From 36b41b4e5a378cca555579858b7f364ffeb416c7 Mon Sep 17 00:00:00 2001
From: Frank Schubert <fronk@fronk.at>
Date: Thu, 25 Aug 2022 16:59:54 +0200
Subject: [PATCH] WIP AddressDB + api

---
 Layout/default/User/Form.php                  |  29 +
 application/ADBGemeinde/ADBGemeinde.php       |  68 +++
 .../ADBGemeinde/ADBGemeindeController.php     |  22 +
 application/ADBHausnummer/ADBHausnummer.php   |  44 ++
 application/ADBOrtschaft/ADBOrtschaft.php     |  27 +
 .../ADBOrtschaft/ADBOrtschaftController.php   |  21 +
 application/ADBPlz/ADBPlz.php                 |   9 +
 application/ADBStrasse/ADBStrasse.php         |  14 +
 .../ADBStrasse/ADBStrasseController.php       |  21 +
 application/AddressDB/AddressDB.php           | 111 ++++
 application/AddressDB/AddressDBController.php |   5 +
 application/Api/v1/OrtApicontroller.php       |  71 +++
 application/User/User.php                     |  59 ++
 application/User/UserController.php           |  35 ++
 application/User/UserModel.php                |   1 +
 lib/autoloader/autoloader.php                 |  17 +-
 lib/mvcfronk/mfBase/mfBaseApicontroller.php   | 546 ++++++++++++++++++
 lib/mvcfronk/mfBase/mfBaseController.php      |   7 +-
 lib/mvcfronk/mfBase/mfBaseModel.php           |  10 +-
 lib/mvcfronk/mfResponse/mfResponse.php        |  70 +++
 lib/mvcfronk/mfRouter/mfRouter.php            |  95 ++-
 lib/mvcfronk/mfRouter/mfRouter_old.php        | 104 ++++
 public/.htaccess                              |  21 +-
 23 files changed, 1373 insertions(+), 34 deletions(-)
 create mode 100644 application/ADBGemeinde/ADBGemeinde.php
 create mode 100644 application/ADBGemeinde/ADBGemeindeController.php
 create mode 100644 application/ADBHausnummer/ADBHausnummer.php
 create mode 100644 application/ADBOrtschaft/ADBOrtschaft.php
 create mode 100644 application/ADBOrtschaft/ADBOrtschaftController.php
 create mode 100644 application/ADBPlz/ADBPlz.php
 create mode 100644 application/ADBStrasse/ADBStrasse.php
 create mode 100644 application/ADBStrasse/ADBStrasseController.php
 create mode 100644 application/AddressDB/AddressDB.php
 create mode 100644 application/AddressDB/AddressDBController.php
 create mode 100644 application/Api/v1/OrtApicontroller.php
 create mode 100644 lib/mvcfronk/mfBase/mfBaseApicontroller.php
 create mode 100644 lib/mvcfronk/mfResponse/mfResponse.php
 create mode 100644 lib/mvcfronk/mfRouter/mfRouter_old.php

diff --git a/Layout/default/User/Form.php b/Layout/default/User/Form.php
index 2e76f7a39..0a5fd586f 100644
--- a/Layout/default/User/Form.php
+++ b/Layout/default/User/Form.php
@@ -82,6 +82,35 @@
         </div>
       </div>
     </div>
+    
+    <?php if($user->id): ?>
+        <div class="row">
+          <div class="col-lg">
+            <div class="card">
+              <div class="card-header">
+                <h3 class="card-title">API Key</h3>
+              </div>
+              <div class="card-body">
+                <div class="form-group">
+                  <input type="text" class="form-control" value="<?=$user->apikey?>" disabled="disabled" />
+                </div>
+                <div class="form-group">
+                  <form method="post" action="<?=self::getUrl("User", "generateApikey")?>">
+                    <input type="hidden" name="id" value="<?=$user->id?>" />
+                  <?php if($user->apikey): ?>
+                    <button type="submit" class="btn btn-primary" onclick="if(!confirm('Achtung: Dadurch wird der bisherige API Key ungültig. Wirklich neuen API Key generieren?')) return false;">Neuen API Key generieren</button>
+                  <?php else: ?>
+                    <button type="submit" class="btn btn-primary">API Key generieren</button>
+                  <?php endif; ?>
+                  </form>
+                </div>
+                
+              </div>
+              
+            </div>
+          </div>
+        </div>
+        <?php endif; ?>
 
