id=list_id, receipt_filename=receipt_filename
+        ).first()
+        if existing:
+            return
+    new_expense = Expense(
+        list_id=list_id, amount=amount, receipt_filename=receipt_filename
+    )
+
+    db.session.add(new_expense)
+    log_list_activity(list_id, 'expense_added', item_name=None, actor=current_user if current_user.is_authenticated else None, actor_name=current_user.username if current_user.is_authenticated else 'Gość', details=f'kwota: {float(amount):.2f} PLN')
+    db.session.commit()
+
+    total = (
+        db.session.query(func.sum(Expense.amount)).filter_by(list_id=list_id).scalar()
+        or 0
+    )
+
+    emit("expense_added", {"amount": amount, "total": total}, to=str(list_id))
+
+
+@socketio.on("mark_not_purchased")
+def handle_mark_not_purchased(data):
+    item = db.session.get(Item, data["item_id"])
+
+    reason = data.get("reason", "")
+    if item:
+        item.not_purchased = True
+        item.not_purchased_reason = reason
+        item.purchased = False
+        item.purchased_at = None
+        log_list_activity(item.list_id, 'item_marked_not_purchased', item_name=item.name, actor=current_user if current_user.is_authenticated else None, actor_name=current_user.username if current_user.is_authenticated else 'Gość', details=reason or None)
+        db.session.commit()
+        emit(
+            "item_marked_not_purchased",
+            {"item_id": item.id, "reason": reason},
+            to=str(item.list_id),
+        )
+
+
+@socketio.on("unmark_not_purchased")
+def handle_unmark_not_purchased(data):
+    item = db.session.get(Item, data["item_id"])
+
+    if item:
+        item.not_purchased = False
+        item.purchased = False
+        item.purchased_at = None
+        item.not_purchased_reason = None
+        log_list_activity(item.list_id, 'item_unmarked_not_purchased', item_name=item.name, actor=current_user if current_user.is_authenticated else None, actor_name=current_user.username if current_user.is_authenticated else 'Gość')
+        db.session.commit()
+        emit("item_unmarked_not_purchased", {"item_id": item.id}, to=str(item.list_id))
+
+
+@app.cli.command("db_info")
+def create_db():
+    with app.app_context():
+        inspector = inspect(db.engine)
+        actual_tables = inspector.get_table_names()
+
+        table_count = len(actual_tables)
+        record_total = 0
+        with db.engine.connect() as conn:
+            for table in actual_tables:
+                try:
+                    count = conn.execute(text(f"SELECT COUNT(*) FROM {table}")).scalar()
+                    record_total += count
+                except Exception:
+                    pass
+
+        print("\nStruktura bazy danych jest poprawna.")
+        print(f"Silnik: {db.engine.name}")
+        print(f"Liczba tabel: {table_count}")
+        print(f"Łączna liczba rekordów: {record_total}")
+
+
+if __name__ == "__main__":
+    logging.basicConfig(level=logging.DEBUG if DEBUG_MODE else logging.INFO)
+    socketio.run(app, host="0.0.0.0", port=APP_PORT, debug=False)
+
+
+@app.cli.group("admins")
+def admins_cli():
+    """Zarzadzanie kontami administratorow z CLI."""
+
+
+@admins_cli.command("list")
+def admins_list_command():
+    with app.app_context():
+        users = User.query.order_by(User.username.asc()).all()
+        if not users:
+            click.echo('Brak uzytkownikow.')
+            return
+        for user in users:
+            role = 'admin' if user.is_admin else 'user'
+            click.echo(f"{user.id}	{user.username}	{role}")
+
+
+@admins_cli.command("create")
+@click.argument("username")
+@click.argument("password")
+@click.option("--admin/--user", "make_admin", default=True, show_default=True, help="Utworz konto admina albo zwyklego uzytkownika.")
+def admins_create_command(username, password, make_admin):
+    with app.app_context():
+        user, created, _ = create_or_update_admin_user(username, password=password, make_admin=make_admin, update_password=False)
+        status = 'Utworzono' if created else 'Istnieje juz'
+        click.echo(f"{status} konto: id={user.id}, username={user.username}, admin={user.is_admin}")
+
+
+@admins_cli.command("promote")
+@click.argument("username")
+def admins_promote_command(username):
+    with app.app_context():
+        user = resolve_user_identifier(username)
+        if not user:
+            raise click.ClickException('Nie znaleziono uzytkownika.')
+        user.is_admin = True
+        db.session.commit()
+        click.echo(f"Uzytkownik {user.username} ma teraz uprawnienia admina.")
+
+
+@admins_cli.command("demote")
+@click.argument("username")
+def admins_demote_command(username):
+    with app.app_context():
+        user = resolve_user_identifier(username)
+        if not user:
+            raise click.ClickException('Nie znaleziono uzytkownika.')
+        user.is_admin = False
+        db.session.commit()
+        click.echo(f"Uzytkownik {user.username} nie jest juz adminem.")
+
+
+@admins_cli.command("set-password")
+@click.argument("username")
+@click.argument("password")
+def admins_set_password_command(username, password):
+    with app.app_context():
+        user = resolve_user_identifier(username)
+        if not user:
+            raise click.ClickException('Nie znaleziono uzytkownika.')
+        user.password_hash = hash_password(password)
+        db.session.commit()
+        click.echo(f"Zmieniono haslo dla {user.username}.")
+
+
+@app.cli.group("lists")
+def lists_cli():
+    """Operacje CLI na listach zakupowych."""
+
+
+def _load_list_for_cli(list_id: int):
+    return ShoppingList.query.options(joinedload(ShoppingList.items), joinedload(ShoppingList.categories), joinedload(ShoppingList.owner)).get(list_id)
+
+
+def _parse_many_when_values(raw_values: str):
+    values = []
+    for part in (raw_values or '').split(','):
+        normalized = part.strip()
+        if not normalized:
+            continue
+        values.append(parse_cli_datetime(normalized))
+    if not values:
+        raise ValueError('Podaj co najmniej jedna date w --when-list.')
+    return values
+
+
+@lists_cli.command("copy-schedule")
+@click.option("--source-list-id", required=True, type=int, help="ID listy zrodlowej.")
+@click.option("--when", "when_value", required=True, help="Nowa data utworzenia listy: YYYY-MM-DD lub YYYY-MM-DD HH:MM")
+@click.option("--owner", "owner_value", default=None, help="Nowy wlasciciel: username albo ID. Domyslnie wlasciciel oryginalu.")
+@click.option("--title", default=None, help="Nowy tytul listy. Domyslnie taki sam jak w oryginale.")
+def lists_copy_schedule_command(source_list_id, when_value, owner_value, title):
+    with app.app_context():
+        source_list = _load_list_for_cli(source_list_id)
+        if not source_list:
+            raise click.ClickException('Nie znaleziono listy zrodlowej.')
+
+        try:
+            scheduled_for = parse_cli_datetime(when_value)
+        except ValueError as exc:
+            raise click.ClickException(str(exc))
+
+        owner = None
+        if owner_value:
+            owner = resolve_user_identifier(owner_value)
+            if not owner:
+                raise click.ClickException('Nie znaleziono docelowego wlasciciela.')
+
+        new_list = duplicate_list_for_schedule(source_list, scheduled_for=scheduled_for, owner=owner, title=title)
+        log_list_activity(new_list.id, 'list_duplicated', actor_name='CLI', details=f'copy-schedule ze zrodla #{source_list.id}')
+        db.session.commit()
+        click.echo(
+            f"Utworzono kopie listy: nowa_id={new_list.id}, tytul={new_list.title}, created_at={new_list.created_at.isoformat()}"
+        )
+
+
+@lists_cli.command("move")
+@click.option("--list-id", required=True, type=int, help="ID listy.")
+@click.option("--when", "when_value", required=True, help="Nowy termin listy: YYYY-MM-DD lub YYYY-MM-DD HH:MM")
+@click.option("--keep-item-times", is_flag=True, help="Nie przesuwaj added_at/purchased_at pozycji.")
+@click.option("--keep-expiry", is_flag=True, help="Nie przesuwaj expires_at.")
+def lists_move_command(list_id, when_value, keep_item_times, keep_expiry):
+    with app.app_context():
+        shopping_list = _load_list_for_cli(list_id)
+        if not shopping_list:
+            raise click.ClickException('Nie znaleziono listy.')
+        try:
+            new_when = parse_cli_datetime(when_value)
+        except ValueError as exc:
+            raise click.ClickException(str(exc))
+        old_created = shopping_list.created_at
+        move_list_schedule(shopping_list, new_when, keep_item_times=keep_item_times, keep_expiry=keep_expiry)
+        log_list_activity(shopping_list.id, 'list_moved', actor_name='CLI', details=f'Z {old_created} na {shopping_list.created_at}')
+        db.session.commit()
+        click.echo(f'Przeniesiono liste #{shopping_list.id} na {shopping_list.created_at.isoformat()}')
+
+
+@lists_cli.command("archive")
+@click.option("--list-id", required=True, type=int, help="ID listy.")
+def lists_archive_command(list_id):
+    with app.app_context():
+        shopping_list = _load_list_for_cli(list_id)
+        if not shopping_list:
+            raise click.ClickException('Nie znaleziono listy.')
+        set_list_archived(shopping_list, archived=True)
+        log_list_activity(shopping_list.id, 'list_archived', actor_name='CLI')
+        db.session.commit()
+        click.echo(f'Zarchiwizowano liste #{shopping_list.id}.')
+
+
+@lists_cli.command("unarchive")
+@click.option("--list-id", required=True, type=int, help="ID listy.")
+def lists_unarchive_command(list_id):
+    with app.app_context():
+        shopping_list = _load_list_for_cli(list_id)
+        if not shopping_list:
+            raise click.ClickException('Nie znaleziono listy.')
+        set_list_archived(shopping_list, archived=False)
+        log_list_activity(shopping_list.id, 'list_unarchived', actor_name='CLI')
+        db.session.commit()
+        click.echo(f'Przywrocono liste #{shopping_list.id} z archiwum.')
+
+
+@lists_cli.command("assign-owner")
+@click.option("--list-id", required=True, type=int, help="ID listy.")
+@click.option("--owner", "owner_value", required=True, help="Nowy wlasciciel: username albo ID.")
+def lists_assign_owner_command(list_id, owner_value):
+    with app.app_context():
+        shopping_list = _load_list_for_cli(list_id)
+        if not shopping_list:
+            raise click.ClickException('Nie znaleziono listy.')
+        owner = resolve_user_identifier(owner_value)
+        if not owner:
+            raise click.ClickException('Nie znaleziono docelowego wlasciciela.')
+        previous_owner = shopping_list.owner.username if shopping_list.owner else shopping_list.owner_id
+        assign_list_owner(shopping_list, owner)
+        log_list_activity(shopping_list.id, 'list_owner_changed', actor_name='CLI', details=f'{previous_owner} -> {owner.username}')
+        db.session.commit()
+        click.echo(f'Zmieniono wlasciciela listy #{shopping_list.id} na {owner.username}.')
+
+
+@lists_cli.command("create-from-template")
+@click.option("--template-id", required=True, type=int, help="ID szablonu.")
+@click.option("--owner", "owner_value", required=True, help="Wlasciciel nowej listy: username albo ID.")
+@click.option("--when", "when_value", default=None, help="Termin utworzenia: YYYY-MM-DD lub YYYY-MM-DD HH:MM")
+@click.option("--title", default=None, help="Tytul nowej listy.")
+def lists_create_from_template_command(template_id, owner_value, when_value, title):
+    with app.app_context():
+        template = ListTemplate.query.options(joinedload(ListTemplate.items)).get(template_id)
+        if not template:
+            raise click.ClickException('Nie znaleziono szablonu.')
+        owner = resolve_user_identifier(owner_value)
+        if not owner:
+            raise click.ClickException('Nie znaleziono docelowego wlasciciela.')
+        try:
+            scheduled_for = parse_cli_datetime(when_value) if when_value else datetime.now(timezone.utc)
+        except ValueError as exc:
+            raise click.ClickException(str(exc))
+        new_list = create_list_from_template_at_schedule(template, owner=owner, scheduled_for=scheduled_for, title=title)
+        log_list_activity(new_list.id, 'template_created', actor_name='CLI', details=f'create-from-template z szablonu #{template.id}')
+        db.session.commit()
+        click.echo(f'Utworzono liste z szablonu: nowa_id={new_list.id}, tytul={new_list.title}, created_at={new_list.created_at.isoformat()}')
+
+
+@lists_cli.command("delete")
+@click.option("--list-id", required=True, type=int, help="ID listy.")
+def lists_delete_command(list_id):
+    with app.app_context():
+        shopping_list = _load_list_for_cli(list_id)
+        if not shopping_list:
+            raise click.ClickException('Nie znaleziono listy.')
+        title = shopping_list.title
+        delete_list_with_relations(shopping_list)
+        db.session.commit()
+        click.echo(f'Usunieto liste #{list_id}: {title}')
+
+
+@lists_cli.command("rename")
+@click.option("--list-id", required=True, type=int, help="ID listy.")
+@click.option("--title", "new_title", required=True, help="Nowy tytul listy.")
+def lists_rename_command(list_id, new_title):
+    with app.app_context():
+        shopping_list = _load_list_for_cli(list_id)
+        if not shopping_list:
+            raise click.ClickException('Nie znaleziono listy.')
+        old_title = shopping_list.title
+        try:
+            rename_list(shopping_list, new_title)
+        except ValueError as exc:
+            raise click.ClickException(str(exc))
+        log_list_activity(shopping_list.id, 'list_renamed', actor_name='CLI', details=f'{old_title} -> {shopping_list.title}')
+        db.session.commit()
+        click.echo(f'Zmieniono tytul listy #{shopping_list.id} na: {shopping_list.title}')
+
+
+@lists_cli.command("duplicate-many")
+@click.option("--source-list-id", required=True, type=int, help="ID listy zrodlowej.")
+@click.option("--when-list", required=True, help="Lista terminow rozdzielona przecinkami.")
+@click.option("--owner", "owner_value", default=None, help="Nowy wlasciciel: username albo ID.")
+@click.option("--title-prefix", default=None, help="Prefiks tytulu dla nowych list.")
+def lists_duplicate_many_command(source_list_id, when_list, owner_value, title_prefix):
+    with app.app_context():
+        source_list = _load_list_for_cli(source_list_id)
+        if not source_list:
+            raise click.ClickException('Nie znaleziono listy zrodlowej.')
+        owner = None
+        if owner_value:
+            owner = resolve_user_identifier(owner_value)
+            if not owner:
+                raise click.ClickException('Nie znaleziono docelowego wlasciciela.')
+        try:
+            schedule_values = _parse_many_when_values(when_list)
+        except ValueError as exc:
+            raise click.ClickException(str(exc))
+        created_lists = duplicate_list_many(source_list, schedule_values=schedule_values, owner=owner, title_prefix=title_prefix)
+        for new_list in created_lists:
+            log_list_activity(new_list.id, 'list_duplicated', actor_name='CLI', details=f'duplicate-many ze zrodla #{source_list.id}')
+        db.session.commit()
+        click.echo('Utworzono listy: ' + ', '.join([f'#{row.id}@{row.created_at.isoformat()}' for row in created_lists]))

shopping_app/startup_info.py

@@ -0,0 +1,95 @@
+import os
+import sys
+import platform
+import socket
+from datetime import datetime
+
+import psutil
+
+try:
+    from sqlalchemy import text
+except Exception:
+    text = None
+
+def mb(x):
+    return int(x / 1024 / 1024)
+
+
+def get_db_type(app):
+    uri = app.config.get("SQLALCHEMY_DATABASE_URI") or app.config.get("DATABASE_URL", "")
+
+    if not uri:
+        return "NONE"
+
+    if uri.startswith("sqlite"):
+        return "SQLite"
+    if uri.startswith("mysql"):
+        return "MySQL"
+    if uri.startswith("postgresql"):
+        return "PostgreSQL"
+
+    return "OTHER"
+
+def print_startup_info(app):
+    host = os.getenv("HOST", "127.0.0.1")
+    port = int(os.getenv("PORT", "8000"))
+
+    rules = list(app.url_map.iter_rules())
+
+    cpu = psutil.cpu_percent(interval=0.2)
+    ram = psutil.virtual_memory()
+    proc = psutil.Process(os.getpid())
+
+    db_type = get_db_type(app)
+
+    print("\n" + "="*52)
+    print(" APP START")
+    print("="*52)
+
+    # SYSTEM
+    print("\n[ SYSTEM ]")
+    print(f"Time   : {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
+    print(f"OS     : {platform.system()} {platform.release()} ({platform.machine()})")
+    print(f"Python : {sys.version.split()[0]}")
+    print(f"Host   : {socket.gethostname()}")
+
+    # SERVER
+    print("\n[ SERVER ]")
+    print(f"Bind   : {host}:{port}")
+    print(f"URL    : http://127.0.0.1:{port}")
+
+    # APP
+    print("\n[ APP ]")
+    print(f"Name   : {app.name}")
+    print(f"Mode   : {'DEV' if app.debug else 'PROD'}")
+    print(f"Debug  : {app.debug}")
+
+    # RESOURCES
+    print("\n[ RESOURCES ]")
+    print(f"CPU    : {cpu:>5.1f}%")
+    print(f"RAM    : {ram.percent:>5.1f}% ({mb(ram.used)} / {mb(ram.total)} MB)")
+    print(f"PROC   : {mb(proc.memory_info().rss)} MB")
+
+    # DATABASE
+    print("\n[ DATABASE ]")
+    print(f"Type   : {db_type}")
+
+    # SECURITY
+    print("\n[ SECURITY ]")
+    print(f"Secret : {'OK' if app.config.get('SECRET_KEY') else 'MISSING'}")
+    print(f"Talis  : {'OFF' if app.config.get('TALISMAN_DISABLED') else 'ON'}")
+
+    # HEALTH
+    print("\n[ HEALTH ]")
+    print(f"Uploads: {'OK' if os.path.exists('uploads') else 'MISS'}")
+    print(f"Static : {'OK' if os.path.exists(app.static_folder) else 'MISS'}")
+
+    # ROUTES
+    print("\n[ ROUTES ]")
+    print(f"Total  : {len(rules)}")
+
+    # STATUS
+    print("\n[ STATUS ]")
+    print("READY")
+
+    print("="*52 + "\n")

shopping_app/static/css/split/buttons.css

@@ -0,0 +1,195 @@
+.btn {
+  min-height: 40px;
+  padding: 0.52rem 0.8rem;
+  border-radius: 10px;
+  font-weight: 600;
+  letter-spacing: 0.01em;
+  box-shadow: none;
+  transition: transform .18s ease, box-shadow .18s ease, background-color .18s ease, border-color .18s ease;
+}
+
+.btn-sm {
+  min-height: 34px;
+  padding: 0.4rem 0.64rem;
+  border-radius: 9px;
+}
+
+.btn:focus,
+.btn:focus-visible {
+  border-color: rgba(25, 135, 84, 0.6) !important;
+  box-shadow: 0 0 0 0.2rem rgba(25, 135, 84, 0.16) !important;
+}
+
+.btn:hover,
+.btn:focus-visible {
+  transform: translateY(-1px);
+}
+
+.btn-primary {
+  background-color: var(--primary) !important;
+  border-color: var(--primary-border) !important;
+}
+
+.btn-primary:hover,
+.btn-primary:focus,
+.btn-primary:active {
+  background-color: #13315f !important;
+  border-color: #10284f !important;
+}
+
+.btn-success {
+  background: linear-gradient(135deg, #29d17d, #1ea860) !important;
+  border-color: rgba(41, 209, 125, 0.9) !important;
+  color: #fff !important;
+  box-shadow: 0 10px 24px rgba(0,0,0,0.16);
+}
+
+.btn-success:hover,
+.btn-success:focus,
+.btn-success:active {
+  color: #fff !important;
+}
+
+.btn-warning {
+  background-color: var(--warning) !important;
+  border-color: var(--warning-border) !important;
+  color: var(--warning-text) !important;
+}
+
+.btn-warning:hover,
+.btn-warning:focus,
+.btn-warning:active {
+  background-color: #5c4c17 !important;
+  border-color: #3e3610 !important;
+  color: var(--warning-text) !important;
+}
+
+.btn-outline-light,
+.btn-outline-secondary,
+.btn-outline-warning,
+.btn-outline-danger,
+.btn-outline-primary,
+.btn-outline-success,
+.btn-outline-info {
+  background: rgba(255,255,255,0.03);
+}
+
+.btn-outline-light {
+  color: #f8f9fa !important;
+  border-color: #f8f9fa !important;
+}
+
+.btn-outline-light:hover,
+.btn-outline-light:focus,
+.btn-outline-light:focus-visible {
+  background-color: rgba(255,255,255,0.1) !important;
+  color: #fff !important;
+  border-color: #6c757d !important;
+  box-shadow: 0 10px 24px rgba(0,0,0,0.16);
+}
+
+.btn-outline-light:active,
+.btn-outline-light.active,
+.show > .btn-outline-light.dropdown-toggle {
+  background-color: #5a6268 !important;
+  color: #fff !important;
+  border-color: #545b62 !important;
+}
+
+.btn-outline-secondary:hover,
+.btn-outline-secondary:focus,
+.btn-outline-secondary:focus-visible {
+  background: rgba(108, 117, 125, 0.18) !important;
+  box-shadow: 0 10px 24px rgba(0,0,0,0.16);
+}
+
+.btn-outline-success {
+  color: var(--success) !important;
+  border-color: var(--success) !important;
+}
+
+.btn-outline-success:hover,
+.btn-outline-success:focus,
+.btn-outline-success:active,
+.btn-outline-success:focus-visible {
+  background: var(--ui-success-soft) !important;
+  border-color: var(--success-border) !important;
+  color: #fff !important;
+  box-shadow: 0 10px 24px rgba(0,0,0,0.16);
+}
+
+.btn-outline-warning {
+  color: #d9c97a !important;
+  border-color: var(--warning) !important;
+}
+
+.btn-outline-warning:hover,
+.btn-outline-warning:focus,
+.btn-outline-warning:active,
+.btn-outline-warning:focus-visible {
+  background: var(--ui-warning-soft) !important;
+  border-color: var(--warning-border) !important;
+  color: var(--warning-text) !important;
+}
+
+.btn-outline-danger:hover,
+.btn-outline-danger:focus,
+.btn-outline-danger:focus-visible {
+  background: rgba(220, 53, 69, 0.16) !important;
+}
+
+.btn-outline-info {
+  color: var(--info) !important;
+  border-color: var(--info) !important;
+}
+
+.btn-outline-info:hover,
+.btn-outline-info:focus,
+.btn-outline-info:focus-visible {
+  background-color: #1d4d8c !important;
+  border-color: #1d4d8c !important;
+  color: var(--info-text) !important;
+}
+
+.btn-outline-info:active,
+.btn-outline-info.active,
+.show > .btn-outline-info.dropdown-toggle {
+  background-color: var(--info) !important;
+  border-color: var(--info-border) !important;
+  color: var(--info-text) !important;
+}
+
+#items .btn-group {
+  gap: 0.4rem;
+}
+
+#items .btn-group .btn {
+  border-radius: 12px !important;
+}
+
+.btn-group-compact,
+.admin-shortcuts .d-flex,
+.stack-form,
+.page-actions {
+  gap: 0.4rem;
+}
+
+.btn-group-compact .btn {
+  padding: 0.3rem 0.55rem;
+  font-size: 0.82rem;
+}
+
+.btn-group-compact .btn-text {
+  font-size: 0.78rem;
+}
+
+input[type="file"]::file-selector-button {
+  background-color: #1b4a29;
+  color: #f0f0f0;
+  border: none;
+  padding: .5em 1em;
+  border-radius: 4px;
+  font-weight: bold;
+  cursor: pointer;
+  transition: background .2s;
+}

