fix w cropie

.gitignore

@@ -8,4 +8,6 @@ uploads/
 db/mysql/*
 db/pgsql/*
 db/shopping.db
-*.swp
+*.swp
+version.txt
+deploy/varnish/default.vcl

Dockerfile

@@ -1,36 +0,0 @@
-# Używamy lekkiego obrazu Pythona
-FROM python:3.13-slim
-
-# Ustawiamy katalog roboczy
-WORKDIR /app
-
-# Zależności systemowe do OCR, obrazów, tesseract i języka PL
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    tesseract-ocr \
-    tesseract-ocr-pol \
-    libglib2.0-0 \
-    libsm6 \
-    libxrender1 \
-    libxext6 \
-    poppler-utils \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
-
-# Kopiujemy wymagania
-COPY requirements.txt requirements.txt
-
-# Instalujemy zależności
-RUN pip install --no-cache-dir -r requirements.txt
-
-# Kopiujemy resztę aplikacji
-COPY . .
-
-# Kopiujemy entrypoint i ustawiamy uprawnienia
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-
-# Otwieramy port
-EXPOSE 8000
-
-# Ustawiamy entrypoint
-ENTRYPOINT ["/entrypoint.sh"]

Dockerfile

@@ -0,0 +1 @@
+deploy/app/Dockerfile

app.py

@@ -127,6 +127,7 @@ AUTH_COOKIE_MAX_AGE = app.config.get("AUTH_COOKIE_MAX_AGE")
 HEALTHCHECK_TOKEN = app.config.get("HEALTHCHECK_TOKEN")
 SESSION_TIMEOUT_MINUTES = int(app.config.get("SESSION_TIMEOUT_MINUTES"))
 SESSION_COOKIE_SECURE = app.config.get("SESSION_COOKIE_SECURE")
+APP_PORT = int(app.config.get("APP_PORT"))
 
 app.config["COMPRESS_ALGORITHM"] = ["zstd", "br", "gzip", "deflate"]
 app.config["PERMANENT_SESSION_LIFETIME"] = timedelta(minutes=SESSION_TIMEOUT_MINUTES)
@@ -147,6 +148,41 @@ WEBP_SAVE_PARAMS = {
     "quality": 95,  # tylko jeśli lossless=False
 }
 
+
+def read_commit_and_date(filename="version.txt", root_path=None):
+    base = root_path or os.path.dirname(os.path.abspath(__file__))
+    path = os.path.join(base, filename)
+    if not os.path.exists(path):
+        return None, None
+
+    try:
+        commit = open(path, "r", encoding="utf-8").read().strip()
+        if commit:
+            commit = commit[:12]
+    except Exception:
+        commit = None
+
+    try:
+        ts = os.path.getmtime(path)
+        date_str = datetime.fromtimestamp(ts).strftime("%Y.%m.%d")
+    except Exception:
+        date_str = None
+
+    return date_str, commit
+
+
+deploy_date, commit = read_commit_and_date(
+    "version.txt", root_path=os.path.dirname(__file__)
+)
+if not deploy_date:
+    deploy_date = datetime.now().strftime("%Y.%m.%d")
+if not commit:
+    commit = "dev"
+
+
+APP_VERSION = f"{deploy_date}+{commit}"
+app.config["APP_VERSION"] = APP_VERSION
+
 db = SQLAlchemy(app)
 socketio = SocketIO(app, async_mode="eventlet")
 login_manager = LoginManager(app)
@@ -1126,20 +1162,40 @@ def save_pdf_as_webp(file, path):
 
 def get_active_months_query(visible_lists_query=None):
     if db.engine.name in ("sqlite",):
-        month_col = func.strftime("%Y-%m", ShoppingList.created_at)
+
+        def month_expr(col):
+            return func.strftime("%Y-%m", col)
+
     elif db.engine.name in ("mysql", "mariadb"):
-        month_col = func.date_format(ShoppingList.created_at, "%Y-%m")
-    else:  # PostgreSQL i inne wspierające to_char
-        month_col = func.to_char(ShoppingList.created_at, "YYYY-MM")
 
-    query = db.session.query(month_col.label("month"))
+        def month_expr(col):
+            return func.date_format(col, "%Y-%m")
+
+    else:  # PostgreSQL
+
+        def month_expr(col):
+            return func.to_char(col, "YYYY-MM")
+
     if visible_lists_query is not None:
-        query = query.select_from(visible_lists_query.subquery())
+        s = visible_lists_query.subquery()
+        month_sel = month_expr(s.c.created_at).label("month")
+        inner = (
+            db.session.query(month_sel)
+            .filter(month_sel.isnot(None))
+            .distinct()
+            .subquery()
+        )
+    else:
+        month_sel = month_expr(ShoppingList.created_at).label("month")
+        inner = (
+            db.session.query(month_sel)
+            .filter(ShoppingList.created_at.isnot(None))
+            .distinct()
+            .subquery()
+        )
 
-    active_months = (
-        query.filter(ShoppingList.created_at != None).distinct().order_by("month").all()
-    )
-    return [row.month for row in active_months]
+    rows = db.session.query(inner.c.month).order_by(inner.c.month).all()
+    return [r.month for r in rows]
 
 
 def normalize_name(name):
@@ -1320,6 +1376,11 @@ def load_user(user_id):
     return db.session.get(User, int(user_id))
 
 
+@app.context_processor
+def inject_version():
+    return {"APP_VERSION": app.config["APP_VERSION"]}
+
+
 @app.context_processor
 def inject_time():
     return dict(time=time)
@@ -1339,7 +1400,19 @@ def inject_is_blocked():
 @app.before_request
 def require_system_password():
     endpoint = request.endpoint
-    if endpoint in ("static_bp.serve_js_lib", "static_bp.serve_css_lib"):
+
+    if endpoint in (
+        "static_bp.serve_js",
+        "static_bp.serve_css",
+        "static_bp.serve_js_lib",
+        "static_bp.serve_css_lib",
+        "favicon",
+        "favicon_ico",
+        "uploaded_file",
+    ):
+        return
+
+    if endpoint in ("system_auth", "healthcheck", "robots_txt"):
         return
 
     ip = request.access_route[0]
@@ -1349,26 +1422,7 @@ def require_system_password():
     if endpoint is None:
         return
 
-    if endpoint in ("system_auth", "healthcheck", "robots_txt"):
-        return
-
-    if (
-        "authorized" not in request.cookies
-        and not endpoint.startswith("login")
-        and endpoint != "favicon"
-    ):
-
-        if endpoint == "static_bp.serve_js":
-            requested_file = request.view_args.get("filename", "")
-            if requested_file == "toasts.js":
-                return
-            if requested_file.endswith(".js"):
-                return redirect(url_for("system_auth", next=request.url))
-            return
-
-        if endpoint.startswith("static_bp."):
-            return
-
+    if "authorized" not in request.cookies and not endpoint.startswith("login"):
         if request.path == "/":
             return redirect(url_for("system_auth"))
 
@@ -1379,26 +1433,45 @@ def require_system_password():
 
 @app.after_request
 def apply_headers(response):
+    # Specjalny endpoint wykresów/API – zawsze no-cache
+    if request.path == "/expenses_data":
+        response.headers["Cache-Control"] = "no-store, no-cache, must-revalidate"
+        response.headers["Pragma"] = "no-cache"
+        response.headers["Expires"] = "0"
+        return response
+
+    # --- statyczne pliki (nagłówki z .env) ---
     if request.path.startswith(("/static/", "/uploads/")):
         response.headers["Vary"] = "Accept-Encoding"
         return response
 
+    # --- redirecty ---
     if response.status_code in (301, 302, 303, 307, 308):
         response.headers["Cache-Control"] = "no-store"
         response.headers.pop("Vary", None)
         return response
 
+    # --- błędy 4xx ---
     if 400 <= response.status_code < 500:
         response.headers["Cache-Control"] = "no-store"
-        response.headers["Content-Type"] = "text/html; charset=utf-8"
+        ct = (response.headers.get("Content-Type") or "").lower()
+        if "application/json" not in ct:
+            response.headers["Content-Type"] = "text/html; charset=utf-8"
         response.headers.pop("Vary", None)
 
+    # --- błędy 5xx ---
     elif 500 <= response.status_code < 600:
         response.headers["Cache-Control"] = "no-store"
-        response.headers["Content-Type"] = "text/html; charset=utf-8"
+        ct = (response.headers.get("Content-Type") or "").lower()
+        if "application/json" not in ct:
+            response.headers["Content-Type"] = "text/html; charset=utf-8"
         response.headers["Retry-After"] = "120"
         response.headers.pop("Vary", None)
 
+    # --- strony dynamiczne (domyślnie) ---
+    # Wszystko, co nie jest /static/ ani /uploads/ ma być no-store/no-cache
+    response.headers.setdefault("Cache-Control", "no-cache, no-store")
+
     return response
 
 
@@ -1723,34 +1796,49 @@ def system_auth():
 @app.route("/edit_my_list/<int:list_id>", methods=["GET", "POST"])
 @login_required
 def edit_my_list(list_id):
+    # --- Pobranie listy i weryfikacja właściciela ---
+    l = db.session.get(ShoppingList, list_id)
+    if l is None:
+        abort(404)
+    if l.owner_id != current_user.id:
+        abort(403, description="Nie jesteś właścicielem tej listy.")
+
+    # Dane do widoku
     receipts = (
         Receipt.query.filter_by(list_id=list_id)
         .order_by(Receipt.uploaded_at.desc())
         .all()
     )
-
-    l = db.session.get(ShoppingList, list_id)
-    if l is None:
-        abort(404)
-
-    if l.owner_id != current_user.id:
-        abort(403, description="Nie jesteś właścicielem tej listy.")
-
     categories = Category.query.order_by(Category.name.asc()).all()
     selected_categories_ids = {c.id for c in l.categories}
 
     next_page = request.args.get("next") or request.referrer
+    wants_json = (
+        "application/json" in (request.headers.get("Accept") or "")
+        or request.headers.get("X-Requested-With") == "fetch"
+    )
 
     if request.method == "POST":
-        grant_username = (request.form.get("grant_username") or "").strip().lower()
-        revoke_user_id = request.form.get("revoke_user_id")
+        action = request.form.get("action")
+
+        # --- Nadanie dostępu (grant) ---
+        if action == "grant":
+            grant_username = (request.form.get("grant_username") or "").strip().lower()
+            if not grant_username:
+                if wants_json:
+                    return jsonify(ok=False, error="empty"), 400
+                flash("Podaj nazwę użytkownika do nadania dostępu.", "danger")
+                return redirect(next_page or request.url)
 
-        if grant_username:
             u = User.query.filter(func.lower(User.username) == grant_username).first()
             if not u:
+                if wants_json:
+                    return jsonify(ok=False, error="not_found"), 404
                 flash("Użytkownik nie istnieje.", "danger")
                 return redirect(next_page or request.url)
             if u.id == current_user.id:
+                if wants_json:
+                    return jsonify(ok=False, error="owner"), 409
                 flash("Jesteś właścicielem tej listy.", "info")
                 return redirect(next_page or request.url)
 
@@ -1765,44 +1853,59 @@ def edit_my_list(list_id):
             if not exists:
                 db.session.add(ListPermission(list_id=l.id, user_id=u.id))
                 db.session.commit()
+                if wants_json:
+                    return jsonify(ok=True, user={"id": u.id, "username": u.username})
                 flash(f"Nadano dostęp użytkownikowi „{u.username}”.", "success")
             else:
+                if wants_json:
+                    return jsonify(ok=False, error="exists"), 409
                 flash("Ten użytkownik już ma dostęp.", "info")
             return redirect(next_page or request.url)
 
+        # --- Odebranie dostępu (revoke) ---
+        revoke_user_id = request.form.get("revoke_user_id")
         if revoke_user_id:
             try:
                 uid = int(revoke_user_id)
             except ValueError:
+                if wants_json:
+                    return jsonify(ok=False, error="bad_id"), 400
                 flash("Błędny identyfikator użytkownika.", "danger")
                 return redirect(next_page or request.url)
 
             ListPermission.query.filter_by(list_id=l.id, user_id=uid).delete()
             db.session.commit()
+            if wants_json:
+                return jsonify(ok=True, removed_user_id=uid)
             flash("Odebrano dostęp użytkownikowi.", "success")
             return redirect(next_page or request.url)
 
+        # --- Przywracanie z archiwum ---
         if "unarchive" in request.form:
             l.is_archived = False
             db.session.commit()
+            if wants_json:
+                return jsonify(ok=True, unarchived=True)
             flash(f"Lista „{l.title}” została przywrócona.", "success")
             return redirect(next_page or request.url)
 
+        # --- Główny zapis pól formularza ---
         move_to_month = request.form.get("move_to_month")
         if move_to_month:
             try:
                 year, month = map(int, move_to_month.split("-"))
-                new_created_at = datetime(year, month, 1, tzinfo=timezone.utc)
-                l.created_at = new_created_at
-                db.session.commit()
-                flash(
-                    f"Zmieniono datę utworzenia listy na {new_created_at.strftime('%Y-%m-%d')}",
-                    "success",
-                )
-                return redirect(next_page or request.url)
+                l.created_at = datetime(year, month, 1, tzinfo=timezone.utc)
+                if not wants_json:
+                    flash(
+                        f"Zmieniono datę utworzenia listy na {l.created_at.strftime('%Y-%m-%d')}",
+                        "success",
+                    )
             except ValueError:
-                flash("Nieprawidłowy format miesiąca", "danger")
-                return redirect(next_page or request.url)
+                if not wants_json:
+                    flash(
+                        "Nieprawidłowy format miesiąca — zignorowano zmianę miesiąca.",
+                        "danger",
+                    )
 
         new_title = (request.form.get("title") or "").strip()
         is_public = "is_public" in request.form
@@ -1812,6 +1915,8 @@ def edit_my_list(list_id):
         expires_time = request.form.get("expires_time")
 
         if not new_title:
+            if wants_json:
+                return jsonify(ok=False, error="title_empty"), 400
             flash("Podaj poprawny tytuł", "danger")
             return redirect(next_page or request.url)
 
@@ -1826,16 +1931,23 @@ def edit_my_list(list_id):
                 expires_dt = datetime.strptime(combined, "%Y-%m-%d %H:%M")
                 l.expires_at = expires_dt.replace(tzinfo=timezone.utc)
             except ValueError:
+                if wants_json:
+                    return jsonify(ok=False, error="bad_expiry"), 400
                 flash("Błędna data lub godzina wygasania", "danger")
                 return redirect(next_page or request.url)
         else:
             l.expires_at = None
 
+        # Kategorie (używa Twojej pomocniczej funkcji)
         update_list_categories_from_form(l, request.form)
+
         db.session.commit()
+        if wants_json:
+            return jsonify(ok=True, saved=True)
         flash("Zaktualizowano dane listy", "success")
         return redirect(next_page or request.url)
 
+    # GET: użytkownicy z dostępem
     permitted_users = (
         db.session.query(User)
         .join(ListPermission, ListPermission.user_id == User.id)
@@ -1854,6 +1966,52 @@ def edit_my_list(list_id):
     )
 
 
+
+@app.route("/edit_my_list/<int:list_id>/suggestions", methods=["GET"])
+@login_required
+def edit_my_list_suggestions(list_id: int):
+    # Weryfikacja listy i właściciela (prywatność)
+    l = db.session.get(ShoppingList, list_id)
+    if l is None:
+        abort(404)
+    if l.owner_id != current_user.id:
+        abort(403, description="Nie jesteś właścicielem tej listy.")
+
+    q = (request.args.get("q") or "").strip().lower()
+
+    # Historia nadawań uprawnień przez tego właściciela (po wszystkich jego listach)
+    subq = (
+        db.session.query(
+            ListPermission.user_id.label("uid"),
+            func.count(ListPermission.id).label("grant_count"),
+            func.max(ListPermission.id).label("last_grant_id"),
+        )
+        .join(ShoppingList, ShoppingList.id == ListPermission.list_id)
+        .filter(ShoppingList.owner_id == current_user.id)
+        .group_by(ListPermission.user_id)
+        .subquery()
+    )
+
+    query = (
+        db.session.query(User.username, subq.c.grant_count, subq.c.last_grant_id)
+        .join(subq, subq.c.uid == User.id)
+    )
+    if q:
+        query = query.filter(func.lower(User.username).like(f"{q}%"))
+
+    rows = (
+        query.order_by(
+            subq.c.grant_count.desc(),
+            subq.c.last_grant_id.desc(),
+            func.lower(User.username).asc(),
+        )
+        .limit(20)
+        .all()
+    )
+
+    return jsonify({"users": [r.username for r in rows]})
+
+
 @app.route("/delete_user_list/<int:list_id>", methods=["POST"])
 @login_required
 def delete_user_list(list_id):
@@ -1952,43 +2110,54 @@ def create_list():
 
 @app.route("/list/<int:list_id>")
 @login_required
+# ─────────────────────────────────────────────────────────────────────────────
+# Widok listy właściciela – dopięcie permitted_users do kontekstu
+# ─────────────────────────────────────────────────────────────────────────────
+@login_required
 def view_list(list_id):
-
     shopping_list = db.session.get(ShoppingList, list_id)
     if not shopping_list:
         abort(404)
 
     is_owner = current_user.id == shopping_list.owner_id
     if not is_owner:
-        flash(
-            "Nie jesteś właścicielem listy, przekierowano do widoku publicznego.",
-            "warning",
-        )
+        flash("Nie jesteś właścicielem listy, przekierowano do widoku publicznego.", "warning")
         if current_user.is_admin:
-            flash(
-                "W celu modyfikacji listy, przejdź do panelu administracyjnego.", "info"
-            )
+            flash("W celu modyfikacji listy, przejdź do panelu administracyjnego.", "info")
         return redirect(url_for("shared_list", token=shopping_list.share_token))
 
+    # Twoja obecna logika ładująca szczegóły listy:
     shopping_list, items, receipts, expenses, total_expense = get_list_details(list_id)
     total_count = len(items)
     purchased_count = len([i for i in items if i.purchased])
     percent = (purchased_count / total_count * 100) if total_count > 0 else 0
-    is_owner = current_user.id == shopping_list.owner_id
 
+    # Uzupełnienie "added_by_display" — jak u Ciebie:
     for item in items:
         if item.added_by != shopping_list.owner_id:
-            item.added_by_display = (
-                item.added_by_user.username if item.added_by_user else "?"
-            )
+            item.added_by_display = (item.added_by_user.username if item.added_by_user else "?")
         else:
             item.added_by_display = None
 
+    # Badges kategorii (jak u Ciebie)
     shopping_list.category_badges = [
         {"name": c.name, "color": category_to_color(c.name)}
         for c in shopping_list.categories
     ]
 
+    # Dane do modala kategorii
+    categories = Category.query.order_by(Category.name.asc()).all()
+    selected_categories_ids = {c.id for c in shopping_list.categories}
+
+    # ⬅️ NOWE: użytkownicy z uprawnieniami do tej listy (dla modala w list.html)
+    permitted_users = (
+        db.session.query(User)
+        .join(ListPermission, ListPermission.user_id == User.id)
+        .filter(ListPermission.list_id == shopping_list.id)
+        .order_by(User.username.asc())
+        .all()
+    )
+
     return render_template(
         "list.html",
         list=shopping_list,
@@ -2001,9 +2170,145 @@ def view_list(list_id):
         total_expense=total_expense,
         is_share=False,
         is_owner=is_owner,
+        categories=categories,
+        selected_categories=selected_categories_ids,
+        permitted_users=permitted_users,  # ⬅️ ważne dla tokenów w modalu
     )
 