 <script type="text/javascript">
   $("#address_id").select2({
diff --git a/application/ADBGemeinde/ADBGemeinde.php b/application/ADBGemeinde/ADBGemeinde.php
new file mode 100644
index 000000000..3f70d7a96
--- /dev/null
+++ b/application/ADBGemeinde/ADBGemeinde.php
@@ -0,0 +1,68 @@
+<?php
+
+class ADBGemeinde extends mfBaseModel {
+  public $plz = [];
+
+  
+  protected function init() {
+    $this->db = FronkDB::singleton(ADDRESSDB_DBHOST, ADDRESSDB_DBUSER, ADDRESSDB_DBPASS, ADDRESSDB_DBNAME);
+  }
+  
+  
+  public function loadByGemeindeCode($code) {
+    $res = $this->db->select("Gemeinde","*","code=$code");
+    if($this->db->num_rows($res)) {
+      $data = $this->db->fetch_object($res);
+      $this->load($data);
+      return true;
+    }
+    return false;
+  }
+
+  public function find($search) {
+    $seach = $this->db->escape($search);
+    if(!$search) {
+      return false;
+    }
+    
+    $results = [];
+    
+    $res = $this->db->select("Gemeinde", "*", "name like '%$search%'");
+    if($this->db->num_rows($res)) {
+      while($data = $this->db->fetch_object($res)) {
+        $results[] = new ADBGemeinde($data);
+      }
+    }
+    
+    return $results;
+  }
+  
+  public function afterLoad() {
+    $this->loadPlz();
+  }
+
+  public function loadPlz() {
+    if(!$this->id) {
+      return false;
+    }
+
+    $plz = [];
+
+    $res = $this->db->select("Plz","*","gemeinde_id=".$this->id);
+    if($this->db->num_rows($res)) {
+      while($data = $this->db->fetch_object($res)) {
+        $this->plz[] = new ADBPlz($data);
+      }
+    }
+
+    return true;
+  }
+
+  public function getPlzList() {
+    $list = [];
+    foreach($this->plz as $plz) {
+      $list[$plz->id] = $plz->plz;
+    }
+    return $list;
+  }
+}
diff --git a/application/ADBGemeinde/ADBGemeindeController.php b/application/ADBGemeinde/ADBGemeindeController.php
new file mode 100644
index 000000000..371d5381f
--- /dev/null
+++ b/application/ADBGemeinde/ADBGemeindeController.php
@@ -0,0 +1,22 @@
+<?php
+
+class ADBGemeindeController extends mfBaseController {
+  
+  protected function init() {
+    $db = $this->db(ADDRESSDB_DBHOST, ADDRESSDB_DBUSER, ADDRESSDB_DBPASS, ADDRESSDB_DBNAME);
+  }
+  
+  public function getGemeinden() {
+    $gemeinden = array();
+    
+    $res = $this->db()->select("Gemeinde","*","1=1 ORDER BY name");
+    if($this->db()->num_rows($res)) {
+      while($data = $this->db()->fetch_object($res)) {
+        $gemeinden[] = new ADBOrtschaft($data);
+      }
+    }
+    
+    return $gemeinden;
+  }
+  
+}
\ No newline at end of file
diff --git a/application/ADBHausnummer/ADBHausnummer.php b/application/ADBHausnummer/ADBHausnummer.php
new file mode 100644
index 000000000..d8ea63d5e
--- /dev/null
+++ b/application/ADBHausnummer/ADBHausnummer.php
@@ -0,0 +1,44 @@
+<?php
+
+class ADBHausnummer extends mfBaseModel {
+  public $strasse;
+  public $status;
+  public $providers = [];
+  public $providerlist = [];
+
+  protected function init() {
+    $this->db = FronkDB::singleton(ADDRESSDB_DBHOST, ADDRESSDB_DBUSER, ADDRESSDB_DBPASS, ADDRESSDB_DBNAME);
+  }
+  
+  public function afterLoad() {
+    $this->strasse = new ADBStrasse($this->strasse_id);
+    //$this->loadStatus();
+    //$this->loadProvider();
+  }
+  /*
+  public function loadStatus() {
+    if(!$this->id) {
+      return false;
+    }
+    $status = HausnummerStatus::singleton();
+    $this->status = $status->getObject($this->status_id);
+  }
+
+  public function loadProvider() {
+    if(!$this->id) {
+      return false;
+    }
+
+    $res = $this->db->select("HausnummerProvider", "*", "hausnummer_id=".$this->id);
+    if($this->db->num_rows($res)) {
+      while($data = $this->db->fetch_object($res)) {
+        $provider = new Provider($data->provider_id);
+        $this->providerlist[$provider->id] = $provider->name;
+        $this->providers[] = $provider;
+      }
+    }
+
+    return true;
+  }*/
+
+}
diff --git a/application/ADBOrtschaft/ADBOrtschaft.php b/application/ADBOrtschaft/ADBOrtschaft.php
new file mode 100644
index 000000000..014b3dc98
--- /dev/null
+++ b/application/ADBOrtschaft/ADBOrtschaft.php
@@ -0,0 +1,27 @@
+<?php
+
+class ADBOrtschaft extends mfBaseModel {
+  
+  protected function init() {
+    $this->db = FronkDB::singleton(ADDRESSDB_DBHOST, ADDRESSDB_DBUSER, ADDRESSDB_DBPASS, ADDRESSDB_DBNAME);
+  }
+  
+  public function find($search) {
+    $seach = $this->db->escape($search);
+    if(!$search) {
+      return false;
+    }
+    
+    $results = [];
+    
+    $res = $this->db->select("Ortschaft", "*", "name like '%$search%'");
+    if($this->db->num_rows($res)) {
+      while($data = $this->db->fetch_object($res)) {
+        $results[] = new ADBOrtschaft($data);
+      }
+    }
+    
+    return $results;
+  }
+  
+}
\ No newline at end of file
diff --git a/application/ADBOrtschaft/ADBOrtschaftController.php b/application/ADBOrtschaft/ADBOrtschaftController.php
new file mode 100644
index 000000000..26603affe
--- /dev/null
+++ b/application/ADBOrtschaft/ADBOrtschaftController.php
@@ -0,0 +1,21 @@
+<?php
+
+class ADBOrtschaftController extends mfBaseController {
+  
+  protected function init() {
+    $db = $this->db(ADDRESSDB_DBHOST, ADDRESSDB_DBUSER, ADDRESSDB_DBPASS, ADDRESSDB_DBNAME);
+  }
+  
+  public function getOrte() {
+    $orte = array();
+    
+    $res = $this->db()->query("SELECT ortschaft_id AS id FROM view_ort ORDER BY gemeinde_kennziffer,gemeinde,ort");
+    if($this->db()->num_rows($res)) {
+      while($data = $this->db()->fetch_object($res)) {
+        $orte[] = new ADBOrtschaft($data->id);
+      }
+    }
+    
+    return $orte;
+  }
+}
\ No newline at end of file
diff --git a/application/ADBPlz/ADBPlz.php b/application/ADBPlz/ADBPlz.php
new file mode 100644
index 000000000..d6d368453
--- /dev/null
+++ b/application/ADBPlz/ADBPlz.php
@@ -0,0 +1,9 @@
+<?php
+
+class ADBPlz extends mfBaseModel {
+  
+  protected function init() {
+    $this->db = FronkDB::singleton(ADDRESSDB_DBHOST, ADDRESSDB_DBUSER, ADDRESSDB_DBPASS, ADDRESSDB_DBNAME);
+  }
+  
+}
diff --git a/application/ADBStrasse/ADBStrasse.php b/application/ADBStrasse/ADBStrasse.php
new file mode 100644
index 000000000..a0ab98206
--- /dev/null
+++ b/application/ADBStrasse/ADBStrasse.php
@@ -0,0 +1,14 @@
+<?php
+
+class Strasse extends mfBaseModel {
+  public $gemeinde = [];
+
+  protected function init() {
+    $this->db = FronkDB::singleton(ADDRESSDB_DBHOST, ADDRESSDB_DBUSER, ADDRESSDB_DBPASS, ADDRESSDB_DBNAME);
+  }
+  
+  public function afterLoad() {
+    $this->gemeinde = new ADBGemeinde($this->gemeinde_id);
+  }
+
+}
diff --git a/application/ADBStrasse/ADBStrasseController.php b/application/ADBStrasse/ADBStrasseController.php
new file mode 100644
index 000000000..e1c6f0299
--- /dev/null
+++ b/application/ADBStrasse/ADBStrasseController.php
@@ -0,0 +1,21 @@
+<?php
+
+class StrasseController extends mfBaseController {
+  
+  protected function init() {
+    $db = $this->db(ADDRESSDB_DBHOST, ADDRESSDB_DBUSER, ADDRESSDB_DBPASS, ADDRESSDB_DBNAME);
+  }
+  
+  public function getStrassen() {
+    $strassen = array();
+    
+    $res = $this->db()->query("SELECT strasse_id AS id FROM view_strasse ORDER BY gemeinde_kennziffer,gemeinde,ort,strasse");
+    if($this->db()->num_rows($res)) {
+      while($data = $this->db()->fetch_object($res)) {
+        $strassen[] = new ADBStrasse($data->id);
+      }
+    }
+    
+    return $strassen;
+  }
+}
\ No newline at end of file
diff --git a/application/AddressDB/AddressDB.php b/application/AddressDB/AddressDB.php
new file mode 100644
index 000000000..b82765e8b
--- /dev/null
+++ b/application/AddressDB/AddressDB.php
@@ -0,0 +1,111 @@
+<?php
+
+class AddressDB {
+  private $log;
+  private $db;
+  
+  public $data;
+  
+  public function __contruct() {
+    
+  }
+  
+  public function findAddress($search) {
+    if(!is_array($search)) {
+      return false;
+    }
+    
+    $gemeinde_name = $search['gemeinde_name'];
+    $ort_name = $search['ort_name'];
+    $plz = $search['plz'];
+    $strasse_name = $search['strasse_name'];
+    $hausnummer = $search['hausnummer'];
+    $block = $search['block'];
+    $stiege = $search['stiege'];
+    $stock = $search['stock'];
+    $tuer = $search['tuee'];
+    
+    /*
+    if($gemeinde_id < 1 || $strasse_id < 1 || !$hausnummer
+             || $gemeinde_id > pow(2, 30) || $strasse_id > pow(2, 30) || strlen($hausnummer) > 32) {
+      $this->redirect('Check','',['status' => 'error']);
+    }*/
+    
+    $hausnummerMatch = true;
+    
+    $gemeinde = new Gemeinde($gemeinde_id);
+    $strasse = new Strasse($strasse_id);
+    
+    // try exact hausnummer
+    $res = $this->db()->select("view_adresseProvider", "*", "gemeinde = '".$gemeinde->name."' AND strasse = '".$strasse->name."' AND hausnummer = '$hausnummer'");
+    if(!$this->db()->num_rows($res)) {
+      $hausnummerMatch = false;
+      // check for anschlüsse in the same street
+      $res = $this->db()->select("view_adresseProvider", "*", "gemeinde = '".$gemeinde->name."' AND strasse = '".$strasse->name."'");
+      if(!$this->db()->num_rows($res)) {
+        // XXX: if breitband stmk
+        $this->layout()->setTemplate("Check/Result/Fail");
+        
+        // xdsl anzeigen
+        return $this->checkVull($request);
+      }
+    }
+    
+    // if multiple hausnummern, anschluss in street available, or multiple providers
+    if($this->db()->num_rows($res)) {
+      $addresses = [];
+      $providers = [];
+      $homeProvider = false;
+      $multipleAddress = false;
+      
+      while($data = $this->db()->fetch_object($res)) {
+        $addresses[] = new Hausnummer($data->id);
+        if($data->provider_id == HOME_PROVIDER_ID) {
+          $homeProvider = true;
+        }
+        if(!in_array($data->provider, $providers)) {
+          $providers[$data->provider_id] = $data->provider;
+        }
+        if($data->hausnummer != $hausnummer) {
+          $multipleAddress = true;
+        }
+      }
+      
+      $pc = new ProductController();
+      
+      if($homeProvider && $multipleAddress) {
+        $this->layout()->set("debug", "multi hausnummern, homeprovider");
+        $this->layout()->setTemplate("Check/Result/Street");
+        return true;
+      }
+      if($homeProvider) {
+        $this->layout()->set("debug", "single hausnummer, homeprovider");
+        $this->layout()->setTemplate("Check/Result/Success");
+        $this->layout()->set("productsPrivate", $pc->getProducts(1, "fiber", "privat"));
+        $this->layout()->set("productsBusiness", $pc->getProducts(1, "fiber", "business"));
+        if($data->status == 1) {
+          $this->layout()->set("debug", "single hausnummer, homeprovider, rohr am grundstück");
+          $this->layout()->setTemplate("Check/Result/Street");
+        }
+        return true;
+      }
+      if(!$homeProvider) {
+        $this->layout()->set("providers", $providers);
+        $this->layout()->set("debug", "single hausnummer, partner provider");
+        $this->layout()->setTemplate("Check/Result/SuccessPartner");
+        return true;
+      }
+      
+      return true;
+    } /*elseif($this->db()->num_rows($res) == 1 && $hausnummerMatch) {
+      // exactly 1 match
+      $data = $this->db()->fetch_object($res);
+      $address = new Hausnummer($data->id);
+      $this->layout()->set("adresse", $address);
+      $this->layout()->set("debug", "single address, only homeprovider");
+      $this->layout()->setTemplate("Check/Result/Success");
+      return true;
+    }*/
+    
+  }
+}
\ No newline at end of file
diff --git a/application/AddressDB/AddressDBController.php b/application/AddressDB/AddressDBController.php
new file mode 100644
index 000000000..f9c6b3745
--- /dev/null
+++ b/application/AddressDB/AddressDBController.php
@@ -0,0 +1,5 @@
+<?php
+
+class AddressDBController extends mfBaseController {
+  
+}
\ No newline at end of file
diff --git a/application/Api/v1/OrtApicontroller.php b/application/Api/v1/OrtApicontroller.php
new file mode 100644
index 000000000..a1c66de95
--- /dev/null
+++ b/application/Api/v1/OrtApicontroller.php
@@ -0,0 +1,71 @@
+<?php
+
+class OrtApicontroller extends mfBaseApicontroller {
+  
+  protected function init() {
+    //$this->addRoute("/home/getAll", "getHomes", "GET");
+    $this->addRoute("/ort/find", "findOrt", "POST");
+    //$this->addRoute("/home/:oanid/products", "getHomeProducts", "GET");
+  }
+  
+  protected function findOrt() {
+    $search = $this->post['search'];
+    
+    if(!$search) {
+      return mfResponse::BadRequest(['message' => "Suchbegriff darf nicht leer sein!"]);
+    }
+    
+    $orte = [];
+    
+    $ag = new ADBGemeinde();
+    $results = $ag->find($search);
+    //var_dump($results);exit;
+    foreach($results as $result) {
+      if(is_array($result->plz) && count($result->plz)) {
+        foreach($result->plz as $plz) {
+          $orte[] = ['plz' => $plz->plzstring, 'ort' => $result->name];
+        }
+      }
+      
+    }
+    
+    return mfResponse::Ok(['orte' => $orte]);
+  }
+  
+  /*
+  protected function getHomes() {
+    $homes = [];
+    
+    foreach(HomeModel::search(['operationalstate_id' => [5,3]]) as $home) { 
+      $homes[] = $home->getApiArray();
+    }
+    
+    return mfResponse::Ok(['homes' => $homes]);
+  }*/
+  /*
+  protected function validateOan($oan_id) {
+    $home = new Home();
+    $home->loadByOan($oan_id);
+    if(!$home->id) {
+      return mfResponse::NotFound(['oan_d' => $oan_id, 'isValid' => false]);
+    }
+    
+    return mfResponse::Ok(['oan_d' => $oan_id, 'isValid' => true]);
+  }*/
+  /*
+  protected function getHomeProducts($oanid) {
+    $home = new Home();
+    $home->loadByOan($oanid);
+    if(!$home->id) {
+      return mfResponse::NotFound(['message' => "Home not found"]);
+    }
+    
+    $products = [];
+    foreach(ProductModel::search(['provider_id' => $this->me->provider_id]) as $product) {
+      $products[] = $product->getApiArray();
+    }
+    
+    return mfResponse::Ok(["products" => $products]);
+    
+  }*/
+}
\ No newline at end of file
diff --git a/application/User/User.php b/application/User/User.php
index 0f6015f5c..3fc21192b 100644
--- a/application/User/User.php
+++ b/application/User/User.php
@@ -43,6 +43,65 @@ class User extends mfBaseModel {
     return false;
   }
   