shopping_app/static/css/split/forms.css

@@ -0,0 +1,138 @@
+.form-select,
+.form-control,
+textarea.form-control {
+  background-color: var(--dark-700) !important;
+  color: var(--text-strong) !important;
+  border: 1px solid var(--dark-300) !important;
+}
+
+.form-select:focus,
+.form-control:focus,
+textarea.form-control:focus {
+  background-color: var(--dark-800) !important;
+  border-color: var(--primary) !important;
+  color: #fff !important;
+  box-shadow: 0 0 0 .25rem rgba(24, 64, 118, .35) !important;
+}
+
+.form-control:disabled,
+textarea.form-control:disabled {
+  background-color: var(--dark-550) !important;
+  color: var(--muted) !important;
+  cursor: not-allowed;
+}
+
+.form-switch .form-check-input {
+  background-color: var(--dark-400) !important;
+  border-color: var(--dark-300) !important;
+}
+
+.form-switch .form-check-input:checked {
+  background-color: var(--primary) !important;
+  border-color: var(--primary-border) !important;
+}
+
+.form-control::placeholder,
+.bg-dark .form-control::placeholder {
+  color: #aaa !important;
+  opacity: 1 !important;
+}
+
+.tom-dark .ts-control {
+  background-color: var(--dark-700) !important;
+  color: #fff !important;
+  border: 1px solid var(--dark-300) !important;
+  border-radius: .375rem;
+  min-height: 38px;
+  padding: .25rem .5rem;
+  box-sizing: border-box;
+}
+
+.tom-dark .ts-control .item {
+  background-color: var(--dark-400) !important;
+  color: #fff !important;
+  border-radius: .25rem;
+  padding: 2px 8px;
+  margin-right: 4px;
+}
+
+.ts-dropdown {
+  background-color: var(--dark-700) !important;
+  color: #fff !important;
+  border: 1px solid var(--dark-300);
+  border-radius: .375rem;
+  z-index: 9999 !important;
+  max-height: 300px;
+  overflow-y: auto;
+}
+
+.ts-dropdown .active {
+  background-color: var(--dark-300) !important;
+  color: #fff !important;
+}
+
+td select.tom-dark {
+  width: 100%;
+  max-width: 100%;
+  box-sizing: border-box;
+}
+
+.large-checkbox,
+input[type="checkbox"].large-checkbox {
+  width: 1.2rem;
+  height: 1.2rem;
+}
+
+.large-checkbox {
+  accent-color: #29d17d;
+  transform: none;
+  transform-origin: center;
+}
+
+input[type="checkbox"].large-checkbox {
+  appearance: none;
+  -webkit-appearance: none;
+  -moz-appearance: none;
+  margin: 0;
+  padding: 0;
+  outline: none;
+  background: none;
+  cursor: pointer;
+  position: relative;
+  vertical-align: middle;
+}
+
+input[type="checkbox"].large-checkbox::before {
+  content: '✗';
+  color: #dc3545;
+  font-size: 1.6em;
+  font-weight: 700;
+  position: absolute;
+  inset: 0;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  line-height: 1;
+  transition: color .2s;
+}
+
+input[type="checkbox"].large-checkbox:checked::before {
+  content: '✓';
+  color: #fff;
+}
+
+input[type="checkbox"].large-checkbox:disabled::before {
+  opacity: .5;
+  cursor: not-allowed;
+}
+
+input[type="checkbox"].large-checkbox:disabled {
+  cursor: not-allowed;
+}
+
+#createListTempToggle,
+.create-list-temp-toggle,
+#tempToggle {
+  border-top-left-radius: 0 !important;
+  border-bottom-left-radius: 0 !important;
+}

shopping_app/static/css/split/pages.css

@@ -0,0 +1,725 @@
+.preview-product-list {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+
+.preview-product-summary {
+  padding: 0 0 0.85rem;
+  margin-bottom: 0.1rem;
+  border-bottom: 1px solid rgba(255,255,255,0.08);
+}
+
+.preview-product-section {
+  display: flex;
+  flex-direction: column;
+  gap: 0.65rem;
+}
+
+.preview-product-section-title {
+  margin: 0;
+  font-size: 1.05rem;
+  font-weight: 700;
+}
+
+.preview-modal-items {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+
+#productPreviewModal .preview-modal-list-item {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  width: 100%;
+  min-width: 0;
+  padding: 0.9rem 1rem;
+  margin: 0 !important;
+  border-radius: 16px !important;
+  border: 1px solid rgba(255,255,255,0.08) !important;
+  background: linear-gradient(180deg, rgba(11,22,40,0.92) 0%, rgba(8,16,30,0.92) 100%) !important;
+  box-shadow: inset 0 1px 0 rgba(255,255,255,0.03);
+}
+
+#productPreviewModal .preview-modal-list-item:first-child,
+#productPreviewModal .preview-modal-list-item:last-child,
+#productPreviewModal .list-group-flush > .list-group-item:first-child,
+#productPreviewModal .list-group-flush > .list-group-item:last-child {
+  border-radius: 16px !important;
+}
+
+#productPreviewModal .preview-modal-list-item__name {
+  min-width: 0;
+  overflow-wrap: anywhere;
+  flex: 1 1 auto;
+}
+
+#productPreviewModal .preview-modal-list-item .badge {
+  flex-shrink: 0;
+  min-width: 2.5rem;
+  border-radius: 10px;
+}
+
+.receipt-disclosure {
+  width: 100%;
+  cursor: pointer;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  border-radius: 20px;
+  background: linear-gradient(135deg, rgba(255, 255, 255, 0.04), rgba(255, 255, 255, 0.02));
+  box-shadow: 0 12px 32px rgba(0, 0, 0, 0.18);
+  transition: transform 0.2s ease, border-color 0.2s ease, box-shadow 0.2s ease, background 0.2s ease;
+}
+
+.receipt-disclosure:hover,
+.receipt-disclosure:focus-visible {
+  transform: translateY(-1px);
+  border-color: rgba(255, 255, 255, 0.18);
+  box-shadow: 0 16px 36px rgba(0, 0, 0, 0.24);
+  outline: none;
+}
+
+.receipt-disclosure.is-open {
+  border-color: rgba(24, 64, 118, 0.9);
+  background: linear-gradient(135deg, rgba(24, 64, 118, 0.22), rgba(255, 255, 255, 0.03));
+}
+
+.receipt-disclosure__content {
+  display: flex;
+  align-items: center;
+  gap: 14px;
+  padding: 16px 18px;
+}
+
+.receipt-disclosure__icon {
+  display: grid;
+  place-items: center;
+  width: 48px;
+  height: 48px;
+  border-radius: 14px;
+  background: rgba(255, 255, 255, 0.06);
+  font-size: 1.25rem;
+  flex-shrink: 0;
+}
+
+.receipt-disclosure__text {
+  min-width: 0;
+  flex: 1;
+}
+
+.receipt-disclosure__eyebrow {
+  font-size: 0.72rem;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  color: rgba(255, 255, 255, 0.52);
+  margin-bottom: 2px;
+}
+
+.receipt-disclosure__title {
+  font-size: 1rem;
+  font-weight: 600;
+  color: var(--text-strong);
+}
+
+.receipt-disclosure__meta {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  margin-left: auto;
+  flex-shrink: 0;
+}
+
+.receipt-disclosure__count {
+  min-width: 34px;
+  padding: 6px 10px;
+  border-radius: 999px;
+  background: rgba(255, 255, 255, 0.08);
+  color: var(--text-strong);
+  font-size: 0.875rem;
+  text-align: center;
+}
+
+.receipt-disclosure__chevron {
+  font-size: 1.15rem;
+  color: rgba(255, 255, 255, 0.7);
+  transition: transform 0.2s ease;
+}
+
+.receipt-disclosure.is-open .receipt-disclosure__chevron {
+  transform: rotate(180deg);
+}
+
+@media (max-width: 575.98px) {
+  .receipt-disclosure__content {
+    padding: 14px;
+    gap: 12px;
+  }
+
+  .receipt-disclosure__icon {
+    width: 42px;
+    height: 42px;
+    border-radius: 12px;
+  }
+
+  .receipt-disclosure__meta {
+    gap: 10px;
+  }
+
+  .receipt-disclosure__title {
+    font-size: 0.95rem;
+  }
+}
+
+.endpoint-edit_my_list .stack-form > .mb-3 > .ui-consistent-input,
+.endpoint-edit_my_list .stack-form > .mb-4 > .ui-consistent-input,
+.endpoint-edit_my_list .stack-form .row .ui-consistent-input,
+.endpoint-edit_list form > .mb-3 > .ui-consistent-input,
+.endpoint-edit_list form > .mb-4 > .ui-consistent-input,
+.endpoint-edit_list form .row .ui-consistent-input,
+.endpoint-user_management .row > [class*="col-"] > .ui-consistent-input,
+.endpoint-user_management .modal .ui-consistent-input {
+  border-radius: var(--ui-control-radius) !important;
+}
+
+.endpoint-edit_my_list .ts-wrapper.single .ts-control,
+.endpoint-edit_list .ts-wrapper.single .ts-control,
+.endpoint-edit_my_list .ts-wrapper.multi .ts-control,
+.endpoint-edit_list .ts-wrapper.multi .ts-control {
+  min-height: var(--ui-control-height) !important;
+  border-radius: var(--ui-control-radius) !important;
+}
+
+.share-hub {
+  border: 1px solid rgba(79, 142, 255, 0.18);
+  background: linear-gradient(180deg, rgba(11, 24, 43, 0.98), rgba(8, 17, 31, 0.96)) !important;
+}
+
+.share-hub .card-body {
+  padding: 1rem;
+}
+
+.share-hub__top {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 0.9rem;
+  margin-bottom: 0.85rem;
+}
+
+.share-hub__eyebrow,
+.share-sheet__eyebrow {
+  font-size: 0.72rem;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  color: rgba(186, 210, 240, 0.62);
+  margin-bottom: 0.35rem;
+}
+
+.share-hub__title {
+  font-size: 1.1rem;
+  font-weight: 700;
+}
+
+.share-hub__status,
+.share-sheet__section-head {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.45rem;
+  align-items: center;
+}
+
+.share-state-badge {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.3rem;
+  min-height: 32px;
+  padding: 0.45rem 0.72rem;
+  font-size: 0.76rem;
+  font-weight: 600;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+}
+
+.share-state-badge--public {
+  background: rgba(41, 209, 125, 0.16);
+  color: #dfffea;
+}
+
+.share-state-badge--private {
+  background: rgba(255, 255, 255, 0.06);
+  color: #edf5ff;
+}
+
+.share-state-badge--link {
+  background: rgba(79, 142, 255, 0.14);
+  color: #d7e7ff;
+}
+
+.share-state-badge--people {
+  background: rgba(255, 255, 255, 0.08);
+  color: #edf5ff;
+}
+
+.share-hub__note {
+  color: rgba(210, 224, 244, 0.74);
+  font-size: 0.92rem;
+  line-height: 1.45;
+}
+
+.share-hub__linkbox {
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  background: rgba(255, 255, 255, 0.035);
+  border-radius: 16px;
+  padding: 0.85rem 0.95rem;
+}
+
+.share-hub__linklabel {
+  font-size: 0.72rem;
+  text-transform: uppercase;
+  letter-spacing: 0.07em;
+  color: rgba(186, 210, 240, 0.58);
+  margin-bottom: 0.3rem;
+}
+
+.share-hub__linkvalue {
+  color: #f4f8ff;
+  font-size: 0.95rem;
+  line-height: 1.45;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.share-hub__actions {
+  display: grid;
+  grid-template-columns: 1fr;
+  gap: 0.65rem;
+}
+
+.share-hub__primary,
+.share-hub__secondary,
+.share-hub__manage,
+.share-sheet__toggle,
+.share-sheet__sticky-actions .btn,
+.share-sheet__linkstack .btn,
+
+.share-hub__manage {
+  white-space: nowrap;
+}
+
+.share-sheet {
+  height: auto !important;
+  max-height: min(90vh, 760px);
+  border-top-left-radius: 24px;
+  border-top-right-radius: 24px;
+  border: 1px solid rgba(255, 255, 255, 0.06);
+  background: linear-gradient(180deg, rgba(8, 18, 33, 0.995), rgba(6, 13, 24, 0.99)) !important;
+  box-shadow: 0 -24px 60px rgba(0, 0, 0, 0.42);
+}
+
+.share-sheet__header {
+  align-items: flex-start;
+  padding: 0.85rem 1rem 0.6rem;
+}
+
+.share-sheet__body {
+  padding: 0 1rem calc(1rem + env(safe-area-inset-bottom));
+  overflow-y: auto;
+}
+
+.share-sheet__grabber {
+  width: 52px;
+  height: 5px;
+  border-radius: 999px;
+  margin: 0 auto 0.8rem;
+  background: rgba(255, 255, 255, 0.22);
+}
+
+.share-sheet__section {
+  border: 1px solid rgba(255, 255, 255, 0.07);
+  background: rgba(255, 255, 255, 0.035);
+  border-radius: 18px;
+  padding: 0.95rem;
+  margin-bottom: 0.9rem;
+}
+
+.share-sheet__section-head {
+  justify-content: space-between;
+  margin-bottom: 0.7rem;
+  font-weight: 600;
+}
+
+.share-sheet__linkstack,
+.share-access-panel__input {
+  display: grid;
+  grid-template-columns: 1fr;
+  gap: 0.65rem;
+}
+
+.share-access-panel .tokens {
+  min-height: 2rem;
+}
+
+.share-access-panel .token {
+  background: rgba(255, 255, 255, 0.03);
+}
+
+.share-sheet__sticky-actions {
+  position: sticky;
+  bottom: 0;
+  padding-top: 0.3rem;
+  background: linear-gradient(180deg, rgba(6, 13, 24, 0), rgba(6, 13, 24, 0.96) 28%);
+}
+
+@media (min-width: 576px) {
+  .share-hub .card-body,
+  .share-sheet__header,
+  .share-sheet__body {
+    padding-left: 1.2rem;
+    padding-right: 1.2rem;
+  }
+
+  .share-sheet__linkstack,
+  .share-access-panel__input {
+    grid-template-columns: 1fr auto;
+    align-items: center;
+  }
+}
+
+@media (min-width: 768px) {
+  .share-hub .card-body {
+    padding: 1.15rem 1.2rem;
+  }
+
+  .share-hub__actions {
+    grid-template-columns: minmax(0, 1.2fr) minmax(0, 1fr);
+  }
+
+  .share-sheet {
+    max-width: 760px;
+    margin: 0 auto;
+    left: 0;
+    right: 0;
+  }
+}
+
+.endpoint-main_page .create-list-input-group {
+  display: flex;
+  flex-wrap: nowrap !important;
+  align-items: stretch;
+  overflow: hidden;
+  border-radius: 16px;
+  border: 1px solid rgba(255, 255, 255, 0.12);
+  background: rgba(7, 17, 31, 0.9);
+  box-shadow: 0 10px 28px rgba(0, 0, 0, 0.18);
+}
+
+.endpoint-main_page .create-list-input-group > .create-list-title-input,
+.endpoint-main_page .create-list-input-group > .form-control {
+  border: 0 !important;
+  border-right: 1px solid rgba(255, 255, 255, 0.08) !important;
+  border-radius: 0 !important;
+  background: transparent !important;
+  box-shadow: none !important;
+}
+
+.endpoint-main_page .create-list-input-group > .create-list-title-input:focus,
+.endpoint-main_page .create-list-input-group > .form-control:focus {
+  background: rgba(255, 255, 255, 0.02) !important;
+  box-shadow: none !important;
+}
+
+.endpoint-main_page .create-list-input-group > .create-list-temp-toggle,
+.endpoint-main_page .create-list-input-group > #tempToggle {
+  min-width: 9.5rem;
+  border: 0 !important;
+  border-radius: 0 !important;
+  background: rgba(255, 255, 255, 0.04) !important;
+  box-shadow: none !important;
+}
+
+.endpoint-main_page .create-list-input-group > .create-list-temp-toggle.is-active,
+.endpoint-main_page .create-list-input-group > #tempToggle.is-active {
+  background: rgba(41, 209, 125, 0.18) !important;
+}
+
+.endpoint-main_page .create-list-temp-toggle__label {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  min-height: 100%;
+}
+
+.endpoint-main_page .create-list-input-group:focus-within {
+  border-color: rgba(41, 209, 125, 0.55);
+  box-shadow: 0 0 0 0.18rem rgba(41, 209, 125, 0.12), 0 10px 28px rgba(0, 0, 0, 0.18);
+}
+
+.receipt-disclosure {
+  display: block;
+  padding: 0;
+  text-align: left;
+}
+
+.receipt-disclosure,
+.receipt-disclosure:hover,
+.receipt-disclosure:focus,
+.receipt-disclosure:active {
+  width: 100%;
+  appearance: none;
+  -webkit-appearance: none;
+}
+
+.receipt-disclosure:focus-visible {
+  outline: none;
+}
+
+.receipt-section--restoring {
+  transition: none !important;
+}
+
+@media (max-width: 767.98px) {
+  .endpoint-main_page .create-list-input-group {
+    border-radius: 14px;
+  }
+
+  .endpoint-main_page .create-list-input-group > .create-list-temp-toggle,
+  .endpoint-main_page .create-list-input-group > #tempToggle {
+    min-width: 8.25rem;
+    padding-left: .8rem;
+    padding-right: .8rem;
+    font-size: .9rem;
+  }
+}
+
+@media (max-width: 575.98px) {
+  .endpoint-main_page .create-list-input-group > .create-list-title-input,
+  .endpoint-main_page .create-list-input-group > .form-control {
+    padding-left: .85rem;
+    padding-right: .7rem;
+    font-size: .95rem;
+  }
+
+  .endpoint-main_page .create-list-input-group > .create-list-temp-toggle,
+  .endpoint-main_page .create-list-input-group > #tempToggle {
+    min-width: 7.6rem;
+    font-size: .84rem;
+  }
+
+  .receipt-disclosure {
+    border-radius: 16px;
+  }
+}
+
+.form-check-spaced {
+  gap: .35rem;
+}
+
+.form-check-spaced .form-check-input,
+input[type="checkbox"].form-check-input,
+.table-select-checkbox {
+  width: .95rem !important;
+  height: .95rem !important;
+  min-width: .95rem !important;
+  min-height: .95rem !important;
+  margin-top: .18rem;
+}
+
+.form-switch-compact .form-check-input {
+  width: 1.8rem !important;
+  height: .95rem !important;
+}
+
+.switch-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
+  gap: .8rem;
+}
+
+.form-check.form-switch.app-switch {
+  display: inline-flex;
+  align-items: center;
+  gap: .75rem;
+  min-height: 2.75rem;
+  margin: 0;
+  padding: .58rem .82rem;
+  background: rgba(255,255,255,.04);
+  border: 1px solid var(--ui-border);
+  border-radius: 16px;
+}
+
+.form-check.form-switch.app-switch .form-check-input {
+  float: none;
+  flex: 0 0 auto;
+  width: 2.45em !important;
+  height: 1.3em !important;
+  margin: 0 !important;
+  cursor: pointer;
+  background-color: var(--dark-400) !important;
+  border-color: var(--dark-300) !important;
+  background-position: left center !important;
+  transition: background-position .18s ease-in-out, background-color .18s ease-in-out, border-color .18s ease-in-out, box-shadow .18s ease-in-out !important;
+}
+
+.form-check.form-switch.app-switch .form-check-input:checked {
+  background-color: var(--primary) !important;
+  border-color: var(--primary-border) !important;
+  background-position: right center !important;
+}
+
+.form-check.form-switch.app-switch .form-check-input:focus {
+  box-shadow: 0 0 0 .18rem rgba(24, 64, 118, .22) !important;
+}
+
+.form-check.form-switch.app-switch .form-check-label {
+  display: inline-flex;
+  align-items: center;
+  min-height: 1.3rem;
+  margin: 0 !important;
+  line-height: 1.35;
+  cursor: pointer;
+}
+
+.form-check.form-switch.app-switch.form-switch-compact {
+  width: 100%;
+  justify-content: flex-start;
+}
+
+.form-check.form-switch.app-switch.form-switch-compact .form-check-input {
+  width: 2.45em !important;
+  height: 1.3em !important;
+}
+
+.hide-purchased-switch.form-check,
+.hide-purchased-switch.form-check.app-switch {
+  display: inline-flex;
+  align-items: center;
+  gap: .7rem;
+  width: auto;
+  max-width: 100%;
+  padding: .5rem .82rem;
+  border-radius: 14px;
+  background: rgba(255,255,255,.04);
+  border: 1px solid var(--ui-border);
+}
+
+.hide-purchased-switch .form-check-input {
+  flex: 0 0 auto;
+  float: none;
+  width: 2.45em !important;
+  height: 1.3em !important;
+  margin: 0 !important;
+  cursor: pointer;
+  background-position: left center !important;
+  transition: background-position .18s ease-in-out, background-color .18s ease-in-out, border-color .18s ease-in-out, box-shadow .18s ease-in-out !important;
+}
+
+.hide-purchased-switch .form-check-input:checked {
+  background-position: right center !important;
+}
+
+.hide-purchased-switch .form-check-label {
+  margin: 0 !important;
+  white-space: nowrap;
+  cursor: pointer;
+}
+
+.create-list-input-group {
+  display: flex;
+  flex-wrap: nowrap !important;
+  align-items: stretch;
+  gap: 0 !important;
+}
+
+.create-list-input-group > .form-control {
+  flex: 1 1 auto !important;
+  width: 1% !important;
+  min-width: 0 !important;
+  border-top-right-radius: 0 !important;
+  border-bottom-right-radius: 0 !important;
+}
+
+.create-list-input-group > .create-list-temp-toggle,
+.create-list-input-group > #tempToggle {
+  flex: 0 0 auto !important;
+  width: auto !important;
+  min-width: 10rem;
+  margin-left: -1px;
+  font-weight: 600;
+  white-space: nowrap;
+  border-top-left-radius: 0 !important;
+  border-bottom-left-radius: 0 !important;
+  border-top-right-radius: 14px !important;
+  border-bottom-right-radius: 14px !important;
+  background: rgba(255,255,255,0.03) !important;
+  border-color: var(--app-border) !important;
+  color: var(--app-text) !important;
+  transition: background-color .18s ease, border-color .18s ease, color .18s ease, box-shadow .18s ease;
+}
+
+.create-list-input-group > .create-list-temp-toggle.is-active,
+.create-list-input-group > #tempToggle.is-active {
+  background: rgba(41, 209, 125, 0.16) !important;
+  border-color: rgba(41, 209, 125, 0.72) !important;
+  color: #9bf0c1 !important;
+  box-shadow: inset 0 0 0 1px rgba(41, 209, 125, 0.15);
+}
+
+.create-list-input-group > .create-list-temp-toggle:hover,
+.create-list-input-group > #tempToggle:hover,
+.create-list-input-group > .create-list-temp-toggle:focus,
+.create-list-input-group > #tempToggle:focus {
+  background: rgba(255,255,255,0.06) !important;
+  color: var(--app-text) !important;
+}
+
+.create-list-input-group > .create-list-temp-toggle.is-active:hover,
+.create-list-input-group > #tempToggle.is-active:hover,
+.create-list-input-group > .create-list-temp-toggle.is-active:focus,
+.create-list-input-group > #tempToggle.is-active:focus {
+  background: rgba(41, 209, 125, 0.2) !important;
+  color: #b7f7d2 !important;
+}
+
+.endpoint-edit_my_list .switch-grid {
+  grid-template-columns: repeat(auto-fit, minmax(320px, 1fr));
+}
+
+.endpoint-edit_my_list .switch-grid .app-switch,
+.endpoint-admin_edit_list .switch-grid .app-switch {
+  width: 100%;
+  min-height: 3.35rem;
+}
+
+@media (max-width: 767.98px) {
+  .hide-purchased-switch {
+    padding-left: 2.95rem;
+  }
+
+  .hide-purchased-switch.form-check.app-switch {
+    width: 100%;
+  }
+
+  .switch-grid,
+  .endpoint-edit_my_list .switch-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .create-list-input-group {
+    gap: 0 !important;
+  }
+
+  .create-list-input-group > .form-control {
+    padding-left: .9rem;
+    padding-right: .75rem;
+  }
+
+  .create-list-input-group > .create-list-temp-toggle,
+  .create-list-input-group > #tempToggle {
+    min-width: 8.75rem;
+    padding-left: .85rem;
+    padding-right: .85rem;
+    font-size: .92rem;
+    letter-spacing: 0;
+  }
+}

