feat: HL tenant setup + email domain auto-assignment

- Create pre-configured Hogan Lovells tenant with demo flag and auto_assign_domains: ["hoganlovells.com"] - Add POST /api/tenants/auto-assign endpoint: checks email domain against tenant settings, auto-assigns user as associate if match - Add AutoAssignByDomain to TenantService - Update registration flow: after signup, check auto-assign before showing tenant creation form. Skip tenant creation if auto-assigned. - Add DemoBanner component shown when tenant.settings.demo is true - Extend GET /api/me to return is_demo flag from tenant settings
fix: resolve merge conflicts from role-based permissions + audit trail branches
2026-03-30 11:24:52 +02:00 · 2026-03-30 11:24:43 +02:00
28 changed files with 220 additions and 2355 deletions
--- a/backend/internal/auth/middleware.go
+++ b/backend/internal/auth/middleware.go
@@ -43,9 +43,8 @@ func (m *Middleware) RequireAuth(next http.Handler) http.Handler {
 		}
 		ctx = ContextWithRequestInfo(ctx, ip, r.UserAgent())

-		// Tenant resolution is handled by TenantResolver middleware for scoped routes.
+		// Tenant/role resolution is handled by TenantResolver middleware for scoped routes.
 		// Tenant management routes handle their own access control.
-
 		next.ServeHTTP(w, r.WithContext(ctx))
 	})
 }
--- a/backend/internal/auth/tenant_resolver.go
+++ b/backend/internal/auth/tenant_resolver.go
@@ -12,7 +12,6 @@ import (
 // Defined as an interface to avoid circular dependency with services.
 type TenantLookup interface {
 	FirstTenantForUser(ctx context.Context, userID uuid.UUID) (*uuid.UUID, error)
-	VerifyAccess(ctx context.Context, userID, tenantID uuid.UUID) (bool, error)
 	GetUserRole(ctx context.Context, userID, tenantID uuid.UUID) (string, error)
 }

@@ -42,7 +41,6 @@ func (tr *TenantResolver) Resolve(next http.Handler) http.Handler {
 				http.Error(w, `{"error":"invalid X-Tenant-ID"}`, http.StatusBadRequest)
 				return
 			}
-
 			// Verify user has access and get their role
 			role, err := tr.lookup.GetUserRole(r.Context(), userID, parsed)
 			if err != nil {
@@ -71,10 +69,10 @@ func (tr *TenantResolver) Resolve(next http.Handler) http.Handler {
 			}
 			tenantID = *first

-			// Also resolve role for default tenant
+			// Resolve role for default tenant
 			role, err := tr.lookup.GetUserRole(r.Context(), userID, tenantID)
 			if err != nil {
-				slog.Error("failed to get role for default tenant", "error", err, "user_id", userID, "tenant_id", tenantID)
+				slog.Error("failed to resolve role for default tenant", "error", err)
 				http.Error(w, `{"error":"internal error"}`, http.StatusInternalServerError)
 				return
 			}
--- a/backend/internal/auth/tenant_resolver_test.go
+++ b/backend/internal/auth/tenant_resolver_test.go
@@ -10,34 +10,26 @@ import (
 )

 type mockTenantLookup struct {
-	tenantID  *uuid.UUID
-	err       error
-	hasAccess bool
-	accessErr error
-	role      string
+	tenantID *uuid.UUID
+	role     string
+	roleSet  bool // true means role was explicitly set (even if empty)
+	err      error
 }

 func (m *mockTenantLookup) FirstTenantForUser(ctx context.Context, userID uuid.UUID) (*uuid.UUID, error) {
 	return m.tenantID, m.err
 }

-func (m *mockTenantLookup) VerifyAccess(ctx context.Context, userID, tenantID uuid.UUID) (bool, error) {
-	return m.hasAccess, m.accessErr
-}
-
 func (m *mockTenantLookup) GetUserRole(ctx context.Context, userID, tenantID uuid.UUID) (string, error) {
-	if m.role != "" {
+	if m.roleSet {
 		return m.role, m.err
 	}
-	if m.hasAccess {
-		return "associate", m.err
-	}
-	return "", m.err
+	return "associate", m.err
 }

 func TestTenantResolver_FromHeader(t *testing.T) {
 	tenantID := uuid.New()
-	tr := NewTenantResolver(&mockTenantLookup{hasAccess: true, role: "partner"})
+	tr := NewTenantResolver(&mockTenantLookup{role: "partner"})

 	var gotTenantID uuid.UUID
 	next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -66,7 +58,7 @@ func TestTenantResolver_FromHeader(t *testing.T) {

 func TestTenantResolver_FromHeader_NoAccess(t *testing.T) {
 	tenantID := uuid.New()
-	tr := NewTenantResolver(&mockTenantLookup{hasAccess: false})
+	tr := NewTenantResolver(&mockTenantLookup{role: "", roleSet: true})

 	next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		t.Fatal("next should not be called")
--- a/backend/internal/handlers/billing_rates.go
+++ b/backend/internal/handlers/billing_rates.go
@@ -1,66 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"net/http"
-
-	"mgit.msbls.de/m/KanzlAI-mGMT/internal/auth"
-	"mgit.msbls.de/m/KanzlAI-mGMT/internal/services"
-)
-
-type BillingRateHandler struct {
-	svc *services.BillingRateService
-}
-
-func NewBillingRateHandler(svc *services.BillingRateService) *BillingRateHandler {
-	return &BillingRateHandler{svc: svc}
-}
-
-// List handles GET /api/billing-rates
-func (h *BillingRateHandler) List(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-
-	rates, err := h.svc.List(r.Context(), tenantID)
-	if err != nil {
-		internalError(w, "failed to list billing rates", err)
-		return
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{"billing_rates": rates})
-}
-
-// Upsert handles PUT /api/billing-rates
-func (h *BillingRateHandler) Upsert(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-
-	var input services.UpsertBillingRateInput
-	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid JSON body")
-		return
-	}
-
-	if input.Rate < 0 {
-		writeError(w, http.StatusBadRequest, "rate must be non-negative")
-		return
-	}
-	if input.ValidFrom == "" {
-		writeError(w, http.StatusBadRequest, "valid_from is required")
-		return
-	}
-
-	rate, err := h.svc.Upsert(r.Context(), tenantID, input)
-	if err != nil {
-		internalError(w, "failed to upsert billing rate", err)
-		return
-	}
-
-	writeJSON(w, http.StatusOK, rate)
-}
--- a/backend/internal/handlers/deadlines.go
+++ b/backend/internal/handlers/deadlines.go
@@ -198,9 +198,8 @@ func (h *DeadlineHandlers) Delete(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	err = h.deadlines.Delete(r.Context(), tenantID, deadlineID)
-	if err != nil {
-		writeError(w, http.StatusNotFound, err.Error())
+	if err := h.deadlines.Delete(r.Context(), tenantID, deadlineID); err != nil {
+		writeError(w, http.StatusNotFound, "deadline not found")
 		return
 	}

--- a/backend/internal/handlers/invoices.go
+++ b/backend/internal/handlers/invoices.go
@@ -1,170 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"net/http"
-
-	"mgit.msbls.de/m/KanzlAI-mGMT/internal/auth"
-	"mgit.msbls.de/m/KanzlAI-mGMT/internal/services"
-
-	"github.com/google/uuid"
-)
-
-type InvoiceHandler struct {
-	svc *services.InvoiceService
-}
-
-func NewInvoiceHandler(svc *services.InvoiceService) *InvoiceHandler {
-	return &InvoiceHandler{svc: svc}
-}
-
-// List handles GET /api/invoices?case_id=&status=
-func (h *InvoiceHandler) List(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-
-	var caseID *uuid.UUID
-	if caseStr := r.URL.Query().Get("case_id"); caseStr != "" {
-		parsed, err := uuid.Parse(caseStr)
-		if err != nil {
-			writeError(w, http.StatusBadRequest, "invalid case_id")
-			return
-		}
-		caseID = &parsed
-	}
-
-	invoices, err := h.svc.List(r.Context(), tenantID, caseID, r.URL.Query().Get("status"))
-	if err != nil {
-		internalError(w, "failed to list invoices", err)
-		return
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{"invoices": invoices})
-}
-
-// Get handles GET /api/invoices/{id}
-func (h *InvoiceHandler) Get(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-
-	invoiceID, err := parsePathUUID(r, "id")
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "invalid invoice ID")
-		return
-	}
-
-	inv, err := h.svc.GetByID(r.Context(), tenantID, invoiceID)
-	if err != nil {
-		internalError(w, "failed to get invoice", err)
-		return
-	}
-	if inv == nil {
-		writeError(w, http.StatusNotFound, "invoice not found")
-		return
-	}
-
-	writeJSON(w, http.StatusOK, inv)
-}
-
-// Create handles POST /api/invoices
-func (h *InvoiceHandler) Create(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-	userID, _ := auth.UserFromContext(r.Context())
-
-	var input services.CreateInvoiceInput
-	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid JSON body")
-		return
-	}
-
-	if input.ClientName == "" {
-		writeError(w, http.StatusBadRequest, "client_name is required")
-		return
-	}
-	if input.CaseID == uuid.Nil {
-		writeError(w, http.StatusBadRequest, "case_id is required")
-		return
-	}
-
-	inv, err := h.svc.Create(r.Context(), tenantID, userID, input)
-	if err != nil {
-		internalError(w, "failed to create invoice", err)
-		return
-	}
-
-	writeJSON(w, http.StatusCreated, inv)
-}
-
-// Update handles PUT /api/invoices/{id}
-func (h *InvoiceHandler) Update(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-
-	invoiceID, err := parsePathUUID(r, "id")
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "invalid invoice ID")
-		return
-	}
-
-	var input services.UpdateInvoiceInput
-	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid JSON body")
-		return
-	}
-
-	inv, err := h.svc.Update(r.Context(), tenantID, invoiceID, input)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	writeJSON(w, http.StatusOK, inv)
-}
-
-// UpdateStatus handles PATCH /api/invoices/{id}/status
-func (h *InvoiceHandler) UpdateStatus(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-
-	invoiceID, err := parsePathUUID(r, "id")
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "invalid invoice ID")
-		return
-	}
-
-	var body struct {
-		Status string `json:"status"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid JSON body")
-		return
-	}
-	if body.Status == "" {
-		writeError(w, http.StatusBadRequest, "status is required")
-		return
-	}
-
-	inv, err := h.svc.UpdateStatus(r.Context(), tenantID, invoiceID, body.Status)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	writeJSON(w, http.StatusOK, inv)
-}
--- a/backend/internal/handlers/tenant_handler.go
+++ b/backend/internal/handlers/tenant_handler.go
@@ -356,6 +356,71 @@ func (h *TenantHandler) UpdateMemberRole(w http.ResponseWriter, r *http.Request)
 	jsonResponse(w, map[string]string{"status": "updated"}, http.StatusOK)
 }

+// AutoAssign handles POST /api/tenants/auto-assign — checks if the user's email domain
+// matches any tenant's auto_assign_domains and assigns them if so.
+func (h *TenantHandler) AutoAssign(w http.ResponseWriter, r *http.Request) {
+	userID, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	var req struct {
+		Email string `json:"email"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		jsonError(w, "invalid request body", http.StatusBadRequest)
+		return
+	}
+	if req.Email == "" {
+		jsonError(w, "email is required", http.StatusBadRequest)
+		return
+	}
+
+	// Extract domain from email
+	parts := splitEmail(req.Email)
+	if parts == "" {
+		jsonError(w, "invalid email format", http.StatusBadRequest)
+		return
+	}
+
+	result, err := h.svc.AutoAssignByDomain(r.Context(), userID, parts)
+	if err != nil {
+		slog.Error("auto-assign failed", "error", err)
+		jsonError(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+
+	if result == nil {
+		jsonResponse(w, map[string]any{"assigned": false}, http.StatusOK)
+		return
+	}
+
+	jsonResponse(w, map[string]any{
+		"assigned":  true,
+		"tenant_id": result.ID,
+		"name":      result.Name,
+		"slug":      result.Slug,
+		"role":      result.Role,
+		"settings":  result.Settings,
+	}, http.StatusOK)
+}
+
+// splitEmail extracts the domain part from an email address.
+func splitEmail(email string) string {
+	at := -1
+	for i, c := range email {
+		if c == '@' {
+			at = i
+			break
+		}
+	}
+	if at < 0 || at >= len(email)-1 {
+		return ""
+	}
+	return email[at+1:]
+}
+
 // GetMe handles GET /api/me — returns the current user's ID and role in the active tenant.
 func (h *TenantHandler) GetMe(w http.ResponseWriter, r *http.Request) {
 	userID, ok := auth.UserFromContext(r.Context())
@@ -370,11 +435,26 @@ func (h *TenantHandler) GetMe(w http.ResponseWriter, r *http.Request) {
 	// Get user's permissions for frontend UI
 	perms := auth.GetRolePermissions(role)