+  public function loadByUsername($username) {
+    $username = $this->db->escape($username);
+    if(!$username) {
+      return false;
+    }
+    
+    $res = $this->db->select($this->table, "*", "username='$username' LIMIT 1");
+    if($this->db->num_rows($res)) {
+      $data = $this->db->fetch_object($res);
+      $this->load($data);
+      return true;
+    }
+    return false;
+  }
+  
+  public function loadByApikey($key) {
+    $key = $this->db->escape($key);
+    if(!$key) {
+      return false;
+    }
+    
+    $res = $this->db->select($this->table, "*", "apikey='$key'");
+    if($this->db->num_rows($res) === 1) {
+      $data = $this->db->fetch_object($res);
+      $this->load($data);
+      return true;
+    }
+    return false;
+  }
+  
+  public function createApiKey() {
+    $tries = 3;
+    $key = false;
+    
+    while(!$key) {
+      $source = random_bytes(128);
+      $key = base64_encode($source);
+      $key = str_replace(["/","=","+"], "", $key);
+      $key = substr($key, 0, 32);
+      
+      $res = $this->db->select($this->table, "id", "apikey='$key'");
+      if($this->db->num_rows($res) || strlen($key) < 32) {
+        $key = false;
+        $tries--;
+        $this->log->error("new api key not unique ($tries)");
+        if($tries < 1) {
+          break;
+        }
+      }
+    }
+    
+    if(!$key) {
+      $this->log->error("unable to create unique api key");
+      return null;
+    }
+    
+    return $key;
+  }
+  
   public function getAbbrName() {
     if(strpos($this->name, " ") === false) {
       return $this->name;
diff --git a/application/User/UserController.php b/application/User/UserController.php
index 7eb5d27cc..e5cc98f9b 100644
--- a/application/User/UserController.php
+++ b/application/User/UserController.php
@@ -73,6 +73,30 @@ class UserController extends mfBaseController {
     $this->layout()->set("addresses", $addresses);
   }
   
