Merge branch 'main' into feat/299_plz

lib/accounts/user.ex

@@ -118,6 +118,8 @@ defmodule Mv.Accounts.User do
       change Mv.EmailSync.Changes.SyncUserEmailToMember do
         where [changing(:email)]
       end
+
+      change Mv.Vereinfacht.Changes.SyncLinkedMemberAfterUserChange
     end
 
     create :create_user do
@@ -145,6 +147,8 @@ defmodule Mv.Accounts.User do
 
       # Sync user email to member when linking (User → Member)
       change Mv.EmailSync.Changes.SyncUserEmailToMember
+
+      change Mv.Vereinfacht.Changes.SyncLinkedMemberAfterUserChange
     end
 
     update :update_user do
@@ -178,6 +182,8 @@ defmodule Mv.Accounts.User do
       change Mv.EmailSync.Changes.SyncUserEmailToMember do
         where any([changing(:email), changing(:member)])
       end
+
+      change Mv.Vereinfacht.Changes.SyncLinkedMemberAfterUserChange
     end
 
     # Internal update used only by SystemActor/bootstrap and tests to assign role to system user.
@@ -211,6 +217,8 @@ defmodule Mv.Accounts.User do
       change Mv.EmailSync.Changes.SyncUserEmailToMember do
         where [changing(:email)]
       end
+
+      change Mv.Vereinfacht.Changes.SyncLinkedMemberAfterUserChange
     end
 
     # Action to link an OIDC account to an existing password-only user
@@ -248,6 +256,8 @@ defmodule Mv.Accounts.User do
       change Mv.EmailSync.Changes.SyncUserEmailToMember do
         where [changing(:email)]
       end
+
+      change Mv.Vereinfacht.Changes.SyncLinkedMemberAfterUserChange
     end
 
     read :get_by_subject do
@@ -328,6 +338,8 @@ defmodule Mv.Accounts.User do
       # Sync user email to member when linking (User → Member)
       change Mv.EmailSync.Changes.SyncUserEmailToMember
 
+      change Mv.Vereinfacht.Changes.SyncLinkedMemberAfterUserChange
+
       # Sync role from OIDC groups (e.g. admin group → Admin role) after user is created/updated
       change fn changeset, _ctx ->
         user_info = Ash.Changeset.get_argument(changeset, :user_info)

lib/membership/member.ex

@@ -116,6 +116,9 @@ defmodule Mv.Membership.Member do
       # Requires both join_date and membership_fee_type_id to be present
       change Mv.MembershipFees.Changes.SetMembershipFeeStartDate
 
+      # Sync member to Vereinfacht as finance contact (if configured)
+      change Mv.Vereinfacht.Changes.SyncContact
+
       # Trigger cycle generation after member creation
       # Only runs if membership_fee_type_id is set
       # Note: Cycle generation runs asynchronously to not block the action,
@@ -189,6 +192,9 @@ defmodule Mv.Membership.Member do
         where [changing(:membership_fee_type_id)]
       end
 
+      # Sync member to Vereinfacht as finance contact (if configured)
+      change Mv.Vereinfacht.Changes.SyncContact
+
       # Trigger cycle regeneration when membership_fee_type_id changes
       # This deletes future unpaid cycles and regenerates them with the new type/amount
       # Note: Cycle regeneration runs synchronously in the same transaction to ensure atomicity
@@ -242,6 +248,13 @@ defmodule Mv.Membership.Member do
              end)
     end
 
+    # Internal: set vereinfacht_contact_id after syncing with Vereinfacht API.
+    # Not exposed via code interface; used only by Mv.Vereinfacht.Changes.SyncContact.
+    update :set_vereinfacht_contact_id do
+      require_atomic? false
+      accept [:vereinfacht_contact_id]
+    end
+
     # Action to handle fuzzy search on specific fields
     read :search do
       argument :query, :string, allow_nil?: true
@@ -319,6 +332,12 @@ defmodule Mv.Membership.Member do
       authorize_if Mv.Authorization.Checks.HasPermission
     end
 
+    # Internal sync action: only SystemActor may set vereinfacht_contact_id (used by SyncContact change).
+    policy action(:set_vereinfacht_contact_id) do
+      description "Only system actor may set Vereinfacht contact ID"
+      authorize_if Mv.Authorization.Checks.ActorIsSystemUser
+    end
+
     # CREATE/UPDATE: Forbid member–user link unless admin, then check permissions
     # ForbidMemberUserLinkUnlessAdmin: only admins may pass :user (link or unlink via nil/empty).
     # HasPermission: :own_data → update linked; :read_only → no update; :normal_user/admin → update all.
@@ -475,48 +494,97 @@ defmodule Mv.Membership.Member do
       end
     end
 
-    # Validate required custom fields (actor from validation context only; no fallback)
+    # Validate required custom fields (actor from validation context only; no fallback).
+    # Only for create_member/update_member; skip for set_vereinfacht_contact_id (internal sync
+    # only sets vereinfacht_contact_id; custom fields were already validated and saved).
     validate fn changeset, context ->
-      provided_values = provided_custom_field_values(changeset)
-      actor = context.actor
+               provided_values = provided_custom_field_values(changeset)
+               actor = context.actor
 
-      case Mv.Membership.list_required_custom_fields(actor: actor) do
-        {:ok, required_custom_fields} ->
-          missing_fields = missing_required_fields(required_custom_fields, provided_values)
+               case Mv.Membership.list_required_custom_fields(actor: actor) do
+                 {:ok, required_custom_fields} ->
+                   missing_fields =
+                     missing_required_fields(required_custom_fields, provided_values)
 
-          if Enum.empty?(missing_fields) do
-            :ok
-          else
-            build_custom_field_validation_error(missing_fields)
-          end
+                   if Enum.empty?(missing_fields) do
+                     :ok
+                   else
+                     build_custom_field_validation_error(missing_fields)
+                   end
 
-        {:error, %Ash.Error.Forbidden{}} ->
-          Logger.warning(
-            "Required custom fields validation: actor not authorized to read CustomField"
-          )
+                 {:error, %Ash.Error.Forbidden{}} ->
+                   Logger.warning(
+                     "Required custom fields validation: actor not authorized to read CustomField"
+                   )
 
-          {:error,
-           field: :custom_field_values,
-           message:
-             "You are not authorized to perform this action. Please sign in again or contact support."}
+                   {:error,
+                    field: :custom_field_values,
+                    message:
+                      "You are not authorized to perform this action. Please sign in again or contact support."}
 
-        {:error, :missing_actor} ->
-          Logger.warning("Required custom fields validation: no actor in context")
+                 {:error, :missing_actor} ->
+                   Logger.warning("Required custom fields validation: no actor in context")
 
-          {:error,
-           field: :custom_field_values,
-           message:
-             "You are not authorized to perform this action. Please sign in again or contact support."}
+                   {:error,
+                    field: :custom_field_values,
+                    message:
+                      "You are not authorized to perform this action. Please sign in again or contact support."}
 
-        {:error, error} ->
-          Logger.error(
-            "Failed to load custom fields for validation: #{inspect(error)}. Required field validation cannot be performed."
-          )
+                 {:error, error} ->
+                   Logger.error(
+                     "Failed to load custom fields for validation: #{inspect(error)}. Required field validation cannot be performed."
+                   )
 
-          {:error,
-           field: :custom_field_values,
-           message:
-             "Unable to validate required custom fields. Please try again or contact support."}
+                   {:error,
+                    field: :custom_field_values,
+                    message:
+                      "Unable to validate required custom fields. Please try again or contact support."}
+               end
+             end,
+             where: [action_is([:create_member, :update_member])]
+
+    # Validate member fields that are marked as required in settings or by Vereinfacht.
+    # When settings cannot be loaded, we still enforce email + Vereinfacht-required fields.
+    validate fn changeset, _context ->
+      vereinfacht_required? = Mv.Config.vereinfacht_configured?()
+
+      required_fields =
+        case Mv.Membership.get_settings() do
+          {:ok, settings} ->
+            required_config = settings.member_field_required || %{}
+            normalized = VisibilityConfig.normalize(required_config)
+
+            Enum.filter(Mv.Constants.member_fields(), fn field ->
+              field == :email ||
+                (vereinfacht_required? && Mv.Constants.vereinfacht_required_field?(field)) ||
+                Map.get(normalized, field, false)
+            end)
+
+          {:error, reason} ->
+            Logger.warning(
+              "Member required-fields validation: could not load settings (#{inspect(reason)}). " <>
+                "Enforcing only email and Vereinfacht-required fields."
+            )
+
+            Enum.filter(Mv.Constants.member_fields(), fn field ->
+              field == :email ||
+                (vereinfacht_required? && Mv.Constants.vereinfacht_required_field?(field))
+            end)
+        end
+
+      missing =
+        Enum.filter(required_fields, fn field ->
+          value = Ash.Changeset.get_attribute(changeset, field)
+          not member_field_value_present?(field, value)
+        end)
+
+      if Enum.empty?(missing) do
+        :ok
+      else
+        field = hd(missing)
+
+        {:error,
+         field: field, message: Gettext.dgettext(MvWeb.Gettext, "default", "can't be blank")}
       end
     end
   end
@@ -591,6 +659,14 @@ defmodule Mv.Membership.Member do
       public? true
       description "Date from which membership fees should be calculated"
     end
+
+    # Vereinfacht accounting software integration: ID of the finance contact synced via API.
+    # Set by Mv.Vereinfacht.Changes.SyncContact; not accepted in create/update actions.
+    attribute :vereinfacht_contact_id, :string do
+      allow_nil? true
+      public? true
+      description "ID of the finance contact in Vereinfacht (set by sync)"
+    end
   end
 
   relationships do
@@ -1272,17 +1348,24 @@ defmodule Mv.Membership.Member do
     end
   end
 
-  # Extracts custom field values from existing member data (update scenario)
+  # Extracts custom field values from existing member data (update scenario).
+  # Actor must come from context; no system-actor fallback (per guidelines).
+  # When no actor is present we skip the load and return empty map.
   defp extract_existing_values(member_data, changeset) do
-    actor = Map.get(changeset.context, :actor)
-    opts = Helpers.ash_actor_opts(actor)
-
-    case Ash.load(member_data, :custom_field_values, opts) do
-      {:ok, %{custom_field_values: existing_values}} ->
-        Enum.reduce(existing_values, %{}, &extract_value_from_cfv/2)
-
-      _ ->
+    case Map.get(changeset.context, :actor) do
+      nil ->
         %{}
+
+      actor ->
+        opts = Helpers.ash_actor_opts(actor)
+
+        case Ash.load(member_data, :custom_field_values, opts) do
+          {:ok, %{custom_field_values: existing_values}} ->
+            Enum.reduce(existing_values, %{}, &extract_value_from_cfv/2)
+
+          _ ->
+            %{}
+        end
     end
   end
 
@@ -1385,4 +1468,14 @@ defmodule Mv.Membership.Member do
   defp value_present?(_value, :email), do: false
 
   defp value_present?(_value, _type), do: false
+
+  # Used by member-field-required validation (settings-driven required fields)
+  defp member_field_value_present?(_field, nil), do: false
+
+  defp member_field_value_present?(_, value) when is_binary(value),
+    do: String.trim(value) != ""
+
+  defp member_field_value_present?(_, %Date{}), do: true
+  defp member_field_value_present?(_, value) when is_struct(value, Date), do: true
+  defp member_field_value_present?(_, _), do: false
 end

lib/membership/membership.ex

@@ -64,6 +64,8 @@ defmodule Mv.Membership do
 
       define :update_single_member_field_visibility,
         action: :update_single_member_field_visibility
+
+      define :update_single_member_field, action: :update_single_member_field
     end
 
     resource Mv.Membership.Group do
@@ -257,6 +259,46 @@ defmodule Mv.Membership do
     |> Ash.update(domain: __MODULE__)
   end
 
+  @doc """
+  Atomically updates visibility and required for a single member field.
+
+  Updates both `member_field_visibility` and `member_field_required` in one
+  operation. Use this when saving from the member field settings form.
+
+  ## Parameters
+
+    - `settings` - The settings record to update
+    - `field` - The member field name as a string (e.g., "first_name", "street")
+    - `show_in_overview` - Boolean value indicating visibility in member overview
+    - `required` - Boolean value indicating whether the field is required in member forms
+
+  ## Returns
+
+    - `{:ok, updated_settings}` - Successfully updated settings
+    - `{:error, error}` - Validation or update error
+
+  ## Examples
+
+      iex> {:ok, settings} = Mv.Membership.get_settings()
+      iex> {:ok, updated} = Mv.Membership.update_single_member_field(settings, field: "first_name", show_in_overview: true, required: true)
+      iex> updated.member_field_required["first_name"]
+      true
+
+  """
+  def update_single_member_field(settings,
+        field: field,
+        show_in_overview: show_in_overview,
+        required: required
+      ) do
+    settings
+    |> Ash.Changeset.new()
+    |> Ash.Changeset.set_argument(:field, field)
+    |> Ash.Changeset.set_argument(:show_in_overview, show_in_overview)
+    |> Ash.Changeset.set_argument(:required, required)
+    |> Ash.Changeset.for_update(:update_single_member_field, %{})
+    |> Ash.update(domain: __MODULE__)
+  end
+
   @doc """
   Gets a group by its slug.
 

lib/membership/setting.ex

@@ -11,6 +11,8 @@ defmodule Mv.Membership.Setting do
   - `club_name` - The name of the association/club (required, cannot be empty)
   - `member_field_visibility` - JSONB map storing visibility configuration for member fields
     (e.g., `%{"street" => false, "house_number" => false}`). Fields not in the map default to `true`.
+  - `member_field_required` - JSONB map storing which member fields are required in forms
+    (e.g., `%{"first_name" => true, "last_name" => true}`). Email is always required; other fields default to optional.
   - `include_joining_cycle` - Whether to include the joining cycle in membership fee generation (default: true)
   - `default_membership_fee_type_id` - Default membership fee type for new members (optional)
 
@@ -42,6 +44,9 @@ defmodule Mv.Membership.Setting do
       # Update member field visibility
       {:ok, updated} = Mv.Membership.update_member_field_visibility(settings, %{"street" => false, "house_number" => false})
 
+      # Update visibility and required for a single member field (e.g. from settings UI)
+      {:ok, updated} = Mv.Membership.update_single_member_field(settings, field: "first_name", show_in_overview: true, required: true)
+
       # Update membership fee settings
       {:ok, updated} = Mv.Membership.update_settings(settings, %{include_joining_cycle: false})
   """
@@ -68,8 +73,13 @@ defmodule Mv.Membership.Setting do
       accept [
         :club_name,
         :member_field_visibility,
+        :member_field_required,
         :include_joining_cycle,
-        :default_membership_fee_type_id
+        :default_membership_fee_type_id,
+        :vereinfacht_api_url,
+        :vereinfacht_api_key,
+        :vereinfacht_club_id,
+        :vereinfacht_app_url
       ]
     end
 
@@ -80,8 +90,13 @@ defmodule Mv.Membership.Setting do
       accept [
         :club_name,
         :member_field_visibility,
+        :member_field_required,
         :include_joining_cycle,
-        :default_membership_fee_type_id
+        :default_membership_fee_type_id,
+        :vereinfacht_api_url,
+        :vereinfacht_api_key,
+        :vereinfacht_club_id,
+        :vereinfacht_app_url
       ]
     end
 
@@ -101,6 +116,17 @@ defmodule Mv.Membership.Setting do
       change Mv.Membership.Setting.Changes.UpdateSingleMemberFieldVisibility
     end
 
+    update :update_single_member_field do
+      description "Atomically updates visibility and required for a single member field"
+      require_atomic? false
+
+      argument :field, :string, allow_nil?: false
+      argument :show_in_overview, :boolean, allow_nil?: false
+      argument :required, :boolean, allow_nil?: false
+
+      change Mv.Membership.Setting.Changes.UpdateSingleMemberField
+    end
+
     update :update_membership_fee_settings do
       description "Updates the membership fee configuration"
       require_atomic? false
@@ -154,6 +180,44 @@ defmodule Mv.Membership.Setting do
              end,
              on: [:create, :update]
 
+    # Validate member_field_required map structure and content
+    validate fn changeset, _context ->
+               required_config = Ash.Changeset.get_attribute(changeset, :member_field_required)
+
+               if required_config && is_map(required_config) do
+                 invalid_values =
+                   Enum.filter(required_config, fn {_key, value} ->
+                     not is_boolean(value)
+                   end)
+
+                 valid_field_strings = Mv.Constants.member_fields() |> Enum.map(&Atom.to_string/1)
+
+                 invalid_keys =
+                   Enum.filter(required_config, fn {key, _value} ->
+                     key not in valid_field_strings
+                   end)
+                   |> Enum.map(fn {key, _value} -> key end)
+
+                 cond do
+                   not Enum.empty?(invalid_values) ->
+                     {:error,
+                      field: :member_field_required,
+                      message: "All values in member_field_required must be booleans"}
+
+                   not Enum.empty?(invalid_keys) ->
+                     {:error,
+                      field: :member_field_required,
+                      message: "Invalid member field keys: #{inspect(invalid_keys)}"}
+
+                   true ->
+                     :ok
+                 end
+               else
+                 :ok
+               end
+             end,
+             on: [:create, :update]
+
     # Validate default_membership_fee_type_id exists if set
     validate fn changeset, context ->
                fee_type_id =
@@ -211,6 +275,12 @@ defmodule Mv.Membership.Setting do
       description:
         "Configuration for member field visibility in overview (JSONB map). Keys are member field names (atoms), values are booleans."
 