+	// Check if tenant is in demo mode
+	isDemo := false
+	if tenant, err := h.svc.GetByID(r.Context(), tenantID); err == nil && tenant != nil {
+		var settings map[string]json.RawMessage
+		if json.Unmarshal(tenant.Settings, &settings) == nil {
+			if demoRaw, ok := settings["demo"]; ok {
+				var demo bool
+				if json.Unmarshal(demoRaw, &demo) == nil {
+					isDemo = demo
+				}
+			}
+		}
+	}
+
 	jsonResponse(w, map[string]any{
 		"user_id":     userID,
 		"tenant_id":   tenantID,
 		"role":        role,
 		"permissions": perms,
+		"is_demo":     isDemo,
 	}, http.StatusOK)
 }

--- a/backend/internal/handlers/time_entries.go
+++ b/backend/internal/handlers/time_entries.go
@@ -1,209 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"net/http"
-	"strconv"
-
-	"mgit.msbls.de/m/KanzlAI-mGMT/internal/auth"
-	"mgit.msbls.de/m/KanzlAI-mGMT/internal/services"
-
-	"github.com/google/uuid"
-)
-
-type TimeEntryHandler struct {
-	svc *services.TimeEntryService
-}
-
-func NewTimeEntryHandler(svc *services.TimeEntryService) *TimeEntryHandler {
-	return &TimeEntryHandler{svc: svc}
-}
-
-// ListForCase handles GET /api/cases/{id}/time-entries
-func (h *TimeEntryHandler) ListForCase(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-
-	caseID, err := parsePathUUID(r, "id")
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "invalid case ID")
-		return
-	}
-
-	entries, err := h.svc.ListForCase(r.Context(), tenantID, caseID)
-	if err != nil {
-		internalError(w, "failed to list time entries", err)
-		return
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{"time_entries": entries})
-}
-
-// List handles GET /api/time-entries?case_id=&user_id=&from=&to=
-func (h *TimeEntryHandler) List(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-
-	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
-	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
-	limit, offset = clampPagination(limit, offset)
-
-	filter := services.TimeEntryFilter{
-		From:   r.URL.Query().Get("from"),
-		To:     r.URL.Query().Get("to"),
-		Limit:  limit,
-		Offset: offset,
-	}
-
-	if caseStr := r.URL.Query().Get("case_id"); caseStr != "" {
-		caseID, err := uuid.Parse(caseStr)
-		if err != nil {
-			writeError(w, http.StatusBadRequest, "invalid case_id")
-			return
-		}
-		filter.CaseID = &caseID
-	}
-	if userStr := r.URL.Query().Get("user_id"); userStr != "" {
-		userID, err := uuid.Parse(userStr)
-		if err != nil {
-			writeError(w, http.StatusBadRequest, "invalid user_id")
-			return
-		}
-		filter.UserID = &userID
-	}
-
-	entries, total, err := h.svc.List(r.Context(), tenantID, filter)
-	if err != nil {
-		internalError(w, "failed to list time entries", err)
-		return
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{
-		"time_entries": entries,
-		"total":        total,
-	})
-}
-
-// Create handles POST /api/cases/{id}/time-entries
-func (h *TimeEntryHandler) Create(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-	userID, _ := auth.UserFromContext(r.Context())
-
-	caseID, err := parsePathUUID(r, "id")
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "invalid case ID")
-		return
-	}
-
-	var input services.CreateTimeEntryInput
-	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid JSON body")
-		return
-	}
-	input.CaseID = caseID
-
-	if input.Description == "" {
-		writeError(w, http.StatusBadRequest, "description is required")
-		return
-	}
-	if input.DurationMinutes <= 0 {
-		writeError(w, http.StatusBadRequest, "duration_minutes must be positive")
-		return
-	}
-	if input.Date == "" {
-		writeError(w, http.StatusBadRequest, "date is required")
-		return
-	}
-
-	entry, err := h.svc.Create(r.Context(), tenantID, userID, input)
-	if err != nil {
-		internalError(w, "failed to create time entry", err)
-		return
-	}
-
-	writeJSON(w, http.StatusCreated, entry)
-}
-
-// Update handles PUT /api/time-entries/{id}
-func (h *TimeEntryHandler) Update(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-
-	entryID, err := parsePathUUID(r, "id")
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "invalid time entry ID")
-		return
-	}
-
-	var input services.UpdateTimeEntryInput
-	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid JSON body")
-		return
-	}
-
-	entry, err := h.svc.Update(r.Context(), tenantID, entryID, input)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	writeJSON(w, http.StatusOK, entry)
-}
-
-// Delete handles DELETE /api/time-entries/{id}
-func (h *TimeEntryHandler) Delete(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-
-	entryID, err := parsePathUUID(r, "id")
-	if err != nil {
-		writeError(w, http.StatusBadRequest, "invalid time entry ID")
-		return
-	}
-
-	if err := h.svc.Delete(r.Context(), tenantID, entryID); err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	writeJSON(w, http.StatusOK, map[string]string{"status": "deleted"})
-}
-
-// Summary handles GET /api/time-entries/summary?group_by=case|user|month&from=&to=
-func (h *TimeEntryHandler) Summary(w http.ResponseWriter, r *http.Request) {
-	tenantID, ok := auth.TenantFromContext(r.Context())
-	if !ok {
-		writeError(w, http.StatusForbidden, "missing tenant")
-		return
-	}
-
-	groupBy := r.URL.Query().Get("group_by")
-	if groupBy == "" {
-		groupBy = "case"
-	}
-
-	summaries, err := h.svc.Summary(r.Context(), tenantID, groupBy,
-		r.URL.Query().Get("from"), r.URL.Query().Get("to"))
-	if err != nil {
-		internalError(w, "failed to get summary", err)
-		return
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{"summary": summaries})
-}
--- a/backend/internal/models/billing_rate.go
+++ b/backend/internal/models/billing_rate.go
@@ -1,18 +0,0 @@
-package models
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-type BillingRate struct {
-	ID        uuid.UUID  `db:"id" json:"id"`
-	TenantID  uuid.UUID  `db:"tenant_id" json:"tenant_id"`
-	UserID    *uuid.UUID `db:"user_id" json:"user_id,omitempty"`
-	Rate      float64    `db:"rate" json:"rate"`
-	Currency  string     `db:"currency" json:"currency"`
-	ValidFrom string     `db:"valid_from" json:"valid_from"`
-	ValidTo   *string    `db:"valid_to" json:"valid_to,omitempty"`
-	CreatedAt time.Time  `db:"created_at" json:"created_at"`
-}
--- a/backend/internal/models/invoice.go
+++ b/backend/internal/models/invoice.go
@@ -1,38 +0,0 @@
-package models
-
-import (
-	"encoding/json"
-	"time"
-
-	"github.com/google/uuid"
-)
-
-type Invoice struct {
-	ID            uuid.UUID       `db:"id" json:"id"`
-	TenantID      uuid.UUID       `db:"tenant_id" json:"tenant_id"`
-	CaseID        uuid.UUID       `db:"case_id" json:"case_id"`
-	InvoiceNumber string          `db:"invoice_number" json:"invoice_number"`
-	ClientName    string          `db:"client_name" json:"client_name"`
-	ClientAddress *string         `db:"client_address" json:"client_address,omitempty"`
-	Items         json.RawMessage `db:"items" json:"items"`
-	Subtotal      float64         `db:"subtotal" json:"subtotal"`
-	TaxRate       float64         `db:"tax_rate" json:"tax_rate"`
-	TaxAmount     float64         `db:"tax_amount" json:"tax_amount"`
-	Total         float64         `db:"total" json:"total"`
-	Status        string          `db:"status" json:"status"`
-	IssuedAt      *string         `db:"issued_at" json:"issued_at,omitempty"`
-	DueAt         *string         `db:"due_at" json:"due_at,omitempty"`
-	PaidAt        *time.Time      `db:"paid_at" json:"paid_at,omitempty"`
-	Notes         *string         `db:"notes" json:"notes,omitempty"`
-	CreatedBy     uuid.UUID       `db:"created_by" json:"created_by"`
-	CreatedAt     time.Time       `db:"created_at" json:"created_at"`
-	UpdatedAt     time.Time       `db:"updated_at" json:"updated_at"`
-}
-
-type InvoiceItem struct {
-	Description     string  `json:"description"`
-	DurationMinutes int     `json:"duration_minutes,omitempty"`
-	HourlyRate      float64 `json:"hourly_rate,omitempty"`
-	Amount          float64 `json:"amount"`
-	TimeEntryID     *string `json:"time_entry_id,omitempty"`
-}
--- a/backend/internal/models/time_entry.go
+++ b/backend/internal/models/time_entry.go
@@ -1,24 +0,0 @@
-package models
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-type TimeEntry struct {
-	ID              uuid.UUID  `db:"id" json:"id"`
-	TenantID        uuid.UUID  `db:"tenant_id" json:"tenant_id"`
-	CaseID          uuid.UUID  `db:"case_id" json:"case_id"`
-	UserID          uuid.UUID  `db:"user_id" json:"user_id"`
-	Date            string     `db:"date" json:"date"`
-	DurationMinutes int        `db:"duration_minutes" json:"duration_minutes"`
-	Description     string     `db:"description" json:"description"`
-	Activity        *string    `db:"activity" json:"activity,omitempty"`
-	Billable        bool       `db:"billable" json:"billable"`
-	Billed          bool       `db:"billed" json:"billed"`
-	InvoiceID       *uuid.UUID `db:"invoice_id" json:"invoice_id,omitempty"`
-	HourlyRate      *float64   `db:"hourly_rate" json:"hourly_rate,omitempty"`
-	CreatedAt       time.Time  `db:"created_at" json:"created_at"`
-	UpdatedAt       time.Time  `db:"updated_at" json:"updated_at"`
-}
--- a/backend/internal/router/router.go
+++ b/backend/internal/router/router.go
@@ -31,9 +31,6 @@ func New(db *sqlx.DB, authMW *auth.Middleware, cfg *config.Config, calDAVSvc *se
 	storageCli := services.NewStorageClient(cfg.SupabaseURL, cfg.SupabaseServiceKey)
 	documentSvc := services.NewDocumentService(db, storageCli, auditSvc)
 	assignmentSvc := services.NewCaseAssignmentService(db)
-	timeEntrySvc := services.NewTimeEntryService(db, auditSvc)
-	billingRateSvc := services.NewBillingRateService(db, auditSvc)
-	invoiceSvc := services.NewInvoiceService(db, auditSvc)

 	// AI service (optional — only if API key is configured)
 	var aiH *handlers.AIHandler
@@ -68,9 +65,6 @@ func New(db *sqlx.DB, authMW *auth.Middleware, cfg *config.Config, calDAVSvc *se
 	eventH := handlers.NewCaseEventHandler(db)
 	docH := handlers.NewDocumentHandler(documentSvc)
 	assignmentH := handlers.NewCaseAssignmentHandler(assignmentSvc)
-	timeEntryH := handlers.NewTimeEntryHandler(timeEntrySvc)
-	billingRateH := handlers.NewBillingRateHandler(billingRateSvc)
-	invoiceH := handlers.NewInvoiceHandler(invoiceSvc)

 	// Public routes
 	mux.HandleFunc("GET /health", handleHealth(db))
@@ -79,6 +73,7 @@ func New(db *sqlx.DB, authMW *auth.Middleware, cfg *config.Config, calDAVSvc *se
 	api := http.NewServeMux()

 	// Tenant management (no tenant resolver — these operate across tenants)
+	api.HandleFunc("POST /api/tenants/auto-assign", tenantH.AutoAssign)
 	api.HandleFunc("POST /api/tenants", tenantH.CreateTenant)
 	api.HandleFunc("GET /api/tenants", tenantH.ListTenants)
 	api.HandleFunc("GET /api/tenants/{id}", tenantH.GetTenant)
@@ -112,7 +107,7 @@ func New(db *sqlx.DB, authMW *auth.Middleware, cfg *config.Config, calDAVSvc *se
 	scoped.HandleFunc("GET /api/cases", caseH.List)
 	scoped.HandleFunc("POST /api/cases", perm(auth.PermCreateCase, caseH.Create))
 	scoped.HandleFunc("GET /api/cases/{id}", caseH.Get)
-	scoped.HandleFunc("PUT /api/cases/{id}", caseH.Update)
+	scoped.HandleFunc("PUT /api/cases/{id}", caseH.Update)    // case-level access checked in handler
 	scoped.HandleFunc("DELETE /api/cases/{id}", perm(auth.PermCreateCase, caseH.Delete))

 	// Parties — same access as case editing
@@ -162,7 +157,7 @@ func New(db *sqlx.DB, authMW *auth.Middleware, cfg *config.Config, calDAVSvc *se
 	// Dashboard — all can view
 	scoped.HandleFunc("GET /api/dashboard", dashboardH.Get)