+  protected function generateApikey($request) {
+    if(!$this->isAdmin()) {
+      $this->redirect("Dashboard");
+    }
+    $id = $request['id'];
+    if(!is_numeric($id) || $id < 1) {
+      $this->layout()->setFlash("User nicht gefunden.", "error");
+      $this->redirect("User");
+    }
+    
+    $user = new User($id);
+    if(!$user->id) {
+      $this->layout()->setFlash("User nicht gefunden.", "error");
+      $this->redirect("User");
+    }
+    
+    $user->apikey = $user->createApiKey();
+    $user->save();
+    
+    $this->layout()->setFlash("API Key erfolgreich generiert.", "success");
+    $this->redirect("User", "edit", ['id' => $id]);
+    
+  }
+  
   protected function profileAction($request) {
     
   }
@@ -92,6 +116,17 @@ class UserController extends mfBaseController {
     }
     
     $user = new User($id);
+    
+    // check if new user already exits
+    if($this->isAdmin() && !$r->id) {
+      $tu = new User();
+      $tu->loadByUsername($r->username);
+      if($tu->id) {
+        $this->layout()->setFlash("Benutzer mit diesem Benutzername bereits vorhanden!", "error");
+        $this->redirect("User");
+      }
+    }
+    
     if(!$user->permissions) {
       $user->permissions = new WorkerPermission();
     }
diff --git a/application/User/UserModel.php b/application/User/UserModel.php
index d39dff2ef..d3ef81ddd 100644
--- a/application/User/UserModel.php
+++ b/application/User/UserModel.php
@@ -6,6 +6,7 @@ class UserModel {
   public $password = null;
   public $name = null;
   public $email = null;
+  public $apikey = null;
   public $ip = null;
   public $sessionid = null;
   
diff --git a/lib/autoloader/autoloader.php b/lib/autoloader/autoloader.php
index 1d1fabecb..c38183069 100644
--- a/lib/autoloader/autoloader.php
+++ b/lib/autoloader/autoloader.php
@@ -1,6 +1,7 @@
 <?php
 
 spl_autoload_register("mfAutoload", true);
+spl_autoload_register("mfBaseApicontroller::loadApiClass");
 require_once BASEDIR.'/vendor/autoload.php';
 