shopping_app/static/css/split/responsive.css

@@ -0,0 +1,895 @@
+.app-navbar__meta--mobile {
+  display: none;
+}
+
+.app-user-chip--mobile {
+  max-width: min(46vw, 15rem);
+  min-width: 0;
+  padding-left: .6rem;
+  padding-right: .4rem;
+}
+
+.app-user-chip--mobile .badge {
+  max-width: 100%;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+@media (max-width: 991.98px) {
+  .app-header {
+    padding-top: .55rem;
+  }
+
+  .app-navbar .container-xxl {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) auto auto;
+    align-items: center;
+    gap: .6rem;
+    border-radius: 26px;
+    padding-top: .8rem;
+    padding-bottom: .8rem;
+  }
+
+  .app-navbar__meta {
+    display: none;
+  }
+
+  .app-brand {
+    overflow: hidden;
+  }
+
+  .app-brand > span:last-child {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+
+  .app-brand__title,
+  .app-brand__accent {
+    font-size: 1rem;
+  }
+
+  .app-navbar__meta--mobile {
+    display: flex !important;
+    width: auto;
+    justify-content: flex-end;
+    justify-self: end;
+    grid-column: 2;
+    min-width: 0;
+    max-width: min(42vw, 12rem);
+  }
+
+  .app-user-chip--mobile {
+    display: inline-flex;
+  }
+
+  .app-mobile-menu {
+    grid-column: 3;
+    justify-self: end;
+  }
+}
+
+@media (max-width: 575.98px) {
+  .app-brand__icon {
+    width: 2.25rem;
+    height: 2.25rem;
+  }
+
+  .app-user-chip--mobile {
+    gap: .35rem;
+    padding: .34rem .38rem .34rem .5rem;
+  }
+
+  .app-user-chip--mobile .app-user-chip__label {
+    font-size: .62rem;
+    letter-spacing: .05em;
+  }
+
+  .app-user-chip--mobile .badge {
+    font-size: .72rem;
+    max-width: 5.9rem;
+  }
+}
+
+@media (max-width: 430px) {
+  .app-navbar .container-xxl {
+    grid-template-columns: minmax(0, 1fr) auto auto;
+    gap: .45rem;
+  }
+
+  .app-user-chip--mobile {
+    max-width: min(38vw, 8.5rem);
+  }
+
+  .app-user-chip--mobile .app-user-chip__label {
+    display: none;
+  }
+}
+
+.endpoint-main_page .list-group-item {
+  display: flex;
+  flex-direction: column;
+  align-items: stretch;
+  justify-content: flex-start;
+}
+
+.endpoint-main_page .main-list-progress-wrap {
+  display: block;
+  width: 100%;
+  flex: 0 0 100%;
+  margin-top: 0.8rem !important;
+}
+
+.endpoint-main_page .list-group-item > .main-list-row + .main-list-progress-wrap {
+  align-self: stretch;
+}
+
+.endpoint-main_page .main-list-progress {
+  width: 100%;
+  height: 16px;
+  margin-top: 0 !important;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  background:
+    linear-gradient(180deg, rgba(255, 255, 255, 0.05), rgba(255, 255, 255, 0.02)),
+    var(--dark-700) !important;
+  box-shadow:
+    inset 0 1px 0 rgba(255, 255, 255, 0.05),
+    0 4px 10px rgba(0, 0, 0, 0.18);
+}
+
+.endpoint-main_page .main-list-progress .progress-bar.bg-success {
+  background: linear-gradient(135deg, rgba(40, 199, 111, 0.98), rgba(22, 163, 74, 0.98)) !important;
+}
+
+.endpoint-main_page .main-list-progress .progress-bar.bg-warning {
+  background: linear-gradient(135deg, rgba(245, 189, 65, 0.98), rgba(217, 119, 6, 0.98)) !important;
+}
+
+.endpoint-main_page .main-list-progress .progress-bar.bg-transparent {
+  background: rgba(255, 255, 255, 0.08) !important;
+}
+
+.endpoint-main_page .main-list-progress__label {
+  max-width: calc(100% - 0.85rem);
+  padding: 0 0.45rem;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  text-align: center;
+  text-shadow: 0 1px 2px rgba(0, 0, 0, 0.45);
+  letter-spacing: 0.01em;
+}
+
+@media (max-width: 575.98px) {
+  .endpoint-main_page .main-list-progress {
+    height: 15px;
+  }
+
+  .endpoint-main_page .main-list-progress__label {
+    font-size: 0.64rem;
+  }
+}
+
+.endpoint-main_page #mainStatsCollapse.collapsing,
+.endpoint-main_page #mainStatsCollapse.show {
+  overflow: visible;
+}
+
+.endpoint-main_page .main-summary-card {
+  height: 100%;
+  padding: 1rem 1rem 1.05rem;
+  border-radius: 1rem;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  background: linear-gradient(180deg, rgba(255,255,255,0.04), rgba(255,255,255,0.02)), rgba(9, 16, 28, 0.88);
+  box-shadow: 0 12px 28px rgba(0, 0, 0, 0.2);
+}
+
+.endpoint-main_page .main-summary-card__eyebrow {
+  font-size: 0.72rem;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+  color: rgba(255, 255, 255, 0.65);
+  margin-bottom: 0.2rem;
+}
+
+.endpoint-main_page .main-summary-card__title {
+  font-size: 1.05rem;
+}
+
+.endpoint-main_page .main-summary-stats {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 0.7rem;
+}
+
+.endpoint-main_page .main-summary-stat {
+  padding: 0.65rem 0.75rem;
+  border-radius: 0.85rem;
+  background: rgba(255, 255, 255, 0.04);
+  border: 1px solid rgba(255, 255, 255, 0.06);
+}
+
+.endpoint-main_page .main-summary-stat__label {
+  display: block;
+  font-size: 0.73rem;
+  color: rgba(255, 255, 255, 0.66);
+  margin-bottom: 0.15rem;
+}
+
+@media (max-width: 575.98px) {
+  .endpoint-main_page .main-summary-card {
+    padding: 0.9rem;
+  }
+
+  .endpoint-main_page .main-summary-stats {
+    grid-template-columns: 1fr;
+  }
+}
+
+@media (max-width: 575.98px) {
+  .endpoint-list_share .shopping-item-head,
+  .endpoint-shared_list .shopping-item-head {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) auto;
+    align-items: start;
+    column-gap: .45rem;
+  }
+
+  .endpoint-list_share .shopping-item-actions,
+  .endpoint-shared_list .shopping-item-actions {
+    align-self: start;
+    margin-left: 0;
+    justify-self: end;
+  }
+}
+
+@media (max-width: 575.98px) {
+  .endpoint-list_share .shopping-item-main,
+  .endpoint-shared_list .shopping-item-main {
+    align-items: center;
+  }
+
+  .endpoint-list_share .shopping-item-text,
+  .endpoint-shared_list .shopping-item-text,
+  .endpoint-list_share .shopping-item-main > .large-checkbox,
+  .endpoint-shared_list .shopping-item-main > .large-checkbox,
+  .endpoint-list_share .shopping-item-actions,
+  .endpoint-shared_list .shopping-item-actions {
+    align-self: center;
+  }
+
+  .endpoint-list_share .shopping-item-actions,
+  .endpoint-shared_list .shopping-item-actions {
+    margin-left: auto;
+    justify-self: auto;
+  }
+}
+
+.endpoint-list #items,
+.endpoint-view_list #items,
+.endpoint-list_share #items,
+.endpoint-shared_list #items {
+  display: flex;
+  flex-direction: column;
+}
+
+.endpoint-list #items > .list-group-item,
+.endpoint-view_list #items > .list-group-item,
+.endpoint-list_share #items > .list-group-item,
+.endpoint-shared_list #items > .list-group-item {
+  margin: 0 !important;
+  border-width: 1px !important;
+  box-shadow: 0 4px 14px rgba(0,0,0,0.12) !important;
+  background-clip: padding-box;
+}
+
+.endpoint-list #items > .list-group-item + .list-group-item,
+.endpoint-view_list #items > .list-group-item + .list-group-item,
+.endpoint-list_share #items > .list-group-item + .list-group-item,
+.endpoint-shared_list #items > .list-group-item + .list-group-item {
+  margin-top: 0 !important;
+  border-top-width: 1px !important;
+}
+
+@media (max-width: 767.98px){
+  .endpoint-list_share #items .list-group-item,
+  .endpoint-shared_list #items .list-group-item {
+    align-items: flex-start;
+  }
+  .endpoint-list_share .list-item-actions,
+  .endpoint-shared_list .list-item-actions {
+    width: 100%;
+    margin-left: 0;
+    justify-content: flex-start;
+  }
+}
+
+@media (max-width: 767.98px){
+  .share-page-toolbar {
+    justify-content: stretch;
+  }
+
+  .share-page-toolbar__spacer {
+    display: none;
+  }
+
+  .switch-grid,
+  .endpoint-edit_my_list .switch-grid {
+    grid-template-columns: 1fr;
+  }
+}
+
+@media (max-width: 991.98px){
+  .endpoint-admin_templates .table-responsive > table.table {
+    width: max-content !important;
+    min-width: 900px !important;
+  }
+}
+
+@media (max-width: 576px){
+  .mobile-list-heading {
+    display: inline-flex;
+    max-width: 100%;
+  }
+
+  .mobile-list-heading__title {
+    max-width: 100%;
+  }
+}
+
+@media (max-width: 575.98px){
+  .endpoint-main_page .list-group-item > .main-list-row {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .endpoint-main_page .list-main-actions {
+    width: 100%;
+  }
+}
+
+@media (max-width: 575.98px){
+  .endpoint-main_page .list-group-item > .main-list-row {
+    flex-direction: row;
+    align-items: center;
+  }
+
+  .endpoint-main_page .list-main-actions {
+    width: auto;
+    margin-left: auto;
+  }
+
+  .endpoint-main_page .list-main-actions .btn {
+    padding: .38rem .52rem;
+    min-width: 2.35rem;
+  }
+
+  .endpoint-main_page .list-main-title {
+    display: flex;
+    flex-wrap: wrap;
+    gap: .15rem;
+  }
+
+  .endpoint-main_page .list-main-meta {
+    flex: 1 1 auto;
+    min-width: 0;
+  }
+
+  .endpoint-main_page .list-main-title__link {
+    min-width: 0;
+    max-width: 100%;
+  }
+
+  .shopping-item-row {
+    align-items: flex-start !important;
+  }
+
+  .shopping-item-actions {
+    width: auto;
+    margin-top: 0;
+    margin-left: auto;
+    justify-content: flex-end;
+  }
+
+  .shopping-item-actions .btn {
+    min-width: 2.35rem;
+    padding: .38rem .52rem;
+  }
+
+  .shopping-compact-input-group {
+    display: flex;
+  }
+
+  .shopping-compact-input-group > .form-control {
+    min-width: 0;
+  }
+
+  .shopping-qty-input {
+    flex-basis: 4rem;
+    max-width: 4rem;
+  }
+
+  .shopping-compact-submit {
+    min-width: auto;
+    padding-left: .8rem;
+    padding-right: .8rem;
+  }
+
+  .ui-password-group > .ui-password-toggle {
+    min-width: 2.75rem;
+    padding-left: .7rem;
+    padding-right: .7rem;
+  }
+}
+
+@media (max-width: 575.98px){
+  .shopping-item-main {
+    gap: .55rem;
+  }
+
+  .shopping-item-head {
+    gap: .45rem;
+  }
+
+  .shopping-item-actions {
+    margin-left: auto;
+    align-self: flex-start;
+  }
+
+  .shopping-item-actions .btn {
+    min-width: 2.2rem;
+    padding: .34rem .48rem;
+  }
+
+  .shopping-product-input-group > .shopping-product-name-input,
+  .shopping-expense-input-group > .shopping-expense-amount-input {
+    flex: 0 0 60%;
+    min-width: 0;
+  }
+
+  .shopping-product-input-group > .shopping-qty-input {
+    flex: 0 0 15%;
+    max-width: 15%;
+    min-width: 0;
+  }
+
+  .shopping-product-input-group > .shopping-compact-submit {
+    flex: 0 0 25%;
+    width: 25%;
+    min-width: 0;
+    padding-left: .55rem;
+    padding-right: .55rem;
+    font-size: .95rem;
+  }
+
+  .shopping-expense-input-group > .shopping-compact-submit {
+    padding-left: .7rem;
+    padding-right: .7rem;
+  }
+
+  .list-toolbar {
+    align-items: flex-start !important;
+  }
+
+  .list-toolbar__sort {
+    flex: 0 0 auto;
+  }
+}
+
+@media (max-width: 767.98px){
+  .endpoint-list .shopping-product-input-group,
+  .endpoint-list_share .shopping-product-input-group,
+  .endpoint-shared_list .shopping-product-input-group,
+  .endpoint-list .shopping-expense-input-group,
+  .endpoint-list_share .shopping-expense-input-group,
+  .endpoint-shared_list .shopping-expense-input-group {
+    width: 100%;
+  }
+
+  .endpoint-list .shopping-product-input-group > .shopping-product-name-input,
+  .endpoint-list_share .shopping-product-input-group > .shopping-product-name-input,
+  .endpoint-shared_list .shopping-product-input-group > .shopping-product-name-input {
+    flex: 0 0 60% !important;
+    max-width: 60% !important;
+    min-width: 0;
+  }
+
+  .endpoint-list .shopping-product-input-group > .shopping-qty-input,
+  .endpoint-list_share .shopping-product-input-group > .shopping-qty-input,
+  .endpoint-shared_list .shopping-product-input-group > .shopping-qty-input {
+    flex: 0 0 15% !important;
+    max-width: 15% !important;
+    min-width: 0;
+    padding-left: .35rem;
+    padding-right: .35rem;
+  }
+
+  .endpoint-list .shopping-product-input-group > .shopping-compact-submit,
+  .endpoint-list_share .shopping-product-input-group > .shopping-compact-submit,
+  .endpoint-shared_list .shopping-product-input-group > .shopping-compact-submit {
+    flex: 0 0 25% !important;
+    width: 25% !important;
+    min-width: 0 !important;
+    padding-left: .4rem;
+    padding-right: .4rem;
+  }
+
+  .endpoint-list .shopping-expense-input-group > .shopping-expense-amount-input,
+  .endpoint-list_share .shopping-expense-input-group > .shopping-expense-amount-input,
+  .endpoint-shared_list .shopping-expense-input-group > .shopping-expense-amount-input {
+    flex: 1 1 auto !important;
+    min-width: 0;
+  }
+
+  .endpoint-list .shopping-expense-input-group > .shopping-compact-submit,
+  .endpoint-list_share .shopping-expense-input-group > .shopping-compact-submit,
+  .endpoint-shared_list .shopping-expense-input-group > .shopping-compact-submit {
+    flex: 0 0 5rem !important;
+    width: 5rem !important;
+    min-width: 5rem !important;
+    padding-left: .35rem;
+    padding-right: .35rem;
+  }
+
+  .endpoint-list .shopping-product-input-group > .shopping-compact-submit .shopping-btn-label,
+  .endpoint-list_share .shopping-product-input-group > .shopping-compact-submit .shopping-btn-label,
+  .endpoint-shared_list .shopping-product-input-group > .shopping-compact-submit .shopping-btn-label,
+  .endpoint-list .shopping-expense-input-group > .shopping-compact-submit .shopping-btn-label,
+  .endpoint-list_share .shopping-expense-input-group > .shopping-compact-submit .shopping-btn-label,
+  .endpoint-shared_list .shopping-expense-input-group > .shopping-compact-submit .shopping-btn-label {
+    display: none;
+  }
+
+  .endpoint-list .shopping-product-input-group > .shopping-compact-submit .shopping-btn-icon,
+  .endpoint-list_share .shopping-product-input-group > .shopping-compact-submit .shopping-btn-icon,
+  .endpoint-shared_list .shopping-product-input-group > .shopping-compact-submit .shopping-btn-icon,
+  .endpoint-list .shopping-expense-input-group > .shopping-compact-submit .shopping-btn-icon,
+  .endpoint-list_share .shopping-expense-input-group > .shopping-compact-submit .shopping-btn-icon,
+  .endpoint-shared_list .shopping-expense-input-group > .shopping-compact-submit .shopping-btn-icon {
+    margin: 0;
+    font-size: 1rem;
+  }
+}
+
+@media (max-width: 767.98px){
+  .endpoint-view_list .shopping-product-input-group > .shopping-product-name-input {
+    flex: 0 0 60% !important;
+    max-width: 60% !important;
+    min-width: 0;
+  }
+
+  .endpoint-view_list .shopping-product-input-group > .shopping-qty-input {
+    flex: 0 0 15% !important;
+    max-width: 15% !important;
+    min-width: 0;
+    padding-left: .35rem;
+    padding-right: .35rem;
+  }
+
+  .endpoint-view_list .shopping-product-input-group > .shopping-compact-submit {
+    flex: 0 0 25% !important;
+    width: 25% !important;
+    min-width: 0 !important;
+    padding-left: .4rem;
+    padding-right: .4rem;
+  }
+
+  .endpoint-view_list .shopping-expense-input-group > .shopping-expense-amount-input {
+    flex: 1 1 auto !important;
+    min-width: 0;
+  }
+
+  .endpoint-view_list .shopping-expense-input-group > .shopping-compact-submit {
+    flex: 0 0 5rem !important;
+    width: 5rem !important;
+    min-width: 5rem !important;
+    padding-left: .35rem;
+    padding-right: .35rem;
+  }
+
+  .endpoint-view_list .shopping-product-input-group > .shopping-compact-submit .shopping-btn-label,
+  .endpoint-view_list .shopping-expense-input-group > .shopping-compact-submit .shopping-btn-label {
+    display: none;
+  }
+
+  .endpoint-view_list .shopping-product-input-group > .shopping-compact-submit .shopping-btn-icon,
+  .endpoint-view_list .shopping-expense-input-group > .shopping-compact-submit .shopping-btn-icon {
+    margin: 0;
+    font-size: 1rem;
+  }
+}
+
+@media (max-width: 575.98px){
+  .shopping-item-head {
+    flex-wrap: wrap;
+    align-items: flex-start;
+  }
+
+  .shopping-item-text {
+    flex: 1 1 100%;
+    min-width: 0;
+  }
+
+  .shopping-item-actions {
+    width: 100%;
+    margin-left: 0;
+    justify-content: flex-end;
+  }
+}
+
+@media (max-width: 575.98px){
+  .shopping-item-main {
+    align-items: center;
+  }
+
+  .shopping-item-head {
+    flex-wrap: nowrap;
+    align-items: center;
+    gap: .4rem;
+  }
+
+  .shopping-item-text {
+    flex: 1 1 auto;
+    min-width: 0;
+    gap: .25rem;
+  }
+
+  .shopping-item-actions {
+    width: auto;
+    margin-left: auto;
+    gap: .25rem;
+  }
+
+  .shopping-item-actions .btn {
+    min-width: 2rem;
+    padding: .3rem .42rem;
+  }
+
+  .hide-purchased-switch--right {
+    width: auto;
+    max-width: 100%;
+  }
+
+  .list-action-row {
+    gap: .5rem;
+  }
+
+  .list-action-row > .list-action-row__btn,
+  .list-action-row__form {
+    flex: 1 1 50%;
+    min-width: 0;
+  }
+
+  .list-action-row__btn {
+    padding-left: .55rem;
+    padding-right: .55rem;
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+  }
+}
+
+@media (max-width: 575.98px){
+  .endpoint-view_list .list-toolbar {
+    display: grid !important;
+    grid-template-columns: minmax(0, 1fr) auto;
+    align-items: center !important;
+    gap: .4rem !important;
+    flex-wrap: nowrap !important;
+  }
+
+  .endpoint-view_list .list-toolbar__sort.btn {
+    min-width: 0;
+    padding: .35rem .55rem;
+    font-size: .82rem;
+  }
+
+  .endpoint-view_list .hide-purchased-switch--right {
+    min-width: 0;
+    gap: .25rem;
+    font-size: .82rem;
+  }
+
+  .endpoint-view_list .hide-purchased-switch--right .form-check-label {
+    margin-left: .25rem !important;
+    white-space: nowrap;
+  }
+
+  .endpoint-view_list .hide-purchased-switch--right .form-check-input {
+    transform: scale(.92);
+    transform-origin: center;
+  }
+
+  .list-header-toolbar {
+    align-items: flex-start !important;
+  }
+
+  .list-header-toolbar .list-toolbar {
+    width: 100%;
+    justify-content: flex-end !important;
+  }
+}
+
+@media (max-width: 575.98px){
+  .endpoint-list_share .shopping-item-main,
+  .endpoint-shared_list .shopping-item-main,
+  .endpoint-view_list .shopping-item-main,
+  .endpoint-list .shopping-item-main {
+    gap: .55rem;
+  }
+
+  .endpoint-list_share .shopping-item-head,
+  .endpoint-shared_list .shopping-item-head,
+  .endpoint-view_list .shopping-item-head,
+  .endpoint-list .shopping-item-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: .45rem;
+  }
+
+  .endpoint-list_share .shopping-item-text,
+  .endpoint-shared_list .shopping-item-text,
+  .endpoint-view_list .shopping-item-text,
+  .endpoint-list .shopping-item-text {
+    flex: 1 1 auto;
+    min-width: 0;
+    gap: .25rem;
+  }
+
+  .endpoint-list_share .shopping-item-actions,
+  .endpoint-shared_list .shopping-item-actions,
+  .endpoint-view_list .shopping-item-actions,
+  .endpoint-list .shopping-item-actions {
+    align-self: start;
+    width: auto;
+    margin-left: auto;
+    gap: .25rem;
+  }
+
+  .endpoint-list_share .shopping-item-actions .btn,
+  .endpoint-shared_list .shopping-item-actions .btn {
+    min-width: 2rem;
+    padding: .3rem .42rem;
+  }
+}
+
+@media (max-width: 575.98px){
+  .endpoint-list_share .shopping-action-btn,
+  .endpoint-shared_list .shopping-action-btn,
+  .endpoint-view_list .shopping-action-btn,
+  .endpoint-list .shopping-action-btn {
+    width: 2.15rem !important;
+    height: 2.15rem !important;
+    min-width: 2.15rem !important;
+    min-height: 2.15rem !important;
+    border-radius: .65rem !important;
+  }
+
+  .endpoint-list_share .shopping-action-btn--wide,
+  .endpoint-shared_list .shopping-action-btn--wide,
+  .endpoint-view_list .shopping-action-btn--wide,
+  .endpoint-list .shopping-action-btn--wide {
+    min-width: 5.4rem !important;
+    padding: 0 .72rem !important;
+  }
+}
+
+@media (max-width: 575.98px){
+  .endpoint-list_share .shopping-action-btn--countdown,
+  .endpoint-shared_list .shopping-action-btn--countdown,
+  .endpoint-view_list .shopping-action-btn--countdown,
+  .endpoint-list .shopping-action-btn--countdown {
+    min-width: 3rem !important;
+    padding: 0 .55rem !important;
+  }
+}
+
+@media (max-width: 575.98px) {
+  .ui-password-group > .ui-password-toggle {
+    flex-basis: 44px !important;
+    width: 44px !important;
+    min-width: 44px !important;
+  }
+}
+
+@media (max-width: 767.98px) {
+  .endpoint-list .shopping-entry-card,
+  .endpoint-list_share .shopping-entry-card,
+  .endpoint-shared_list .shopping-entry-card,
+  .endpoint-view_list .shopping-entry-card {
+    padding: .8rem;
+    border-radius: .95rem;
+  }
+
+  .endpoint-list .shopping-entry-card__label,
+  .endpoint-list_share .shopping-entry-card__label,
+  .endpoint-shared_list .shopping-entry-card__label,
+  .endpoint-view_list .shopping-entry-card__label {
+    font-size: .92rem;
+  }
+
+  .endpoint-list .shopping-entry-card__hint,
+  .endpoint-list_share .shopping-entry-card__hint,
+  .endpoint-shared_list .shopping-entry-card__hint,
+  .endpoint-view_list .shopping-entry-card__hint {
+    font-size: .78rem;
+    margin-bottom: .65rem;
+  }
+}
+
+@media (max-width: 767.98px) {
+  .endpoint-expenses .expenses-range-toolbar {
+    justify-content: stretch !important;
+    overflow: visible;
+    padding-bottom: 0;
+  }
+
+  .endpoint-expenses .expenses-range-group {
+    display: grid !important;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 0.55rem;
+    width: 100%;
+    min-width: 0;
+  }
+
+  .endpoint-expenses .expenses-table-toolbar .expenses-range-group {
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+  }
+
+  .endpoint-expenses .expenses-range-group > .btn {
+    flex: initial !important;
+    width: 100%;
+    min-width: 0;
+    padding-inline: 0.55rem;
+    font-size: 0.95rem;
+  }
+
+  .endpoint-expenses .expenses-date-range {
+    display: grid !important;
+    grid-template-columns: 52px minmax(0, 1fr);
+    gap: 0.55rem;
+    width: 100%;
+    max-width: 100% !important;
+    flex-wrap: wrap !important;
+  }
+
+  .endpoint-expenses .expenses-date-range > .input-group-text,
+  .endpoint-expenses .expenses-date-range > .form-control,
+  .endpoint-expenses .expenses-date-range > .btn {
+    width: 100% !important;
+    min-width: 0 !important;
+    flex: initial !important;
+    border-radius: 0.85rem !important;
+  }
+
+  .endpoint-expenses .expenses-date-range > .btn {
+    grid-column: 1 / -1;
+  }
+}
+
+@media (max-width: 767.98px) {
+  .list-quick-actions {
+    padding: .9rem;
+    gap: .75rem;
+  }
+
+  .list-quick-actions__header {
+    flex-direction: column;
+    gap: .35rem;
+  }
+
+  .list-quick-actions__hint {
+    max-width: none;
+    text-align: left;
+  }
+
+  .list-quick-actions__grid {
+    grid-template-columns: 1fr;
+  }
+
+  .list-quick-actions__action.btn {
+    min-height: 72px;
+    padding: .85rem .9rem;
+  }
+}