 
+@app.route("/list/<int:list_id>/settings", methods=["POST"])
+@login_required
+def list_settings(list_id):
+    # Uprawnienia: właściciel
+    l = db.session.get(ShoppingList, list_id)
+    if l is None:
+        abort(404)
+    if l.owner_id != current_user.id:
+        abort(403, description="Brak uprawnień do ustawień tej listy.")
+
+    next_page = request.form.get("next") or url_for("view_list", list_id=list_id)
+    wants_json = (
+        "application/json" in (request.headers.get("Accept") or "")
+        or request.headers.get("X-Requested-With") == "fetch"
+    )
+
+    action = request.form.get("action")
+
+    # 1) Ustawienie kategorii (pojedynczy wybór z list.html -> modal kategorii)
+    if action == "set_category":
+        cid = request.form.get("category_id")
+        if cid in (None, "", "none"):
+            # usunięcie kategorii lub brak zmiany – w zależności od Twojej logiki
+            l.categories = []
+            db.session.commit()
+            if wants_json:
+                return jsonify(ok=True, saved=True)
+            flash("Zapisano kategorię.", "success")
+            return redirect(next_page)
+
+        try:
+            cid = int(cid)
+        except (TypeError, ValueError):
+            if wants_json:
+                return jsonify(ok=False, error="bad_category"), 400
+            flash("Błędna kategoria.", "danger")
+            return redirect(next_page)
+
+        c = db.session.get(Category, cid)
+        if not c:
+            if wants_json:
+                return jsonify(ok=False, error="bad_category"), 400
+            flash("Błędna kategoria.", "danger")
+            return redirect(next_page)
+
+        # Jeśli jeden wybór – zastąp listę kategorii jedną:
+        l.categories = [c]
+        db.session.commit()
+        if wants_json:
+            return jsonify(ok=True, saved=True)
+        flash("Zapisano kategorię.", "success")
+        return redirect(next_page)
+
+    # 2) Nadanie dostępu (akceptuj 'grant_access' i 'grant')
+    if action in ("grant_access", "grant"):
+        grant_username = (request.form.get("grant_username") or "").strip().lower()
+
+        if not grant_username:
+            if wants_json:
+                return jsonify(ok=False, error="empty_username"), 400
+            flash("Podaj nazwę użytkownika.", "danger")
+            return redirect(next_page)
+
+        # Szukamy użytkownika po username (case-insensitive)
+        u = User.query.filter(func.lower(User.username) == grant_username).first()
+        if not u:
+            if wants_json:
+                return jsonify(ok=False, error="not_found"), 404
+            flash("Użytkownik nie istnieje.", "danger")
+            return redirect(next_page)
+
+        # Właściciel już ma dostęp
+        if u.id == l.owner_id:
+            if wants_json:
+                return jsonify(ok=False, error="owner"), 409
+            flash("Jesteś właścicielem tej listy.", "info")
+            return redirect(next_page)
+
+        # Czy już ma dostęp?
+        exists = (
+            db.session.query(ListPermission.id)
+            .filter(ListPermission.list_id == l.id, ListPermission.user_id == u.id)
+            .first()
+        )
+        if exists:
+            if wants_json:
+                return jsonify(ok=False, error="exists"), 409
+            flash("Ten użytkownik już ma dostęp.", "info")
+            return redirect(next_page)
+
+        # Zapis uprawnienia
+        db.session.add(ListPermission(list_id=l.id, user_id=u.id))
+        db.session.commit()
+
+        if wants_json:
+            # Zwracamy usera, żeby JS mógł dokleić token bez odświeżania
+            return jsonify(ok=True, user={"id": u.id, "username": u.username})
+        flash(f"Nadano dostęp użytkownikowi „{u.username}”.", "success")
+        return redirect(next_page)
+
+    # 3) Odebranie dostępu (po polu revoke_user_id, nie po action)
+    revoke_uid = request.form.get("revoke_user_id")
+    if revoke_uid:
+        try:
+            uid = int(revoke_uid)
+        except (TypeError, ValueError):
+            if wants_json:
+                return jsonify(ok=False, error="bad_user_id"), 400
+            flash("Błędny identyfikator użytkownika.", "danger")
+            return redirect(next_page)
+
+        # Nie pozwalaj usunąć właściciela
+        if uid == l.owner_id:
+            if wants_json:
+                return jsonify(ok=False, error="cannot_revoke_owner"), 400
+            flash("Nie można odebrać dostępu właścicielowi.", "danger")
+            return redirect(next_page)
+
+        ListPermission.query.filter_by(list_id=l.id, user_id=uid).delete()
+        db.session.commit()
+
+        if wants_json:
+            return jsonify(ok=True, removed_user_id=uid)
+        flash("Odebrano dostęp użytkownikowi.", "success")
+        return redirect(next_page)
+
+    # 4) Nieznana akcja
+    if wants_json:
+        return jsonify(ok=False, error="unknown_action"), 400
+    flash("Nieznana akcja.", "danger")
+    return redirect(next_page)
+
+
 @app.route("/expenses")
 @login_required
 def expenses():
@@ -3564,6 +3869,10 @@ def admin_lists_access(list_id=None):
             if not u:
                 flash("Użytkownik nie istnieje.", "danger")
                 return redirect(request.url)
+            if u.id == l.owner_id:
+                flash("Nie można nadawać uprawnień właścicielowi listy.", "danger")
+                return redirect(request.url)
+
             exists = (
                 db.session.query(ListPermission.id)
                 .filter(ListPermission.list_id == l.id, ListPermission.user_id == u.id)
@@ -3619,7 +3928,7 @@ def admin_lists_access(list_id=None):
     query_string = f"per_page={per_page}"
 
     return render_template(
-        "admin/admin_lists_access.html",
+        "admin/lists_access.html",
         lists=lists,
         permitted_by_list=permitted_by_list,
         page=page,
@@ -4005,4 +4314,4 @@ def create_db():
 
 if __name__ == "__main__":
     logging.basicConfig(level=logging.DEBUG if DEBUG_MODE else logging.INFO)
-    socketio.run(app, host="0.0.0.0", port=8000, debug=False)
+    socketio.run(app, host="0.0.0.0", port=APP_PORT, debug=False)

config.py

@@ -10,6 +10,8 @@ class Config:
     
     SECRET_KEY = os.environ.get("SECRET_KEY", "D8pceNZ8q%YR7^7F&9wAC2")
 
+    APP_PORT = int(os.environ.get("APP_PORT", "8000") or "8000")
+
     DB_ENGINE = os.environ.get("DB_ENGINE", "sqlite").lower()
     if DB_ENGINE == "sqlite":
         SQLALCHEMY_DATABASE_URI = (
@@ -78,6 +80,6 @@ class Config:
             "Spożywcze,Budowlane,Zabawki,Chemia,Inne,Elektronika,Odzież i obuwie,"
             "Artykuły biurowe,Kosmetyki i higiena,Motoryzacja,Ogród i rośliny,"
             "Zwierzęta,Sprzęt sportowy,Książki i prasa,Narzędzia i majsterkowanie,"
-            "RTV / AGD,Apteka i suplementy,Artykuły dekoracyjne,Gry i hobby,Usługi,Pieczywo,Różne,Chiny,Dom,Leki"
+            "RTV / AGD,Apteka i suplementy,Artykuły dekoracyjne,Gry i hobby,Usługi,Pieczywo,Różne,Chiny,Dom,Leki,Odzież,Samochód"
         ).split(",") if c.strip()
     ]

deploy/app/Dockerfile

@@ -0,0 +1,35 @@
+
+FROM python:3.14-rc-trixie
+#FROM python:3.13-slim
+WORKDIR /app
+
+# Zależności systemowe do OCR, obrazów, tesseract i języka PL
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    tesseract-ocr \
+    tesseract-ocr-pol \
+    libglib2.0-0 \
+    libsm6 \
+    libxrender1 \
+    libxext6 \
+    poppler-utils \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Kopiujemy wymagania
+COPY requirements.txt requirements.txt
+
+# Instalujemy zależności
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Kopiujemy resztę aplikacji
+COPY . .
+
+# Kopiujemy entrypoint i ustawiamy uprawnienia
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+# Otwieramy port
+#EXPOSE 8000
+
+# Ustawiamy entrypoint
+ENTRYPOINT ["/entrypoint.sh"]

deploy/varnish/default.vcl.template

@@ -0,0 +1,234 @@
+vcl 4.1;
+
+import vsthrottle;
+import std;
+
+# ===== Backend =====
+backend app {
+  .host = "app";
+  .port = "${APP_PORT}";
+}
+
+# ===== ACL =====
+acl purge {
+  "127.0.0.1";
+  "::1";
+}
+
+# ===== RECV =====
+sub vcl_recv {
+  # RATE LIMIT: 200 żądań / 10s, blokada 60s
+  if (vsthrottle.is_denied(client.identity, 200, 10s, 60s)) {
+    return (synth(429, "Too Many Requests"));
+  }
+
+  # PURGE tylko lokalnie
+  if (req.method == "PURGE") {
+    if (!client.ip ~ purge) { return (synth(405, "Not allowed")); }
+    return (purge);
+  }
+
+  # omijamy cache dla healthchecków / wewnętrznych nagłówków
+  if (req.url == "/healthcheck" || req.http.X-Internal-Check) { return (pass); }
+
+  # Specjalna obsługa WebSocket i socket.io
+  if (req.http.Upgrade ~ "(?i)websocket" || req.url ~ "^/socket.io/") {
+    return (pipe);
+  }
+
+  # metody inne niż GET/HEAD bez cache
+  if (req.method != "GET" && req.method != "HEAD") { return (pass); }
+
+  # Żądania z Authorization nie są buforowane
+  if (req.http.Authorization) { return (pass); }
+
+  # ---- Normalizacja Accept-Encoding (kolejność: zstd > br > gzip) ----
+  if (req.http.Accept-Encoding) {
+    if (req.http.Accept-Encoding ~ "zstd") {
+      set req.http.Accept-Encoding = "zstd";
+    } else if (req.http.Accept-Encoding ~ "br") {
+      set req.http.Accept-Encoding = "br";
+    } else if (req.http.Accept-Encoding ~ "gzip") {
+      set req.http.Accept-Encoding = "gzip";
+    } else {
+      set req.http.Accept-Encoding = "identity";
+    }
+  }
+
+  # ---- (Opcjonalnie) Normalizacja Accept dla obrazów generowanych wariantowo ----
+  # if (req.url ~ "\.(png|jpe?g|gif|bmp)$") {
+  #   if (req.http.Accept ~ "image/webp") {
+  #     set req.http.X-Accept-Image = "modern";   # webp
+  #   } else {
+  #     set req.http.X-Accept-Image = "legacy";   # jpg/png
+  #   }
+  # }
+
+  # ---- STATYCZNE – agresywny cache + ignorujemy sesję ----
+  if (req.url ~ "^/static/" || req.url ~ "\.(css|js|png|jpe?g|webp|svg|ico|woff2?)$") {
+    unset req.http.Cookie;
+    unset req.http.Authorization;
+    return (hash);
+  }
+
+  if (!req.http.X-Forwarded-Proto) {
+    set req.http.X-Forwarded-Proto = "https";
+  }
+
+  return (hash);
+}
+
+# ===== PIPE (WebSocket passthrough) =====
+sub vcl_pipe {
+  if (req.http.Upgrade) {
+    set bereq.http.Upgrade = req.http.Upgrade;
+    set bereq.http.Connection = req.http.Connection;
+  }
+}
+
+# ===== HASH =====
+sub vcl_hash {
+  hash_data(req.url);
+  if (req.http.host) { hash_data(req.http.host); } else { hash_data(server.ip); }
+
+  # Cookie: zostają dla dynamicznych (dla statyków wyczyszczone wcześniej)
+  if (req.http.Cookie) { hash_data(req.http.Cookie); }
+
+  # Accept-Encoding: już znormalizowany do zstd/br/gzip/identity
+  if (req.http.Accept-Encoding) { hash_data(req.http.Accept-Encoding); }
+
+  # (Opcjonalnie) sygnał obrazów z negocjacją po Accept
+  if (req.http.X-Accept-Image) { hash_data(req.http.X-Accept-Image); }
+}
+
+# ===== BACKEND_RESPONSE =====
+sub vcl_backend_response {
+  # Zakaz cache – respektujemy
+  if (beresp.http.Cache-Control ~ "(?i)no-store|private") {
+    set beresp.uncacheable = true;
+    set beresp.ttl = 0s;
+    return (deliver);
+  }
+
+  # NIE cache'uj redirectów do loginu (HTML) z backendu
+  if (beresp.status >= 300 && beresp.status < 400) {
+    set beresp.uncacheable = true;
+    set beresp.ttl = 0s;
+    return (deliver);
+  }
+
+  # Nie cache'uj statyków, jeśli status ≠ 200
+  if (bereq.url ~ "^/static/" ||
+      bereq.url ~ "\.(css|js|png|jpe?g|webp|svg|ico|woff2?)($|\?)") {
+    if (beresp.status != 200) {
+      set beresp.uncacheable = true;
+      set beresp.ttl = 0s;
+      return (deliver);
+    }
+  }
+
+  # Jeśli pod .js przychodzi text/html — też nie cache'uj (to zwykle redirect/login)
+  if (bereq.url ~ "\.js(\?.*)?$" && beresp.http.Content-Type ~ "(?i)text/html") {
+    set beresp.uncacheable = true;
+    set beresp.ttl = 0s;
+    return (deliver);
+  }
+
+  # Wymuś poprawny Content-Type dla .js/.css, gdy backend zwróci HTML
+  if (bereq.url ~ "\.js(\?.*)?$") {
+    if (!beresp.http.Content-Type || beresp.http.Content-Type ~ "(?i)text/html") {
+      set beresp.http.Content-Type = "application/javascript; charset=utf-8";
+    }
+  }
+  if (bereq.url ~ "\.css(\?.*)?$") {
+    if (!beresp.http.Content-Type || beresp.http.Content-Type ~ "(?i)text/html") {
+      set beresp.http.Content-Type = "text/css; charset=utf-8";
+    }
+  }
+
+  # ---- STATYCZNE: zdejmij Set-Cookie i Vary: Cookie, zapewnij TTL ----
+  if (bereq.url ~ "^/static/" || bereq.url ~ "\.(css|js|png|jpe?g|webp|svg|ico|woff2?)$") {
+    unset beresp.http.Set-Cookie;
+
+    # Jeśli backend dodał Vary: Cookie, usuńmy ten element (nie wpływa na statyki)
+    if (beresp.http.Vary) {
+      set beresp.http.Vary = regsuball(beresp.http.Vary, "(?i)(^|,)[[:space:]]*Cookie[[:space:]]*(,|$)", "\1");
+      set beresp.http.Vary = regsuball(beresp.http.Vary, ",[[:space:]]*,", ",");
+      set beresp.http.Vary = regsub(beresp.http.Vary, "^[[:space:]]*,[[:space:]]*", "");
+      set beresp.http.Vary = regsub(beresp.http.Vary, "[[:space:]]*,[[:space:]]*$", "");
+      if (beresp.http.Vary ~ "^[[:space:]]*$") { unset beresp.http.Vary; }
+    }
+
+    # Jeśli brak kontroli czasu życia – ustawiamy twarde wartości
+    if (!(beresp.http.Cache-Control ~ "(?i)(s-maxage|max-age)")) {
+      set beresp.ttl = 24h;
+      set beresp.http.Cache-Control = "public, max-age=86400, immutable";
+    }
+
+    set beresp.grace = 1h;
+    set beresp.keep  = 24h;
+  }
+
+  # ---- Ogólne TTL z nagłówków ----
+  if (beresp.http.Cache-Control ~ "(?i)s-maxage=([0-9]+)") {
+    set beresp.ttl = std.duration(regsub(beresp.http.Cache-Control, "(?i).*s-maxage=([0-9]+).*", "\1") + "s", 0s);
+  } else if (beresp.http.Cache-Control ~ "(?i)max-age=([0-9]+)") {
+    set beresp.ttl = std.duration(regsub(beresp.http.Cache-Control, "(?i).*max-age=([0-9]+).*", "\1") + "s", 0s);
+  } else if (beresp.http.Expires) {
+    set beresp.ttl = std.time(beresp.http.Expires, now) - now;
+    if (beresp.ttl < 0s) { set beresp.ttl = 0s; }
+  } else {
+    if (beresp.ttl <= 0s) { set beresp.ttl = 60s; }
+  }
+
+  # Immutable => dłuższe grace/keep
+  if (beresp.http.Cache-Control ~ "(?i)immutable") {
+    set beresp.grace = 1h;
+    set beresp.keep  = 24h;
+  }
+
+  # Kompresja po stronie Varnisha wyłącznie dla klientów akceptujących gzip
+  # i tylko jeśli backend nie dostarczył już Content-Encoding.
+  if (!beresp.http.Content-Encoding && bereq.http.Accept-Encoding ~ "gzip") {
+    # Kompresujemy tylko „tekstowe” typy; wykluczamy WASM
+    if (beresp.http.Content-Type ~ "(?i)text/|application/(javascript|json|xml)") {
+      set beresp.do_gzip = true;
+    }
+  }
+
+  # Duże odpowiedzi streamujemy
+  if (beresp.http.Content-Length && std.integer(beresp.http.Content-Length, 0) > 1048576) {
+    set beresp.do_stream = true;
+  }
+}
+
+# (Opcjonalnie) Serwuj „stale” przy błędach backendu, jeśli jest obiekt w grace
+sub vcl_backend_error {
+  return (deliver);
+}
+
+# ===== DELIVER =====
+sub vcl_deliver {
+  if (obj.uncacheable) {
+    set resp.http.X-Cache = "PASS";
+    unset resp.http.Age;
+  } else if (obj.hits > 0) {
+    set resp.http.X-Cache = "HIT";
+  } else {
+    set resp.http.X-Cache = "MISS";
+    unset resp.http.Age;
+  }
+
+  unset resp.http.Via;
+  unset resp.http.X-Varnish;
+  unset resp.http.Server;
+}
+
+sub vcl_synth {
+  set resp.http.X-Cache = "SYNTH";
+}
+
+# ===== PURGE HANDLER =====
+sub vcl_purge {
+  return (synth(200, "Purged"));
+}

deploy_docker.sh

@@ -1,14 +1,23 @@
 #!/bin/bash
 set -e
 
+# --- Wczytaj zmienne z .env ---
+if [[ -f .env ]]; then
+  set -a
+  source .env
+  set +a
+fi
+
+APP_PORT="${APP_PORT:-8080}"
+
 PROFILE=$1
 
 if [[ -z "$PROFILE" ]]; then
-  echo "Uzycie: $0 {pgsql|mysql|sqlite}"
+  echo "Użycie: $0 {pgsql|mysql|sqlite}"
   exit 1
 fi
 
-echo "Zatrzymuje kontenery aplikacji i bazy..."
+echo "Zatrzymuję kontenery aplikacji i bazy..."
 if [[ "$PROFILE" == "sqlite" ]]; then
   docker compose stop
 else
@@ -18,11 +27,17 @@ fi
 echo "Pobieram najnowszy kod z repozytorium..."
 git pull
 
-echo "Buduje i uruchamiam kontenery..."
+echo "Generowanie default.vcl z APP_PORT=$APP_PORT"
+envsubst < deploy/varnish/default.vcl.template > deploy/varnish/default.vcl
+
+echo "Zapisuję hash commita do version.txt..."
+git rev-parse --short HEAD > version.txt
+
+echo "Buduję i uruchamiam kontenery..."
 if [[ "$PROFILE" == "sqlite" ]]; then
   docker compose up -d --build
 else
   DB_ENGINE="$PROFILE" docker compose --profile "$PROFILE" up -d --build
 fi
 