 //require_once PEARDIR.'/PEAR2/Autoload.php';
@@ -50,13 +51,21 @@ function mfAutoload($name) {
 function mfAutoload_loadLib($name) {
 	if(preg_match('/^mf.+/',$name)) {
 		$filename=LIBDIR."/mvcfronk/$name/$name.php";
-		if(preg_match('/^(.*)Controller$/',$name,$m)) {
+    if(preg_match('/^(.*)Apicontroller$/',$name,$m)) {
 			$filename=LIBDIR."/mvcfronk/".$m[1]."/$name.php";
 		}
-		if(file_exists($filename)) {
+    if(file_exists($filename)) {
 			require_once($filename);
-		}
-	} elseif(preg_match('/^([^_]+)_(.+)$/',$name,$m)) {
+		} else {
+      if(preg_match('/^(.*)Controller$/',$name,$m)) {
+  			$filename=LIBDIR."/mvcfronk/".$m[1]."/$name.php";
+  		}
+      if(file_exists($filename)) {
+        require_once($filename);
+      }
+    }
+    
+  } elseif(preg_match('/^([^_]+)_(.+)$/',$name,$m)) {
 		$filename=LIBDIR."/".$m[1]."/".$m[2].".php";
 	} else {
 		$filename=LIBDIR."/$name/$name.php";
diff --git a/lib/mvcfronk/mfBase/mfBaseApicontroller.php b/lib/mvcfronk/mfBase/mfBaseApicontroller.php
new file mode 100644
index 000000000..76d67745b
--- /dev/null
+++ b/lib/mvcfronk/mfBase/mfBaseApicontroller.php
@@ -0,0 +1,546 @@
+<?php
+
+// include BaseModel if available
+include_once(realpath(dirname(__FILE__))."/mfBaseModel.php");
+
+class mfBaseApicontroller {
+	protected $log;
+  protected $needlogin = false;
+  protected $siteTitle;
+	private $mfAction;
+	private $mfDBI;
+	private $mfMenu;
+	private $mfUser;
+  protected $requireAuth = true;
+  protected $me;
+  protected $mod;
+  protected $action;
+  protected $apiversion;
+  protected $headers = [];
+  protected $route;
+  protected $get = [];
+  protected $post = [];
+  protected $format = "default";
+  
+  private $http_method;
+  private $routes = [];
+	
+	public function __construct($params = NULL) {
+		// load logging facility
+		$this->log = mfLoghandler::singleton();
+    $this->loadRequest($params);
+    
+    register_shutdown_function(["mfBaseApicontroller", "return_errors"]);
+    
+    // run Controllers init() function
+		if(method_exists($this,"init")) {
+			$this->init();
+		}
+    
+    if($this->requireAuth) {
+      $this->authenticateUser();
+    }
+    
+    // route to action
+    $this->route = $params['apicall'].(($params['apiparams']) ? $params['apiparams'] : "");
+    $responseData = $this->runRoute($this->route);
+    
+    if(!$responseData) {
+      $this->return(mfResponse::InternalServerError());
+    }
+    
+    // return respnse
+    $this->return($responseData);
+    
+	}
+  
+  private function authenticateUser() {
+    $key = false;
+    //var_dump($this->headers);exit;
+    if(array_key_exists("x-api-key", $this->headers) && $this->headers['x-api-key']) {
+      $key = $this->headers['x-api-key']; // change to X-Auth-Token
+    }
+    if(array_key_exists("apikey", $this->get)) {
+      $key = $this->get['apikey']; // token
+    }
+    
+    $me = new User;
+    $me->loadByApikey($key);
+    
+    if(!$me->id) {
+      $this->return(mfResponse::Unauthorized(['message' => "API key missing or invalid"]));
+    }
+    $_SESSION[MFAPPNAME.'_username'] = $me->username;
+    $this->log->info("Authenticated '".$me->username."' with api key");
+    $this->me = $me;
+  }
+  
+  private function loadRequest($params) {
+    foreach(apache_request_headers() as $header => $value) {
+      $this->headers[strtolower($header)] = $value;
+    }
+    // GET parameters
+    $get = $params;
+    unset($get['mod']);
+    unset($get['action']);
+    unset($get['apiv']);
+    unset($get['apicall']);
+    unset($get['apiparams']);
+    unset($get['http_method']);
+    $this->get = $get;
+    $this->mod = $params['mod'];
+    $this->action = $params['action'];
+    
+    // check for api version
+    $apiversion = API_VERSION;
+    if($params['apiv'] && $params['apiv'] != $apiversion) {
+      $apiversion = $params['apiv'];
+    }
+    $this->apiversion = $apiversion;
+    $this->http_method = strtoupper($_SERVER['REQUEST_METHOD']);
+
+    if($this->http_method == "BREW") {
+      // easter egg :)
+      $this->return(mfResponse::ImATeaPot());
+    }
+    
+    // CORS preflight OPTIONS
+    // CORS headers must be correctly set in .htaccess or vhost config
+    if($this->http_method == "OPTIONS") {
+      $this->return(mfResponse::Ok());
+    }
+    
+    // POST Request
+    $post = [];
+    if($this->http_method == "POST") {
+      $post = $this->getPostRequest();
+      if($post === false) {
+        $post = [];
+        //$this->return(mfResponse::BadRequest(["message" => "Invalid request body; expected Form-Urlencoded or JSON format"]));
+      }
+      $this->post = $post;
+    }
+    
+    return true;
+  }
+  
+  private function getPostRequest() {
+    $body = $this->getRequestBody();
+    if(is_array($body)) {
+      // request is parsed already ($_POST)
+      return $body;
+    }
+    
+    // otherwise request likely is json
+    $json_request = json_decode($body);
+    if(json_last_error() === JSON_ERROR_NONE) {
+      //var_dump((array)$json_request);exit;
+      return (array)$json_request;
+    }
+    
+    return false;
+  }
+  
+  private function getRequestBody() {
+    if($_SERVER["CONTENT_TYPE"] == "application/json") {
+      $request_body = file_get_contents('php://input');
+      return $request_body;
+    }
+    
+    return $_POST;
+    
+  }
+  
+  protected function return($response) {
+    //var_dump($response);exit;
+    $code = 500;
+    $status = "Internal Server Error";
+    $data = [];
+    
+    if($response['code']) {
+      $code = $response['code'];
+    }
+    if($response['status']) {
+      $status = $response['status'];
+    }
+    if(is_array($response['data'])) {
+      $data = $response['data'];
+    }
+    
+    $proto = "HTTP/1.0";
+    if($_SERVER["SERVER_PROTOCOL"]) {
+      $proto = $_SERVER["SERVER_PROTOCOL"];
+    }
+    header("$proto $code $status");
+    header("Content-type: application/json");
+    //http_response_code($code);
+    echo json_encode(["status" => $status, "result" => $data]);
+    exit;
+  }
+  
+  public static function staticReturn($response) {
+    //var_dump($response);exit;
+    $code = 500;
+    $status = "Internal Server Error";
+    $data = [];
+    
+    if($response['code']) {
+      $code = $response['code'];
+    }
+    if($response['status']) {
+      $status = $response['status'];
+    }
+    if(is_array($response['data'])) {
+      $data = $response['data'];
+    }
+    
+    $proto = "HTTP/1.0";
+    if($_SERVER["SERVER_PROTOCOL"]) {
+      $proto = $_SERVER["SERVER_PROTOCOL"];
+    }
+    header("$proto $code $status");
+    header("Content-type: application/json");
+    //http_response_code($code);
+    echo json_encode(["status" => $status, "result" => $data]);
+    exit;
+  }
+  
+  private function checkAuth() {
+    
+  }
+  
+  protected function runRoute($params) {
+    if(!is_array($this->routes) || !count($this->routes)) {
+      return false;
+    }
+    
+    $params = trim($params, "/");
+    $m = [];
+    
+    if(preg_match('/\.(\w+)$/', $params, $m)) {
+      if($m[1]) {
+        $format = strtolower($m[1]);
+        $params = preg_replace("/\.$format$/", "", $params);
+        $this->format = $format;
+      }
+    }
+    
+    //var_dump($params);exit;
+    
+    $req_parts = explode("/", $params);
+    $req_count = count($req_parts);
+
+    foreach($this->routes as $route) {
+      if($route['method'] != $this->http_method) {
+        continue;
+      }
+      
+      $route_string = trim($route['route'], "/");
+      $route_parts = explode("/", $route_string);
+      $route_count = count($route_parts);
+      
+      if($req_count != $route_count) {
+        continue;
+      }