-	// Audit log — view requires PermViewAuditLog
+	// Audit log
 	scoped.HandleFunc("GET /api/audit-log", perm(auth.PermViewAuditLog, auditH.List))

 	// Documents — all can upload, delete checked in handler (own vs all)
@@ -170,7 +165,7 @@ func New(db *sqlx.DB, authMW *auth.Middleware, cfg *config.Config, calDAVSvc *se
 	scoped.HandleFunc("POST /api/cases/{id}/documents", perm(auth.PermUploadDocuments, docH.Upload))
 	scoped.HandleFunc("GET /api/documents/{docId}", docH.Download)
 	scoped.HandleFunc("GET /api/documents/{docId}/meta", docH.GetMeta)
-	scoped.HandleFunc("DELETE /api/documents/{docId}", docH.Delete)
+	scoped.HandleFunc("DELETE /api/documents/{docId}", docH.Delete) // permission check inside handler

 	// AI endpoints (rate limited: 5 req/min burst 10 per IP)
 	if aiH != nil {
@@ -196,25 +191,6 @@ func New(db *sqlx.DB, authMW *auth.Middleware, cfg *config.Config, calDAVSvc *se
 		scoped.HandleFunc("GET /api/caldav/status", calDAVH.GetStatus)
 	}

-	// Time entries — billing permission for create/update/delete
-	scoped.HandleFunc("GET /api/cases/{id}/time-entries", timeEntryH.ListForCase)
-	scoped.HandleFunc("POST /api/cases/{id}/time-entries", perm(auth.PermManageBilling, timeEntryH.Create))
-	scoped.HandleFunc("GET /api/time-entries", timeEntryH.List)
-	scoped.HandleFunc("GET /api/time-entries/summary", perm(auth.PermManageBilling, timeEntryH.Summary))
-	scoped.HandleFunc("PUT /api/time-entries/{id}", perm(auth.PermManageBilling, timeEntryH.Update))
-	scoped.HandleFunc("DELETE /api/time-entries/{id}", perm(auth.PermManageBilling, timeEntryH.Delete))
-
-	// Billing rates — billing permission required
-	scoped.HandleFunc("GET /api/billing-rates", perm(auth.PermManageBilling, billingRateH.List))
-	scoped.HandleFunc("PUT /api/billing-rates", perm(auth.PermManageBilling, billingRateH.Upsert))
-
-	// Invoices — billing permission required
-	scoped.HandleFunc("GET /api/invoices", perm(auth.PermManageBilling, invoiceH.List))
-	scoped.HandleFunc("POST /api/invoices", perm(auth.PermManageBilling, invoiceH.Create))
-	scoped.HandleFunc("GET /api/invoices/{id}", perm(auth.PermManageBilling, invoiceH.Get))
-	scoped.HandleFunc("PUT /api/invoices/{id}", perm(auth.PermManageBilling, invoiceH.Update))
-	scoped.HandleFunc("PATCH /api/invoices/{id}/status", perm(auth.PermManageBilling, invoiceH.UpdateStatus))
-
 	// Wire: auth -> tenant routes go directly, scoped routes get tenant resolver
 	api.Handle("/api/", tenantResolver.Resolve(scoped))

--- a/backend/internal/services/billing_rate_service.go
+++ b/backend/internal/services/billing_rate_service.go
@@ -1,88 +0,0 @@
-package services
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/google/uuid"
-	"github.com/jmoiron/sqlx"
-
-	"mgit.msbls.de/m/KanzlAI-mGMT/internal/models"
-)
-
-type BillingRateService struct {
-	db    *sqlx.DB
-	audit *AuditService
-}
-
-func NewBillingRateService(db *sqlx.DB, audit *AuditService) *BillingRateService {
-	return &BillingRateService{db: db, audit: audit}
-}
-
-type UpsertBillingRateInput struct {
-	UserID    *uuid.UUID `json:"user_id,omitempty"`
-	Rate      float64    `json:"rate"`
-	Currency  string     `json:"currency"`
-	ValidFrom string     `json:"valid_from"`
-	ValidTo   *string    `json:"valid_to,omitempty"`
-}
-
-func (s *BillingRateService) List(ctx context.Context, tenantID uuid.UUID) ([]models.BillingRate, error) {
-	var rates []models.BillingRate
-	err := s.db.SelectContext(ctx, &rates,
-		`SELECT id, tenant_id, user_id, rate, currency, valid_from, valid_to, created_at
-		 FROM billing_rates
-		 WHERE tenant_id = $1
-		 ORDER BY valid_from DESC, user_id NULLS LAST`,
-		tenantID)
-	if err != nil {
-		return nil, fmt.Errorf("list billing rates: %w", err)
-	}
-	return rates, nil
-}
-
-func (s *BillingRateService) Upsert(ctx context.Context, tenantID uuid.UUID, input UpsertBillingRateInput) (*models.BillingRate, error) {
-	if input.Currency == "" {
-		input.Currency = "EUR"
-	}
-
-	// Close any existing open-ended rate for this user
-	_, err := s.db.ExecContext(ctx,
-		`UPDATE billing_rates SET valid_to = $3
-		 WHERE tenant_id = $1
-		 AND (($2::uuid IS NULL AND user_id IS NULL) OR user_id = $2)
-		 AND valid_to IS NULL
-		 AND valid_from < $3`,
-		tenantID, input.UserID, input.ValidFrom)
-	if err != nil {
-		return nil, fmt.Errorf("close existing rate: %w", err)
-	}
-
-	var rate models.BillingRate
-	err = s.db.QueryRowxContext(ctx,
-		`INSERT INTO billing_rates (tenant_id, user_id, rate, currency, valid_from, valid_to)
-		 VALUES ($1, $2, $3, $4, $5, $6)
-		 RETURNING id, tenant_id, user_id, rate, currency, valid_from, valid_to, created_at`,
-		tenantID, input.UserID, input.Rate, input.Currency, input.ValidFrom, input.ValidTo,
-	).StructScan(&rate)
-	if err != nil {
-		return nil, fmt.Errorf("upsert billing rate: %w", err)
-	}
-
-	s.audit.Log(ctx, "create", "billing_rate", &rate.ID, nil, rate)
-	return &rate, nil
-}
-
-func (s *BillingRateService) GetCurrentRate(ctx context.Context, tenantID uuid.UUID, userID uuid.UUID, date string) (*float64, error) {
-	var rate float64
-	err := s.db.GetContext(ctx, &rate,
-		`SELECT rate FROM billing_rates
-		 WHERE tenant_id = $1 AND (user_id = $2 OR user_id IS NULL)
-		 AND valid_from <= $3 AND (valid_to IS NULL OR valid_to >= $3)
-		 ORDER BY user_id NULLS LAST LIMIT 1`,
-		tenantID, userID, date)
-	if err != nil {
-		return nil, err
-	}
-	return &rate, nil
-}
--- a/backend/internal/services/invoice_service.go
+++ b/backend/internal/services/invoice_service.go
@@ -1,292 +0,0 @@
-package services
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"fmt"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/jmoiron/sqlx"
-
-	"mgit.msbls.de/m/KanzlAI-mGMT/internal/models"
-)
-
-type InvoiceService struct {
-	db    *sqlx.DB
-	audit *AuditService
-}
-
-func NewInvoiceService(db *sqlx.DB, audit *AuditService) *InvoiceService {
-	return &InvoiceService{db: db, audit: audit}
-}
-
-type CreateInvoiceInput struct {
-	CaseID        uuid.UUID             `json:"case_id"`
-	ClientName    string                `json:"client_name"`
-	ClientAddress *string               `json:"client_address,omitempty"`
-	Items         []models.InvoiceItem  `json:"items"`
-	TaxRate       *float64              `json:"tax_rate,omitempty"`
-	IssuedAt      *string               `json:"issued_at,omitempty"`
-	DueAt         *string               `json:"due_at,omitempty"`
-	Notes         *string               `json:"notes,omitempty"`
-	TimeEntryIDs  []uuid.UUID           `json:"time_entry_ids,omitempty"`
-}
-
-type UpdateInvoiceInput struct {
-	ClientName    *string               `json:"client_name,omitempty"`
-	ClientAddress *string               `json:"client_address,omitempty"`
-	Items         []models.InvoiceItem  `json:"items,omitempty"`
-	TaxRate       *float64              `json:"tax_rate,omitempty"`
-	IssuedAt      *string               `json:"issued_at,omitempty"`
-	DueAt         *string               `json:"due_at,omitempty"`
-	Notes         *string               `json:"notes,omitempty"`
-}
-
-const invoiceCols = `id, tenant_id, case_id, invoice_number, client_name, client_address,
-	items, subtotal, tax_rate, tax_amount, total, status, issued_at, due_at, paid_at, notes,
-	created_by, created_at, updated_at`
-
-func (s *InvoiceService) List(ctx context.Context, tenantID uuid.UUID, caseID *uuid.UUID, status string) ([]models.Invoice, error) {
-	where := "WHERE tenant_id = $1"
-	args := []any{tenantID}
-	argIdx := 2
-
-	if caseID != nil {
-		where += fmt.Sprintf(" AND case_id = $%d", argIdx)
-		args = append(args, *caseID)
-		argIdx++
-	}
-	if status != "" {
-		where += fmt.Sprintf(" AND status = $%d", argIdx)
-		args = append(args, status)
-		argIdx++
-	}
-
-	var invoices []models.Invoice
-	err := s.db.SelectContext(ctx, &invoices,
-		fmt.Sprintf("SELECT %s FROM invoices %s ORDER BY created_at DESC", invoiceCols, where),
-		args...)
-	if err != nil {
-		return nil, fmt.Errorf("list invoices: %w", err)
-	}
-	return invoices, nil
-}
-
-func (s *InvoiceService) GetByID(ctx context.Context, tenantID, invoiceID uuid.UUID) (*models.Invoice, error) {
-	var inv models.Invoice
-	err := s.db.GetContext(ctx, &inv,
-		`SELECT `+invoiceCols+` FROM invoices WHERE tenant_id = $1 AND id = $2`,
-		tenantID, invoiceID)
-	if err == sql.ErrNoRows {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, fmt.Errorf("get invoice: %w", err)
-	}
-	return &inv, nil
-}
-
-func (s *InvoiceService) Create(ctx context.Context, tenantID, userID uuid.UUID, input CreateInvoiceInput) (*models.Invoice, error) {
-	tx, err := s.db.BeginTxx(ctx, nil)
-	if err != nil {
-		return nil, fmt.Errorf("begin tx: %w", err)
-	}
-	defer tx.Rollback()
-
-	// Generate invoice number: RE-YYYY-NNN
-	year := time.Now().Year()
-	var seq int
-	err = tx.GetContext(ctx, &seq,
-		`SELECT COUNT(*) + 1 FROM invoices WHERE tenant_id = $1 AND invoice_number LIKE $2`,
-		tenantID, fmt.Sprintf("RE-%d-%%", year))
-	if err != nil {
-		return nil, fmt.Errorf("generate invoice number: %w", err)
-	}
-	invoiceNumber := fmt.Sprintf("RE-%d-%03d", year, seq)
-
-	// Calculate totals
-	taxRate := 19.00
-	if input.TaxRate != nil {
-		taxRate = *input.TaxRate
-	}
-
-	var subtotal float64
-	for _, item := range input.Items {
-		subtotal += item.Amount
-	}
-	taxAmount := subtotal * taxRate / 100
-	total := subtotal + taxAmount
-
-	itemsJSON, err := json.Marshal(input.Items)
-	if err != nil {
-		return nil, fmt.Errorf("marshal items: %w", err)
-	}
-
-	var inv models.Invoice
-	err = tx.QueryRowxContext(ctx,
-		`INSERT INTO invoices (tenant_id, case_id, invoice_number, client_name, client_address,
-			items, subtotal, tax_rate, tax_amount, total, issued_at, due_at, notes, created_by)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)
-		 RETURNING `+invoiceCols,
-		tenantID, input.CaseID, invoiceNumber, input.ClientName, input.ClientAddress,
-		itemsJSON, subtotal, taxRate, taxAmount, total, input.IssuedAt, input.DueAt, input.Notes, userID,
-	).StructScan(&inv)
-	if err != nil {
-		return nil, fmt.Errorf("create invoice: %w", err)
-	}
-
-	// Mark linked time entries as billed
-	if len(input.TimeEntryIDs) > 0 {
-		query, args, err := sqlx.In(
-			`UPDATE time_entries SET billed = true, invoice_id = ? WHERE tenant_id = ? AND id IN (?)`,
-			inv.ID, tenantID, input.TimeEntryIDs)
-		if err != nil {
-			return nil, fmt.Errorf("build time entry update: %w", err)
-		}
-		query = tx.Rebind(query)
-		_, err = tx.ExecContext(ctx, query, args...)
-		if err != nil {
-			return nil, fmt.Errorf("mark time entries billed: %w", err)
-		}
-	}
-
-	if err := tx.Commit(); err != nil {
-		return nil, fmt.Errorf("commit: %w", err)
-	}
-
-	s.audit.Log(ctx, "create", "invoice", &inv.ID, nil, inv)
-	return &inv, nil
-}
-
-func (s *InvoiceService) Update(ctx context.Context, tenantID, invoiceID uuid.UUID, input UpdateInvoiceInput) (*models.Invoice, error) {
-	old, err := s.GetByID(ctx, tenantID, invoiceID)
-	if err != nil {
-		return nil, err
-	}
-	if old == nil {
-		return nil, fmt.Errorf("invoice not found")
-	}
-	if old.Status != "draft" {
-		return nil, fmt.Errorf("can only update draft invoices")
-	}
-
-	// Recalculate totals if items changed
-	var itemsJSON json.RawMessage
-	var subtotal float64
-	taxRate := old.TaxRate
-
-	if input.Items != nil {
-		for _, item := range input.Items {
-			subtotal += item.Amount
-		}
-		itemsJSON, _ = json.Marshal(input.Items)
-	}
-	if input.TaxRate != nil {
-		taxRate = *input.TaxRate
-	}
-
-	if input.Items != nil {
-		taxAmount := subtotal * taxRate / 100
-		total := subtotal + taxAmount
-
-		var inv models.Invoice
-		err = s.db.QueryRowxContext(ctx,
-			`UPDATE invoices SET
-				client_name = COALESCE($3, client_name),
-				client_address = COALESCE($4, client_address),
-				items = $5,
-				subtotal = $6,
-				tax_rate = $7,
-				tax_amount = $8,
-				total = $9,
-				issued_at = COALESCE($10, issued_at),
-				due_at = COALESCE($11, due_at),
-				notes = COALESCE($12, notes),
-				updated_at = now()
-			 WHERE tenant_id = $1 AND id = $2
-			 RETURNING `+invoiceCols,
-			tenantID, invoiceID, input.ClientName, input.ClientAddress,
-			itemsJSON, subtotal, taxRate, subtotal*taxRate/100, total,
-			input.IssuedAt, input.DueAt, input.Notes,
-		).StructScan(&inv)
-		if err != nil {
-			return nil, fmt.Errorf("update invoice: %w", err)
-		}
-		s.audit.Log(ctx, "update", "invoice", &inv.ID, old, inv)
-		return &inv, nil
-	}
-
-	// Update without changing items
-	var inv models.Invoice
-	err = s.db.QueryRowxContext(ctx,
-		`UPDATE invoices SET
-			client_name = COALESCE($3, client_name),
-			client_address = COALESCE($4, client_address),
-			tax_rate = COALESCE($5, tax_rate),
-			issued_at = COALESCE($6, issued_at),
-			due_at = COALESCE($7, due_at),
-			notes = COALESCE($8, notes),
-			updated_at = now()
-		 WHERE tenant_id = $1 AND id = $2
-		 RETURNING `+invoiceCols,
-		tenantID, invoiceID, input.ClientName, input.ClientAddress,
-		input.TaxRate, input.IssuedAt, input.DueAt, input.Notes,
-	).StructScan(&inv)
-	if err != nil {
-		return nil, fmt.Errorf("update invoice: %w", err)
-	}
-
-	s.audit.Log(ctx, "update", "invoice", &inv.ID, old, inv)
-	return &inv, nil
-}
-
-func (s *InvoiceService) UpdateStatus(ctx context.Context, tenantID, invoiceID uuid.UUID, newStatus string) (*models.Invoice, error) {
-	old, err := s.GetByID(ctx, tenantID, invoiceID)
-	if err != nil {
-		return nil, err
-	}
-	if old == nil {
-		return nil, fmt.Errorf("invoice not found")
-	}
-
-	// Validate transitions
-	validTransitions := map[string][]string{
-		"draft":     {"sent", "cancelled"},
-		"sent":      {"paid", "cancelled"},
-		"paid":      {},
-		"cancelled": {},
-	}
-	allowed := validTransitions[old.Status]
-	valid := false
-	for _, s := range allowed {
-		if s == newStatus {
-			valid = true
-			break
-		}
-	}
-	if !valid {
-		return nil, fmt.Errorf("invalid status transition from %s to %s", old.Status, newStatus)
-	}
-
-	var paidAt *time.Time
-	if newStatus == "paid" {
-		now := time.Now()
-		paidAt = &now
-	}
-
-	var inv models.Invoice
-	err = s.db.QueryRowxContext(ctx,
-		`UPDATE invoices SET status = $3, paid_at = COALESCE($4, paid_at), updated_at = now()
-		 WHERE tenant_id = $1 AND id = $2
-		 RETURNING `+invoiceCols,
-		tenantID, invoiceID, newStatus, paidAt,
-	).StructScan(&inv)
-	if err != nil {
-		return nil, fmt.Errorf("update invoice status: %w", err)
-	}
-
-	s.audit.Log(ctx, "update", "invoice", &inv.ID, old, inv)
-	return &inv, nil
-}
--- a/backend/internal/services/tenant_service.go
+++ b/backend/internal/services/tenant_service.go
@@ -240,6 +240,54 @@ func (s *TenantService) UpdateMemberRole(ctx context.Context, tenantID, userID u
 	return nil
 }