shopping_app/static/css/split/theme.css

@@ -0,0 +1,80 @@
+:root {
+  --primary: #184076;
+  --primary-border: #153866;
+  --primary-text: #e6f0ff;
+
+  --info: var(--primary);
+  --info-border: var(--primary-border);
+  --info-text: var(--primary-text);
+
+  --success: #1c6930;
+  --success-border: #165024;
+  --success-text: #eaffea;
+
+  --warning: #665c1e;
+  --warning-border: #4d4415;
+  --warning-text: #fffbe5;
+
+  --danger: #6e1a1e;
+  --danger-border: #531417;
+  --danger-text: #ffeaea;
+
+  --dark-900: #181a1b;
+  --dark-800: #1c1f22;
+  --dark-750: #1f2225;
+  --dark-700: #212529;
+  --dark-650: #23272a;
+  --dark-600: #2a2d31;
+  --dark-550: #2b2f33;
+  --dark-500: #2c2f33;
+  --dark-480: #2c3034;
+  --dark-470: #2a2d31;
+  --dark-450: #3a3f44;
+  --dark-400: #343a40;
+  --dark-350: #3d4248;
+  --dark-300: #495057;
+
+  --text-strong: #f8f9fa;
+  --text: #e2e3e5;
+  --text-dim: #e1e1e1;
+  --muted: #6c757d;
+
+  --progress-default: #3d7bd6;
+}
+
+.clickable-item {
+  cursor: pointer;
+}
+
+.progress-thin {
+  height: 12px;
+}
+
+.item-not-checked {
+  background-color: var(--dark-500) !important;
+  color: #fff !important;
+}
+
+#empty-placeholder {
+  font-style: italic;
+  pointer-events: none;
+}
+
+.fade-out {
+  opacity: 0;
+  transition: opacity 0.5s ease;
+}
+
+@media (pointer: fine){
+  .only-mobile {
+    display: none !important;
+  }
+}
+
+.bg-success {
+  background-color: var(--success) !important;
+}
+
+.bg-warning {
+  background-color: var(--warning) !important;
+}

shopping_app/static/js/access_users.js

@@ -19,6 +19,28 @@
         tokensBox.appendChild(btn);
     }
 
+    function pluralizePeople(count) {
+        if (count === 1) return 'osoba';
+        const mod10 = count % 10;
+        const mod100 = count % 100;
+        if (mod10 >= 2 && mod10 <= 4 && !(mod100 >= 12 && mod100 <= 14)) return 'osoby';
+        return 'osób';
+    }
+
+    function syncAccessCount(box) {
+        if (!box) return;
+        const count = $$('.token', box).length;
+        const sheetBadge = document.getElementById('shareSheetPeopleBadge');
+        const cardBadge = document.getElementById('sharePeopleBadge');
+
+        if (sheetBadge) sheetBadge.textContent = String(count);
+
+        if (cardBadge) {
+            cardBadge.textContent = `👥 ${count} ${pluralizePeople(count)}`;
+            cardBadge.classList.toggle('d-none', count === 0);
+        }
+    }
+
     function wantsJSON() {
         return {
             'Accept': 'application/json',
@@ -29,7 +51,7 @@
     async function postAction(postUrl, nextPath, params) {
         const form = new FormData();
         for (const [k, v] of Object.entries(params)) form.set(k, v);
-        form.set('next', nextPath); // dla trybu HTML fallback
+        form.set('next', nextPath);
 
         try {
             const res = await fetch(postUrl, {
@@ -61,13 +83,16 @@
         const suggestUrl = box.dataset.suggestUrl || '';
         const grantAction = box.dataset.grantAction || 'grant';
         const revokeField = box.dataset.revokeField || 'revoke_user_id';
+        const listId = box.dataset.listId || '';
 
         const tokensBox = $('.tokens', box);
         const input = $('.access-input', box);
         const addBtn = $('.access-add', box);
 
-        // współdzielony datalist do sugestii
-        let datalist = $('#userHintsGeneric');
+        let datalist = null;
+        const existingListId = input?.getAttribute('list');
+        if (existingListId) datalist = document.getElementById(existingListId);
+        if (!datalist) datalist = $('#userHintsGeneric');
         if (!datalist) {
             datalist = document.createElement('datalist');
             datalist.id = 'userHintsGeneric';
@@ -79,25 +104,32 @@
         const parseUserText = (txt) => unique((txt || '').split(/[\s,;]+/g).map(s => s.trim().replace(/^@/, '').toLowerCase()).filter(Boolean));
         const debounce = (fn, ms = 200) => { let t; return (...a) => { clearTimeout(t); t = setTimeout(() => fn(...a), ms); }; };
 
-        // Sugestie (GET JSON)
-        const renderHints = (users = []) => { datalist.innerHTML = users.slice(0, 20).map(u => `<option value="${u}">@${u}</option>`).join(''); };
+        const initialOptions = Array.from(datalist.querySelectorAll('option')).map(o => o.value).filter(Boolean);
+        const renderHints = (users = []) => {
+            const merged = unique([...(users || []), ...initialOptions]).slice(0, 20);
+            datalist.innerHTML = merged.map(u => `<option value="${u}"></option>`).join('');
+        };
+        renderHints(initialOptions);
+
         let acCtrl = null;
         const fetchHints = debounce(async (q) => {
             if (!suggestUrl) return;
             try {
                 acCtrl?.abort();
                 acCtrl = new AbortController();
-                const res = await fetch(`${suggestUrl}?q=${encodeURIComponent(q || '')}`, { credentials: 'same-origin', signal: acCtrl.signal });
+                const normalized = String(q || '').trim().replace(/^@/, '');
+                const res = await fetch(`${suggestUrl}?q=${encodeURIComponent(normalized)}`, { credentials: 'same-origin', signal: acCtrl.signal });
                 if (!res.ok) return renderHints([]);
                 const data = await res.json().catch(() => ({ users: [] }));
                 renderHints(data.users || []);
-            } catch { renderHints([]); }
+            } catch {
+                renderHints(initialOptions);
+            }
         }, 200);
 
         input?.addEventListener('focus', () => fetchHints(input.value));
         input?.addEventListener('input', () => fetchHints(input.value));
 
-        // Revoke (klik w token)
         box.addEventListener('click', async (e) => {
             const btn = e.target.closest('.token');
             if (!btn || !box.contains(btn)) return;
@@ -107,7 +139,7 @@
             if (!userId) return toast('Brak identyfikatora użytkownika.', 'danger');
 
             btn.disabled = true; btn.classList.add('disabled');
-            const res = await postAction(postUrl, nextPath, { [revokeField]: userId });
+            const res = await postAction(postUrl, nextPath, { action: 'revoke', target_list_id: listId, [revokeField]: userId });
 
             if (res.ok) {
                 btn.remove();
@@ -117,6 +149,7 @@
                     empty.textContent = 'Brak dodanych uprawnień.';
                     tokensBox.appendChild(empty);
                 }
+                syncAccessCount(box);
                 toast(`Odebrano dostęp: @${username}`, 'success');
             } else {
                 btn.disabled = false; btn.classList.remove('disabled');
@@ -124,7 +157,6 @@
             }
         });
 
-        // Grant (wiele loginów, bez przeładowania strony)
         async function addUsers() {
             const users = parseUserText(input?.value);
             if (!users?.length) return toast('Podaj co najmniej jednego użytkownika', 'warning');
@@ -136,13 +168,13 @@
             let okCount = 0, failCount = 0, appended = 0;
 
             for (const u of users) {
-                const res = await postAction(postUrl, nextPath, { action: grantAction, grant_username: u });
+                const res = await postAction(postUrl, nextPath, { action: grantAction, target_list_id: listId, grant_username: u });
                 if (res.ok) {
                     okCount++;
-                    // jeśli backend odda JSON z userem – dolep token live
                     if (res.data?.user) {
                         appendToken(box, res.data.user);
                         appended++;
+                        syncAccessCount(box);
                     }
                 } else {
                     failCount++;
@@ -156,15 +188,14 @@
             if (okCount) toast(`Dodano dostęp: ${okCount} użytkownika`, 'success');
             if (failCount) toast(`Błędy przy dodawaniu: ${failCount}`, 'danger');
 
-            // fallback: jeśli nic nie dolepiliśmy (brak JSON), odśwież, by zobaczyć nowe tokeny
             if (okCount && appended === 0) {
-                // opóźnij minimalnie, by toast mignął
                 setTimeout(() => location.reload(), 400);
             }
         }
 
         addBtn?.addEventListener('click', addUsers);
         input?.addEventListener('keydown', (e) => { if (e.key === 'Enter') { e.preventDefault(); addUsers(); } });
+        syncAccessCount(box);
     }
 
     document.addEventListener('DOMContentLoaded', () => {

shopping_app/static/js/admin_settings.js

@@ -0,0 +1,114 @@
+(function () {
+  const form = document.getElementById("settings-form");
+  const resetAllBtn = document.getElementById("reset-all");
+  if (!form) return;
+
+  function getCard(input) {
+    return input.closest(".settings-category-card");
+  }
+
+  function getAutoHex(input) {
+    const autoHex = (input.dataset.auto || "").trim();
+    return autoHex ? autoHex.toUpperCase() : "#000000";
+  }
+
+  function setOverrideState(input, enabled) {
+    const card = getCard(input);
+    const flag = card?.querySelector('.override-enabled');
+    const badge = card?.querySelector('[data-role="override-status"]');
+    input.dataset.hasOverride = enabled ? "1" : "0";
+    if (flag) flag.value = enabled ? "1" : "0";
+    if (badge) {
+      badge.textContent = enabled ? "Nadpisany" : "Domyślny";
+      badge.classList.toggle('text-bg-info', enabled);
+      badge.classList.toggle('text-bg-secondary', !enabled);
+    }
+  }
+
+  function updatePreview(input) {
+    const card = getCard(input);
+    if (!card) return;
+    const hexAutoEl = card.querySelector('.hex-auto');
+    const hexEffEl = card.querySelector('.hex-effective');
+    const barAuto = card.querySelector('.bar[data-kind="auto"]');
+    const barEff = card.querySelector('.bar[data-kind="effective"]');
+    const autoHex = getAutoHex(input);
+    const effectiveHex = ((input.value || autoHex).trim() || autoHex).toUpperCase();
+    const hasOverride = input.dataset.hasOverride === '1';
+
+    if (barAuto) barAuto.style.backgroundColor = autoHex;
+    if (hexAutoEl) hexAutoEl.textContent = autoHex;
+    if (barEff) barEff.style.backgroundColor = effectiveHex;
+    if (hexEffEl) hexEffEl.textContent = effectiveHex;
+    setOverrideState(input, hasOverride);
+  }
+
+  function applyDefaultVisual(input, keepOverride) {
+    input.value = getAutoHex(input);
+    setOverrideState(input, !!keepOverride);
+    updatePreview(input);
+  }
+
+  form.querySelectorAll('.use-default').forEach((btn) => {
+    btn.addEventListener('click', () => {
+      const input = form.querySelector(`#${btn.dataset.target}`);
+      if (!input) return;
+      applyDefaultVisual(input, true);
+    });
+  });
+
+  form.querySelectorAll('.reset-one').forEach((btn) => {
+    btn.addEventListener('click', () => {
+      const input = form.querySelector(`#${btn.dataset.target}`);
+      if (!input) return;
+      applyDefaultVisual(input, false);
+    });
+  });
+
+  resetAllBtn?.addEventListener('click', () => {
+    form.querySelectorAll('input[type="color"].category-color').forEach((input) => {
+      applyDefaultVisual(input, false);
+    });
+  });
+
+  form.querySelectorAll('input[type="color"].category-color').forEach((input) => {
+    updatePreview(input);
+    input.addEventListener('input', () => {
+      setOverrideState(input, true);
+      updatePreview(input);
+    });
+    input.addEventListener('change', () => {
+      setOverrideState(input, true);
+      updatePreview(input);
+    });
+  });
+
+  (function () {
+    const slider = document.getElementById('ocr_sensitivity');
+    const badge = document.getElementById('ocr_sens_badge');
+    const value = document.getElementById('ocr_sens_value');
+    if (!slider || !badge || !value) return;
+
+    function labelFor(v) {
+      v = Number(v);
+      if (v <= 3) return 'Niski';
+      if (v <= 7) return 'Średni';
+      return 'Wysoki';
+    }
+    function clsFor(v) {
+      v = Number(v);
+      if (v <= 3) return 'sens-low';
+      if (v <= 7) return 'sens-mid';
+      return 'sens-high';
+    }
+    function update() {
+      value.textContent = `(${slider.value})`;
+      badge.textContent = labelFor(slider.value);
+      badge.classList.remove('sens-low', 'sens-mid', 'sens-high');
+      badge.classList.add(clsFor(slider.value));
+    }
+    slider.addEventListener('input', update);
+    slider.addEventListener('change', update);
+    update();
+  })();
+})();

shopping_app/static/js/app_ui.js

@@ -0,0 +1,270 @@
+document.addEventListener('DOMContentLoaded', function () {
+  enhancePasswordFields();
+  observePasswordFields();
+  enhanceSearchableTables();
+  wireCopyButtons();
+  wireUnsavedWarnings();
+  enhanceMobileTables();
+  wireAdminNavToggle();
+  initResponsiveCategoryBadges();
+});
+
+function initPasswordField(input) {
+  if (!input || input.dataset.uiPasswordReady === '1') return;
+  if (input.closest('[data-ui-skip-toggle="true"]')) return;
+
+  const btn = document.createElement('button');
+  btn.type = 'button';
+  btn.className = 'ui-password-toggle';
+  btn.setAttribute('aria-label', 'Pokaż lub ukryj hasło');
+  btn.setAttribute('aria-pressed', 'false');
+  btn.title = 'Pokaż hasło';
+  btn.innerHTML = '<span aria-hidden="true">👁</span>';
+
+  const syncState = function () {
+    const visible = input.type === 'text';
+    btn.innerHTML = visible ? '<span aria-hidden="true">🙈</span>' : '<span aria-hidden="true">👁</span>';
+    btn.classList.toggle('is-active', visible);
+    btn.setAttribute('aria-pressed', visible ? 'true' : 'false');
+    btn.title = visible ? 'Ukryj hasło' : 'Pokaż hasło';
+  };
+
+  btn.addEventListener('click', function () {
+    const selectionStart = input.selectionStart;
+    const selectionEnd = input.selectionEnd;
+    input.type = input.type === 'password' ? 'text' : 'password';
+    syncState();
+    input.focus({ preventScroll: true });
+    if (typeof selectionStart === 'number' && typeof selectionEnd === 'number') {
+      try {
+        input.setSelectionRange(selectionStart, selectionEnd);
+      } catch (err) {}
+    }
+  });
+
+  const parent = input.parentElement;
+  if (parent && parent.classList.contains('input-group')) {
+    parent.classList.add('ui-password-group');
+    if (!parent.querySelector(':scope > .ui-password-toggle')) {
+      parent.appendChild(btn);
+    }
+  } else {
+    const wrapper = document.createElement('div');
+    wrapper.className = 'input-group ui-password-group';
+    input.parentNode.insertBefore(wrapper, input);
+    wrapper.appendChild(input);
+    wrapper.appendChild(btn);
+  }
+
+  input.dataset.uiPasswordReady = '1';
+  syncState();
+}
+
+function enhancePasswordFields(root) {
+  const scope = root && root.querySelectorAll ? root : document;
+  if (scope.matches && scope.matches('input[type="password"]')) {
+    initPasswordField(scope);
+  }
+  scope.querySelectorAll('input[type="password"]').forEach(initPasswordField);
+}
+
+function observePasswordFields() {
+  if (window.__uiPasswordObserverReady) return;
+  const observer = new MutationObserver(function (mutations) {
+    mutations.forEach(function (mutation) {
+      mutation.addedNodes.forEach(function (node) {
+        if (!(node instanceof HTMLElement)) return;
+        enhancePasswordFields(node);
+      });
+    });
+  });
+
+  observer.observe(document.body, { childList: true, subtree: true });
+  window.__uiPasswordObserverReady = true;
+}
+
+function enhanceSearchableTables() {
+  if (document.getElementById('search-table')) return;
+  const tables = document.querySelectorAll('table.sortable, table[data-searchable="true"]');
+
+  tables.forEach(function (table, index) {
+    if (table.dataset.uiSearchReady === '1') return;
+
+    const tbody = table.tBodies[0];
+    if (!tbody) return;
+    const rows = Array.from(tbody.querySelectorAll('tr'));
+    if (rows.length < 6) return;
+
+    const toolbar = document.createElement('div');
+    toolbar.className = 'table-toolbar';
+    toolbar.innerHTML = [
+      '<div class="input-group input-group-sm table-toolbar__search">',
+      '  <span class="input-group-text">🔎</span>',
+      '  <input type="search" class="form-control" placeholder="Filtruj tabelę…" aria-label="Filtruj tabelę">',
+      '  <button type="button" class="btn btn-outline-light">Wyczyść</button>',
+      '</div>',
+      '<div class="table-toolbar__meta text-secondary small">',
+      '  <span class="table-toolbar__count"></span>',
+      '</div>'
+    ].join('');
+
+    const input = toolbar.querySelector('input');
+    const clearBtn = toolbar.querySelector('button');
+    const count = toolbar.querySelector('.table-toolbar__count');
+
+    function updateTableFilter() {
+      const query = (input.value || '').trim().toLowerCase();
+      let visible = 0;
+      rows.forEach(function (row) {
+        const rowText = row.innerText.toLowerCase();
+        const match = !query || rowText.includes(query);
+        row.style.display = match ? '' : 'none';
+        if (match) visible += 1;
+      });
+      count.textContent = 'Widoczne: ' + visible + ' / ' + rows.length;
+    }
+
+    input.addEventListener('input', updateTableFilter);
+    clearBtn.addEventListener('click', function () {
+      input.value = '';
+      updateTableFilter();
+      input.focus();
+    });
+
+    const container = table.closest('.table-responsive') || table;
+    container.parentNode.insertBefore(toolbar, container);
+    updateTableFilter();
+    table.dataset.uiSearchReady = '1';
+  });
+}
+
+function wireCopyButtons() {
+  document.querySelectorAll('[data-copy-target]').forEach(function (button) {
+    if (button.dataset.uiCopyReady === '1') return;
+    button.dataset.uiCopyReady = '1';
+
+    button.addEventListener('click', async function () {
+      const target = document.querySelector(button.dataset.copyTarget);
+      if (!target) return;
+      const text = target.value || target.textContent || '';
+      try {
+        await navigator.clipboard.writeText(text.trim());
+        const original = button.textContent;
+        button.textContent = '✅ Skopiowano';
+        setTimeout(function () {
+          button.textContent = original;
+        }, 1800);
+      } catch (err) {
+        console.warn('Copy failed', err);
+      }
+    });
+  });
+}
+
+function wireUnsavedWarnings() {
+  const trackedForms = Array.from(document.querySelectorAll('form[data-unsaved-warning="true"]'));
+  if (!trackedForms.length) return;
+
+  trackedForms.forEach(function (form) {
+    if (form.dataset.uiUnsavedReady === '1') return;
+    form.dataset.uiUnsavedReady = '1';
+    form.dataset.uiDirty = '0';
+
+    const markDirty = function () {
+      form.dataset.uiDirty = '1';
+      form.classList.add('is-dirty');
+    };
+
+    form.addEventListener('input', markDirty);
+    form.addEventListener('change', markDirty);
+    form.addEventListener('submit', function () {
+      form.dataset.uiDirty = '0';
+      form.classList.remove('is-dirty');
+    });
+  });
+
+  window.addEventListener('beforeunload', function (event) {
+    const hasDirty = trackedForms.some(function (form) {
+      return form.dataset.uiDirty === '1';
+    });
+    if (!hasDirty) return;
+    event.preventDefault();
+    event.returnValue = '';
+  });
+}
+
+
+function enhanceMobileTables() {
+  document.querySelectorAll('table').forEach(function (table) {
+    if (table.dataset.mobileLabelsReady === '1') return;
+    const headers = Array.from(table.querySelectorAll('thead th')).map(function (th) {
+      return (th.innerText || '').trim();
+    });
+    if (!headers.length) return;
+    table.querySelectorAll('tbody tr').forEach(function (row) {
+      Array.from(row.children).forEach(function (cell, index) {
+        if (!cell.dataset.label && headers[index]) {
+          cell.dataset.label = headers[index];
+        }
+      });
+    });
+    table.dataset.mobileLabelsReady = '1';
+  });
+}
+
+function wireAdminNavToggle() {
+  const toggle = document.querySelector('[data-admin-nav-toggle]');
+  const nav = document.querySelector('[data-admin-nav-body]');
+  if (!toggle || !nav) return;
+
+  toggle.addEventListener('click', function () {
+    const expanded = toggle.getAttribute('aria-expanded') === 'true';
+    toggle.setAttribute('aria-expanded', expanded ? 'false' : 'true');
+    nav.classList.toggle('is-open', !expanded);
+  });
+}
+
+
+function initResponsiveCategoryBadges() {
+  const headings = Array.from(document.querySelectorAll('[data-mobile-list-heading]'));
+  if (!headings.length) return;
+
+  const update = function () {
+    const isMobile = window.matchMedia('(max-width: 575.98px)').matches;
+
+    headings.forEach(function (heading) {
+      const title = heading.querySelector('[data-mobile-list-title]');
+      const group = heading.querySelector('[data-mobile-category-group]');
+      if (!title || !group) return;
+
+      group.classList.remove('is-compact');
+      if (!isMobile || !group.children.length) return;
+
+      const headingWidth = Math.ceil(heading.getBoundingClientRect().width);
+      if (!headingWidth) return;
+
+      const titleRect = title.getBoundingClientRect();
+      const groupRect = group.getBoundingClientRect();
+      const titleWidth = Math.ceil(titleRect.width);
+      const groupWidth = Math.ceil(group.scrollWidth);
+      const wrapped = groupRect.top - titleRect.top > 4;
+      const needsCompact = wrapped || (titleWidth + groupWidth > headingWidth);
+      group.classList.toggle('is-compact', needsCompact);
+    });
+  };
+
+  let resizeTimer = null;
+  window.addEventListener('resize', function () {
+    window.clearTimeout(resizeTimer);
+    resizeTimer = window.setTimeout(update, 60);
+  });
+
+  if (typeof ResizeObserver === 'function') {
+    const observer = new ResizeObserver(update);
+    headings.forEach(function (heading) {
+      observer.observe(heading);
+    });
+  }
+
+  update();
+}

