Initial commit - Project start (July 17, 2025)

Original: feat: enhance security logging and ensure rate limit blocks are properly tracked

- Add comprehensive logging for rate limit blocks with full request details
  - IP address (with proper proxy detection), user agent, headers, timestamps
  - Rate limit info (current count, limit, remaining, reset time)
  - Separate tracking for auth vs general endpoints

- Enhance authentication failure logging
  - JWT validation failures with detailed error info
  - Admin auth attempts without token
  - Failed token validation with user context
  - All events include IP, path, method, user agent

- Improve Winston logger configuration for production
  - Add automatic log rotation (10MB errors, 50MB combined)
  - Create separate security.log for auth/rate limit events
  - Ensure logs directory exists automatically
  - Add structured JSON format for log aggregation
  - Support container logging with LOG_TO_CONSOLE env var

- Create comprehensive documentation
  - Security logging guide with examples
  - Monitoring recommendations
  - Configuration reference

- Add test script to verify logging functionality

All rate limit settings remain configurable via admin panel:
- Window duration, max requests, auth limits
- Skip authenticated requests option
- Public endpoints only option

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

backend/.dockerignore

@@ -0,0 +1,14 @@
+node_modules
+npm-debug.log
+.env
+storage/events/active/*
+storage/events/archived/*
+storage/thumbnails/*
+data/*.db
+logs/*
+coverage
+.git
+.gitignore
+README.md
+.eslintrc.js
+jest.config.js

backend/.env.example

@@ -0,0 +1,41 @@
+# Backend Environment Variables Example
+# Copy this file to .env and update with your values
+
+# Application
+NODE_ENV=production
+PORT=3000
+
+# Security
+JWT_SECRET=your-very-secure-jwt-secret-at-least-32-characters-long
+
+# URLs
+ADMIN_URL=https://yourdomain.com
+FRONTEND_URL=https://yourdomain.com
+
+# Database Configuration
+DATABASE_CLIENT=pg
+DB_HOST=db
+DB_PORT=5432
+DB_USER=picpeak
+DB_PASSWORD=your-secure-database-password
+DB_NAME=picpeak
+
+# Email Configuration
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=your-smtp-username
+SMTP_PASS=your-smtp-password
+EMAIL_FROM=[email protected]
+
+# Storage Paths (Docker)
+STORAGE_PATH=/app/storage
+EVENTS_PATH=/app/storage/events
+ARCHIVE_PATH=/app/storage/events/archived
+
+# Analytics (Optional)
+UMAMI_URL=https://analytics.yourdomain.com
+UMAMI_WEBSITE_ID=your-website-id
+
+# Logging
+LOG_LEVEL=info

backend/.eslintrc.js

@@ -0,0 +1,23 @@
+module.exports = {
+  env: {
+    browser: false,
+    es2021: true,
+    node: true,
+    jest: true
+  },
+  extends: [
+    'eslint:recommended'
+  ],
+  parserOptions: {
+    ecmaVersion: 'latest',
+    sourceType: 'module'
+  },
+  rules: {
+    'indent': ['error', 2],
+    'linebreak-style': ['error', 'unix'],
+    'quotes': ['error', 'single'],
+    'semi': ['error', 'always'],
+    'no-unused-vars': ['error', { 'argsIgnorePattern': '^_' }],
+    'no-console': ['warn', { allow: ['warn', 'error'] }]
+  }
+};

backend/Dockerfile

@@ -0,0 +1,44 @@
+FROM node:18-alpine AS builder
+
+# Add build argument for cache busting
+ARG CACHEBUST=1
+
+WORKDIR /app
+
+# Copy package files
+COPY package*.json ./
+
+# Install dependencies
+RUN npm ci --only=production
+
+# Copy application files
+COPY . .
+
+# Production stage
+FROM node:18-alpine
+
+WORKDIR /app
+
+# Install dumb-init for proper signal handling and postgresql-client for database checks
+RUN apk add --no-cache dumb-init postgresql-client
+
+# Create non-root user
+RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
+
+# Copy from builder
+COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
+COPY --chown=nodejs:nodejs . .
+
+# Make wait script executable
+RUN chmod +x wait-for-db.sh
+
+# Create necessary directories
+RUN mkdir -p storage/events/active storage/events/archived storage/thumbnails data logs && \
+    chown -R nodejs:nodejs storage data logs
+
+USER nodejs
+
+EXPOSE 3000
+
+ENTRYPOINT ["dumb-init", "--"]
+CMD ["./wait-for-db.sh", "node", "server.js"]

backend/Dockerfile.dev

@@ -0,0 +1,29 @@
+FROM node:18-alpine
+
+WORKDIR /app
+
+# Install dumb-init for proper signal handling
+RUN apk add --no-cache dumb-init
+
+# Copy package files
+COPY package*.json ./
+
+# Install all dependencies (including dev)
+RUN npm install
+
+# Copy application files
+COPY . .
+
+# Create necessary directories
+RUN mkdir -p storage/events/active storage/events/archived storage/thumbnails data logs
+
+# Create non-root user
+RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
+RUN chown -R nodejs:nodejs /app
+
+USER nodejs
+
+EXPOSE 3000
+
+ENTRYPOINT ["dumb-init", "--"]
+CMD ["npm", "run", "dev"]

backend/audit-backend.json

@@ -0,0 +1,22 @@
+{
+  "auditReportVersion": 2,
+  "vulnerabilities": {},
+  "metadata": {
+    "vulnerabilities": {
+      "info": 0,
+      "low": 0,
+      "moderate": 0,
+      "high": 0,
+      "critical": 0,
+      "total": 0
+    },
+    "dependencies": {
+      "prod": 329,
+      "dev": 307,
+      "optional": 54,
+      "peer": 1,
+      "peerOptional": 0,
+      "total": 690
+    }
+  }
+}

backend/docs/SECURITY_LOGGING.md

@@ -0,0 +1,161 @@
+# Security Logging Documentation
+
+## Overview
+This document describes the comprehensive security logging implemented in the PicPeak application to track authentication failures, rate limiting, and suspicious activities.
+
+## Log Files
+
+### 1. **security.log**
+- Location: `logs/security.log`
+- Contains: All security-related events (authentication, rate limiting, suspicious activity)
+- Max Size: 20MB with rotation (keeps 10 files)
+- Format: JSON with timestamp
+
+### 2. **error.log**
+- Location: `logs/error.log`
+- Contains: All error-level logs including auth failures
+- Max Size: 10MB with rotation (keeps 5 files)
+
+### 3. **combined.log**
+- Location: `logs/combined.log`
+- Contains: All logs (info, warn, error)
+- Max Size: 50MB with rotation (keeps 10 files)
+
+## Security Events Logged
+
+### Rate Limiting
+When rate limits are exceeded, the following is logged:
+```json
+{
+  "timestamp": "2024-01-18 14:23:45.123",
+  "level": "warn",
+  "message": "Rate limit exceeded",
+  "security": true,
+  "ip": "192.168.1.1",
+  "path": "/api/admin/login",
+  "method": "POST",
+  "authenticated": false,
+  "userAgent": "Mozilla/5.0...",
+  "referer": "https://app.example.com",
+  "origin": "https://app.example.com",
+  "headers": {
+    "x-forwarded-for": "192.168.1.1",
+    "x-real-ip": "192.168.1.1"
+  },
+  "requestUrl": "/api/admin/login",
+  "rateLimitInfo": {
+    "limit": 5,
+    "current": 6,
+    "remaining": 0,
+    "resetTime": "2024-01-18T14:38:45.123Z"
+  }
+}
+```
+
+### Authentication Failures
+
+#### Admin Login Failures
+- Tracked in `login_attempts` table
+- Logged with: IP address, username, user agent, timestamp
+- Account lockout after 5 failures in 15 minutes
+
+#### Gallery Password Failures
+- Tracked in `access_logs` table with action='login_fail'
+- Logged with: event_id, IP address, user agent
+- Gallery lockout after 5 failures in 15 minutes
+
+### JWT Validation Failures
+```json
+{
+  "timestamp": "2024-01-18 14:23:45.123",
+  "level": "warn",
+  "message": "JWT validation failed",
+  "ip": "192.168.1.1",
+  "path": "/api/admin/events",
+  "method": "GET",
+  "userAgent": "Mozilla/5.0...",
+  "error": "TokenExpiredError",
+  "message": "jwt expired"
+}
+```
+
+### Suspicious Activity
+- Multiple IPs attempting login for same account
+- Token usage from different IP than issued
+- Token usage after password change
+- Revoked token usage attempts
+
+## Configuration Settings
+
+All rate limiting settings are configurable via the admin panel:
+
+| Setting | Default | Range | Description |
+|---------|---------|-------|-------------|
+| rate_limit_enabled | true | - | Enable/disable rate limiting |
+| rate_limit_window_minutes | 15 | 1-60 | Time window for rate limit |
+| rate_limit_max_requests | 1000 | 10-10000 | Max requests for general endpoints |
+| rate_limit_auth_max_requests | 5 | 1-100 | Max requests for auth endpoints |
+| rate_limit_skip_authenticated | true | - | Skip rate limit for authenticated requests |
+| rate_limit_public_endpoints_only | false | - | Only rate limit public endpoints |
+
+## Database Tables
+
+### login_attempts
+```sql
+- id
+- username
+- ip_address
+- user_agent
+- success (boolean)
+- created_at
+```
+
+### access_logs
+```sql
+- id
+- event_id
+- ip_address
+- user_agent
+- action ('view', 'download', 'login_success', 'login_fail')
+- photo_id (nullable)
+- created_at
+```
+
+## Environment Variables
+
+- `LOG_LEVEL`: Set logging level (default: 'info')
+- `LOG_TO_CONSOLE`: Enable console logging in production (default: false)
+
+## Monitoring Recommendations
+
+1. **Set up alerts for:**
+   - Rate limit exceeded events (possible DDoS)
+   - Multiple failed login attempts from same IP
+   - Account lockout events
+   - JWT validation failures spike
+
+2. **Regular review:**
+   - Check security.log for patterns
+   - Review login_attempts table for brute force attempts
+   - Monitor access_logs for suspicious gallery access patterns
+
+3. **Log analysis tools:**
+   - Use log aggregation tools (ELK stack, Splunk)
+   - Set up dashboards for security metrics
+   - Configure alerts for threshold breaches
+
+## Production Deployment Notes
+
+1. Ensure logs directory has proper permissions
+2. Set up log rotation outside of application if needed
+3. Consider shipping logs to centralized logging service
+4. Monitor disk space for log files
+5. Set `LOG_TO_CONSOLE=true` for container deployments
+
+## Security Best Practices
+
+1. Never log sensitive data (passwords, tokens)
+2. Use generic error messages to prevent user enumeration
+3. Clean up old login attempts regularly (7 days retention)
+4. Monitor for unusual patterns in real-time
+5. Keep rate limit settings appropriate for your usage

backend/ecosystem.config.js

@@ -0,0 +1,21 @@
+module.exports = {
+  apps: [{
+    name: 'picpeak',
+    script: './server.js',
+    instances: 'max',
+    exec_mode: 'cluster',
+    env: {
+      NODE_ENV: 'production',
+      PORT: 3000
+    },
+    error_file: './logs/pm2-error.log',
+    out_file: './logs/pm2-out.log',
+    log_date_format: 'YYYY-MM-DD HH:mm:ss',
+    max_memory_restart: '1G',
+    watch: false,
+    ignore_watch: ['node_modules', 'logs', 'storage'],
+    wait_ready: true,
+    listen_timeout: 3000,
+    kill_timeout: 5000
+  }]
+};