+    attribute :member_field_required, :map,
+      allow_nil?: true,
+      public?: true,
+      description:
+        "Configuration for which member fields are required in forms (JSONB map). Keys are member field names (strings), values are booleans. Email is always required."
+
     # Membership fee settings
     attribute :include_joining_cycle, :boolean do
       allow_nil? false
@@ -225,6 +295,33 @@ defmodule Mv.Membership.Setting do
       description "Default membership fee type ID for new members"
     end
 
+    # Vereinfacht accounting software integration (can be overridden by ENV)
+    attribute :vereinfacht_api_url, :string do
+      allow_nil? true
+      public? true
+      description "Vereinfacht API base URL (e.g. https://api.verein.visuel.dev/api/v1)"
+    end
+
+    attribute :vereinfacht_api_key, :string do
+      allow_nil? true
+      public? false
+      description "Vereinfacht API key (Bearer token)"
+      sensitive? true
+    end
+
+    attribute :vereinfacht_club_id, :string do
+      allow_nil? true
+      public? true
+      description "Vereinfacht club ID for multi-tenancy"
+    end
+
+    attribute :vereinfacht_app_url, :string do
+      allow_nil? true
+      public? true
+
+      description "Vereinfacht app base URL for contact view links (e.g. https://app.verein.visuel.dev)"
+    end
+
     timestamps()
   end
 

lib/membership/setting/changes/update_single_member_field.ex

@@ -0,0 +1,179 @@
+defmodule Mv.Membership.Setting.Changes.UpdateSingleMemberField do
+  @moduledoc """
+  Ash change that atomically updates visibility and required for a single member field.
+
+  Updates both `member_field_visibility` and `member_field_required` JSONB maps
+  in one SQL UPDATE to avoid lost updates when saving from the settings UI.
+
+  ## Arguments
+  - `field` - The member field name as a string (e.g., "street", "first_name")
+  - `show_in_overview` - Boolean value indicating visibility in member overview
+  - `required` - Boolean value indicating whether the field is required in member forms
+
+  ## Example
+      settings
+      |> Ash.Changeset.for_update(:update_single_member_field, %{},
+        arguments: %{field: "first_name", show_in_overview: true, required: true}
+      )
+      |> Ash.update(domain: Mv.Membership)
+  """
+  use Ash.Resource.Change
+
+  alias Ash.Error.Invalid
+  alias Ecto.Adapters.SQL
+  require Logger
+
+  def change(changeset, _opts, _context) do
+    with {:ok, field} <- get_and_validate_field(changeset),
+         {:ok, show_in_overview} <- get_and_validate_boolean(changeset, :show_in_overview),
+         {:ok, required} <- get_and_validate_boolean(changeset, :required) do
+      add_after_action(changeset, field, show_in_overview, required)
+    else
+      {:error, updated_changeset} -> updated_changeset
+    end
+  end
+
+  defp get_and_validate_field(changeset) do
+    case Ash.Changeset.get_argument(changeset, :field) do
+      nil ->
+        {:error,
+         add_error(changeset,
+           field: :field,
+           message: "field argument is required"
+         )}
+
+      field ->
+        valid_fields = Mv.Constants.member_fields() |> Enum.map(&Atom.to_string/1)
+
+        if field in valid_fields do
+          {:ok, field}
+        else
+          {:error,
+           add_error(
+             changeset,
+             field: :field,
+             message: "Invalid member field: #{field}"
+           )}
+        end
+    end
+  end
+
+  defp get_and_validate_boolean(changeset, :show_in_overview = arg_name) do
+    do_validate_boolean(changeset, arg_name, :show_in_overview)
+  end
+
+  defp get_and_validate_boolean(changeset, :required = arg_name) do
+    do_validate_boolean(changeset, arg_name, :member_field_required)
+  end
+
+  defp do_validate_boolean(changeset, arg_name, error_field) do
+    case Ash.Changeset.get_argument(changeset, arg_name) do
+      nil ->
+        {:error,
+         add_error(
+           changeset,
+           field: error_field,
+           message: "#{arg_name} argument is required"
+         )}
+
+      value when is_boolean(value) ->
+        {:ok, value}
+
+      _ ->
+        {:error,
+         add_error(
+           changeset,
+           field: error_field,
+           message: "#{arg_name} must be a boolean"
+         )}
+    end
+  end
+
+  defp add_error(changeset, opts) do
+    Ash.Changeset.add_error(changeset, opts)
+  end
+
+  defp add_after_action(changeset, field, show_in_overview, required) do
+    Ash.Changeset.after_action(changeset, fn _changeset, settings ->
+      # Update both JSONB columns in one statement
+      sql = """
+      UPDATE settings
+      SET
+        member_field_visibility = jsonb_set(
+          COALESCE(member_field_visibility, '{}'::jsonb),
+          ARRAY[$1::text],
+          to_jsonb($2::boolean),
+          true
+        ),
+        member_field_required = jsonb_set(
+          COALESCE(member_field_required, '{}'::jsonb),
+          ARRAY[$1::text],
+          to_jsonb($3::boolean),
+          true
+        ),
+        updated_at = (now() AT TIME ZONE 'utc')
+      WHERE id = $4
+      RETURNING member_field_visibility, member_field_required
+      """
+
+      uuid_binary = Ecto.UUID.dump!(settings.id)
+
+      case SQL.query(Mv.Repo, sql, [field, show_in_overview, required, uuid_binary]) do
+        {:ok, %{rows: [[updated_visibility, updated_required] | _]}} ->
+          vis = normalize_jsonb_result(updated_visibility)
+          req = normalize_jsonb_result(updated_required)
+
+          updated_settings = %{
+            settings
+            | member_field_visibility: vis,
+              member_field_required: req
+          }
+
+          {:ok, updated_settings}
+
+        {:ok, %{rows: []}} ->
+          {:error,
+           Invalid.exception(
+             field: :member_field_required,
+             message: "Settings not found"
+           )}
+
+        {:error, error} ->
+          Logger.error("Failed to atomically update member field settings: #{inspect(error)}")
+
+          {:error,
+           Invalid.exception(
+             field: :member_field_required,
+             message: "Failed to update member field settings"
+           )}
+      end
+    end)
+  end
+
+  defp normalize_jsonb_result(updated_jsonb) do
+    case updated_jsonb do
+      map when is_map(map) ->
+        Enum.reduce(map, %{}, fn
+          {k, v}, acc when is_atom(k) -> Map.put(acc, Atom.to_string(k), v)
+          {k, v}, acc -> Map.put(acc, k, v)
+        end)
+
+      binary when is_binary(binary) ->
+        case Jason.decode(binary) do
+          {:ok, decoded} when is_map(decoded) ->
+            decoded
+
+          {:ok, _} ->
+            %{}
+
+          {:error, reason} ->
+            Logger.warning("Failed to decode JSONB: #{inspect(reason)}")
+            %{}
+        end
+
+      _ ->
+        Logger.warning("Unexpected JSONB format: #{inspect(updated_jsonb)}")
+        %{}
+    end
+  end
+end

lib/mv/application.ex

@@ -7,6 +7,8 @@ defmodule Mv.Application do
 
   @impl true
   def start(_type, _args) do
+    Mv.Vereinfacht.SyncFlash.create_table!()
+
     children = [
       MvWeb.Telemetry,
       Mv.Repo,

lib/mv/authorization/checks/actor_is_system_user.ex

@@ -0,0 +1,15 @@
+defmodule Mv.Authorization.Checks.ActorIsSystemUser do
+  @moduledoc """
+  Policy check: true only when the actor is the system user (e.g. system@mila.local).
+
+  Used to restrict internal actions (e.g. Member.set_vereinfacht_contact_id) so that
+  only code paths using SystemActor can perform them, not regular admins.
+  """
+  use Ash.Policy.SimpleCheck
+
+  @impl true
+  def describe(_opts), do: "actor is the system user"
+
+  @impl true
+  def match?(actor, _context, _opts), do: Mv.Helpers.SystemActor.system_user?(actor)
+end

lib/mv/config.ex

@@ -142,4 +142,160 @@ defmodule Mv.Config do
     |> Keyword.get(key, default)
     |> parse_and_validate_integer(default)
   end
+
+  # ---------------------------------------------------------------------------
+  # Vereinfacht accounting software integration
+  # ENV variables take priority; fallback to Settings from database.
+  # ---------------------------------------------------------------------------
+
+  @doc """
+  Returns the Vereinfacht API base URL.
+
+  Reads from `VEREINFACHT_API_URL` env first, then from Settings.
+  """
+  @spec vereinfacht_api_url() :: String.t() | nil
+  def vereinfacht_api_url do
+    env_or_setting("VEREINFACHT_API_URL", :vereinfacht_api_url)
+  end
+
+  @doc """
+  Returns the Vereinfacht API key (Bearer token).
+
+  Reads from `VEREINFACHT_API_KEY` env first, then from Settings.
+  """
+  @spec vereinfacht_api_key() :: String.t() | nil
+  def vereinfacht_api_key do
+    env_or_setting("VEREINFACHT_API_KEY", :vereinfacht_api_key)
+  end
+
+  @doc """
+  Returns the Vereinfacht club ID for multi-tenancy.
+
+  Reads from `VEREINFACHT_CLUB_ID` env first, then from Settings.
+  """
+  @spec vereinfacht_club_id() :: String.t() | nil
+  def vereinfacht_club_id do
+    env_or_setting("VEREINFACHT_CLUB_ID", :vereinfacht_club_id)
+  end
+
+  @doc """
+  Returns the Vereinfacht app base URL for contact view links (frontend, not API).
+
+  Reads from `VEREINFACHT_APP_URL` env first, then from Settings.
+  Used to build links like https://app.verein.visuel.dev/en/admin/finances/contacts/{id}.
+  If not set, derived from API URL by replacing host \"api.\" with \"app.\" when possible.
+  """
+  @spec vereinfacht_app_url() :: String.t() | nil
+  def vereinfacht_app_url do
+    env_or_setting("VEREINFACHT_APP_URL", :vereinfacht_app_url) ||
+      derive_app_url_from_api_url(vereinfacht_api_url())
+  end
+
+  defp derive_app_url_from_api_url(nil), do: nil
+
+  defp derive_app_url_from_api_url(api_url) when is_binary(api_url) do
+    api_url = String.trim(api_url)
+    uri = URI.parse(api_url)
+    host = uri.host || ""
+
+    if String.starts_with?(host, "api.") do
+      app_host = "app." <> String.slice(host, 4..-1//1)
+      scheme = uri.scheme || "https"
+      "#{scheme}://#{app_host}"
+    else
+      nil
+    end
+  end
+
+  defp derive_app_url_from_api_url(_), do: nil
+
+  @doc """
+  Returns true if Vereinfacht is fully configured (URL, API key, and club ID all set).
+  """
+  @spec vereinfacht_configured?() :: boolean()
+  def vereinfacht_configured? do
+    present?(vereinfacht_api_url()) and present?(vereinfacht_api_key()) and
+      present?(vereinfacht_club_id())
+  end
+
+  @doc """
+  Returns true if any Vereinfacht ENV variable is set (used to show hint in Settings UI).
+  """
+  @spec vereinfacht_env_configured?() :: boolean()
+  def vereinfacht_env_configured? do
+    vereinfacht_api_url_env_set?() or vereinfacht_api_key_env_set?() or
+      vereinfacht_club_id_env_set?()
+  end
+
+  @doc """
+  Returns true if VEREINFACHT_API_URL is set (field is read-only in Settings).
+  """
+  def vereinfacht_api_url_env_set?, do: env_set?("VEREINFACHT_API_URL")
+
+  @doc """
+  Returns true if VEREINFACHT_API_KEY is set (field is read-only in Settings).
+  """
+  def vereinfacht_api_key_env_set?, do: env_set?("VEREINFACHT_API_KEY")
+
+  @doc """
+  Returns true if VEREINFACHT_CLUB_ID is set (field is read-only in Settings).
+  """
+  def vereinfacht_club_id_env_set?, do: env_set?("VEREINFACHT_CLUB_ID")
+
+  @doc """
+  Returns true if VEREINFACHT_APP_URL is set (field is read-only in Settings).
+  """
+  def vereinfacht_app_url_env_set?, do: env_set?("VEREINFACHT_APP_URL")
+
+  defp env_set?(key) do
+    case System.get_env(key) do
+      nil -> false
+      v when is_binary(v) -> String.trim(v) != ""
+      _ -> false
+    end
+  end
+
+  defp env_or_setting(env_key, setting_key) do
+    case System.get_env(env_key) do
+      nil -> get_vereinfacht_from_settings(setting_key)
+      value -> trim_nil(value)
+    end
+  end
+
+  defp get_vereinfacht_from_settings(key) do
+    case Mv.Membership.get_settings() do
+      {:ok, settings} -> settings |> Map.get(key) |> trim_nil()
+      {:error, _} -> nil
+    end
+  end
+
+  defp trim_nil(nil), do: nil
+
+  defp trim_nil(s) when is_binary(s) do
+    t = String.trim(s)
+    if t == "", do: nil, else: t
+  end
+
+  @doc """
+  Returns the URL to view a finance contact in the Vereinfacht app (frontend).
+
+  Uses the configured app base URL (or derived from API URL) and appends
+  /en/admin/finances/contacts/{id}. Returns nil if no app URL can be determined.
+  """
+  @spec vereinfacht_contact_view_url(String.t()) :: String.t() | nil
+  def vereinfacht_contact_view_url(contact_id) when is_binary(contact_id) do
+    base = vereinfacht_app_url()
+
+    if present?(base) do
+      base
+      |> String.trim_trailing("/")
+      |> then(&"#{&1}/en/admin/finances/contacts/#{contact_id}")
+    else
+      nil
+    end
+  end
+
+  defp present?(nil), do: false
+  defp present?(s) when is_binary(s), do: String.trim(s) != ""
+  defp present?(_), do: false
 end

lib/mv/constants.ex

@@ -28,8 +28,26 @@ defmodule Mv.Constants do
 
   @email_validator_checks [:html_input, :pow]
 
+  # Member fields that are required when Vereinfacht integration is active (contact sync)
+  @vereinfacht_required_member_fields [:first_name, :last_name, :street, :postal_code, :city]
+
   def member_fields, do: @member_fields
 
+  @doc """
+  Returns member fields that are always required when Vereinfacht integration is configured.
+
+  Used for validation, member form required indicators, and settings UI (checkbox disabled).
+  """
+  def vereinfacht_required_member_fields, do: @vereinfacht_required_member_fields
+
+  @doc """
+  Returns whether the given member field is required by Vereinfacht when integration is active.
+  """
+  def vereinfacht_required_field?(field) when is_atom(field),
+    do: field in @vereinfacht_required_member_fields
+
+  def vereinfacht_required_field?(_), do: false
+
   @doc """
   Returns the prefix used for custom field keys in field visibility maps.
 

lib/mv/membership/member_export.ex

@@ -16,7 +16,7 @@ defmodule Mv.Membership.MemberExport do
   alias MvWeb.MemberLive.Index.MembershipFeeStatus
 
   @member_fields_allowlist (Mv.Constants.member_fields() |> Enum.map(&Atom.to_string/1)) ++
-                             ["membership_fee_status"]
+                             ["membership_fee_status", "groups"]
   @computed_export_fields ["membership_fee_status"]
   @computed_insert_after "membership_fee_start_date"
   @custom_field_prefix Mv.Constants.custom_field_prefix()
@@ -323,10 +323,14 @@ defmodule Mv.Membership.MemberExport do
       |> Enum.filter(&(&1 in @domain_member_field_strings))
       |> order_member_fields_like_table()
 
-    # final member_fields list (used for column specs order): table order + computed inserted
+    # Separate groups from other fields (groups is handled as a special field, not a member field)
+    groups_field = if "groups" in member_fields, do: ["groups"], else: []
+
+    # final member_fields list (used for column specs order): table order + computed inserted + groups
     ordered_member_fields =
       selectable_member_fields
       |> insert_computed_fields_like_table(computed_fields)
+      |> then(fn fields -> fields ++ groups_field end)
 
     %{
       selected_ids: filter_valid_uuids(extract_list(params, "selected_ids")),

lib/mv/membership/member_export/build.ex

@@ -132,12 +132,15 @@ defmodule Mv.Membership.MemberExport.Build do
         parsed.computed_fields != [] or
         "membership_fee_status" in parsed.member_fields
 
+    need_groups = "groups" in parsed.member_fields
+
     query =
       Member
       |> Ash.Query.new()
       |> Ash.Query.select(select_fields)
       |> load_custom_field_values_query(custom_field_ids_union)
       |> maybe_load_cycles(need_cycles, parsed.show_current_cycle)
+      |> maybe_load_groups(need_groups)
 
     query =
       if parsed.selected_ids != [] do
@@ -241,16 +244,22 @@ defmodule Mv.Membership.MemberExport.Build do
   defp maybe_sort(query, _field, nil), do: {query, false}
 
   defp maybe_sort(query, field, order) when is_binary(field) do
-    if custom_field_sort?(field) do
-      {query, true}
-    else
-      field_atom = String.to_existing_atom(field)
+    cond do
+      field == "groups" ->
+        # Groups sort → in-memory nach dem Read (wie Tabelle)
+        {query, true}
 