shopping_app/static/js/categories_autosave.js

@@ -0,0 +1,43 @@
+(function () {
+    const $$ = (sel, ctx = document) => Array.from(ctx.querySelectorAll(sel));
+    const $ = (sel, ctx = document) => ctx.querySelector(sel);
+
+    const saveCategories = async (listId, ids, names, listTitle) => {
+        try {
+            const res = await fetch(`/admin/edit_categories/${listId}/save`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ category_ids: ids })
+            });
+            const data = await res.json().catch(() => ({}));
+            if (!res.ok || !data.ok) throw new Error(data.error || 'save_failed');
+
+            const cats = names.length ? names.join(', ') : 'brak';
+            showToast(`Zapisano kategorie [${cats}] dla listy <b>${listTitle}</b>`, 'success');
+        } catch (err) {
+            console.error('Autosave error:', err);
+            showToast(`Błąd zapisu kategorii dla listy <b>${listTitle}</b>`, 'danger');
+        }
+    };
+
+    const timers = new Map();
+    const debounce = (key, fn, delay = 300) => {
+        clearTimeout(timers.get(key));
+        timers.set(key, setTimeout(fn, delay));
+    };
+
+    $$('.form-select[name^="categories_"]').forEach(select => {
+        const listId = select.getAttribute('data-list-id') || select.name.replace('categories_', '');
+        const listTitle = select.closest('tr')?.querySelector('td a')?.textContent.trim() || `#${listId}`;
+
+        select.addEventListener('change', () => {
+            const selectedOptions = Array.from(select.options).filter(o => o.selected);
+            const ids = selectedOptions.map(o => o.value);              // <-- ID
+            const names = selectedOptions.map(o => o.textContent.trim());
+            debounce(listId, () => saveCategories(listId, ids, names, listTitle));
+        });
+    });
+
+    const fallback = $('#fallback-save-btn');
+    if (fallback) fallback.classList.add('d-none');
+})();

shopping_app/static/js/category_modal.js

@@ -0,0 +1,18 @@
+document.addEventListener('DOMContentLoaded', () => {
+    document.querySelectorAll('#categoriesModal .category-suggestion').forEach(btn => {
+        btn.addEventListener('click', () => {
+            const select = document.getElementById('category_id');
+            if (!select) return;
+
+            select.value = btn.dataset.catId || '';
+            const form = btn.closest('form');
+            if (form) {
+                if (typeof form.requestSubmit === 'function') {
+                    form.requestSubmit();
+                } else {
+                    form.submit();
+                }
+            }
+        });
+    });
+});

shopping_app/static/js/chart_controls.js

@@ -76,7 +76,7 @@ document.addEventListener("DOMContentLoaded", function () {
         }
 
         // porzucenie zakresu
-        document.querySelectorAll("#chartTab .range-btn").forEach(b => b.classList.remove("active"));
+        document.querySelectorAll("#chartTab .chart-range-btn").forEach(b => b.classList.remove("active"));
         reloadRespectingSplit();
     });
 
@@ -90,9 +90,9 @@ document.addEventListener("DOMContentLoaded", function () {
     });
 
     // ——— Predefiniowane zakresy pod wykresem ———
-    document.querySelectorAll("#chartTab .range-btn").forEach((btn) => {
+    document.querySelectorAll("#chartTab .chart-range-btn").forEach((btn) => {
         btn.addEventListener("click", function () {
-            document.querySelectorAll("#chartTab .range-btn").forEach((b) => b.classList.remove("active"));
+            document.querySelectorAll("#chartTab .chart-range-btn").forEach((b) => b.classList.remove("active"));
             this.classList.add("active");
             const r = this.getAttribute("data-range"); // last30days/currentmonth/monthly/quarterly/halfyearly/yearly
 

shopping_app/static/js/clickable_row.js

@@ -25,16 +25,15 @@ document.addEventListener("DOMContentLoaded", () => {
     }
 
     checkbox.disabled = true;
-    row.classList.add('opacity-50');
+    row.classList.add('opacity-50', 'is-pending');
 
-    // Dodaj spinner tylko jeśli nie ma
-    let existingSpinner = row.querySelector('.spinner-border');
+    let existingSpinner = row.querySelector('.shopping-item-spinner');
     if (!existingSpinner) {
       const spinner = document.createElement('span');
-      spinner.className = 'spinner-border spinner-border-sm ms-2';
+      spinner.className = 'shopping-item-spinner spinner-border spinner-border-sm';
       spinner.setAttribute('role', 'status');
       spinner.setAttribute('aria-hidden', 'true');
-      checkbox.parentElement.appendChild(spinner);
+      row.appendChild(spinner);
     }
   });
 });

shopping_app/static/js/expense_table.js

@@ -1,7 +1,7 @@
 document.addEventListener('DOMContentLoaded', () => {
     const checkboxes = document.querySelectorAll('.list-checkbox');
     const totalEl = document.getElementById('listsTotal');
-    const filterButtons = document.querySelectorAll('.range-btn');
+    const filterButtons = document.querySelectorAll('#listsTab .table-range-btn');
     const rows = document.querySelectorAll('#listsTableBody tr');
     const categoryButtons = document.querySelectorAll('.category-filter');
     const applyCustomBtn = document.getElementById('applyCustomRange');
@@ -136,7 +136,7 @@ document.addEventListener('DOMContentLoaded', () => {
             if (initialLoad) {
                 filterByLast30Days();
             } else {
-                const activeRange = document.querySelector('.range-btn.active');
+                const activeRange = document.querySelector('#listsTab .table-range-btn.active');
                 if (activeRange) filterByRange(activeRange.dataset.range);
             }
             applyExpenseFilter();
@@ -158,7 +158,7 @@ document.addEventListener('DOMContentLoaded', () => {
                 return;
             }
             initialLoad = false;
-            document.querySelectorAll('.range-btn').forEach(b => b.classList.remove('active'));
+            document.querySelectorAll('#listsTab .table-range-btn').forEach(b => b.classList.remove('active'));
             filterByCustomRange(startStr, endStr);
             applyExpenseFilter();
             applyCategoryFilter();

shopping_app/static/js/functions.js

@@ -0,0 +1,490 @@
+function updateItemState(itemId, isChecked) {
+  const checkbox = document.querySelector(`#item-${itemId} input[type='checkbox']`);
+  if (checkbox) {
+    checkbox.checked = isChecked;
+    checkbox.disabled = false;
+    const li = checkbox.closest('li');
+    li.classList.remove('opacity-50', 'is-pending', 'bg-light', 'text-dark', 'bg-success', 'text-white', 'bg-warning', 'item-not-checked');
+
+    if (isChecked) {
+      li.classList.add('bg-success', 'text-white');
+    } else {
+      li.classList.add('item-not-checked');
+    }
+
+    li.querySelectorAll('.shopping-item-spinner, .spinner-border').forEach(sp => sp.remove());
+  }
+  updateProgressBar();
+  applyHidePurchased();
+}
+
+function updateProgressBar() {
+  const barPurchased = document.getElementById('progress-bar-purchased');
+  const barNotPurchased = document.getElementById('progress-bar-not-purchased');
+  const barRemaining = document.getElementById('progress-bar-remaining');
+  const progressLabel = document.getElementById('progress-label');
+  const percentValueEl = document.getElementById('percent-value');
+
+  if (!barPurchased || !barNotPurchased || !barRemaining || !progressLabel) {
+    return;
+  }
+
+  const items = document.querySelectorAll('#items li');
+  const total = items.length;
+
+  const purchased = Array.from(items).filter(li => li.classList.contains('bg-success')).length;
+  const notPurchased = Array.from(items).filter(li => li.classList.contains('bg-warning')).length;
+  const remaining = total - purchased - notPurchased;
+
+  const percentPurchased = total > 0 ? (purchased / total) * 100 : 0;
+  const percentNotPurchased = total > 0 ? (notPurchased / total) * 100 : 0;
+  const percentRemaining = total > 0 ? (remaining / total) * 100 : 0;
+
+  const percent = total > 0 ? Math.round((purchased / total) * 100) : 0;
+
+  barPurchased.style.width = `${percentPurchased}%`;
+  barNotPurchased.style.width = `${percentNotPurchased}%`;
+  barRemaining.style.width = `${percentRemaining}%`;
+
+  progressLabel.textContent = `${percent}%`;
+  progressLabel.classList.toggle('text-white', percent < 51);
+  progressLabel.classList.toggle('text-dark', percent >= 51);
+
+  const purchasedCountEl = document.getElementById('purchased-count');
+  const totalCountEl = document.getElementById('total-count');
+
+  if (purchasedCountEl) purchasedCountEl.textContent = purchased;
+  if (totalCountEl) totalCountEl.textContent = total;
+  if (percentValueEl) percentValueEl.textContent = percent;
+}
+
+function addItem(listId) {
+  const name = document.getElementById('newItem').value;
+  const quantityInput = document.getElementById('newQuantity');
+  let quantity = 1;
+
+  if (quantityInput) {
+    quantity = parseInt(quantityInput.value);
+    if (isNaN(quantity) || quantity < 1) {
+      quantity = 1;
+    }
+  }
+
+  if (name.trim() === '') return;
+
+  socket.emit('add_item', { list_id: listId, name: name, quantity: quantity });
+
+  document.getElementById('newItem').value = '';
+  if (quantityInput) quantityInput.value = 1;
+  document.getElementById('newItem').focus();
+}
+
+function deleteItem(id) {
+  if (confirm('Na pewno usunąć produkt?')) {
+    socket.emit('delete_item', { item_id: id });
+  }
+}
+
+function editItem(id, oldName, oldQuantity) {
+  const finalName = String(oldName ?? '').trim();
+  let newQuantity = parseInt(oldQuantity, 10);
+
+  if (!finalName) {
+    showToast('Nazwa produktu nie może być pusta.', 'warning');
+    return;
+  }
+
+  if (isNaN(newQuantity) || newQuantity < 1) {
+    newQuantity = 1;
+  }
+
+  socket.emit('edit_item', { item_id: id, new_name: finalName, new_quantity: newQuantity });
+}
+
+function openEditItemModal(event, id, oldName, oldQuantity) {
+  if (event && typeof event.stopPropagation === 'function') {
+    event.stopPropagation();
+  }
+
+  const modalEl = document.getElementById('editItemModal');
+  const idInput = document.getElementById('editItemId');
+  const nameInput = document.getElementById('editItemName');
+  const quantityInput = document.getElementById('editItemQuantity');
+
+  if (!modalEl || !idInput || !nameInput || !quantityInput || typeof bootstrap === 'undefined') {
+    editItem(id, oldName, oldQuantity);
+    return;
+  }
+
+  idInput.value = id;
+  nameInput.value = String(oldName ?? '').trim();
+
+  const parsedQuantity = parseInt(oldQuantity, 10);
+  quantityInput.value = !isNaN(parsedQuantity) && parsedQuantity > 0 ? parsedQuantity : 1;
+
+  const modal = bootstrap.Modal.getOrCreateInstance(modalEl);
+  modal.show();
+
+  setTimeout(() => {
+    nameInput.focus();
+    nameInput.select();
+  }, 150);
+}
+
+function submitExpense(listId) {
+  const amountInput = document.getElementById('expenseAmount');
+  const amount = parseFloat(amountInput.value);
+  if (isNaN(amount) || amount <= 0) {
+    showToast('Podaj poprawną kwotę!');
+    return;
+  }
+  socket.emit('add_expense', {
+    list_id: listId,
+    amount: amount
+  });
+  amountInput.value = '';
+}
+
+function copyLink(link) {
+  if (navigator.share) {
+    navigator.share({
+      title: 'Udostępnij link',
+      text: 'Udostępniam link do listy:',
+      url: link
+    }).then(() => {
+      showToast('Link udostępniony!');
+    }).catch((err) => {
+      tryClipboard(link);
+    });
+    return;
+  }
+  tryClipboard(link);
+}
+
+function tryClipboard(link) {
+  if (navigator.clipboard && window.isSecureContext) {
+    navigator.clipboard.writeText(link).then(() => {
+      showToast('Link skopiowany do schowka!');
+    }).catch((err) => {
+      console.error('Błąd clipboard API:', err);
+      fallbackCopyText(link);
+    });
+  } else {
+    fallbackCopyText(link);
+  }
+}
+
+function fallbackCopyText(text) {
+  const textarea = document.createElement('textarea');
+  textarea.value = text;
+  textarea.style.position = 'fixed';
+  textarea.style.top = 0;
+  textarea.style.left = 0;
+  textarea.style.opacity = 0;
+  document.body.appendChild(textarea);
+  textarea.focus();
+  textarea.select();
+
+  try {
+    const successful = document.execCommand('copy');
+    if (successful) {
+      showToast('Link skopiowany do schowka!');
+    } else {
+      showToast('Nie udało się skopiować linku', 'warning');
+    }
+  } catch (err) {
+    console.error('Fallback błąd kopiowania:', err);
+    showToast('Nie udało się skopiować linku', 'warning');
+  }
+
+  document.body.removeChild(textarea);
+}
+
+function openList(link) {
+  window.open(link, '_blank');
+}
+
+function applyHidePurchased(isInit = false) {
+  const toggle = document.getElementById('hidePurchasedToggle');
+  if (!toggle) return;
+  const hide = toggle.checked;
+
+  const items = document.querySelectorAll('#items li');
+
+  items.forEach(li => {
+    const isCheckedItem =
+      li.classList.contains('bg-success') || // kupione
+      li.classList.contains('bg-warning');   // niekupione
+
+    if (isCheckedItem) {
+      if (hide) {
+        if (isInit) {
+          // Jeśli inicjalizacja: od razu ukryj
+          li.classList.add('hide-purchased');
+          li.classList.remove('fade-out');
+        } else {
+          // Z animacją
+          li.classList.add('fade-out');
+          setTimeout(() => {
+            li.classList.add('hide-purchased');
+          }, 700);
+        }
+      } else {
+        // Odsłanianie
+        li.classList.remove('hide-purchased');
+        setTimeout(() => {
+          li.classList.remove('fade-out');
+        }, 10);
+      }
+    } else {
+      // Element nieoznaczony — zawsze pokazany
+      li.classList.remove('hide-purchased', 'fade-out');
+    }
+  });
+}
+
+function formatShareUrlPreview(url) {
+  return String(url || '').replace(/^https?:\/\//, '');
+}
+
+function setVisibilityBadgeState(el, isPublic, publicLabel = '🌍 Publiczna', privateLabel = '🔒 Prywatna') {
+  if (!el) return;
+  el.classList.remove('share-state-badge--public', 'share-state-badge--private');
+  el.classList.add(isPublic ? 'share-state-badge--public' : 'share-state-badge--private');
+  el.textContent = isPublic ? publicLabel : privateLabel;
+}
+
+function updateShareVisibilityUI(data) {
+  const shareUrl = data?.share_url || '';
+  const isPublic = !!data?.is_public;
+
+  const shareUrlInput = document.getElementById('shareUrlInput');
+  const shareUrlPreview = document.getElementById('shareUrlPreview');
+  const copyBtn = document.getElementById('copyBtn');
+  const toggleBtn = document.getElementById('toggleVisibilityBtn');
+  const mainNote = document.getElementById('shareVisibilityNote');
+  const sheetNote = document.getElementById('shareSheetVisibilityNote');
+  const mainOpenBtn = document.getElementById('openShareModeBtn');
+  const sheetOpenBtn = document.getElementById('openShareModeBtnSheet');
+
+  if (shareUrlInput) shareUrlInput.value = shareUrl;
+  if (shareUrlPreview) shareUrlPreview.textContent = formatShareUrlPreview(shareUrl);
+  if (copyBtn) copyBtn.disabled = false;
+  if (mainOpenBtn) mainOpenBtn.href = shareUrl;
+  if (sheetOpenBtn) sheetOpenBtn.href = shareUrl;
+
+  setVisibilityBadgeState(document.getElementById('shareVisibilityBadge'), isPublic);
+  setVisibilityBadgeState(document.getElementById('shareSheetVisibilityBadge'), isPublic, 'Publiczna', 'Prywatna');
+
+  if (mainNote) {
+    mainNote.textContent = isPublic
+      ? 'Lista działa publicznie i przez link udostępniania.'
+      : 'Lista działa przez link udostępniania i dla zaproszonych osób.';
+  }
+
+  if (sheetNote) {
+    sheetNote.textContent = isPublic
+      ? 'Lista jest widoczna publicznie i nadal działa przez link.'
+      : 'Lista nie jest publiczna, ale nadal działa przez link i dla zaproszonych osób.';
+  }
+
+  if (toggleBtn) {
+    toggleBtn.innerHTML = isPublic ? '🙈 Ustaw jako prywatną' : '🌍 Uczyń publiczną';
+  }
+}
+
+function toggleVisibility(listId) {
+  fetch('/toggle_visibility/' + listId, { method: 'POST' })
+    .then(response => response.json())
+    .then(data => {
+      updateShareVisibilityUI(data);
+      showToast(data.is_public ? 'Lista jest teraz publiczna.' : 'Lista jest teraz prywatna.', 'success');
+    })
+    .catch(() => {
+      showToast('Nie udało się zmienić widoczności listy.', 'danger');
+    });
+}
+
+function markNotPurchasedModal(e, id) {
+  e.stopPropagation();
+  const reason = prompt("Podaj powód oznaczenia jako niekupione:");
+  if (reason !== null) {
+    socket.emit('mark_not_purchased', { item_id: id, reason: reason });
+  }
+}
+
+function showToast(message, type = 'primary') {
+  const toastContainer = document.getElementById('toast-container');
+  const toast = document.createElement('div');
+  toast.className = `toast align-items-center text-bg-${type} border-0 show`;
+  toast.setAttribute('role', 'alert');
+  toast.innerHTML = `<div class="d-flex"><div class="toast-body">${message}</div></div>`;
+  toastContainer.appendChild(toast);
+  setTimeout(() => { toast.remove(); }, 1750);
+}
+
+
+function escapeHtml(value) {
+  return String(value ?? '')
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+
+function isListDifferent(oldItems, newItems) {
+  if (oldItems.length !== newItems.length) return true;
+
+  const oldIds = Array.from(oldItems).map(li => parseInt(li.id.replace('item-', ''), 10)).sort();
+  const newIds = newItems.map(i => i.id).sort();
+
+  for (let i = 0; i < newIds.length; i++) {
+    if (oldIds[i] !== newIds[i]) {
+      return true;
+    }
+  }
+  return false;
+}
+
+
+function renderItem(item, isShare = window.IS_SHARE, optionsOrShowEditOnly = false) {
+  const options = (typeof optionsOrShowEditOnly === 'object' && optionsOrShowEditOnly !== null)
+    ? optionsOrShowEditOnly
+    : { showEditOnly: !!optionsOrShowEditOnly };
+
+  const showEditOnly = !!options.showEditOnly;
+  const temporaryShareUndo = !!options.temporaryShareUndo;
+  const countdownSeconds = Math.max(0, parseInt(options.countdownSeconds, 10) || 15);
+
+  const li = document.createElement('li');
+  li.id = `item-${item.id}`;
+  li.dataset.name = String(item.name || '').toLowerCase();
+  li.dataset.isShare = isShare ? 'true' : 'false';
+  li.className = `list-group-item shopping-item-row clickable-item ${item.purchased ? 'bg-success text-white'
+    : item.not_purchased ? 'bg-warning text-dark'
+      : 'item-not-checked'
+    }`;
+
+  const isOwner = window.IS_OWNER === true || window.IS_OWNER === 'true';
+  const isArchived = window.IS_ARCHIVED === true || window.IS_ARCHIVED === 'true';
+  const safeName = escapeHtml(item.name || '');
+  const nameForEdit = JSON.stringify(String(item.name || ''));
+  const quantity = Number.isInteger(item.quantity) ? item.quantity : parseInt(item.quantity, 10) || 1;
+  const quantityBadge = quantity > 1
+    ? `<span class="badge rounded-pill bg-secondary">x${quantity}</span>`
+    : '';
+
+  const canEditListItem = !isShare;
+  const canShowShareActions = isShare && !showEditOnly && !temporaryShareUndo;
+  const canMarkNotPurchased = !item.not_purchased && !isArchived;
+  const checkboxHtml = `<input id="checkbox-${item.id}" class="large-checkbox" type="checkbox" ${item.purchased ? 'checked' : ''} ${(item.not_purchased || isArchived) ? 'disabled' : ''}>`;
+
+  const infoParts = [];
+  if (item.note) {
+    infoParts.push(`<span class="text-danger">[ <b>${escapeHtml(item.note)}</b> ]</span>`);
+  }
+  if (item.not_purchased_reason) {
+    infoParts.push(`<span class="text-dark">[ <b>Powód: ${escapeHtml(item.not_purchased_reason)}</b> ]</span>`);
+  }
+  const addedByDisplay = item.added_by_display || (isShare ? item.added_by : '');
+  const addedById = item.added_by_id != null ? Number(item.added_by_id) : null;
+  const ownerId = item.owner_id != null ? Number(item.owner_id) : null;
+  const shouldShowAddedBy = !!addedByDisplay && (addedById === null || ownerId === null || addedById !== ownerId);
+  if (shouldShowAddedBy) {
+    infoParts.push(`<span class="item-added-by-meta">· dodał/a: <b>${escapeHtml(addedByDisplay)}</b></span>`);
+  }
+  const infoHtml = infoParts.length
+    ? `<span class="info-line small" id="info-${item.id}">${infoParts.join(' ')}</span>`
+    : '';
+
+  const iconBtn = 'btn btn-outline-light btn-sm shopping-action-btn';
+  const wideBtn = 'btn btn-outline-light btn-sm shopping-action-btn shopping-action-btn--wide';
+  let actionButtons = '';
+
+  if (canEditListItem) {
+    const dragHandleButton = window.isSorting
+      ? `<button type="button" class="${iconBtn} drag-handle" title="Przesuń produkt" aria-label="Przesuń produkt" ${isArchived ? 'disabled' : ''}>☰</button>`
+      : '';
+
+    actionButtons += `
+      ${dragHandleButton}
+      <button type="button" class="${iconBtn}" ${isArchived ? 'disabled' : `onclick='openEditItemModal(event, ${item.id}, ${JSON.stringify(String(item.name || ''))}, ${quantity})'`}>✏️</button>
+      <button type="button" class="${iconBtn}" ${isArchived ? 'disabled' : `onclick="deleteItem(${item.id})"`}>🗑️</button>`;
+  }
+
+  if (item.not_purchased) {
+    actionButtons += `
+      <button type="button" class="${wideBtn}" ${isArchived ? 'disabled' : `onclick="unmarkNotPurchased(${item.id})"`}>Przywróć</button>`;
+  } else if (!isShare || canShowShareActions || isOwner) {
+    actionButtons += `
+      <button type="button" class="${iconBtn}" ${canMarkNotPurchased ? `onclick="markNotPurchasedModal(event, ${item.id})"` : 'disabled'}>⚠️</button>`;
+  }
+
+  if (temporaryShareUndo) {
+    actionButtons += `
+      <button type="button" class="${iconBtn} shopping-action-btn--countdown" disabled data-countdown-for="${item.id}">${countdownSeconds}s</button>
+      <button type="button" class="${iconBtn}" ${isArchived ? 'disabled' : `onclick='openEditItemModal(event, ${item.id}, ${nameForEdit}, ${quantity})'`}>✏️</button>
+      <button type="button" class="${iconBtn}" ${isArchived ? 'disabled' : `onclick="deleteItem(${item.id})"`}>🗑️</button>`;
+  } else if (canShowShareActions || (!isShare && isOwner)) {
+    actionButtons += `
+      <button type="button" class="${iconBtn}" ${isArchived ? 'disabled' : `onclick="openNoteModal(event, ${item.id})"`}>📝</button>`;
+  }
+
+  li.innerHTML = `
+    <div class="shopping-item-main">
+      ${checkboxHtml}
+      <div class="shopping-item-content">
+        <div class="shopping-item-head">
+          <div class="shopping-item-text">
+            <span id="name-${item.id}" class="shopping-item-name text-white">${safeName}</span>
+            ${quantityBadge}
+            ${infoHtml}
+          </div>
+          <div class="list-item-actions shopping-item-actions" role="group">
+            ${actionButtons}
+          </div>
+        </div>
+      </div>
+    </div>`;
+
+  return li;
+}
+
+function updateListSmoothly(newItems) {
+  const itemsContainer = document.getElementById('items');
+  const existingItemsMap = new Map();
+
+  Array.from(itemsContainer.querySelectorAll('li')).forEach(li => {
+    const id = parseInt(li.id.replace('item-', ''), 10);
+    existingItemsMap.set(id, li);
+  });
+
+  const fragment = document.createDocumentFragment();
+
+  newItems.forEach(item => {
+    const li = renderItem(item);
+    fragment.appendChild(li);
+  });
+
+  itemsContainer.innerHTML = '';
+  itemsContainer.appendChild(fragment);
+
+  updateProgressBar();
+  toggleEmptyPlaceholder();
+  applyHidePurchased();
+}
+
+document.addEventListener("DOMContentLoaded", function () {
+  const toggle = document.getElementById('hidePurchasedToggle');
+  if (!toggle) return;
+
+  const savedState = localStorage.getItem('hidePurchasedToggle');
+  toggle.checked = savedState === 'true';
+  applyHidePurchased(true);
+  toggle.addEventListener('change', function () {
+    localStorage.setItem('hidePurchasedToggle', toggle.checked ? 'true' : 'false');
+    applyHidePurchased();
+  });
+});