+      // same number of parts
+      
+      $vars = [];
+      foreach($route_parts as $i => $rp) {
+        if(substr($rp,0,1) == ":") {
+          // part is variable
+          $var_name = substr($rp, 1);
+          $vars[$var_name] = $req_parts[$i];
+          continue;
+        } else {
+          if($rp != $req_parts[$i]) {
+            continue 2; // break out of this loop and continue outer foreach
+          }
+        }
+      }
+      // found valid route
+      return $this->call($route['action'], $vars);
+      
+    }
+    
+    // no route found
+    $this->return(mfResponse::BadRequest());
+    exit;
+    
+  }
+  
+  /**
+   * Shutdown handler to return PHP errors as API response.
+   * Errors are still logged in error_log
+   */
+  public static function return_errors() {
+    $error = error_get_last();
+    //var_dump($error);exit;
+    
+    if($error && $error['type'] & (E_ERROR|E_CORE_ERROR|E_COMPILE_ERROR|E_USER_ERROR|E_RECOVERABLE_ERROR)) {
+      mfBaseApicontroller::staticReturn(mfResponse::InternalServerError(["message" => "An internal error occured, please try again"]));
+    }
+    
+    
+    /*header("Content-type: application/json");
+    http_response_code($code);
+    echo json_encode(["status" => $status, "result" => $data]);
+    exit;*/
+    
+  } 
+  
+  private function call($function, $params = []) {
+    if(count($params) === 1) {
+      return $this->__call($function,reset($params));
+    } else {
+      return $this->__call($function,$params);
+    }
+  }
+  
+  protected function addRoute($route, $action, $method) {
+    $this->routes[] = [
+        "route" => $route,
+        "action" => $action,
+        "method" => $method
+    ];
+  }
+	
+  public static function loadApiClass($name) {
+    //var_dump($name);exit;
+    if(!$name) {
+      return false;
+    }
+    
+    $folder = APPDIR."Api/".((defined("CURRENT_API_VERSION")) ? CURRENT_API_VERSION : API_VERSION);
+    
+    $m = [];
+    if(preg_match('/(.+)Apicontroller/',$name, $m)) {
+      $classname = $m[1]."Apicontroller";
+      $filename = "$classname.php";
+      if(file_exists("$folder/$filename")) {
+        require_once "$folder/$filename";
+      }
+    }
+  }
+  
+	protected function user() {
+		if(!MFUSELOGIN) {
+			trigger_error("mvcfronk: Tried to access mfBaseController::user(), though MFUSELOGIN is set to false.", E_USER_WARNING);
+			return false;
+		}
+		if(!$this->mfUser) {
+			$this->mfUser=mfUser::singleton();
+		}
+		return $this->mfUser;
+	}
+
+	
+	protected function db() {
+		$args=func_get_args();
+		
+		// if no arguments, just return a DB instance
+		if(!$args) {
+      // don't allow managed FronkDB instance, but new custom instance is allowed
+      if(!FRONKDB) {
+        return false;
+      }
+			if(!is_object($this->mfDBI)) {
+				$this->mfDBI=FronkDB::singleton();
+				
+			}
+			return $this->mfDBI;
+		} else {
+			// else return a new instance
+			var_dump($args);
+			$dbhost=$args[0];
+			$dbuser=$args[1];
+			$dbpass=$args[2];
+			$dbname=$args[3];
+			return $this->getNewDBInstance($dbhost,$dbuser,$dbpass,$dbname);
+		}
+		
+	}
+
+	public function __call($name,$params) {
+		if(method_exists($this,$name)) {
+      return call_user_func(array($this, $name), $params);
+		} else { // if function doesn't exist, maybe it's an Action
+			$funcname=lcfirst($name);
+			if(!preg_match('/Action$/',$name)) {
+				$funcname.="Action";
+			}
+			
+			if(method_exists($this,$funcname)) {
+        return call_user_func(array($this, $funcname), $params);
+			} else {
+				throw new Exception(get_class($this).": $name not found",404);
+			}
+		}
+	}
+  
+  public function __get($name) {
+    if($name == "db") {
+      return $this->db();
+    }
+    
+    return null;
+  }
+
+  
+  protected function logout() {
+		mfLoginController::logout();
+		$this->redirect(DEFAULT_ROUTE);
+	}
+
+  /*
+	 *  private internal functions
+	 */	
+	
+	private function getNewDBInstance($dbhost=false,$dbuser=false,$dbpass=false,$dbname=false) {
+		if(!$dbhost) $dbhost=FRONKDB_DBHOST;
+		if(!$dbuser) $dbhost=FRONKDB_DBUSER;
+		if(!$dbpass) $dbhost=FRONKDB_DBPASS;
+		if(!$dbname) $dbname=FRONKDB_DBNAME;
+		
+		return new FronkDB($dbhost,$dbuser,$dbpass,$dbname);
+	}
+	
+	public static function redirect($mod=false,$action=false,$params=false,$anker=false) {
+		//var_dump($mod);
+		//var_dump($action);
+    
+    $log = mfLoghandler::singleton();
+		
+    if(MFUSEFANCYURLS && defined('MFFANCYBASEURL')) {
+      // use fancy urls
+      $url=MFFANCYBASEURL;
+      if($mod) {
+        $url.="/$mod";
+        if($action) {
+          $url.="/$action";
+        }
+      }
+    } else {
+      // no fancy urls
+      if(!$mod) {
+        $url="?";
+      } elseif($mod) {
+        $url="?action=$mod";
+        if($action) {
+          $url.="_$action";
+        }
+      }
+    }
+    /*
+    if(is_array($params) && count($params)) {
+      foreach($params as $k => $v) {
+        $url.="&$k=$v";
+      }
+    }*/
+    
+    if(is_array($params) && count($params)) {
+      $url .= (MFUSEFANCYURLS) ? "/?" : "&";
+			foreach($params as $k => $v) {
+        $v = urlencode($v);
+        
+        if($k) {
+          $k = urlencode($k);
+          $url .= "$k=$v&";
+        } else {
+          $url .= "$v&";
+        }
+			}
+      
+      $url = preg_replace('/&$/', '', $url);
+    }
+    
+    if($anker) {  
+      $url.="#$anker";  
+    }
+
+    $log->debug("Redirecting to $url");
+		header("Location: $url");
+		exit;
+	}
+  
+  public static function getUrl($mod, $action=null, $param=null) {
+		if(!$mod) {
+			return "";
+		}
+
+    
+    if(MFUSEFANCYURLS) {
+      // use fancy urls
+      $url=MFFANCYBASEURL;
+      if($mod) {
+        $url.="/$mod";
+        if($action) {
+          $url.="/$action";
+        }
+      }
+      $url = preg_replace('#//#','/',$url);
+    } else {
+      // no fancy urls
+      $url="?action=$mod";
+      if($action) {
+        $url.="_$action";
+      }
+    }
+		if(is_array($param) && count($param)) {
+      $url .= (MFUSEFANCYURLS) ? "/" : "&amp;";
+      $param_qs = http_build_query($param);
+			$url .= "$param_qs";
+		}
+		
+		return $url;
+	}
+  
+  public static function returnJson($data) {
+    if(is_array($data)) {
+      header("Content-Type: application/json");
+      echo json_encode($data);
+      exit;
+    } else {
+      throw new Exception("Data not an array");
+    }
+  }
+  
+  // Helper functions
+
+    public static function dateToTimestamp($date) {
+    $t = array(0,0,0);
+
+    // extract day, month, year
+    if (!preg_match('/^(\d{1,2})\.(\d{1,2})\.(\d{2,4})/',$date,$d)) {
+      return false;
+    }
+    // extract time if available
+    if (preg_match('/(\d\d):(\d\d):(\d\d)$/',$date,$t)) {
+      if (!$t[3]) {
+        $t[3] = 0;
+      }
+    }
+  // make and return timestamp
+    $ts = mktime($t[1],$t[2],$t[3],$d[2],$d[1],$d[3]);
+    return $ts;
+  }
+  
+  public static function dateToDB($date,$type='l') {
+    // get timestamp
+    $ts = self::dateToTimestamp($date);
+    
+    // only proceed if timestamp conversion was successful
+    if(!$ts) {
+      return false;
+    }
+    
+    // return date and time if long type requested
+    if($type = 'l') {
+      $dbdate = date('Y-m-d H:i:s',$ts);
+    } else {
+      $dbdate = date('Y-m-d',$ts);
+    }
+
+    return $dbdate;
+  }
+  
+}
diff --git a/lib/mvcfronk/mfBase/mfBaseController.php b/lib/mvcfronk/mfBase/mfBaseController.php
index 11c00ed0d..a01e3085e 100644
--- a/lib/mvcfronk/mfBase/mfBaseController.php
+++ b/lib/mvcfronk/mfBase/mfBaseController.php
@@ -19,6 +19,10 @@ class mfBaseController {
 		// load logging facility
 		$this->log = mfLoghandler::singleton();
 		