+// AutoAssignByDomain finds a tenant with a matching auto_assign_domains setting
+// and adds the user as a member. Returns the tenant and role, or nil if no match.
+func (s *TenantService) AutoAssignByDomain(ctx context.Context, userID uuid.UUID, emailDomain string) (*models.TenantWithRole, error) {
+	// Find tenant where settings.auto_assign_domains contains this domain
+	var tenant models.Tenant
+	err := s.db.GetContext(ctx, &tenant,
+		`SELECT id, name, slug, settings, created_at, updated_at
+		 FROM tenants
+		 WHERE settings->'auto_assign_domains' ? $1
+		 LIMIT 1`,
+		emailDomain,
+	)
+	if err != nil {
+		return nil, nil // no match — not an error
+	}
+
+	// Check if already a member
+	var exists bool
+	err = s.db.GetContext(ctx, &exists,
+		`SELECT EXISTS(SELECT 1 FROM user_tenants WHERE user_id = $1 AND tenant_id = $2)`,
+		userID, tenant.ID,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("check membership: %w", err)
+	}
+	if exists {
+		// Already a member — return the existing membership
+		role, err := s.GetUserRole(ctx, userID, tenant.ID)
+		if err != nil {
+			return nil, fmt.Errorf("get existing role: %w", err)
+		}
+		return &models.TenantWithRole{Tenant: tenant, Role: role}, nil
+	}
+
+	// Add as member (associate by default for auto-assigned users)
+	role := "associate"
+	_, err = s.db.ExecContext(ctx,
+		`INSERT INTO user_tenants (user_id, tenant_id, role) VALUES ($1, $2, $3)`,
+		userID, tenant.ID, role,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("auto-assign user: %w", err)
+	}
+
+	s.audit.Log(ctx, "create", "auto_membership", &tenant.ID, map[string]any{"domain": emailDomain}, map[string]any{"user_id": userID, "role": role})
+	return &models.TenantWithRole{Tenant: tenant, Role: role}, nil
+}
+
 // RemoveMember removes a user from a tenant. Cannot remove the last owner.
 func (s *TenantService) RemoveMember(ctx context.Context, tenantID, userID uuid.UUID) error {
 	// Check if the user being removed is an owner
--- a/backend/internal/services/time_entry_service.go
+++ b/backend/internal/services/time_entry_service.go
@@ -1,276 +0,0 @@
-package services
-
-import (
-	"context"
-	"database/sql"
-	"fmt"
-
-	"github.com/google/uuid"
-	"github.com/jmoiron/sqlx"
-
-	"mgit.msbls.de/m/KanzlAI-mGMT/internal/models"
-)
-
-type TimeEntryService struct {
-	db    *sqlx.DB
-	audit *AuditService
-}
-
-func NewTimeEntryService(db *sqlx.DB, audit *AuditService) *TimeEntryService {
-	return &TimeEntryService{db: db, audit: audit}
-}
-
-type CreateTimeEntryInput struct {
-	CaseID          uuid.UUID `json:"case_id"`
-	Date            string    `json:"date"`
-	DurationMinutes int       `json:"duration_minutes"`
-	Description     string    `json:"description"`
-	Activity        *string   `json:"activity,omitempty"`
-	Billable        *bool     `json:"billable,omitempty"`
-	HourlyRate      *float64  `json:"hourly_rate,omitempty"`
-}
-
-type UpdateTimeEntryInput struct {
-	Date            *string  `json:"date,omitempty"`
-	DurationMinutes *int     `json:"duration_minutes,omitempty"`
-	Description     *string  `json:"description,omitempty"`
-	Activity        *string  `json:"activity,omitempty"`
-	Billable        *bool    `json:"billable,omitempty"`
-	HourlyRate      *float64 `json:"hourly_rate,omitempty"`
-}
-
-type TimeEntryFilter struct {
-	CaseID *uuid.UUID
-	UserID *uuid.UUID
-	From   string
-	To     string
-	Limit  int
-	Offset int
-}
-
-type TimeEntrySummary struct {
-	GroupKey       string  `db:"group_key" json:"group_key"`
-	TotalMinutes   int     `db:"total_minutes" json:"total_minutes"`
-	BillableMinutes int   `db:"billable_minutes" json:"billable_minutes"`
-	TotalAmount    float64 `db:"total_amount" json:"total_amount"`
-	EntryCount     int     `db:"entry_count" json:"entry_count"`
-}
-
-const timeEntryCols = `id, tenant_id, case_id, user_id, date, duration_minutes, description,
-	activity, billable, billed, invoice_id, hourly_rate, created_at, updated_at`
-
-func (s *TimeEntryService) ListForCase(ctx context.Context, tenantID, caseID uuid.UUID) ([]models.TimeEntry, error) {
-	var entries []models.TimeEntry
-	err := s.db.SelectContext(ctx, &entries,
-		`SELECT `+timeEntryCols+` FROM time_entries
-		 WHERE tenant_id = $1 AND case_id = $2
-		 ORDER BY date DESC, created_at DESC`,
-		tenantID, caseID)
-	if err != nil {
-		return nil, fmt.Errorf("list time entries for case: %w", err)
-	}
-	return entries, nil
-}
-
-func (s *TimeEntryService) List(ctx context.Context, tenantID uuid.UUID, filter TimeEntryFilter) ([]models.TimeEntry, int, error) {
-	if filter.Limit <= 0 {
-		filter.Limit = 20
-	}
-	if filter.Limit > 100 {
-		filter.Limit = 100
-	}
-
-	where := "WHERE tenant_id = $1"
-	args := []any{tenantID}
-	argIdx := 2
-
-	if filter.CaseID != nil {
-		where += fmt.Sprintf(" AND case_id = $%d", argIdx)
-		args = append(args, *filter.CaseID)
-		argIdx++
-	}
-	if filter.UserID != nil {
-		where += fmt.Sprintf(" AND user_id = $%d", argIdx)
-		args = append(args, *filter.UserID)
-		argIdx++
-	}
-	if filter.From != "" {
-		where += fmt.Sprintf(" AND date >= $%d", argIdx)
-		args = append(args, filter.From)
-		argIdx++
-	}
-	if filter.To != "" {
-		where += fmt.Sprintf(" AND date <= $%d", argIdx)
-		args = append(args, filter.To)
-		argIdx++
-	}
-
-	var total int
-	err := s.db.GetContext(ctx, &total,
-		"SELECT COUNT(*) FROM time_entries "+where, args...)
-	if err != nil {
-		return nil, 0, fmt.Errorf("count time entries: %w", err)
-	}
-
-	query := fmt.Sprintf("SELECT %s FROM time_entries %s ORDER BY date DESC, created_at DESC LIMIT $%d OFFSET $%d",
-		timeEntryCols, where, argIdx, argIdx+1)
-	args = append(args, filter.Limit, filter.Offset)
-
-	var entries []models.TimeEntry
-	err = s.db.SelectContext(ctx, &entries, query, args...)
-	if err != nil {
-		return nil, 0, fmt.Errorf("list time entries: %w", err)
-	}
-	return entries, total, nil
-}
-
-func (s *TimeEntryService) GetByID(ctx context.Context, tenantID, entryID uuid.UUID) (*models.TimeEntry, error) {
-	var entry models.TimeEntry
-	err := s.db.GetContext(ctx, &entry,
-		`SELECT `+timeEntryCols+` FROM time_entries WHERE tenant_id = $1 AND id = $2`,
-		tenantID, entryID)
-	if err == sql.ErrNoRows {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, fmt.Errorf("get time entry: %w", err)
-	}
-	return &entry, nil
-}
-
-func (s *TimeEntryService) Create(ctx context.Context, tenantID, userID uuid.UUID, input CreateTimeEntryInput) (*models.TimeEntry, error) {
-	billable := true
-	if input.Billable != nil {
-		billable = *input.Billable
-	}
-
-	// If no hourly rate provided, look up the current billing rate
-	hourlyRate := input.HourlyRate
-	if hourlyRate == nil {
-		var rate float64
-		err := s.db.GetContext(ctx, &rate,
-			`SELECT rate FROM billing_rates
-			 WHERE tenant_id = $1 AND (user_id = $2 OR user_id IS NULL)
-			 AND valid_from <= $3 AND (valid_to IS NULL OR valid_to >= $3)
-			 ORDER BY user_id NULLS LAST LIMIT 1`,
-			tenantID, userID, input.Date)
-		if err == nil {
-			hourlyRate = &rate
-		}
-	}
-
-	var entry models.TimeEntry
-	err := s.db.QueryRowxContext(ctx,
-		`INSERT INTO time_entries (tenant_id, case_id, user_id, date, duration_minutes, description, activity, billable, hourly_rate)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
-		 RETURNING `+timeEntryCols,
-		tenantID, input.CaseID, userID, input.Date, input.DurationMinutes, input.Description, input.Activity, billable, hourlyRate,
-	).StructScan(&entry)
-	if err != nil {
-		return nil, fmt.Errorf("create time entry: %w", err)
-	}
-
-	s.audit.Log(ctx, "create", "time_entry", &entry.ID, nil, entry)
-	return &entry, nil
-}
-
-func (s *TimeEntryService) Update(ctx context.Context, tenantID, entryID uuid.UUID, input UpdateTimeEntryInput) (*models.TimeEntry, error) {
-	old, err := s.GetByID(ctx, tenantID, entryID)
-	if err != nil {
-		return nil, err
-	}
-	if old == nil {
-		return nil, fmt.Errorf("time entry not found")
-	}
-	if old.Billed {
-		return nil, fmt.Errorf("cannot update a billed time entry")
-	}
-
-	var entry models.TimeEntry
-	err = s.db.QueryRowxContext(ctx,
-		`UPDATE time_entries SET
-			date = COALESCE($3, date),
-			duration_minutes = COALESCE($4, duration_minutes),
-			description = COALESCE($5, description),
-			activity = COALESCE($6, activity),
-			billable = COALESCE($7, billable),
-			hourly_rate = COALESCE($8, hourly_rate),
-			updated_at = now()
-		 WHERE tenant_id = $1 AND id = $2
-		 RETURNING `+timeEntryCols,
-		tenantID, entryID, input.Date, input.DurationMinutes, input.Description, input.Activity, input.Billable, input.HourlyRate,
-	).StructScan(&entry)
-	if err != nil {
-		return nil, fmt.Errorf("update time entry: %w", err)
-	}
-
-	s.audit.Log(ctx, "update", "time_entry", &entry.ID, old, entry)
-	return &entry, nil
-}
-
-func (s *TimeEntryService) Delete(ctx context.Context, tenantID, entryID uuid.UUID) error {
-	old, err := s.GetByID(ctx, tenantID, entryID)
-	if err != nil {
-		return err
-	}
-	if old == nil {
-		return fmt.Errorf("time entry not found")
-	}
-	if old.Billed {
-		return fmt.Errorf("cannot delete a billed time entry")
-	}
-
-	_, err = s.db.ExecContext(ctx,
-		`DELETE FROM time_entries WHERE tenant_id = $1 AND id = $2`,
-		tenantID, entryID)
-	if err != nil {
-		return fmt.Errorf("delete time entry: %w", err)
-	}
-
-	s.audit.Log(ctx, "delete", "time_entry", &entryID, old, nil)
-	return nil
-}
-
-func (s *TimeEntryService) Summary(ctx context.Context, tenantID uuid.UUID, groupBy string, from, to string) ([]TimeEntrySummary, error) {
-	var groupExpr string
-	switch groupBy {
-	case "user":
-		groupExpr = "user_id::text"
-	case "month":
-		groupExpr = "to_char(date, 'YYYY-MM')"
-	default:
-		groupExpr = "case_id::text"
-	}
-
-	where := "WHERE tenant_id = $1"
-	args := []any{tenantID}
-	argIdx := 2
-
-	if from != "" {
-		where += fmt.Sprintf(" AND date >= $%d", argIdx)
-		args = append(args, from)
-		argIdx++
-	}
-	if to != "" {
-		where += fmt.Sprintf(" AND date <= $%d", argIdx)
-		args = append(args, to)
-		argIdx++
-	}
-
-	query := fmt.Sprintf(`SELECT %s AS group_key,
-		SUM(duration_minutes) AS total_minutes,
-		SUM(CASE WHEN billable THEN duration_minutes ELSE 0 END) AS billable_minutes,
-		SUM(CASE WHEN billable AND hourly_rate IS NOT NULL THEN duration_minutes * hourly_rate / 60.0 ELSE 0 END) AS total_amount,
-		COUNT(*) AS entry_count
-		FROM time_entries %s
-		GROUP BY %s
-		ORDER BY %s`,
-		groupExpr, where, groupExpr, groupExpr)
-
-	var summaries []TimeEntrySummary
-	err := s.db.SelectContext(ctx, &summaries, query, args...)
-	if err != nil {
-		return nil, fmt.Errorf("time entry summary: %w", err)
-	}
-	return summaries, nil
-}
--- a/frontend/src/app/(app)/abrechnung/page.tsx
+++ b/frontend/src/app/(app)/abrechnung/page.tsx
@@ -1,164 +0,0 @@
-"use client";
-
-import { useQuery } from "@tanstack/react-query";
-import { api } from "@/lib/api";
-import type { TimeEntry } from "@/lib/types";
-import { format } from "date-fns";
-import { de } from "date-fns/locale";
-import { Timer, Loader2 } from "lucide-react";
-import { useState } from "react";
-import Link from "next/link";
-import { Breadcrumb } from "@/components/layout/Breadcrumb";
-
-function formatDuration(minutes: number): string {
-  const h = Math.floor(minutes / 60);
-  const m = minutes % 60;
-  if (h === 0) return `${m}min`;
-  if (m === 0) return `${h}h`;
-  return `${h}h ${m}min`;
-}
-
-export default function AbrechnungPage() {
-  const [from, setFrom] = useState(() => {
-    const d = new Date();
-    d.setDate(1);
-    return format(d, "yyyy-MM-dd");
-  });
-  const [to, setTo] = useState(() => format(new Date(), "yyyy-MM-dd"));
-
-  const { data, isLoading } = useQuery({
-    queryKey: ["time-entries", from, to],
-    queryFn: () =>
-      api.get<{ time_entries: TimeEntry[]; total: number }>(
-        `/time-entries?from=${from}&to=${to}&limit=100`,
-      ),
-  });
-
-  const entries = data?.time_entries ?? [];
-  const totalMinutes = entries.reduce((s, e) => s + e.duration_minutes, 0);
-  const billableMinutes = entries
-    .filter((e) => e.billable)
-    .reduce((s, e) => s + e.duration_minutes, 0);
-  const totalAmount = entries