backend/init-production.sh

@@ -0,0 +1,50 @@
+#!/bin/sh
+# init-production.sh - Production initialization script
+
+set -e
+
+echo "🚀 Initializing PicPeak Production Environment..."
+
+# Wait for services to be ready
+echo "⏳ Waiting for database to be fully ready..."
+sleep 3
+
+# Fix permissions if running as root (shouldn't happen with proper Dockerfile)
+if [ "$(id -u)" = "0" ]; then
+    echo "🔧 Fixing file permissions..."
+    chown -R nodejs:nodejs /app/storage /app/data /app/logs 2>/dev/null || true
+fi
+
+# Create required directories
+echo "📁 Creating required directories..."
+mkdir -p /app/storage/events/active \
+         /app/storage/events/archived \
+         /app/storage/thumbnails \
+         /app/storage/uploads/logos \
+         /app/storage/uploads/favicons \
+         /app/data \
+         /app/logs
+
+# Run migrations with safe runner
+echo "🗄️ Running database migrations (safe mode)..."
+NODE_ENV=production npm run migrate:safe
+
+# Create admin user if environment variables are set
+if [ -n "$ADMIN_EMAIL" ] && [ -n "$ADMIN_PASSWORD" ]; then
+    echo "👤 Creating admin user..."
+    node scripts/create-admin.js \
+        --email "$ADMIN_EMAIL" \
+        --username "${ADMIN_USERNAME:-admin}" \
+        --password "$ADMIN_PASSWORD" || echo "Admin user might already exist"
+fi
+
+# Initialize email configuration if variables are set
+if [ -n "$SMTP_HOST" ]; then
+    echo "📧 Email configuration detected via environment variables"
+fi
+
+echo "✅ Production initialization complete!"
+echo "🌐 Starting application server..."
+
+# Start the application
+exec node server.js

backend/jest.config.js

@@ -0,0 +1,12 @@
+module.exports = {
+  testEnvironment: 'node',
+  coverageDirectory: 'coverage',
+  collectCoverageFrom: [
+    'src/**/*.js',
+    '!src/**/*.test.js'
+  ],
+  testMatch: [
+    '**/__tests__/**/*.test.js'
+  ],
+  setupFilesAfterEnv: ['<rootDir>/jest.setup.js']
+};

backend/jest.setup.js

@@ -0,0 +1,4 @@
+beforeAll(() => {
+  process.env.NODE_ENV = 'test';
+  process.env.JWT_SECRET = 'test-secret';
+});

backend/knexfile.js

@@ -0,0 +1,59 @@
+require('dotenv').config();
+
+const path = require('path');
+
+// Database configuration for different environments
+const config = {
+  development: {
+    client: process.env.DATABASE_CLIENT || 'sqlite3',
+    connection: process.env.DATABASE_CLIENT === 'pg' ? {
+      host: process.env.DB_HOST || 'localhost',
+      port: process.env.DB_PORT || 5432,
+      user: process.env.DB_USER || 'postgres',
+      password: process.env.DB_PASSWORD || 'postgres',
+      database: process.env.DB_NAME || 'photo_sharing'
+    } : {
+      filename: path.join(__dirname, process.env.DATABASE_PATH || './data/photo_sharing.db')
+    },
+    useNullAsDefault: process.env.DATABASE_CLIENT !== 'pg',
+    migrations: {
+      directory: './migrations'
+    },
+    seeds: {
+      directory: './seeds'
+    }
+  },
+
+  production: {
+    client: process.env.DATABASE_CLIENT || 'pg',
+    connection: {
+      host: process.env.DB_HOST || 'db',
+      port: process.env.DB_PORT || 5432,
+      user: process.env.DB_USER || 'picpeak',
+      password: process.env.DB_PASSWORD,
+      database: process.env.DB_NAME || 'picpeak',
+      ssl: process.env.DB_SSL === 'true' ? { rejectUnauthorized: false } : false,
+      // Connection stability settings
+      connectionTimeoutMillis: 30000,
+      idleTimeoutMillis: 30000,
+      keepAlive: true,
+      keepAliveInitialDelayMillis: 0
+    },
+    pool: {
+      min: 2,
+      max: 10,
+      acquireTimeoutMillis: 30000,
+      createTimeoutMillis: 30000,
+      idleTimeoutMillis: 30000,
+      reapIntervalMillis: 1000,
+      createRetryIntervalMillis: 200,
+      propagateCreateError: false
+    },
+    migrations: {
+      directory: './migrations'
+    },
+    acquireConnectionTimeout: 60000
+  }
+};
+
+module.exports = config[process.env.NODE_ENV || 'development'];

backend/migrations/004_add_categories_and_cms.js

@@ -0,0 +1,101 @@
+const { db } = require('../src/database/db');
+
+async function up() {
+  console.log('Adding photo categories and CMS tables...');
+  
+  // Create photo_categories table
+  await db.schema.createTable('photo_categories', (table) => {
+    table.increments('id').primary();
+    table.string('name', 100).notNullable();
+    table.string('slug', 100).notNullable();
+    table.boolean('is_global').defaultTo(true);
+    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+    table.timestamp('created_at').defaultTo(db.fn.now());
+    
+    // Unique constraint for slug within event scope
+    table.unique(['slug', 'event_id']);
+  });
+
+  // Create cms_pages table
+  await db.schema.createTable('cms_pages', (table) => {
+    table.increments('id').primary();
+    table.string('slug', 100).unique().notNullable();
+    table.text('title_en');
+    table.text('title_de');
+    table.text('content_en');
+    table.text('content_de');
+    table.timestamp('updated_at').defaultTo(db.fn.now());
+  });
+
+  // Add category_id to photos table
+  await db.schema.alterTable('photos', (table) => {
+    table.integer('category_id').references('id').inTable('photo_categories');
+  });
+
+  // Add language preference to admin_users
+  await db.schema.alterTable('admin_users', (table) => {
+    table.string('language', 2).defaultTo('en');
+  });
+
+  // Add language preference to app_settings for global default
+  await db('app_settings').insert({
+    setting_key: 'default_language',
+    setting_value: 'en',
+    setting_type: 'general',
+    updated_at: new Date()
+  });
+
+  // Insert default global categories
+  const defaultCategories = [
+    { name: 'Ceremony', slug: 'ceremony', is_global: true },
+    { name: 'Reception', slug: 'reception', is_global: true },
+    { name: 'Portraits', slug: 'portraits', is_global: true },
+    { name: 'Group Photos', slug: 'group-photos', is_global: true },
+    { name: 'Details', slug: 'details', is_global: true },
+    { name: 'Party', slug: 'party', is_global: true }
+  ];
+
+  await db('photo_categories').insert(defaultCategories);
+
+  // Insert default legal pages
+  await db('cms_pages').insert([
+    {
+      slug: 'impressum',
+      title_en: 'Legal Notice',
+      title_de: 'Impressum',
+      content_en: '<h2>Legal Notice</h2><p>Please edit this content in the admin panel.</p>',
+      content_de: '<h2>Impressum</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
+      updated_at: new Date()
+    },
+    {
+      slug: 'datenschutz',
+      title_en: 'Privacy Policy',
+      title_de: 'Datenschutzerklärung',
+      content_en: '<h2>Privacy Policy</h2><p>Please edit this content in the admin panel.</p>',
+      content_de: '<h2>Datenschutzerklärung</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
+      updated_at: new Date()
+    }
+  ]);
+
+  console.log('Photo categories and CMS tables created successfully');
+}
+
+async function down() {
+  // Remove language from app_settings
+  await db('app_settings').where('setting_key', 'default_language').delete();
+  
+  // Drop columns
+  await db.schema.alterTable('admin_users', (table) => {
+    table.dropColumn('language');
+  });
+  
+  await db.schema.alterTable('photos', (table) => {
+    table.dropColumn('category_id');
+  });
+  
+  // Drop tables
+  await db.schema.dropTableIfExists('cms_pages');
+  await db.schema.dropTableIfExists('photo_categories');
+}
+
+module.exports = { up, down };

backend/migrations/006_add_photo_counter_to_categories.js

@@ -0,0 +1,28 @@
+exports.up = async function(knex) {
+  // Add photo_counter column to photo_categories table
+  await knex.schema.alterTable('photo_categories', function(table) {
+    table.integer('photo_counter').defaultTo(0).notNullable();
+  });
+
+  // Initialize counters based on existing photos
+  const categories = await knex('photo_categories').select('id');
+  
+  for (const category of categories) {
+    const photoCount = await knex('photos')
+      .where('category_id', category.id)
+      .count('id as count')
+      .first();
+    
+    if (photoCount && photoCount.count > 0) {
+      await knex('photo_categories')
+        .where('id', category.id)
+        .update({ photo_counter: photoCount.count });
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  await knex.schema.alterTable('photo_categories', function(table) {
+    table.dropColumn('photo_counter');
+  });
+};

backend/migrations/007_add_read_at_to_activity_logs.js

@@ -0,0 +1,15 @@
+exports.up = async function(knex) {
+  // Add read_at column to activity_logs table
+  const hasReadAt = await knex.schema.hasColumn('activity_logs', 'read_at');
+  if (!hasReadAt) {
+    await knex.schema.table('activity_logs', (table) => {
+      table.datetime('read_at').nullable();
+    });
+  }
+};
+
+exports.down = async function(knex) {
+  await knex.schema.table('activity_logs', (table) => {
+    table.dropColumn('read_at');
+  });
+};

backend/migrations/008_add_language_support_to_email_templates.js

@@ -0,0 +1,35 @@
+exports.up = async function(knex) {
+  // Add language-specific columns to email_templates
+  await knex.schema.alterTable('email_templates', function(table) {
+    // Add English versions (rename existing columns for consistency)
+    table.renameColumn('subject', 'subject_en');
+    table.renameColumn('body_html', 'body_html_en');
+    table.renameColumn('body_text', 'body_text_en');
+    
+    // Add German versions
+    table.string('subject_de');
+    table.text('body_html_de');
+    table.text('body_text_de');
+  });
+
+  // Copy existing values to German columns as defaults
+  await knex('email_templates').update({
+    subject_de: knex.raw('subject_en'),
+    body_html_de: knex.raw('body_html_en'),
+    body_text_de: knex.raw('body_text_en')
+  });
+};
+
+exports.down = async function(knex) {
+  await knex.schema.alterTable('email_templates', function(table) {
+    // Remove German columns
+    table.dropColumn('subject_de');
+    table.dropColumn('body_html_de');
+    table.dropColumn('body_text_de');
+    
+    // Rename columns back
+    table.renameColumn('subject_en', 'subject');
+    table.renameColumn('body_html_en', 'body_html');
+    table.renameColumn('body_text_en', 'body_text');
+  });
+};