+    if($params === null || $params === false) {
+      $params = [];
+    }
+    
     $this->mod = $params['mod'];
     $this->action = $params['action'];
     
@@ -117,7 +121,6 @@ class mfBaseController {
 			return $this->mfDBI;
 		} else {
 			// else return a new instance
-			var_dump($args);
 			$dbhost=$args[0];
 			$dbuser=$args[1];
 			$dbpass=$args[2];
@@ -171,7 +174,7 @@ class mfBaseController {
 		if(!$dbpass) $dbhost=FRONKDB_DBPASS;
 		if(!$dbname) $dbname=FRONKDB_DBNAME;
 		
-		return new FronkDB($dbhost,$dbuser,$dbpass,$dbname);
+		return FronkDB::singleton($dbhost,$dbuser,$dbpass,$dbname);
 	}
 	
 	public static function redirect($mod=false,$action=false,$params=false,$anker=false) {
diff --git a/lib/mvcfronk/mfBase/mfBaseModel.php b/lib/mvcfronk/mfBase/mfBaseModel.php
index 0868d60fe..951e85d4f 100644
--- a/lib/mvcfronk/mfBase/mfBaseModel.php
+++ b/lib/mvcfronk/mfBase/mfBaseModel.php
@@ -41,15 +41,17 @@ class mfBaseModel {
 		if(defined("MFMODEL_USEFIELDPREFIX") && MFMODEL_USEFIELDPREFIX==true) {
 			$this->prefixfields=true;
 		}
-		if(method_exists($this, "init")) {
-			$this->init($_);
-		}
-		$this->data = new stdClass();
+    
+    $this->data = new stdClass();
     
     if(FRONKDB) {
         $this->db=FronkDB::singleton();
     }
     
+		if(method_exists($this, "init")) {
+			$this->init($_);
+		}
+    
 		if(is_numeric($_)) {
       $this->fetch($_);
 		} elseif(is_object($_)) {
diff --git a/lib/mvcfronk/mfResponse/mfResponse.php b/lib/mvcfronk/mfResponse/mfResponse.php
new file mode 100644
index 000000000..9af379df2
--- /dev/null
+++ b/lib/mvcfronk/mfResponse/mfResponse.php
@@ -0,0 +1,70 @@
+<?php
+
+class mfResponse {
+  
+  public static function Ok($data = []) {
+    $response = [];
+    $response['code'] = 200;
+    $response['status'] = "OK";
+    $response["data"] = $data;
+    return $response;
+  }
+  
+  public static function Created($data = []) {
+    $response = [];
+    $response['code'] = 201;
+    $response['status'] = "Created";
+    $response["data"] = $data;
+    return $response;
+  }
+  
+  public static function NotFound($data = []) {
+    $response = [];
+    $response['code'] = 404;
+    $response['status'] = "Not Found";
+    $response["data"] = $data;
+    return $response;
+  }
+  
+  public static function BadRequest($data = []) {
+    $response = [];
+    $response['code'] = 400;
+    $response['status'] = "Bad Request";
+    $response["data"] = $data;
+    return $response;
+  }
+  
+  public static function InternalServerError($data = []) {
+    $response = [];
+    $response['code'] = 500;
+    $response['status'] = "Internal Server Error";
+    $response["data"] = $data;
+    return $response;
+  }
+  
+  public static function Unauthorized($data = []) {
+    $response = [];
+    $response['code'] = 401;
+    $response['status'] = "Unauthorized";
+    $response["data"] = $data;
+    return $response;
+  }
+  
+  public static function Forbidden($data = []) {
+    $response = [];
+    $response['code'] = 403;
+    $response['status'] = "Forbidden";
+    $response["data"] = $data;
+    return $response;
+  }
+  
+  public static function ImATeaPot($data = []) {
+    $response = [];
+    $response['code'] = 418;
+    $response['status'] = "I'm a teapot";
+    $response["data"] = $data;
+    return $response;
+  }
+  
+  
+}
\ No newline at end of file
diff --git a/lib/mvcfronk/mfRouter/mfRouter.php b/lib/mvcfronk/mfRouter/mfRouter.php
index 875579ad9..6036debd3 100644
--- a/lib/mvcfronk/mfRouter/mfRouter.php
+++ b/lib/mvcfronk/mfRouter/mfRouter.php
@@ -20,6 +20,7 @@ class mfRouter {
 	
 	
 	public function __construct($request) {
+    //var_dump($request);exit;
     // set default route, in case no default route is defined in configfile.
 		$this->default['mod']="Application";
 		$this->default['action']="Index";
@@ -29,73 +30,125 @@ class mfRouter {
     }
     
 		if(defined("DEFAULT_ROUTE") && strlen(DEFAULT_ROUTE)) {
-			$defroute=explode("_",DEFAULT_ROUTE);
-			$this->default['mod']=$defroute[0];
-			if(count($defroute) == 2 && $defroute[1]) {
-				$this->default['action']=$defroute[1];
+			$defroute = explode("_",DEFAULT_ROUTE);
+			$this->default['mod'] = $defroute[0];
+			if(count($defroute) > 1 && $defroute[1]) {
+				$this->default['action'] = $defroute[1];
 			}
 			
 		}
 		
-    if(defined("MFSESSION") && MFSESSION === true) {
-      session_name(MFAPPNAME."_session");
-      session_start();
-    }
+    
     
     // set parameters supplied in url
     $umod = "";
     $uaction = "";
     
     // get mod and action
-		if(preg_match('/^([^_]+)(?:_(.+)?)?$/',$request['action'],$m)) {
+    $m = [];
+		if(array_key_exists("action", $request) && preg_match('/^([^_]+)(?:_(.+)?)?$/',$request['action'],$m)) {
       $umod = $m[1];
 			$this->mod = $m[1];
 			$this->action = "Index";
-			if(count($m) == 3 && $m[2]) {
+			if(count($m) > 2 && $m[2]) {
         $uaction = $m[2];
-				$this->action=$m[2];
+				$this->action = $m[2];
 			}
 		} else {
-			$this->mod=$this->default['mod'];
-			$this->action=$this->default['action'];
+			$this->mod = $this->default['mod'];
+			$this->action = $this->default['action'];
 		}
+    
+    // if login request, redirect to mfLoginController
+    if(array_key_exists("mfLogin_action", $request) && $request['mfLogin_action'] == "mfLogin_Login") {
+      $this->mod = "mfLogin";
+      $this->action = "Login";
+      $classname = "mfLoginController";
+    } else {
+      // set classname of controller to load
+      $classname = $this->mod."Controller";
+    }
+    
+    
     // get baseurl from fancy urls if used
     if(MFUSEFANCYURLS) {
       if(!$umod) {
         $baseurl = $_SERVER['REQUEST_URI'];
       }
       if($umod && !$uaction) {
-        if(preg_match("#^(.+)/$umod/?\\??#",$_SERVER['REQUEST_URI'],$m)) {
+        if(preg_match("#^(.+)/$umod/?\\??#i",$_SERVER['REQUEST_URI'],$m)) {
           $baseurl = $m[1];
         }
       }
       if($umod && $uaction) {
-        if(preg_match("#^(.+)/$umod/$uaction/?\\??#",$_SERVER['REQUEST_URI'],$m)) {
+        if(preg_match("#^(.+)/$umod/$uaction/?\\??#i",$_SERVER['REQUEST_URI'],$m)) {
           $baseurl = $m[1];
         }
       }
       define("MFFANCYBASEURL",$baseurl);
     }
     
-		$request['mod']=ucfirst($this->mod);
-		$request['action']=ucfirst($this->action);
+
+    // api call handling
+    if(ucfirst($this->mod) == "Api") {
+      //var_dump($request);exit;
+      $apiversion = API_VERSION;
+      $apicall = false;
+      $apimod = "";
+      $apiaction = "";
+      
+      if($request["apiv"]) {
+        $apiversion = $request["apiv"];
+      }
+      if(!defined("CURRENT_API_VERSION")) {
+        define("CURRENT_API_VERSION", $apiversion);
+      }
+      
+      if($request['apicall']) {
+        $apicall = $request['apicall'];
+        
+        $m = [];
+        if(preg_match('/^([^_]+)(?:_(.+)?)?$/',$apicall,$m)) {
+          $apimod = $m[1];
+          $apiaction = "Call";
+          if(array_key_exists(2, $m) && $m[2]) {
+            $apiaction = $m[2];
+          }
+        }
+        $this->mod = ucfirst($apimod);
+        $this->action = $apiaction;
+        
+        // set classname to apropriate Api Controller
+        $classname = $this->mod."Apicontroller";
+      }
+    } else {
+      // session only for non-api requests
+      if(defined("MFSESSION") && MFSESSION === true) {
+        session_name(MFAPPNAME."_session");
+        session_start();
+      }
+    }
 		