shopping_app/static/js/lists_access.js

@@ -0,0 +1,22 @@
+(function () {
+const $=(s,r=document)=>r.querySelector(s); const $$=(s,r=document)=>Array.from(r.querySelectorAll(s));
+const filterInput=$('#listFilter'),filterCount=$('#filterCount'),selectAll=$('#selectAll'),bulkTokens=$('#bulkTokens'),bulkInput=$('#bulkUsersInput'),bulkBtn=$('#bulkAddBtn');
+const unique=arr=>Array.from(new Set(arr));
+const parseUserText=txt=>unique((txt||'').split(/[\s,;]+/g).map(s=>s.trim().replace(/^@/,'').toLowerCase()).filter(Boolean));
+const selectedListIds=()=>$$('.row-check:checked').map(ch=>ch.dataset.listId);
+const visibleRows=()=>$$('#listsTable tbody tr').filter(r=>r.style.display!=='none');
+function applyFilter(){const q=(filterInput?.value||'').trim().toLowerCase();let shown=0;$$('#listsTable tbody tr').forEach(tr=>{const hay=`${tr.dataset.id||''} ${tr.dataset.title||''} ${tr.dataset.owner||''}`;const ok=!q||hay.includes(q);tr.style.display=ok?'':'none';if(ok) shown++;});if(filterCount) filterCount.textContent=shown?`Widoczne: ${shown}`:'Brak wyników';}
+filterInput?.addEventListener('input',applyFilter);applyFilter();
+selectAll?.addEventListener('change',()=>{visibleRows().forEach(tr=>{const cb=tr.querySelector('.row-check'); if(cb) cb.checked=selectAll.checked;});});
+$$('.copy-share').forEach(btn=>btn.addEventListener('click',async()=>{const url=btn.dataset.url;try{await navigator.clipboard.writeText(url);}catch{const ta=Object.assign(document.createElement('textarea'),{value:url});document.body.appendChild(ta);ta.select();document.execCommand('copy');ta.remove();}showToast('Skopiowano link udostępnienia','success');}));
+function addGlobalToken(username){if(!username) return;const exists=$(`.user-token[data-user="${username}"]`,bulkTokens);if(exists) return;const token=document.createElement('span');token.className='badge rounded-pill text-bg-secondary user-token';token.dataset.user=username;token.innerHTML=`@${username} <button type="button" class="btn btn-sm btn-link p-0 ms-1 text-white">✕</button>`;token.querySelector('button').addEventListener('click',()=>token.remove());bulkTokens.appendChild(token);}
+bulkInput?.addEventListener('keydown',e=>{if(e.key==='Enter'){e.preventDefault();parseUserText(bulkInput.value).forEach(addGlobalToken);bulkInput.value='';}});
+bulkInput?.addEventListener('change',()=>{parseUserText(bulkInput.value).forEach(addGlobalToken);bulkInput.value='';});
+let hintCtrl=null;
+function renderBulkHints(users){const dl=$('#userHints'); if(!dl) return; dl.innerHTML=(users||[]).slice(0,20).map(u=>`<option value="${u}"></option>`).join('');}
+async function fetchBulkHints(q=''){const normalized=String(q||'').trim().replace(/^@/,'');try{hintCtrl?.abort();hintCtrl=new AbortController();const res=await fetch(`/admin/user-suggestions?q=${encodeURIComponent(normalized)}`,{credentials:'same-origin',signal:hintCtrl.signal});if(!res.ok) return renderBulkHints([]);const data=await res.json().catch(()=>({users:[]}));renderBulkHints(data.users||[]);}catch(e){renderBulkHints([]);}}
+bulkInput?.addEventListener('focus',()=>fetchBulkHints(bulkInput.value));
+bulkInput?.addEventListener('input',()=>fetchBulkHints(bulkInput.value));
+async function bulkGrant(){const lists=selectedListIds(), users=$$('.user-token',bulkTokens).map(t=>t.dataset.user);if(!lists.length) return showToast('Zaznacz przynajmniej jedną listę','warning');if(!users.length) return showToast('Dodaj przynajmniej jednego użytkownika','warning');bulkBtn.disabled=true;bulkBtn.textContent='Pracuję…';const url=location.pathname+location.search;let ok=0,fail=0;for(const lid of lists){for(const u of users){const form=new FormData();form.set('action','grant');form.set('target_list_id',lid);form.set('grant_username',u);try{const res=await fetch(url,{method:'POST',body:form,credentials:'same-origin',headers:{'Accept':'application/json','X-Requested-With':'fetch'}});if(res.ok) ok++; else fail++;}catch{fail++;}}}bulkBtn.disabled=false;bulkBtn.textContent='➕ Nadaj dostęp';showToast(`Gotowe. Sukcesy: ${ok}${fail?`, błędy: ${fail}`:''}`,fail?'danger':'success');if(ok) location.reload();}
+bulkBtn?.addEventListener('click',bulkGrant);
+})();

shopping_app/static/js/live.js

@@ -13,7 +13,7 @@ function toggleEmptyPlaceholder() {
     const li = document.createElement('li');
     li.id = 'empty-placeholder';
     li.className = 'list-group-item bg-dark text-secondary text-center w-100';
-    li.textContent = 'Brak produktów w tej liście.';
+    li.textContent = 'Brak produktów w tej liście.';
     list.appendChild(li);
   } else if (hasRealItems && placeholder) {
     placeholder.remove();
@@ -88,15 +88,15 @@ function setupList(listId, username) {
         }
 
         e.target.disabled = true;
-        li.classList.add('opacity-50');
+        li.classList.add('opacity-50', 'is-pending');
 
-        let existingSpinner = li.querySelector('.spinner-border');
+        let existingSpinner = li.querySelector('.shopping-item-spinner');
         if (!existingSpinner) {
           const spinner = document.createElement('span');
-          spinner.className = 'spinner-border spinner-border-sm ms-2';
+          spinner.className = 'shopping-item-spinner spinner-border spinner-border-sm';
           spinner.setAttribute('role', 'status');
           spinner.setAttribute('aria-hidden', 'true');
-          e.target.parentElement.appendChild(spinner);
+          li.appendChild(spinner);
         }
       }
     }
@@ -139,45 +139,48 @@ function setupList(listId, username) {
       note: ''
     };
 
-    const li = renderItem(item, false, true);  // ← tryb 15s
+    const isOwnFreshShareItem = Boolean(
+      window.IS_SHARE &&
+      data.added_by &&
+      window.CURRENT_LIST_USERNAME &&
+      String(data.added_by) === String(window.CURRENT_LIST_USERNAME)
+    );
+
+    const li = renderItem(
+      item,
+      window.IS_SHARE,
+      isOwnFreshShareItem ? { temporaryShareUndo: true, countdownSeconds: 15 } : false
+    );
+
     document.getElementById('items').appendChild(li);
     toggleEmptyPlaceholder();
     updateProgressBar();
 
-    if (window.IS_SHARE) {
-      const countdownId = `countdown-${data.id}`;
-      const countdownBtn = document.createElement('button');
-      countdownBtn.type = 'button';
-      countdownBtn.className = 'btn btn-outline-warning';
-      countdownBtn.id = countdownId;
-      countdownBtn.disabled = true;
-      countdownBtn.textContent = '15s';
-
-      const btnGroup = li.querySelector('.btn-group');
-      if (btnGroup) {
-        btnGroup.prepend(countdownBtn);
-      }
-
+    if (isOwnFreshShareItem) {
       let seconds = 15;
       const intervalId = setInterval(() => {
-        const el = document.getElementById(countdownId);
-        if (el) {
-          seconds--;
-          el.textContent = `${seconds}s`;
-          if (seconds <= 0) {
-            el.remove();
-            clearInterval(intervalId);
-          }
-        } else {
+        const currentItem = document.getElementById(`item-${data.id}`);
+        const countdownEl = currentItem?.querySelector(`[data-countdown-for="${data.id}"]`);
+
+        if (!currentItem || !countdownEl) {
           clearInterval(intervalId);
+          return;
         }
+
+        seconds -= 1;
+        if (seconds <= 0) {
+          clearInterval(intervalId);
+          return;
+        }
+
+        countdownEl.textContent = `${seconds}s`;
       }, 1000);
 
       setTimeout(() => {
+        clearInterval(intervalId);
         const existing = document.getElementById(`item-${data.id}`);
         if (existing) {
-          const updated = renderItem(item, true);
-          existing.replaceWith(updated);
+          existing.replaceWith(renderItem(item, window.IS_SHARE));
         }
       }, 15000);
     }
@@ -203,7 +206,7 @@ function setupList(listId, username) {
 
     const progressTitle = document.getElementById('progress-title');
     if (progressTitle) {
-      progressTitle.textContent = `📊 Postęp listy — ${data.purchased_count}/${data.total_count} kupionych (${Math.round(data.percent)}%)`;
+      progressTitle.textContent = `Postęp listy — ${data.purchased_count}/${data.total_count} kupionych (${Math.round(data.percent)}%)`;
     }
   });
 
@@ -218,7 +221,7 @@ function setupList(listId, username) {
       window.currentItems[idx].name = data.new_name;
       window.currentItems[idx].quantity = data.new_quantity;
 
-      const newItem = renderItem(window.currentItems[idx], true);
+      const newItem = renderItem(window.currentItems[idx], window.IS_SHARE);
       const oldItem = document.getElementById(`item-${data.item_id}`);
       if (oldItem && newItem) {
         oldItem.replaceWith(newItem);
@@ -234,6 +237,7 @@ function setupList(listId, username) {
   // --- WAŻNE: zapisz dane do reconnect ---
   window.LIST_ID = listId;
   window.usernameForReconnect = username;
+  window.CURRENT_LIST_USERNAME = username;
 
 }
 

shopping_app/static/js/notes.js

@@ -3,9 +3,9 @@ window.currentItemId = window.currentItemId ?? null;
 window.openNoteModal = function (event, itemId) {
   event.stopPropagation();
   window.currentItemId = itemId;
-  const noteEl = document.querySelector(`#item-${itemId} small.text-danger`);
+  const noteEl = document.querySelector(`#info-${itemId} .text-danger b`);
   document.getElementById('noteText').value = noteEl
-    ? noteEl.innerText.replace(/\[|\]|Powód:/g, "").trim()
+    ? noteEl.innerText.trim()
     : "";
   const modal = new bootstrap.Modal(document.getElementById('noteModal'));
   modal.show();

shopping_app/static/js/preview_list_modal.js

@@ -0,0 +1,140 @@
+document.addEventListener("DOMContentLoaded", function () {
+    const modalElement = document.getElementById("productPreviewModal");
+    if (!modalElement || typeof bootstrap === "undefined") return;
+
+    const modal = new bootstrap.Modal(modalElement);
+    const modalTitle = document.getElementById("previewModalLabel");
+    const productList = document.getElementById("product-list");
+
+    if (!modalTitle || !productList) return;
+
+    const renderState = (message, extraClass = "text-white") => {
+        productList.innerHTML = "";
+
+        const wrapper = document.createElement("div");
+        wrapper.className = "preview-modal-items";
+
+        const item = document.createElement("div");
+        item.className = `preview-modal-list-item ${extraClass}`.trim();
+        item.textContent = message;
+
+        wrapper.appendChild(item);
+        productList.appendChild(wrapper);
+    };
+
+    const createSection = (titleText) => {
+        const section = document.createElement("section");
+        section.className = "preview-product-section";
+
+        const title = document.createElement("h6");
+        title.className = "preview-product-section-title";
+        title.textContent = titleText;
+
+        const items = document.createElement("div");
+        items.className = "preview-modal-items";
+
+        section.appendChild(title);
+        section.appendChild(items);
+
+        return { section, items };
+    };
+
+    const createItem = (itemData) => {
+        const row = document.createElement("div");
+        row.className = "preview-modal-list-item";
+
+        const name = document.createElement("span");
+        name.className = "preview-modal-list-item__name";
+        name.textContent = itemData.name;
+
+        const badge = document.createElement("span");
+        badge.className = "badge";
+
+        if (itemData.purchased) {
+            badge.classList.add("bg-success");
+        } else if (itemData.not_purchased) {
+            badge.classList.add("bg-warning", "text-dark");
+        } else {
+            badge.classList.add("bg-secondary");
+        }
+
+        badge.textContent = `x${itemData.quantity}`;
+
+        row.appendChild(name);
+        row.appendChild(badge);
+        return row;
+    };
+
+    modalElement.addEventListener("hidden.bs.modal", function () {
+        document.querySelectorAll(".modal-backdrop").forEach((el) => el.remove());
+        document.body.classList.remove("modal-open");
+        document.body.style.overflow = "";
+    });
+
+    document.querySelectorAll(".preview-btn").forEach((btn) => {
+        btn.addEventListener("click", async () => {
+            const listId = btn.dataset.listId;
+
+            modalTitle.textContent = "Ładowanie...";
+            renderState("⏳ Ładowanie produktów...");
+            modal.show();
+
+            try {
+                const res = await fetch(`/admin/list_items/${listId}`);
+                if (!res.ok) {
+                    throw new Error(`HTTP ${res.status}`);
+                }
+
+                const data = await res.json();
+                const totalCount = Number(data.total_count || 0);
+                const purchasedCount = Number(data.purchased_count || 0);
+                const totalExpense = Number(data.total_expense || 0);
+                const percent = totalCount > 0 ? Math.round((purchasedCount / totalCount) * 100) : 0;
+
+                modalTitle.textContent = `🛒 ${data.title}`;
+                productList.innerHTML = "";
+
+                const summary = document.createElement("div");
+                summary.className = "preview-product-summary";
+                summary.innerHTML = `
+                    <p class="mb-1">📦 <strong>${totalCount}</strong> produktów</p>
+                    <p class="mb-1">✅ Kupione: <strong>${purchasedCount}</strong> (${percent}%)</p>
+                    <p class="mb-0">💸 Wydatek: <strong>${totalExpense.toFixed(2)} zł</strong></p>`;
+                productList.appendChild(summary);
+
+                const purchased = createSection("✔️ Kupione");
+                const pending = createSection("🚫 Niekupione / Nieoznaczone");
+
+                let hasPurchased = false;
+                let hasPending = false;
+
+                (data.items || []).forEach((item) => {
+                    const row = createItem(item);
+
+                    if (item.purchased) {
+                        purchased.items.appendChild(row);
+                        hasPurchased = true;
+                    } else {
+                        pending.items.appendChild(row);
+                        hasPending = true;
+                    }
+                });
+
+                if (hasPurchased) {
+                    productList.appendChild(purchased.section);
+                }
+
+                if (hasPending) {
+                    productList.appendChild(pending.section);
+                }
+
+                if (!hasPurchased && !hasPending) {
+                    renderState("Brak produktów", "text-muted fst-italic");
+                }
+            } catch (error) {
+                modalTitle.textContent = "Błąd";
+                renderState("❌ Błąd podczas ładowania", "text-danger");
+            }
+        });
+    });
+});

shopping_app/static/js/receipt_crop.js

@@ -1,27 +1,45 @@
 (function () {
+    const configs = (window.CROP_CONFIGS && Array.isArray(window.CROP_CONFIGS))
+        ? window.CROP_CONFIGS
+        : (window.CROP_CONFIG ? [window.CROP_CONFIG] : []);
+
+    if (!configs.length) return;
+
     document.addEventListener("DOMContentLoaded", function () {
-        const cropModal = document.getElementById("adminCropModal");
-        const cropImage = document.getElementById("adminCropImage");
-        const spinner = document.getElementById("adminCropLoading");
-        const saveButton = document.getElementById("adminSaveCrop");
+        configs.forEach((cfg) => initCropperSet(cfg));
+    });
+
+    function initCropperSet(cfg) {
+        const {
+            modalId,
+            imageId,
+            spinnerId,
+            saveBtnId,
+            endpoint
+        } = cfg || {};
+
+        const cropModal = document.getElementById(modalId);
+        const cropImage = document.getElementById(imageId);
+        const spinner = document.getElementById(spinnerId);
+        const saveButton = document.getElementById(saveBtnId);
 
         if (!cropModal || !cropImage || !spinner || !saveButton) return;
 
         let cropper;
         let currentReceiptId;
-        const currentEndpoint = "/admin/crop_receipt";
+        const currentEndpoint = endpoint;
 
         cropModal.addEventListener("shown.bs.modal", function (event) {
             const button = event.relatedTarget;
-            const baseSrc = button.getAttribute("data-img-src") || "";
-            const ver = button.getAttribute("data-version") || Date.now();
+            const baseSrc = button?.getAttribute("data-img-src") || "";
+            const ver = button?.getAttribute("data-version") || Date.now();
             const sep = baseSrc.includes("?") ? "&" : "?";
             cropImage.src = baseSrc + sep + "cb=" + ver;
 
-            currentReceiptId = button.getAttribute("data-receipt-id");
+            currentReceiptId = button?.getAttribute("data-receipt-id");
 
             document.querySelectorAll('.cropper-container').forEach(e => e.remove());
-            if (cropper) cropper.destroy();
+            if (cropper && cropper.destroy) cropper.destroy();
             cropImage.onload = () => { cropper = cropUtils.initCropper(cropImage); };
         });
 
@@ -35,5 +53,5 @@
             spinner.classList.remove("d-none");
             cropUtils.handleCrop(currentEndpoint, currentReceiptId, cropper, spinner);
         });
-    });
+    }
 })();

shopping_app/static/js/receipt_section.js

@@ -0,0 +1,54 @@
+document.addEventListener("DOMContentLoaded", function () {
+  const receiptSection = document.getElementById("receiptSection");
+  const toggleEl = document.getElementById("toggleReceiptBtn");
+
+  if (!receiptSection || !toggleEl || typeof bootstrap === "undefined") return;
+  if (receiptSection.dataset.receiptInit === "1") return;
+  receiptSection.dataset.receiptInit = "1";
+
+  const storageKey = receiptSection.dataset.receiptStorageKey || "receiptSectionOpen";
+  const collapse = bootstrap.Collapse.getOrCreateInstance(receiptSection, { toggle: false });
+  const titleEl = toggleEl.querySelector(".receipt-disclosure__title");
+
+  function isShown() {
+    return receiptSection.classList.contains("show");
+  }
+
+  function persist(state) {
+    localStorage.setItem(storageKey, state ? "true" : "false");
+  }
+
+  function updateUI() {
+    const shown = isShown();
+    toggleEl.classList.toggle("is-open", shown);
+    toggleEl.setAttribute("aria-expanded", shown ? "true" : "false");
+
+    if (titleEl) {
+      titleEl.textContent = shown ? "Ukryj sekcję paragonów" : "Pokaż sekcję paragonów";
+    }
+  }
+
+  toggleEl.addEventListener("click", function () {
+    collapse.toggle();
+  });
+
+  receiptSection.addEventListener("shown.bs.collapse", function () {
+    persist(true);
+    updateUI();
+  });
+
+  receiptSection.addEventListener("hidden.bs.collapse", function () {
+    persist(false);
+    updateUI();
+  });
+
+  if (localStorage.getItem(storageKey) === "true") {
+    receiptSection.classList.add("receipt-section--restoring");
+    collapse.show();
+    requestAnimationFrame(function () {
+      receiptSection.classList.remove("receipt-section--restoring");
+    });
+  }
+
+  updateUI();
+});

shopping_app/static/js/sockets.js

@@ -126,6 +126,9 @@ socket.on('full_list', function (data) {
 
   window.currentItems = data.items;
   updateListSmoothly(data.items);
+  if (typeof window.syncSortModeUI === 'function') {
+    window.syncSortModeUI();
+  }
   toggleEmptyPlaceholder();
 
   if (didReceiveFirstFullList && isDifferent) {

shopping_app/static/js/sort_mode.js

@@ -1,32 +1,62 @@
 let sortable = null;
-let isSorting = false;
+window.isSorting = false;
+
+function syncSortModeUI() {
+    const active = !!window.isSorting;
+    const btn = document.getElementById('sort-toggle-btn');
+    const itemsContainer = document.getElementById('items');
+
+    document.body.classList.toggle('sorting-active', active);
+
+    if (btn) {
+        if (active) {
+            btn.textContent = '✔️ Zakończ sortowanie';
+            btn.classList.remove('btn-outline-warning');
+            btn.classList.add('btn-outline-success');
+        } else {
+            btn.textContent = '✳️ Zmień kolejność';
+            btn.classList.remove('btn-outline-success');
+            btn.classList.add('btn-outline-warning');
+        }
+    }
+
+    if (itemsContainer && window.currentItems) {
+        updateListSmoothly(window.currentItems);
+    }
+
+    document.querySelectorAll('.drag-handle').forEach(handle => {
+        handle.hidden = !active;
+        handle.setAttribute('aria-hidden', active ? 'false' : 'true');
+    });
+}
 
 function enableSortMode() {
-    if (isSorting) return;
-    isSorting = true;
-    window.isSorting = true;
-    localStorage.setItem('sortModeEnabled', 'true');
+    if (window.isSorting) return;
 
     const itemsContainer = document.getElementById('items');
     const listId = window.LIST_ID;
     if (!itemsContainer || !listId) return;
 