-echo "Gotowe!"
+echo "Gotowe! Wersja aplikacji: $(cat version.txt)"

docker-compose.yml

@@ -1,11 +1,13 @@
 services:
   app:
     build: .
-    container_name: live-lista-zakupow
-    ports:
-      - "${APP_PORT:-8000}:8000"
+    container_name: lista-zakupow-app
+    #ports:
+    #  - "${APP_PORT:-8000}:8000"
+    expose:
+      - "${APP_PORT:-8000}"
     healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request; import sys; req = urllib.request.Request('http://localhost:8000/healthcheck', headers={'X-Internal-Check': '${HEALTHCHECK_TOKEN}'}); sys.exit(0) if urllib.request.urlopen(req).read() == b'OK' else sys.exit(1)"]
+      test: ["CMD", "python", "-c", "import urllib.request; import sys; req = urllib.request.Request('http://localhost:${APP_PORT:-8000}/healthcheck', headers={'X-Internal-Check': '${HEALTHCHECK_TOKEN}'}); sys.exit(0) if urllib.request.urlopen(req).read() == b'OK' else sys.exit(1)"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -16,23 +18,36 @@ services:
       - .:/app
       - ./uploads:/app/uploads
       - ./instance:/app/instance
+    networks:
+      - lista-zakupow_network
     restart: unless-stopped
 
-  pgsql:
-    image: postgres:17
-    container_name: pgsql-db
-    environment:
-      POSTGRES_DB: ${DB_NAME}
-      POSTGRES_USER: ${DB_USER}
-      POSTGRES_PASSWORD: ${DB_PASSWORD}
+  varnish:
+    image: varnish:latest
+    container_name: lista-zakupow-varnish
+    depends_on:
+      app:
+        condition: service_healthy
+    ports:
+      - "${APP_PORT:-8000}:80"
     volumes:
-      - ./db/pgsql:/var/lib/postgresql/data
+      - ./deploy/varnish/default.vcl:/etc/varnish/default.vcl:ro
+    environment:
+      - VARNISH_SIZE=256m
+    healthcheck:
+      test: [ "CMD-SHELL", "curl -fsS -H 'X-Internal-Check=${HEALTHCHECK_TOKEN}' http://localhost/healthcheck | grep -q OK" ]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+    env_file:
+      - .env
+    networks:
+      - lista-zakupow_network
     restart: unless-stopped
-    profiles: ["pgsql"]
 
   mysql:
     image: mysql:8
-    container_name: mysql-db
+    container_name: lista-zakupow-mysql-db
     environment:
       MYSQL_DATABASE: ${DB_NAME}
       MYSQL_USER: ${DB_USER}
@@ -41,4 +56,25 @@ services:
     volumes:
       - ./db/mysql:/var/lib/mysql
     restart: unless-stopped
-    profiles: ["mysql"]
+    networks:
+      - lista-zakupow_network
+    profiles: ["mysql"]
+
+  pgsql:
+    image: postgres:18
+    container_name: lista-zakupow-pgsql
+    environment:
+      POSTGRES_DB: ${DB_NAME}
+      POSTGRES_USER: ${DB_USER}
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      PGDATA: /var/lib/postgresql
+    volumes:
+      - ./db/pgsql/:/var/lib/postgresql
+    networks:
+      - lista-zakupow_network
+    restart: unless-stopped
+    profiles: ["pgsql"]
+
+networks:
+  lista-zakupow_network:
+    driver: bridge

static/css/style_old.css

@@ -0,0 +1,416 @@
+/* --- Rozmiary i kursory --- */
+.large-checkbox {
+    width: 1.5em;
+    height: 1.5em;
+}
+
+.clickable-item {
+    cursor: pointer;
+}
+
+/* --- Kolory tła (nadpisane klasy Bootstrapa) --- */
+.bg-success {
+    background-color: #1e7e34 !important;
+}
+
+.btn-outline-light:hover {
+    background-color: #ffc107 !important;
+    color: #000 !important;
+    border-color: #ffc107 !important;
+}
+
+.progress-dark {
+    background-color: #212529 !important;
+    border-radius: 20px !important;
+    overflow: hidden;
+}
+
+.progress-bar {
+    border-radius: 0 !important;
+    transition: width 0.4s ease, background-color 0.4s ease;
+}
+
+.progress-bar:first-child {
+    border-top-left-radius: 20px !important;
+    border-bottom-left-radius: 20px !important;
+}
+
+.progress-bar:last-child {
+    border-top-right-radius: 20px !important;
+    border-bottom-right-radius: 20px !important;
+}
+
+
+/* rodzic już ma position-relative */
+.progress-label {
+    position: absolute;
+    top: 50%;
+    left: 50%;
+    transform: translate(-50%, -50%);
+    pointer-events: none;
+    /* klikalne przyciski obok paska nie ucierpią */
+    white-space: nowrap;
+}
+
+.progress-thin {
+    height: 12px;
+}
+
+.item-not-checked {
+    background-color: #2c2f33 !important;
+    color: white !important;
+}
+
+/* --- Styl przycisku wyboru pliku --- */
+input[type="file"]::file-selector-button {
+    background-color: #225d36;
+    color: #fff;
+    border: none;
+    padding: 0.5em 1em;
+    border-radius: 4px;
+    font-weight: bold;
+    cursor: pointer;
+    transition: background 0.2s;
+}
+
+/* --- Ciemniejsze alerty Bootstrapa --- */
+.alert-success {
+    background-color: #225d36 !important;
+    color: #eaffea !important;
+    border-color: #174428 !important;
+}
+
+.alert-danger {
+    background-color: #7a1f23 !important;
+    color: #ffeaea !important;
+    border-color: #531417 !important;
+}
+
+.alert-info {
+    background-color: #1d3a4d !important;
+    color: #eaf6ff !important;
+    border-color: #152837 !important;
+}
+
+.alert-warning {
+    background-color: #665c1e !important;
+    color: #fffbe5 !important;
+    border-color: #4d4415 !important;
+}
+
+/* Badge - kolory pasujące do ciemnych alertów */
+.badge.bg-success,
+.badge.text-bg-success {
+    background-color: #225d36 !important;
+    color: #eaffea !important;
+}
+
+.badge.bg-danger,
+.badge.text-bg-danger {
+    background-color: #7a1f23 !important;
+    color: #ffeaea !important;
+}
+
+.badge.bg-info,
+.badge.text-bg-info {
+    background-color: #1d3a4d !important;
+    color: #eaf6ff !important;
+}
+
+.badge.bg-warning,
+.badge.text-bg-warning {
+    background-color: #665c1e !important;
+    color: #fffbe5 !important;
+}
+
+.badge.bg-secondary,
+.badge.text-bg-secondary {
+    background-color: #343a40 !important;
+    color: #e2e3e5 !important;
+}
+
+.badge.bg-primary,
+.badge.text-bg-primary {
+    background-color: #184076 !important;
+    color: #e6f0ff !important;
+}
+
+.badge.bg-light,
+.badge.text-bg-light {
+    background-color: #444950 !important;
+    color: #f8f9fa !important;
+}
+
+.badge.bg-dark,
+.badge.text-bg-dark {
+    background-color: #181a1b !important;
+    color: #f8f9fa !important;
+}
+
+/* --- Styl dla własnych checkboxów --- */
+input[type="checkbox"].large-checkbox {
+    appearance: none;
+    -webkit-appearance: none;
+    -moz-appearance: none;
+    width: 1.5em;
+    height: 1.5em;
+    margin: 0;
+    padding: 0;
+    outline: none;
+    background: none;
+    cursor: pointer;
+    position: relative;
+    vertical-align: middle;
+}
+
+input[type="checkbox"].large-checkbox::before {
+    content: '✗';
+    color: #dc3545;
+    font-size: 1.5em;
+    font-weight: bold;
+    position: absolute;
+    left: 0;
+    top: 50%;
+    transform: translateY(-50%);
+    line-height: 1;
+    transition: color 0.2s;
+}
+
+input[type="checkbox"].large-checkbox:checked::before {
+    content: '✓';
+    color: #ffffff;
+}
+
+input[type="checkbox"].large-checkbox:disabled::before {
+    opacity: 0.5;
+    cursor: not-allowed;
+}
+
+input[type="checkbox"].large-checkbox:disabled {
+    cursor: not-allowed;
+}
+
+#tempToggle {
+    border-top-left-radius: 0;
+    border-bottom-left-radius: 0;
+}
+
+input.form-control {
+    border-top-right-radius: 0;
+    border-bottom-right-radius: 0;
+}
+
+.info-bar-fixed {
+    width: 100%;
+    color: #f8f9fa;
+    background-color: #212529;
+    border-radius: 12px 12px 0 0;
+    text-align: center;
+    padding: 10px 10px;
+    font-size: 0.95rem;
+    box-sizing: border-box;
+    margin-top: 2rem;
+    box-shadow: 0 -1px 4px rgba(0, 0, 0, 0.25);
+}
+
+@media (max-width: 768px) {
+    .info-bar-fixed {
+        position: static;
+        font-size: 0.85rem;
+        padding: 8px 4px;
+        border-radius: 0;
+    }
+}
+
+.table-responsive {
+    overflow-x: auto;
+    -webkit-overflow-scrolling: touch;
+}
+
+.table-responsive table {
+    min-width: 1000px;
+}
+
+.bg-dark .form-control::placeholder {
+    color: #ccc !important;
+    opacity: 1;
+}
+
+.toast-body {
+    color: #ffffff !important;
+    font-weight: 500 !important;
+}
+
+.toast {
+    animation: fadeInUp 0.5s ease;
+}
+
+@keyframes fadeInUp {
+    from {
+        opacity: 0;
+        transform: translateY(20px);
+    }
+
+    to {
+        opacity: 1;
+        transform: translateY(0);
+    }
+}
+
+#mass-add-list li.active {
+    background: #198754 !important;
+    color: #fff !important;
+    border: 1px solid #000000 !important;
+}
+
+#mass-add-list li {
+    transition: background 0.2s;
+}
+
+.quantity-input {
+    width: 60px;
+    background: #343a40;
+    color: #fff;
+    border: 1px solid #495057;
+    border-radius: 4px;
+    text-align: center;
+}
+
+.add-btn {
+    margin-left: 10px;
+}
+
+.quantity-controls {
+    min-width: 120px;
+    display: flex;
+    align-items: center;
+    justify-content: flex-end;
+    gap: 4px;
+}
+
+.list-group-item {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+}
+
+#empty-placeholder {
+    font-style: italic;
+    pointer-events: none;
+}
+
+#items li.hide-purchased {
+    display: none !important;
+}
+
+.list-group-item:first-child,
+.list-group-item:last-child {
+    border-radius: 0 !important;
+}
+
+.fade-out {
+    opacity: 0;
+    transition: opacity 0.5s ease;
+}
+
+@media (pointer: fine) {
+    .only-mobile {
+        display: none !important;
+    }
+}
+
+
+.ts-dropdown .active {
+    background-color: #495057 !important;
+}
+
+.pagination-dark .page-link {
+    color: #fff;
+    background-color: #212529;
+    border: 1px solid #495057;
+}
+
+.pagination-dark .page-link:hover {
+    background-color: #343a40;
+    border-color: #6c757d;
+    color: #fff;
+}
+
+.pagination-dark .page-item.active .page-link {
+    background-color: #0d6efd;
+    border-color: #0d6efd;
+    color: #fff;
+}
+
+.pagination-dark .page-item.disabled .page-link {
+    background-color: #2b3035;
+    border-color: #495057;
+    color: #6c757d;
+}
+
+.tom-dark .ts-control {
+    background-color: #212529 !important;
+    color: #fff !important;
+    border: 1px solid #495057 !important;
+    border-radius: 0.375rem;
+    min-height: 38px;
+    padding: 0.25rem 0.5rem;
+    box-sizing: border-box;
+}
+
+.tom-dark .ts-control .item {
+    background-color: #343a40 !important;
+    color: #fff !important;
+    border-radius: 0.25rem;
+    padding: 2px 8px;
+    margin-right: 4px;
+}
+
+.ts-dropdown {
+    background-color: #212529 !important;
+    color: #fff !important;
+    border: 1px solid #495057;
+    border-radius: 0.375rem;
+    z-index: 9999 !important;
+    max-height: 300px;
+    overflow-y: auto;
+}
+
+.ts-dropdown .active {
+    background-color: #495057 !important;
+    color: #fff !important;
+}
+
+td select.tom-dark {
+    width: 100%;
+    max-width: 100%;
+    box-sizing: border-box;
+}
+
+.table-dark.table-striped tbody tr:nth-of-type(odd) {
+    background-color: rgba(255, 255, 255, 0.025);
+}
+
+.table-dark tbody tr:hover {
+    background-color: rgba(255, 255, 255, 0.04);
+}
+
+.table-dark thead th {
+    background-color: #1c1f22;
+    color: #e1e1e1;
+    font-weight: 500;
+    border-bottom: 1px solid #3a3f44;
+}
+
+.table-dark td,
+.table-dark th {
+    padding: 0.6rem 0.75rem;
+    vertical-align: middle;
+    border-top: 1px solid #3a3f44;
+}
+
+.card .table {
+    border-radius: 0 !important;
+    overflow: hidden;
+    margin-bottom: 0;
+}

static/js/access_users.js

@@ -0,0 +1,176 @@
+(function () {
+    const $ = (s, root = document) => root.querySelector(s);
+    const $$ = (s, root = document) => Array.from(root.querySelectorAll(s));
+    const toast = (m, t = 'info') => (window.showToast ? window.showToast(m, t) : console.log(`[${t}]`, m));
+
+    function appendToken(box, user) {
+        const tokensBox = $('.tokens', box);
+        if (!tokensBox || !user?.id || !user?.username) return;
+        const empty = $('.no-perms', box);
+        if (empty) empty.remove();
+
+        const btn = document.createElement('button');
+        btn.type = 'button';
+        btn.className = 'btn btn-sm btn-outline-secondary rounded-pill token';
+        btn.dataset.userId = user.id;
+        btn.dataset.username = user.username;
+        btn.title = 'Kliknij, aby odebrać dostęp';
+        btn.innerHTML = `@${user.username} <span aria-hidden="true">×</span>`;
+        tokensBox.appendChild(btn);
+    }
+
+    function wantsJSON() {
+        return {
+            'Accept': 'application/json',
+            'X-Requested-With': 'fetch'
+        };
+    }
+
+    async function postAction(postUrl, nextPath, params) {
+        const form = new FormData();
+        for (const [k, v] of Object.entries(params)) form.set(k, v);
+        form.set('next', nextPath); // dla trybu HTML fallback
+
+        try {
+            const res = await fetch(postUrl, {
+                method: 'POST',
+                body: form,
+                credentials: 'same-origin',
+                headers: wantsJSON()
+            });
+
+            const ct = res.headers.get('content-type') || '';
+            if (ct.includes('application/json')) {
+                const data = await res.json().catch(() => ({}));
+                return { ok: !!data?.ok, data, status: res.status };
+            }
+            return { ok: res.ok, data: null, status: res.status };
+        } catch (e) {
+            console.error('POST failed', e);
+            return { ok: false, data: null, status: 0 };
+        }
+    }
+
+    function initEditor(box) {
+        if (!box || !box.classList?.contains('access-editor')) return;
+        if (box.dataset._accessEditorInit === '1') return;
+        box.dataset._accessEditorInit = '1';
+
+        const postUrl = box.dataset.postUrl || location.pathname;
+        const nextPath = box.dataset.next || location.pathname;
+        const suggestUrl = box.dataset.suggestUrl || '';
+        const grantAction = box.dataset.grantAction || 'grant';
+        const revokeField = box.dataset.revokeField || 'revoke_user_id';
+
+        const tokensBox = $('.tokens', box);
+        const input = $('.access-input', box);
+        const addBtn = $('.access-add', box);
+
+        // współdzielony datalist do sugestii
+        let datalist = $('#userHintsGeneric');
+        if (!datalist) {
+            datalist = document.createElement('datalist');
+            datalist.id = 'userHintsGeneric';
+            document.body.appendChild(datalist);
+        }
+        input?.setAttribute('list', datalist.id);
+
+        const unique = (arr) => Array.from(new Set(arr));
+        const parseUserText = (txt) => unique((txt || '').split(/[\s,;]+/g).map(s => s.trim().replace(/^@/, '').toLowerCase()).filter(Boolean));
+        const debounce = (fn, ms = 200) => { let t; return (...a) => { clearTimeout(t); t = setTimeout(() => fn(...a), ms); }; };
+
+        // Sugestie (GET JSON)
+        const renderHints = (users = []) => { datalist.innerHTML = users.slice(0, 20).map(u => `<option value="${u}">@${u}</option>`).join(''); };
+        let acCtrl = null;
+        const fetchHints = debounce(async (q) => {
+            if (!suggestUrl) return;
+            try {
+                acCtrl?.abort();
+                acCtrl = new AbortController();
+                const res = await fetch(`${suggestUrl}?q=${encodeURIComponent(q || '')}`, { credentials: 'same-origin', signal: acCtrl.signal });
+                if (!res.ok) return renderHints([]);
+                const data = await res.json().catch(() => ({ users: [] }));
+                renderHints(data.users || []);
+            } catch { renderHints([]); }
+        }, 200);
+
+        input?.addEventListener('focus', () => fetchHints(input.value));
+        input?.addEventListener('input', () => fetchHints(input.value));
+
+        // Revoke (klik w token)
+        box.addEventListener('click', async (e) => {
+            const btn = e.target.closest('.token');
+            if (!btn || !box.contains(btn)) return;
+
+            const userId = btn.dataset.userId;
+            const username = btn.dataset.username;
+            if (!userId) return toast('Brak identyfikatora użytkownika.', 'danger');
+
+            btn.disabled = true; btn.classList.add('disabled');
+            const res = await postAction(postUrl, nextPath, { [revokeField]: userId });
+
+            if (res.ok) {
+                btn.remove();
+                if (!$$('.token', box).length && tokensBox) {
+                    const empty = document.createElement('span');
+                    empty.className = 'no-perms text-warning small';
+                    empty.textContent = 'Brak dodanych uprawnień.';
+                    tokensBox.appendChild(empty);
+                }
+                toast(`Odebrano dostęp: @${username}`, 'success');
+            } else {
+                btn.disabled = false; btn.classList.remove('disabled');
+                toast(`Nie udało się odebrać dostępu @${username}`, 'danger');
+            }
+        });
+
+        // Grant (wiele loginów, bez przeładowania strony)
+        async function addUsers() {
+            const users = parseUserText(input?.value);
+            if (!users?.length) return toast('Podaj co najmniej jednego użytkownika', 'warning');
+
+            addBtn.disabled = true;
+            const prevText = addBtn.textContent;
+            addBtn.textContent = 'Dodaję…';
+
+            let okCount = 0, failCount = 0, appended = 0;
+
+            for (const u of users) {
+                const res = await postAction(postUrl, nextPath, { action: grantAction, grant_username: u });
+                if (res.ok) {
+                    okCount++;
+                    // jeśli backend odda JSON z userem – dolep token live
+                    if (res.data?.user) {
+                        appendToken(box, res.data.user);
+                        appended++;
+                    }
+                } else {
+                    failCount++;
+                }
+            }
+
+            addBtn.disabled = false;
+            addBtn.textContent = prevText;
+            if (input) input.value = '';
+
+            if (okCount) toast(`Dodano dostęp: ${okCount} użytkownika`, 'success');
+            if (failCount) toast(`Błędy przy dodawaniu: ${failCount}`, 'danger');
+
+            // fallback: jeśli nic nie dolepiliśmy (brak JSON), odśwież, by zobaczyć nowe tokeny
+            if (okCount && appended === 0) {
+                // opóźnij minimalnie, by toast mignął
+                setTimeout(() => location.reload(), 400);
+            }
+        }
+
+        addBtn?.addEventListener('click', addUsers);
+        input?.addEventListener('keydown', (e) => { if (e.key === 'Enter') { e.preventDefault(); addUsers(); } });
+    }
+
+    document.addEventListener('DOMContentLoaded', () => {
+        $$('.access-editor').forEach(initEditor);
+    });
+    document.addEventListener('shown.bs.modal', (ev) => {
+        $$('.access-editor', ev.target).forEach(initEditor);
+    });
+})();