-      if field_atom in (Mv.Constants.member_fields() -- [:notes]) do
-        {Ash.Query.sort(query, [{field_atom, String.to_existing_atom(order)}]), false}
-      else
-        {query, false}
-      end
+      custom_field_sort?(field) ->
+        {query, true}
+
+      true ->
+        field_atom = String.to_existing_atom(field)
+
+        if field_atom in (Mv.Constants.member_fields() -- [:notes]) do
+          {Ash.Query.sort(query, [{field_atom, String.to_existing_atom(order)}]), false}
+        else
+          {query, false}
+        end
     end
   rescue
     ArgumentError -> {query, false}
@@ -260,11 +269,25 @@ defmodule Mv.Membership.MemberExport.Build do
     do: []
 
   defp sort_members_by_custom_field(members, field, order, custom_fields) when is_binary(field) do
+    if field == "groups" do
+      sort_members_by_groups_export(members, order)
+    else
+      sort_by_custom_field_value(members, field, order, custom_fields)
+    end
+  end
+
+  defp sort_by_custom_field_value(members, field, order, custom_fields) do
     id_str = String.trim_leading(field, @custom_field_prefix)
     custom_field = Enum.find(custom_fields, fn cf -> to_string(cf.id) == id_str end)
 
-    if is_nil(custom_field), do: members
+    if is_nil(custom_field) do
+      members
+    else
+      sort_members_with_custom_field(members, custom_field, order)
+    end
+  end
 
+  defp sort_members_with_custom_field(members, custom_field, order) do
     key_fn = fn member ->
       cfv = find_cfv(member, custom_field)
       raw = if cfv, do: cfv.value, else: nil
@@ -277,6 +300,26 @@ defmodule Mv.Membership.MemberExport.Build do
     |> Enum.map(fn {m, _} -> m end)
   end
 
+  defp sort_members_by_groups_export(members, order) do
+    # Members with groups first, then by first group name alphabetically (min = first by sort order)
+    # Match table behavior from MvWeb.MemberLive.Index.sort_members_by_groups/2
+    first_group_name = fn member ->
+      (member.groups || [])
+      |> Enum.map(& &1.name)
+      |> Enum.min(fn -> nil end)
+    end
+
+    members
+    |> Enum.sort_by(fn member ->
+      name = first_group_name.(member)
+      # Nil (no groups) sorts last in asc, first in desc
+      {name == nil, name || ""}
+    end)
+    |> then(fn list ->
+      if order == "desc", do: Enum.reverse(list), else: list
+    end)
+  end
+
   defp find_cfv(member, custom_field) do
     (member.custom_field_values || [])
     |> Enum.find(fn cfv ->
@@ -294,6 +337,13 @@ defmodule Mv.Membership.MemberExport.Build do
     MembershipFeeStatus.load_cycles_for_members(query, show_current)
   end
 
+  defp maybe_load_groups(query, false), do: query
+
+  defp maybe_load_groups(query, true) do
+    # Load groups with id and name only (for export formatting)
+    Ash.Query.load(query, groups: [:id, :name])
+  end
+
   defp apply_cycle_status_filter(members, nil, _show_current), do: members
 
   defp apply_cycle_status_filter(members, status, show_current) when status in [:paid, :unpaid] do
@@ -343,6 +393,19 @@ defmodule Mv.Membership.MemberExport.Build do
         }
       end)
 
+    groups_col =
+      if "groups" in parsed.member_fields do
+        [
+          %{
+            key: :groups,
+            kind: :groups,
+            label: label_fn.(:groups)
+          }
+        ]
+      else
+        []
+      end
+
     custom_cols =
       parsed.custom_field_ids
       |> Enum.map(fn id ->
@@ -361,7 +424,7 @@ defmodule Mv.Membership.MemberExport.Build do
       end)
       |> Enum.reject(&is_nil/1)
 
-    member_cols ++ computed_cols ++ custom_cols
+    member_cols ++ computed_cols ++ groups_col ++ custom_cols
   end
 
   defp build_rows(members, columns, custom_fields_by_id) do
@@ -391,6 +454,11 @@ defmodule Mv.Membership.MemberExport.Build do
     if is_binary(value), do: value, else: ""
   end
 
+  defp cell_value(member, %{kind: :groups, key: :groups}, _custom_fields_by_id) do
+    groups = Map.get(member, :groups) || []
+    format_groups(groups)
+  end
+
   defp key_to_atom(k) when is_atom(k), do: k
 
   defp key_to_atom(k) when is_binary(k) do
@@ -424,6 +492,15 @@ defmodule Mv.Membership.MemberExport.Build do
   defp format_member_value(%NaiveDateTime{} = dt), do: NaiveDateTime.to_iso8601(dt)
   defp format_member_value(value), do: to_string(value)
 
+  defp format_groups([]), do: ""
+
+  defp format_groups(groups) when is_list(groups) do
+    groups
+    |> Enum.map(fn group -> Map.get(group, :name) || "" end)
+    |> Enum.reject(&(&1 == ""))
+    |> Enum.join(", ")
+  end
+
   defp build_meta(members) do
     %{
       generated_at: DateTime.utc_now() |> DateTime.to_iso8601(),

lib/mv/membership/members_csv.ex

@@ -59,6 +59,11 @@ defmodule Mv.Membership.MembersCSV do
     if is_binary(value), do: value, else: ""
   end
 
+  defp cell_value(member, %{kind: :groups, key: :groups}) do
+    groups = Map.get(member, :groups) || []
+    format_groups(groups)
+  end
+
   defp key_to_atom(k) when is_atom(k), do: k
 
   defp key_to_atom(k) when is_binary(k) do
@@ -97,4 +102,13 @@ defmodule Mv.Membership.MembersCSV do
   defp format_member_value(%DateTime{} = dt), do: DateTime.to_iso8601(dt)
   defp format_member_value(%NaiveDateTime{} = dt), do: NaiveDateTime.to_iso8601(dt)
   defp format_member_value(value), do: to_string(value)
+
+  defp format_groups([]), do: ""
+
+  defp format_groups(groups) when is_list(groups) do
+    groups
+    |> Enum.map(fn group -> Map.get(group, :name) || "" end)
+    |> Enum.reject(&(&1 == ""))
+    |> Enum.join(", ")
+  end
 end

lib/mv/vereinfacht/changes/sync_contact.ex

@@ -0,0 +1,91 @@
+defmodule Mv.Vereinfacht.Changes.SyncContact do
+  @moduledoc """
+  Syncs a member to Vereinfacht as a finance contact after create/update.
+
+  - If the member has no `vereinfacht_contact_id`, creates a contact via API and saves the ID.
+  - If the member already has an ID, updates the contact via API.
+  Runs in `after_transaction` so the member is persisted first. API failures are logged
+  but do not block the member operation. Requires Vereinfacht to be configured
+  (Mv.Config.vereinfacht_configured?/0).
+
+  Only runs when relevant data changed: on create always; on update only when
+  first_name, last_name, email, street, house_number, postal_code, or city changed,
+  or when the member has no vereinfacht_contact_id yet (to avoid unnecessary API calls).
+  """
+  use Ash.Resource.Change
+
+  require Logger
+
+  @synced_attributes [
+    :first_name,
+    :last_name,
+    :email,
+    :street,
+    :house_number,
+    :postal_code,
+    :city
+  ]
+
+  @impl true
+  def change(changeset, _opts, _context) do
+    if Mv.Config.vereinfacht_configured?() and sync_relevant?(changeset) do
+      Ash.Changeset.after_transaction(changeset, &sync_after_transaction/2)
+    else
+      changeset
+    end
+  end
+
+  defp sync_relevant?(changeset) do
+    case changeset.action_type do
+      :create -> true
+      :update -> relevant_update?(changeset)
+      _ -> false
+    end
+  end
+
+  defp relevant_update?(changeset) do
+    any_synced_attr_changed? =
+      Enum.any?(@synced_attributes, &Ash.Changeset.changing_attribute?(changeset, &1))
+
+    record = changeset.data
+    no_contact_id_yet? = record && blank_contact_id?(record.vereinfacht_contact_id)
+
+    any_synced_attr_changed? or no_contact_id_yet?
+  end
+
+  defp blank_contact_id?(nil), do: true
+  defp blank_contact_id?(""), do: true
+  defp blank_contact_id?(s) when is_binary(s), do: String.trim(s) == ""
+  defp blank_contact_id?(_), do: false
+
+  # Ash calls after_transaction with (changeset, result) only - 2 args.
+  defp sync_after_transaction(_changeset, {:ok, member}) do
+    case Mv.Vereinfacht.sync_member(member) do
+      :ok ->
+        Mv.Vereinfacht.SyncFlash.store(to_string(member.id), :ok, "Synced to Vereinfacht.")
+        {:ok, member}
+
+      {:ok, member_updated} ->
+        Mv.Vereinfacht.SyncFlash.store(
+          to_string(member_updated.id),
+          :ok,
+          "Synced to Vereinfacht."
+        )
+
+        {:ok, member_updated}
+
+      {:error, reason} ->
+        Logger.warning("Vereinfacht sync failed for member #{member.id}: #{inspect(reason)}")
+
+        Mv.Vereinfacht.SyncFlash.store(
+          to_string(member.id),
+          :warning,
+          Mv.Vereinfacht.format_error(reason)
+        )
+
+        {:ok, member}
+    end
+  end
+
+  defp sync_after_transaction(_changeset, error), do: error
+end

lib/mv/vereinfacht/changes/sync_linked_member_after_user_change.ex

@@ -0,0 +1,71 @@
+defmodule Mv.Vereinfacht.Changes.SyncLinkedMemberAfterUserChange do
+  @moduledoc """
+  Syncs the linked Member to Vereinfacht after a User action that may have updated
+  the member's email via Ecto (e.g. User email change → SyncUserEmailToMember).
+
+  Attach to any User action that uses SyncUserEmailToMember. After the transaction
+  commits, if the user has a linked member and Vereinfacht is configured, syncs
+  that member to the API. Failures are logged but do not affect the User result.
+  """
+  use Ash.Resource.Change
+
+  require Logger
+  alias Mv.Membership.Member
+  alias Mv.Membership
+  alias Mv.Helpers.SystemActor
+  alias Mv.Helpers
+
+  @impl true
+  def change(changeset, _opts, _context) do
+    if Mv.Config.vereinfacht_configured?() and relevant_change?(changeset) do
+      Ash.Changeset.after_transaction(changeset, &sync_linked_member_after_transaction/2)
+    else
+      changeset
+    end
+  end
+
+  # Only sync when something that affects the linked member's data actually changed
+  # (email sync or member link), to avoid unnecessary API calls on every user update.
+  defp relevant_change?(changeset) do
+    Ash.Changeset.changing_attribute?(changeset, :email) or
+      Ash.Changeset.changing_relationship?(changeset, :member)
+  end
+
+  defp sync_linked_member_after_transaction(_changeset, {:ok, user}) do
+    case load_linked_member(user) do
+      nil ->
+        {:ok, user}
+
+      member ->
+        case Mv.Vereinfacht.sync_member(member) do
+          :ok ->
+            {:ok, user}
+
+          {:ok, _} ->
+            {:ok, user}
+
+          {:error, reason} ->
+            Logger.warning(
+              "Vereinfacht sync failed for member #{member.id} (linked to user #{user.id}): #{inspect(reason)}"
+            )
+
+            {:ok, user}
+        end
+    end
+  end
+
+  defp sync_linked_member_after_transaction(_changeset, result), do: result
+
+  defp load_linked_member(%{member_id: nil}), do: nil
+  defp load_linked_member(%{member_id: ""}), do: nil
+
+  defp load_linked_member(user) do
+    actor = SystemActor.get_system_actor()
+    opts = Helpers.ash_actor_opts(actor)
+
+    case Ash.get(Member, user.member_id, [domain: Membership] ++ opts) do
+      {:ok, %Member{} = member} -> member
+      _ -> nil
+    end
+  end
+end