-    if (window.currentItems) {
-        updateListSmoothly(window.currentItems);
-    }
+    window.isSorting = true;
+    syncSortModeUI();
 
     setTimeout(() => {
-        if (sortable) sortable.destroy();
+        if (!window.isSorting) return;
+
+        if (sortable) {
+            sortable.destroy();
+            sortable = null;
+        }
 
         sortable = Sortable.create(itemsContainer, {
             animation: 150,
             handle: '.drag-handle',
             ghostClass: 'drag-ghost',
-            filter: 'input, button',
+            filter: 'input, button:not(.drag-handle)',
             preventOnFilter: false,
             onEnd: () => {
                 const order = Array.from(itemsContainer.children)
-                    .map(li => parseInt(li.id.replace('item-', '')))
+                    .map(li => parseInt(li.id.replace('item-', ''), 10))
                     .filter(id => !isNaN(id));
 
                 fetch('/reorder_items', {
@@ -37,16 +67,14 @@ function enableSortMode() {
                     showToast('Zapisano nową kolejność', 'success');
 
                     if (window.currentItems) {
-                        window.currentItems = order.map(id =>
-                            window.currentItems.find(item => item.id === id)
-                        );
+                        window.currentItems = order
+                            .map(id => window.currentItems.find(item => item.id === id))
+                            .filter(Boolean);
                         updateListSmoothly(window.currentItems);
                     }
                 });
             }
         });
-
-        updateSortButtonUI(true);
     }, 50);
 }
 
@@ -56,39 +84,22 @@ function disableSortMode() {
         sortable = null;
     }
 
-    isSorting = false;
-    localStorage.removeItem('sortModeEnabled');
     window.isSorting = false;
-    if (window.currentItems) {
-        updateListSmoothly(window.currentItems);
-    }
-
-    updateSortButtonUI(false);
-
+    syncSortModeUI();
 }
 
 function toggleSortMode() {
-    isSorting ? disableSortMode() : enableSortMode();
-}
-
-function updateSortButtonUI(active) {
-    const btn = document.getElementById('sort-toggle-btn');
-    if (!btn) return;
-
-    if (active) {
-        btn.textContent = '✔️ Zakończ sortowanie';
-        btn.classList.remove('btn-outline-warning');
-        btn.classList.add('btn-outline-success');
+    if (window.isSorting) {
+        disableSortMode();
     } else {
-        btn.textContent = '✳️ Zmień kolejność';
-        btn.classList.remove('btn-outline-success');
-        btn.classList.add('btn-outline-warning');
-    }
-}
-
-document.addEventListener('DOMContentLoaded', () => {
-    const wasSorting = localStorage.getItem('sortModeEnabled') === 'true';
-    if (wasSorting) {
         enableSortMode();
     }
+}
+
+window.toggleSortMode = toggleSortMode;
+window.syncSortModeUI = syncSortModeUI;
+
+document.addEventListener('DOMContentLoaded', () => {
+    window.isSorting = false;
+    syncSortModeUI();
 });

shopping_app/static/js/toggle_button.js

@@ -0,0 +1,30 @@
+document.addEventListener("DOMContentLoaded", function () {
+    const toggleBtn = document.getElementById("tempToggle");
+    const hiddenInput = document.getElementById("temporaryHidden");
+    if (!toggleBtn || !hiddenInput) return;
+
+    if (typeof bootstrap !== "undefined") {
+        new bootstrap.Tooltip(toggleBtn);
+    }
+
+    function updateToggle(isActive) {
+        toggleBtn.classList.toggle("is-active", isActive);
+        toggleBtn.textContent = isActive ? "Tymczasowa ✔" : "Tymczasowa";
+        toggleBtn.setAttribute("aria-pressed", isActive ? "true" : "false");
+        toggleBtn.setAttribute("title", isActive
+            ? "Lista tymczasowa będzie ważna przez 7 dni"
+            : "Po zaznaczeniu lista będzie ważna tylko 7 dni");
+    }
+
+    let active = toggleBtn.getAttribute("data-active") === "1";
+    hiddenInput.value = active ? "1" : "0";
+    updateToggle(active);
+
+    toggleBtn.addEventListener("click", function (event) {
+        event.preventDefault();
+        active = !active;
+        toggleBtn.setAttribute("data-active", active ? "1" : "0");
+        hiddenInput.value = active ? "1" : "0";
+        updateToggle(active);
+    });
+});

shopping_app/templates/_list_progress.html

@@ -0,0 +1,33 @@
+{% set total_count = total_count or 0 %}
+{% set purchased_count = purchased_count or 0 %}
+{% set not_purchased_count = not_purchased_count or 0 %}
+{% set accounted_count = purchased_count + not_purchased_count %}
+{% set remaining_count = (total_count - accounted_count) if total_count > accounted_count else 0 %}
+
+{% set percent = ((purchased_count / total_count) * 100) if total_count > 0 else 0 %}
+{% set purchased_percent = ((purchased_count / total_count) * 100) if total_count > 0 else 0 %}
+{% set not_purchased_percent = ((not_purchased_count / total_count) * 100) if total_count > 0 else 0 %}
+{% set remaining_percent = ((remaining_count / total_count) * 100) if total_count > 0 else 0 %}
+
+<div class="main-list-progress-wrap mt-2">
+  <div class="main-list-progress progress progress-dark progress-thin position-relative"
+       aria-label="Postęp listy {{ purchased_count }} z {{ total_count }} kupionych">
+    <div class="progress-bar bg-success" role="progressbar"
+         style="width: {{ '%.6f'|format(purchased_percent) }}%"
+         aria-valuemin="0" aria-valuemax="100"
+         aria-valuenow="{{ percent|round(0)|int }}"></div>
+
+    <div class="progress-bar bg-warning" role="progressbar"
+         style="width: {{ '%.6f'|format(not_purchased_percent) }}%"
+         aria-valuemin="0" aria-valuemax="100"></div>
+
+    <div class="progress-bar bg-transparent" role="progressbar"
+         style="width: {{ '%.6f'|format(remaining_percent) }}%"
+         aria-valuemin="0" aria-valuemax="100"></div>
+
+    <span class="progress-label main-list-progress__label small fw-bold {% if percent < 51 %}text-white{% else %}text-dark{% endif %}">
+      Produkty: {{ purchased_count }}/{{ total_count }} ({{ percent|round(0)|int }}%)
+      {% if total_expense > 0 %} — 💸 {{ '%.2f'|format(total_expense) }} PLN{% endif %}
+    </span>
+  </div>
+</div>

shopping_app/templates/admin/_nav.html

@@ -0,0 +1,18 @@
+<div class="card bg-secondary bg-opacity-10 text-white mb-4 admin-shortcuts">
+  <div class="card-body p-2">
+    <div class="d-md-none mb-2">
+      <button type="button" class="btn btn-outline-light w-100" data-admin-nav-toggle aria-expanded="false">☰ Menu admina</button>
+    </div>
+    <div class="d-flex flex-wrap gap-2" data-admin-nav-body>
+      <a href="{{ url_for('admin_panel') }}" class="btn btn-sm {% if request.endpoint == 'admin_panel' %}btn-success{% else %}btn-outline-light{% endif %}">📊 Dashboard</a>
+      <a href="{{ url_for('list_users') }}" class="btn btn-sm {% if request.endpoint == 'list_users' %}btn-success{% else %}btn-outline-light{% endif %}">👥 Użytkownicy</a>
+      <a href="{{ url_for('admin_receipts') }}" class="btn btn-sm {% if request.endpoint == 'admin_receipts' %}btn-success{% else %}btn-outline-light{% endif %}">📸 Paragony</a>
+      <a href="{{ url_for('list_products') }}" class="btn btn-sm {% if request.endpoint == 'list_products' %}btn-success{% else %}btn-outline-light{% endif %}">🛍️ Produkty</a>
+      <a href="{{ url_for('admin_edit_categories') }}" class="btn btn-sm {% if request.endpoint == 'admin_edit_categories' %}btn-success{% else %}btn-outline-light{% endif %}">🗂 Kategorie</a>
+      <a href="{{ url_for('admin_lists_access') }}" class="btn btn-sm {% if request.endpoint == 'admin_lists_access' %}btn-success{% else %}btn-outline-light{% endif %}">🔐 Uprawnienia</a>
+      <a href="{{ url_for('admin_api_tokens') }}" class="btn btn-sm {% if request.endpoint in ['admin_api_tokens', 'admin_api_docs'] %}btn-success{% else %}btn-outline-light{% endif %}">🔑 Tokeny API</a>
+      <a href="{{ url_for('admin_templates') }}" class="btn btn-sm {% if request.endpoint == 'admin_templates' %}btn-success{% else %}btn-outline-light{% endif %}">🧩 Szablony</a>
+      <a href="{{ url_for('admin_settings') }}" class="btn btn-sm {% if request.endpoint == 'admin_settings' %}btn-success{% else %}btn-outline-light{% endif %}">⚙️ Ustawienia</a>
+    </div>
+  </div>
+</div>

shopping_app/templates/admin/admin_panel.html

@@ -2,22 +2,16 @@
 {% block title %}Panel administratora{% endblock %}
 {% block content %}
 
-<div class="d-flex justify-content-between align-items-center flex-wrap mb-4">
-  <h2 class="mb-2">⚙️ Panel administratora</h2>
+<div class="admin-page-head mb-4">
+  <div>
+    <h2 class="mb-2">⚙️ Panel administratora</h2>
+    <p class="text-secondary mb-0">Wgląd w użytkowników, listy, paragony, wydatki i ustawienia aplikacji.</p>
+  </div>
   <a href="{{ url_for('main_page') }}" class="btn btn-outline-secondary">← Powrót do strony głównej</a>
 </div>
 
-<div class="card bg-secondary bg-opacity-10 text-white mb-4">
-  <div class="card-body p-2">
-    <div class="d-flex flex-wrap gap-2">
-      <a href="{{ url_for('list_users') }}" class="btn btn-outline-light btn-sm">👥 Użytkownicy</a>
-      <a href="{{ url_for('admin_receipts') }}" class="btn btn-outline-light btn-sm">📸 Paragony</a>
-      <a href="{{ url_for('list_products') }}" class="btn btn-outline-light btn-sm">🛍️ Produkty</a>
-      <a href="{{ url_for('admin_mass_edit_categories') }}" class="btn btn-outline-light btn-sm">🗂 Kategorie</a>
-      <a href="{{ url_for('admin_lists_access') }}" class="btn btn-outline-light btn-sm">🔐 Uprawnienia</a>
-    </div>
-  </div>
-</div>
+{% include 'admin/_nav.html' %}
+
 
 <div class="row g-3 mb-4">
   <!-- Statystyki liczbowe -->
@@ -157,7 +151,7 @@
     </div>
   </div>
 
-  <div class="card bg-dark text-white mb-5">
+  {% if expiring_lists %}<div class="alert alert-warning mb-4"><div class="fw-semibold mb-2">⏰ Listy tymczasowe wygasające w ciągu 24h</div><ul class="mb-0 ps-3">{% for l in expiring_lists %}<li>#{{ l.id }} {{ l.title }} — {{ l.owner.username if l.owner else '—' }} — {{ l.expires_at.strftime('%Y-%m-%d %H:%M') }}</li>{% endfor %}</ul></div>{% endif %}<div class="card bg-dark text-white mb-5">
     <div class="card-body">
 
       {# panel wyboru miesiąca zawsze widoczny #}
@@ -242,10 +236,10 @@
               {% for e in enriched_lists %}
               {% set l = e.list %}
               <tr>
-                <td><input type="checkbox" name="list_ids" value="{{ l.id }}"></td>
+                <td><input type="checkbox" name="list_ids" value="{{ l.id }}" class="table-select-checkbox"></td>
                 <td>{{ l.id }}</td>
                 <td class="fw-bold align-middle">
-                  <a href="{{ url_for('view_list', list_id=l.id) }}" class="text-white">{{ l.title }}</a>
+                  <a href="{{ url_for('view_list', list_id=l.id) }}" class="text-white">{{ l.title }}</a>{% if l.is_temporary and l.expires_at %}<div class="small text-warning mt-1">wygasa: {{ l.expires_at.strftime('%Y-%m-%d %H:%M') }}</div>{% endif %}
                   {% if l.categories %}
                   <span class="ms-1 text-info" data-bs-toggle="tooltip"
                     title="{{ l.categories | map(attribute='name') | join(', ') }}">
@@ -294,13 +288,9 @@
                   {% endif %}
                 </td>
                 <td>
-                  <div class="btn-group btn-group-sm" role="group">
-                    <a href="{{ url_for('edit_list', list_id=l.id) }}" class="btn btn-sm btn-outline-light"
-                      title="Edytuj">✏️</a>
-                    <button type="button" class="btn btn-sm btn-outline-light preview-btn" data-list-id="{{ l.id }}"
-                      title="Podgląd produktów">
-                      👁️
-                    </button>
+                  <div class="d-flex flex-wrap gap-2">
+                    <a href="{{ url_for('edit_list', list_id=l.id) }}" class="btn btn-sm btn-outline-light" title="Edytuj">✏️</a>
+                    <button type="button" class="btn btn-sm btn-outline-light preview-btn" data-list-id="{{ l.id }}" title="Podgląd produktów">👁️</button>
                   </div>
                 </td>
               </tr>
@@ -338,7 +328,7 @@
           <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Zamknij"></button>
         </div>
         <div class="modal-body">
-          <ul id="product-list" class="list-group list-group-flush"></ul>
+          <div id="product-list" class="preview-product-list"></div>
         </div>
       </div>
     </div>
@@ -351,7 +341,7 @@
       checkboxes.forEach(cb => cb.checked = this.checked);
     });
   </script>
-  <script src="{{ url_for('static_bp.serve_js', filename='preview_list_modal.js') }}?v={{ APP_VERSION }}"></script>
+  <script src="{{ static_asset_url('static_bp.serve_js', 'preview_list_modal.js') }}?v=3"></script>
   {% endblock %}
 
   {% endblock %}

shopping_app/templates/admin/api_tokens.html

@@ -0,0 +1,161 @@
+{% extends 'base.html' %}
+{% block title %}Tokeny API{% endblock %}
+
+{% block content %}
+<div class="d-flex justify-content-between align-items-center flex-wrap mb-4 gap-2">
+  <div>
+    <h2 class="mb-2">🔑 Tokeny API</h2>
+    <p class="text-secondary mb-0">Administrator może utworzyć wiele tokenów, ograniczyć ich zakres i endpointy oraz w każdej chwili je wyłączyć albo usunąć.</p>
+  </div>
+  <div class="d-flex gap-2 flex-wrap">
+    <a href="{{ url_for('admin_api_docs') }}" class="btn btn-outline-light" target="_blank">📄 Zobacz opis API</a>
+    <a href="{{ url_for('admin_panel') }}" class="btn btn-outline-secondary">← Powrót do panelu</a>
+  </div>
+</div>
+
+{% include 'admin/_nav.html' %}
+
+{% if latest_plain_token %}
+<div class="alert alert-success border-success mb-4" role="alert">
+  <div class="d-flex flex-column gap-2">
+    <div><strong>Nowy token:</strong> {{ latest_api_token_name or 'API' }}</div>
+    <div class="input-group">
+      <input type="text" id="latestApiToken" class="form-control" readonly value="{{ latest_plain_token }}">
+      <button type="button" class="btn btn-outline-light" data-copy-target="#latestApiToken">📋 Kopiuj</button>
+    </div>
+    <div class="small text-warning">Pełna wartość jest widoczna tylko teraz. Po odświeżeniu zostanie ukryta.</div>
+  </div>
+</div>
+{% endif %}
+
+<div class="card bg-dark text-white">
+  <div class="card-body">
+    <h5 class="mb-3">➕ Utwórz token</h5>
+    <form method="post" data-unsaved-warning="true" class="stack-form">
+      <input type="hidden" name="action" value="create">
+      <div class="row g-4">
+        <div class="col-xl-4">
+          <label for="name" class="form-label">Nazwa tokenu</label>
+          <input type="text" id="name" name="name" class="form-control" placeholder="np. integracja ERP / Power BI" required>
+          <div class="form-text">Nazwij token tak, aby było wiadomo do czego służy.</div>
+        </div>
+        <div class="col-sm-6 col-xl-4">
+          <label class="form-label d-block">Zakresy</label>
+          <div class="form-check form-check-spaced"><input class="form-check-input" type="checkbox" id="scope_expenses_read" name="scope_expenses_read" checked><label class="form-check-label" for="scope_expenses_read">Odczyt wydatków</label></div>
+          <div class="form-check form-check-spaced"><input class="form-check-input" type="checkbox" id="scope_lists_read" name="scope_lists_read" checked><label class="form-check-label" for="scope_lists_read">Odczyt list i wydatków list</label></div>
+          <div class="form-check form-check-spaced"><input class="form-check-input" type="checkbox" id="scope_templates_read" name="scope_templates_read"><label class="form-check-label" for="scope_templates_read">Odczyt szablonów</label></div>
+        </div>
+        <div class="col-sm-6 col-xl-4">
+          <label class="form-label d-block">Dozwolone endpointy</label>
+          <div class="form-check form-check-spaced"><input class="form-check-input" type="checkbox" id="allow_ping" name="allow_ping" checked><label class="form-check-label" for="allow_ping">/api/ping</label></div>
+          <div class="form-check form-check-spaced"><input class="form-check-input" type="checkbox" id="allow_latest_expenses" name="allow_latest_expenses" checked><label class="form-check-label" for="allow_latest_expenses">/api/expenses/latest</label></div>
+          <div class="form-check form-check-spaced"><input class="form-check-input" type="checkbox" id="allow_expenses_summary" name="allow_expenses_summary" checked><label class="form-check-label" for="allow_expenses_summary">/api/expenses/summary</label></div>
+          <div class="form-check form-check-spaced"><input class="form-check-input" type="checkbox" id="allow_lists" name="allow_lists" checked><label class="form-check-label" for="allow_lists">/api/lists oraz /api/lists/&lt;id&gt;/expenses</label></div>
+          <div class="form-check form-check-spaced"><input class="form-check-input" type="checkbox" id="allow_templates" name="allow_templates"><label class="form-check-label" for="allow_templates">/api/templates</label></div>
+        </div>
+        <div class="col-sm-6 col-xl-3">
+          <label for="max_limit" class="form-label">Maksymalny limit rekordów</label>
+          <input type="number" id="max_limit" name="max_limit" min="1" max="500" value="100" class="form-control">
+        </div>
+        <div class="col-sm-6 col-xl-3 d-flex align-items-end">
+          <button type="submit" class="btn btn-success w-100">🔑 Wygeneruj token</button>
+        </div>
+      </div>
+    </form>
+  </div>
+</div>
+
+<div class="card bg-dark text-white mt-4">
+  <div class="card-body">
+    <div class="d-flex justify-content-between align-items-center flex-wrap gap-2 mb-3">
+      <h5 class="mb-0">📘 Dokumentacja API</h5>
+      <a href="{{ url_for('admin_api_docs') }}" class="btn btn-sm btn-outline-light" target="_blank">Otwórz TXT</a>
+    </div>
+    <div class="small text-secondary mb-3">Autoryzacja: <code>Authorization: Bearer TWOJ_TOKEN</code> lub <code>X-API-Token</code>. Endpoint i zakres muszą być jednocześnie dozwolone na tokenie. Parametr <code>limit</code> jest przycinany do wartości ustawionej w tokenie.</div>
+    <div class="table-responsive admin-table-responsive admin-table-responsive--full">
+      <table class="table table-dark align-middle table-sm keep-horizontal">
+        <thead>
+          <tr><th>Metoda</th><th>Endpoint</th><th>Wymagany zakres</th><th>Opis</th></tr>
+        </thead>
+        <tbody>
+          {% for row in api_examples %}
+          <tr>
+            <td><code>{{ row.method }}</code></td>
+            <td><code class="api-chip api-chip--wrap">{{ row.path }}</code></td>
+            <td><code class="api-chip">{{ row.scope }}</code></td>
+            <td>{{ row.description }}</td>
+          </tr>
+          {% endfor %}
+        </tbody>
+      </table>
+    </div>
+  </div>
+</div>
+
+<div class="card bg-dark text-white mt-4">
+  <div class="card-body">
+    <div class="admin-page-head mb-3">
+      <h5 class="mb-0">📋 Aktywne i historyczne tokeny</h5>
+      <span class="badge rounded-pill bg-secondary">{{ api_tokens|length }} szt.</span>
+    </div>
+    <div class="table-responsive admin-table-responsive admin-table-responsive--wide">
+      <table class="table table-dark align-middle sortable keep-horizontal" data-searchable="true">
+        <thead>
+          <tr>
+            <th>Nazwa</th>
+            <th>Prefix</th>
+            <th>Status</th>
+            <th>Zakres</th>
+            <th>Endpointy</th>
+            <th>Max limit</th>
+            <th>Utworzono</th>
+            <th>Ostatnie użycie</th>
+            <th>Akcje</th>
+          </tr>
+        </thead>
+        <tbody>
+          {% for token in api_tokens %}
+          <tr>
+            <td>
+              <div class="fw-semibold text-break">{{ token.name }}</div>
+              <div class="small text-secondary">Autor: {{ token.creator.username if token.creator else '—' }}</div>
+            </td>
+            <td><code class="api-chip">{{ token.token_prefix }}…</code></td>
+            <td>{% if token.is_active %}<span class="badge rounded-pill bg-success">Aktywny</span>{% else %}<span class="badge rounded-pill bg-secondary">Wyłączony</span>{% endif %}</td>
+            <td><code class="api-chip api-chip--wrap">{{ token.scopes or '—' }}</code></td>
+            <td><code class="api-chip api-chip--wrap">{{ token.allowed_endpoints or '—' }}</code></td>
+            <td>{{ token.max_limit or '—' }}</td>
+            <td>{{ token.created_at.strftime('%Y-%m-%d %H:%M') if token.created_at else '—' }}</td>
+            <td>{{ token.last_used_at.strftime('%Y-%m-%d %H:%M') if token.last_used_at else 'Jeszcze nie użyto' }}</td>
+            <td>
+              <div class="d-flex flex-wrap gap-2">
+                {% if token.is_active %}
+                <form method="post" class="d-inline">
+                  <input type="hidden" name="action" value="deactivate">
+                  <input type="hidden" name="token_id" value="{{ token.id }}">
+                  <button type="submit" class="btn btn-sm btn-outline-warning">⏸ Wyłącz</button>
+                </form>
+                {% else %}
+                <form method="post" class="d-inline">
+                  <input type="hidden" name="action" value="activate">
+                  <input type="hidden" name="token_id" value="{{ token.id }}">
+                  <button type="submit" class="btn btn-sm btn-outline-success">▶ Włącz</button>
+                </form>
+                {% endif %}
+                <form method="post" class="d-inline" onsubmit="return confirm('Usunąć ten token API?')">
+                  <input type="hidden" name="action" value="delete">
+                  <input type="hidden" name="token_id" value="{{ token.id }}">
+                  <button type="submit" class="btn btn-sm btn-outline-danger">🗑 Usuń</button>
+                </form>
+              </div>
+            </td>
+          </tr>
+          {% else %}
+          <tr><td colspan="9" class="text-center text-secondary py-4">Brak tokenów API.</td></tr>
+          {% endfor %}
+        </tbody>
+      </table>
+    </div>
+  </div>
+</div>
+{% endblock %}

shopping_app/templates/admin/edit_categories.html

@@ -9,28 +9,29 @@
     </div>
 </div>
 
+{% include 'admin/_nav.html' %}
+
 <div class="card bg-dark text-white mb-5">
     <div class="card-body">
         <div class="alert alert-warning border-warning text-dark" role="alert">
-            ⚠️ <strong>Uwaga!</strong> Przypisanie więcej niż jednej kategorii do listy może zaburzyć
-            poprawne zliczanie wydatków, ponieważ wydatki tej listy będą jednocześnie
-            klasyfikowane do kilku kategorii.
+            ⚠️ <strong>Uwaga!</strong> Przypisanie więcej niż jednej kategorii do listy może zaburzyć poprawne zliczanie
+            wydatków.
         </div>
 