static/js/admin_receipt_crop.js

@@ -13,16 +13,16 @@
 
         cropModal.addEventListener("shown.bs.modal", function (event) {
             const button = event.relatedTarget;
-            const imgSrc = button.getAttribute("data-img-src");
+            const baseSrc = button.getAttribute("data-img-src") || "";
+            const ver = button.getAttribute("data-version") || Date.now();
+            const sep = baseSrc.includes("?") ? "&" : "?";
+            cropImage.src = baseSrc + sep + "cb=" + ver;
+
             currentReceiptId = button.getAttribute("data-receipt-id");
-            cropImage.src = imgSrc;
 
             document.querySelectorAll('.cropper-container').forEach(e => e.remove());
-
             if (cropper) cropper.destroy();
-            cropImage.onload = () => {
-                cropper = cropUtils.initCropper(cropImage);
-            };
+            cropImage.onload = () => { cropper = cropUtils.initCropper(cropImage); };
         });
 
         cropModal.addEventListener("hidden.bs.modal", function () {

static/js/chart_controls.js

@@ -0,0 +1,179 @@
+// chart_controls.js
+// Logika UI: wybór zakresu, przełączanie dzienny/miesięczny, kategorie, show_all.
+// Współpracuje z window.loadExpenses (z expense_chart.js).
+document.addEventListener("DOMContentLoaded", function () {
+    const toggleMonthlySplit = document.getElementById("toggleMonthlySplit");
+    const toggleDailySplit = document.getElementById("toggleDailySplit");
+    const toggleCategory = document.getElementById("toggleCategorySplit");
+    const startDateInput = document.getElementById("startDate");
+    const endDateInput = document.getElementById("endDate");
+    const customRangeBtn = document.getElementById("customRangeBtn");
+    const showAllCheckbox = document.getElementById("showAllLists");
+
+    // pomocnicze
+    const iso = (d) => d.toISOString().split("T")[0];
+    const today = () => new Date();
+    const daysAgo = (n) => { const d = new Date(); d.setDate(d.getDate() - n); return d; };
+
+    function setActiveTimeSplit(active) {
+        const on = (btn) => { btn.classList.add("btn-primary"); btn.classList.remove("btn-outline-light"); btn.setAttribute("aria-pressed", "true"); };
+        const off = (btn) => { btn.classList.remove("btn-primary"); btn.classList.add("btn-outline-light"); btn.setAttribute("aria-pressed", "false"); };
+        if (active === "monthly") { on(toggleMonthlySplit); off(toggleDailySplit); }
+        else { on(toggleDailySplit); off(toggleMonthlySplit); }
+    }
+    function isDailyActive() { return toggleDailySplit?.classList.contains("btn-primary"); }
+
+    // ——— KLUCZOWE: jedno miejsce, które przeładowuje wykres zgodnie z aktualnym trybem ———
+    function reloadRespectingSplit(preferredRange = null) {
+        // preferredRange używamy dla przycisków typu monthly/quarterly/halfyearly/yearly
+        const sd = startDateInput?.value || null;
+        const ed = endDateInput?.value || null;
+
+        if (isDailyActive()) {
+            // Dzienny ZAWSZE z datami (fallback: ostatnie 30 dni), bo inaczej backend spadnie na monthly
+            const _sd = sd && ed ? sd : iso(daysAgo(30));
+            const _ed = sd && ed ? ed : iso(today());
+            window.loadExpenses("daily", _sd, _ed);
+            return;
+        }
+
+        // Miesięczny
+        if (sd && ed) {
+            window.loadExpenses("monthly", sd, ed);
+        } else if (preferredRange) {
+            window.loadExpenses(preferredRange);
+        } else {
+            window.loadExpenses("monthly");
+        }
+    }
+
+    // ——— Przełączniki czasu ———
+    toggleMonthlySplit?.addEventListener("click", () => {
+        setActiveTimeSplit("monthly");
+        reloadRespectingSplit("monthly");
+    });
+
+    toggleDailySplit?.addEventListener("click", () => {
+        setActiveTimeSplit("daily");
+        reloadRespectingSplit();
+    });
+
+    // ——— Podział na kategorie ———
+    toggleCategory?.addEventListener("click", function () {
+        const active = this.classList.contains("btn-primary");
+        if (active) {
+            this.classList.remove("btn-primary");
+            this.classList.add("btn-outline-light");
+            this.setAttribute("aria-pressed", "false");
+            this.textContent = "Przełącz na kategorie";
+            window.setCategorySplit(false);
+        } else {
+            this.classList.add("btn-primary");
+            this.classList.remove("btn-outline-light");
+            this.setAttribute("aria-pressed", "true");
+            this.textContent = "Przełącz na sumy";
+            window.setCategorySplit(true);
+        }
+
+        // porzucenie zakresu
+        document.querySelectorAll("#chartTab .range-btn").forEach(b => b.classList.remove("active"));
+        reloadRespectingSplit();
+    });
+
+
+    // ——— Własny zakres ———
+    customRangeBtn?.addEventListener("click", function () {
+        const sd = startDateInput?.value;
+        const ed = endDateInput?.value;
+        if (!(sd && ed)) return alert("Proszę wybrać obie daty!");
+        reloadRespectingSplit();
+    });
+
+    // ——— Predefiniowane zakresy pod wykresem ———
+    document.querySelectorAll("#chartTab .range-btn").forEach((btn) => {
+        btn.addEventListener("click", function () {
+            document.querySelectorAll("#chartTab .range-btn").forEach((b) => b.classList.remove("active"));
+            this.classList.add("active");
+            const r = this.getAttribute("data-range"); // last30days/currentmonth/monthly/quarterly/halfyearly/yearly
+
+            // Zakresy kubełkowane – bez start/end, bez "daily"
+            if (["monthly", "quarterly", "halfyearly", "yearly"].includes(r)) {
+                if (startDateInput) startDateInput.value = "";
+                if (endDateInput) endDateInput.value = "";
+                window.loadExpenses(r); // => /expenses_data?range=monthly|quarterly|halfyearly|yearly
+                return;
+            }
+
+            if (r === "currentmonth") {
+                const t = today();
+                const first = new Date(t.getFullYear(), t.getMonth(), 1);
+                if (isDailyActive()) {
+                    window.loadExpenses("daily", iso(first), iso(t));
+                } else {
+                    window.loadExpenses("monthly", iso(first), iso(t));
+                }
+                return;
+            }
+            if (r === "last30days") {
+                if (isDailyActive()) {
+                    window.loadExpenses("daily", iso(daysAgo(30)), iso(today()));
+                } else {
+                    window.loadExpenses("last30days");
+                }
+                return;
+            }
+
+            // reset pickera
+            if (startDateInput) startDateInput.value = "";
+            if (endDateInput) endDateInput.value = "";
+
+            reloadRespectingSplit(r);
+        });
+    });
+
+    // ——— KATEGORIE (🌐 Wszystkie + pojedyncze) ———
+    document.querySelectorAll(".category-filter").forEach((btn) => {
+        btn.addEventListener("click", function () {
+            // UI: podmień podświetlenie
+            document.querySelectorAll(".category-filter").forEach(b => {
+                b.classList.remove("btn-success");
+                b.classList.add("btn-outline-light");
+            });
+            this.classList.add("btn-success");
+            this.classList.remove("btn-outline-light");
+
+            // Zapisz filtr kategorii do globalnej zmiennej, którą odczytuje expense_chart.js
+            const cid = this.getAttribute("data-category-id") || "";
+            window.selectedCategoryId = cid;
+
+            // I ważne: przeładuj zgodnie z aktualnym trybem (to naprawia Twój przypadek #1)
+            reloadRespectingSplit();
+        });
+    });
+
+    // ——— SHOW ALL (Uwzględnij listy udostępnione/publiczne) ———
+    showAllCheckbox?.addEventListener("change", () => {
+        reloadRespectingSplit();
+    });
+
+
+    // ——— Inicjalizacja ———
+    // Podpowiedź dat do inputów
+
+
+    //if (startDateInput && endDateInput) {
+    //    startDateInput.value = iso(daysAgo(7));
+    //    endDateInput.value = iso(today());
+    //}
+
+    if (startDateInput && endDateInput) {
+        const now = new Date();
+        const startOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
+
+        startDateInput.value = iso(startOfMonth);
+        endDateInput.value = iso(now);
+    }
+
+    setActiveTimeSplit("daily");
+    reloadRespectingSplit();
+});

static/js/download_chart.js

@@ -0,0 +1,67 @@
+// download_chart.js — eksport PNG z ciemnym tłem (tymczasowo), bez wielokrotnego bindowania
+
+document.addEventListener("DOMContentLoaded", () => {
+    const dlBtn = document.getElementById("downloadMainChartBtn");
+    if (!dlBtn) return;
+
+    // helper: bezpieczna nazwa pliku
+    const sanitize = (s) =>
+        (s || "")
+            .normalize("NFD").replace(/[\u0300-\u036f]/g, "")
+            .replace(/[^a-zA-Z0-9-_]+/g, "_")
+            .replace(/_+/g, "_").replace(/^_+|_+$/g, "");
+
+    // helper: eksport z tymczasowym tłem
+    const exportChartPNG = (chart, bgColor = "#1e1e1e") => {
+        const canvas = chart.canvas;
+        const ctx = canvas.getContext("2d");
+
+        // 1) zapisz obraz
+        const snapshot = ctx.getImageData(0, 0, canvas.width, canvas.height);
+
+        // 2) podłóż tło pod istniejący rysunek
+        ctx.save();
+        ctx.globalCompositeOperation = "destination-over";
+        ctx.fillStyle = bgColor;
+        ctx.fillRect(0, 0, canvas.width, canvas.height);
+        ctx.restore();
+
+        // 3) wygeneruj PNG
+        const dataUrl = chart.toBase64Image("image/png", 1.0);
+
+        // 4) przywróć pierwotny obraz (transparentny)
+        ctx.putImageData(snapshot, 0, 0);
+
+        return dataUrl;
+    };
+
+    // jednorazowe bindowanie click
+    if (!dlBtn.dataset.bound) {
+        dlBtn.addEventListener("click", () => {
+            const chart = window.expensesChart || Chart.getChart(document.getElementById("expensesChart"));
+            if (!chart) return;
+
+            // nazwa: zakres + timestamp
+            const now = new Date();
+            const pad = (n) => String(n).padStart(2, "0");
+            const stamp = `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}_${pad(now.getHours())}-${pad(now.getMinutes())}-${pad(now.getSeconds())}`;
+            const rangeLabel = document.getElementById("chartRangeLabel")?.textContent || "";
+            const filename = `wydatki-${sanitize(rangeLabel)}-${stamp}.png`;
+
+            // (opcjonalnie) upewnij się, że layout jest świeży
+            chart.resize();
+            chart.update("none");
+
+            const a = document.createElement("a");
+            a.href = exportChartPNG(chart, "#1e1e1e"); // tu ustawiasz kolor tła eksportu
+            a.download = filename;
+            a.click();
+        });
+        dlBtn.dataset.bound = "1";
+    }
+
+    // aktywuj przycisk, gdy wykres istnieje
+    const enableIfReady = () => { dlBtn.disabled = !window.expensesChart; };
+    document.addEventListener("expensesChart:ready", enableIfReady);
+    enableIfReady();
+});

static/js/expense_chart.js

@@ -1,174 +1,150 @@
+// expense_chart.js
+// Czyste generowanie wykresu + publiczne API: window.loadExpenses, window.setCategorySplit
+// Współpracuje z backendem /expenses_data (range_type, start/end, by_category) – patrz app.py :contentReference[oaicite:3]{index=3}
+
 document.addEventListener("DOMContentLoaded", function () {
     let expensesChart = null;
-    let categorySplit = true;
-    const rangeLabel = document.getElementById("chartRangeLabel");
+    let categorySplit = false; // domyślnie wykres całościowy; przycisk w HTML startuje z aria-pressed="false"
 
+    const rangeLabel = document.getElementById("chartRangeLabel");
+    const showAllCheckbox = document.getElementById("showAllLists");
+    const ctx = document.getElementById("expensesChart")?.getContext("2d");
+
+    // Pomocnicze
+    const iso = (d) => d.toISOString().split("T")[0];
+    const today = () => new Date();
+    const daysAgo = (n) => { const d = new Date(); d.setDate(d.getDate() - n); return d; };
+
+    // Jeśli ktoś nie wstrzyknął globalnie selectedCategoryId (np. przez inny widok),
+    // zapewniamy istnienie zmiennej:
     if (typeof window.selectedCategoryId === "undefined") {
         window.selectedCategoryId = "";
     }
 
-    function loadExpenses(range = "currentmonth", startDate = null, endDate = null) {
-        let url = '/expenses_data?range=' + range;
+    // Ustawia tryb podziału na kategorie, bez odświeżania (kontroler zadzwoni potem w loadExpenses)
+    function setCategorySplit(on) {
+        categorySplit = !!on;
+    }
 
-        const showAllCheckbox = document.getElementById("showAllLists");
+    // Budowa URL dla /expenses_data zgodnie z backendem (range/start/end/show_all/category_id/by_category) :contentReference[oaicite:4]{index=4}
+    function buildUrl(range, startDate, endDate) {
+        let url = `/expenses_data?range=${encodeURIComponent(range)}`;
+
+        // show_all
         if (showAllCheckbox) {
-            url += showAllCheckbox.checked ? '&show_all=true' : '&show_all=false';
+            url += showAllCheckbox.checked ? "&show_all=true" : "&show_all=false";
         } else {
-            url += '&show_all=true';
+            url += "&show_all=true";
         }
 
+        // daty (dodaj tylko, gdy kompletne)
         if (startDate && endDate) {
-            url += `&start_date=${startDate}&end_date=${endDate}`;
+            url += `&start_date=${encodeURIComponent(startDate)}&end_date=${encodeURIComponent(endDate)}`;
         }
+
+        // filtr kategorii list (z listy, nie "podziału na kategorie" na wykresie)
         if (window.selectedCategoryId) {
-            url += `&category_id=${window.selectedCategoryId}`;
+            url += `&category_id=${encodeURIComponent(window.selectedCategoryId)}`;
         }
+
+        // podział na kategorie na wykresie
         if (categorySplit) {
-            url += '&by_category=true';
+            url += "&by_category=true";
         }
 
+        return url;
+    }
+
+    // Label dla UI
+    function applyRangeLabel(range, startDate, endDate) {
+        if (startDate && endDate) {
+            rangeLabel.textContent = `Widok: własny zakres (${startDate} → ${endDate})`;
+            return;
+        }
+        const map = {
+            last30days: "Widok: ostatnie 30 dni",
+            currentmonth: "Widok: bieżący miesiąc",
+            monthly: "Widok: miesięczne",
+            quarterly: "Widok: kwartalne",
+            halfyearly: "Widok: półroczne",
+            yearly: "Widok: roczne",
+            daily: "Widok: dzienne",
+        };
+        rangeLabel.textContent = map[range] || "Widok: miesięczne";
+    }
+
+    // Publiczne API – kontroler zawsze woła nas z odpowiednim 'range' i (dla daily) z datami.
+    function loadExpenses(range = "monthly", startDate = null, endDate = null) {
+        // Naprawa: daily bez dat => ostatnie 30 dni
+        if (range === "daily" && !(startDate && endDate)) {
+            startDate = iso(daysAgo(30));
+            endDate = iso(today());
+        }
+
+        const url = buildUrl(range, startDate, endDate);
+
         fetch(url, { cache: "no-store" })
-            .then(response => response.json())
-            .then(data => {
-                const ctx = document.getElementById('expensesChart').getContext('2d');
+            .then((r) => r.json())
+            .then((data) => {
+                if (!ctx) return;
 
-                if (expensesChart) {
-                    expensesChart.destroy();
-                }
+                if (expensesChart) { expensesChart.destroy(); window.expensesChart = null; }
+
+                //if (expensesChart) expensesChart.destroy();
 
                 const tooltipOptions = {
-                    mode: 'index',
+                    mode: "index",
                     intersect: false,
                     callbacks: {
                         label: function (context) {
-                            if (context.parsed.y === 0) {
-                                return ''; // pomija kategorie o wartości 0
-                            }
-                            return context.dataset.label + ': ' + context.parsed.y;
-                        }
-                    }
+                            if (context.parsed.y === 0) return "";
+                            return (context.dataset.label || "Suma") + ": " + context.parsed.y;
+                        },
+                    },
                 };
 
                 if (categorySplit) {
+                    // Stacked per-kategoria – backend zwraca datasets z labelami kategorii :contentReference[oaicite:6]{index=6}
                     expensesChart = new Chart(ctx, {
-                        type: 'bar',
-                        data: { labels: data.labels, datasets: data.datasets },
+
+                        type: "bar",
+                        data: { labels: data.labels || [], datasets: data.datasets || [] },
                         options: {
                             responsive: true,
-                            plugins: {
-                                tooltip: tooltipOptions,
-                                legend: { position: 'top' }
-                            },
-                            scales: {
-                                x: { stacked: true },
-                                y: { stacked: true, beginAtZero: true }
-                            }
-                        }
+                            plugins: { tooltip: tooltipOptions, legend: { position: "top" } },
+                            scales: { x: { stacked: true }, y: { stacked: true, beginAtZero: true } },
+                        },
                     });
                 } else {
+                    // Całościowo – backend zwraca labels + expenses (sumy) :contentReference[oaicite:7]{index=7}
                     expensesChart = new Chart(ctx, {
-                        type: 'bar',
+
+                        type: "bar",
                         data: {
-                            labels: data.labels,
+                            labels: data.labels || [],
                             datasets: [{
-                                label: 'Suma wydatków [PLN]',
-                                data: data.expenses,
-                                backgroundColor: '#0d6efd'
-                            }]
+                                label: "Suma wydatków [PLN]",
+                                data: data.expenses || [],
+                            }],
                         },
                         options: {
                             responsive: true,
-                            plugins: {
-                                tooltip: tooltipOptions
-                            },
-                            scales: { y: { beginAtZero: true } }
-                        }
+                            plugins: { tooltip: tooltipOptions },
+                            scales: { y: { beginAtZero: true } },
+                        },
                     });
                 }
 
-                if (startDate && endDate) {
-                    rangeLabel.textContent = `Widok: własny zakres (${startDate} → ${endDate})`;
-                } else {
-                    let labelText = "";
-                    if (range === "last30days") labelText = "Widok: ostatnie 30 dni";
-                    else if (range === "currentmonth") labelText = "Widok: bieżący miesiąc";
-                    else if (range === "monthly") labelText = "Widok: miesięczne";
-                    else if (range === "quarterly") labelText = "Widok: kwartalne";
-                    else if (range === "halfyearly") labelText = "Widok: półroczne";
-                    else if (range === "yearly") labelText = "Widok: roczne";
-                    rangeLabel.textContent = labelText;
-                }
+                // na potrzeby otwarciu w modalu
+                window.expensesChart = expensesChart;
+                document.dispatchEvent(new Event('expensesChart:ready'));
+
+                applyRangeLabel(range, startDate, endDate);
             })
-            .catch(error => console.error("Błąd pobierania danych:", error));
+            .catch((e) => console.error("Błąd pobierania danych:", e));
     }
 