backend/migrations/009_update_german_email_templates.js

@@ -0,0 +1,67 @@
+exports.up = async function(knex) {
+  // Update gallery_created template with German content
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_de: 'Ihre Fotogalerie ist bereit!',
+      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
+<p><strong>Galerie-Details:</strong></p>
+<ul>
+  <li>Veranstaltungsdatum: {{event_date}}</li>
+  <li>Galerie-Link: {{gallery_link}}</li>
+  <li>Passwort: {{gallery_password}}</li>
+  <li>Gültig bis: {{expiry_date}}</li>
+</ul>
+<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit sie Fotos ansehen und herunterladen können.</p>`,
+      body_text_de: 'Galerie erfolgreich erstellt\n\nLiebe(r) {{host_name}},\n\nIhre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!'
+    });
+  
+  // Update expiration_warning template with German content
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_de: 'Ihre Fotogalerie läuft bald ab',
+      body_html_de: `<h2>Galerie läuft bald ab</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" läuft in {{days_remaining}} Tagen ab.</p>
+<p>Nach Ablauf wird die Galerie archiviert und ist für Gäste nicht mehr zugänglich.</p>
+<p><a href="{{gallery_link}}">Galerie besuchen</a></p>`,
+      body_text_de: 'Galerie läuft bald ab\n\nLiebe(r) {{host_name}},\n\nIhre Fotogalerie "{{event_name}}" läuft in {{days_remaining}} Tagen ab.'
+    });
+  
+  // Update gallery_expired template if it exists
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_de: 'Ihre Fotogalerie {{event_name}} ist abgelaufen',
+      body_html_de: `<h2>Galerie abgelaufen</h2>
+<p>Ihre Fotogalerie für "{{event_name}}" ist abgelaufen und nicht mehr zugänglich.</p>
+<p>Die Fotos wurden zur sicheren Aufbewahrung archiviert. Wenn Sie wieder Zugriff benötigen, wenden Sie sich bitte an den Administrator unter {{admin_email}}.</p>
+<p>Vielen Dank für die Nutzung unseres Foto-Sharing-Services!</p>
+<p>Mit freundlichen Grüßen,<br>Das Foto-Sharing-Team</p>`,
+      body_text_de: 'Ihre Fotogalerie für {{event_name}} ist abgelaufen und nicht mehr zugänglich.\n\nDie Fotos wurden archiviert. Bei Bedarf kontaktieren Sie bitte den Administrator unter {{admin_email}}.'
+    });
+  
+  // Update archive_complete template if it exists
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_de: 'Archivierung abgeschlossen: {{event_name}}',
+      body_html_de: `<h2>Archivierung abgeschlossen</h2>
+<p>Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.</p>
+<p>Archivgröße: {{archive_size}}</p>
+<p>Das Archiv wird sicher aufbewahrt und kann bei Bedarf wiederhergestellt werden.</p>`,
+      body_text_de: 'Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.\n\nArchivgröße: {{archive_size}}'
+    });
+};
+
+exports.down = async function(knex) {
+  // Reset German fields to null
+  await knex('email_templates').update({
+    subject_de: null,
+    body_html_de: null,
+    body_text_de: null
+  });
+};

backend/migrations/010_add_missing_email_templates.js

@@ -0,0 +1,57 @@
+exports.up = async function(knex) {
+  // Check if gallery_expired template exists
+  const galleryExpiredExists = await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .first();
+    
+  if (!galleryExpiredExists) {
+    await knex('email_templates').insert({
+      template_key: 'gallery_expired',
+      subject_en: 'Your {{event_name}} photo gallery has expired',
+      body_html_en: `<h2>Gallery Expired</h2>
+<p>Your photo gallery for {{event_name}} has expired and is no longer accessible.</p>
+<p>The photos have been archived for safekeeping. If you need access to them, please contact the event administrator at {{admin_email}}.</p>
+<p>Thank you for using our photo sharing service!</p>
+<p>Best regards,<br>The Photo Sharing Team</p>`,
+      body_text_en: 'Your photo gallery for {{event_name}} has expired and is no longer accessible.\n\nThe photos have been archived. Please contact the administrator at {{admin_email}} if you need access.',
+      subject_de: 'Ihre Fotogalerie {{event_name}} ist abgelaufen',
+      body_html_de: `<h2>Galerie abgelaufen</h2>
+<p>Ihre Fotogalerie für "{{event_name}}" ist abgelaufen und nicht mehr zugänglich.</p>
+<p>Die Fotos wurden zur sicheren Aufbewahrung archiviert. Wenn Sie wieder Zugriff benötigen, wenden Sie sich bitte an den Administrator unter {{admin_email}}.</p>
+<p>Vielen Dank für die Nutzung unseres Foto-Sharing-Services!</p>
+<p>Mit freundlichen Grüßen,<br>Das Foto-Sharing-Team</p>`,
+      body_text_de: 'Ihre Fotogalerie für {{event_name}} ist abgelaufen und nicht mehr zugänglich.\n\nDie Fotos wurden archiviert. Bei Bedarf kontaktieren Sie bitte den Administrator unter {{admin_email}}.',
+      variables: JSON.stringify(['event_name', 'admin_email'])
+    });
+  }
+  
+  // Check if archive_complete template exists
+  const archiveCompleteExists = await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .first();
+    
+  if (!archiveCompleteExists) {
+    await knex('email_templates').insert({
+      template_key: 'archive_complete',
+      subject_en: 'Archive Complete: {{event_name}}',
+      body_html_en: `<h2>Archive Complete</h2>
+<p>The photo gallery "{{event_name}}" has been successfully archived.</p>
+<p>Archive size: {{archive_size}}</p>
+<p>The archive has been stored securely and can be restored if needed.</p>`,
+      body_text_en: 'The photo gallery "{{event_name}}" has been successfully archived.\n\nArchive size: {{archive_size}}',
+      subject_de: 'Archivierung abgeschlossen: {{event_name}}',
+      body_html_de: `<h2>Archivierung abgeschlossen</h2>
+<p>Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.</p>
+<p>Archivgröße: {{archive_size}}</p>
+<p>Das Archiv wird sicher aufbewahrt und kann bei Bedarf wiederhergestellt werden.</p>`,
+      body_text_de: 'Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.\n\nArchivgröße: {{archive_size}}',
+      variables: JSON.stringify(['event_name', 'archive_size'])
+    });
+  }
+};
+
+exports.down = async function(knex) {
+  await knex('email_templates')
+    .whereIn('template_key', ['gallery_expired', 'archive_complete'])
+    .del();
+};

backend/migrations/011_add_user_upload_settings.js

@@ -0,0 +1,23 @@
+exports.up = async function(knex) {
+  // Add user upload settings to events table
+  await knex.schema.alterTable('events', function(table) {
+    table.boolean('allow_user_uploads').defaultTo(false);
+    table.integer('upload_category_id').references('id').inTable('photo_categories').onDelete('SET NULL');
+  });
+  
+  // Add uploaded_by field to photos table to track who uploaded
+  await knex.schema.alterTable('photos', function(table) {
+    table.string('uploaded_by').defaultTo('admin'); // 'admin' or guest identifier
+  });
+};
+
+exports.down = async function(knex) {
+  await knex.schema.alterTable('events', function(table) {
+    table.dropColumn('allow_user_uploads');
+    table.dropColumn('upload_category_id');
+  });
+  
+  await knex.schema.alterTable('photos', function(table) {
+    table.dropColumn('uploaded_by');
+  });
+};

backend/migrations/012_add_hero_photo_id.js

@@ -0,0 +1,15 @@
+exports.up = async function(knex) {
+  // Add hero_photo_id to events table
+  const hasColumn = await knex.schema.hasColumn('events', 'hero_photo_id');
+  if (!hasColumn) {
+    await knex.schema.alterTable('events', function(table) {
+      table.integer('hero_photo_id').references('id').inTable('photos').onDelete('SET NULL');
+    });
+  }
+};
+
+exports.down = async function(knex) {
+  await knex.schema.alterTable('events', function(table) {
+    table.dropColumn('hero_photo_id');
+  });
+};

backend/migrations/013_fix_email_links_and_date_format.js

@@ -0,0 +1,112 @@
+exports.up = async function(knex) {
+  // First, add date format configuration to app_settings table
+  const dateFormatSetting = await knex('app_settings').where('setting_key', 'general_date_format').first();
+  if (!dateFormatSetting) {
+    await knex('app_settings').insert({
+      setting_key: 'general_date_format',
+      setting_value: JSON.stringify({
+        format: 'DD/MM/YYYY',  // European format as default
+        locale: 'en-GB'
+      }),
+      setting_type: 'general',
+      updated_at: new Date()
+    });
+  }
+
+  // Update English email templates to use proper HTML links
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      body_html_en: `<h2>Gallery Successfully Created</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has been successfully created!</p>
+<p><strong>Gallery Details:</strong></p>
+<ul>
+  <li>Event Date: {{event_date}}</li>
+  <li>Gallery Link: <a href="{{gallery_link}}" style="color: #5C8762; text-decoration: none;">{{gallery_link}}</a></li>
+  <li>Password: {{gallery_password}}</li>
+  <li>Valid Until: {{expiry_date}}</li>
+</ul>
+<p>Share this link and password with your guests so they can view and download photos.</p>
+<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">View Gallery</a></p>`,
+      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
+<p><strong>Galerie-Details:</strong></p>
+<ul>
+  <li>Veranstaltungsdatum: {{event_date}}</li>
+  <li>Galerie-Link: <a href="{{gallery_link}}" style="color: #5C8762; text-decoration: none;">{{gallery_link}}</a></li>
+  <li>Passwort: {{gallery_password}}</li>
+  <li>Gültig bis: {{expiry_date}}</li>
+</ul>
+<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit sie Fotos ansehen und herunterladen können.</p>
+<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">Galerie anzeigen</a></p>`
+    });
+
+  // Update expiration warning template
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      body_html_en: `<h2>Gallery Expiring Soon</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days.</p>
+<p>After expiration, the gallery will be archived and no longer accessible to guests.</p>
+<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">Visit Gallery</a></p>
+<p>Gallery Link: <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></p>`,
+      body_html_de: `<h2>Galerie läuft bald ab</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" läuft in {{days_remaining}} Tagen ab.</p>
+<p>Nach Ablauf wird die Galerie archiviert und ist für Gäste nicht mehr zugänglich.</p>
+<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">Galerie besuchen</a></p>
+<p>Galerie-Link: <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></p>`
+    });
+
+  // Update gallery expired template
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      body_html_en: `<h2>Gallery Expired</h2>
+<p>Your photo gallery for "{{event_name}}" has expired and is no longer accessible.</p>
+<p>The photos have been safely archived. If you need access again, please contact the administrator at <a href="mailto:{{admin_email}}" style="color: #5C8762;">{{admin_email}}</a>.</p>
+<p>Thank you for using our photo sharing service!</p>
+<p>Best regards,<br>The Photo Sharing Team</p>`,
+      body_html_de: `<h2>Galerie abgelaufen</h2>
+<p>Ihre Fotogalerie für "{{event_name}}" ist abgelaufen und nicht mehr zugänglich.</p>
+<p>Die Fotos wurden zur sicheren Aufbewahrung archiviert. Wenn Sie wieder Zugriff benötigen, wenden Sie sich bitte an den Administrator unter <a href="mailto:{{admin_email}}" style="color: #5C8762;">{{admin_email}}</a>.</p>
+<p>Vielen Dank für die Nutzung unseres Foto-Sharing-Services!</p>
+<p>Mit freundlichen Grüßen,<br>Das Foto-Sharing-Team</p>`
+    });
+};
+
+exports.down = async function(knex) {
+  // Remove date format setting
+  await knex('app_settings').where('setting_key', 'general_date_format').del();
+  
+  // Revert email templates to plain text links
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      body_html_en: `<h2>Gallery Successfully Created</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has been successfully created!</p>
+<p><strong>Gallery Details:</strong></p>
+<ul>
+  <li>Event Date: {{event_date}}</li>
+  <li>Gallery Link: {{gallery_link}}</li>
+  <li>Password: {{gallery_password}}</li>
+  <li>Valid Until: {{expiry_date}}</li>
+</ul>
+<p>Share this link and password with your guests so they can view and download photos.</p>`,
+      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
+<p><strong>Galerie-Details:</strong></p>
+<ul>
+  <li>Veranstaltungsdatum: {{event_date}}</li>
+  <li>Galerie-Link: {{gallery_link}}</li>
+  <li>Passwort: {{gallery_password}}</li>
+  <li>Gültig bis: {{expiry_date}}</li>
+</ul>
+<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit sie Fotos ansehen und herunterladen können.</p>`
+    });
+};