-        <form method="post">
-            <div class="card bg-dark text-white mb-5">
+        <form method="post" id="mass-edit-form" data-unsaved-warning="true">
+            <div class="card bg-dark text-white mb-4">
                 <div class="card-body p-0">
-                    <div class="table-responsive">
-                        <table class="table table-dark align-middle sortable">
-                            <thead>
+                    <div class="table-responsive admin-table-responsive admin-table-responsive--full">
+                        <table class="table table-dark align-middle sortable mb-0">
+                            <thead class="position-sticky top-0 bg-dark">
                                 <tr>
                                     <th scope="col">ID</th>
                                     <th scope="col">Nazwa listy</th>
                                     <th scope="col">Właściciel</th>
-                                    <th scope="col">Data utworzenia</th>
+                                    <th scope="col">Data</th>
                                     <th scope="col">Status</th>
-                                    <th scope="col">Podgląd produktów</th>
-                                    <th scope="col">Kategorie</th>
+                                    <th scope="col">Podgląd</th>
+                                    <th scope="col" style="min-width: 260px;">Kategorie</th>
                                 </tr>
                             </thead>
                             <tbody>
@@ -44,22 +45,17 @@
                                     <td>
                                         {% if l.owner %}
                                         👤 {{ l.owner.username }} ({{ l.owner.id }})
-                                        {% else %}
-                                        -
-                                        {% endif %}
+                                        {% else %}-{% endif %}
                                     </td>
                                     <td>{{ l.created_at.strftime('%Y-%m-%d %H:%M') if l.created_at else '-' }}</td>
                                     <td>
                                         {% if l.is_archived %}<span
-                                            class="badge rounded-pill bg-secondary">Archiwalna</span>{%
-                                        endif %}
+                                            class="badge rounded-pill bg-secondary me-1">Archiwalna</span>{% endif %}
                                         {% if l.is_temporary %}<span
-                                            class="badge rounded-pill bg-warning text-dark">Tymczasowa</span>{%
+                                            class="badge rounded-pill bg-warning text-dark me-1">Tymczasowa</span>{%
                                         endif %}
-                                        {% if l.is_public %}<span
-                                            class="badge rounded-pill bg-success">Publiczna</span>{% else
-                                        %}
-                                        <span class="badge rounded-pill bg-dark">Prywatna</span>{% endif %}
+                                        {% if l.is_public %}<span class="badge rounded-pill bg-success">Publiczna</span>
+                                        {% else %}<span class="badge rounded-pill bg-dark">Prywatna</span>{% endif %}
                                     </td>
                                     <td>
                                         <button type="button" class="btn btn-sm btn-outline-light preview-btn"
@@ -67,24 +63,25 @@
                                             🔍 Zobacz
                                         </button>
                                     </td>
-                                    <td style="min-width: 220px;">
-                                        <select name="categories_{{ l.id }}" multiple
-                                            class="form-select tom-dark bg-dark text-white border-secondary rounded">
-                                            {% for cat in categories %}
-                                            <option value="{{ cat.id }}" {% if cat in l.categories %}selected{% endif
-                                                %}>
-                                                {{ cat.name }}
-                                            </option>
-                                            {% endfor %}
-                                        </select>
+                                    <td>
+                                        <div class="d-flex align-items-center gap-2">
+                                            <select name="categories_{{ l.id }}" multiple
+                                                class="form-select tom-dark bg-dark text-white border-secondary rounded"
+                                                data-list-id="{{ l.id }}"
+                                                aria-label="Wybierz kategorie dla listy {{ l.id }}">
+                                                {% for cat in categories %}
+                                                <option value="{{ cat.id }}" {% if cat in l.categories %}selected{%
+                                                    endif %}>{{ cat.name }}</option>
+                                                {% endfor %}
+                                            </select>
+                                        </div>
                                     </td>
                                 </tr>
                                 {% endfor %}
+
                                 {% if lists|length == 0 %}
                                 <tr>
-                                    <td colspan="12" class="text-center py-4">
-                                        Brak list zakupowych do wyświetlenia
-                                    </td>
+                                    <td colspan="12" class="text-center py-4">Brak list zakupowych do wyświetlenia</td>
                                 </tr>
                                 {% endif %}
                             </tbody>
@@ -92,9 +89,8 @@
                     </div>
                 </div>
             </div>
-            <div>
-                <button type="submit" class="btn btn-sm btn-outline-light">💾 Zapisz zmiany</button>
-            </div>
+
+            <div class="d-flex justify-content-end mt-3"><button type="submit" class="btn btn-sm btn-outline-light">💾 Zapisz wszystkie zmiany</button></div>
         </form>
     </div>
 </div>
@@ -120,8 +116,7 @@
             </li>
             {% for p in range(1, total_pages + 1) %}
             <li class="page-item {% if p == page %}active{% endif %}">
-                <a class="page-link" href="?{{ query_string }}{% if query_string %}&{% endif %}page={{ p }}">{{
-                    p }}</a>
+                <a class="page-link" href="?{{ query_string }}{% if query_string %}&{% endif %}page={{ p }}">{{ p }}</a>
             </li>
             {% endfor %}
             <li class="page-item {% if page >= total_pages %}disabled{% endif %}">
@@ -132,7 +127,6 @@
     </nav>
 </div>
 
-
 <!-- Modal podglądu produktów -->
 <div class="modal fade" id="productPreviewModal" tabindex="-1" aria-labelledby="previewModalLabel" aria-hidden="true">
     <div class="modal-dialog modal-lg modal-dialog-scrollable">
@@ -143,14 +137,15 @@
                     aria-label="Zamknij"></button>
             </div>
             <div class="modal-body">
-                <ul id="product-list" class="list-group list-group-flush"></ul>
+                <div id="product-list" class="preview-product-list"></div>
             </div>
         </div>
     </div>
 </div>
 
 {% endblock %}
+
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js', filename='preview_list_modal.js') }}?v={{ APP_VERSION }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='categories_select_admin.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ static_asset_url('static_bp.serve_js', 'preview_list_modal.js') }}?v=3"></script>
+<script src="{{ static_asset_url('static_bp.serve_js', 'categories_select_admin.js') }}"></script>
 {% endblock %}

shopping_app/templates/admin/edit_list.html

@@ -7,16 +7,18 @@
   <a href="{{ url_for('admin_panel') }}" class="btn btn-outline-secondary">← Powrót do panelu</a>
 </div>
 
+{% include 'admin/_nav.html' %}
+
 <div class="card bg-secondary bg-opacity-10 text-white mb-5">
   <div class="card-body">
     <h4 class="card-title">📄 Podstawowe informacje</h4>
-    <form method="post" class="mt-3">
+    <form method="post" class="mt-3" data-unsaved-warning="true">
       <input type="hidden" name="action" value="save">
 
       <!-- Nazwa listy -->
       <div class="mb-3">
         <label for="title" class="form-label">📝 Nazwa listy</label>
-        <input type="text" class="form-control bg-dark text-white border-secondary rounded" id="title" name="title"
+        <input type="text" class="form-control bg-dark text-white border-secondary ui-consistent-input" id="title" name="title"
           value="{{ list.title }}" required>
       </div>
 
@@ -24,13 +26,13 @@
       <div class="row mb-3">
         <div class="col-md-6">
           <label for="amount" class="form-label">💰 Całkowity wydatek (PLN)</label>
-          <input type="number" step="0.01" min="0" class="form-control bg-dark text-white border-secondary rounded"
+          <input type="number" step="0.01" min="0" class="form-control bg-dark text-white border-secondary ui-consistent-input"
             id="amount" name="amount" value="{{ '%.2f'|format(total_expense) }}">
         </div>
 
         <div class="col-md-6">
           <label for="owner_id" class="form-label">👤 Właściciel</label>
-          <select class="form-select bg-dark text-white border-secondary" id="owner_id" name="owner_id">
+          <select class="form-select bg-dark text-white border-secondary ui-consistent-input" id="owner_id" name="owner_id">
             {% for user in users %}
             <option value="{{ user.id }}" {% if list.owner_id==user.id %}selected{% endif %}>
               {{ user.username }}
@@ -43,20 +45,20 @@
       <!-- Statusy -->
       <div class="mb-4">
         <label class="form-label">⚙️ Statusy listy</label>
-        <div class="d-flex flex-wrap gap-3">
-          <div class="form-check form-switch">
+        <div class="switch-grid">
+          <div class="form-check form-switch app-switch">
             <input class="form-check-input" type="checkbox" id="archived" name="archived" {% if list.is_archived
               %}checked{% endif %}>
             <label class="form-check-label" for="archived">📦 Archiwalna</label>
           </div>
 
-          <div class="form-check form-switch">
+          <div class="form-check form-switch app-switch">
             <input class="form-check-input" type="checkbox" id="public" name="public" {% if list.is_public %}checked{%
               endif %}>
             <label class="form-check-label" for="public">🌐 Publiczna</label>
           </div>
 
-          <div class="form-check form-switch">
+          <div class="form-check form-switch app-switch">
             <input class="form-check-input" type="checkbox" id="temporary" name="temporary" {% if list.is_temporary
               %}checked{% endif %}>
             <label class="form-check-label" for="temporary">⏳ Tymczasowa (podaj date i godzine wygasania)</label>
@@ -69,12 +71,12 @@
       <div class="row mb-4">
         <div class="col-md-6">
           <label for="expires_date" class="form-label">📅 Data wygaśnięcia</label>
-          <input type="date" class="form-control bg-dark text-white border-secondary rounded" id="expires_date"
+          <input type="date" class="form-control bg-dark text-white border-secondary ui-consistent-input" id="expires_date"
             name="expires_date" value="{{ list.expires_at.strftime('%Y-%m-%d') if list.expires_at else '' }}">
         </div>
         <div class="col-md-6">
           <label for="expires_time" class="form-label">⏰ Godzina wygaśnięcia</label>
-          <input type="time" class="form-control bg-dark text-white border-secondary rounded" id="expires_time"
+          <input type="time" class="form-control bg-dark text-white border-secondary ui-consistent-input" id="expires_time"
             name="expires_time" value="{{ list.expires_at.strftime('%H:%M') if list.expires_at else '' }}">
         </div>
       </div>
@@ -92,7 +94,7 @@
         <div class="col-md-6">
           <label class="form-label">📁 Przenieś do miesiąca (format: rok-miesiąc np 2026-01)</label>
           <input type="month" id="created_month" name="created_month"
-            class="form-control bg-dark text-white border-secondary rounded">
+            class="form-control bg-dark text-white border-secondary ui-consistent-input">
         </div>
       </div>
 
@@ -100,7 +102,7 @@
       <div class="mb-4">
         <label for="categories" class="form-label">🏷️ Kategorie</label>
         <select id="categories" name="categories"
-          class="form-select tom-dark bg-dark text-white border-secondary rounded">
+          class="form-select tom-dark bg-dark text-white border-secondary ui-consistent-input">
           <option value="">– brak –</option>
           {% for cat in categories %}
           <option value="{{ cat.id }}" {% if cat.id in selected_categories %}selected{% endif %}>
@@ -113,7 +115,7 @@
       <!-- Link udostępnienia -->
       <div class="mb-4">
         <label class="form-label">🔗 Link do udostępnienia</label>
-        <input type="text" class="form-control bg-dark text-white border-secondary rounded" readonly
+        <input type="text" class="form-control bg-dark text-white border-secondary ui-consistent-input" readonly
           value="{{ request.url_root }}share/{{ list.share_token }}">
       </div>
 
@@ -155,11 +157,11 @@
     <form method="post" class="row g-2 mb-3">
       <input type="hidden" name="action" value="add_item">
       <div class="col-md-8">
-        <input type="text" class="form-control bg-dark text-white border-secondary rounded" name="item_name"
+        <input type="text" class="form-control bg-dark text-white border-secondary ui-consistent-input" name="item_name"
           placeholder="Nazwa produktu" required>
       </div>
       <div class="col-md-1">
-        <input type="number" class="form-control bg-dark text-white border-secondary rounded" name="quantity" min="1"
+        <input type="number" class="form-control bg-dark text-white border-secondary ui-consistent-input" name="quantity" min="1"
           value="1">
       </div>
       <div class="col-md-3 d-grid">
@@ -301,5 +303,5 @@
 
 {% endblock %}
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js', filename='select.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ static_asset_url('static_bp.serve_js', 'select.js') }}"></script>
 {% endblock %}

shopping_app/templates/admin/list_products.html

@@ -7,6 +7,8 @@
   <a href="{{ url_for('admin_panel') }}" class="btn btn-outline-secondary">← Powrót do panelu</a>
 </div>
 
+{% include 'admin/_nav.html' %}
+
 <div class="card bg-secondary bg-opacity-10 text-white mb-4">
   <div class="card-body">
 
@@ -40,7 +42,7 @@
       <span class="badge rounded-pill bg-info">{{ total_items }} produktów</span>
     </div>
     <div class="card-body p-0">
-      <table class="table table-dark align-middle sortable">
+      <table class="table table-dark align-middle sortable keep-horizontal">
         <thead>
           <tr>
             <th>ID</th>
@@ -99,7 +101,7 @@
     </div>
     <div class="card-body p-0">
       {% set item_names = items | map(attribute='name') | map('lower') | list %}
-      <table class="table table-dark align-middle sortable">
+      <table class="table table-dark align-middle sortable keep-horizontal">
         <thead>
           <tr>
             <th>ID</th>
@@ -168,8 +170,8 @@
 </div>
 
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js', filename='product_suggestion.js') }}?v={{ APP_VERSION }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='table_search.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ static_asset_url('static_bp.serve_js', 'product_suggestion.js') }}"></script>
+<script src="{{ static_asset_url('static_bp.serve_js', 'table_search.js') }}"></script>
 {% endblock %}
 
 {% endblock %}

shopping_app/templates/admin/lists_access.html

@@ -3,8 +3,7 @@
 
 {% block content %}
 <div class="d-flex justify-content-between align-items-center flex-wrap mb-3">
-  <h2 class="mb-2">🔐{% if list_id %} Zarządzanie dostępem listy #{{ list_id }}{% else %} Zarządzanie dostępem do list
-    {% endif %}</h2>
+  <h2 class="mb-2">🔐{% if list_id %} Dostęp do listy #{{ list_id }}{% else %} Zarządzanie dostępem do list{% endif %}</h2>
   <div class="d-flex gap-2">
     {% if list_id %}
     <a href="{{ url_for('admin_lists_access') }}" class="btn btn-outline-light">Powrót do wszystkich list</a>
@@ -13,12 +12,14 @@
   </div>
 </div>
 
+{% include 'admin/_nav.html' %}
+
 <!-- STICKY ACTION BAR -->
 <div id="bulkBar" class="position-sticky top-0 z-3 mb-3" style="backdrop-filter: blur(6px);">
   <div class="card bg-dark border-secondary shadow-sm">
     <div class="card-body py-2 d-flex flex-wrap align-items-center gap-3">
-      <div class="d-flex align-items-center gap-2">
-        <input id="selectAll" class="form-check-input" type="checkbox" />
+      <div class="d-flex align-items-center gap-2 w-100">
+        <input id="selectAll" class="form-check-input table-select-checkbox" type="checkbox" />
         <label for="selectAll" class="form-check-label">Zaznacz wszystko</label>
       </div>
 
@@ -36,7 +37,7 @@
       <div class="flex-grow-1">
         <div class="input-group input-group-sm">
           <input id="bulkUsersInput" class="form-control bg-dark text-white border-secondary"
-            placeholder="Podaj użytkowników (po przecinku lub enterach)" list="userHints">
+            placeholder="Podaj użytkowników (po przecinku lub enterach)" list="userHints" autocomplete="off">
           <button id="bulkAddBtn" class="btn btn-outline-light" type="button">➕ Nadaj dostęp</button>
         </div>
         <div id="bulkTokens" class="d-flex flex-wrap gap-2 mt-2"></div>
@@ -47,15 +48,14 @@
 
 
 <!-- HINTS -->
-<datalist id="userHints"></datalist>
+<datalist id="userHints">
+  {% for username in all_usernames %}<option value="{{ username }}"></option>{% endfor %}
+</datalist>
 
 <div class="card bg-dark text-white mb-5">
   <div class="card-body">
-    <form id="statusForm" method="post">
-      <input type="hidden" name="action" value="save_changes">
-
-      <div class="table-responsive">
-        <table class="table table-dark align-middle" id="listsTable">
+      <div class="table-responsive admin-table-responsive admin-table-responsive--wide">
+        <table class="table table-dark align-middle sortable lists-access-table" id="listsTable">
           <thead class="align-middle">
             <tr>
               <th scope="col" style="width:36px;"></th>
@@ -63,9 +63,8 @@
               <th scope="col">Nazwa listy</th>
               <th scope="col">Właściciel</th>
               <th scope="col">Utworzono</th>
-              <th scope="col">Statusy</th>
               <th scope="col">Udostępnianie</th>
-              <th scope="col" style="min-width: 340px;">Uprawnienia</th>
+              <th scope="col" style="min-width: 420px;">Uprawnienia</th>
             </tr>
           </thead>
           <tbody>
@@ -73,11 +72,10 @@
             <tr data-id="{{ l.id }}" data-title="{{ l.title|lower }}"
               data-owner="{{ (l.owner.username if l.owner else '-')|lower }}">
               <td>
-                <input class="row-check form-check-input" type="checkbox" data-list-id="{{ l.id }}">
-                <input type="hidden" name="visible_ids" value="{{ l.id }}">
+                <input class="row-check form-check-input table-select-checkbox" type="checkbox" data-list-id="{{ l.id }}">
               </td>
 
-              <td class="text-nowrap">#{{ l.id }}</td>
+              <td class="text-nowrap">{{ l.id }}</td>
 
               <td class="fw-bold align-middle">
                 <a href="{{ url_for('view_list', list_id=l.id) }}" class="text-white text-decoration-none">{{ l.title
@@ -92,29 +90,10 @@
               </td>
 
               <td class="text-nowrap">{{ l.created_at.strftime('%Y-%m-%d %H:%M') if l.created_at else '-' }}</td>
-
-              <td style="min-width: 230px;">
-                <div class="form-check form-switch">
-                  <input class="form-check-input" type="checkbox" id="pub_{{ l.id }}" name="is_public_{{ l.id }}" {% if
-                    l.is_public %}checked{% endif %}>
-                  <label class="form-check-label" for="pub_{{ l.id }}">🌐 Publiczna</label>
-                </div>
-                <div class="form-check form-switch">
-                  <input class="form-check-input" type="checkbox" id="tmp_{{ l.id }}" name="is_temporary_{{ l.id }}" {%
-                    if l.is_temporary %}checked{% endif %}>
-                  <label class="form-check-label" for="tmp_{{ l.id }}">⏳ Tymczasowa</label>
-                </div>
-                <div class="form-check form-switch">
-                  <input class="form-check-input" type="checkbox" id="arc_{{ l.id }}" name="is_archived_{{ l.id }}" {%
-                    if l.is_archived %}checked{% endif %}>
-                  <label class="form-check-label" for="arc_{{ l.id }}">📦 Archiwalna</label>
-                </div>
-              </td>
-
               <td style="min-width: 260px;">
                 {% if l.share_token %}
                 {% set share_url = url_for('shared_list', token=l.share_token, _external=True) %}
-                <div class="d-flex align-items-center gap-2">
+                <div class="d-flex align-items-center gap-2 w-100">
                   <div class="flex-grow-1 text-truncate mono small" title="{{ share_url }}">{{ share_url }}</div>
                   <button class="btn btn-sm btn-outline-secondary copy-share" type="button" data-url="{{ share_url }}"
                     aria-label="Kopiuj link">📋</button>
@@ -123,12 +102,12 @@
                   {% if l.is_public %}Lista widoczna publicznie{% else %}Dostęp przez link / uprawnienia{% endif %}
                 </div>
                 {% else %}
-                <div class="text-warning small">Brak tokenu</div>
+                <div class="text-warning small w-100 d-block">Brak tokenu</div>
                 {% endif %}
               </td>
 
               <td>
-                <div class="access-editor" data-list-id="{{ l.id }}">
+                <div class="access-editor" data-list-id="{{ l.id }}" data-post-url="{{ request.path }}{{ ('?page=' ~ page ~ "&per_page=" ~ per_page) if not list_id else "" }}" data-suggest-url="{{ url_for('admin_user_suggestions') }}" data-next="{{ request.full_path if request.query_string else request.path }}">
                   <!-- Tokeny z uprawnieniami -->
                   <div class="d-flex flex-wrap gap-2 mb-2 tokens">
                     {% for u in permitted_by_list.get(l.id, []) %}
@@ -146,11 +125,11 @@
                   <div class="input-group input-group-sm">
                     <input type="text"
                       class="form-control form-control-sm bg-dark text-white border-secondary access-input"
-                      placeholder="Dodaj @użytkownika (wiele: przecinki/enter)" list="userHints"
+                      placeholder="Dodaj użytkownika (wiele: przecinki/enter)" list="userHints" autocomplete="off"
                       aria-label="Dodaj użytkowników">
-                    <button type="button" class="btn btn-sm btn-outline-light access-add">➕ Dodaj</button>
+                    <button type="button" class="btn btn-sm btn-outline-light access-add">💾 Zapisz dostęp</button>
                   </div>
-                  <div class="text-secondary small mt-1">Kliknij token, aby odebrać dostęp.</div>
+                  <div class="text-secondary small mt-1">Kliknij token, aby odebrać dostęp. Zmiana zapisuje się od razu.</div>
                 </div>
               </td>
 
@@ -158,17 +137,13 @@
             {% endfor %}
             {% if lists|length == 0 %}
             <tr>
-              <td colspan="8" class="text-center py-4">Brak list do wyświetlenia</td>
+              <td colspan="7" class="text-center py-4">Brak list do wyświetlenia</td>
             </tr>
             {% endif %}
           </tbody>
         </table>
       </div>
 
-      <div class="mt-3 d-flex justify-content-end">
-        <button type="submit" class="btn btn-sm btn-outline-light">💾 Zapisz zmiany statusów</button>
-      </div>
-    </form>
   </div>
 </div>
 
@@ -206,6 +181,7 @@
 
 {% endblock %}
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js', filename='lists_access.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ static_asset_url('static_bp.serve_js', 'access_users.js') }}"></script>
+<script src="{{ static_asset_url('static_bp.serve_js', 'lists_access.js') }}"></script>
 
 {% endblock %}

shopping_app/templates/admin/receipts.html

@@ -46,6 +46,8 @@
   </div>
 </div>
 
+{% include 'admin/_nav.html' %}
+
 <div class="card bg-secondary bg-opacity-10 text-white mb-5">
   <div class="card-body">
     <div class="row g-3">
@@ -213,8 +215,17 @@
 </div>
 
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js', filename='admin_receipt_crop.js') }}?v={{ APP_VERSION }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='receipt_crop_logic.js') }}?v={{ APP_VERSION }}"></script>
+<script>
+  window.CROP_CONFIG = {
+    modalId: "adminCropModal",
+    imageId: "adminCropImage",
+    spinnerId: "adminCropLoading",
+    saveBtnId: "adminSaveCrop",
+    endpoint: "/admin/crop_receipt"
+  };
+</script>
+<script src="{{ static_asset_url('static_bp.serve_js', 'receipt_crop.js') }}"></script>
+<script src="{{ static_asset_url('static_bp.serve_js', 'receipt_crop_logic.js') }}"></script>
 {% endblock %}
 
 {% endblock %}