-    .filter((e) => e.billable && e.hourly_rate)
-    .reduce((s, e) => s + (e.duration_minutes / 60) * (e.hourly_rate ?? 0), 0);
-
-  return (
-    <div className="animate-fade-in">
-      <Breadcrumb
-        items={[
-          { label: "Dashboard", href: "/dashboard" },
-          { label: "Abrechnung" },
-        ]}
-      />
-
-      <div className="mt-4 flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-        <h1 className="text-lg font-semibold text-neutral-900">
-          Zeiterfassung
-        </h1>
-        <Link
-          href="/abrechnung/rechnungen"
-          className="text-sm text-neutral-500 transition-colors hover:text-neutral-700"
-        >
-          Rechnungen ansehen &rarr;
-        </Link>
-      </div>
-
-      {/* Filters */}
-      <div className="mt-4 flex flex-wrap items-center gap-3">
-        <div className="flex items-center gap-2">
-          <label className="text-xs text-neutral-500">Von</label>
-          <input
-            type="date"
-            value={from}
-            onChange={(e) => setFrom(e.target.value)}
-            className="rounded-md border border-neutral-300 px-2 py-1 text-sm focus:border-neutral-500 focus:outline-none"
-          />
-        </div>
-        <div className="flex items-center gap-2">
-          <label className="text-xs text-neutral-500">Bis</label>
-          <input
-            type="date"
-            value={to}
-            onChange={(e) => setTo(e.target.value)}
-            className="rounded-md border border-neutral-300 px-2 py-1 text-sm focus:border-neutral-500 focus:outline-none"
-          />
-        </div>
-      </div>
-
-      {/* Summary cards */}
-      <div className="mt-4 grid grid-cols-1 gap-3 sm:grid-cols-3">
-        <div className="rounded-md border border-neutral-200 bg-white p-4">
-          <p className="text-xs text-neutral-500">Gesamt</p>
-          <p className="mt-1 text-xl font-semibold text-neutral-900">
-            {formatDuration(totalMinutes)}
-          </p>
-        </div>
-        <div className="rounded-md border border-neutral-200 bg-white p-4">
-          <p className="text-xs text-neutral-500">Abrechenbar</p>
-          <p className="mt-1 text-xl font-semibold text-neutral-900">
-            {formatDuration(billableMinutes)}
-          </p>
-        </div>
-        <div className="rounded-md border border-neutral-200 bg-white p-4">
-          <p className="text-xs text-neutral-500">Betrag</p>
-          <p className="mt-1 text-xl font-semibold text-neutral-900">
-            {totalAmount.toFixed(2)} EUR
-          </p>
-        </div>
-      </div>
-
-      {/* Entries */}
-      {isLoading ? (
-        <div className="flex items-center justify-center py-8">
-          <Loader2 className="h-5 w-5 animate-spin text-neutral-400" />
-        </div>
-      ) : entries.length === 0 ? (
-        <div className="flex flex-col items-center py-12 text-center">
-          <div className="rounded-xl bg-neutral-100 p-3">
-            <Timer className="h-5 w-5 text-neutral-400" />
-          </div>
-          <p className="mt-2 text-sm text-neutral-500">
-            Keine Zeiteintraege im gewaehlten Zeitraum.
-          </p>
-        </div>
-      ) : (
-        <div className="mt-4 space-y-2">
-          {entries.map((entry) => (
-            <div
-              key={entry.id}
-              className="flex items-center justify-between rounded-md border border-neutral-200 bg-white px-4 py-3"
-            >
-              <div className="min-w-0 flex-1">
-                <p className="text-sm font-medium text-neutral-900 truncate">
-                  {entry.description}
-                </p>
-                <div className="mt-0.5 flex gap-3 text-xs text-neutral-500">
-                  <span>
-                    {format(new Date(entry.date), "d. MMM yyyy", { locale: de })}
-                  </span>
-                  <Link
-                    href={`/cases/${entry.case_id}/zeiterfassung`}
-                    className="hover:text-neutral-700"
-                  >
-                    Akte ansehen
-                  </Link>
-                </div>
-              </div>
-              <div className="flex items-center gap-4 ml-4 text-sm">
-                {entry.billable ? (
-                  <span className="text-emerald-600">abrechenbar</span>
-                ) : (
-                  <span className="text-neutral-400">intern</span>
-                )}
-                <span className="font-medium text-neutral-900 whitespace-nowrap">
-                  {formatDuration(entry.duration_minutes)}
-                </span>
-              </div>
-            </div>
-          ))}
-        </div>
-      )}
-    </div>
-  );
-}
--- a/frontend/src/app/(app)/abrechnung/rechnungen/[id]/page.tsx
+++ b/frontend/src/app/(app)/abrechnung/rechnungen/[id]/page.tsx
@@ -1,225 +0,0 @@
-"use client";
-
-import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
-import { useParams } from "next/navigation";
-import { api } from "@/lib/api";
-import type { Invoice } from "@/lib/types";
-import { format } from "date-fns";
-import { de } from "date-fns/locale";
-import { Loader2, AlertTriangle } from "lucide-react";
-import { Breadcrumb } from "@/components/layout/Breadcrumb";
-
-const STATUS_BADGE: Record<string, string> = {
-  draft: "bg-neutral-100 text-neutral-600",
-  sent: "bg-blue-50 text-blue-700",
-  paid: "bg-emerald-50 text-emerald-700",
-  cancelled: "bg-red-50 text-red-600",
-};
-
-const STATUS_LABEL: Record<string, string> = {
-  draft: "Entwurf",
-  sent: "Versendet",
-  paid: "Bezahlt",
-  cancelled: "Storniert",
-};
-
-const TRANSITIONS: Record<string, { label: string; next: string }[]> = {
-  draft: [
-    { label: "Als versendet markieren", next: "sent" },
-    { label: "Stornieren", next: "cancelled" },
-  ],
-  sent: [
-    { label: "Als bezahlt markieren", next: "paid" },
-    { label: "Stornieren", next: "cancelled" },
-  ],
-  paid: [],
-  cancelled: [],
-};
-
-export default function InvoiceDetailPage() {
-  const { id } = useParams<{ id: string }>();
-  const queryClient = useQueryClient();
-
-  const { data: invoice, isLoading, error } = useQuery({
-    queryKey: ["invoice", id],
-    queryFn: () => api.get<Invoice>(`/invoices/${id}`),
-  });
-
-  const statusMutation = useMutation({
-    mutationFn: (status: string) =>
-      api.patch<Invoice>(`/invoices/${id}/status`, { status }),
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ["invoice", id] });
-      queryClient.invalidateQueries({ queryKey: ["invoices"] });
-    },
-  });
-
-  if (isLoading) {
-    return (
-      <div className="flex items-center justify-center py-12">
-        <Loader2 className="h-5 w-5 animate-spin text-neutral-400" />
-      </div>
-    );
-  }
-
-  if (error || !invoice) {
-    return (
-      <div className="py-12 text-center">
-        <AlertTriangle className="mx-auto h-6 w-6 text-red-500" />
-        <p className="mt-2 text-sm text-neutral-500">
-          Rechnung nicht gefunden.
-        </p>
-      </div>
-    );
-  }
-
-  const items = Array.isArray(invoice.items) ? invoice.items : [];
-  const actions = TRANSITIONS[invoice.status] ?? [];
-
-  return (
-    <div className="animate-fade-in">
-      <Breadcrumb
-        items={[
-          { label: "Dashboard", href: "/dashboard" },
-          { label: "Abrechnung", href: "/abrechnung" },
-          { label: "Rechnungen", href: "/abrechnung/rechnungen" },
-          { label: invoice.invoice_number },
-        ]}
-      />
-
-      <div className="mt-4 flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
-        <div>
-          <div className="flex items-center gap-3">
-            <h1 className="text-lg font-semibold text-neutral-900">
-              {invoice.invoice_number}
-            </h1>
-            <span
-              className={`rounded-full px-2 py-0.5 text-xs font-medium ${STATUS_BADGE[invoice.status]}`}
-            >
-              {STATUS_LABEL[invoice.status]}
-            </span>
-          </div>
-          <p className="mt-1 text-sm text-neutral-500">
-            {invoice.client_name}
-          </p>
-        </div>
-        <div className="flex gap-2">
-          {actions.map((action) => (
-            <button
-              key={action.next}
-              onClick={() => statusMutation.mutate(action.next)}
-              disabled={statusMutation.isPending}
-              className="rounded-md bg-neutral-900 px-3 py-1.5 text-sm font-medium text-white transition-colors hover:bg-neutral-800 disabled:opacity-50"
-            >
-              {action.label}
-            </button>
-          ))}
-        </div>
-      </div>
-
-      {/* Invoice details */}
-      <div className="mt-6 rounded-md border border-neutral-200 bg-white">
-        {/* Client info */}
-        <div className="border-b border-neutral-100 p-4">
-          <p className="text-xs text-neutral-500">Empfaenger</p>
-          <p className="mt-1 text-sm font-medium text-neutral-900">
-            {invoice.client_name}
-          </p>
-          {invoice.client_address && (
-            <p className="mt-0.5 text-sm text-neutral-500 whitespace-pre-line">
-              {invoice.client_address}
-            </p>
-          )}
-        </div>
-
-        {/* Dates */}
-        <div className="flex flex-wrap gap-6 border-b border-neutral-100 p-4">
-          {invoice.issued_at && (
-            <div>
-              <p className="text-xs text-neutral-500">Rechnungsdatum</p>
-              <p className="mt-0.5 text-sm text-neutral-900">
-                {format(new Date(invoice.issued_at), "d. MMMM yyyy", { locale: de })}
-              </p>
-            </div>
-          )}
-          {invoice.due_at && (
-            <div>
-              <p className="text-xs text-neutral-500">Faellig am</p>
-              <p className="mt-0.5 text-sm text-neutral-900">
-                {format(new Date(invoice.due_at), "d. MMMM yyyy", { locale: de })}
-              </p>
-            </div>
-          )}
-          {invoice.paid_at && (
-            <div>
-              <p className="text-xs text-neutral-500">Bezahlt am</p>
-              <p className="mt-0.5 text-sm text-neutral-900">
-                {format(new Date(invoice.paid_at), "d. MMMM yyyy", { locale: de })}
-              </p>
-            </div>
-          )}
-        </div>
-
-        {/* Line items */}
-        <div className="p-4">
-          <table className="w-full text-sm">
-            <thead>
-              <tr className="border-b border-neutral-100 text-left text-xs text-neutral-500">
-                <th className="pb-2 font-medium">Beschreibung</th>
-                <th className="pb-2 font-medium text-right">Betrag</th>
-              </tr>
-            </thead>
-            <tbody>
-              {items.map((item, i) => (
-                <tr key={i} className="border-b border-neutral-50">
-                  <td className="py-2 text-neutral-900">
-                    {item.description}
-                    {item.duration_minutes && item.hourly_rate && (
-                      <span className="ml-2 text-xs text-neutral-400">
-                        ({Math.floor(item.duration_minutes / 60)}h{" "}
-                        {item.duration_minutes % 60}min x {item.hourly_rate} EUR/h)
-                      </span>
-                    )}
-                  </td>
-                  <td className="py-2 text-right text-neutral-900">
-                    {item.amount.toFixed(2)} EUR
-                  </td>
-                </tr>
-              ))}
-            </tbody>
-          </table>
-        </div>
-
-        {/* Totals */}
-        <div className="border-t border-neutral-200 p-4">
-          <div className="flex justify-end">
-            <div className="w-48 space-y-1">
-              <div className="flex justify-between text-sm">
-                <span className="text-neutral-500">Netto</span>
-                <span>{invoice.subtotal.toFixed(2)} EUR</span>
-              </div>
-              <div className="flex justify-between text-sm">
-                <span className="text-neutral-500">