backend/migrations/014_add_default_welcome_message.js

@@ -0,0 +1,130 @@
+exports.up = async function(knex) {
+  // Add default welcome message to app_settings
+  const existingSetting = await knex('app_settings')
+    .where('setting_key', 'general_default_welcome_message')
+    .first();
+  
+  if (!existingSetting) {
+    await knex('app_settings').insert({
+      setting_key: 'general_default_welcome_message',
+      setting_value: JSON.stringify('Thank you for using our photo sharing service! We hope you enjoy your photos.'),
+      setting_type: 'general',
+      updated_at: new Date()
+    });
+  }
+
+  // Update the gallery_created email template to ensure it has the welcome_message placeholder
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      body_html_en: `<h2>Gallery Successfully Created</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has been successfully created!</p>
+{{#if welcome_message}}
+<div style="background-color: #f3f4f6; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0 0 10px 0; font-weight: 600; color: #374151;">Personal Message:</p>
+  <p style="margin: 0; color: #4b5563;">{{welcome_message}}</p>
+</div>
+{{/if}}
+<p><strong>Gallery Details:</strong></p>
+<ul>
+  <li>Event Date: {{event_date}}</li>
+  <li>Gallery Link: <a href="{{gallery_link}}" style="color: #5C8762; text-decoration: none;">{{gallery_link}}</a></li>
+  <li>Password: {{gallery_password}}</li>
+  <li>Valid Until: {{expiry_date}}</li>
+</ul>
+<p>Share this link and password with your guests so they can view and download photos.</p>
+<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">View Gallery</a></p>`,
+      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
+{{#if welcome_message}}
+<div style="background-color: #f3f4f6; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0 0 10px 0; font-weight: 600; color: #374151;">Persönliche Nachricht:</p>
+  <p style="margin: 0; color: #4b5563;">{{welcome_message}}</p>
+</div>
+{{/if}}
+<p><strong>Galerie-Details:</strong></p>
+<ul>
+  <li>Veranstaltungsdatum: {{event_date}}</li>
+  <li>Galerie-Link: <a href="{{gallery_link}}" style="color: #5C8762; text-decoration: none;">{{gallery_link}}</a></li>
+  <li>Passwort: {{gallery_password}}</li>
+  <li>Gültig bis: {{expiry_date}}</li>
+</ul>
+<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit sie Fotos ansehen und herunterladen können.</p>
+<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">Galerie anzeigen</a></p>`,
+      body_text_en: `Gallery Successfully Created
+
+Dear {{host_name}},
+
+Your photo gallery "{{event_name}}" has been successfully created!
+
+{{#if welcome_message}}
+Personal Message:
+{{welcome_message}}
+
+{{/if}}
+Gallery Details:
+- Event Date: {{event_date}}
+- Gallery Link: {{gallery_link}}
+- Password: {{gallery_password}}
+- Valid Until: {{expiry_date}}
+
+Share this link and password with your guests so they can view and download photos.`,
+      body_text_de: `Galerie erfolgreich erstellt
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!
+
+{{#if welcome_message}}
+Persönliche Nachricht:
+{{welcome_message}}
+
+{{/if}}
+Galerie-Details:
+- Veranstaltungsdatum: {{event_date}}
+- Galerie-Link: {{gallery_link}}
+- Passwort: {{gallery_password}}
+- Gültig bis: {{expiry_date}}
+
+Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit sie Fotos ansehen und herunterladen können.`
+    });
+};
+
+exports.down = async function(knex) {
+  // Remove the default welcome message setting
+  await knex('app_settings')
+    .where('setting_key', 'general_default_welcome_message')
+    .del();
+
+  // Revert email templates
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      body_html_en: `<h2>Gallery Successfully Created</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has been successfully created!</p>
+<p><strong>Gallery Details:</strong></p>
+<ul>
+  <li>Event Date: {{event_date}}</li>
+  <li>Gallery Link: <a href="{{gallery_link}}" style="color: #5C8762; text-decoration: none;">{{gallery_link}}</a></li>
+  <li>Password: {{gallery_password}}</li>
+  <li>Valid Until: {{expiry_date}}</li>
+</ul>
+<p>Share this link and password with your guests so they can view and download photos.</p>
+<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">View Gallery</a></p>`,
+      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
+<p><strong>Galerie-Details:</strong></p>
+<ul>
+  <li>Veranstaltungsdatum: {{event_date}}</li>
+  <li>Galerie-Link: <a href="{{gallery_link}}" style="color: #5C8762; text-decoration: none;">{{gallery_link}}</a></li>
+  <li>Passwort: {{gallery_password}}</li>
+  <li>Gültig bis: {{expiry_date}}</li>
+</ul>
+<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit sie Fotos ansehen und herunterladen können.</p>
+<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">Galerie anzeigen</a></p>`
+    });
+};

backend/migrations/014_add_host_name_to_events.js

@@ -0,0 +1,35 @@
+const { db } = require('../src/database/db');
+
+async function up() {
+  // Check if host_name column already exists
+  const hasHostName = await db.schema.hasColumn('events', 'host_name');
+  
+  if (!hasHostName) {
+    await db.schema.table('events', (table) => {
+      table.string('host_name').after('event_date');
+    });
+    
+    console.log('Added host_name column to events table');
+  }
+}
+
+async function down() {
+  await db.schema.table('events', (table) => {
+    table.dropColumn('host_name');
+  });
+}
+
+module.exports = { up, down };
+
+// Run migration if called directly
+if (require.main === module) {
+  up()
+    .then(() => {
+      console.log('Migration completed successfully');
+      process.exit(0);
+    })
+    .catch((error) => {
+      console.error('Migration failed:', error);
+      process.exit(1);
+    });
+}

backend/migrations/015_add_login_attempts_table.js

@@ -0,0 +1,19 @@
+exports.up = function(knex) {
+  return knex.schema.createTable('login_attempts', table => {
+    table.increments('id').primary();
+    table.string('identifier').notNullable(); // username or email
+    table.string('ip_address', 45).notNullable(); // IPv4 or IPv6
+    table.text('user_agent');
+    table.timestamp('attempt_time').defaultTo(knex.fn.now());
+    table.boolean('success').defaultTo(false);
+    
+    // Indexes for performance
+    table.index('identifier');
+    table.index('attempt_time');
+    table.index(['identifier', 'success', 'attempt_time']);
+  });
+};
+
+exports.down = function(knex) {
+  return knex.schema.dropTableIfExists('login_attempts');
+};

backend/migrations/016_add_auth_security_columns.js

@@ -0,0 +1,25 @@
+exports.up = function(knex) {
+  return knex.schema.table('admin_users', table => {
+    // Add password change tracking
+    table.timestamp('password_changed_at').nullable();
+    
+    // Add last login IP for security monitoring
+    table.string('last_login_ip', 45).nullable();
+    
+    // Add account security flags
+    table.boolean('two_factor_enabled').defaultTo(false);
+    table.string('two_factor_secret').nullable();
+    
+    // Add index for performance
+    table.index('password_changed_at');
+  });
+};
+
+exports.down = function(knex) {
+  return knex.schema.table('admin_users', table => {
+    table.dropColumn('password_changed_at');
+    table.dropColumn('last_login_ip');
+    table.dropColumn('two_factor_enabled');
+    table.dropColumn('two_factor_secret');
+  });
+};

backend/migrations/017_add_token_revocation_tables.js

@@ -0,0 +1,34 @@
+exports.up = function(knex) {
+  return knex.schema
+    // Table for individual token revocations
+    .createTable('revoked_tokens', table => {
+      table.increments('id').primary();
+      table.string('token_id').notNullable().unique(); // JWT ID or generated ID
+      table.integer('user_id').nullable(); // User who owned the token
+      table.string('token_type', 20); // admin, gallery, etc.
+      table.timestamp('revoked_at').defaultTo(knex.fn.now());
+      table.timestamp('expires_at').notNullable(); // When token would have expired
+      table.string('reason', 100); // password_change, logout, compromised, etc.
+      table.text('metadata'); // Additional JSON data
+      
+      // Indexes for performance
+      table.index('token_id');
+      table.index('user_id');
+      table.index('expires_at'); // For cleanup
+    })
+    // Table for user-level revocations (revoke all tokens before a certain time)
+    .createTable('user_token_revocations', table => {
+      table.integer('user_id').primary();
+      table.timestamp('revoked_at').notNullable();
+      table.string('reason', 100);
+      
+      // Index for quick lookups
+      table.index('revoked_at');
+    });
+};
+
+exports.down = function(knex) {
+  return knex.schema
+    .dropTableIfExists('user_token_revocations')
+    .dropTableIfExists('revoked_tokens');
+};

backend/migrations/018_add_created_at_to_email_queue.js

@@ -0,0 +1,23 @@
+exports.up = async function(knex) {
+  // Check if created_at column already exists
+  const hasCreatedAt = await knex.schema.hasColumn('email_queue', 'created_at');
+  
+  if (!hasCreatedAt) {
+    await knex.schema.table('email_queue', (table) => {
+      table.datetime('created_at').defaultTo(knex.fn.now());
+    });
+    
+    // Update existing rows to have a created_at value based on scheduled_at
+    await knex('email_queue')
+      .whereNull('created_at')
+      .update({
+        created_at: knex.ref('scheduled_at')
+      });
+  }
+};
+
+exports.down = async function(knex) {
+  await knex.schema.table('email_queue', (table) => {
+    table.dropColumn('created_at');
+  });
+};

backend/migrations/019_fix_email_templates_columns.js

@@ -0,0 +1,35 @@
+exports.up = async function(knex) {
+  // Check current column structure
+  const hasSubjectEn = await knex.schema.hasColumn('email_templates', 'subject_en');
+  const hasSubject = await knex.schema.hasColumn('email_templates', 'subject');
+  
+  if (hasSubjectEn && !hasSubject) {
+    // The language migration was applied, need to add back basic columns
+    await knex.schema.alterTable('email_templates', function(table) {
+      table.string('subject');
+      table.text('body_html');
+      table.text('body_text');
+    });
+    
+    // Copy English values to the basic columns
+    await knex('email_templates').update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+  }
+};
+
+exports.down = async function(knex) {
+  // Check if we have the basic columns
+  const hasSubject = await knex.schema.hasColumn('email_templates', 'subject');
+  const hasSubjectEn = await knex.schema.hasColumn('email_templates', 'subject_en');
+  
+  if (hasSubject && hasSubjectEn) {
+    await knex.schema.alterTable('email_templates', function(table) {
+      table.dropColumn('subject');
+      table.dropColumn('body_html');
+      table.dropColumn('body_text');
+    });
+  }
+};