+    $request['mod'] = ucfirst($this->mod);
+		$request['action'] = ucfirst($this->action);
+    $request['http_method'] = $_SERVER['REQUEST_METHOD'];
+    
     define('MFROUTER_MOD',$this->mod);
     define('MFROUTER_ACTION',$this->action);
     
 		// initiate layout instance
-		$Layout=Layout::singleton();
+		$Layout = Layout::singleton();
 		$Layout->setTemplate($this->mod."/".$this->action);
 		$Layout->set("Mod",$this->mod);
 		$Layout->set("Action",$this->action);
 		
 		// load the appropriate Controller
-		$classname=$this->mod."Controller";
+		
 		try {
-			$page=new $classname($request);
+			$page = new $classname($request);
 		} catch(Exception $e) {
 			require_once(LIBDIR."/mvcfronk/mfExceptionhandler/mfExceptionhandlerController.php");
-			$exhc=new mfExceptionhandlerController($e);
+			$exhc = new mfExceptionhandlerController($e);
 		}
 		
 		$Layout->display();
diff --git a/lib/mvcfronk/mfRouter/mfRouter_old.php b/lib/mvcfronk/mfRouter/mfRouter_old.php
new file mode 100644
index 000000000..875579ad9
--- /dev/null
+++ b/lib/mvcfronk/mfRouter/mfRouter_old.php
@@ -0,0 +1,104 @@
+<?php
+
+require_once(LIBDIR."/autoloader/autoloader.php");
+require_once(LIBDIR."/mvcfronk/mfLog/mfLoghandler.php");
+
+/**
+ * This class routes incoming requests. 
+ * It should be called by the entry script (public/index.php or CLI.php) as the entrypoint into the application.
+ * Looks at mod and action parameters and loads the corresponding class.
+ * If no parameters are given, uses default route.
+ * Also loads Configfile.
+ * 
+ * @author fronk
+ * @param array of request params $request
+ */
+class mfRouter {
+	private $default=array();
+	private $mod;
+	private $action;
+	
+	
+	public function __construct($request) {
+    // set default route, in case no default route is defined in configfile.
+		$this->default['mod']="Application";
+		$this->default['action']="Index";
+		
+    if(!defined('MFUSEFANCYURLS')) {
+      define('MFUSEFANCYURLS',false);
+    }
+    
+		if(defined("DEFAULT_ROUTE") && strlen(DEFAULT_ROUTE)) {
+			$defroute=explode("_",DEFAULT_ROUTE);
+			$this->default['mod']=$defroute[0];
+			if(count($defroute) == 2 && $defroute[1]) {
+				$this->default['action']=$defroute[1];
+			}
+			
+		}
+		
+    if(defined("MFSESSION") && MFSESSION === true) {
+      session_name(MFAPPNAME."_session");
+      session_start();
+    }
+    
+    // set parameters supplied in url
+    $umod = "";
+    $uaction = "";
+    
+    // get mod and action
+		if(preg_match('/^([^_]+)(?:_(.+)?)?$/',$request['action'],$m)) {
+      $umod = $m[1];
+			$this->mod = $m[1];
+			$this->action = "Index";
+			if(count($m) == 3 && $m[2]) {
+        $uaction = $m[2];
+				$this->action=$m[2];
+			}
+		} else {
+			$this->mod=$this->default['mod'];
+			$this->action=$this->default['action'];
+		}
+    // get baseurl from fancy urls if used
+    if(MFUSEFANCYURLS) {
+      if(!$umod) {
+        $baseurl = $_SERVER['REQUEST_URI'];
+      }
+      if($umod && !$uaction) {
+        if(preg_match("#^(.+)/$umod/?\\??#",$_SERVER['REQUEST_URI'],$m)) {
+          $baseurl = $m[1];
+        }
+      }
+      if($umod && $uaction) {
+        if(preg_match("#^(.+)/$umod/$uaction/?\\??#",$_SERVER['REQUEST_URI'],$m)) {
+          $baseurl = $m[1];
+        }
+      }
+      define("MFFANCYBASEURL",$baseurl);
+    }
+    
+		$request['mod']=ucfirst($this->mod);
+		$request['action']=ucfirst($this->action);
+		
+    define('MFROUTER_MOD',$this->mod);
+    define('MFROUTER_ACTION',$this->action);
+    
+		// initiate layout instance
+		$Layout=Layout::singleton();
+		$Layout->setTemplate($this->mod."/".$this->action);
+		$Layout->set("Mod",$this->mod);
+		$Layout->set("Action",$this->action);
+		
+		// load the appropriate Controller
+		$classname=$this->mod."Controller";
+		try {
+			$page=new $classname($request);
+		} catch(Exception $e) {
+			require_once(LIBDIR."/mvcfronk/mfExceptionhandler/mfExceptionhandlerController.php");
+			$exhc=new mfExceptionhandlerController($e);
+		}
+		
+		$Layout->display();
+	}
+
+}
\ No newline at end of file
diff --git a/public/.htaccess b/public/.htaccess
index b20c9f033..82a20271a 100644
--- a/public/.htaccess
+++ b/public/.htaccess
@@ -1,3 +1,8 @@
+SetEnvIf Origin "(https://docs.breitband-steiermark.at|https://editor.swagger.io)$" AccessControlAllowOrigin=$0
+Header add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
+Header add Access-Control-Allow-Methods: "GET,POST,OPTIONS"
+Header add Access-Control-Allow-Headers: "X-Api-Key"
+
 RewriteEngine on
 
 RewriteRule \.css\.map$ - [F]
@@ -8,6 +13,19 @@ RewriteRule \.js\.map$ - [F]
 # if url is aliased, uncomment and change to relative base url
 #RewriteBase /
 
+# API calls
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteCond %{REQUEST_FILENAME} !-l
+RewriteRule ^api/(v\d+)/([^/]+)/?$ index.php?action=Api&apiv=$1&apicall=$2 [QSA]
+
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteCond %{REQUEST_FILENAME} !-l
+RewriteRule ^api/(v\d+)/([^/]+)(/.+)$ index.php?action=Api&apiv=$1&apicall=$2&apiparams=$3 [QSA]
+
+
+# regular web calls
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteCond %{REQUEST_FILENAME} !-l
@@ -19,19 +37,16 @@ RewriteCond %{REQUEST_FILENAME} !-l
 RewriteRule ^([^/]+)/([^/]+)/(\d+)/?$ index.php?action=$1_$2&id=$3 [QSA]
 
 
-
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteCond %{REQUEST_FILENAME} !-l
 RewriteRule ^([^/]+)/?$ index.php?action=$1 [QSA]
 
-
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteCond %{REQUEST_FILENAME} !-l
 RewriteRule ^([^/]+)/([^/]+)/?$ index.php?action=$1_$2 [QSA]
 
-
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteCond %{REQUEST_FILENAME} !-l