Add phase 2: recipes with visibility, photos, search and favourites

- Recipe model with ingredients (amount/range, unit, group, note), steps,
  lowercase tags, author notes, source URL and private/public visibility
- Central RecipeQuerySet.visible_to() used by every read path; edit only
  by owner, delete by owner or admin (visible recipes only)
- Text-based editing: ingredient/step parser with roundtrip and scaling
- Photo upload (JPEG/PNG/WebP/HEIC), re-encoded to WebP without EXIF,
  thumbnails, cover image, served only through permission-checked view
- Search across title, description, ingredients, tags; ingredient and tag
  filters; "mine" and favourites views
- Admin can delete all recipes of a deactivated user
- Acceptance tests: private recipes unreachable for others and admins
  in list, search, tags, favourites, detail, edit, delete and image URLs

Co-Authored-By: Claude Opus 5.5 <[email protected]>

accounts/admin_views.py

@@ -103,6 +103,25 @@ def user_action(request, pk, action):
     return redirect("accounts:admin_users")
 
 
+@admin_required
+@never_cache
+def user_delete_recipes(request, pk):
+    """Delete all recipes of a deactivated user, including private ones (content is never shown)."""
+    from recipes.models import Recipe
+    from recipes.views import delete_recipe
+
+    target = get_object_or_404(User, pk=pk, is_active=False)
+    recipes = Recipe.objects.filter(owner=target)
+    if request.method == "POST":
+        count = 0
+        for recipe in recipes:
+            delete_recipe(recipe)
+            count += 1
+        messages.success(request, f"{count} Rezepte von {target} gelöscht.")
+        return redirect("accounts:admin_users")
+    return render(request, "accounts/admin/delete_recipes.html", {"target": target, "count": recipes.count()})
+
+
 @admin_required
 @never_cache
 def invitation_list(request):

accounts/urls.py

@@ -12,7 +12,8 @@ urlpatterns = [
     path("konto/", views.profile, name="profile"),
     path("konto/passwort/", views.password_change, name="password_change"),
     path("verwaltung/nutzer/", admin_views.user_list, name="admin_users"),
-    path("verwaltung/nutzer/<int:pk>/<str:action>/", admin_views.user_action, name="admin_user_action"),
+    path("verwaltung/nutzer/<int:pk>/rezepte-loeschen/", admin_views.user_delete_recipes, name="admin_user_delete_recipes"),
+    path("verwaltung/nutzer/<int:pk>/<str:action>/",admin_views.user_action, name="admin_user_action"),
     path("verwaltung/einladungen/", admin_views.invitation_list, name="admin_invitations"),
     path("verwaltung/einladungen/<int:pk>/widerrufen/", admin_views.invitation_revoke, name="admin_invitation_revoke"),
 ]

accounts/views.py

@@ -38,7 +38,7 @@ def _safe_next(request):
 @never_cache
 def login_view(request):
     if request.user.is_authenticated:
-        return redirect("core:home")
+        return redirect("recipes:list")
     form = LoginForm(request.POST or None)
     status = 200
     if request.method == "POST" and form.is_valid():
@@ -100,7 +100,7 @@ def register(request, token):
             invitation.save(update_fields=["used_at", "used_by"])
         login(request, user, backend="django.contrib.auth.backends.ModelBackend")
         messages.success(request, "Willkommen im Kochbuch!")
-        return redirect("core:home")
+        return redirect("recipes:list")
     return render(request, "accounts/register.html", {"form": form, "invitation": invitation})
 
 
@@ -126,7 +126,7 @@ def password_reset(request, token):
             reset.save(update_fields=["used_at"])
         login(request, user, backend="django.contrib.auth.backends.ModelBackend")
         messages.success(request, "Dein Passwort wurde geändert.")
-        return redirect("core:home")
+        return redirect("recipes:list")
     return render(request, "accounts/password_reset.html", {"form": form, "reset_user": reset.user})
 
 
@@ -152,5 +152,5 @@ def password_change(request):
         user.save(update_fields=["password", "must_change_password"])
         update_session_auth_hash(request, user)
         messages.success(request, "Dein Passwort wurde geändert.")
-        return redirect("core:home")
+        return redirect("recipes:list")
     return render(request, "accounts/password_change.html", {"form": form, "forced": user.must_change_password})