lib/mv/vereinfacht/client.ex

@@ -0,0 +1,364 @@
+defmodule Mv.Vereinfacht.Client do
+  @moduledoc """
+  HTTP client for the Vereinfacht accounting software JSON:API.
+
+  Creates and updates finance contacts. Uses Bearer token authentication and
+  requires club ID for multi-tenancy. Configuration via ENV or Settings
+  (see Mv.Config).
+  """
+  require Logger
+
+  @content_type "application/vnd.api+json"
+
+  @doc """
+  Creates a finance contact in Vereinfacht for the given member.
+
+  Returns the contact ID on success. Does not update the member record;
+  the caller (e.g. SyncContact change) must persist `vereinfacht_contact_id`.
+
+  ## Options
+  - None; URL, API key, and club ID are read from Mv.Config.
+
+  ## Examples
+
+      iex> create_contact(member)
+      {:ok, "242"}
+
+      iex> create_contact(member)
+      {:error, {:http, 401, "Unauthenticated."}}
+  """
+  @spec create_contact(struct()) :: {:ok, String.t()} | {:error, term()}
+  def create_contact(member) do
+    base_url = base_url()
+    api_key = api_key()
+    club_id = club_id()
+
+    if is_nil(base_url) or is_nil(api_key) or is_nil(club_id) do
+      {:error, :not_configured}
+    else
+      body = build_create_body(member, club_id)
+      url = base_url |> String.trim_trailing("/") |> then(&"#{&1}/finance-contacts")
+      post_and_parse_contact(url, body, api_key)
+    end
+  end
+
+  @sync_timeout_ms 5_000
+
+  # In test, skip retries so sync fails fast when no API is running (avoids log spam and long waits).
+  defp req_http_options do
+    opts = [receive_timeout: @sync_timeout_ms]
+    if Mix.env() == :test, do: [retry: false] ++ opts, else: opts
+  end
+
+  defp post_and_parse_contact(url, body, api_key) do
+    encoded_body = Jason.encode!(body)
+
+    case Req.post(url, [body: encoded_body, headers: headers(api_key)] ++ req_http_options()) do
+      {:ok, %{status: 201, body: resp_body}} ->
+        case get_contact_id_from_response(resp_body) do
+          nil -> {:error, {:invalid_response, resp_body}}
+          id -> {:ok, id}
+        end
+
+      {:ok, %{status: status, body: resp_body}} ->
+        {:error, {:http, status, extract_error_message(resp_body)}}
+
+      {:error, reason} ->
+        {:error, {:request_failed, reason}}
+    end
+  end
+
+  @doc """
+  Updates an existing finance contact in Vereinfacht.
+
+  Only sends attributes that are typically synced from the member (name, email,
+  address fields). Returns the same contact_id on success.
+
+  ## Examples
+
+      iex> update_contact("242", member)
+      {:ok, "242"}
+
+      iex> update_contact("242", member)
+      {:error, {:http, 404, "Not Found"}}
+  """
+  @spec update_contact(String.t(), struct()) :: {:ok, String.t()} | {:error, term()}
+  def update_contact(contact_id, member) when is_binary(contact_id) do
+    base_url = base_url()
+    api_key = api_key()
+
+    if is_nil(base_url) or is_nil(api_key) do
+      {:error, :not_configured}
+    else
+      body = build_update_body(contact_id, member)
+      encoded_body = Jason.encode!(body)
+
+      url =
+        base_url
+        |> String.trim_trailing("/")
+        |> then(&"#{&1}/finance-contacts/#{contact_id}")
+
+      case Req.patch(
+             url,
+             [
+               body: encoded_body,
+               headers: headers(api_key)
+             ] ++ req_http_options()
+           ) do
+        {:ok, %{status: 200, body: _resp_body}} ->
+          {:ok, contact_id}
+
+        {:ok, %{status: status, body: body}} ->
+          {:error, {:http, status, extract_error_message(body)}}
+
+        {:error, reason} ->
+          {:error, {:request_failed, reason}}
+      end
+    end
+  end
+
+  @doc """
+  Finds a finance contact by email (GET /finance-contacts, then match in response).
+
+  The Vereinfacht API does not allow filter by email on this endpoint, so we
+  fetch the first page and find the contact client-side. Returns {:ok, contact_id}
+  if a contact with that email exists, {:error, :not_found} if none, or
+  {:error, reason} on API/network failure. Used before create for idempotency.
+  """
+  @spec find_contact_by_email(String.t()) :: {:ok, String.t()} | {:error, :not_found | term()}
+  def find_contact_by_email(email) when is_binary(email) do
+    if is_nil(base_url()) or is_nil(api_key()) or is_nil(club_id()) do
+      {:error, :not_configured}
+    else
+      do_find_contact_by_email(email)
+    end
+  end
+
+  @find_contact_page_size 100
+  @find_contact_max_pages 100
+
+  defp do_find_contact_by_email(email) do
+    normalized = String.trim(email) |> String.downcase()
+    do_find_contact_by_email_page(1, normalized)
+  end
+
+  defp do_find_contact_by_email_page(page, _normalized) when page > @find_contact_max_pages do
+    {:error, :not_found}
+  end
+
+  defp do_find_contact_by_email_page(page, normalized) do
+    base = base_url() |> String.trim_trailing("/") |> then(&"#{&1}/finance-contacts")
+    url = base <> "?page[size]=#{@find_contact_page_size}&page[number]=#{page}"
+
+    case Req.get(url, [headers: headers(api_key())] ++ req_http_options()) do
+      {:ok, %{status: 200, body: body}} when is_map(body) ->
+        handle_find_contact_page_response(body, page, normalized)
+
+      {:ok, %{status: status, body: body}} ->
+        {:error, {:http, status, extract_error_message(body)}}
+
+      {:error, reason} ->
+        {:error, {:request_failed, reason}}
+    end
+  end
+
+  defp handle_find_contact_page_response(body, page, normalized) do
+    case find_contact_id_by_email_in_list(body, normalized) do
+      id when is_binary(id) -> {:ok, id}
+      nil -> maybe_find_contact_next_page(body, page, normalized)
+    end
+  end
+
+  defp maybe_find_contact_next_page(body, page, normalized) do
+    data = Map.get(body, "data") || []
+
+    if length(data) < @find_contact_page_size,
+      do: {:error, :not_found},
+      else: do_find_contact_by_email_page(page + 1, normalized)
+  end
+
+  defp find_contact_id_by_email_in_list(%{"data" => list}, normalized) when is_list(list) do
+    Enum.find_value(list, fn
+      %{"id" => id, "attributes" => %{"email" => att_email, "isExternal" => true}}
+      when is_binary(att_email) ->
+        if att_email |> String.trim() |> String.downcase() == normalized do
+          normalize_contact_id(id)
+        else
+          nil
+        end
+
+      %{"id" => id, "attributes" => %{"email" => att_email, "isExternal" => "true"}}
+      when is_binary(att_email) ->
+        if att_email |> String.trim() |> String.downcase() == normalized do
+          normalize_contact_id(id)
+        else
+          nil
+        end
+
+      %{"id" => _id, "attributes" => _} ->
+        nil
+
+      _ ->
+        nil
+    end)
+  end
+
+  defp find_contact_id_by_email_in_list(_, _), do: nil
+
+  defp normalize_contact_id(id) when is_binary(id), do: id
+  defp normalize_contact_id(id) when is_integer(id), do: to_string(id)
+  defp normalize_contact_id(_), do: nil
+
+  @doc """
+  Fetches a single finance contact from Vereinfacht (GET /finance-contacts/:id).
+
+  Returns the full response body (decoded JSON) for debugging/display.
+  """
+  @spec get_contact(String.t()) :: {:ok, map()} | {:error, term()}
+  def get_contact(contact_id) when is_binary(contact_id) do
+    fetch_contact(contact_id, [])
+  end
+
+  @doc """
+  Fetches a finance contact with receipts (GET /finance-contacts/:id?include=receipts).
+
+  Returns {:ok, receipts} where receipts is a list of maps with :id and :attributes
+  (and optional :type) for each receipt, or {:error, reason}.
+  """
+  @spec get_contact_with_receipts(String.t()) :: {:ok, [map()]} | {:error, term()}
+  def get_contact_with_receipts(contact_id) when is_binary(contact_id) do
+    case fetch_contact(contact_id, include: "receipts") do
+      {:ok, body} -> {:ok, extract_receipts_from_response(body)}
+      {:error, _} = err -> err
+    end
+  end
+
+  defp fetch_contact(contact_id, query_params) do
+    base_url = base_url()
+    api_key = api_key()
+
+    if is_nil(base_url) or is_nil(api_key) do
+      {:error, :not_configured}
+    else
+      path =
+        base_url |> String.trim_trailing("/") |> then(&"#{&1}/finance-contacts/#{contact_id}")
+
+      url = build_url_with_params(path, query_params)
+
+      case Req.get(url, [headers: headers(api_key)] ++ req_http_options()) do
+        {:ok, %{status: 200, body: body}} when is_map(body) ->
+          {:ok, body}
+
+        {:ok, %{status: status, body: body}} ->
+          {:error, {:http, status, extract_error_message(body)}}
+
+        {:error, reason} ->
+          {:error, {:request_failed, reason}}
+      end
+    end
+  end
+
+  defp build_url_with_params(base, []), do: base
+
+  defp build_url_with_params(base, include: value) do
+    sep = if String.contains?(base, "?"), do: "&", else: "?"
+    base <> sep <> "include=" <> URI.encode(value, &URI.char_unreserved?/1)
+  end
+
+  # Allowlist of receipt attribute keys we expose (avoids String.to_atom on arbitrary API input / DoS).
+  @receipt_attr_allowlist ~w[amount bookingDate createdAt receiptType referenceNumber status updatedAt]a
+
+  defp extract_receipts_from_response(%{"included" => included}) when is_list(included) do
+    included
+    |> Enum.filter(&match?(%{"type" => "receipts"}, &1))
+    |> Enum.map(fn %{"id" => id, "attributes" => attrs} = r ->
+      Map.merge(%{id: id, type: r["type"]}, receipt_attrs_allowlist(attrs || %{}))
+    end)
+  end
+
+  defp extract_receipts_from_response(_), do: []
+
+  defp receipt_attrs_allowlist(attrs) when is_map(attrs) do
+    Map.new(@receipt_attr_allowlist, fn key ->
+      str_key = to_string(key)
+      {key, Map.get(attrs, str_key)}
+    end)
+    |> Enum.reject(fn {_k, v} -> is_nil(v) end)
+    |> Map.new()
+  end
+
+  defp base_url, do: Mv.Config.vereinfacht_api_url()
+  defp api_key, do: Mv.Config.vereinfacht_api_key()
+  defp club_id, do: Mv.Config.vereinfacht_club_id()
+
+  defp headers(api_key) do
+    [
+      {"Accept", @content_type},
+      {"Content-Type", @content_type},
+      {"Authorization", "Bearer #{api_key}"}
+    ]
+  end
+
+  defp build_create_body(member, club_id) do
+    attributes = member_to_attributes(member)
+
+    %{
+      "data" => %{
+        "type" => "finance-contacts",
+        "attributes" => attributes,
+        "relationships" => %{
+          "club" => %{
+            "data" => %{"type" => "clubs", "id" => club_id}
+          }
+        }
+      }
+    }
+  end
+
+  defp build_update_body(contact_id, member) do
+    attributes = member_to_attributes(member)
+
+    %{
+      "data" => %{
+        "type" => "finance-contacts",
+        "id" => contact_id,
+        "attributes" => attributes
+      }
+    }
+  end
+
+  defp member_to_attributes(member) do
+    address =
+      [member |> Map.get(:street), member |> Map.get(:house_number)]
+      |> Enum.reject(&is_nil/1)
+      |> Enum.map_join(" ", &to_string/1)
+      |> then(fn s -> if s == "", do: nil, else: s end)
+
+    %{}
+    |> put_attr("lastName", member |> Map.get(:last_name))
+    |> put_attr("firstName", member |> Map.get(:first_name))
+    |> put_attr("email", member |> Map.get(:email))
+    |> put_attr("address", address)
+    |> put_attr("zipCode", member |> Map.get(:postal_code))
+    |> put_attr("city", member |> Map.get(:city))
+    |> Map.put("contactType", "person")
+    |> Map.put("isExternal", true)
+    |> Enum.reject(fn {_k, v} -> is_nil(v) end)
+    |> Map.new()
+  end
+
+  defp put_attr(acc, _key, nil), do: acc
+  defp put_attr(acc, key, value), do: Map.put(acc, key, to_string(value))
+
+  defp get_contact_id_from_response(%{"data" => %{"id" => id}}) when is_binary(id), do: id
+
+  defp get_contact_id_from_response(%{"data" => %{"id" => id}}) when is_integer(id),
+    do: to_string(id)
+
+  defp get_contact_id_from_response(_), do: nil
+
+  defp extract_error_message(%{"errors" => [%{"detail" => d} | _]}) when is_binary(d), do: d
+  defp extract_error_message(%{"errors" => [%{"title" => t} | _]}) when is_binary(t), do: t
+  defp extract_error_message(body) when is_map(body), do: inspect(body)
+  defp extract_error_message(other), do: inspect(other)
+end

lib/mv/vereinfacht/sync_flash.ex

@@ -0,0 +1,46 @@
+defmodule Mv.Vereinfacht.SyncFlash do
+  @moduledoc """
+  Short-lived store for Vereinfacht sync results so the UI can show them after save.
+
+  The SyncContact change runs in after_transaction and cannot access the LiveView
+  socket. This module stores a message keyed by member_id; the form LiveView
+  calls `take/1` after a successful save and displays the message in flash.
+  """
+  @table :vereinfacht_sync_flash
+
+  @doc """
+  Stores a sync result for the given member. Overwrites any previous message.
+
+  - `:ok` - Sync succeeded (optional user message).
+  - `:warning` - Sync failed; message should be shown as a warning.
+  """
+  @spec store(String.t(), :ok | :warning, String.t()) :: :ok
+  def store(member_id, kind, message) when is_binary(member_id) do
+    :ets.insert(@table, {member_id, {kind, message}})
+    :ok
+  end
+
+  @doc """
+  Takes and removes the stored sync message for the given member.
+
+  Returns `{kind, message}` if present, otherwise `nil`.
+  """
+  @spec take(String.t()) :: {:ok | :warning, String.t()} | nil
+  def take(member_id) when is_binary(member_id) do
+    case :ets.take(@table, member_id) do
+      [{^member_id, value}] -> value
+      [] -> nil
+    end
+  end
+
+  @doc false
+  def create_table! do
+    # :public so any process can write (SyncContact runs in LiveView/Ash transaction process,
+    # not the process that created the table). :protected would restrict writes to the creating process.
+    if :ets.whereis(@table) == :undefined do
+      :ets.new(@table, [:set, :public, :named_table])
+    end
+
+    :ok
+  end
+end

lib/mv/vereinfacht/vereinfacht.ex

@@ -0,0 +1,165 @@
+defmodule Mv.Vereinfacht do
+  @moduledoc """
+  Business logic for Vereinfacht accounting software integration.
+
+  - `sync_member/1` – Sync a single member to the API (create or update contact).
+    Used by Member create/update (SyncContact) and by User actions that update
+    the linked member's email via Ecto (e.g. user email change).
+  - `sync_members_without_contact/0` – Bulk sync of members without a contact ID.
+  """
+  require Ash.Query
+  import Ash.Expr
+  alias Mv.Vereinfacht.Client
+  alias Mv.Membership.Member
+  alias Mv.Helpers.SystemActor
+  alias Mv.Helpers
+
+  @doc """
+  Syncs a single member to Vereinfacht (create or update finance contact).
+
+  If the member has no `vereinfacht_contact_id`, creates a contact and updates
+  the member with the new ID. If they already have an ID, updates the contact.
+  Uses system actor for any Ash update. Does nothing if Vereinfacht is not configured.
+
+  Returns:
+  - `:ok` – Contact was updated.
+  - `{:ok, member}` – Contact was created and member was updated with the new ID.
+  - `{:error, reason}` – API or update failed.
+  """
+  @spec sync_member(struct()) :: :ok | {:ok, struct()} | {:error, term()}
+  def sync_member(member) do
+    if Mv.Config.vereinfacht_configured?() do
+      do_sync_member(member)
+    else
+      :ok
+    end
+  end
+
+  defp do_sync_member(member) do
+    if present_contact_id?(member.vereinfacht_contact_id) do
+      sync_existing_contact(member)
+    else
+      ensure_contact_then_save(member)
+    end
+  end
+
+  defp sync_existing_contact(member) do
+    case Client.update_contact(member.vereinfacht_contact_id, member) do
+      {:ok, _} -> :ok
+      {:error, reason} -> {:error, reason}
+    end
+  end
+
+  defp ensure_contact_then_save(member) do
+    case get_or_create_contact_id(member) do
+      {:ok, contact_id} -> save_contact_id(member, contact_id)
+      {:error, _} = err -> err
+    end
+  end
+
+  # Before create: find by email to avoid duplicate contacts (idempotency).
+  # When an existing contact is found, update it with current member data.
+  defp get_or_create_contact_id(member) do
+    email = member |> Map.get(:email) |> to_string() |> String.trim()
+
+    if email == "" do
+      Client.create_contact(member)
+    else
+      case Client.find_contact_by_email(email) do
+        {:ok, existing_id} -> update_existing_contact_and_return_id(existing_id, member)
+        {:error, :not_found} -> Client.create_contact(member)
+        {:error, _} = err -> err
+      end
+    end
+  end
+
+  defp update_existing_contact_and_return_id(contact_id, member) do
+    case Client.update_contact(contact_id, member) do
+      {:ok, _} -> {:ok, contact_id}
+      {:error, _} = err -> err
+    end
+  end
+
+  defp save_contact_id(member, contact_id) do
+    system_actor = SystemActor.get_system_actor()
+    opts = Helpers.ash_actor_opts(system_actor)
+
+    case Ash.update(member, %{vereinfacht_contact_id: contact_id}, [
+           {:action, :set_vereinfacht_contact_id} | opts
+         ]) do
+      {:ok, updated} -> {:ok, updated}
+      {:error, reason} -> {:error, reason}
+    end
+  end
+
+  defp present_contact_id?(nil), do: false
+  defp present_contact_id?(""), do: false
+  defp present_contact_id?(s) when is_binary(s), do: String.trim(s) != ""
+  defp present_contact_id?(_), do: false
+
+  @doc """
+  Formats an API/request error reason into a short user-facing message.
+
+  Used by SyncContact (flash) and GlobalSettingsLive (sync result list).
+  """
+  @spec format_error(term()) :: String.t()
+  def format_error({:http, _status, detail}) when is_binary(detail), do: "Vereinfacht: " <> detail
+  def format_error({:http, status, _}), do: "Vereinfacht: API error (HTTP #{status})."
+
+  def format_error({:request_failed, _}),
+    do: "Vereinfacht: Request failed (e.g. connection error)."
+
+  def format_error({:invalid_response, _}), do: "Vereinfacht: Invalid API response."
+  def format_error(other), do: "Vereinfacht: " <> inspect(other)
+
+  @doc """
+  Creates Vereinfacht contacts for all members that do not yet have a
+  `vereinfacht_contact_id`. Uses system actor for reads and updates.
+
+  Returns `{:ok, %{synced: count, errors: list}}` where errors is a list of
+  `{member_id, reason}`. Does nothing if Vereinfacht is not configured.
+  """
+  @spec sync_members_without_contact() ::
+          {:ok, %{synced: non_neg_integer(), errors: [{String.t(), term()}]}}
+          | {:error, :not_configured}
+  def sync_members_without_contact do
+    if Mv.Config.vereinfacht_configured?() do
+      system_actor = SystemActor.get_system_actor()
+      opts = Helpers.ash_actor_opts(system_actor)
+
+      query =
+        Member
+        |> Ash.Query.filter(
+          expr(is_nil(^ref(:vereinfacht_contact_id)) or ^ref(:vereinfacht_contact_id) == "")
+        )
+
+      case Ash.read(query, opts) do
+        {:ok, members} ->
+          do_sync_members(members, opts)
+
+        {:error, _} = err ->
+          err
+      end
+    else
+      {:error, :not_configured}
+    end
+  end
+
+  defp do_sync_members(members, opts) do
+    {synced, errors} =
+      Enum.reduce(members, {0, []}, fn member, {acc_synced, acc_errors} ->
+        {inc, new_errors} = sync_one_member(member, opts)
+        {acc_synced + inc, acc_errors ++ new_errors}
+      end)
+
+    {:ok, %{synced: synced, errors: errors}}
+  end
+
+  defp sync_one_member(member, _opts) do
+    case sync_member(member) do
+      :ok -> {1, []}
+      {:ok, _} -> {1, []}
+      {:error, reason} -> {0, [{member.id, reason}]}
+    end
+  end
+end

lib/mv_web/components/core_components.ex

@@ -448,6 +448,8 @@ defmodule MvWeb.CoreComponents do
   end
 
   def input(%{type: "select"} = assigns) do
+    assigns = ensure_aria_required_for_input(assigns)
+
     ~H"""
     <fieldset class="mb-2 fieldset">
       <label>
@@ -475,6 +477,8 @@ defmodule MvWeb.CoreComponents do
   end
 
   def input(%{type: "textarea"} = assigns) do
+    assigns = ensure_aria_required_for_input(assigns)
+
     ~H"""
     <fieldset class="mb-2 fieldset">
       <label>
@@ -502,6 +506,8 @@ defmodule MvWeb.CoreComponents do
 
   # All other inputs text, datetime-local, url, password, etc. are handled here...
   def input(assigns) do
+    assigns = ensure_aria_required_for_input(assigns)
+
     ~H"""
     <fieldset class="mb-2 fieldset">
       <label>
@@ -529,6 +535,18 @@ defmodule MvWeb.CoreComponents do
     """
   end
 
+  # WCAG 2.1: set aria-required when required is true so screen readers announce required state
+  defp ensure_aria_required_for_input(assigns) do
+    rest = assigns.rest || %{}
+
+    rest =
+      if rest[:required],
+        do: Map.put(rest, :aria_required, "true"),
+        else: rest
+
+    assign(assigns, :rest, rest)
+  end
+
   # Helper used by inputs to generate form errors
   defp error(assigns) do
     ~H"""

lib/mv_web/controllers/member_export_controller.ex

@@ -18,7 +18,8 @@ defmodule MvWeb.MemberExportController do
   alias MvWeb.MemberLive.Index.MembershipFeeStatus
   use Gettext, backend: MvWeb.Gettext
 
-  @member_fields_allowlist Mv.Constants.member_fields() |> Enum.map(&Atom.to_string/1)
+  @member_fields_allowlist (Mv.Constants.member_fields() |> Enum.map(&Atom.to_string/1)) ++
+                             ["groups"]
   @computed_export_fields ["membership_fee_status"]
   @custom_field_prefix Mv.Constants.custom_field_prefix()
 