backend/migrations/020_ensure_default_email_templates.js

@@ -0,0 +1,91 @@
+exports.up = async function(knex) {
+  // Check if we have the default email templates
+  const templates = await knex('email_templates').select('template_key');
+  const existingKeys = templates.map(t => t.template_key);
+  
+  // Check which columns exist in the table
+  const hasSubjectEn = await knex.schema.hasColumn('email_templates', 'subject_en');
+  const hasSubject = await knex.schema.hasColumn('email_templates', 'subject');
+  
+  // Determine which columns to use based on schema
+  const subjectCol = hasSubjectEn ? 'subject_en' : 'subject';
+  const bodyHtmlCol = hasSubjectEn ? 'body_html_en' : 'body_html';
+  const bodyTextCol = hasSubjectEn ? 'body_text_en' : 'body_text';
+  
+  const defaultTemplates = [
+    {
+      template_key: 'gallery_created',
+      [subjectCol]: 'Your Photo Gallery is Ready!',
+      [bodyHtmlCol]: `<h2>Gallery Created Successfully</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has been created successfully!</p>
+<p><strong>Gallery Details:</strong></p>
+<ul>
+  <li>Event Date: {{event_date}}</li>
+  <li>Gallery Link: {{gallery_link}}</li>
+  <li>Password: {{gallery_password}}</li>
+  <li>Expires: {{expiry_date}}</li>
+</ul>
+<p>Share this link and password with your guests to allow them to view and download photos.</p>`,
+      [bodyTextCol]: 'Gallery Created Successfully\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" has been created successfully!',
+      variables: JSON.stringify(['host_name', 'event_name', 'event_date', 'gallery_link', 'gallery_password', 'expiry_date'])
+    },
+    {
+      template_key: 'expiration_warning',
+      [subjectCol]: 'Your Photo Gallery Expires Soon',
+      [bodyHtmlCol]: `<h2>Gallery Expiring Soon</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days.</p>
+<p>After expiration, the gallery will be archived and no longer accessible to guests.</p>
+<p><a href="{{gallery_link}}">Visit Gallery</a></p>`,
+      [bodyTextCol]: 'Gallery Expiring Soon\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" will expire in {{days_remaining}} days.',
+      variables: JSON.stringify(['host_name', 'event_name', 'days_remaining', 'gallery_link'])
+    },
+    {
+      template_key: 'gallery_expired',
+      [subjectCol]: 'Your Photo Gallery Has Expired',
+      [bodyHtmlCol]: `<h2>Gallery Expired</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has expired and been archived.</p>
+<p>The photos are safely stored in our archive system. If you need access to the archived photos, please contact support.</p>`,
+      [bodyTextCol]: 'Gallery Expired\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" has expired and been archived.',
+      variables: JSON.stringify(['host_name', 'event_name'])
+    },
+    {
+      template_key: 'archive_complete',
+      [subjectCol]: 'Gallery Archive Complete',
+      [bodyHtmlCol]: `<h2>Archive Complete</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has been successfully archived.</p>
+<p>Archive size: {{archive_size}}</p>
+<p>The archive is stored securely and can be retrieved if needed.</p>`,
+      [bodyTextCol]: 'Archive Complete\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" has been successfully archived.',
+      variables: JSON.stringify(['host_name', 'event_name', 'archive_size'])
+    }
+  ];
+  
+  // Insert missing templates
+  for (const template of defaultTemplates) {
+    if (!existingKeys.includes(template.template_key)) {
+      // If we have language columns, also set German versions with same content
+      if (hasSubjectEn) {
+        template.subject_de = template[subjectCol];
+        template.body_html_de = template[bodyHtmlCol];
+        template.body_text_de = template[bodyTextCol];
+        
+        // Also ensure we have the basic columns if they exist
+        if (hasSubject) {
+          template.subject = template[subjectCol];
+          template.body_html = template[bodyHtmlCol];
+          template.body_text = template[bodyTextCol];
+        }
+      }
+      
+      await knex('email_templates').insert(template);
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  // Don't remove templates on rollback as they might have been customized
+};

backend/migrations/021_add_default_cms_pages.js

@@ -0,0 +1,121 @@
+exports.up = async function(knex) {
+  // Check if CMS pages already exist
+  const impressumExists = await knex('cms_pages')
+    .where('slug', 'impressum')
+    .first();
+    
+  const datenschutzExists = await knex('cms_pages')
+    .where('slug', 'datenschutz')
+    .first();
+  
+  const pagesToInsert = [];
+  
+  // Add Impressum page if it doesn't exist
+  if (!impressumExists) {
+    pagesToInsert.push({
+      slug: 'impressum',
+      title_en: 'Legal Notice',
+      title_de: 'Impressum',
+      content_en: `<h1>Legal Notice</h1>
+<p>Information according to § 5 TMG</p>
+
+<h2>Responsible for content</h2>
+<p>[Your Name]<br>
+[Your Address]<br>
+[Postal Code City]</p>
+
+<h2>Contact</h2>
+<p>Email: [Your Email Address]<br>
+Phone: [Your Phone Number]</p>
+
+<h2>Disclaimer</h2>
+<h3>Liability for content</h3>
+<p>The contents of our pages were created with great care. However, we cannot guarantee the accuracy, completeness and timeliness of the content.</p>
+
+<h3>Liability for links</h3>
+<p>Our website contains links to external third-party websites over whose content we have no influence. Therefore, we cannot accept any liability for this third-party content.</p>`,
+      content_de: `<h1>Impressum</h1>
+<p>Angaben gemäß § 5 TMG</p>
+
+<h2>Verantwortlich für den Inhalt</h2>
+<p>[Ihr Name]<br>
+[Ihre Adresse]<br>
+[PLZ Ort]</p>
+
+<h2>Kontakt</h2>
+<p>E-Mail: [Ihre E-Mail-Adresse]<br>
+Telefon: [Ihre Telefonnummer]</p>
+
+<h2>Haftungsausschluss</h2>
+<h3>Haftung für Inhalte</h3>
+<p>Die Inhalte unserer Seiten wurden mit größter Sorgfalt erstellt. Für die Richtigkeit, Vollständigkeit und Aktualität der Inhalte können wir jedoch keine Gewähr übernehmen.</p>
+
+<h3>Haftung für Links</h3>
+<p>Unser Angebot enthält Links zu externen Webseiten Dritter, auf deren Inhalte wir keinen Einfluss haben. Deshalb können wir für diese fremden Inhalte auch keine Gewähr übernehmen.</p>`,
+      updated_at: new Date()
+    });
+  }
+  
+  // Add Datenschutz page if it doesn't exist
+  if (!datenschutzExists) {
+    pagesToInsert.push({
+      slug: 'datenschutz',
+      title_en: 'Privacy Policy',
+      title_de: 'Datenschutzerklärung',
+      content_en: `<h1>Privacy Policy</h1>
+
+<h2>1. Privacy at a Glance</h2>
+<h3>General Information</h3>
+<p>The following information provides a simple overview of what happens to your personal data when you visit this website.</p>
+
+<h3>Data Collection on This Website</h3>
+<p><strong>Who is responsible for data collection on this website?</strong></p>
+<p>Data processing on this website is carried out by the website operator. Their contact details can be found in the legal notice of this website.</p>
+
+<p><strong>How do we collect your data?</strong></p>
+<p>Your data is collected when you provide it to us. This could be data that you enter into a contact form, for example.</p>
+
+<p><strong>What do we use your data for?</strong></p>
+<p>Some of the data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior.</p>
+
+<h2>2. Hosting</h2>
+<p>This website is hosted externally. The personal data collected on this website is stored on the servers of the host.</p>
+
+<h2>3. General Information and Mandatory Information</h2>
+<h3>Data Protection</h3>
+<p>The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.</p>`,
+      content_de: `<h1>Datenschutzerklärung</h1>
+
+<h2>1. Datenschutz auf einen Blick</h2>
+<h3>Allgemeine Hinweise</h3>
+<p>Die folgenden Hinweise geben einen einfachen Überblick darüber, was mit Ihren personenbezogenen Daten passiert, wenn Sie diese Website besuchen.</p>
+
+<h3>Datenerfassung auf dieser Website</h3>
+<p><strong>Wer ist verantwortlich für die Datenerfassung auf dieser Website?</strong></p>
+<p>Die Datenverarbeitung auf dieser Website erfolgt durch den Websitebetreiber. Dessen Kontaktdaten können Sie dem Impressum dieser Website entnehmen.</p>
+
+<p><strong>Wie erfassen wir Ihre Daten?</strong></p>
+<p>Ihre Daten werden zum einen dadurch erhoben, dass Sie uns diese mitteilen. Hierbei kann es sich z.B. um Daten handeln, die Sie in ein Kontaktformular eingeben.</p>
+
+<p><strong>Wofür nutzen wir Ihre Daten?</strong></p>
+<p>Ein Teil der Daten wird erhoben, um eine fehlerfreie Bereitstellung der Website zu gewährleisten. Andere Daten können zur Analyse Ihres Nutzerverhaltens verwendet werden.</p>
+
+<h2>2. Hosting</h2>
+<p>Diese Website wird extern gehostet. Die personenbezogenen Daten, die auf dieser Website erfasst werden, werden auf den Servern des Hosters gespeichert.</p>
+
+<h2>3. Allgemeine Hinweise und Pflichtinformationen</h2>
+<h3>Datenschutz</h3>
+<p>Die Betreiber dieser Seiten nehmen den Schutz Ihrer persönlichen Daten sehr ernst. Wir behandeln Ihre personenbezogenen Daten vertraulich und entsprechend der gesetzlichen Datenschutzvorschriften sowie dieser Datenschutzerklärung.</p>`,
+      updated_at: new Date()
+    });
+  }
+  
+  // Insert pages if any need to be added
+  if (pagesToInsert.length > 0) {
+    await knex('cms_pages').insert(pagesToInsert);
+  }
+};
+
+exports.down = async function(knex) {
+  // Don't remove CMS pages on rollback as they might have been customized
+};

backend/migrations/022_fix_json_columns.js

@@ -0,0 +1,68 @@
+exports.up = async function(knex) {
+  console.log('Fixing JSON columns in database...');
+  
+  // Fix email_templates variables column
+  const templates = await knex('email_templates').select('id', 'template_key', 'variables');
+  
+  for (const template of templates) {
+    if (template.variables && typeof template.variables === 'string') {
+      try {
+        // Check if it's already valid JSON
+        JSON.parse(template.variables);
+      } catch (e) {
+        console.log(`Fixing invalid JSON in email template ${template.template_key}`);
+        // Attempt to fix common issues
+        let fixed = template.variables;
+        
+        // If it looks like an array but isn't valid JSON, try to fix it
+        if (fixed.startsWith('[') && fixed.endsWith(']')) {
+          // Extract the content and properly format it
+          const content = fixed.slice(1, -1);
+          const items = content.split(',').map(item => item.trim().replace(/['"]/g, ''));
+          fixed = JSON.stringify(items);
+        } else {
+          // Default to empty array if we can't fix it
+          fixed = JSON.stringify([]);
+        }
+        
+        await knex('email_templates')
+          .where('id', template.id)
+          .update({ variables: fixed });
+      }
+    } else if (!template.variables) {
+      // Set default empty array for null values
+      await knex('email_templates')
+        .where('id', template.id)
+        .update({ variables: JSON.stringify([]) });
+    }
+  }
+  
+  // Fix activity_logs metadata column
+  const activities = await knex('activity_logs').select('id', 'metadata');
+  
+  for (const activity of activities) {
+    if (activity.metadata && typeof activity.metadata === 'string') {
+      try {
+        // Check if it's already valid JSON
+        JSON.parse(activity.metadata);
+      } catch (e) {
+        console.log(`Fixing invalid JSON in activity log ${activity.id}`);
+        // Default to empty object if we can't parse it
+        await knex('activity_logs')
+          .where('id', activity.id)
+          .update({ metadata: JSON.stringify({}) });
+      }
+    } else if (!activity.metadata) {
+      // Set default empty object for null values
+      await knex('activity_logs')
+        .where('id', activity.id)
+        .update({ metadata: JSON.stringify({}) });
+    }
+  }
+  
+  console.log('JSON columns fixed successfully');
+};
+
+exports.down = async function(knex) {
+  // No rollback needed - data fixes only
+};

backend/migrations/023_ensure_postgres_compatibility.js

@@ -0,0 +1,22 @@
+/**
+ * Ensure PostgreSQL compatibility for all insert operations
+ * This migration doesn't change the schema but ensures all tables
+ * are compatible with .returning() syntax
+ */
+
+exports.up = async function(knex) {
+  // This migration is informational only
+  // All insert operations should use .returning('id') going forward
+  
+  console.log('PostgreSQL compatibility check:');
+  console.log('- All INSERT operations should use .returning("id")');
+  console.log('- All date operations should use ISO strings');
+  console.log('- Boolean values are handled automatically by Knex');
+  
+  return Promise.resolve();
+};
+
+exports.down = async function(knex) {
+  // No rollback needed
+  return Promise.resolve();
+};