-    // Udostępnienie globalne, żeby inne skrypty mogły wywołać reload
+    // Eksport publiczny dla kontrolerów
     window.loadExpenses = loadExpenses;
-
-    const toggleBtn = document.getElementById("toggleCategorySplit");
-    toggleBtn.addEventListener("click", function () {
-        categorySplit = !categorySplit;
-        if (categorySplit) {
-            this.textContent = "🔵 Pokaż całościowo";
-            this.classList.remove("btn-outline-warning");
-            this.classList.add("btn-outline-info");
-        } else {
-            this.textContent = "🎨 Pokaż podział na kategorie";
-            this.classList.remove("btn-outline-info");
-            this.classList.add("btn-outline-warning");
-        }
-        loadExpenses();
-    });
-
-    toggleBtn.textContent = "🔵 Pokaż całościowo";
-    toggleBtn.classList.remove("btn-outline-warning");
-    toggleBtn.classList.add("btn-outline-info");
-
-    const startDateInput = document.getElementById("startDate");
-    const endDateInput = document.getElementById("endDate");
-
-    const today = new Date();
-    const lastWeek = new Date(today);
-    lastWeek.setDate(today.getDate() - 7);
-    const formatDate = (d) => d.toISOString().split('T')[0];
-    startDateInput.value = formatDate(lastWeek);
-    endDateInput.value = formatDate(today);
-
-    document.getElementById('customRangeBtn').addEventListener('click', function () {
-        const startDate = startDateInput.value;
-        const endDate = endDateInput.value;
-        if (startDate && endDate) {
-            document.querySelectorAll('.range-btn').forEach(b => b.classList.remove('active'));
-            loadExpenses('custom', startDate, endDate);
-        } else {
-            alert("Proszę wybrać obie daty!");
-        }
-    });
-
-    document.querySelectorAll('.range-btn').forEach(btn => {
-        btn.addEventListener('click', function () {
-            document.querySelectorAll('.range-btn').forEach(b => b.classList.remove('active'));
-            this.classList.add('active');
-            const range = this.getAttribute('data-range');
-
-            if (range === "currentmonth") {
-                const today = new Date();
-                const firstDay = new Date(today.getFullYear(), today.getMonth(), 1);
-                const formatDate = (d) => d.toISOString().split('T')[0];
-                loadExpenses('custom', formatDate(firstDay), formatDate(today));
-            } else {
-                loadExpenses(range);
-            }
-        });
-    });
-
-    // Automatyczne ładowanie danych po przełączeniu na zakładkę Wykres
-    document.getElementById('chart-tab').addEventListener('shown.bs.tab', function () {
-        loadExpenses();
-    });
-
-    // Jeśli jesteśmy od razu na zakładce Wykres
-    if (document.getElementById('chart-tab').classList.contains('active')) {
-        loadExpenses("currentmonth");
-    }
+    window.setCategorySplit = setCategorySplit;
 });

static/js/lists_access.js

@@ -0,0 +1,254 @@
+(function () {
+    const $ = (s, root = document) => root.querySelector(s);
+    const $$ = (s, root = document) => Array.from(root.querySelectorAll(s));
+
+    const filterInput = $('#listFilter');
+    const filterCount = $('#filterCount');
+    const selectAll = $('#selectAll');
+    const bulkTokens = $('#bulkTokens');
+    const bulkInput = $('#bulkUsersInput');
+    const bulkBtn = $('#bulkAddBtn');
+    const datalist = $('#userHints');
+
+    const unique = (arr) => Array.from(new Set(arr));
+    const parseUserText = (txt) => unique((txt || '')
+        .split(/[\s,;]+/g)
+        .map(s => s.trim().replace(/^@/, '').toLowerCase())
+        .filter(Boolean)
+    );
+
+    const selectedListIds = () =>
+        $$('.row-check:checked').map(ch => ch.dataset.listId);
+
+    const visibleRows = () =>
+        $$('#listsTable tbody tr').filter(r => r.style.display !== 'none');
+
+    // ===== Podpowiedzi (datalist) z DOM-u =====
+    (function buildHints() {
+        const names = new Set();
+        $$('.owner-username').forEach(el => names.add(el.dataset.username));
+        $$('.permitted-username').forEach(el => names.add(el.dataset.username));
+        // również tokeny już wyrenderowane
+        $$('.token[data-username]').forEach(el => names.add(el.dataset.username));
+        datalist.innerHTML = Array.from(names)
+            .sort((a, b) => a.localeCompare(b))
+            .map(u => `<option value="${u}">@${u}</option>`)
+            .join('');
+    })();
+
+    // ===== Live filter =====
+    function applyFilter() {
+        const q = (filterInput?.value || '').trim().toLowerCase();
+        let shown = 0;
+        $$('#listsTable tbody tr').forEach(tr => {
+            const hay = `${tr.dataset.id || ''} ${tr.dataset.title || ''} ${tr.dataset.owner || ''}`;
+            const ok = !q || hay.includes(q);
+            tr.style.display = ok ? '' : 'none';
+            if (ok) shown++;
+        });
+        if (filterCount) filterCount.textContent = shown ? `Widoczne: ${shown}` : 'Brak wyników';
+    }
+    filterInput?.addEventListener('input', applyFilter);
+    applyFilter();
+
+    // ===== Select all =====
+    selectAll?.addEventListener('change', () => {
+        visibleRows().forEach(tr => {
+            const cb = tr.querySelector('.row-check');
+            if (cb) cb.checked = selectAll.checked;
+        });
+    });
+
+    // ===== Copy share URL =====
+    $$('.copy-share').forEach(btn => {
+        btn.addEventListener('click', async () => {
+            const url = btn.dataset.url;
+            try {
+                await navigator.clipboard.writeText(url);
+                showToast('Skopiowano link udostępnienia', 'success');
+            } catch {
+                const ta = Object.assign(document.createElement('textarea'), { value: url });
+                document.body.appendChild(ta); ta.select(); document.execCommand('copy'); ta.remove();
+                showToast('Skopiowano link udostępnienia', 'success');
+            }
+        });
+    });
+
+    // ===== Tokenized users field (global – belka) =====
+    function addGlobalToken(username) {
+        if (!username) return;
+        const exists = $(`.user-token[data-user="${username}"]`, bulkTokens);
+        if (exists) return;
+        const token = document.createElement('span');
+        token.className = 'badge rounded-pill text-bg-secondary user-token';
+        token.dataset.user = username;
+        token.innerHTML = `@${username} <button type="button" class="btn btn-sm btn-link p-0 ms-1 text-white">✕</button>`;
+        token.querySelector('button').addEventListener('click', () => token.remove());
+        bulkTokens.appendChild(token);
+    }
+    bulkInput?.addEventListener('keydown', (e) => {
+        if (e.key === 'Enter') {
+            e.preventDefault();
+            parseUserText(bulkInput.value).forEach(addGlobalToken);
+            bulkInput.value = '';
+        }
+    });
+    bulkInput?.addEventListener('change', () => {
+        parseUserText(bulkInput.value).forEach(addGlobalToken);
+        bulkInput.value = '';
+    });
+
+    // ===== Bulk grant (z belki) =====
+    async function bulkGrant() {
+        const lists = selectedListIds();
+        const users = $$('.user-token', bulkTokens).map(t => t.dataset.user);
+
+        if (!lists.length) { showToast('Zaznacz przynajmniej jedną listę', 'warning'); return; }
+        if (!users.length) { showToast('Dodaj przynajmniej jednego użytkownika', 'warning'); return; }
+
+        bulkBtn.disabled = true;
+        bulkBtn.textContent = 'Pracuję…';
+
+        const url = location.pathname + location.search;
+        let ok = 0, fail = 0;
+
+        for (const lid of lists) {
+            for (const u of users) {
+                const form = new FormData();
+                form.set('action', 'grant');
+                form.set('target_list_id', lid);
+                form.set('grant_username', u);
+
+                try {
+                    const res = await fetch(url, { method: 'POST', body: form, credentials: 'same-origin' });
+                    if (res.ok) ok++; else fail++;
+                } catch { fail++; }
+            }
+        }
+
+        bulkBtn.disabled = false;
+        bulkBtn.textContent = '➕ Nadaj dostęp';
+
+        showToast(`Gotowe. Sukcesy: ${ok}${fail ? `, błędy: ${fail}` : ''}`, fail ? 'danger' : 'success');
+        location.reload();
+    }
+    bulkBtn?.addEventListener('click', bulkGrant);
+
+    // ===== Per-row "Access editor" (tokeny + dodawanie) =====
+    async function postAction(params) {
+        const url = location.pathname + location.search;
+        const form = new FormData();
+        for (const [k, v] of Object.entries(params)) form.set(k, v);
+        const res = await fetch(url, { method: 'POST', body: form, credentials: 'same-origin' });
+        return res.ok;
+    }
+
+    // Delegacja zdarzeń: kliknięcie tokenu = revoke
+    document.addEventListener('click', async (e) => {
+        const btn = e.target.closest('.access-editor .token');
+        if (!btn) return;
+
+        const wrapper = btn.closest('.access-editor');
+        const listId = wrapper?.dataset.listId;
+        const userId = btn.dataset.userId;
+        const username = btn.dataset.username;
+
+        if (!listId || !userId) return;
+
+        btn.disabled = true;
+        btn.classList.add('disabled');
+
+        const ok = await postAction({
+            action: 'revoke',
+            target_list_id: listId,
+            revoke_user_id: userId
+        });
+
+        if (ok) {
+            btn.remove();
+            const tokens = $$('.token', wrapper);
+            if (!tokens.length) {
+                // pokaż info „brak uprawnień”
+                let empty = $('.no-perms', wrapper);
+                if (!empty) {
+                    empty = document.createElement('span');
+                    empty.className = 'text-warning small no-perms';
+                    empty.textContent = 'Brak dodanych uprawnień.';
+                    $('.tokens', wrapper).appendChild(empty);
+                }
+            }
+            showToast(`Odebrano dostęp: @${username}`, 'success');
+        } else {
+            btn.disabled = false;
+            btn.classList.remove('disabled');
+            showToast(`Nie udało się odebrać dostępu @${username}`, 'danger');
+        }
+    });
+
+    // Dodawanie wielu użytkowników per-row
+    document.addEventListener('click', async (e) => {
+        const addBtn = e.target.closest('.access-editor .access-add');
+        if (!addBtn) return;
+
+        const wrapper = addBtn.closest('.access-editor');
+        const listId = wrapper?.dataset.listId;
+        const input = $('.access-input', wrapper);
+        if (!listId || !input) return;
+
+        const users = parseUserText(input.value);
+        if (!users.length) { showToast('Podaj co najmniej jednego użytkownika', 'warning'); return; }
+
+        addBtn.disabled = true;
+        addBtn.textContent = 'Dodaję…';
+
+        let okCount = 0, failCount = 0;
+
+        for (const u of users) {
+            const ok = await postAction({
+                action: 'grant',
+                target_list_id: listId,
+                grant_username: u
+            });
+            if (ok) {
+                okCount++;
+                // usuń info „brak uprawnień”
+                $('.no-perms', wrapper)?.remove();
+                // dodaj token jeśli nie ma
+                const exists = $(`.token[data-username="${u}"]`, wrapper);
+                if (!exists) {
+                    const token = document.createElement('button');
+                    token.type = 'button';
+                    token.className = 'btn btn-sm btn-outline-secondary rounded-pill token';
+                    token.dataset.username = u;
+                    token.dataset.userId = ''; // nie znamy ID — token nadal klikany, ale bez revoke po ID
+                    token.title = '@' + u;
+                    token.innerHTML = `@${u} <span aria-hidden="true">×</span>`;
+                    $('.tokens', wrapper).appendChild(token);
+                }
+            } else {
+                failCount++;
+            }
+        }
+
+        addBtn.disabled = false;
+        addBtn.textContent = '➕ Dodaj';
+        input.value = '';
+
+        if (okCount) showToast(`Dodano dostęp: ${okCount} użytk.`, 'success');
+        if (failCount) showToast(`Błędy przy dodawaniu: ${failCount}`, 'danger');
+
+        // Odśwież, by mieć poprawne user_id w tokenach (backend wie lepiej)
+        if (okCount) location.reload();
+    });
+
+    // Enter w polu per-row = zadziałaj jak przycisk
+    document.addEventListener('keydown', (e) => {
+        const inp = e.target.closest('.access-editor .access-input');
+        if (inp && e.key === 'Enter') {
+            e.preventDefault();
+            const btn = inp.closest('.access-editor')?.querySelector('.access-add');
+            btn?.click();
+        }
+    });
+
+})();

static/js/modal_chart.js

@@ -0,0 +1,118 @@
+// modal_chart.js — final: kopiuje kolory z oryginałów, bez fallbacków i bez debugów
+
+function openChartFullscreen(sourceChartIdOrKey, title) {
+    const modalEl = document.getElementById("chartFullscreenModal");
+    const canvas = document.getElementById("chartFullscreenCanvas");
+    const titleEl = document.getElementById("chartModalTitle");
+    if (titleEl) titleEl.textContent = title || "Wykres";
+
+    // Znajdź wykres źródłowy (po elemencie, id Chart.js lub globalu)
+    const srcEl = document.getElementById(sourceChartIdOrKey);
+    const srcChart =
+        (srcEl && Chart.getChart(srcEl)) ||
+        Chart.getChart(sourceChartIdOrKey) ||
+        window[sourceChartIdOrKey] ||
+        window.expensesChart ||
+        null;
+
+    if (!srcChart) {
+        bootstrap.Modal.getOrCreateInstance(modalEl).show();
+        return;
+    }
+
+    // Skopiuj labels i datasets 1:1 (tylko bezpieczne klucze, żeby nie przenosić referencji Chart.js)
+    const safeDataset = (d) => {
+        const out = {
+            // dane i opis
+            label: d.label,
+            data: Array.isArray(d.data) ? d.data.slice() : [],
+            type: d.type,
+            // kolory / styl — dokładnie z oryginału, jeśli były
+            backgroundColor: d.backgroundColor,
+            borderColor: d.borderColor,
+            borderWidth: d.borderWidth,
+            borderSkipped: d.borderSkipped,
+            // stacking / kolejność
+            stack: d.stack,
+            order: d.order,
+            // wszystko co może być ważne dla Twoich barów/konfiguracji
+            parsing: d.parsing,
+            indexAxis: d.indexAxis,
+        };
+        // usuń klucze undefined (Chart.js lubi czyste configi)
+        Object.keys(out).forEach((k) => out[k] === undefined && delete out[k]);
+        return out;
+    };
+
+    const freshData = {
+        labels: Array.isArray(srcChart.data?.labels) ? srcChart.data.labels.slice() : [],
+        datasets: (srcChart.data?.datasets || []).map(safeDataset),
+    };
+
+    // Typ wykresu z oryginału (np. "bar")
+    const chartType = (srcChart.config && srcChart.config.type) || "bar";
+
+    // Minimalne, bezpieczne opcje: responsywność + stacking + orientacja
+    const scx = srcChart.config?.options?.scales?.x || {};
+    const scy = srcChart.config?.options?.scales?.y || {};
+
+    const freshOptions = {
+        responsive: true,
+        maintainAspectRatio: false,
+        // jeżeli oryginał miał pion/poziom, zachowaj
+        indexAxis: srcChart.config?.options?.indexAxis || "x",
+        // nie kopiujemy całych pluginów (unikamy referencji) — domyślne legend/tooltip są OK
+        plugins: {},
+        scales: {
+            x: { stacked: !!scx.stacked },
+            y: { stacked: !!scy.stacked, beginAtZero: scy.beginAtZero !== false },
+        },
+    };
+
+    // Helper: zniszcz wykres na canvasie modala, jeśli istnieje
+    const destroyOnCanvas = () => {
+        if (canvas._chartInstance) {
+            try { canvas._chartInstance.destroy(); } catch { }
+            canvas._chartInstance = null;
+        }
+        const existing = Chart.getChart(canvas);
+        if (existing) {
+            try { existing.destroy(); } catch { }
+        }
+    };
+    destroyOnCanvas();
+
+    // Po pokazaniu modala twórz wykres (gdy ma już wymiary)
+    const onShown = () => {
+        destroyOnCanvas();
+        const ctx = canvas.getContext("2d");
+        canvas._chartInstance = new Chart(ctx, {
+            type: chartType,
+            data: freshData,
+            options: freshOptions,
+        });
+        // lekki nudge layoutu
+        requestAnimationFrame(() => {
+            canvas._chartInstance.resize();
+            canvas._chartInstance.update();
+        });
+    };
+
+    const onHidden = () => { destroyOnCanvas(); };
+
+    const modal = bootstrap.Modal.getOrCreateInstance(modalEl);
+    modalEl.addEventListener("shown.bs.modal", onShown, { once: true });
+    modalEl.addEventListener("hidden.bs.modal", onHidden, { once: true });
+
+    modal.show();
+}
+
+// Odblokuj ⛶ gdy bazowy wykres gotowy
+document.addEventListener("expensesChart:ready", () => {
+    const b = document.getElementById("openFsBtn");
+    if (b) b.disabled = false;
+});
+document.addEventListener("DOMContentLoaded", () => {
+    const b = document.getElementById("openFsBtn");
+    if (b && window.expensesChart) b.disabled = false;
+});

static/js/user_receipt_crop.js

@@ -13,16 +13,16 @@
 
         cropModal.addEventListener("shown.bs.modal", function (event) {
             const button = event.relatedTarget;
-            const imgSrc = button.getAttribute("data-img-src");
+            const baseSrc = button.getAttribute("data-img-src") || "";
+            const ver = button.getAttribute("data-version") || Date.now();
+            const sep = baseSrc.includes("?") ? "&" : "?";
+            cropImage.src = baseSrc + sep + "cb=" + ver;
+
             currentReceiptId = button.getAttribute("data-receipt-id");
-            cropImage.src = imgSrc;
 
             document.querySelectorAll('.cropper-container').forEach(e => e.remove());
-
             if (cropper) cropper.destroy();
-            cropImage.onload = () => {
-                cropper = cropUtils.initCropper(cropImage);
-            };
+            cropImage.onload = () => { cropper = cropUtils.initCropper(cropImage); };
         });
 