-                  USt. {invoice.tax_rate}%
-                </span>
-                <span>{invoice.tax_amount.toFixed(2)} EUR</span>
-              </div>
-              <div className="flex justify-between border-t border-neutral-200 pt-1 text-sm font-semibold">
-                <span>Gesamt</span>
-                <span>{invoice.total.toFixed(2)} EUR</span>
-              </div>
-            </div>
-          </div>
-        </div>
-
-        {/* Notes */}
-        {invoice.notes && (
-          <div className="border-t border-neutral-100 p-4">
-            <p className="text-xs text-neutral-500">Anmerkungen</p>
-            <p className="mt-1 text-sm text-neutral-700">{invoice.notes}</p>
-          </div>
-        )}
-      </div>
-    </div>
-  );
-}
--- a/frontend/src/app/(app)/abrechnung/rechnungen/page.tsx
+++ b/frontend/src/app/(app)/abrechnung/rechnungen/page.tsx
@@ -1,118 +0,0 @@
-"use client";
-
-import { useQuery } from "@tanstack/react-query";
-import { api } from "@/lib/api";
-import type { Invoice } from "@/lib/types";
-import { format } from "date-fns";
-import { de } from "date-fns/locale";
-import { Receipt, Loader2 } from "lucide-react";
-import Link from "next/link";
-import { useState } from "react";
-import { Breadcrumb } from "@/components/layout/Breadcrumb";
-
-const STATUS_BADGE: Record<string, string> = {
-  draft: "bg-neutral-100 text-neutral-600",
-  sent: "bg-blue-50 text-blue-700",
-  paid: "bg-emerald-50 text-emerald-700",
-  cancelled: "bg-red-50 text-red-600",
-};
-
-const STATUS_LABEL: Record<string, string> = {
-  draft: "Entwurf",
-  sent: "Versendet",
-  paid: "Bezahlt",
-  cancelled: "Storniert",
-};
-
-export default function RechnungenPage() {
-  const [statusFilter, setStatusFilter] = useState("");
-
-  const { data, isLoading } = useQuery({
-    queryKey: ["invoices", statusFilter],
-    queryFn: () => {
-      const params = statusFilter ? `?status=${statusFilter}` : "";
-      return api.get<{ invoices: Invoice[] }>(`/invoices${params}`);
-    },
-  });
-
-  const invoices = data?.invoices ?? [];
-
-  return (
-    <div className="animate-fade-in">
-      <Breadcrumb
-        items={[
-          { label: "Dashboard", href: "/dashboard" },
-          { label: "Abrechnung", href: "/abrechnung" },
-          { label: "Rechnungen" },
-        ]}
-      />
-
-      <div className="mt-4 flex items-center justify-between">
-        <h1 className="text-lg font-semibold text-neutral-900">Rechnungen</h1>
-      </div>
-
-      {/* Filters */}
-      <div className="mt-4 flex gap-2">
-        {["", "draft", "sent", "paid", "cancelled"].map((s) => (
-          <button
-            key={s}
-            onClick={() => setStatusFilter(s)}
-            className={`rounded-md px-2.5 py-1 text-xs font-medium transition-colors ${
-              statusFilter === s
-                ? "bg-neutral-900 text-white"
-                : "bg-neutral-100 text-neutral-600 hover:bg-neutral-200"
-            }`}
-          >
-            {s === "" ? "Alle" : STATUS_LABEL[s]}
-          </button>
-        ))}
-      </div>
-
-      {isLoading ? (
-        <div className="flex items-center justify-center py-8">
-          <Loader2 className="h-5 w-5 animate-spin text-neutral-400" />
-        </div>
-      ) : invoices.length === 0 ? (
-        <div className="flex flex-col items-center py-12 text-center">
-          <div className="rounded-xl bg-neutral-100 p-3">
-            <Receipt className="h-5 w-5 text-neutral-400" />
-          </div>
-          <p className="mt-2 text-sm text-neutral-500">
-            Keine Rechnungen vorhanden.
-          </p>
-        </div>
-      ) : (
-        <div className="mt-4 space-y-2">
-          {invoices.map((inv) => (
-            <Link
-              key={inv.id}
-              href={`/abrechnung/rechnungen/${inv.id}`}
-              className="flex items-center justify-between rounded-md border border-neutral-200 bg-white px-4 py-3 transition-colors hover:bg-neutral-50"
-            >
-              <div>
-                <div className="flex items-center gap-2">
-                  <p className="text-sm font-medium text-neutral-900">
-                    {inv.invoice_number}
-                  </p>
-                  <span
-                    className={`rounded-full px-2 py-0.5 text-xs font-medium ${STATUS_BADGE[inv.status]}`}
-                  >
-                    {STATUS_LABEL[inv.status]}
-                  </span>
-                </div>
-                <p className="mt-0.5 text-xs text-neutral-500">
-                  {inv.client_name}
-                  {inv.issued_at &&
-                    ` — ${format(new Date(inv.issued_at), "d. MMM yyyy", { locale: de })}`}
-                </p>
-              </div>
-              <p className="text-sm font-semibold text-neutral-900">
-                {inv.total.toFixed(2)} EUR
-              </p>
-            </Link>
-          ))}
-        </div>
-      )}
-    </div>
-  );
-}
--- a/frontend/src/app/(app)/cases/[id]/layout.tsx
+++ b/frontend/src/app/(app)/cases/[id]/layout.tsx
@@ -17,7 +17,6 @@ import {
  StickyNote,
  AlertTriangle,
  ScrollText,
-  Timer,
 } from "lucide-react";
 import { format } from "date-fns";
 import { de } from "date-fns/locale";
@@ -47,7 +46,6 @@ const TABS = [
  { segment: "dokumente", label: "Dokumente", icon: FileText },
  { segment: "parteien", label: "Parteien", icon: Users },
  { segment: "mitarbeiter", label: "Mitarbeiter", icon: UserCheck },
-  { segment: "zeiterfassung", label: "Zeiterfassung", icon: Timer },
  { segment: "notizen", label: "Notizen", icon: StickyNote },
  { segment: "protokoll", label: "Protokoll", icon: ScrollText },
 ] as const;
@@ -58,7 +56,6 @@ const TAB_LABELS: Record<string, string> = {
  dokumente: "Dokumente",
  parteien: "Parteien",
  mitarbeiter: "Mitarbeiter",
-  zeiterfassung: "Zeiterfassung",
  notizen: "Notizen",
  protokoll: "Protokoll",
 };
--- a/frontend/src/app/(app)/cases/[id]/zeiterfassung/page.tsx
+++ b/frontend/src/app/(app)/cases/[id]/zeiterfassung/page.tsx
@@ -1,306 +0,0 @@
-"use client";
-
-import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
-import { useParams } from "next/navigation";
-import { api } from "@/lib/api";
-import type { TimeEntry } from "@/lib/types";
-import { format } from "date-fns";
-import { de } from "date-fns/locale";
-import { Timer, Loader2, Plus, Trash2 } from "lucide-react";
-import { useState } from "react";
-
-function formatDuration(minutes: number): string {
-  const h = Math.floor(minutes / 60);
-  const m = minutes % 60;
-  if (h === 0) return `${m}min`;
-  if (m === 0) return `${h}h`;
-  return `${h}h ${m}min`;
-}
-
-function formatAmount(minutes: number, rate?: number): string {
-  if (!rate) return "-";
-  return `${((minutes / 60) * rate).toFixed(2)} EUR`;
-}
-
-const ACTIVITIES = [
-  { value: "", label: "Keine Kategorie" },
-  { value: "research", label: "Recherche" },
-  { value: "drafting", label: "Entwurf" },
-  { value: "hearing", label: "Verhandlung" },
-  { value: "call", label: "Telefonat" },
-  { value: "review", label: "Prüfung" },
-  { value: "travel", label: "Reise" },
-  { value: "meeting", label: "Besprechung" },
-];
-
-export default function ZeiterfassungPage() {
-  const { id } = useParams<{ id: string }>();
-  const queryClient = useQueryClient();
-  const [showForm, setShowForm] = useState(false);
-  const [desc, setDesc] = useState("");
-  const [hours, setHours] = useState("");
-  const [minutes, setMinutes] = useState("");
-  const [date, setDate] = useState(format(new Date(), "yyyy-MM-dd"));
-  const [activity, setActivity] = useState("");
-  const [billable, setBillable] = useState(true);
-
-  const { data, isLoading } = useQuery({
-    queryKey: ["case-time-entries", id],
-    queryFn: () =>
-      api.get<{ time_entries: TimeEntry[] }>(`/cases/${id}/time-entries`),
-  });
-
-  const createMutation = useMutation({
-    mutationFn: (input: {
-      description: string;
-      duration_minutes: number;
-      date: string;
-      activity?: string;
-      billable: boolean;
-    }) => api.post<TimeEntry>(`/cases/${id}/time-entries`, input),
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ["case-time-entries", id] });
-      setShowForm(false);
-      setDesc("");
-      setHours("");
-      setMinutes("");
-      setActivity("");
-      setBillable(true);
-    },
-  });
-
-  const deleteMutation = useMutation({
-    mutationFn: (entryId: string) =>
-      api.delete(`/time-entries/${entryId}`),
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ["case-time-entries", id] });
-    },
-  });
-
-  function handleSubmit(e: React.FormEvent) {
-    e.preventDefault();
-    const totalMinutes = (parseInt(hours || "0") * 60) + parseInt(minutes || "0");
-    if (totalMinutes <= 0 || !desc.trim()) return;
-    createMutation.mutate({
-      description: desc.trim(),
-      duration_minutes: totalMinutes,
-      date,
-      activity: activity || undefined,
-      billable,
-    });
-  }
-
-  if (isLoading) {
-    return (
-      <div className="flex items-center justify-center py-8">
-        <Loader2 className="h-5 w-5 animate-spin text-neutral-400" />
-      </div>
-    );
-  }
-
-  const entries = data?.time_entries ?? [];
-  const totalMinutes = entries.reduce((s, e) => s + e.duration_minutes, 0);
-  const billableMinutes = entries
-    .filter((e) => e.billable)
-    .reduce((s, e) => s + e.duration_minutes, 0);
-
-  return (
-    <div className="space-y-4">
-      {/* Summary bar */}
-      <div className="flex flex-wrap items-center justify-between gap-3">
-        <div className="flex gap-6 text-sm text-neutral-500">
-          <span>
-            Gesamt: <span className="font-medium text-neutral-900">{formatDuration(totalMinutes)}</span>
-          </span>
-          <span>
-            Abrechenbar: <span className="font-medium text-neutral-900">{formatDuration(billableMinutes)}</span>
-          </span>
-        </div>
-        <button
-          onClick={() => setShowForm(!showForm)}
-          className="inline-flex items-center gap-1.5 rounded-md bg-neutral-900 px-3 py-1.5 text-sm font-medium text-white transition-colors hover:bg-neutral-800"
-        >
-          <Plus className="h-3.5 w-3.5" />
-          Eintrag
-        </button>
-      </div>
-
-      {/* Quick add form */}
-      {showForm && (
-        <form
-          onSubmit={handleSubmit}
-          className="rounded-md border border-neutral-200 bg-neutral-50 p-4 space-y-3"
-        >
-          <div>
-            <label className="block text-xs font-medium text-neutral-600 mb-1">
-              Beschreibung
-            </label>
-            <input
-              type="text"
-              value={desc}
-              onChange={(e) => setDesc(e.target.value)}
-              placeholder="Was wurde getan?"
-              className="w-full rounded-md border border-neutral-300 px-3 py-1.5 text-sm focus:border-neutral-500 focus:outline-none"
-              required
-            />
-          </div>
-          <div className="flex flex-wrap gap-3">
-            <div className="flex-1 min-w-[120px]">
-              <label className="block text-xs font-medium text-neutral-600 mb-1">
-                Dauer
-              </label>
-              <div className="flex gap-2">
-                <div className="flex items-center gap-1">
-                  <input
-                    type="number"
-                    min="0"
-                    value={hours}
-                    onChange={(e) => setHours(e.target.value)}
-                    placeholder="0"
-                    className="w-16 rounded-md border border-neutral-300 px-2 py-1.5 text-sm focus:border-neutral-500 focus:outline-none"
-                  />
-                  <span className="text-xs text-neutral-500">h</span>
-                </div>
-                <div className="flex items-center gap-1">
-                  <input
-                    type="number"
-                    min="0"
-                    max="59"
-                    value={minutes}
-                    onChange={(e) => setMinutes(e.target.value)}