@@ -83,6 +84,7 @@ defmodule MvWeb.MemberExportController do
     domain_fields = Mv.Constants.member_fields() |> Enum.map(&Atom.to_string/1)
     selectable = Enum.filter(member_fields, fn f -> f in domain_fields end)
     computed = Enum.filter(member_fields, fn f -> f in @computed_export_fields end)
+    # "groups" is neither a domain field nor a computed field, it's handled separately
     {selectable, computed}
   end
 
@@ -235,12 +237,15 @@ defmodule MvWeb.MemberExportController do
     need_cycles =
       parsed.computed_fields != [] and "membership_fee_status" in parsed.computed_fields
 
+    need_groups = "groups" in parsed.member_fields
+
     query =
       Member
       |> Ash.Query.new()
       |> Ash.Query.select(select_fields)
       |> load_custom_field_values_query(parsed.custom_field_ids)
       |> maybe_load_cycles(need_cycles, parsed.show_current_cycle)
+      |> maybe_load_groups(need_groups)
 
     query =
       if parsed.selected_ids != [] do
@@ -284,6 +289,13 @@ defmodule MvWeb.MemberExportController do
     MembershipFeeStatus.load_cycles_for_members(query, show_current)
   end
 
+  defp maybe_load_groups(query, false), do: query
+
+  defp maybe_load_groups(query, true) do
+    # Load groups with id and name only (for export formatting)
+    Ash.Query.load(query, groups: [:id, :name])
+  end
+
   # Adds computed field values to members (e.g. membership_fee_status)
   defp add_computed_fields(members, computed_fields, show_current_cycle) do
     if "membership_fee_status" in computed_fields do
@@ -329,17 +341,23 @@ defmodule MvWeb.MemberExportController do
   defp maybe_sort_export(query, _field, nil), do: {query, false}
 
   defp maybe_sort_export(query, field, order) when is_binary(field) do
-    if custom_field_sort?(field) do
-      # Custom field sort → in-memory nach dem Read (wie Tabelle)
-      {query, true}
-    else
-      field_atom = String.to_existing_atom(field)
+    cond do
+      field == "groups" ->
+        # Groups sort → in-memory nach dem Read (wie Tabelle)
+        {query, true}
 
-      if field_atom in (Mv.Constants.member_fields() -- [:notes]) do
-        {Ash.Query.sort(query, [{field_atom, String.to_existing_atom(order)}]), false}
-      else
-        {query, false}
-      end
+      custom_field_sort?(field) ->
+        # Custom field sort → in-memory nach dem Read (wie Tabelle)
+        {query, true}
+
+      true ->
+        field_atom = String.to_existing_atom(field)
+
+        if field_atom in (Mv.Constants.member_fields() -- [:notes]) do
+          {Ash.Query.sort(query, [{field_atom, String.to_existing_atom(order)}]), false}
+        else
+          {query, false}
+        end
     end
   rescue
     ArgumentError -> {query, false}
@@ -358,6 +376,15 @@ defmodule MvWeb.MemberExportController do
   defp sort_members_by_custom_field_export(members, field, order, custom_fields)
        when is_binary(field) do
     order = order || "asc"
+
+    if field == "groups" do
+      sort_members_by_groups_export(members, order)
+    else
+      sort_by_custom_field_value(members, field, order, custom_fields)
+    end
+  end
+
+  defp sort_by_custom_field_value(members, field, order, custom_fields) do
     id_str = String.trim_leading(field, @custom_field_prefix)
 
     custom_field =
@@ -387,6 +414,26 @@ defmodule MvWeb.MemberExportController do
     end
   end
 
+  defp sort_members_by_groups_export(members, order) do
+    # Members with groups first, then by first group name alphabetically (min = first by sort order)
+    # Match table behavior from MvWeb.MemberLive.Index.sort_members_by_groups/2
+    first_group_name = fn member ->
+      (member.groups || [])
+      |> Enum.map(& &1.name)
+      |> Enum.min(fn -> nil end)
+    end
+
+    members
+    |> Enum.sort_by(fn member ->
+      name = first_group_name.(member)
+      # Nil (no groups) sorts last in asc, first in desc
+      {name == nil, name || ""}
+    end)
+    |> then(fn list ->
+      if order == "desc", do: Enum.reverse(list), else: list
+    end)
+  end
+
   defp has_non_empty_custom_field_value?(member, custom_field) do
     case find_cfv(member, custom_field) do
       nil ->
@@ -441,6 +488,19 @@ defmodule MvWeb.MemberExportController do
         }
       end)
 
+    groups_col =
+      if "groups" in parsed.member_fields do
+        [
+          %{
+            header: groups_field_header(conn),
+            kind: :groups,
+            key: :groups
+          }
+        ]
+      else
+        []
+      end
+
     custom_cols =
       parsed.custom_field_ids
       |> Enum.map(fn id ->
@@ -459,7 +519,7 @@ defmodule MvWeb.MemberExportController do
       end)
       |> Enum.reject(&is_nil/1)
 
-    member_cols ++ computed_cols ++ custom_cols
+    member_cols ++ computed_cols ++ groups_col ++ custom_cols
   end
 
   # --- headers: use MemberFields.label for translations ---
@@ -499,6 +559,10 @@ defmodule MvWeb.MemberExportController do
     cf.name
   end
 
+  defp groups_field_header(_conn) do
+    MemberFields.label(:groups)
+  end
+
   defp humanize_field(str) do
     str
     |> String.replace("_", " ")

lib/mv_web/live/global_settings_live.ex

@@ -23,6 +23,9 @@ defmodule MvWeb.GlobalSettingsLive do
   """
   use MvWeb, :live_view
 
+  require Ash.Query
+  import Ash.Expr
+
   alias Mv.Membership
 
   on_mount {MvWeb.LiveHelpers, :ensure_user_role_loaded}
@@ -41,11 +44,23 @@ defmodule MvWeb.GlobalSettingsLive do
       |> assign(:settings, settings)
       |> assign(:active_editing_section, nil)
       |> assign(:locale, locale)
+      |> assign(:vereinfacht_env_configured, Mv.Config.vereinfacht_env_configured?())
+      |> assign(:vereinfacht_api_url_env_set, Mv.Config.vereinfacht_api_url_env_set?())
+      |> assign(:vereinfacht_api_key_env_set, Mv.Config.vereinfacht_api_key_env_set?())
+      |> assign(:vereinfacht_club_id_env_set, Mv.Config.vereinfacht_club_id_env_set?())
+      |> assign(:vereinfacht_app_url_env_set, Mv.Config.vereinfacht_app_url_env_set?())
+      |> assign(:vereinfacht_api_key_set, present?(settings.vereinfacht_api_key))
+      |> assign(:last_vereinfacht_sync_result, nil)
       |> assign_form()
 
     {:ok, socket}
   end
 
+  defp present?(nil), do: false
+  defp present?(""), do: false
+  defp present?(s) when is_binary(s), do: String.trim(s) != ""
+  defp present?(_), do: false
+
   @impl true
   def render(assigns) do
     ~H"""
@@ -74,6 +89,98 @@ defmodule MvWeb.GlobalSettingsLive do
           </.button>
         </.form>
       </.form_section>
+      <%!-- Vereinfacht Integration Section --%>
+      <.form_section title={gettext("Vereinfacht Integration")}>
+        <%= if @vereinfacht_env_configured do %>
+          <p class="text-sm text-base-content/70 mb-4">
+            {gettext("Some values are set via environment variables. Those fields are read-only.")}
+          </p>
+        <% end %>
+        <.form for={@form} id="vereinfacht-form" phx-change="validate" phx-submit="save">
+          <div class="grid gap-4">
+            <.input
+              field={@form[:vereinfacht_api_url]}
+              type="text"
+              label={gettext("API URL")}
+              disabled={@vereinfacht_api_url_env_set}
+              placeholder={
+                if(@vereinfacht_api_url_env_set,
+                  do: gettext("From VEREINFACHT_API_URL"),
+                  else: "https://api.verein.visuel.dev/api/v1"
+                )
+              }
+            />
+            <div class="form-control">
+              <label class="label" for={@form[:vereinfacht_api_key].id}>
+                <span class="label-text">{gettext("API Key")}</span>
+                <%= if @vereinfacht_api_key_set do %>
+                  <span class="label-text-alt badge badge-ghost">{gettext("(set)")}</span>
+                <% end %>
+              </label>
+              <.input
+                field={@form[:vereinfacht_api_key]}
+                type="password"
+                label=""
+                disabled={@vereinfacht_api_key_env_set}
+                placeholder={
+                  if(@vereinfacht_api_key_env_set,
+                    do: gettext("From VEREINFACHT_API_KEY"),
+                    else:
+                      if(@vereinfacht_api_key_set,
+                        do: gettext("Leave blank to keep current"),
+                        else: nil
+                      )
+                  )
+                }
+              />
+            </div>
+            <.input
+              field={@form[:vereinfacht_club_id]}
+              type="text"
+              label={gettext("Club ID")}
+              disabled={@vereinfacht_club_id_env_set}
+              placeholder={
+                if(@vereinfacht_club_id_env_set, do: gettext("From VEREINFACHT_CLUB_ID"), else: "2")
+              }
+            />
+            <.input
+              field={@form[:vereinfacht_app_url]}
+              type="text"
+              label={gettext("App URL (contact view link)")}
+              disabled={@vereinfacht_app_url_env_set}
+              placeholder={
+                if(@vereinfacht_app_url_env_set,
+                  do: gettext("From VEREINFACHT_APP_URL"),
+                  else: "https://app.verein.visuel.dev"
+                )
+              }
+            />
+          </div>
+          <.button
+            :if={
+              not (@vereinfacht_api_url_env_set and @vereinfacht_api_key_env_set and
+                     @vereinfacht_club_id_env_set)
+            }
+            phx-disable-with={gettext("Saving...")}
+            variant="primary"
+            class="mt-2"
+          >
+            {gettext("Save Vereinfacht Settings")}
+          </.button>
+          <.button
+            :if={Mv.Config.vereinfacht_configured?()}
+            type="button"
+            phx-click="sync_vereinfacht_contacts"
+            phx-disable-with={gettext("Syncing...")}
+            class="mt-4 btn-outline"
+          >
+            {gettext("Sync all members without Vereinfacht contact")}
+          </.button>
+          <%= if @last_vereinfacht_sync_result do %>
+            <.vereinfacht_sync_result result={@last_vereinfacht_sync_result} />
+          <% end %>
+        </.form>
+      </.form_section>
       <%!-- Memberdata Section --%>
       <.form_section title={gettext("Memberdata")}>
         <.live_component
@@ -100,18 +207,54 @@ defmodule MvWeb.GlobalSettingsLive do
      assign(socket, form: AshPhoenix.Form.validate(socket.assigns.form, setting_params))}
   end
 
+  @impl true
+  def handle_event("sync_vereinfacht_contacts", _params, socket) do
+    case Mv.Vereinfacht.sync_members_without_contact() do
+      {:ok, %{synced: synced, errors: errors}} ->
+        errors_with_names = enrich_sync_errors(errors)
+        result = %{synced: synced, errors: errors_with_names}
+
+        socket =
+          socket
+          |> assign(:last_vereinfacht_sync_result, result)
+          |> put_flash(
+            :info,
+            if(errors_with_names == [],
+              do: gettext("Synced %{count} member(s) to Vereinfacht.", count: synced),
+              else:
+                gettext("Synced %{count} member(s). %{error_count} failed.",
+                  count: synced,
+                  error_count: length(errors_with_names)
+                )
+            )
+          )
+
+        {:noreply, socket}
+
+      {:error, :not_configured} ->
+        {:noreply,
+         put_flash(
+           socket,
+           :error,
+           gettext("Vereinfacht is not configured. Set API URL, API Key, and Club ID.")
+         )}
+    end
+  end
+
   @impl true
   def handle_event("save", %{"setting" => setting_params}, socket) do
     actor = MvWeb.LiveHelpers.current_actor(socket)
+    # Never send blank API key so we do not overwrite the stored secret (security)
+    setting_params_clean = drop_blank_vereinfacht_api_key(setting_params)
 
-    case MvWeb.LiveHelpers.submit_form(socket.assigns.form, setting_params, actor) do
+    case MvWeb.LiveHelpers.submit_form(socket.assigns.form, setting_params_clean, actor) do
       {:ok, _updated_settings} ->
-        # Reload settings from database to ensure all dependent data is updated
         {:ok, fresh_settings} = Membership.get_settings()
 
         socket =
           socket
           |> assign(:settings, fresh_settings)
+          |> assign(:vereinfacht_api_key_set, present?(fresh_settings.vereinfacht_api_key))
           |> put_flash(:info, gettext("Settings updated successfully"))
           |> assign_form()
 
@@ -122,6 +265,16 @@ defmodule MvWeb.GlobalSettingsLive do
     end
   end
 
+  defp drop_blank_vereinfacht_api_key(params) when is_map(params) do
+    case params do
+      %{"vereinfacht_api_key" => v} when v in [nil, ""] ->
+        Map.delete(params, "vereinfacht_api_key")
+
+      _ ->
+        params
+    end
+  end
+
   @impl true
   def handle_info({:custom_field_saved, _custom_field, action}, socket) do
     send_update(MvWeb.CustomFieldLive.IndexComponent,
@@ -202,9 +355,12 @@ defmodule MvWeb.GlobalSettingsLive do
   end
 
   defp assign_form(%{assigns: %{settings: settings}} = socket) do
+    # Never put API key into form/DOM to avoid secret leak in source or DevTools
+    settings_for_form = %{settings | vereinfacht_api_key: nil}
+
     form =
       AshPhoenix.Form.for_update(
-        settings,
+        settings_for_form,
         :update,
         api: Membership,
         as: "setting",
@@ -213,4 +369,74 @@ defmodule MvWeb.GlobalSettingsLive do
 
     assign(socket, form: to_form(form))
   end
+
+  defp enrich_sync_errors([]), do: []
+
+  defp enrich_sync_errors(errors) when is_list(errors) do
+    name_by_id = fetch_member_names_by_ids(Enum.map(errors, fn {id, _} -> id end))
+
+    Enum.map(errors, fn {member_id, reason} ->
+      %{
+        member_id: member_id,
+        member_name: Map.get(name_by_id, member_id) || to_string(member_id),
+        message: Mv.Vereinfacht.format_error(reason),
+        detail: extract_vereinfacht_detail(reason)
+      }
+    end)
+  end
+
+  defp fetch_member_names_by_ids(ids) do
+    actor = Mv.Helpers.SystemActor.get_system_actor()
+    opts = Mv.Helpers.ash_actor_opts(actor)
+    query = Ash.Query.filter(Mv.Membership.Member, expr(id in ^ids))
+
+    case Ash.read(query, opts) do
+      {:ok, members} ->
+        Map.new(members, fn m -> {m.id, MvWeb.Helpers.MemberHelpers.display_name(m)} end)
+
+      _ ->
+        %{}
+    end
+  end
+
+  defp extract_vereinfacht_detail({:http, _status, detail}) when is_binary(detail), do: detail
+  defp extract_vereinfacht_detail(_), do: nil
+
+  defp translate_vereinfacht_message(%{detail: detail}) when is_binary(detail) do
+    gettext("Vereinfacht: %{detail}",
+      detail: Gettext.dgettext(MvWeb.Gettext, "default", detail)
+    )
+  end
+
+  defp translate_vereinfacht_message(%{message: message}) do
+    Gettext.dgettext(MvWeb.Gettext, "default", message)
+  end
+
+  attr :result, :map, required: true
+
+  defp vereinfacht_sync_result(assigns) do
+    ~H"""
+    <div class="mt-4 p-4 rounded-lg border border-base-300 bg-base-200 space-y-2">
+      <p class="font-medium">
+        {gettext("Last sync result:")}
+        <span class="text-success-aa ml-1">{gettext("%{count} synced", count: @result.synced)}</span>
+        <%= if @result.errors != [] do %>
+          <span class="text-error-aa ml-1">
+            {gettext("%{count} failed", count: length(@result.errors))}
+          </span>
+        <% end %>
+      </p>
+      <%= if @result.errors != [] do %>
+        <p class="text-sm text-base-content/70 mt-2">{gettext("Failed members:")}</p>
+        <ul class="list-disc list-inside text-sm space-y-1 max-h-48 overflow-y-auto">
+          <%= for err <- @result.errors do %>
+            <li>
+              <span class="font-medium">{err.member_name}</span>: {translate_vereinfacht_message(err)}
+            </li>
+          <% end %>
+        </ul>
+      <% end %>
+    </div>
+    """
+  end
 end

lib/mv_web/live/group_live/show.ex

@@ -17,10 +17,12 @@ defmodule MvWeb.GroupLive.Show do
 
   require Logger
 
+  import Ash.Expr
   import MvWeb.LiveHelpers, only: [current_actor: 1]
   import MvWeb.Authorization
 
   alias Mv.Membership
+  alias MvWeb.Helpers.MemberHelpers, as: MemberHelpers
 
   @impl true
   def mount(_params, _session, socket) do
@@ -29,6 +31,7 @@ defmodule MvWeb.GroupLive.Show do
      |> assign(:show_add_member_input, false)
      |> assign(:member_search_query, "")
      |> assign(:available_members, [])
+     |> assign(:add_member_candidates, [])
      |> assign(:selected_member_ids, [])
      |> assign(:selected_members, [])
      |> assign(:show_member_dropdown, false)
@@ -94,13 +97,21 @@ defmodule MvWeb.GroupLive.Show do
         </h1>
 