         cropModal.addEventListener("hidden.bs.modal", function () {

templates/admin/admin_lists_access.html

@@ -1,179 +0,0 @@
-{% extends 'base.html' %}
-{% block title %}Zarządzanie dostępem do list{% endblock %}
-
-{% block content %}
-<div class="d-flex justify-content-between align-items-center flex-wrap mb-4">
-<h2 class="mb-2">🔐{% if list_id %} Zarządzanie dostępem listy #{{ list_id }}{% else %} Zarządzanie dostępem do list {% endif %}</h2>
-    <div>
-        {% if list_id %}
-            <a href="{{ url_for('admin_lists_access') }}" class="btn btn-outline-light me-2">Powrót do wszystkich list</a>
-        {% endif %}
-        <a href="{{ url_for('admin_panel') }}" class="btn btn-outline-secondary">← Powrót do panelu</a>
-    </div>
-</div>
-
-<div class="card bg-dark text-white mb-5">
-    <div class="card-body">
-        <form method="post">
-            <input type="hidden" name="action" value="save_changes">
-
-            <div class="table-responsive">
-                <table class="table table-dark align-middle sortable">
-                    <thead>
-                        <tr>
-                            <th scope="col">ID</th>
-                            <th scope="col">Nazwa listy</th>
-                            <th scope="col">Właściciel</th>
-                            <th scope="col">Utworzono</th>
-                            <th scope="col">Statusy</th>
-                            <th scope="col">Udostępnianie</th>
-                            <th scope="col">Uprawnienia</th>
-                        </tr>
-                    </thead>
-                    <tbody>
-                        {% for l in lists %}
-                        <tr>
-                            <td>
-                                {{ l.id }}
-                                <input type="hidden" name="visible_ids" value="{{ l.id }}">
-                            </td>
-
-                            <td class="fw-bold align-middle">
-                                <a href="{{ url_for('view_list', list_id=l.id) }}" class="text-white">{{ l.title }}</a>
-                            </td>
-
-                            <td>
-                                {% if l.owner %}
-                                👤 {{ l.owner.username }} ({{ l.owner.id }})
-                                {% else %}-{% endif %}
-                            </td>
-
-                            <td>{{ l.created_at.strftime('%Y-%m-%d %H:%M') if l.created_at else '-' }}</td>
-
-                            <td style="min-width: 220px;">
-                                <div class="form-check form-switch">
-                                    <input class="form-check-input" type="checkbox" id="pub_{{ l.id }}"
-                                        name="is_public_{{ l.id }}" {% if l.is_public %}checked{% endif %}>
-                                    <label class="form-check-label" for="pub_{{ l.id }}">🌐 Publiczna</label>
-                                </div>
-                                <div class="form-check form-switch">
-                                    <input class="form-check-input" type="checkbox" id="tmp_{{ l.id }}"
-                                        name="is_temporary_{{ l.id }}" {% if l.is_temporary %}checked{% endif %}>
-                                    <label class="form-check-label" for="tmp_{{ l.id }}">⏳ Tymczasowa</label>
-                                </div>
-                                <div class="form-check form-switch">
-                                    <input class="form-check-input" type="checkbox" id="arc_{{ l.id }}"
-                                        name="is_archived_{{ l.id }}" {% if l.is_archived %}checked{% endif %}>
-                                    <label class="form-check-label" for="arc_{{ l.id }}">📦 Archiwalna</label>
-                                </div>
-                            </td>
-
-                            <td style="min-width: 220px;">
-                                {% if l.share_token %}
-                                {% set share_url = url_for('shared_list', token=l.share_token, _external=True) %}
-                                <div class="d-flex align-items-center gap-2">
-                                    <div class="flex-grow-1 text-truncate mono" title="{{ share_url }}">
-                                        {{ share_url }}
-                                    </div>
-                                </div>
-                                <div class="text-info small">
-                                    {% if l.is_public %}Lista widoczna publicznie{% else %}Lista dostępna przez
-                                    link/uprawnienia{%
-                                    endif %}
-                                </div>
-                                {% else %}
-                                <div class="text-warning small">Brak tokenu</div>
-                                {% endif %}
-                            </td>
-
-                            <td style="min-width: 320px;">
-                                <ul class="list-group list-group-flush mb-2">
-                                    {% for u in permitted_by_list.get(l.id, []) %}
-                                    <li
-                                        class="list-group-item bg-dark text-white d-flex justify-content-between align-items-center border-secondary">
-                                        <div>
-                                            <span class="fw-semibold">@{{ u.username }}</span>
-                                        </div>
-                                        <form method="post" class="m-0"
-                                            onsubmit="return confirm('Odebrać dostęp @{{ u.username }}?');">
-                                            <input type="hidden" name="action" value="revoke">
-                                            <input type="hidden" name="target_list_id" value="{{ l.id }}">
-                                            <input type="hidden" name="revoke_user_id" value="{{ u.id }}">
-                                            <button type="submit" class="btn btn-sm btn-outline-danger">🚫
-                                                Odbierz</button>
-                                        </form>
-                                    </li>
-                                    {% endfor %}
-                                    {% if permitted_by_list.get(l.id, [])|length == 0 %}
-                                    <li class="list-group-item bg-dark text-white border-secondary">
-                                        <div class="text-warning small">Brak dodanych uprawnień.</div>
-                                    </li>
-                                    {% endif %}
-                                </ul>
-
-                                <!-- Nadawanie dostępu -->
-                                <form method="post" class="m-0">
-                                    <input type="hidden" name="action" value="grant">
-                                    <input type="hidden" name="target_list_id" value="{{ l.id }}">
-                                    <div class="input-group input-group-sm">
-                                        <input type="text" name="grant_username"
-                                            class="form-control bg-dark text-white border-secondary"
-                                            placeholder="nazwa użytkownika">
-                                        <button type="submit" class="btn btn-outline-light">➕ Dodaj</button>
-                                    </div>
-                                </form>
-
-                            </td>
-                        </tr>
-                        {% endfor %}
-                        {% if lists|length == 0 %}
-                        <tr>
-                            <td colspan="7" class="text-center py-4">Brak list do wyświetlenia</td>
-                        </tr>
-                        {% endif %}
-                    </tbody>
-                </table>
-            </div>
-
-            <div class="mt-3">
-                <button type="submit" class="btn btn-sm btn-outline-light">💾 Zapisz zmiany</button>
-            </div>
-        </form>
-    </div>
-</div>
-
-{% if not list_id %}
-<hr>
-<div class="d-flex justify-content-between align-items-center mt-4">
-    <form method="get" class="d-flex align-items-center">
-        <label for="per_page" class="me-2">🔢 Pozycji na stronę:</label>
-        <select id="per_page" name="per_page" class="form-select form-select-sm me-2"
-            onchange="this.form.page.value = 1; this.form.submit();">
-            <option value="25" {% if per_page==25 %}selected{% endif %}>25</option>
-            <option value="50" {% if per_page==50 %}selected{% endif %}>50</option>
-            <option value="100" {% if per_page==100 %}selected{% endif %}>100</option>
-        </select>
-        <input type="hidden" name="page" value="{{ page }}">
-    </form>
-
-    <nav aria-label="Nawigacja stron">
-        <ul class="pagination pagination-dark mb-0">
-            <li class="page-item {% if page <= 1 %}disabled{% endif %}">
-                <a class="page-link"
-                    href="?{{ query_string }}{% if query_string %}&{% endif %}page={{ page - 1 }}">«</a>
-            </li>
-            {% for p in range(1, total_pages + 1) %}
-            <li class="page-item {% if p == page %}active{% endif %}">
-                <a class="page-link" href="?{{ query_string }}{% if query_string %}&{% endif %}page={{ p }}">{{ p }}</a>
-            </li>
-            {% endfor %}
-            <li class="page-item {% if page >= total_pages %}disabled{% endif %}">
-                <a class="page-link"
-                    href="?{{ query_string }}{% if query_string %}&{% endif %}page={{ page + 1 }}">»</a>
-            </li>
-        </ul>
-    </nav>
-</div>
-{% endif %}
-
-{% endblock %}

templates/admin/admin_panel.html

@@ -218,7 +218,8 @@
         — <strong>{{ month_str|replace('-', ' / ') }}</strong>
         {% endif %}
       </h3>
-      <form method="post" action="{{ url_for('admin_delete_list') }}" onsubmit="return confirm('Na pewno usunąć tę listę?')" class="d-inline">
+      <form method="post" action="{{ url_for('admin_delete_list') }}"
+        onsubmit="return confirm('Na pewno usunąć tę listę?')" class="d-inline">
         <div class="table-responsive">
           <table class="table table-dark align-middle sortable">
             <thead>
@@ -350,7 +351,7 @@
       checkboxes.forEach(cb => cb.checked = this.checked);
     });
   </script>
-  <script src="{{ url_for('static_bp.serve_js', filename='preview_list_modal.js') }}"></script>
+  <script src="{{ url_for('static_bp.serve_js', filename='preview_list_modal.js') }}?v={{ APP_VERSION }}"></script>
   {% endblock %}
 
   {% endblock %}

templates/admin/edit_list.html

@@ -122,10 +122,9 @@
       <div class="mb-4 border-top pt-3 mt-4">
         <h5 class="mb-3">🔐 Użytkownicy z dostępem</h5>
 
-       <a class="btn btn-outline-warning btn-sm mb-3"
-         href="{{ url_for('admin_lists_access', list_id=list.id) }}">
-         ⚙️ Edytuj uprawnienia
-       </a>
+        <a class="btn btn-outline-warning btn-sm mb-3" href="{{ url_for('admin_lists_access', list_id=list.id) }}">
+          ⚙️ Edytuj uprawnienia
+        </a>
 
         {% if permitted_users %}
         <ul class="list-group list-group-flush mb-3">
@@ -302,5 +301,5 @@
 
 {% endblock %}
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js', filename='select.js') }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='select.js') }}?v={{ APP_VERSION }}"></script>
 {% endblock %}

templates/admin/list_products.html

@@ -168,8 +168,8 @@
 </div>
 
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js', filename='product_suggestion.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='table_search.js') }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='product_suggestion.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='table_search.js') }}?v={{ APP_VERSION }}"></script>
 {% endblock %}
 
 {% endblock %}

templates/admin/lists_access.html

@@ -0,0 +1,211 @@
+{% extends 'base.html' %}
+{% block title %}Zarządzanie dostępem do list{% endblock %}
+
+{% block content %}
+<div class="d-flex justify-content-between align-items-center flex-wrap mb-3">
+  <h2 class="mb-2">🔐{% if list_id %} Zarządzanie dostępem listy #{{ list_id }}{% else %} Zarządzanie dostępem do list
+    {% endif %}</h2>
+  <div class="d-flex gap-2">
+    {% if list_id %}
+    <a href="{{ url_for('admin_lists_access') }}" class="btn btn-outline-light">Powrót do wszystkich list</a>
+    {% endif %}
+    <a href="{{ url_for('admin_panel') }}" class="btn btn-outline-secondary">← Powrót do panelu</a>
+  </div>
+</div>
+
+<!-- STICKY ACTION BAR -->
+<div id="bulkBar" class="position-sticky top-0 z-3 mb-3" style="backdrop-filter: blur(6px);">
+  <div class="card bg-dark border-secondary shadow-sm">
+    <div class="card-body py-2 d-flex flex-wrap align-items-center gap-3">
+      <div class="d-flex align-items-center gap-2">
+        <input id="selectAll" class="form-check-input" type="checkbox" />
+        <label for="selectAll" class="form-check-label">Zaznacz wszystko</label>
+      </div>
+
+      <div class="vr text-secondary"></div>
+
+      <div class="flex-grow-1 d-flex align-items-center gap-2">
+        <input id="listFilter" class="form-control form-control-sm bg-dark text-white border-secondary"
+          placeholder="Szukaj po tytule/ID/właścicielu…" aria-label="Filtruj listy">
+        <span class="text-secondary small ms-1" id="filterCount">—</span>
+      </div>
+
+      <div class="vr text-secondary d-none d-md-block"></div>
+
+      <!-- BULK GRANT -->
+      <div class="flex-grow-1">
+        <div class="input-group input-group-sm">
+          <input id="bulkUsersInput" class="form-control bg-dark text-white border-secondary"
+            placeholder="Podaj użytkowników (po przecinku lub enterach)" list="userHints">
+          <button id="bulkAddBtn" class="btn btn-outline-light" type="button">➕ Nadaj dostęp</button>
+        </div>
+        <div id="bulkTokens" class="d-flex flex-wrap gap-2 mt-2"></div>
+      </div>
+    </div>
+  </div>
+</div>
+
+
+<!-- HINTS -->
+<datalist id="userHints"></datalist>
+
+<div class="card bg-dark text-white mb-5">
+  <div class="card-body">
+    <form id="statusForm" method="post">
+      <input type="hidden" name="action" value="save_changes">
+
+      <div class="table-responsive">
+        <table class="table table-dark align-middle" id="listsTable">
+          <thead class="align-middle">
+            <tr>
+              <th scope="col" style="width:36px;"></th>
+              <th scope="col">ID</th>
+              <th scope="col">Nazwa listy</th>
+              <th scope="col">Właściciel</th>
+              <th scope="col">Utworzono</th>
+              <th scope="col">Statusy</th>
+              <th scope="col">Udostępnianie</th>
+              <th scope="col" style="min-width: 340px;">Uprawnienia</th>
+            </tr>
+          </thead>
+          <tbody>
+            {% for l in lists %}
+            <tr data-id="{{ l.id }}" data-title="{{ l.title|lower }}"
+              data-owner="{{ (l.owner.username if l.owner else '-')|lower }}">
+              <td>
+                <input class="row-check form-check-input" type="checkbox" data-list-id="{{ l.id }}">
+                <input type="hidden" name="visible_ids" value="{{ l.id }}">
+              </td>
+
+              <td class="text-nowrap">#{{ l.id }}</td>
+
+              <td class="fw-bold align-middle">
+                <a href="{{ url_for('view_list', list_id=l.id) }}" class="text-white text-decoration-none">{{ l.title
+                  }}</a>
+              </td>
+
+              <td>
+                {% if l.owner %}
+                👤 <span class="owner-username" data-username="{{ l.owner.username }}">@{{ l.owner.username }}</span>
+                ({{ l.owner.id }})
+                {% else %}-{% endif %}
+              </td>
+
+              <td class="text-nowrap">{{ l.created_at.strftime('%Y-%m-%d %H:%M') if l.created_at else '-' }}</td>
+
+              <td style="min-width: 230px;">
+                <div class="form-check form-switch">
+                  <input class="form-check-input" type="checkbox" id="pub_{{ l.id }}" name="is_public_{{ l.id }}" {% if
+                    l.is_public %}checked{% endif %}>
+                  <label class="form-check-label" for="pub_{{ l.id }}">🌐 Publiczna</label>
+                </div>
+                <div class="form-check form-switch">
+                  <input class="form-check-input" type="checkbox" id="tmp_{{ l.id }}" name="is_temporary_{{ l.id }}" {%
+                    if l.is_temporary %}checked{% endif %}>
+                  <label class="form-check-label" for="tmp_{{ l.id }}">⏳ Tymczasowa</label>
+                </div>
+                <div class="form-check form-switch">
+                  <input class="form-check-input" type="checkbox" id="arc_{{ l.id }}" name="is_archived_{{ l.id }}" {%
+                    if l.is_archived %}checked{% endif %}>
+                  <label class="form-check-label" for="arc_{{ l.id }}">📦 Archiwalna</label>
+                </div>
+              </td>
+
+              <td style="min-width: 260px;">
+                {% if l.share_token %}
+                {% set share_url = url_for('shared_list', token=l.share_token, _external=True) %}
+                <div class="d-flex align-items-center gap-2">
+                  <div class="flex-grow-1 text-truncate mono small" title="{{ share_url }}">{{ share_url }}</div>
+                  <button class="btn btn-sm btn-outline-secondary copy-share" type="button" data-url="{{ share_url }}"
+                    aria-label="Kopiuj link">📋</button>
+                </div>
+                <div class="text-info small mt-1">
+                  {% if l.is_public %}Lista widoczna publicznie{% else %}Dostęp przez link / uprawnienia{% endif %}
+                </div>
+                {% else %}
+                <div class="text-warning small">Brak tokenu</div>
+                {% endif %}
+              </td>
+
+              <td>
+                <div class="access-editor" data-list-id="{{ l.id }}">
+                  <!-- Tokeny z uprawnieniami -->
+                  <div class="d-flex flex-wrap gap-2 mb-2 tokens">
+                    {% for u in permitted_by_list.get(l.id, []) %}
+                    <button type="button" class="btn btn-sm btn-outline-secondary rounded-pill token"
+                      data-user-id="{{ u.id }}" data-username="{{ u.username }}" title="Kliknij, aby odebrać dostęp">
+                      @{{ u.username }} <span aria-hidden="true">×</span>
+                    </button>
+                    {% endfor %}
+                    {% if permitted_by_list.get(l.id, [])|length == 0 %}
+                    <span class="text-warning small no-perms">Brak dodanych uprawnień.</span>
+                    {% endif %}
+                  </div>
+
+                  <!-- Dodawanie (wiele na raz) -->
+                  <div class="input-group input-group-sm">
+                    <input type="text"
+                      class="form-control form-control-sm bg-dark text-white border-secondary access-input"
+                      placeholder="Dodaj @użytkownika (wiele: przecinki/enter)" list="userHints"
+                      aria-label="Dodaj użytkowników">
+                    <button type="button" class="btn btn-sm btn-outline-light access-add">➕ Dodaj</button>
+                  </div>
+                  <div class="text-secondary small mt-1">Kliknij token, aby odebrać dostęp.</div>
+                </div>
+              </td>
+
+            </tr>
+            {% endfor %}
+            {% if lists|length == 0 %}
+            <tr>
+              <td colspan="8" class="text-center py-4">Brak list do wyświetlenia</td>
+            </tr>
+            {% endif %}
+          </tbody>
+        </table>
+      </div>
+
+      <div class="mt-3 d-flex justify-content-end">
+        <button type="submit" class="btn btn-sm btn-outline-light">💾 Zapisz zmiany statusów</button>
+      </div>
+    </form>
+  </div>
+</div>
+
+{% if not list_id %}
+<hr>
+<div class="d-flex justify-content-between align-items-center mt-4">
+  <form method="get" class="d-flex align-items-center">
+    <label for="per_page" class="me-2">🔢 Pozycji na stronę:</label>
+    <select id="per_page" name="per_page" class="form-select form-select-sm me-2"
+      onchange="this.form.page.value = 1; this.form.submit();">
+      <option value="25" {% if per_page==25 %}selected{% endif %}>25</option>
+      <option value="50" {% if per_page==50 %}selected{% endif %}>50</option>
+      <option value="100" {% if per_page==100 %}selected{% endif %}>100</option>
+    </select>
+    <input type="hidden" name="page" value="{{ page }}">
+  </form>
+
+  <nav aria-label="Nawigacja stron">
+    <ul class="pagination pagination-dark mb-0">
+      <li class="page-item {% if page <= 1 %}disabled{% endif %}">
+        <a class="page-link" href="?{{ query_string }}{% if query_string %}&{% endif %}page={{ page - 1 }}">«</a>
+      </li>
+      {% for p in range(1, total_pages + 1) %}
+      <li class="page-item {% if p == page %}active{% endif %}">
+        <a class="page-link" href="?{{ query_string }}{% if query_string %}&{% endif %}page={{ p }}">{{ p }}</a>
+      </li>
+      {% endfor %}
+      <li class="page-item {% if page >= total_pages %}disabled{% endif %}">
+        <a class="page-link" href="?{{ query_string }}{% if query_string %}&{% endif %}page={{ page + 1 }}">»</a>
+      </li>
+    </ul>
+  </nav>
+</div>
+{% endif %}
+
+{% endblock %}
+{% block scripts %}
+<script src="{{ url_for('static_bp.serve_js', filename='lists_access.js') }}?v={{ APP_VERSION }}"></script>
+
+{% endblock %}

templates/admin/mass_edit_categories.html

@@ -151,6 +151,6 @@
 
 {% endblock %}
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js', filename='preview_list_modal.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='categories_select_admin.js') }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='preview_list_modal.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='categories_select_admin.js') }}?v={{ APP_VERSION }}"></script>
 {% endblock %}

templates/admin/receipts.html

@@ -20,27 +20,27 @@
       {{ (page_filesize / 1024) | round(1) }} kB
       {% endif %}
     </strong>
-      {% if not (id != 'all' and (id|string).isdigit()) %}
-        | Łącznie:
-        <strong>
-          {% if total_filesize >= 1024*1024 %}
-            {{ (total_filesize / 1024 / 1024) | round(2) }} MB
-          {% else %}
-            {{ (total_filesize / 1024) | round(1) }} kB
-          {% endif %}
-        </strong>
+    {% if not (id != 'all' and (id|string).isdigit()) %}
+    | Łącznie:
+    <strong>
+      {% if total_filesize >= 1024*1024 %}
+      {{ (total_filesize / 1024 / 1024) | round(2) }} MB
+      {% else %}
+      {{ (total_filesize / 1024) | round(1) }} kB
       {% endif %}
+    </strong>
+    {% endif %}
   </p>
 