-                    placeholder="0"
-                    className="w-16 rounded-md border border-neutral-300 px-2 py-1.5 text-sm focus:border-neutral-500 focus:outline-none"
-                  />
-                  <span className="text-xs text-neutral-500">min</span>
-                </div>
-              </div>
-            </div>
-            <div className="flex-1 min-w-[120px]">
-              <label className="block text-xs font-medium text-neutral-600 mb-1">
-                Datum
-              </label>
-              <input
-                type="date"
-                value={date}
-                onChange={(e) => setDate(e.target.value)}
-                className="w-full rounded-md border border-neutral-300 px-3 py-1.5 text-sm focus:border-neutral-500 focus:outline-none"
-              />
-            </div>
-            <div className="flex-1 min-w-[120px]">
-              <label className="block text-xs font-medium text-neutral-600 mb-1">
-                Kategorie
-              </label>
-              <select
-                value={activity}
-                onChange={(e) => setActivity(e.target.value)}
-                className="w-full rounded-md border border-neutral-300 px-3 py-1.5 text-sm focus:border-neutral-500 focus:outline-none"
-              >
-                {ACTIVITIES.map((a) => (
-                  <option key={a.value} value={a.value}>
-                    {a.label}
-                  </option>
-                ))}
-              </select>
-            </div>
-          </div>
-          <div className="flex items-center justify-between">
-            <label className="flex items-center gap-2 text-sm text-neutral-600">
-              <input
-                type="checkbox"
-                checked={billable}
-                onChange={(e) => setBillable(e.target.checked)}
-                className="rounded border-neutral-300"
-              />
-              Abrechenbar
-            </label>
-            <div className="flex gap-2">
-              <button
-                type="button"
-                onClick={() => setShowForm(false)}
-                className="rounded-md px-3 py-1.5 text-sm text-neutral-600 transition-colors hover:bg-neutral-100"
-              >
-                Abbrechen
-              </button>
-              <button
-                type="submit"
-                disabled={createMutation.isPending}
-                className="rounded-md bg-neutral-900 px-3 py-1.5 text-sm font-medium text-white transition-colors hover:bg-neutral-800 disabled:opacity-50"
-              >
-                {createMutation.isPending ? "Speichern..." : "Speichern"}
-              </button>
-            </div>
-          </div>
-          {createMutation.isError && (
-            <p className="text-sm text-red-600">Fehler beim Speichern.</p>
-          )}
-        </form>
-      )}
-
-      {/* Entries list */}
-      {entries.length === 0 ? (
-        <div className="flex flex-col items-center py-8 text-center">
-          <div className="rounded-xl bg-neutral-100 p-3">
-            <Timer className="h-5 w-5 text-neutral-400" />
-          </div>
-          <p className="mt-2 text-sm text-neutral-500">
-            Keine Zeiteintraege vorhanden.
-          </p>
-        </div>
-      ) : (
-        <div className="space-y-2">
-          {entries.map((entry) => (
-            <div
-              key={entry.id}
-              className="flex items-center justify-between rounded-md border border-neutral-200 bg-white px-4 py-3"
-            >
-              <div className="min-w-0 flex-1">
-                <div className="flex items-center gap-2">
-                  <p className="text-sm font-medium text-neutral-900 truncate">
-                    {entry.description}
-                  </p>
-                  {entry.activity && (
-                    <span className="shrink-0 rounded-full bg-neutral-100 px-2 py-0.5 text-xs text-neutral-500">
-                      {ACTIVITIES.find((a) => a.value === entry.activity)?.label ?? entry.activity}
-                    </span>
-                  )}
-                  {!entry.billable && (
-                    <span className="shrink-0 rounded-full bg-neutral-100 px-2 py-0.5 text-xs text-neutral-400">
-                      nicht abrechenbar
-                    </span>
-                  )}
-                  {entry.billed && (
-                    <span className="shrink-0 rounded-full bg-emerald-50 px-2 py-0.5 text-xs text-emerald-700">
-                      abgerechnet
-                    </span>
-                  )}
-                </div>
-                <div className="mt-0.5 flex gap-4 text-xs text-neutral-500">
-                  <span>
-                    {format(new Date(entry.date), "d. MMM yyyy", { locale: de })}
-                  </span>
-                  {entry.hourly_rate && (
-                    <span>{formatAmount(entry.duration_minutes, entry.hourly_rate)}</span>
-                  )}
-                </div>
-              </div>
-              <div className="flex items-center gap-3 ml-4">
-                <span className="text-sm font-medium text-neutral-900 whitespace-nowrap">
-                  {formatDuration(entry.duration_minutes)}
-                </span>
-                {!entry.billed && (
-                  <button
-                    onClick={() => deleteMutation.mutate(entry.id)}
-                    className="rounded-md p-1 text-neutral-400 transition-colors hover:bg-red-50 hover:text-red-600"
-                    title="Loeschen"
-                  >
-                    <Trash2 className="h-3.5 w-3.5" />
-                  </button>
-                )}
-              </div>
-            </div>
-          ))}
-        </div>
-      )}
-    </div>
-  );
-}
--- a/frontend/src/app/(app)/einstellungen/abrechnung/page.tsx
+++ b/frontend/src/app/(app)/einstellungen/abrechnung/page.tsx
@@ -1,166 +0,0 @@
-"use client";
-
-import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
-import { api } from "@/lib/api";
-import type { BillingRate } from "@/lib/types";
-import { format } from "date-fns";
-import { de } from "date-fns/locale";
-import { Loader2, Plus } from "lucide-react";
-import { useState } from "react";
-import { Breadcrumb } from "@/components/layout/Breadcrumb";
-
-export default function BillingRatesPage() {
-  const queryClient = useQueryClient();
-  const [showForm, setShowForm] = useState(false);
-  const [rate, setRate] = useState("");
-  const [validFrom, setValidFrom] = useState(format(new Date(), "yyyy-MM-dd"));
-
-  const { data, isLoading } = useQuery({
-    queryKey: ["billing-rates"],
-    queryFn: () =>
-      api.get<{ billing_rates: BillingRate[] }>("/billing-rates"),
-  });
-
-  const upsertMutation = useMutation({
-    mutationFn: (input: { rate: number; valid_from: string; currency: string }) =>
-      api.put<BillingRate>("/billing-rates", input),
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ["billing-rates"] });
-      setShowForm(false);
-      setRate("");
-    },
-  });
-
-  function handleSubmit(e: React.FormEvent) {
-    e.preventDefault();
-    const rateNum = parseFloat(rate);
-    if (isNaN(rateNum) || rateNum < 0) return;
-    upsertMutation.mutate({
-      rate: rateNum,
-      valid_from: validFrom,
-      currency: "EUR",
-    });
-  }
-
-  const rates = data?.billing_rates ?? [];
-
-  return (
-    <div className="animate-fade-in">
-      <Breadcrumb
-        items={[
-          { label: "Dashboard", href: "/dashboard" },
-          { label: "Einstellungen", href: "/einstellungen" },
-          { label: "Stundensaetze" },
-        ]}
-      />
-
-      <div className="mt-4 flex items-center justify-between">
-        <h1 className="text-lg font-semibold text-neutral-900">
-          Stundensaetze
-        </h1>
-        <button
-          onClick={() => setShowForm(!showForm)}
-          className="inline-flex items-center gap-1.5 rounded-md bg-neutral-900 px-3 py-1.5 text-sm font-medium text-white transition-colors hover:bg-neutral-800"
-        >
-          <Plus className="h-3.5 w-3.5" />
-          Neuer Satz
-        </button>
-      </div>
-
-      {showForm && (
-        <form
-          onSubmit={handleSubmit}
-          className="mt-4 rounded-md border border-neutral-200 bg-neutral-50 p-4 space-y-3"
-        >
-          <div className="flex flex-wrap gap-3">
-            <div className="flex-1 min-w-[150px]">
-              <label className="block text-xs font-medium text-neutral-600 mb-1">
-                Stundensatz (EUR)
-              </label>
-              <input
-                type="number"
-                min="0"
-                step="0.01"
-                value={rate}
-                onChange={(e) => setRate(e.target.value)}
-                placeholder="z.B. 350.00"
-                className="w-full rounded-md border border-neutral-300 px-3 py-1.5 text-sm focus:border-neutral-500 focus:outline-none"
-                required
-              />
-            </div>
-            <div className="flex-1 min-w-[150px]">
-              <label className="block text-xs font-medium text-neutral-600 mb-1">
-                Gueltig ab
-              </label>
-              <input
-                type="date"
-                value={validFrom}
-                onChange={(e) => setValidFrom(e.target.value)}
-                className="w-full rounded-md border border-neutral-300 px-3 py-1.5 text-sm focus:border-neutral-500 focus:outline-none"
-                required
-              />
-            </div>
-          </div>
-          <div className="flex justify-end gap-2">
-            <button
-              type="button"
-              onClick={() => setShowForm(false)}
-              className="rounded-md px-3 py-1.5 text-sm text-neutral-600 hover:bg-neutral-100"
-            >
-              Abbrechen
-            </button>
-            <button
-              type="submit"
-              disabled={upsertMutation.isPending}
-              className="rounded-md bg-neutral-900 px-3 py-1.5 text-sm font-medium text-white hover:bg-neutral-800 disabled:opacity-50"
-            >
-              Speichern
-            </button>
-          </div>
-        </form>
-      )}
-
-      {isLoading ? (
-        <div className="flex items-center justify-center py-8">
-          <Loader2 className="h-5 w-5 animate-spin text-neutral-400" />
-        </div>
-      ) : rates.length === 0 ? (
-        <div className="mt-8 text-center">
-          <p className="text-sm text-neutral-500">
-            Noch keine Stundensaetze definiert.
-          </p>
-        </div>
-      ) : (
-        <div className="mt-4 space-y-2">
-          {rates.map((r) => (
-            <div
-              key={r.id}
-              className="flex items-center justify-between rounded-md border border-neutral-200 bg-white px-4 py-3"
-            >
-              <div>
-                <p className="text-sm font-medium text-neutral-900">
-                  {r.rate.toFixed(2)} {r.currency}/h
-                </p>
-                <p className="mt-0.5 text-xs text-neutral-500">
-                  {r.user_id ? `Benutzer: ${r.user_id.slice(0, 8)}...` : "Standard (alle Benutzer)"}
-                </p>
-              </div>
-              <div className="text-right text-xs text-neutral-500">
-                <p>
-                  Ab{" "}
-                  {format(new Date(r.valid_from), "d. MMM yyyy", { locale: de })}
-                </p>
-                {r.valid_to && (
-                  <p>
-                    Bis{" "}
-                    {format(new Date(r.valid_to), "d. MMM yyyy", { locale: de })}
-                  </p>
-                )}
-              </div>
-            </div>
-          ))}
-        </div>
-      )}
-    </div>
-  );
-}
--- a/frontend/src/app/(app)/layout.tsx
+++ b/frontend/src/app/(app)/layout.tsx
@@ -1,5 +1,6 @@
 import { Sidebar } from "@/components/layout/Sidebar";
 import { Header } from "@/components/layout/Header";
+import { DemoBanner } from "@/components/layout/DemoBanner";