         <div class="flex gap-2">
-          <%= if can?(@current_user, :update, Mv.Membership.Group) do %>
-            <.button variant="primary" navigate={~p"/groups/#{@group.slug}/edit"}>
+          <%= if can?(@current_user, :update, @group) do %>
+            <.button
+              variant="primary"
+              navigate={~p"/groups/#{@group.slug}/edit"}
+              data-testid="group-show-edit-btn"
+            >
               {gettext("Edit")}
             </.button>
           <% end %>
-          <%= if can?(@current_user, :destroy, Mv.Membership.Group) do %>
-            <.button class="btn-error" phx-click="open_delete_modal">
+          <%= if can?(@current_user, :destroy, @group) do %>
+            <.button
+              class="btn-error"
+              phx-click="open_delete_modal"
+              data-testid="group-show-delete-btn"
+            >
               {gettext("Delete")}
             </.button>
           <% end %>
@@ -123,7 +134,7 @@ defmodule MvWeb.GroupLive.Show do
         <div>
           <h2 class="text-lg font-semibold mb-2">{gettext("Members")}</h2>
           <div class="border border-base-300 rounded-lg p-4 bg-base-100">
-            <p class="mb-4">
+            <p class="mb-4" data-testid="group-show-member-count">
               {ngettext(
                 "Total: %{count} member",
                 "Total: %{count} members",
@@ -132,7 +143,7 @@ defmodule MvWeb.GroupLive.Show do
               )}
             </p>
 
-            <%= if can?(@current_user, :update, Mv.Membership.Group) do %>
+            <%= if can?(@current_user, :update, @group) do %>
               <div class="mb-4">
                 <%= if assigns[:show_add_member_input] do %>
                   <div class="join w-full">
@@ -160,6 +171,7 @@ defmodule MvWeb.GroupLive.Show do
                           <input
                             type="text"
                             id="member-search-input"
+                            data-testid="group-show-member-search-input"
                             role="combobox"
                             phx-hook="ComboBox"
                             phx-focus="show_member_dropdown"
@@ -228,6 +240,7 @@ defmodule MvWeb.GroupLive.Show do
                       type="button"
                       class="btn btn-primary join-item"
                       phx-click="add_selected_members"
+                      data-testid="group-show-add-selected-members-btn"
                       disabled={Enum.empty?(@selected_member_ids)}
                       aria-label={gettext("Add members")}
                     >
@@ -255,15 +268,17 @@ defmodule MvWeb.GroupLive.Show do
             <% end %>
 
             <%= if Enum.empty?(@group.members || []) do %>
-              <p class="text-base-content/50 italic">{gettext("No members in this group")}</p>
+              <p class="text-base-content/50 italic" data-testid="group-show-no-members">
+                {gettext("No members in this group")}
+              </p>
             <% else %>
-              <div class="overflow-x-auto">
+              <div class="overflow-x-auto" data-testid="group-show-members-table">
                 <table class="table table-zebra">
                   <thead>
                     <tr>
                       <th>{gettext("Name")}</th>
                       <th>{gettext("Email")}</th>
-                      <%= if can?(@current_user, :update, Mv.Membership.Group) do %>
+                      <%= if can?(@current_user, :update, @group) do %>
                         <th class="w-0">{gettext("Actions")}</th>
                       <% end %>
                     </tr>
@@ -291,13 +306,14 @@ defmodule MvWeb.GroupLive.Show do
                             <span class="text-base-content/50 italic">—</span>
                           <% end %>
                         </td>
-                        <%= if can?(@current_user, :update, Mv.Membership.Group) do %>
+                        <%= if can?(@current_user, :update, @group) do %>
                           <td>
                             <button
                               type="button"
                               class="btn btn-ghost btn-sm text-error"
                               phx-click="remove_member"
                               phx-value-member_id={member.id}
+                              data-testid="group-show-remove-member"
                               aria-label={gettext("Remove member from group")}
                               data-tooltip={gettext("Remove")}
                             >
@@ -431,28 +447,31 @@ defmodule MvWeb.GroupLive.Show do
   # Add Member Events
   @impl true
   def handle_event("show_add_member_input", _params, socket) do
-    # Reload group to ensure we have the latest members list
-    actor = current_actor(socket)
-    group = socket.assigns.group
-    socket = reload_group(socket, group.slug, actor)
+    # Load candidate members once (single DB read). Search/focus then filter in memory (R2).
+    socket =
+      socket
+      |> assign(:show_add_member_input, true)
+      |> assign(:member_search_query, "")
+      |> assign(:selected_member_ids, [])
+      |> assign(:selected_members, [])
+      |> assign(:show_member_dropdown, false)
+      |> assign(:focused_member_index, nil)
+      |> load_add_member_candidates()
 
-    {:noreply,
-     socket
-     |> assign(:show_add_member_input, true)
-     |> assign(:member_search_query, "")
-     |> assign(:available_members, [])
-     |> assign(:selected_member_ids, [])
-     |> assign(:selected_members, [])
-     |> assign(:show_member_dropdown, false)
-     |> assign(:focused_member_index, nil)}
+    {:noreply, socket}
   end
 
   @impl true
   def handle_event("show_member_dropdown", _params, socket) do
-    # Use existing group.members for filtering; reload only on add/remove
+    # Filter in memory from preloaded candidates; no DB read (R2).
+    query = socket.assigns.member_search_query || ""
+
     socket =
       socket
-      |> load_available_members("")
+      |> assign(
+        :available_members,
+        filter_candidates_in_memory(socket.assigns.add_member_candidates, query)
+      )
       |> assign(:show_member_dropdown, true)
       |> assign(:focused_member_index, nil)
 
@@ -466,6 +485,7 @@ defmodule MvWeb.GroupLive.Show do
      |> assign(:show_add_member_input, false)
      |> assign(:member_search_query, "")
      |> assign(:available_members, [])
+     |> assign(:add_member_candidates, [])
      |> assign(:selected_member_ids, [])
      |> assign(:selected_members, [])
      |> assign(:show_member_dropdown, false)
@@ -532,11 +552,13 @@ defmodule MvWeb.GroupLive.Show do
 
   @impl true
   def handle_event("search_members", %{"member_search" => query}, socket) do
-    # Use existing group.members for filtering; reload only on add/remove
+    # Filter in memory from preloaded candidates; no DB read (R2).
+    candidates = socket.assigns.add_member_candidates || []
+
     socket =
       socket
       |> assign(:member_search_query, query)
-      |> load_available_members(query)
+      |> assign(:available_members, filter_candidates_in_memory(candidates, query))
       |> assign(:show_member_dropdown, true)
       |> assign(:focused_member_index, nil)
 
@@ -660,47 +682,69 @@ defmodule MvWeb.GroupLive.Show do
     end
   end
 
-  defp load_available_members(socket, query) do
+  # Load candidate members once when opening add-member UI (single DB read).
+  defp load_add_member_candidates(socket) do
     require Ash.Query
 
-    current_member_ids = group_member_ids_set(socket.assigns.group)
-    base_query = available_members_base_query(query)
-
-    # Fetch more than 10, then exclude already-in-group and take 10 (avoids empty dropdown when first N are all in group)
-    fetch_limit = 50
-    limited_query = Ash.Query.limit(base_query, fetch_limit)
+    group = socket.assigns.group
+    exclude_ids = group_member_ids_set(group) |> MapSet.to_list()
     actor = current_actor(socket)
 
-    case Ash.read(limited_query, actor: actor, domain: Mv.Membership) do
-      {:ok, members} ->
-        available =
-          members
-          |> Enum.reject(fn m -> MapSet.member?(current_member_ids, m.id) end)
-          |> Enum.take(10)
+    if exclude_ids == [] do
+      # No members in group; load first N members
+      query =
+        Mv.Membership.Member
+        |> Ash.Query.sort([:last_name, :first_name])
+        |> Ash.Query.limit(300)
 
-        assign(socket, available_members: available)
+      do_load_add_member_candidates(socket, query, actor)
+    else
+      query =
+        Mv.Membership.Member
+        |> Ash.Query.filter(expr(id not in ^exclude_ids))
+        |> Ash.Query.sort([:last_name, :first_name])
+        |> Ash.Query.limit(300)
+
+      do_load_add_member_candidates(socket, query, actor)
+    end
+  end
+
+  defp do_load_add_member_candidates(socket, query, actor) do
+    case Ash.read(query, actor: actor, domain: Mv.Membership) do
+      {:ok, candidates} ->
+        socket
+        |> assign(:add_member_candidates, candidates)
+        |> assign(:available_members, Enum.take(candidates, 10))
 
       {:error, error} ->
-        Logger.warning("Failed to load available members for group: #{inspect(error)}")
+        Logger.warning("Failed to load add-member candidates: #{inspect(error)}")
 
         socket
-        |> put_flash(:error, gettext("Could not load member search. Please try again."))
+        |> put_flash(:error, gettext("Could not load member list. Please try again."))
+        |> assign(:add_member_candidates, [])
         |> assign(:available_members, [])
     end
   end
 
-  defp available_members_base_query(query) do
-    search_query = if query && String.trim(query) != "", do: String.trim(query), else: nil
+  # Filter preloaded candidates by query string (name/email). No DB read. R2.
+  defp filter_candidates_in_memory(candidates, query) when is_list(candidates) do
+    q = if is_binary(query), do: String.trim(query) |> String.downcase(), else: ""
 
-    if search_query do
-      Mv.Membership.Member
-      |> Ash.Query.for_read(:search, %{query: search_query})
+    if q == "" do
+      candidates |> Enum.take(10)
     else
-      Mv.Membership.Member
-      |> Ash.Query.new()
+      candidates
+      |> Enum.filter(fn m ->
+        name = MemberHelpers.display_name(m) |> String.downcase()
+        email = (m.email || "") |> String.downcase()
+        String.contains?(name, q) or String.contains?(email, q)
+      end)
+      |> Enum.take(10)
     end
   end
 
+  defp filter_candidates_in_memory(_, _), do: []
+
   defp group_member_ids_set(group) do
     members = group.members || []
     members |> Enum.map(& &1.id) |> MapSet.new()
@@ -740,6 +784,7 @@ defmodule MvWeb.GroupLive.Show do
      |> assign(:show_add_member_input, false)
      |> assign(:member_search_query, "")
      |> assign(:available_members, [])
+     |> assign(:add_member_candidates, [])
      |> assign(:selected_member_ids, [])
      |> assign(:selected_members, [])
      |> assign(:show_member_dropdown, false)

lib/mv_web/live/member_field_live/form_component.ex

@@ -16,8 +16,8 @@ defmodule MvWeb.MemberFieldLive.FormComponent do
   - `on_cancel` - Callback function to call when form is cancelled
 
   ## Note
-  Member fields are technical fields that cannot be changed (name, value_type, description, required).
-  Only the visibility (show_in_overview) can be modified.
+  Member fields are technical fields that cannot be changed (name, value_type).
+  Visibility (show_in_overview) and required flag are stored in Settings and can be modified.
   """
   use MvWeb, :live_component
 
@@ -27,14 +27,13 @@ defmodule MvWeb.MemberFieldLive.FormComponent do
   alias MvWeb.Helpers.FieldTypeFormatter
   alias MvWeb.Translations.MemberFields
 
-  @required_fields [:first_name, :last_name, :email]
-
   @impl true
   def render(assigns) do
     assigns =
       assigns
       |> assign(:field_attributes, get_field_attributes(assigns.member_field))
       |> assign(:is_email_field?, assigns.member_field == :email)
+      |> assign(:vereinfacht_required_field?, vereinfacht_required_field?(assigns))
       |> assign(:field_label, MemberFields.label(assigns.member_field))
 
     ~H"""
@@ -117,89 +116,64 @@ defmodule MvWeb.MemberFieldLive.FormComponent do
             </fieldset>
           </div>
 
-          <div
-            :if={@is_email_field?}
-            class="tooltip tooltip-right"
-            data-tip={gettext("This is a technical field and cannot be changed")}
-            aria-label={gettext("This is a technical field and cannot be changed")}
-          >
-            <fieldset class="mb-2 fieldset">
-              <label>
-                <span class="mb-1 label flex items-center gap-2">
-                  {gettext("Description")}
-                  <.icon
-                    name="hero-information-circle"
-                    class="w-4 h-4 text-base-content/60 cursor-help"
-                    aria-hidden="true"
-                  />
-                </span>
-                <input
-                  type="text"
-                  name={@form[:description].name}
-                  id={@form[:description].id}
-                  value={@form[:description].value}
-                  disabled
-                  readonly
-                  class="w-full input"
-                />
-              </label>
-            </fieldset>
-          </div>
-          <.input
-            :if={not @is_email_field?}
-            field={@form[:description]}
-            type="text"
-            label={gettext("Description")}
-            disabled={@is_email_field?}
-            readonly={@is_email_field?}
-          />
-
-          <div
-            :if={@is_email_field?}
-            class="tooltip tooltip-right"
-            data-tip={gettext("This is a technical field and cannot be changed")}
-            aria-label={gettext("This is a technical field and cannot be changed")}
-          >
-            <fieldset class="mb-2 fieldset">
-              <label>
-                <input type="hidden" name={@form[:required].name} value="false" disabled />
-                <span class="label flex items-center gap-2">
-                  <input
-                    type="checkbox"
-                    name={@form[:required].name}
-                    id={@form[:required].id}
-                    value="true"
-                    checked={@form[:required].value}
-                    disabled
-                    readonly
-                    class="checkbox checkbox-sm"
-                  />
-                  <span class="flex items-center gap-2">
-                    {gettext("Required")}
-                    <.icon
-                      name="hero-information-circle"
-                      class="w-4 h-4 text-base-content/60 cursor-help"
-                      aria-hidden="true"
+          <%!-- Line break before Required / Show in overview block --%>
+          <div class="mt-4">
+            <%!-- Required: disabled for email (always required) or Vereinfacht-required fields when integration is active --%>
+            <div
+              :if={@is_email_field? or @vereinfacht_required_field?}
+              class="tooltip tooltip-right"
+              data-tip={
+                if(@is_email_field?,
+                  do: gettext("This is a technical field and cannot be changed"),
+                  else: gettext("Required for Vereinfacht integration and cannot be disabled.")
+                )
+              }
+              aria-label={
+                if(@is_email_field?,
+                  do: gettext("This is a technical field and cannot be changed"),
+                  else: gettext("Required for Vereinfacht integration and cannot be disabled.")
+                )
+              }
+            >
+              <fieldset class="mb-2 fieldset">
+                <label>
+                  <input type="hidden" name={@form[:required].name} value="true" />
+                  <span class="label flex items-center gap-2">
+                    <input
+                      type="checkbox"
+                      name={@form[:required].name}
+                      id={@form[:required].id}
+                      value="true"
+                      checked={@form[:required].value}
+                      disabled
+                      readonly
+                      class="checkbox checkbox-sm"
                     />
+                    <span class="flex items-center gap-2">
+                      {gettext("Required")}
+                      <.icon
+                        name="hero-information-circle"
+                        class="w-4 h-4 text-base-content/60 cursor-help"
+                        aria-hidden="true"
+                      />
+                    </span>
                   </span>
-                </span>
-              </label>
-            </fieldset>
-          </div>
-          <.input
-            :if={not @is_email_field?}
-            field={@form[:required]}
-            type="checkbox"
-            label={gettext("Required")}
-            disabled={@is_email_field?}
-            readonly={@is_email_field?}
-          />
+                </label>
+              </fieldset>
+            </div>
+            <.input
+              :if={not @is_email_field? and not @vereinfacht_required_field?}
+              field={@form[:required]}
+              type="checkbox"
+              label={gettext("Required")}
+            />
 
-          <.input
-            field={@form[:show_in_overview]}
-            type="checkbox"
-            label={gettext("Show in overview")}
-          />
+            <.input
+              field={@form[:show_in_overview]}
+              type="checkbox"
+              label={gettext("Show in overview")}
+            />
+          </div>
 
           <div class="justify-end mt-4 card-actions">
             <.button type="button" phx-click="cancel" phx-target={@myself}>
@@ -225,24 +199,35 @@ defmodule MvWeb.MemberFieldLive.FormComponent do
 
   @impl true
   def handle_event("validate", %{"member_field" => member_field_params}, socket) do
-    # For member fields, we only validate show_in_overview
-    # Other fields are read-only or derived from the Member Resource
     form = socket.assigns.form
-
-    updated_params =
-      member_field_params
-      |> Map.put(
-        "show_in_overview",
+    # Unchecked checkboxes are not in params; preserve current form value when key is missing
+    show_in_overview =
+      if Map.has_key?(member_field_params, "show_in_overview") do
         TypeParsers.parse_boolean(member_field_params["show_in_overview"])
-      )
-      |> Map.put("name", form.source["name"])
-      |> Map.put("value_type", form.source["value_type"])
-      |> Map.put("description", form.source["description"])
-      |> Map.put("required", form.source["required"])
+      else
+        form.source["show_in_overview"]
+      end
+
+    required =
+      socket.assigns.vereinfacht_required_field? ||
+        if Map.has_key?(member_field_params, "required") do
+          TypeParsers.parse_boolean(member_field_params["required"])
+        else
+          form.source["required"]
+        end
+
+    # Merge so we keep name/value_type and have current checkbox state; use as new form source
+    merged_source =
+      form.source
+      |> Map.merge(%{
+        "show_in_overview" => show_in_overview,
+        "required" => required,
+        "name" => form.source["name"],
+        "value_type" => form.source["value_type"]
+      })
 
     updated_form =
-      form
-      |> Map.put(:value, updated_params)
+      to_form(merged_source, as: "member_field")
       |> Map.put(:errors, [])
 