backend/migrations/024_fix_boolean_compatibility.js

@@ -0,0 +1,29 @@
+/**
+ * Fix boolean compatibility issues between PostgreSQL and SQLite
+ * This migration updates the database configuration and existing data
+ */
+
+exports.up = async function(knex) {
+  const isPostgres = knex.client.config.client === 'pg';
+  
+  if (!isPostgres) {
+    // Enable foreign keys for SQLite
+    await knex.raw('PRAGMA foreign_keys = ON');
+    
+    // Note: SQLite stores booleans as 0/1
+    // No data migration needed as Knex handles this automatically
+    // But queries must use formatBoolean() helper
+    
+    console.log('SQLite boolean compatibility check:');
+    console.log('- SQLite stores booleans as 0/1');
+    console.log('- All boolean comparisons should use formatBoolean() helper');
+    console.log('- Foreign keys enabled');
+  }
+  
+  return Promise.resolve();
+};
+
+exports.down = async function(knex) {
+  // No rollback needed
+  return Promise.resolve();
+};

backend/migrations/025_fix_email_queue_updated_at.js

@@ -0,0 +1,33 @@
+/**
+ * Fix email_queue table by ensuring it doesn't have updated_at column
+ * This migration addresses the PostgreSQL error where queries are trying to update
+ * a non-existent updated_at column
+ */
+
+exports.up = async function(knex) {
+  // First, check if the column exists
+  const hasUpdatedAt = await knex.schema.hasColumn('email_queue', 'updated_at');
+  
+  if (hasUpdatedAt) {
+    console.log('Found updated_at column in email_queue table, removing it...');
+    await knex.schema.table('email_queue', (table) => {
+      table.dropColumn('updated_at');
+    });
+  }
+  
+  // Also ensure the table has all required columns
+  const hasCreatedAt = await knex.schema.hasColumn('email_queue', 'created_at');
+  if (!hasCreatedAt) {
+    console.log('Adding missing created_at column to email_queue table...');
+    await knex.schema.table('email_queue', (table) => {
+      table.datetime('created_at').defaultTo(knex.fn.now());
+    });
+  }
+  
+  console.log('email_queue table schema fixed');
+};
+
+exports.down = async function(knex) {
+  // In the down migration, we don't add back updated_at since it shouldn't exist
+  // This is intentionally left minimal
+};

backend/migrations/026_fix_german_email_templates.js

@@ -0,0 +1,234 @@
+exports.up = async function(knex) {
+  // Update gallery_created template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_de: 'Ihre Fotogalerie ist bereit!',
+      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
+{{#if welcome_message}}
+<div style="background-color: #f3f4f6; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0 0 10px 0; font-weight: 600; color: #374151;">Persönliche Nachricht:</p>
+  <p style="margin: 0; color: #4b5563;">{{welcome_message}}</p>
+</div>
+{{/if}}
+<p><strong>Galerie-Details:</strong></p>
+<ul>
+  <li>Veranstaltungsdatum: {{event_date}}</li>
+  <li>Galerie-Link: <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></li>
+  <li>Passwort: {{gallery_password}}</li>
+  <li>Ablaufdatum: {{expiry_date}}</li>
+</ul>
+<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit diese die Fotos ansehen und herunterladen können.</p>
+<p style="background-color: #FEF3C7; padding: 15px; border-radius: 5px; border-left: 4px solid #F59E0B;">
+  <strong>Wichtig:</strong> Diese Galerie läuft am {{expiry_date}} ab. Nach diesem Datum werden die Fotos archiviert und sind nicht mehr zugänglich.
+</p>
+<a href="{{gallery_link}}" style="display: inline-block; padding: 12px 30px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 500; margin: 20px 0;">Galerie anzeigen</a>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Galerie erfolgreich erstellt
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!
+
+{{#if welcome_message}}
+Persönliche Nachricht:
+{{welcome_message}}
+
+{{/if}}
+Galerie-Details:
+- Veranstaltungsdatum: {{event_date}}
+- Galerie-Link: {{gallery_link}}
+- Passwort: {{gallery_password}}
+- Ablaufdatum: {{expiry_date}}
+
+Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit diese die Fotos ansehen und herunterladen können.
+
+WICHTIG: Diese Galerie läuft am {{expiry_date}} ab. Nach diesem Datum werden die Fotos archiviert und sind nicht mehr zugänglich.
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Update expiration_warning template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_de: 'Ihre Fotogalerie läuft bald ab',
+      body_html_de: `<h2>Galerie läuft bald ab</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" läuft in <strong>{{days_remaining}} Tagen</strong> ab.</p>
+<p>Nach Ablauf wird die Galerie archiviert und ist für Gäste nicht mehr zugänglich. Bitte stellen Sie sicher, dass alle gewünschten Fotos heruntergeladen wurden.</p>
+<p><strong>Ablaufdatum:</strong> {{expiry_date}}</p>
+<a href="{{gallery_link}}" style="display: inline-block; padding: 12px 30px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 500; margin: 20px 0;">Galerie jetzt besuchen</a>
+<p style="background-color: #FEE2E2; padding: 15px; border-radius: 5px; border-left: 4px solid #EF4444;">
+  <strong>Erinnerung:</strong> Nach dem {{expiry_date}} können Ihre Gäste nicht mehr auf die Galerie zugreifen.
+</p>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Galerie läuft bald ab
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" läuft in {{days_remaining}} Tagen ab.
+
+Nach Ablauf wird die Galerie archiviert und ist für Gäste nicht mehr zugänglich. Bitte stellen Sie sicher, dass alle gewünschten Fotos heruntergeladen wurden.
+
+Ablaufdatum: {{expiry_date}}
+
+Galerie-Link: {{gallery_link}}
+
+ERINNERUNG: Nach dem {{expiry_date}} können Ihre Gäste nicht mehr auf die Galerie zugreifen.
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Update gallery_expired template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_de: 'Ihre Fotogalerie {{event_name}} ist abgelaufen',
+      body_html_de: `<h2>Galerie abgelaufen</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" ist am {{expiry_date}} abgelaufen und wurde archiviert.</p>
+<p>Die Galerie ist nicht mehr für Gäste zugänglich. Alle Fotos wurden sicher in unserem Archivsystem gespeichert.</p>
+<p>Wenn Sie wieder Zugriff auf die archivierten Fotos benötigen, wenden Sie sich bitte an unseren Support:</p>
+<p style="background-color: #F3F4F6; padding: 15px; border-radius: 5px;">
+  <strong>Kontakt:</strong><br>
+  E-Mail: <a href="mailto:{{admin_email}}" style="color: #5C8762;">{{admin_email}}</a><br>
+  {{#if support_phone}}Telefon: {{support_phone}}{{/if}}
+</p>
+<p>Vielen Dank für die Nutzung unseres Foto-Sharing-Services!</p>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Galerie abgelaufen
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" ist am {{expiry_date}} abgelaufen und wurde archiviert.
+
+Die Galerie ist nicht mehr für Gäste zugänglich. Alle Fotos wurden sicher in unserem Archivsystem gespeichert.
+
+Wenn Sie wieder Zugriff auf die archivierten Fotos benötigen, wenden Sie sich bitte an unseren Support:
+
+E-Mail: {{admin_email}}
+{{#if support_phone}}Telefon: {{support_phone}}{{/if}}
+
+Vielen Dank für die Nutzung unseres Foto-Sharing-Services!
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Update archive_complete template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_de: 'Archivierung abgeschlossen: {{event_name}}',
+      body_html_de: `<h2>Archivierung abgeschlossen</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.</p>
+<p><strong>Archiv-Details:</strong></p>
+<ul>
+  <li>Archivgröße: {{archive_size}}</li>
+  <li>Archivierungsdatum: {{archive_date}}</li>
+  <li>Anzahl der Fotos: {{photo_count}}</li>
+</ul>
+<p>Das Archiv wird sicher in unserem System aufbewahrt. Bei Bedarf können Sie sich an unseren Support wenden, um Zugriff auf die archivierten Fotos zu erhalten.</p>
+<p style="background-color: #F0FDF4; padding: 15px; border-radius: 5px; border-left: 4px solid #22C55E;">
+  <strong>✓ Erfolgreich archiviert:</strong> Ihre Fotos sind sicher gespeichert und können bei Bedarf wiederhergestellt werden.
+</p>
+<p>Kontakt für Archivzugriff:<br>
+E-Mail: <a href="mailto:{{admin_email}}" style="color: #5C8762;">{{admin_email}}</a></p>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Archivierung abgeschlossen
+
+Liebe(r) {{host_name}},
+
+Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.
+
+Archiv-Details:
+- Archivgröße: {{archive_size}}
+- Archivierungsdatum: {{archive_date}}
+- Anzahl der Fotos: {{photo_count}}
+
+Das Archiv wird sicher in unserem System aufbewahrt. Bei Bedarf können Sie sich an unseren Support wenden, um Zugriff auf die archivierten Fotos zu erhalten.
+
+✓ ERFOLGREICH ARCHIVIERT: Ihre Fotos sind sicher gespeichert und können bei Bedarf wiederhergestellt werden.
+
+Kontakt für Archivzugriff:
+E-Mail: {{admin_email}}
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Also update the non-language-specific fields to match German for consistency
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+};
+
+exports.down = async function(knex) {
+  // Revert to previous German translations
+  // This is a simplified rollback - in production you might want to store the old values
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+};

backend/migrations/027_add_language_preferences.js

@@ -0,0 +1,41 @@
+exports.up = async function(knex) {
+  // Add language column to events table if it doesn't exist
+  const hasLanguageInEvents = await knex.schema.hasColumn('events', 'language');
+  if (!hasLanguageInEvents) {
+    await knex.schema.alterTable('events', function(table) {
+      table.string('language', 5).defaultTo('en');
+    });
+  }
+  
+  // Add default_language to email_configs if it doesn't exist
+  const hasDefaultLanguage = await knex.schema.hasColumn('email_configs', 'default_language');
+  if (!hasDefaultLanguage) {
+    await knex.schema.alterTable('email_configs', function(table) {
+      table.string('default_language', 5).defaultTo('en');
+    });
+  }
+  
+  // Set default language to German for the existing email config
+  await knex('email_configs')
+    .update({
+      default_language: 'de'
+    });
+};
+
+exports.down = async function(knex) {
+  // Remove language column from events table
+  const hasLanguageInEvents = await knex.schema.hasColumn('events', 'language');
+  if (hasLanguageInEvents) {
+    await knex.schema.alterTable('events', function(table) {
+      table.dropColumn('language');
+    });
+  }
+  
+  // Remove default_language from email_configs
+  const hasDefaultLanguage = await knex.schema.hasColumn('email_configs', 'default_language');
+  if (hasDefaultLanguage) {
+    await knex.schema.alterTable('email_configs', function(table) {
+      table.dropColumn('default_language');
+    });
+  }
+};

backend/migrations/027_add_rate_limit_settings.js

@@ -0,0 +1,63 @@
+exports.up = async function(knex) {
+  // Add rate limit settings to app_settings
+  const rateLimitSettings = [
+    {
+      setting_key: 'rate_limit_enabled',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_window_minutes',
+      setting_value: JSON.stringify(15),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_max_requests',
+      setting_value: JSON.stringify(1000),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_auth_max_requests',
+      setting_value: JSON.stringify(5),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_skip_authenticated',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_public_endpoints_only',
+      setting_value: JSON.stringify(false),
+      setting_type: 'security'
+    }
+  ];
+
+  // Insert settings if they don't exist
+  for (const setting of rateLimitSettings) {
+    const exists = await knex('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await knex('app_settings').insert({
+        ...setting,
+        updated_at: knex.fn.now()
+      });
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  // Remove rate limit settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'rate_limit_enabled',
+      'rate_limit_window_minutes',
+      'rate_limit_max_requests',
+      'rate_limit_auth_max_requests',
+      'rate_limit_skip_authenticated',
+      'rate_limit_public_endpoints_only'
+    ])
+    .del();
+};