 export const dynamic = "force-dynamic";

@@ -12,6 +13,7 @@ export default function AppLayout({
    <div className="flex h-screen overflow-hidden bg-neutral-50">
      <Sidebar />
      <div className="flex flex-1 flex-col overflow-hidden">
+        <DemoBanner />
        <Header />
        <main className="flex-1 overflow-y-auto p-4 sm:p-6">{children}</main>
      </div>
--- a/frontend/src/app/(auth)/register/page.tsx
+++ b/frontend/src/app/(auth)/register/page.tsx
@@ -5,12 +5,22 @@ import { api } from "@/lib/api";
 import { useRouter } from "next/navigation";
 import { useState } from "react";

+interface AutoAssignResponse {
+  assigned: boolean;
+  tenant_id?: string;
+  name?: string;
+  slug?: string;
+  role?: string;
+  settings?: Record<string, unknown>;
+}
+
 export default function RegisterPage() {
  const [email, setEmail] = useState("");
  const [password, setPassword] = useState("");
  const [firmName, setFirmName] = useState("");
  const [loading, setLoading] = useState(false);
  const [error, setError] = useState<string | null>(null);
+  const [showFirmName, setShowFirmName] = useState(true);
  const router = useRouter();
  const supabase = createClient();

@@ -34,8 +44,30 @@ export default function RegisterPage() {
      return;
    }

-    // 2. Create tenant via backend (the backend adds the user as owner)
    if (data.session) {
+      // 2. Check if email domain matches an existing tenant for auto-assignment
+      try {
+        const result = await api.post<AutoAssignResponse>("/tenants/auto-assign", { email });
+        if (result.assigned && result.tenant_id) {
+          // Auto-assigned — store tenant and go to dashboard
+          localStorage.setItem("kanzlai_tenant_id", result.tenant_id);
+          router.push("/");
+          router.refresh();
+          return;
+        }
+      } catch {
+        // Auto-assign failed — fall through to manual tenant creation
+      }
+
+      // 3. No auto-assignment — create tenant manually
+      if (!firmName) {
+        // Show firm name field if not yet visible
+        setShowFirmName(true);
+        setError("Bitte geben Sie einen Kanzleinamen ein");
+        setLoading(false);
+        return;
+      }
+
      try {
        await api.post("/tenants", { name: firmName });
      } catch (err: unknown) {
@@ -68,23 +100,27 @@ export default function RegisterPage() {
        </div>

        <form onSubmit={handleRegister} className="space-y-4">
-          <div>
-            <label
-              htmlFor="firm"
-              className="block text-sm font-medium text-neutral-700"
-            >
-              Kanzleiname
-            </label>
-            <input
-              id="firm"
-              type="text"
-              value={firmName}
-              onChange={(e) => setFirmName(e.target.value)}
-              required
-              className="mt-1 block w-full rounded-md border border-neutral-300 px-3 py-2 text-sm placeholder-neutral-400 focus:border-neutral-900 focus:outline-none focus:ring-1 focus:ring-neutral-900"
-              placeholder="Muster & Partner Rechtsanwaelte"
-            />
-          </div>
+          {showFirmName && (
+            <div>
+              <label
+                htmlFor="firm"
+                className="block text-sm font-medium text-neutral-700"
+              >
+                Kanzleiname
+              </label>
+              <input
+                id="firm"
+                type="text"
+                value={firmName}
+                onChange={(e) => setFirmName(e.target.value)}
+                className="mt-1 block w-full rounded-md border border-neutral-300 px-3 py-2 text-sm placeholder-neutral-400 focus:border-neutral-900 focus:outline-none focus:ring-1 focus:ring-neutral-900"
+                placeholder="Muster & Partner Rechtsanwaelte"
+              />
+              <p className="mt-1 text-xs text-neutral-400">
+                Leer lassen, falls Sie zu einer bestehenden Kanzlei eingeladen wurden
+              </p>
+            </div>
+          )}

          <div>
            <label
--- a/frontend/src/components/layout/DemoBanner.tsx
+++ b/frontend/src/components/layout/DemoBanner.tsx
@@ -0,0 +1,17 @@
+"use client";
+
+import { usePermissions } from "@/lib/hooks/usePermissions";
+
+export function DemoBanner() {
+  const { isDemo, isLoading } = usePermissions();
+
+  if (isLoading || !isDemo) return null;
+
+  return (
+    <div className="flex items-center justify-center gap-2 bg-amber-50 border-b border-amber-200 px-4 py-2 text-sm text-amber-800">
+      <span className="font-medium">Demo-Modus</span>
+      <span className="text-amber-600">&mdash;</span>
+      <span>Keine echten Mandantendaten eingeben</span>
+    </div>
+  );
+}
--- a/frontend/src/components/layout/Sidebar.tsx
+++ b/frontend/src/components/layout/Sidebar.tsx
@@ -11,7 +11,6 @@ import {
  Settings,
  Menu,
  X,
-  Receipt,
 } from "lucide-react";
 import { useState, useEffect } from "react";
 import { usePermissions } from "@/lib/hooks/usePermissions";
@@ -28,7 +27,6 @@ const allNavigation: NavItem[] = [
  { name: "Akten", href: "/cases", icon: FolderOpen },
  { name: "Fristen", href: "/fristen", icon: Clock },
  { name: "Termine", href: "/termine", icon: Calendar },
-  { name: "Abrechnung", href: "/abrechnung", icon: Receipt, permission: "manage_billing" },
  { name: "AI Analyse", href: "/ai/extract", icon: Brain, permission: "ai_extraction" },
  { name: "Einstellungen", href: "/einstellungen", icon: Settings, permission: "manage_settings" },
 ];
--- a/frontend/src/lib/hooks/usePermissions.ts
+++ b/frontend/src/lib/hooks/usePermissions.ts
@@ -25,5 +25,6 @@ export function usePermissions() {
    isLoading,
    userId: data?.user_id ?? null,
    tenantId: data?.tenant_id ?? null,
+    isDemo: data?.is_demo ?? false,
  };
 }
--- a/frontend/src/lib/types.ts
+++ b/frontend/src/lib/types.ts
@@ -202,6 +202,7 @@ export interface UserInfo {
  tenant_id: string;
  role: UserRole;
  permissions: string[];
+  is_demo: boolean;
 }

 export type UserRole = "owner" | "partner" | "associate" | "paralegal" | "secretary";
@@ -223,125 +224,6 @@ export const CASE_ASSIGNMENT_ROLE_LABELS: Record<CaseAssignmentRole, string> = {
  viewer: "Einsicht",
 };

-// Time tracking & billing
-
-export interface TimeEntry {
-  id: string;
-  tenant_id: string;
-  case_id: string;
-  user_id: string;
-  date: string;
-  duration_minutes: number;
-  description: string;
-  activity?: string;
-  billable: boolean;
-  billed: boolean;
-  invoice_id?: string;
-  hourly_rate?: number;
-  created_at: string;
-  updated_at: string;
-}
-
-export interface BillingRate {
-  id: string;
-  tenant_id: string;
-  user_id?: string;
-  rate: number;
-  currency: string;
-  valid_from: string;
-  valid_to?: string;
-  created_at: string;
-}
-
-export interface InvoiceItem {
-  description: string;
-  duration_minutes?: number;
-  hourly_rate?: number;
-  amount: number;
-  time_entry_id?: string;
-}
-
-export interface Invoice {
-  id: string;
-  tenant_id: string;
-  case_id: string;
-  invoice_number: string;
-  client_name: string;
-  client_address?: string;
-  items: InvoiceItem[];
-  subtotal: number;
-  tax_rate: number;
-  tax_amount: number;
-  total: number;
-  status: "draft" | "sent" | "paid" | "cancelled";
-  issued_at?: string;
-  due_at?: string;
-  paid_at?: string;
-  notes?: string;
-  created_by: string;
-  created_at: string;
-  updated_at: string;
-}
-
-export interface TimeEntrySummary {
-  group_key: string;
-  total_minutes: number;
-  billable_minutes: number;
-  total_amount: number;
-  entry_count: number;
-}
-
-// Notifications
-export interface Notification {
-  id: string;
-  tenant_id: string;
-  user_id: string;
-  type: string;
-  title: string;
-  body?: string;
-  entity_type?: string;
-  entity_id?: string;
-  sent_at?: string;
-  read_at?: string;
-  created_at: string;
-}
-
-export interface NotificationPreferences {
-  user_id: string;
-  tenant_id: string;
-  deadline_reminder_days: number[];
-  email_enabled: boolean;
-  daily_digest: boolean;
-  created_at: string;
-  updated_at: string;
-}
-
-export interface NotificationListResponse {
-  notifications: Notification[];
-  data: Notification[];
-  total: number;
-}
-
-// Audit log
-export interface AuditLogEntry {
-  id: number;
-  tenant_id: string;
-  user_id?: string;
-  action: string;
-  entity_type: string;
-  entity_id?: string;
-  old_values?: Record<string, unknown>;
-  new_values?: Record<string, unknown>;
-  ip_address?: string;
-  user_agent?: string;
-  created_at: string;
-}
-
-export interface AuditLogResponse {
-  entries: AuditLogEntry[];
-  total: number;
-}
-
 export interface ApiError {
  error: string;
  status: number;