   <div>
     {% if id is string and id.isdigit() and id|int > 0 %}
-      <a href="{{ url_for('admin_receipts', id='all') }}" class="btn btn-outline-light me-2">
-        Pokaż wszystkie paragony
-      </a>
+    <a href="{{ url_for('admin_receipts', id='all') }}" class="btn btn-outline-light me-2">
+      Pokaż wszystkie paragony
+    </a>
     {% else %}
-      <a href="{{ url_for('recalculate_filesizes_all') }}" class="btn btn-outline-light me-2">
-        Przelicz rozmiary plików
-      </a>
+    <a href="{{ url_for('recalculate_filesizes_all') }}" class="btn btn-outline-light me-2">
+      Przelicz rozmiary plików
+    </a>
     {% endif %}
     <a href="{{ url_for('admin_panel') }}" class="btn btn-outline-secondary">← Powrót do panelu</a>
   </div>
@@ -85,8 +85,12 @@
                 </li>
                 <li>
                   <a class="dropdown-item" href="#" data-bs-toggle="modal" data-bs-target="#adminCropModal"
-                    data-img-src="{{ url_for('uploaded_file', filename=r.filename) }}" data-receipt-id="{{ r.id }}"
-                    data-crop-endpoint="{{ url_for('crop_receipt_admin') }}">✂️ Przytnij</a>
+                    data-img-src="{{ url_for('uploaded_file', filename=r.filename) }}?v={{ r.version_token or '0' }}"
+                    data-receipt-id="{{ r.id }}" data-crop-endpoint="{{ url_for('crop_receipt_admin') }}"
+                    data-version="{{ r.version_token or '0' }}">
+                    ✂️ Przytnij
+                  </a>
+
                 </li>
                 <li>
                   <a class="dropdown-item" href="{{ url_for('rename_receipt', receipt_id=r.id) }}">✏️ Zmień nazwę</a>
@@ -209,9 +213,8 @@
 </div>
 
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js', filename='receipt_crop.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='admin_receipt_crop.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='receipt_crop_logic.js') }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='admin_receipt_crop.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='receipt_crop_logic.js') }}?v={{ APP_VERSION }}"></script>
 {% endblock %}
 
 {% endblock %}

templates/admin/user_management.html

@@ -115,7 +115,7 @@
 </div>
 
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js', filename='user_management.js') }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='user_management.js') }}?v={{ APP_VERSION }}"></script>
 {% endblock %}
 
 

templates/base.html

@@ -8,28 +8,33 @@
   <link rel="icon" type="image/svg+xml" href="{{ url_for('favicon') }}">
 
   {# --- Bootstrap i główny css zawsze --- #}
-  <link href="{{ url_for('static_bp.serve_css', filename='style.css') }}" rel="stylesheet">
-  <link href="{{ url_for('static_bp.serve_css_lib', filename='bootstrap.min.css') }}" rel="stylesheet">
+  <link href="{{ url_for('static_bp.serve_css', filename='style.css') }}?v={{ APP_VERSION }}" rel="stylesheet">
+  <link href="{{ url_for('static_bp.serve_css_lib', filename='bootstrap.min.css') }}?v={{ APP_VERSION }}"
+    rel="stylesheet">
 
   {# --- Style CSS ładowane tylko dla niezablokowanych --- #}
   {% set exclude_paths = ['/system-auth'] %}
   {% if (exclude_paths | select("in", request.path) | list | length == 0)
   and has_authorized_cookie
   and not is_blocked %}
-  <link href="{{ url_for('static_bp.serve_css_lib', filename='glightbox.min.css') }}" rel="stylesheet">
-  <link href="{{ url_for('static_bp.serve_css_lib', filename='sort_table.min.css') }}" rel="stylesheet">
+  <link href="{{ url_for('static_bp.serve_css_lib', filename='glightbox.min.css') }}?v={{ APP_VERSION }}"
+    rel="stylesheet">
+  <link href="{{ url_for('static_bp.serve_css_lib', filename='sort_table.min.css') }}?v={{ APP_VERSION }}"
+    rel="stylesheet">
   {% endif %}
 
   {# --- Cropper CSS tylko dla wybranych podstron --- #}
   {% set substrings_cropper = ['/admin/receipts', '/edit_my_list'] %}
   {% if substrings_cropper | select("in", request.path) | list | length > 0 %}
-  <link href="{{ url_for('static_bp.serve_css_lib', filename='cropper.min.css') }}" rel="stylesheet">
+  <link href="{{ url_for('static_bp.serve_css_lib', filename='cropper.min.css') }}?v={{ APP_VERSION }}"
+    rel="stylesheet">
   {% endif %}
 
   {# --- Tom Select CSS tylko dla wybranych podstron --- #}
   {% set substrings_tomselect = ['/edit_my_list', '/admin/edit_list', '/admin/mass_edit_categories'] %}
   {% if substrings_tomselect | select("in", request.path) | list | length > 0 %}
-  <link href="{{ url_for('static_bp.serve_css_lib', filename='tom-select.bootstrap5.min.css') }}" rel="stylesheet">
+  <link href="{{ url_for('static_bp.serve_css_lib', filename='tom-select.bootstrap5.min.css') }}?v={{ APP_VERSION }}"
+    rel="stylesheet">
   {% endif %}
 </head>
 
@@ -81,6 +86,7 @@
     <hr class="text-secondary">
     <p class="mb-0">© 2025 <strong>linuxiarz.pl</strong> · <a href="https://gitea.linuxiarz.pl/gru/lista_zakupowa_live"
         target="_blank" class="link-success text-decoration-none"> source code</a>
+    <div class="small">v{{ APP_VERSION }}</div>
   </footer>
 
   <script src="{{ url_for('static_bp.serve_js_lib', filename='bootstrap.bundle.min.js') }}"></script>
@@ -101,14 +107,14 @@
   </script>
 
   {% if request.endpoint != 'system_auth' %}
-  <script src="{{ url_for('static_bp.serve_js_lib', filename='glightbox.min.js') }}"></script>
-  <script src="{{ url_for('static_bp.serve_js_lib', filename='socket.io.min.js') }}"></script>
-  <script src="{{ url_for('static_bp.serve_js_lib', filename='sort_table.min.js') }}"></script>
-  <script src="{{ url_for('static_bp.serve_js', filename='functions.js') }}"></script>
-  <script src="{{ url_for('static_bp.serve_js', filename='live.js') }}"></script>
-  <script src="{{ url_for('static_bp.serve_js', filename='sockets.js') }}"></script>
+  <script src="{{ url_for('static_bp.serve_js_lib', filename='glightbox.min.js') }}?v={{ APP_VERSION }}"></script>
+  <script src="{{ url_for('static_bp.serve_js_lib', filename='socket.io.min.js') }}?v={{ APP_VERSION }}"></script>
+  <script src="{{ url_for('static_bp.serve_js_lib', filename='sort_table.min.js') }}?v={{ APP_VERSION }}"></script>
+  <script src="{{ url_for('static_bp.serve_js', filename='functions.js') }}?v={{ APP_VERSION }}"></script>
+  <script src="{{ url_for('static_bp.serve_js', filename='live.js') }}?v={{ APP_VERSION }}"></script>
+  <script src="{{ url_for('static_bp.serve_js', filename='sockets.js') }}?v={{ APP_VERSION }}"></script>
   {% endif %}
-  <script src="{{ url_for('static_bp.serve_js', filename='toasts.js') }}"></script>
+  <script src="{{ url_for('static_bp.serve_js', filename='toasts.js') }}?v={{ APP_VERSION }}"></script>
   <script>
     let lightbox = GLightbox({
       selector: '.glightbox'
@@ -117,12 +123,13 @@
 
   {% set substrings = ['/admin/receipts', '/edit_my_list'] %}
   {% if substrings | select("in", request.path) | list | length > 0 %}
-  <script src="{{ url_for('static_bp.serve_js_lib', filename='cropper.min.js') }}"></script>
+  <script src="{{ url_for('static_bp.serve_js_lib', filename='cropper.min.js') }}?v={{ APP_VERSION }}"></script>
   {% endif %}
 
   {% set substrings = ['/edit_my_list', '/admin/edit_list', '/admin/mass_edit_categories'] %}
   {% if substrings | select("in", request.path) | list | length > 0 %}
-  <script src="{{ url_for('static_bp.serve_js_lib', filename='tom-select.complete.min.js') }}"></script>
+  <script
+    src="{{ url_for('static_bp.serve_js_lib', filename='tom-select.complete.min.js') }}?v={{ APP_VERSION }}"></script>
   {% endif %}
 
   {% endif %}

templates/edit_my_list.html

@@ -95,68 +95,33 @@
 </div>
 
 <!-- DOSTĘP DO LISTY -->
-<div class="card bg-secondary bg-opacity-10 text-white mb-5">
-  <div class="card-body">
-    <h5 class="mb-3">🔐 Dostęp do listy</h5>
+<div class="mb-3">
+  <label class="form-label">👥 Użytkownicy z dostępem</label>
 
-    <!-- Link udostępniania -->
-    <div class="mb-4">
-      <label class="form-label">🔗 Link udostępniania (wejście przez link daje dostęp; zalogowani dostają
-        uprawnienia na stałę po kliknięciu w link)</label>
+  <div class="access-editor border rounded p-2 bg-dark" data-post-url="{{ request.path }}"
+    data-suggest-url="{{ url_for('edit_my_list_suggestions', list_id=list.id) }}" data-next="{{ request.path }}"
+    data-list-id="{{ list.id }}">
 
-        {% if list.share_token %}
-        <div class="input-group mb-3">
-          <input type="text" class="form-control bg-dark text-white border-secondary"
-                readonly value="{{ url_for('shared_list', token=list.share_token, _external=True) }}"
-                id="sharedListUrl" aria-label="Udostępniony link">
-          <a class="btn btn-outline-light" href="{{ url_for('shared_list', token=list.share_token) }}" target="_blank"
-            title="Otwórz">Otwórz
-          </a>
-        </div>
-      {% else %}
-        <div class="text-warning small">Brak tokenu udostępniania.</div>
-      {% endif %}
-      <div class="text-info small">Ustawienie „🌐 Publiczna” nie jest wymagane dla dostępu z linku.</div>
-    </div>
-
-    <form method="post" class="m-0">
-      <div class="row g-3 align-items-end mb-4">
-        <div class="col-md-6">
-          <label for="grant_username" class="form-label">➕ Nadaj dostęp użytkownikowi (login)</label>
-          <input type="text" name="grant_username" id="grant_username"
-            class="form-control bg-dark text-white border-secondary rounded" placeholder="np. marek">
-        </div>
-        <div class="col-md-3">
-          <button type="submit" class="btn btn-outline-light w-100">➕ Dodaj</button>
-        </div>
-        <!-- opcjonalnie, żeby rozróżnić akcje po stronie serwera -->
-        <input type="hidden" name="action" value="grant">
-        <!-- opcjonalnie zachowanie powrotu -->
-        <input type="hidden" name="next" value="{{ request.path }}">
-      </div>
-    </form>
-
-    <!-- Lista uprawnionych -->
-    <div class="mb-3">
-      <label class="form-label">👥 Użytkownicy z dostępem</label>
-      {% if permitted_users and permitted_users|length > 0 %}
-      <ul class="list-group list-group-flush">
-        {% for u in permitted_users %}
-        <li class="list-group-item bg-dark text-white d-flex justify-content-between align-items-center border-secondary">
-          <div>
-            <span class="fw-semibold">@{{ u.username }}</span>
-          </div>
-          <form method="post" onsubmit="return confirm('Odebrać dostęp użytkownikowi @{{ u.username }}?');">
-            <input type="hidden" name="revoke_user_id" value="{{ u.id }}">
-            <button type="submit" class="btn btn-sm btn-outline-danger">🚫 Odbierz uprawnienia</button>
-          </form>
-        </li>
-        {% endfor %}
-      </ul>
-      {% else %}<br>
-      <div class="text-warning small">Brak dodanych uprawnień.</div>
+    <!-- Tokeny uprawnionych -->
+    <div class="tokens d-flex flex-wrap gap-2 mb-2">
+      {% for u in permitted_users %}
+      <button type="button" class="btn btn-sm btn-outline-secondary rounded-pill token" data-user-id="{{ u.id }}"
+        data-username="{{ u.username }}" title="Kliknij, aby odebrać dostęp">
+        @{{ u.username }} <span aria-hidden="true">×</span>
+      </button>
+      {% endfor %}
+      {% if not permitted_users or permitted_users|length == 0 %}
+      <span class="no-perms text-warning small">Brak dodanych uprawnień.</span>
       {% endif %}
     </div>
+
+    <!-- Dodawanie (wiele: przecinki/enter) + prywatne podpowiedzi -->
+    <div class="input-group input-group-sm">
+      <input type="text" class="access-input form-control form-control-sm bg-dark text-white border-secondary"
+        placeholder="Dodaj @użytkownika (wiele: przecinki/enter)" aria-label="Dodaj użytkowników">
+      <button type="button" class="access-add btn btn-sm btn-outline-light">➕ Dodaj</button>
+    </div>
+    <div class="text-secondary small mt-1">Kliknij token, aby odebrać dostęp.</div>
   </div>
 </div>
 
@@ -279,8 +244,9 @@
 {% endblock %}
 
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js', filename='confirm_delete.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='user_receipt_crop.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='receipt_crop_logic.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='select.js') }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='confirm_delete.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='user_receipt_crop.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='receipt_crop_logic.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='select.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='access_users.js') }}?v={{ APP_VERSION }}"></script>
 {% endblock %}

templates/expenses.html

@@ -132,10 +132,35 @@
       <div class="tab-pane fade" id="chartTab" role="tabpanel">
         <div class="card bg-dark text-white mb-4">
           <div class="card-body">
-            <button class="btn btn-outline-light w-100 py-2 mb-2 d-flex align-items-center justify-content-center gap-2"
-              id="toggleCategorySplit">
-              🎨 Pokaż podział na kategorie
-            </button>
+
+            <div class="text-end mb-2">
+              <div class="btn-group btn-group-sm">
+                <button class="btn btn-outline-light" id="openFsBtn"
+                  onclick="openChartFullscreen('expensesChart','Wydatki')" title="Pełny ekran" disabled>⛶</button>
+
+                <button type="button" class="btn btn-outline-light" id="downloadMainChartBtn" title="Pobierz jako PNG"
+                  disabled>⬇</button>
+              </div>
+            </div>
+
+            <div class="d-flex gap-3 mb-3">
+              <div>
+                <h6 class="text-white">Podział według czasu</h6>
+                <div class="btn-group" role="group" aria-label="Podział czasu">
+                  <button type="button" class="btn btn-outline-light btn-sm" id="toggleMonthlySplit"
+                    aria-pressed="true">Miesięczny</button>
+                  <button type="button" class="btn btn-outline-light btn-sm" id="toggleDailySplit"
+                    aria-pressed="false">Dzienny</button>
+                </div>
+              </div>
+              <div>
+                <h6 class="text-white">Kategorie/Sumy wydatków</h6>
+                <button class="btn btn-outline-light btn-sm" id="toggleCategorySplit" aria-pressed="false">Przełącz na
+                  kategorie</button>
+              </div>
+            </div>
+
+
             <p id="chartRangeLabel" class="fw-bold mb-3">Widok: miesięczne</p>
             <canvas id="expensesChart" height="120"></canvas>
           </div>
@@ -145,7 +170,7 @@
           <div class="btn-group btn-group-sm" role="group">
             <button class="btn btn-outline-light range-btn" data-range="last30days">🗓️ Ostatnie 30
               dni</button>
-            <button class="btn btn-outline-light range-btn active" data-range="currentmonth">📅 Bieżący miesiąc</button>
+            <button class="btn btn-outline-light range-btn" data-range="currentmonth">📅 Bieżący miesiąc</button>
             <button class="btn btn-outline-light range-btn" data-range="monthly">📆 Miesięczne</button>
             <button class="btn btn-outline-light range-btn" data-range="quarterly">📊 Kwartalne</button>
             <button class="btn btn-outline-light range-btn" data-range="halfyearly">🗓️ Półroczne</button>
@@ -167,13 +192,31 @@
   </div>
 </div>
 
+<div class="modal fade" id="chartFullscreenModal" tabindex="-1" aria-hidden="true">
+  <div class="modal-dialog modal-xl modal-dialog-centered">
+    <div class="modal-content bg-dark">
+      <div class="modal-header">
+        <h5 class="modal-title" id="chartModalTitle">Wykres</h5>
+        <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Zamknij"></button>
+      </div>
+      <div class="modal-body p-0">
+        <canvas id="chartFullscreenCanvas"></canvas>
+      </div>
+    </div>
+  </div>
+</div>
+
+
 {% endblock %}
 
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js_lib', filename='chart.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='show_all_expense.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='expense_chart.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='expense_table.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='expense_tab.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='select_all_table.js') }}"></script>
+<script src="{{ url_for('static_bp.serve_js_lib', filename='chart.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='show_all_expense.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='expense_chart.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='expense_table.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='expense_tab.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='select_all_table.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='chart_controls.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='modal_chart.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='download_chart.js') }}?v={{ APP_VERSION }}"></script>
 {% endblock %}

templates/list.html

@@ -12,56 +12,56 @@
     {% if list.category_badges %}
     {% for cat in list.category_badges %}
     <span class="badge rounded-pill rounded-pill text-dark ms-1" style="background-color: {{ cat.color }};
-                   font-size: 0.75rem;
-                   opacity: 0.85;">
+                     font-size: 0.75rem;
+                     opacity: 0.85;">
       {{ cat.name }}
     </span>
     {% endfor %}
+    <!-- PRZYCISK DO MODALA KATEGORII -->
+    <button class="btn btn-sm btn-outline-light ms-2" data-bs-toggle="modal" data-bs-target="#categoriesModal">
+      ✏️ Zmień kategorie
+    </button>
     {% else %}
-    <a href="{{ url_for('edit_my_list', list_id=list.id, next=url_for('view_list', list_id=list.id)) }}"
-      class="ms-2 text-light small fw-light" style="opacity: 0.9;">
+    <!-- ZAMIAST LINKU: OTWARCIE MODALA KATEGORII -->
+    <button class="btn btn-sm btn-outline-light ms-2" data-bs-toggle="modal" data-bs-target="#categoriesModal">
       ➕ Dodaj kategorię
-    </a>
+    </button>
     {% endif %}
   </h2>
 </div>
 
-<a href="{{ request.url_root }}share/{{ list.share_token }}" class="btn btn-primary btn-sm w-100 mb-3" {% if not
+<a href="{{ request.url_root }}share/{{ list.share_token }}" class="btn btn-outline-primary btn-sm w-100 mb-3" {% if not
   list.is_public %}disabled{% endif %}>
   ✅ Otwórz tryb zakupowy / odznaczania produktów
 </a>
+
 <div id="share-card" class="card bg-secondary bg-opacity-10 text-white mb-4">
   <div class="card-body">
     <div class="mb-2">
       <strong id="share-header">
-        {% if list.is_public %}
-        🔗 Udostępnij link (lista publiczna)
-        {% else %}
-        🔗 Udostępnij link (widoczna przez link / uprawnienia)
-        {% endif %}
+        {% if list.is_public %}🔗 Udostępnij link (lista publiczna){% else %}🔗 Udostępnij link (widoczna przez link /
+        uprawnienia){% endif %}
       </strong>
       <span id="share-url" class="badge rounded-pill bg-secondary text-wrap" style="font-size: 0.7rem;">
         {{ request.url_root }}share/{{ list.share_token }}
       </span>
     </div>
     <div class="d-flex flex-column flex-md-row gap-2">
-      <button id="copyBtn" class="btn btn-success btn-sm flex-fill"
+      <button id="copyBtn" class="btn btn-outline-success btn-sm flex-fill"
         onclick="copyLink('{{ request.url_root }}share/{{ list.share_token }}')">
         📋 Skopiuj / Udostępnij
       </button>
 