     {:noreply, assign(socket, form: updated_form)}
@@ -250,23 +235,36 @@ defmodule MvWeb.MemberFieldLive.FormComponent do
 
   @impl true
   def handle_event("save", %{"member_field" => member_field_params}, socket) do
-    # Only show_in_overview can be changed for member fields
-    show_in_overview = TypeParsers.parse_boolean(member_field_params["show_in_overview"])
+    form = socket.assigns.form
+    # Unchecked checkboxes are not in submit params; use form source when key missing
+    show_in_overview =
+      if Map.has_key?(member_field_params, "show_in_overview") do
+        TypeParsers.parse_boolean(member_field_params["show_in_overview"])
+      else
+        form.source["show_in_overview"]
+      end
+
+    required =
+      socket.assigns.vereinfacht_required_field? ||
+        if Map.has_key?(member_field_params, "required") do
+          TypeParsers.parse_boolean(member_field_params["required"])
+        else
+          form.source["required"]
+        end
+
     field_string = Atom.to_string(socket.assigns.member_field)
 
-    # Use atomic action to update only this single field
-    # This prevents lost updates in concurrent scenarios
-    case Membership.update_single_member_field_visibility(
+    case Membership.update_single_member_field(
            socket.assigns.settings,
            field: field_string,
-           show_in_overview: show_in_overview
+           show_in_overview: show_in_overview,
+           required: required
          ) do
       {:ok, _updated_settings} ->
         socket.assigns.on_save.(socket.assigns.member_field, "update")
         {:noreply, socket}
 
       {:error, error} ->
-        # Add error to form
         form =
           socket.assigns.form
           |> Map.put(:errors, [
@@ -288,16 +286,29 @@ defmodule MvWeb.MemberFieldLive.FormComponent do
   defp assign_form(%{assigns: %{member_field: member_field, settings: settings}} = socket) do
     field_attributes = get_field_attributes(member_field)
     visibility_config = settings.member_field_visibility || %{}
-    normalized_config = VisibilityConfig.normalize(visibility_config)
-    show_in_overview = Map.get(normalized_config, member_field, true)
+    required_config = settings.member_field_required || %{}
+    normalized_visibility = VisibilityConfig.normalize(visibility_config)
+    normalized_required = VisibilityConfig.normalize(required_config)
+    show_in_overview = Map.get(normalized_visibility, member_field, true)
+    vereinfacht_required? = Mv.Config.vereinfacht_configured?()
+    # Persist in socket so validate/save can enforce server-side without relying on render assigns
+    socket =
+      assign(
+        socket,
+        :vereinfacht_required_field?,
+        vereinfacht_required_field?(%{member_field: member_field})
+      )
+
+    # Email always required; Vereinfacht-required fields when integration active; else from settings
+    required =
+      member_field == :email ||
+        (vereinfacht_required? && Mv.Constants.vereinfacht_required_field?(member_field)) ||
+        Map.get(normalized_required, member_field, false)
 
-    # Create a manual form structure with string keys
-    # Note: immutable is not included as it's not editable for member fields
     form_data = %{
       "name" => MemberFields.label(member_field),
       "value_type" => FieldTypeFormatter.format(field_attributes.value_type),
-      "description" => field_attributes.description || "",
-      "required" => field_attributes.required,
+      "required" => required,
       "show_in_overview" => show_in_overview
     }
 
@@ -307,24 +318,14 @@ defmodule MvWeb.MemberFieldLive.FormComponent do
   end
 
   defp get_field_attributes(field) when is_atom(field) do
-    # Get attribute info from Member Resource
     alias Ash.Resource.Info
 
     case Info.attribute(Mv.Membership.Member, field) do
       nil ->
-        # Fallback for fields not in resource (shouldn't happen with Constants)
-        %{
-          value_type: :string,
-          description: nil,
-          required: field in @required_fields
-        }
+        %{value_type: :string}
 
       attribute ->
-        %{
-          value_type: attribute.type,
-          description: nil,
-          required: not attribute.allow_nil?
-        }
+        %{value_type: attribute.type}
     end
   end
 
@@ -335,4 +336,9 @@ defmodule MvWeb.MemberFieldLive.FormComponent do
   defp format_error(error) do
     inspect(error)
   end
+
+  defp vereinfacht_required_field?(assigns) do
+    Mv.Config.vereinfacht_configured?() &&
+      Mv.Constants.vereinfacht_required_field?(assigns.member_field)
+  end
 end

lib/mv_web/live/member_field_live/index_component.ex

@@ -22,7 +22,6 @@ defmodule MvWeb.MemberFieldLive.IndexComponent do
     assigns =
       assigns
       |> assign(:member_fields, get_member_fields_with_visibility(assigns.settings))
-      |> assign(:required?, &required?/1)
 
     ~H"""
     <div id={@id}>
@@ -62,22 +61,15 @@ defmodule MvWeb.MemberFieldLive.IndexComponent do
           {format_value_type(field_data.field)}
         </:col>
 
-        <:col :let={{_field_name, field_data}} label={gettext("Description")}>
-          {field_data.description || ""}
-        </:col>
-
         <:col
           :let={{_field_name, field_data}}
           label={gettext("Required")}
           class="max-w-[9.375rem] text-center"
         >
-          <span
-            :if={@required?.(field_data.field)}
-            class="text-base-content font-semibold"
-          >
+          <span :if={field_data.required} class="text-base-content font-semibold">
             {gettext("Required")}
           </span>
-          <span :if={!@required?.(field_data.field)} class="text-base-content/70">
+          <span :if={!field_data.required} class="text-base-content/70">
             {gettext("Optional")}
           </span>
         </:col>
@@ -173,26 +165,35 @@ defmodule MvWeb.MemberFieldLive.IndexComponent do
       {:error, _} ->
         # Return a minimal struct-like map for fallback
         # This is only used for initial rendering, actual settings will be loaded properly
-        %{member_field_visibility: %{}}
+        %{member_field_visibility: %{}, member_field_required: %{}}
     end
   end
 
   defp get_member_fields_with_visibility(settings) do
     member_fields = Mv.Constants.member_fields()
     visibility_config = settings.member_field_visibility || %{}
+    required_config = settings.member_field_required || %{}
+    vereinfacht_required? = Mv.Config.vereinfacht_configured?()
 
-    # Normalize visibility config keys to atoms
-    normalized_config = VisibilityConfig.normalize(visibility_config)
+    normalized_visibility = VisibilityConfig.normalize(visibility_config)
+    normalized_required = VisibilityConfig.normalize(required_config)
 
     Enum.map(member_fields, fn field ->
-      show_in_overview = Map.get(normalized_config, field, true)
+      show_in_overview = Map.get(normalized_visibility, field, true)
+
+      # Email always required; Vereinfacht-required fields when integration active; else from settings
+      required =
+        field == :email ||
+          (vereinfacht_required? && Mv.Constants.vereinfacht_required_field?(field)) ||
+          Map.get(normalized_required, field, false)
+
       attribute = Info.attribute(Mv.Membership.Member, field)
 
       %{
         field: field,
         show_in_overview: show_in_overview,
-        value_type: (attribute && attribute.type) || :string,
-        description: nil
+        required: required,
+        value_type: (attribute && attribute.type) || :string
       }
     end)
     |> Enum.map(fn field_data ->
@@ -206,14 +207,4 @@ defmodule MvWeb.MemberFieldLive.IndexComponent do
       attribute -> FieldTypeFormatter.format(attribute.type)
     end
   end
-
-  # Check if a field is required by checking the actual attribute definition
-  defp required?(field) when is_atom(field) do
-    case Info.attribute(Mv.Membership.Member, field) do
-      nil -> false
-      attribute -> not attribute.allow_nil?
-    end
-  end
-
-  defp required?(_), do: false
 end

lib/mv_web/live/member_live/form.ex

@@ -23,6 +23,8 @@ defmodule MvWeb.MemberLive.Form do
 
   import MvWeb.LiveHelpers, only: [current_actor: 1, submit_form: 3]
 
+  alias Mv.Membership
+  alias Mv.Membership.Helpers.VisibilityConfig
   alias Mv.MembershipFees
   alias Mv.MembershipFees.MembershipFeeType
   alias MvWeb.Helpers.MembershipFeeHelpers
@@ -84,10 +86,18 @@ defmodule MvWeb.MemberLive.Form do
                 <%!-- Name Row --%>
                 <div class="flex gap-4">
                   <div class="w-48">
-                    <.input field={@form[:first_name]} label={gettext("First Name")} />
+                    <.input
+                      field={@form[:first_name]}
+                      label={gettext("First Name")}
+                      required={@member_field_required_map[:first_name]}
+                    />
                   </div>
                   <div class="w-48">
-                    <.input field={@form[:last_name]} label={gettext("Last Name")} />
+                    <.input
+                      field={@form[:last_name]}
+                      label={gettext("Last Name")}
+                      required={@member_field_required_map[:last_name]}
+                    />
                   </div>
                 </div>
 
@@ -97,7 +107,11 @@ defmodule MvWeb.MemberLive.Form do
                     <.input field={@form[:country]} label={gettext("Country")} />
                   </div>
                   <div class="w-24">
-                    <.input field={@form[:postal_code]} label={gettext("Postal Code")} />
+                    <.input
+                      field={@form[:postal_code]}
+                      label={gettext("Postal Code")}
+                      required={@member_field_required_map[:postal_code]}
+                    />
                   </div>
                   <div class="w-48">
                     <.input field={@form[:city]} label={gettext("City")} />
@@ -122,16 +136,31 @@ defmodule MvWeb.MemberLive.Form do
                 <%!-- Membership Dates Row --%>
                 <div class="flex gap-4">
                   <div class="w-36">
-                    <.input field={@form[:join_date]} label={gettext("Join Date")} type="date" />
+                    <.input
+                      field={@form[:join_date]}
+                      label={gettext("Join Date")}
+                      type="date"
+                      required={@member_field_required_map[:join_date]}
+                    />
                   </div>
                   <div class="w-36">
-                    <.input field={@form[:exit_date]} label={gettext("Exit Date")} type="date" />
+                    <.input
+                      field={@form[:exit_date]}
+                      label={gettext("Exit Date")}
+                      type="date"
+                      required={@member_field_required_map[:exit_date]}
+                    />
                   </div>
                 </div>
 
                 <%!-- Notes --%>
                 <div>
-                  <.input field={@form[:notes]} label={gettext("Notes")} type="textarea" />
+                  <.input
+                    field={@form[:notes]}
+                    label={gettext("Notes")}
+                    type="textarea"
+                    required={@member_field_required_map[:notes]}
+                  />
                 </div>
               </div>
             </.form_section>
@@ -261,6 +290,9 @@ defmodule MvWeb.MemberLive.Form do
     # Load available membership fee types
     available_fee_types = load_available_fee_types(member, actor)
 
+    # Load settings to know which member fields are required (for asterisk/tooltip)
+    member_field_required_map = get_member_field_required_map()
+
     {:ok,
      socket
      |> assign(:return_to, return_to(params["return_to"]))
@@ -270,9 +302,38 @@ defmodule MvWeb.MemberLive.Form do
      |> assign(:page_title, page_title)
      |> assign(:available_fee_types, available_fee_types)
      |> assign(:interval_warning, nil)
+     |> assign(:member_field_required_map, member_field_required_map)
      |> assign_form()}
   end
 
+  defp get_member_field_required_map do
+    vereinfacht_required? = Mv.Config.vereinfacht_configured?()
+
+    case Membership.get_settings() do
+      {:ok, settings} ->
+        required_config = settings.member_field_required || %{}
+        normalized = VisibilityConfig.normalize(required_config)
+
+        Mv.Constants.member_fields()
+        |> Enum.map(fn field ->
+          required =
+            field == :email ||
+              (vereinfacht_required? && Mv.Constants.vereinfacht_required_field?(field)) ||
+              Map.get(normalized, field, false)
+
+          {field, required}
+        end)
+        |> Map.new()
+
+      {:error, _} ->
+        # Email always required; Vereinfacht fields when integration active
+        Map.new(Mv.Constants.member_fields(), fn f ->
+          {f,
+           f == :email || (vereinfacht_required? && Mv.Constants.vereinfacht_required_field?(f))}
+        end)
+    end
+  end
+
   defp return_to("show"), do: "show"
   defp return_to(_), do: "index"
 
@@ -326,11 +387,40 @@ defmodule MvWeb.MemberLive.Form do
     socket =
       socket
       |> put_flash(:info, flash_message)
+      |> maybe_put_vereinfacht_sync_flash(member.id)
       |> push_navigate(to: return_path(socket.assigns.return_to, member))
 
     {:noreply, socket}
   end
 
+  defp maybe_put_vereinfacht_sync_flash(socket, member_id) do
+    case Mv.Vereinfacht.SyncFlash.take(to_string(member_id)) do
+      {:warning, message} ->
+        put_flash(socket, :warning, translate_vereinfacht_flash(message))
+
+      {:ok, _message} ->
+        # Optionally show sync success; for now we keep only the main success message
+        socket
+
+      nil ->
+        socket
+    end
+  end
+
+  defp translate_vereinfacht_flash(message) when is_binary(message) do
+    prefix = "Vereinfacht: "
+
+    if String.starts_with?(message, prefix) do
+      detail = message |> String.trim_leading(prefix) |> String.trim()
+
+      Gettext.dgettext(MvWeb.Gettext, "default", "Vereinfacht: %{detail}",
+        detail: Gettext.dgettext(MvWeb.Gettext, "default", detail)
+      )
+    else
+      Gettext.dgettext(MvWeb.Gettext, "default", message)
+    end
+  end
+
   defp handle_save_error(socket, form) do
     # Always show a flash message when save fails
     # Field-level validation errors are displayed in form fields, but flash provides additional feedback

lib/mv_web/live/member_live/index.ex

@@ -682,6 +682,19 @@ defmodule MvWeb.MemberLive.Index do
         |> update_selection_assigns()
       end
 
+    # Update sort components after rendering
+    socket =
+      if socket.assigns[:sort_needs_update] do
+        old_field = socket.assigns[:previous_sort_field] || socket.assigns.sort_field
+
+        socket
+        |> update_sort_components(old_field, socket.assigns.sort_field, socket.assigns.sort_order)
+        |> assign(:sort_needs_update, false)
+        |> assign(:previous_sort_field, nil)
+      else
+        socket
+      end
+
     {:noreply, socket}
   end
 
@@ -940,9 +953,10 @@ defmodule MvWeb.MemberLive.Index do
       )
 
     # Sort in memory if needed (custom fields, groups, group_count; computed fields are blocked)
+    # Note: :groups is in computed_member_fields() but can be sorted in-memory, so we only block :membership_fee_status
     members =
       if sort_after_load and
-           socket.assigns.sort_field not in FieldVisibility.computed_member_fields() do
+           socket.assigns.sort_field != :membership_fee_status do
         sort_members_in_memory(
           members,
           socket.assigns.sort_field,
@@ -1044,21 +1058,15 @@ defmodule MvWeb.MemberLive.Index do
   defp maybe_sort(query, _field, nil, _custom_fields), do: {query, false}
 
   defp maybe_sort(query, field, order, _custom_fields) do
-    if computed_field?(field) do
+    # :groups is in computed_member_fields() but can be sorted in-memory
+    # Only :membership_fee_status should be blocked from sorting
+    if field == :membership_fee_status or field == "membership_fee_status" do
       {query, false}
     else
       apply_sort_to_query(query, field, order)
     end
   end
 
-  defp computed_field?(field) do
-    computed_atoms = FieldVisibility.computed_member_fields()
-    computed_strings = Enum.map(computed_atoms, &Atom.to_string/1)
-
-    (is_atom(field) and field in computed_atoms) or
-      (is_binary(field) and field in computed_strings)
-  end
-
   defp apply_sort_to_query(query, field, order) do
     cond do
       # Groups sort -> after load (in memory)
@@ -1086,13 +1094,19 @@ defmodule MvWeb.MemberLive.Index do
   end
 
   defp valid_sort_field?(field) when is_atom(field) do
-    if field in FieldVisibility.computed_member_fields(),
-      do: false,
-      else: valid_sort_field_db_or_custom?(field)
+    # :groups is in computed_member_fields() but can be sorted
+    # Only :membership_fee_status should be blocked
+    if field == :membership_fee_status do
+      false
+    else
+      valid_sort_field_db_or_custom?(field)
+    end
   end
 
   defp valid_sort_field?(field) when is_binary(field) do
-    if field in Enum.map(FieldVisibility.computed_member_fields(), &Atom.to_string/1) do
+    # "groups" is in computed_member_fields() but can be sorted
+    # Only "membership_fee_status" should be blocked
+    if field == "membership_fee_status" do
       false
     else
       valid_sort_field_db_or_custom?(field)
@@ -1249,10 +1263,13 @@ defmodule MvWeb.MemberLive.Index do
   defp maybe_update_sort(socket, %{"sort_field" => sf, "sort_order" => so}) do
     field = determine_field(socket.assigns.sort_field, sf)
     order = determine_order(socket.assigns.sort_order, so)
+    old_field = socket.assigns.sort_field
 
     socket
     |> assign(:sort_field, field)
     |> assign(:sort_order, order)
+    |> assign(:sort_needs_update, old_field != field or socket.assigns.sort_order != order)
+    |> assign(:previous_sort_field, old_field)
   end
 
   defp maybe_update_sort(socket, _), do: socket
@@ -1261,17 +1278,27 @@ defmodule MvWeb.MemberLive.Index do
   defp determine_field(default, nil), do: default
 
   defp determine_field(default, sf) when is_binary(sf) do
-    computed_strings = Enum.map(FieldVisibility.computed_member_fields(), &Atom.to_string/1)
+    # Handle "groups" specially - it's in computed_member_fields() but can be sorted
+    if sf == "groups" do
+      :groups
+    else
+      computed_strings = Enum.map(FieldVisibility.computed_member_fields(), &Atom.to_string/1)
 
