fix(repairs): normalize public status tokens

backend/hermes/app/services/repair_public_link_service.py

@@ -22,14 +22,24 @@ from app.services.repair_notification_service import STATUS_LABELS
 from app.services.repair_service import repair_label
 
 
+def normalize_token(token: str) -> str:
+    return token.strip()
+
+
 def public_status_path(token: str) -> str:
-    return f"/status/{token}"
+    normalized_token = normalize_token(token)
+    path = f"/status/{normalized_token}"
+    base_url = (settings.public_repair_status_base_url or "").strip().rstrip("/")
+    if not base_url:
+        return path
+    return f"{base_url}/{normalized_token}"
 
 
 class RepairPublicLinkService:
     @staticmethod
     def hash_token(token: str) -> str:
-        return hmac.new(settings.secret_key.encode("utf-8"), token.encode("utf-8"), hashlib.sha256).hexdigest()
+        normalized_token = normalize_token(token)
+        return hmac.new(settings.secret_key.encode("utf-8"), normalized_token.encode("utf-8"), hashlib.sha256).hexdigest()
 
     @staticmethod
     def create_token() -> str:
@@ -100,14 +110,17 @@ class RepairPublicLinkService:
 
     @staticmethod
     def public_status(db: Session, token: str) -> RepairPublicStatusResponse:
-        public_link = RepairRepository.get_public_link_by_hash(db, RepairPublicLinkService.hash_token(token))
+        normalized_token = normalize_token(token)
+        if not normalized_token:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Reparaturstatus nicht gefunden")
+
+        public_link = RepairRepository.get_public_link_by_hash(db, RepairPublicLinkService.hash_token(normalized_token))
         if public_link is None or public_link.repair is None:
             raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Reparaturstatus nicht gefunden")
 
-        RepairRepository.mark_public_link_used(db, public_link)
         repair = public_link.repair
         history = RepairRepository.get_history_public(db, repair.id)
-        return RepairPublicStatusResponse(
+        response = RepairPublicStatusResponse(
             repair_number=repair.repair_number,
             public_status_label=STATUS_LABELS.get(repair.status, repair.status),
             device_manufacturer=repair.device_manufacturer,
@@ -122,3 +135,5 @@ class RepairPublicLinkService:
             ],
             updated_at=repair.updated_at,
         )
+        RepairRepository.mark_public_link_used(db, public_link)
+        return response