       <button id="toggleVisibilityBtn" class="btn btn-outline-light btn-sm flex-fill"
         onclick="toggleVisibility({{ list.id }})">
-        {% if list.is_public %}
-        🙈 Ustaw niepubliczną
-        {% else %}
-        🐵 Uczyń publiczną
-        {% endif %}
+        {% if list.is_public %}🙈 Ustaw niepubliczną{% else %}🐵 Uczyń publiczną{% endif %}
       </button>
-      <a href="{{ url_for('edit_my_list', list_id=list.id, next=url_for('view_list', list_id=list.id)) }}"
-        class="btn btn-outline-info btn-sm flex-fill">
+
+      <!-- ZAMIAST LINKU: OTWARCIE MODALA NADAWANIA DOSTĘPU -->
+      <button class="btn btn-outline-primary btn-sm flex-fill" data-bs-toggle="modal"
+        data-bs-target="#grantAccessModal">
         ➕ Nadaj dostęp
-      </a>
+      </button>
     </div>
   </div>
 </div>
@@ -76,14 +76,11 @@
 
 <div class="progress progress-dark position-relative">
   <div id="progress-bar-purchased" class="progress-bar bg-success" role="progressbar" data-bs-toggle="tooltip"
-    title="Kupione produkty">
-  </div>
+    title="Kupione produkty"></div>
   <div id="progress-bar-not-purchased" class="progress-bar bg-warning" role="progressbar" data-bs-toggle="tooltip"
-    title="Oznaczone jako niekupione">
-  </div>
+    title="Oznaczone jako niekupione"></div>
   <div id="progress-bar-remaining" class="progress-bar bg-transparent" role="progressbar" data-bs-toggle="tooltip"
-    title="Pozostałe do kupienia">
-  </div>
+    title="Pozostałe do kupienia"></div>
   <span id="progress-label" class="progress-label small fw-bold"></span>
 </div>
 
@@ -98,9 +95,8 @@
 {% endif %}
 
 <div class="d-flex justify-content-between align-items-center mb-3 flex-wrap">
-  <button id="sort-toggle-btn" class="btn btn-sm btn-outline-warning" onclick="toggleSortMode()">
-    ✳️ Zmień kolejność
-  </button>
+  <button id="sort-toggle-btn" class="btn btn-sm btn-outline-warning" onclick="toggleSortMode()">✳️ Zmień
+    kolejność</button>
   <div class="form-check form-switch">
     <input class="form-check-input" type="checkbox" id="hidePurchasedToggle">
     <label class="form-check-label ms-2" for="hidePurchasedToggle">Ukryj zaznaczone</label>
@@ -111,14 +107,12 @@
   {% for item in items %}
   <li data-name="{{ item.name|lower }}" id="item-{{ item.id }}"
     class="list-group-item d-flex justify-content-between align-items-center flex-wrap clickable-item 
-         {% if item.purchased %}bg-success text-white{% elif item.not_purchased %}bg-warning text-dark{% else %}item-not-checked{% endif %}"
+           {% if item.purchased %}bg-success text-white{% elif item.not_purchased %}bg-warning text-dark{% else %}item-not-checked{% endif %}"
     data-is-share="{{ 'true' if is_share else 'false' }}">
 
     <div class="d-flex align-items-center gap-2 flex-grow-1">
-
       <input id="checkbox-{{ item.id }}" class="large-checkbox" type="checkbox" {% if item.purchased %}checked{% endif
         %} {% if list.is_archived or item.not_purchased %}disabled{% endif %}>
-
       <span id="name-{{ item.id }}" class="text-white">
         {{ item.name }}
         {% if item.quantity and item.quantity > 1 %}
@@ -128,18 +122,12 @@
 
       <div class="info-line ms-4 small d-flex flex-wrap gap-2" id="info-{{ item.id }}">
         {% set info_parts = [] %}
-        {% if item.note %}
-        {% set _ = info_parts.append('<span class="text-danger">[ <b>' ~ item.note ~ '</b> ]</span>') %}
-        {% endif %}
-        {% if item.not_purchased_reason %}
-        {% set _ = info_parts.append('<span class="text-dark">[ <b>Powód: ' ~ item.not_purchased_reason ~ '</b>
-          ]</span>') %}
-        {% endif %}
-        {% if item.added_by_display %}
-        {% set _ = info_parts.append('<span class="text-info">[ Dodał/a: <b>' ~ item.added_by_display ~ '</b> ]</span>')
-        %}
-        {% endif %}
-
+        {% if item.note %}{% set _ = info_parts.append('<span class="text-danger">[ <b>' ~ item.note ~ '</b> ]</span>')
+        %}{% endif %}
+        {% if item.not_purchased_reason %}{% set _ = info_parts.append('<span class="text-dark">[ <b>Powód: ' ~
+            item.not_purchased_reason ~ '</b> ]</span>') %}{% endif %}
+        {% if item.added_by_display %}{% set _ = info_parts.append('<span class="text-info">[ Dodał/a: <b>' ~
+            item.added_by_display ~ '</b> ]</span>') %}{% endif %}
         {% if info_parts %}
         <div class="info-line ms-4 small d-flex flex-wrap gap-2" id="info-{{ item.id }}">
           {{ info_parts | join(' ') | safe }}
@@ -150,34 +138,24 @@
 
     <div class="btn-group btn-group-sm" role="group">
       {% if not is_share %}
-      <button type="button" class="btn btn-outline-light" {% if list.is_archived %}disabled{% else %}
-        onclick="editItem({{ item.id }}, '{{ item.name }}', {{ item.quantity or 1 }})" {% endif %}>
-        ✏️
-      </button>
-      <button type="button" class="btn btn-outline-light" {% if list.is_archived %}disabled{% else %}
-        onclick="deleteItem({{ item.id }})" {% endif %}>
-        🗑️
-      </button>
+      <button type="button" class="btn btn-outline-light" {% if list.is_archived %}disabled{% else
+        %}onclick="editItem({{ item.id }}, '{{ item.name }}', {{ item.quantity or 1 }})" {% endif %}>✏️</button>
+      <button type="button" class="btn btn-outline-light" {% if list.is_archived %}disabled{% else
+        %}onclick="deleteItem({{ item.id }})" {% endif %}>🗑️</button>
       {% endif %}
 
       {% if item.not_purchased %}
-      <button type="button" class="btn btn-outline-light me-auto" {% if list.is_archived %}disabled{% else %}
-        onclick="unmarkNotPurchased({{ item.id }})" {% endif %}>
-        ✅ Przywróć
-      </button>
+      <button type="button" class="btn btn-outline-light me-auto" {% if list.is_archived %}disabled{% else
+        %}onclick="unmarkNotPurchased({{ item.id }})" {% endif %}>✅ Przywróć</button>
       {% elif not item.not_purchased %}
-      <button type="button" class="btn btn-outline-light" {% if list.is_archived %}disabled{% else %}
-        onclick="markNotPurchasedModal(event, {{ item.id }})" {% endif %}>
-        ⚠️
-      </button>
+      <button type="button" class="btn btn-outline-light" {% if list.is_archived %}disabled{% else
+        %}onclick="markNotPurchasedModal(event, {{ item.id }})" {% endif %}>⚠️</button>
       {% endif %}
     </div>
   </li>
-
   {% else %}
-  <li id="empty-placeholder" class="list-group-item bg-dark text-secondary text-center w-100">
-    Brak produktów w tej liście.
-  </li>
+  <li id="empty-placeholder" class="list-group-item bg-dark text-secondary text-center w-100">Brak produktów w tej
+    liście.</li>
   {% endfor %}
 </ul>
 
@@ -194,7 +172,8 @@
         placeholder="Dodaj produkt i ilość" required>
       <input type="number" id="newQuantity" name="quantity" class="form-control bg-dark text-white border-secondary"
         placeholder="Ilość" min="1" value="1" style="max-width: 90px;">
-      <button type="button" class="btn btn-success rounded-end" onclick="addItem({{ list.id }})">➕ Dodaj</button>
+      <button type="button" class="btn btn-outline-success rounded-end" onclick="addItem({{ list.id }})">➕
+        Dodaj</button>
     </div>
   </div>
 </div>
@@ -216,12 +195,97 @@
   </div>
   {% endfor %}
   {% else %}
-  <div class="alert alert-info text-center w-100" role="alert">
-    ℹ️ Brak wgranych paragonów do tej listy
-  </div>
+  <div class="alert alert-info text-center w-100" role="alert">ℹ️ Brak wgranych paragonów do tej listy</div>
   {% endif %}
 </div>
 
+<!-- MODAL: KATEGORIA (pojedynczy wybór) -->
+<div class="modal fade" id="categoriesModal" tabindex="-1" aria-labelledby="categoriesModalLabel" aria-hidden="true">
+  <div class="modal-dialog modal-lg modal-dialog-scrollable">
+    <div class="modal-content bg-dark text-white">
+      <div class="modal-header">
+        <h5 class="modal-title" id="grantAccessModalLabel">Ustaw kategorię</h5>
+        <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Zamknij"></button>
+      </div>
+
+      <form method="post" action="{{ url_for('list_settings', list_id=list.id) }}">
+        <div class="modal-body">
+          <div class="mb-4">
+            <label for="category_id" class="form-label">🏷️ Kategoria listy</label>
+            <select id="category_id" name="category_id"
+              class="form-select tom-dark bg-dark text-white border-secondary rounded">
+              <option value="">– brak –</option>
+              {% for cat in categories %}
+              <option value="{{ cat.id }}" {% if cat.id in selected_categories %}selected{% endif %}>
+                {{ cat.name }}
+              </option>
+              {% endfor %}
+            </select>
+          </div>
+
+          <input type="hidden" name="action" value="set_category">
+          <input type="hidden" name="next" value="{{ url_for('view_list', list_id=list.id) }}">
+        </div>
+
+        <div class="modal-footer justify-content-end">
+          <div class="btn-group" role="group">
+            <button type="button" class="btn btn-sm btn-outline-light" data-bs-dismiss="modal">❌ Anuluj</button>
+            <button type="submit" class="btn btn-sm btn-outline-light">💾 Zapisz</button>
+          </div>
+        </div>
+      </form>
+
+    </div>
+  </div>
+</div>
+
+<!-- MODAL: NADAWANIE DOSTĘPU -->
+<div class="modal fade" id="grantAccessModal" tabindex="-1" aria-labelledby="grantAccessModalLabel" aria-hidden="true">
+  <div class="modal-dialog modal-lg modal-dialog-scrollable">
+    <div class="modal-content bg-dark text-white">
+      <div class="modal-header">
+        <h5 class="modal-title" id="grantAccessModalLabel">Nadaj dostęp użytkownikom</h5>
+        <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Zamknij"></button>
+      </div>
+
+      <div class="modal-body">
+        <div class="access-editor border rounded p-2 bg-dark"
+          data-post-url="{{ url_for('list_settings', list_id=list.id) }}"
+          data-suggest-url="{{ url_for('edit_my_list_suggestions', list_id=list.id) }}"
+          data-next="{{ url_for('view_list', list_id=list.id) }}" data-list-id="{{ list.id }}"
+          data-grant-action="grant_access" data-revoke-field="revoke_user_id">
+
+          <!-- Tokeny aktualnie uprawnionych -->
+          <div class="tokens d-flex flex-wrap gap-2 mb-2">
+            {% for u in permitted_users %}
+            <button type="button" class="btn btn-sm btn-outline-secondary rounded-pill token" data-user-id="{{ u.id }}"
+              data-username="{{ u.username }}" title="Kliknij, aby odebrać dostęp">
+              @{{ u.username }} <span aria-hidden="true">×</span>
+            </button>
+            {% endfor %}
+            {% if not permitted_users or permitted_users|length == 0 %}
+            <span class="no-perms text-warning small">Brak dodanych uprawnień.</span>
+            {% endif %}
+          </div>
+
+          <!-- Dodawanie wielu na raz + podpowiedzi prywatne -->
+          <div class="input-group input-group-sm">
+            <input type="text" class="access-input form-control form-control-sm bg-dark text-white border-secondary"
+              placeholder="Dodaj @użytkownika (wiele: przecinki/enter)" aria-label="Dodaj użytkowników">
+            <button type="button" class="access-add btn btn-sm btn-outline-light">➕ Dodaj</button>
+          </div>
+          <div class="text-secondary small mt-1">Kliknij token, aby odebrać dostęp.</div>
+        </div>
+      </div>
+
+      <div class="modal-footer justify-content-end">
+        <button type="button" class="btn btn-sm btn-outline-light" data-bs-dismiss="modal">Zamknij</button>
+      </div>
+    </div>
+  </div>
+</div>
+
+
 <div class="modal fade" id="massAddModal" tabindex="-1" aria-labelledby="massAddModalLabel" aria-hidden="true">
   <div class="modal-dialog modal-lg modal-dialog-scrollable">
     <div class="modal-content bg-dark text-white">
@@ -233,20 +297,12 @@
         <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Zamknij"></button>
       </div>
       <div class="modal-body">
-
-        <!-- SORTOWANIE i LICZNIK -->
         <div id="sort-bar" class="mb-2"></div>
-
-        <div class="mb-2">
-          <span id="product-count" class="badge rounded-pill bg-primary ms-2"></span>
-        </div>
-
-        <!-- LISTA PRODUKTÓW -->
+        <div class="mb-2"><span id="product-count" class="badge rounded-pill bg-primary ms-2"></span></div>
         <ul id="mass-add-list" class="list-group"></ul>
-
       </div>
       <div class="modal-footer">
-        <button type="button" class="btn btn-outline-light" data-bs-dismiss="modal">Zamknij</button>
+        <button type="button" class="btn btn-outline-light btn-sm w-100" data-bs-dismiss="modal">Zamknij</button>
       </div>
     </div>
   </div>
@@ -260,9 +316,10 @@
   window.LIST_ID = {{ list.id }};
   window.IS_OWNER = {{ 'true' if is_owner else 'false' }};
 </script>
-<script src="{{ url_for('static_bp.serve_js', filename='mass_add.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='receipt_upload.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='sort_mode.js') }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='mass_add.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='receipt_upload.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='sort_mode.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='access_users.js') }}?v={{ APP_VERSION }}"></script>
 <script>
   setupList({{ list.id }}, '{{ current_user.username if current_user.is_authenticated else 'Gość' }}');
 </script>

templates/list_share.html

@@ -19,7 +19,6 @@
   </span>
   {% endif %}
 
-  {# Kategorie - tylko wyświetlenie, bez linków #}
   {% if list.category_badges %}
   {% for cat in list.category_badges %}
   <span class="badge rounded-pill rounded-pill text-dark ms-1" style="background-color: {{ cat.color }};
@@ -112,8 +111,8 @@
     not current_user.is_authenticated %}disabled{% endif %}>
   <input id="newQuantity" type="number" class="form-control bg-dark text-white border-secondary" placeholder="Ilość"
     min="1" value="1" style="max-width: 90px;" {% if not current_user.is_authenticated %}disabled{% endif %}>
-  <button onclick="addItem({{ list.id }})" class="btn btn-success rounded-end" {% if not current_user.is_authenticated
-    %}disabled{% endif %}>➕ Dodaj</button>
+  <button onclick="addItem({{ list.id }})" class="btn btn-outline-success rounded-end" {% if not
+    current_user.is_authenticated %}disabled{% endif %}>➕ Dodaj</button>
 </div>
 {% endif %}
 
@@ -123,9 +122,8 @@
 <div class="input-group mb-2">
   <input id="expenseAmount" type="number" step="0.01" min="0" class="form-control bg-dark text-white border-secondary"
     placeholder="Kwota (PLN)">
-  <button onclick="submitExpense({{ list.id }})" class="btn btn-success rounded-end">💾 Zapisz</button>
-</div>
-{% endif %}
+  <button onclick="submitExpense({{ list.id }})" class="btn btn-outline-primary rounded-end">💾 Zapisz</button>
+</div>{% endif %}
 <p id="total-expense2"><b>💸 Łącznie wydano:</b> {{ '%.2f'|format(total_expense) }} PLN</p>
 
 <button id="toggleReceiptBtn" class="btn btn-outline-light mb-3 w-100 w-md-auto d-block mx-auto" type="button"
@@ -216,20 +214,23 @@
 
 <!-- Modal notatki -->
 <div class="modal fade" id="noteModal" tabindex="-1" aria-hidden="true">
-  <div class="modal-dialog">
+  <div class="modal-dialog modal-lg modal-dialog-scrollable">
     <div class="modal-content bg-dark text-white">
       <div class="modal-header">
         <h5 class="modal-title">Dodaj notatkę</h5>
         <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Zamknij"></button>
       </div>
+
       <form id="noteForm" onsubmit="submitNote(event)">
         <div class="modal-body">
-          <textarea id="noteText" class="form-control" rows="4"
-            placeholder="Np. 'Nie było, zamieniłem na inny'"></textarea>
+          <textarea id="noteText" class="form-control" rows="4" placeholder="Np. 'Promocja 2+2'"></textarea>
         </div>
         <div class="modal-footer">
-          <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Anuluj</button>
-          <button type="submit" class="btn btn-success">💾 Zapisz</button>
+          <div class="btn-group" role="group">
+            <button type="button" class="btn btn-outline-light btn-sm" data-bs-dismiss="modal">❌ Anuluj</button>
+            <button type="submit" class="btn btn-outline-light btn-sm">💾 Zapisz</button>
+          </div>
+
         </div>
       </form>
     </div>
@@ -245,12 +246,12 @@
     var isSorting = false;
   }
 </script>
-<script src="{{ url_for('static_bp.serve_js_lib', filename='Sortable.min.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='notes.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='clickable_row.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='receipt_section.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='receipt_upload.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='receipt_analysis.js') }}"></script>
+<script src="{{ url_for('static_bp.serve_js_lib', filename='Sortable.min.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='notes.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='clickable_row.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='receipt_section.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='receipt_upload.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='receipt_analysis.js') }}?v={{ APP_VERSION }}"></script>
 <script>
   setupList({{ list.id }}, '{{ current_user.username if current_user.is_authenticated else 'Gość' }}');
 </script>

templates/main.html

@@ -135,7 +135,11 @@
 {% endif %}
 {% endif %}
 
-<h3 class="mt-4">Udostępnione i publiczne listy innych użytkowników</h3>
+
+<h3 class="mt-4"> {% if current_user.is_authenticated %}Udostępnione i publiczne listy innych użytkowników {% else %}
+  Publiczne listy innych użytkowników {% endif %}</h3>
+
+
 {% set lists_to_show = accessible_lists %}
 {% if lists_to_show %}
 <ul class="list-group">
@@ -247,8 +251,8 @@
 </div>
 
 {% block scripts %}
-<script src="{{ url_for('static_bp.serve_js', filename='toggle_button.js') }}"></script>
-<script src="{{ url_for('static_bp.serve_js', filename='select_month.js') }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='toggle_button.js') }}?v={{ APP_VERSION }}"></script>
+<script src="{{ url_for('static_bp.serve_js', filename='select_month.js') }}?v={{ APP_VERSION }}"></script>
 {% endblock %}
 
 {% endblock %}