-    if sf in computed_strings,
-      do: default,
-      else: determine_field_after_computed_check(default, sf)
+      if sf in computed_strings,
+        do: default,
+        else: determine_field_after_computed_check(default, sf)
+    end
   end
 
   defp determine_field(default, sf) when is_atom(sf) do
-    if sf in FieldVisibility.computed_member_fields(),
-      do: default,
-      else: determine_field_after_computed_check(default, sf)
+    # Handle :groups specially - it's in computed_member_fields() but can be sorted
+    if sf == :groups do
+      :groups
+    else
+      if sf in FieldVisibility.computed_member_fields(),
+        do: default,
+        else: determine_field_after_computed_check(default, sf)
+    end
   end
 
   defp determine_field(default, _), do: default
@@ -1620,6 +1647,14 @@ defmodule MvWeb.MemberLive.Index do
       FieldVisibility.computed_member_fields()
       |> Enum.filter(&(&1 in member_fields_computed))
 
+    # Include groups in export only if it's visible in the table
+    member_fields_with_groups =
+      if :groups in socket.assigns[:member_fields_visible] do
+        ordered_member_fields_db ++ ["groups"]
+      else
+        ordered_member_fields_db
+      end
+
     # Order custom fields like the table (same as dynamic_cols / all_custom_fields order)
     ordered_custom_field_ids =
       socket.assigns.all_custom_fields
@@ -1628,7 +1663,11 @@ defmodule MvWeb.MemberLive.Index do
 
     %{
       selected_ids: socket.assigns.selected_members |> MapSet.to_list(),
-      member_fields: Enum.map(ordered_member_fields_db, &Atom.to_string/1),
+      member_fields:
+        Enum.map(member_fields_with_groups, fn
+          f when is_atom(f) -> Atom.to_string(f)
+          f when is_binary(f) -> f
+        end),
       computed_fields: Enum.map(ordered_computed_fields, &Atom.to_string/1),
       custom_field_ids: ordered_custom_field_ids,
       column_order:

lib/mv_web/live/member_live/index.html.heex

@@ -349,6 +349,7 @@
     </:col>
     <:col
       :let={member}
+      :if={:groups in @member_fields_visible}
       label={
         ~H"""
         <.live_component

lib/mv_web/live/member_live/index/field_visibility.ex

@@ -28,7 +28,8 @@ defmodule MvWeb.MemberLive.Index.FieldVisibility do
   alias Mv.Membership.Helpers.VisibilityConfig
 
   # Single UI key for "Membership Fee Status"; only this appears in the dropdown.
-  @pseudo_member_fields [:membership_fee_status]
+  # Groups is also a pseudo field (not a DB attribute, but displayed in the table).
+  @pseudo_member_fields [:membership_fee_status, :groups]
 
   # Export/API may accept this as alias; must not appear in the UI options list.
   @export_only_alias :payment_status
@@ -201,7 +202,7 @@ defmodule MvWeb.MemberLive.Index.FieldVisibility do
   """
   @spec get_visible_member_fields_computed(%{String.t() => boolean()}) :: [atom()]
   def get_visible_member_fields_computed(field_selection) when is_map(field_selection) do
-    computed_set = MapSet.new(@pseudo_member_fields)
+    computed_set = MapSet.new([:membership_fee_status])
 
     field_selection
     |> Enum.filter(fn {field_string, visible} ->

lib/mv_web/live/member_live/show.ex

@@ -256,6 +256,7 @@ defmodule MvWeb.MemberLive.Show do
           id={"membership-fees-#{@member.id}"}
           member={@member}
           current_user={@current_user}
+          vereinfacht_receipts={@vereinfacht_receipts}
         />
       <% end %>
     </Layouts.app>
@@ -264,7 +265,10 @@ defmodule MvWeb.MemberLive.Show do
 
   @impl true
   def mount(_params, _session, socket) do
-    {:ok, assign(socket, :active_tab, :contact)}
+    {:ok,
+     socket
+     |> assign(:active_tab, :contact)
+     |> assign(:vereinfacht_receipts, nil)}
   end
 
   @impl true
@@ -316,6 +320,16 @@ defmodule MvWeb.MemberLive.Show do
     {:noreply, assign(socket, :active_tab, :membership_fees)}
   end
 
+  def handle_event("load_vereinfacht_receipts", %{"contact_id" => contact_id}, socket) do
+    response =
+      case Mv.Vereinfacht.Client.get_contact_with_receipts(contact_id) do
+        {:ok, receipts} -> {:ok, receipts}
+        {:error, reason} -> {:error, reason}
+      end
+
+    {:noreply, assign(socket, :vereinfacht_receipts, response)}
+  end
+
   # Flash set in LiveComponent is not shown in parent layout; child sends this to display flash
   @impl true
   def handle_info({:put_flash, type, message}, socket) do

lib/mv_web/live/member_live/show/membership_fees_component.ex

@@ -50,6 +50,90 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
           <% end %>
         </div>
 
+        <%!-- Vereinfacht: contact info when synced, or warning when API is configured but no contact --%>
+        <%= if Mv.Config.vereinfacht_configured?() do %>
+          <%= if @vereinfacht_contact_present do %>
+            <div class="mb-4">
+              <div class="flex flex-col gap-2">
+                <.link
+                  :if={Mv.Config.vereinfacht_contact_view_url(@member.vereinfacht_contact_id)}
+                  href={Mv.Config.vereinfacht_contact_view_url(@member.vereinfacht_contact_id)}
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  class="link link-accent underline inline-flex items-center gap-1 w-fit"
+                >
+                  {gettext("View contact in Vereinfacht")}
+                  <.icon name="hero-arrow-top-right-on-square" class="inline-block size-4" />
+                </.link>
+                <div>
+                  <button
+                    type="button"
+                    phx-click="load_vereinfacht_receipts"
+                    phx-value-contact_id={@member.vereinfacht_contact_id}
+                    class="btn btn-sm btn-ghost"
+                  >
+                    {gettext("Show bookings/receipts from Vereinfacht")}
+                  </button>
+                </div>
+                <%= if @vereinfacht_receipts do %>
+                  <div
+                    class="mt-2 rounded border border-base-300 bg-base-200 p-3 overflow-x-auto max-h-96 overflow-y-auto"
+                    tabindex="0"
+                    role="region"
+                    aria-label={gettext("Vereinfacht receipts")}
+                  >
+                    <%= if match?({:ok, _}, @vereinfacht_receipts) do %>
+                      <% {_, receipts} = @vereinfacht_receipts %>
+                      <%= if receipts == [] do %>
+                        <p class="text-sm text-base-content/70">{gettext("No receipts")}</p>
+                      <% else %>
+                        <% cols = receipt_display_columns(receipts) %>
+                        <table class="table table-xs table-pin-rows">
+                          <thead>
+                            <tr>
+                              <%= for {_key, translated_label} <- cols do %>
+                                <th>{translated_label}</th>
+                              <% end %>
+                            </tr>
+                          </thead>
+                          <tbody>
+                            <%= for r <- receipts do %>
+                              <tr>
+                                <%= for {col_key, _header_key} <- cols do %>
+                                  <td>{format_receipt_cell(col_key, r[col_key])}</td>
+                                <% end %>
+                              </tr>
+                            <% end %>
+                          </tbody>
+                        </table>
+                      <% end %>
+                    <% else %>
+                      <% {:error, reason} = @vereinfacht_receipts %>
+                      <p class="text-sm text-error">
+                        {gettext("Error loading receipts: %{reason}",
+                          reason: format_vereinfacht_error(reason)
+                        )}
+                      </p>
+                    <% end %>
+                  </div>
+                <% end %>
+              </div>
+            </div>
+          <% else %>
+            <div class="mb-4 rounded-lg border border-warning/50 bg-warning/10 p-3">
+              <p class="text-warning font-medium flex items-center gap-2">
+                <.icon name="hero-exclamation-triangle" class="size-5 shrink-0" />
+                {gettext("No Vereinfacht contact exists for this member.")}
+              </p>
+              <p class="text-sm text-base-content/70 mt-1">
+                {gettext(
+                  "Sync this member from Settings (Vereinfacht section) or save the member again to create the contact."
+                )}
+              </p>
+            </div>
+          <% end %>
+        <% end %>
+
         <%!-- Action Buttons (only when user has permission) --%>
         <div class="flex gap-2 mb-4">
           <.button
@@ -431,6 +515,7 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
      |> assign(:can_create_cycle, can_create_cycle)
      |> assign(:can_destroy_cycle, can_destroy_cycle)
      |> assign(:can_update_cycle, can_update_cycle)
+     |> assign(:vereinfacht_contact_present, present_contact_id?(member.vereinfacht_contact_id))
      |> assign_new(:interval_warning, fn -> nil end)
      |> assign_new(:editing_cycle, fn -> nil end)
      |> assign_new(:deleting_cycle, fn -> nil end)
@@ -439,7 +524,8 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
      |> assign_new(:creating_cycle, fn -> false end)
      |> assign_new(:create_cycle_date, fn -> nil end)
      |> assign_new(:create_cycle_error, fn -> nil end)
-     |> assign_new(:regenerating, fn -> false end)}
+     |> assign_new(:regenerating, fn -> false end)
+     |> assign_new(:vereinfacht_receipts, fn -> nil end)}
   end
 
   @impl true
@@ -997,6 +1083,142 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
 
   defp format_create_cycle_period(_date, _interval), do: ""
 
+  defp present_contact_id?(nil), do: false
+  defp present_contact_id?(id) when is_binary(id), do: String.trim(id) != ""
+  defp present_contact_id?(_), do: false
+
+  defp format_vereinfacht_error({:http, status, detail}) when is_binary(detail),
+    do: "HTTP #{status} – #{detail}"
+
+  defp format_vereinfacht_error({:http, status, _}), do: "HTTP #{status}"
+  defp format_vereinfacht_error(reason), do: inspect(reason)
+
+  # Ordered receipt columns: {api_key, gettext key for header}. Only columns present in data are shown.
+  @receipt_column_spec [
+    {:amount, "Amount"},
+    {:bookingDate, "Booking date"},
+    {:createdAt, "Created at"},
+    {:receiptType, "Receipt type"},
+    {:referenceNumber, "Reference number"},
+    {:status, "Status"},
+    {:updatedAt, "Updated at"}
+  ]
+
+  defp receipt_display_columns(receipts) when is_list(receipts) do
+    keys_in_data = receipts |> Enum.flat_map(&Map.keys/1) |> MapSet.new()
+
+    Enum.filter(@receipt_column_spec, fn {key, _} -> MapSet.member?(keys_in_data, key) end)
+    |> Enum.map(fn {key, msgid} -> {key, Gettext.gettext(MvWeb.Gettext, msgid)} end)
+  end
+
+  defp format_receipt_cell(:amount, nil), do: "—"
+
+  defp format_receipt_cell(:amount, val) when is_number(val) do
+    case Decimal.cast(val) do
+      {:ok, d} -> MembershipFeeHelpers.format_currency(d)
+      _ -> to_string(val)
+    end
+  end
+
+  defp format_receipt_cell(:amount, val) when is_binary(val) do
+    case Decimal.parse(val) do
+      {d, _} -> MembershipFeeHelpers.format_currency(d)
+      :error -> val
+    end
+  end
+
+  defp format_receipt_cell(:amount, val), do: to_string(val)
+
+  defp format_receipt_cell(:status, nil), do: "—"
+
+  defp format_receipt_cell(:status, val) when is_binary(val) do
+    translate_receipt_status(val)
+  end
+
+  defp format_receipt_cell(:status, val), do: translate_receipt_status(to_string(val))
+
+  defp format_receipt_cell(:receiptType, nil), do: "—"
+
+  defp format_receipt_cell(:receiptType, val) when is_binary(val) do
+    translate_receipt_type(val)
+  end
+
+  defp format_receipt_cell(:receiptType, val), do: translate_receipt_type(to_string(val))
+
+  defp format_receipt_cell(col_key, nil) when col_key in [:bookingDate, :createdAt, :updatedAt],
+    do: "—"
+
+  defp format_receipt_cell(col_key, val) when col_key in [:bookingDate, :createdAt, :updatedAt] do
+    format_receipt_date(val)
+  end
+
+  defp format_receipt_cell(_col_key, val) when is_binary(val), do: val
+  defp format_receipt_cell(_col_key, val) when is_number(val), do: to_string(val)
+
+  defp format_receipt_cell(_col_key, val) when is_boolean(val),
+    do: if(val, do: gettext("Yes"), else: gettext("No"))
+
+  defp format_receipt_cell(_col_key, %Date{} = d), do: format_receipt_date_short(d)
+  defp format_receipt_cell(_col_key, val) when is_map(val) or is_list(val), do: Jason.encode!(val)
+  defp format_receipt_cell(_col_key, val), do: to_string(val)
+
+  defp format_receipt_date(%Date{} = d), do: format_receipt_date_short(d)
+
+  defp format_receipt_date(val) when is_binary(val) do
+    case parse_receipt_date(val) do
+      {:ok, d} -> format_receipt_date_short(d)
+      _ -> val
+    end
+  end
+
+  defp format_receipt_date(val), do: to_string(val)
+
+  # Parses ISO date or datetime string to Date (uses first 10 chars for datetime strings)
+  defp parse_receipt_date(val) when is_binary(val) do
+    date_str = if String.length(val) >= 10, do: String.slice(val, 0, 10), else: val
+    Date.from_iso8601(date_str)
+  end
+
+  # Format as "12. Dez. 2025" (day. abbreviated month. year) with translated month
+  defp format_receipt_date_short(%Date{day: day, month: month, year: year}) do
+    "#{day}. #{receipt_month_abbr(month)} #{year}"
+  end
+
+  defp receipt_month_abbr(1), do: gettext("Jan.")
+  defp receipt_month_abbr(2), do: gettext("Feb.")
+  defp receipt_month_abbr(3), do: gettext("Mar.")
+  defp receipt_month_abbr(4), do: gettext("Apr.")
+  defp receipt_month_abbr(5), do: gettext("May")
+  defp receipt_month_abbr(6), do: gettext("Jun.")
+  defp receipt_month_abbr(7), do: gettext("Jul.")
+  defp receipt_month_abbr(8), do: gettext("Aug.")
+  defp receipt_month_abbr(9), do: gettext("Sep.")
+  defp receipt_month_abbr(10), do: gettext("Oct.")
+  defp receipt_month_abbr(11), do: gettext("Nov.")
+  defp receipt_month_abbr(12), do: gettext("Dec.")
+  defp receipt_month_abbr(_), do: ""
+
+  # Translate API status values for display (extend as API returns more values)
+  defp translate_receipt_status("paid"), do: gettext("Paid")
+  defp translate_receipt_status("unpaid"), do: gettext("Unpaid")
+  defp translate_receipt_status("suspended"), do: gettext("Suspended")
+  defp translate_receipt_status("open"), do: gettext("Open")
+  defp translate_receipt_status("cancelled"), do: gettext("Cancelled")
+  defp translate_receipt_status("draft"), do: gettext("Draft")
+  defp translate_receipt_status("incompleted"), do: gettext("Incompleted")
+  defp translate_receipt_status("completed"), do: gettext("Completed")
+  defp translate_receipt_status("empty"), do: "—"
+  defp translate_receipt_status(other), do: other
+
+  # Translate API receipt type values (extend as API returns more values)
+  defp translate_receipt_type("invoice"), do: gettext("Invoice")
+  defp translate_receipt_type("receipt"), do: gettext("Receipt")
+  defp translate_receipt_type("credit_note"), do: gettext("Credit note")
+  defp translate_receipt_type("credit"), do: gettext("Credit")
+  defp translate_receipt_type("expense"), do: gettext("Expense")
+  defp translate_receipt_type("income"), do: gettext("Income")
+  defp translate_receipt_type(other), do: other
+
   # Helper component for section box
   attr :title, :string, required: true
   slot :inner_block, required: true

lib/mv_web/translations/member_fields.ex

@@ -30,6 +30,7 @@ defmodule MvWeb.Translations.MemberFields do
   def label(:country), do: gettext("Country")
   def label(:membership_fee_start_date), do: gettext("Membership Fee Start Date")
   def label(:membership_fee_status), do: gettext("Membership Fee Status")
+  def label(:groups), do: gettext("Groups")
 
   # Fallback for unknown fields
   def label(field) do