backend/migrations/028_update_english_templates_to_match_german.js

@@ -0,0 +1,307 @@
+exports.up = async function(knex) {
+  // Update English templates to match the quality and content of German templates
+  
+  // 1. Gallery Created - Match German version with proper styling and conditionals
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_en: 'Your photo gallery is ready',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> for {{event_date}} has been successfully created and is now online!</p>
+
+{{#if welcome_message}}
+<div style="background-color: #f0f8ff; border-left: 4px solid #5C8762; padding: 15px; margin: 20px 0; border-radius: 4px;">
+  <p style="margin: 0;"><strong>Personal message from your photographer:</strong></p>
+  <p style="margin: 10px 0 0 0;">{{welcome_message}}</p>
+</div>
+{{/if}}
+
+<div style="background-color: #f9f9f9; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <h3 style="margin-top: 0;">Your access data:</h3>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 10px;"><strong>Gallery link:</strong> <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></li>
+    <li style="margin-bottom: 10px;"><strong>Password:</strong> {{gallery_password}}</li>
+  </ul>
+</div>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{gallery_link}}" style="display: inline-block; padding: 12px 30px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 500;">View Gallery</a>
+</div>
+
+<div style="background-color: #fff3cd; border: 1px solid #ffeaa7; color: #856404; padding: 15px; border-radius: 4px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Important:</strong> Your gallery will be available until <strong>{{expiry_date}}</strong>. After this date, the photos will be archived and will only be available upon request.</p>
+</div>
+
+<p>We hope you enjoy your photos!</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" for {{event_date}} has been successfully created and is now online!
+
+{{#if welcome_message}}
+Personal message from your photographer:
+{{welcome_message}}
+{{/if}}
+
+Your access data:
+- Gallery link: {{gallery_link}}
+- Password: {{gallery_password}}
+
+Important: Your gallery will be available until {{expiry_date}}. After this date, the photos will be archived and will only be available upon request.
+
+We hope you enjoy your photos!
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 2. Expiration Warning - Match German version with urgency and styling
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_en: 'Your photo gallery expires soon',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> will expire in <strong style="color: #e74c3c; font-size: 18px;">{{days_remaining}} days</strong>!</p>
+
+<div style="background-color: #fee; border: 1px solid #fcc; color: #c33; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0; font-weight: bold; font-size: 16px;">⚠️ Important Notice</p>
+  <p style="margin: 10px 0 0 0;">After {{expiry_date}}, your gallery will no longer be accessible online. The photos will be archived and will only be available upon special request.</p>
+</div>
+
+<p><strong>Don't miss out – download your photos now!</strong></p>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{gallery_link}}" style="display: inline-block; padding: 14px 35px; background-color: #e74c3c; color: white; text-decoration: none; border-radius: 5px; font-weight: 600; font-size: 16px;">Visit Gallery Now</a>
+</div>
+
+<div style="background-color: #f9f9f9; padding: 15px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Quick reminder of your access data:</strong></p>
+  <ul style="list-style: none; padding: 0; margin: 10px 0 0 0;">
+    <li>Gallery link: <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></li>
+    <li>Password: {{gallery_password}}</li>
+  </ul>
+</div>
+
+<p>If you have any questions, please don't hesitate to contact us.</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days!
+
+⚠️ Important Notice
+After {{expiry_date}}, your gallery will no longer be accessible online. The photos will be archived and will only be available upon special request.
+
+Don't miss out – download your photos now!
+
+Quick reminder of your access data:
+- Gallery link: {{gallery_link}}
+- Password: {{gallery_password}}
+
+If you have any questions, please don't hesitate to contact us.
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 3. Gallery Expired - Match German version with contact information
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_en: 'Your photo gallery has expired',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> expired on {{expiry_date}} and is no longer accessible online.</p>
+
+<div style="background-color: #f9f9f9; border-left: 4px solid #5C8762; padding: 20px; margin: 20px 0; border-radius: 4px;">
+  <h3 style="margin-top: 0;">Your photos are safely archived</h3>
+  <p>Don't worry – your photos have been securely archived and are not lost. If you need access to your photos, please contact us:</p>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 8px;">📧 Email: <a href="mailto:{{support_email}}" style="color: #5C8762;">{{support_email}}</a></li>
+    {{#if support_phone}}
+    <li>📞 Phone: {{support_phone}}</li>
+    {{/if}}
+  </ul>
+</div>
+
+<p>Please have the following information ready when contacting us:</p>
+<ul>
+  <li>Event name: {{event_name}}</li>
+  <li>Event date: {{event_date}}</li>
+  <li>Expiry date: {{expiry_date}}</li>
+</ul>
+
+<p>We'll be happy to help you access your archived photos.</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" expired on {{expiry_date}} and is no longer accessible online.
+
+Your photos are safely archived
+Don't worry – your photos have been securely archived and are not lost. If you need access to your photos, please contact us:
+
+📧 Email: {{support_email}}
+{{#if support_phone}}📞 Phone: {{support_phone}}{{/if}}
+
+Please have the following information ready when contacting us:
+- Event name: {{event_name}}
+- Event date: {{event_date}}
+- Expiry date: {{expiry_date}}
+
+We'll be happy to help you access your archived photos.
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 4. Archive Complete - Match German version with success message and details
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_en: 'Your photo gallery has been successfully archived',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> has been successfully archived.</p>
+
+<div style="background-color: #d4edda; border: 1px solid #c3e6cb; color: #155724; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0; font-weight: bold;">✅ Archive successfully created</p>
+  <p style="margin: 10px 0 0 0;">Your photos are now safely stored in our archive.</p>
+</div>
+
+<div style="background-color: #f9f9f9; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <h3 style="margin-top: 0;">Archive details:</h3>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 8px;"><strong>Event:</strong> {{event_name}}</li>
+    <li style="margin-bottom: 8px;"><strong>Archive date:</strong> {{archive_date}}</li>
+    <li style="margin-bottom: 8px;"><strong>Number of photos:</strong> {{photo_count}}</li>
+    <li><strong>Archive size:</strong> {{archive_size}}</li>
+  </ul>
+</div>
+
+<p>If you need access to your archived photos in the future, please contact us at:</p>
+<p style="margin-left: 20px;">
+  📧 <a href="mailto:{{support_email}}" style="color: #5C8762;">{{support_email}}</a><br>
+  {{#if support_phone}}📞 {{support_phone}}{{/if}}
+</p>
+
+<p>Thank you for using our photo sharing service!</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" has been successfully archived.
+
+✅ Archive successfully created
+Your photos are now safely stored in our archive.
+
+Archive details:
+- Event: {{event_name}}
+- Archive date: {{archive_date}}
+- Number of photos: {{photo_count}}
+- Archive size: {{archive_size}}
+
+If you need access to your archived photos in the future, please contact us at:
+📧 {{support_email}}
+{{#if support_phone}}📞 {{support_phone}}{{/if}}
+
+Thank you for using our photo sharing service!
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 5. Test Email - Update to match German style
+  await knex('email_templates')
+    .where('template_key', 'test_email')
+    .update({
+      subject_en: 'Test Email - Photo Sharing Platform',
+      body_html_en: `
+<h2>Test Email</h2>
+
+<p>This is a test email from your photo sharing platform.</p>
+
+<div style="background-color: #d4edda; border: 1px solid #c3e6cb; color: #155724; padding: 15px; border-radius: 4px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>✅ Email configuration successful!</strong></p>
+  <p style="margin: 10px 0 0 0;">Your email settings have been configured correctly and emails can be sent.</p>
+</div>
+
+<div style="background-color: #f9f9f9; padding: 15px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Configuration details:</strong></p>
+  <ul style="margin: 10px 0 0 0;">
+    <li>Timestamp: {{timestamp}}</li>
+    <li>Sender: {{from_email}}</li>
+  </ul>
+</div>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Test Email
+
+This is a test email from your photo sharing platform.
+
+✅ Email configuration successful!
+Your email settings have been configured correctly and emails can be sent.
+
+Configuration details:
+- Timestamp: {{timestamp}}
+- Sender: {{from_email}}
+
+Best regards,
+Your Photo Sharing Team`
+    });
+};
+
+exports.down = async function(knex) {
+  // Revert to previous simpler English templates
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_en: 'Your Photo Gallery is Ready',
+      body_html_en: '<h2>Hello,</h2><p>Your photo gallery "{{event_name}}" has been created.</p><p><strong>Access Link:</strong> <a href="{{gallery_link}}">{{gallery_link}}</a></p><p><strong>Password:</strong> {{gallery_password}}</p><p>The gallery will be available until {{expiry_date}}.</p>',
+      body_text_en: 'Your photo gallery "{{event_name}}" has been created. Access Link: {{gallery_link}} Password: {{gallery_password}} The gallery will be available until {{expiry_date}}.'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_en: 'Gallery Expires in {{days_remaining}} Days',
+      body_html_en: '<h2>Reminder</h2><p>Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days.</p><p>Please download your photos before {{expiry_date}}.</p><p><a href="{{gallery_link}}">Access Gallery</a></p>',
+      body_text_en: 'Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days. Please download your photos before {{expiry_date}}. Access Gallery: {{gallery_link}}'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_en: 'Gallery Expired',
+      body_html_en: '<h2>Gallery Expired</h2><p>Your photo gallery "{{event_name}}" has expired and is no longer accessible.</p><p>If you need access to your photos, please contact support.</p>',
+      body_text_en: 'Your photo gallery "{{event_name}}" has expired and is no longer accessible. If you need access to your photos, please contact support.'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_en: 'Gallery Archived',
+      body_html_en: '<h2>Archive Complete</h2><p>Your gallery "{{event_name}}" has been archived.</p><p>Archive size: {{archive_size}}</p>',
+      body_text_en: 'Your gallery "{{event_name}}" has been archived. Archive size: {{archive_size}}'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'test_email')
+    .update({
+      subject_en: 'Test Email',
+      body_html_en: '<p>This is a test email sent at {{timestamp}}.</p>',
+      body_text_en: 'This is a test email sent at {{timestamp}}.'
+    });
+};

backend/migrations/helpers.js

@@ -0,0 +1,83 @@
+/**
+ * Migration helper functions for production-safe migrations
+ */
+
+/**
+ * Create a table only if it doesn't already exist
+ */
+async function createTableIfNotExists(knex, tableName, callback) {
+  const exists = await knex.schema.hasTable(tableName);
+  if (!exists) {
+    console.log(`Creating table: ${tableName}`);
+    return knex.schema.createTable(tableName, callback);
+  } else {
+    console.log(`Table ${tableName} already exists, skipping...`);
+  }
+}
+
+/**
+ * Add column to table only if it doesn't exist
+ */
+async function addColumnIfNotExists(knex, tableName, columnName, callback) {
+  const hasColumn = await knex.schema.hasColumn(tableName, columnName);
+  if (!hasColumn) {
+    console.log(`Adding column ${columnName} to table ${tableName}`);
+    return knex.schema.alterTable(tableName, (table) => {
+      callback(table);
+    });
+  } else {
+    console.log(`Column ${columnName} already exists in table ${tableName}, skipping...`);
+  }
+}
+
+/**
+ * Insert data only if it doesn't already exist
+ */
+async function insertIfNotExists(knex, tableName, data, uniqueField) {
+  const exists = await knex(tableName)
+    .where(uniqueField, data[uniqueField])
+    .first();
+  
+  if (!exists) {
+    console.log(`Inserting ${uniqueField}: ${data[uniqueField]} into ${tableName}`);
+    return knex(tableName).insert(data);
+  } else {
+    console.log(`${uniqueField}: ${data[uniqueField]} already exists in ${tableName}, skipping...`);
+  }
+}
+
+/**
+ * Create index only if it doesn't exist
+ */
+async function createIndexIfNotExists(knex, tableName, columns, indexName) {
+  // This is database-specific, works for PostgreSQL
+  if (knex.client.config.client === 'pg') {
+    const result = await knex.raw(`
+      SELECT 1 FROM pg_indexes 
+      WHERE tablename = ? AND indexname = ?
+    `, [tableName, indexName]);
+    
+    if (result.rows.length === 0) {
+      console.log(`Creating index ${indexName} on ${tableName}`);
+      return knex.schema.alterTable(tableName, (table) => {
+        table.index(columns, indexName);
+      });
+    }
+  } else {
+    // For SQLite, just try to create and ignore errors
+    try {
+      await knex.schema.alterTable(tableName, (table) => {
+        table.index(columns, indexName);
+      });
+    } catch (error) {
+      // Index probably already exists
+    }
+  }
+}
+
+module.exports = {
+  createTableIfNotExists,
+  addColumnIfNotExists,
+  insertIfNotExists,
+  createIndexIfNotExists
+};

backend/migrations/init.js

@@ -0,0 +1,126 @@
+const bcrypt = require('bcrypt');
+const { db, initializeDatabase } = require('../src/database/db');
+const { generateReadablePassword } = require('../src/utils/passwordGenerator');
+const fs = require('fs').promises;
+const path = require('path');
+
+async function runMigrations() {
+  console.log('Running database migrations...');
+  
+  try {
+    // Initialize tables
+    await initializeDatabase();
+    
+    // Create default admin user if none exists
+    const adminExists = await db('admin_users').first();
+    if (!adminExists) {
+      // Generate a secure random password
+      const generatedPassword = generateReadablePassword();
+      const passwordHash = await bcrypt.hash(generatedPassword, 12); // Increased rounds for better security
+      
+      await db('admin_users').insert({
+        username: 'admin',
+        email: '[email protected]',
+        password_hash: passwordHash,
+        must_change_password: true, // Flag for forcing password change
+        created_at: new Date()
+      });
+      
+      // Save the generated password to a file for the user to retrieve
+      const setupInfoPath = path.join(__dirname, '..', '..', 'ADMIN_CREDENTIALS.txt');
+      const setupInfo = `
+========================================
+PicPeak Admin Credentials
+========================================
+
+Your admin account has been created with these credentials:
+
+Username: admin
+Password: ${generatedPassword}
+
+IMPORTANT SECURITY NOTES:
+1. You MUST change this password on first login
+2. This file will be created only once
+3. Store these credentials securely
+4. Delete this file after noting the password
+
+Login URL: ${process.env.ADMIN_URL || 'http://localhost:3001'}/admin
+
+Generated on: ${new Date().toISOString()}
+========================================
+`;
+      
+      await fs.writeFile(setupInfoPath, setupInfo, 'utf8');
+      
+      console.log('\n========================================');
+      console.log('✅ Admin user created successfully!');
+      console.log('========================================');
+      console.log('Username: admin');
+      console.log(`Password: ${generatedPassword}`);
+      console.log('\n⚠️  IMPORTANT:');
+      console.log('1. Save these credentials securely');
+      console.log('2. You will be required to change the password on first login');
+      console.log('3. Credentials are also saved in: ADMIN_CREDENTIALS.txt');
+      console.log('========================================\n');
+    }
+    
+    // Create default email templates if none exist
+    const templateExists = await db('email_templates').first();
+    if (!templateExists) {
+      await db('email_templates').insert([
+        {
+          template_key: 'gallery_created',
+          subject: 'Your Photo Gallery is Ready!',
+          body_html: `<h2>Gallery Created Successfully</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has been created successfully!</p>
+<p><strong>Gallery Details:</strong></p>
+<ul>
+  <li>Event Date: {{event_date}}</li>
+  <li>Gallery Link: {{gallery_link}}</li>
+  <li>Password: {{gallery_password}}</li>
+  <li>Expires: {{expiry_date}}</li>
+</ul>
+<p>Share this link and password with your guests to allow them to view and download photos.</p>`,
+          body_text: 'Gallery Created Successfully\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" has been created successfully!',
+          variables: JSON.stringify(['host_name', 'event_name', 'event_date', 'gallery_link', 'gallery_password', 'expiry_date'])
+        },
+        {
+          template_key: 'expiration_warning',
+          subject: 'Your Photo Gallery Expires Soon',
+          body_html: `<h2>Gallery Expiring Soon</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days.</p>
+<p>After expiration, the gallery will be archived and no longer accessible to guests.</p>
+<p><a href="{{gallery_link}}">Visit Gallery</a></p>`,
+          body_text: 'Gallery Expiring Soon\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" will expire in {{days_remaining}} days.',
+          variables: JSON.stringify(['host_name', 'event_name', 'days_remaining', 'gallery_link'])
+        }
+      ]);
+      console.log('Default email templates created');
+    }
+
+    // Create default email config if none exists
+    const emailConfig = await db('email_configs').first();
+    if (!emailConfig) {
+      await db('email_configs').insert({
+        smtp_host: process.env.SMTP_HOST || 'mailhog',
+        smtp_port: process.env.SMTP_PORT || 1025,
+        smtp_secure: process.env.SMTP_SECURE === 'true',
+        smtp_user: process.env.SMTP_USER || '',
+        smtp_pass: process.env.SMTP_PASS || '',
+        from_email: process.env.EMAIL_FROM || '[email protected]',
+        from_name: 'Photo Sharing'
+      });
+      console.log('Default email configuration created');
+    }
+
+    console.log('Migrations completed successfully');
+    process.exit(0);
+  } catch (error) {
+    console.error('Migration failed:', error);
+    process.exit(1);
+  }
+}
+
+runMigrations();

backend/migrations/run-migrations-safe.js

@@ -0,0 +1,170 @@
+const fs = require('fs').promises;
+const path = require('path');
+const { db } = require('../src/database/db');
+
+/**
+ * Production-safe migration runner that handles existing schema
+ */
+
+// Create or verify migrations tracking table
+async function ensureMigrationsTable() {
+  const tableExists = await db.schema.hasTable('migrations');
+  if (!tableExists) {
+    await db.schema.createTable('migrations', (table) => {
+      table.increments('id').primary();
+      table.string('filename').unique().notNullable();
+      table.timestamp('applied_at').defaultTo(db.fn.now());
+    });
+    console.log('Created migrations tracking table');
+  }
+}
+
+// Check if a migration has been applied
+async function isMigrationApplied(filename) {
+  const result = await db('migrations').where('filename', filename).first();
+  return !!result;
+}
+
+// Mark migration as applied without running it (for existing schema)
+async function markMigrationAsApplied(filename) {
+  await db('migrations').insert({ filename });
+  console.log(`Marked migration ${filename} as applied`);
+}
+
+// Detect existing schema and mark migrations as applied
+async function detectExistingSchema() {
+  console.log('Detecting existing schema...');
+  
+  const tableChecks = [
+    { table: 'events', migration: 'init.js' },
+    { table: 'photos', migration: 'init.js' },
+    { table: 'photo_categories', migration: '004_add_categories_and_cms.js' },
+    { table: 'cms_pages', migration: '004_add_categories_and_cms.js' },
+    { table: 'login_attempts', migration: '015_add_login_attempts_table.js' },
+    { table: 'token_blacklist', migration: '017_add_token_revocation_tables.js' },
+  ];
+  
+  for (const check of tableChecks) {
+    const exists = await db.schema.hasTable(check.table);
+    if (exists) {
+      const isApplied = await isMigrationApplied(check.migration);
+      if (!isApplied) {
+        await markMigrationAsApplied(check.migration);
+      }
+    }
+  }
+}
+
+// Run a single migration safely
+async function runMigrationSafely(filename) {
+  try {
+    const migrationPath = path.join(__dirname, filename);
+    const migration = require(migrationPath);
+    
+    if (migration.up) {
+      console.log(`Running migration: ${filename}`);
+      
+      // Run migration in a transaction if possible
+      if (db.client.config.client === 'pg') {
+        await db.transaction(async (trx) => {
+          await migration.up(trx);
+        });
+      } else {
+        await migration.up(db);
+      }
+      
+      await db('migrations').insert({ filename });
+      console.log(`Migration ${filename} completed successfully`);
+    }
+  } catch (error) {
+    // Check if error is because schema already exists
+    if (error.code === '42P07' || // PostgreSQL: relation already exists
+        error.code === 'SQLITE_ERROR' && error.message.includes('already exists')) {
+      console.log(`Migration ${filename} - schema already exists, marking as applied`);
+      await markMigrationAsApplied(filename);
+    } else {
+      throw error;
+    }
+  }
+}
+
+// Main migration runner
+async function runMigrations() {
+  let connection;
+  try {
+    console.log('Starting production-safe database migrations...');
+    
+    // Ensure database connection is ready
+    await db.raw('SELECT 1');
+    console.log('Database connection verified');
+    
+    // Create migrations tracking table
+    await ensureMigrationsTable();
+    
+    // Detect and mark existing schema
+    await detectExistingSchema();
+    
+    // Get all migration files
+    const files = await fs.readdir(__dirname);
+    const migrationFiles = files
+      .filter(f => f.match(/^\d{3}_.*\.js$/) || f === 'init.js')
+      .sort((a, b) => {
+        // Ensure init.js runs first
+        if (a === 'init.js') return -1;
+        if (b === 'init.js') return 1;
+        return a.localeCompare(b);
+      });
+    
+    // Run pending migrations
+    let pendingCount = 0;
+    let skippedCount = 0;
+    
+    for (const file of migrationFiles) {
+      const isApplied = await isMigrationApplied(file);
+      if (!isApplied) {
+        await runMigrationSafely(file);
+        pendingCount++;
+      } else {
+        skippedCount++;
+      }
+    }
+    
+    console.log(`\nMigration Summary:`);
+    console.log(`- Applied: ${pendingCount} migration(s)`);
+    console.log(`- Skipped: ${skippedCount} migration(s) (already applied)`);
+    console.log(`- Total: ${migrationFiles.length} migration(s)`);
+    console.log('\nAll migrations completed successfully');
+    
+    // Close database connection
+    await db.destroy();
+    process.exit(0);
+  } catch (error) {
+    console.error('\n❌ Migration failed:', error.message);
+    console.error('Error details:', error);
+    
+    // Close database connection on error
+    try {
+      await db.destroy();
+    } catch (e) {
+      // Ignore
+    }
+    
+    process.exit(1);
+  }
+}
+
+// Add delay for database readiness in production
+async function waitAndRun() {
+  if (process.env.NODE_ENV === 'production') {
+    console.log('Waiting 2 seconds for database readiness...');
+    await new Promise(resolve => setTimeout(resolve, 2000));
+  }
+  await runMigrations();
+}
+
+// Only run if called directly
+if (require.main === module) {
+  waitAndRun();
+}
+
+module.exports = { runMigrations };

backend/migrations/run-migrations.js

@@ -0,0 +1,90 @@
+const fs = require('fs').promises;
+const path = require('path');
+const { db } = require('../src/database/db');
+
+// Create migrations table if it doesn't exist
+async function createMigrationsTable() {
+  const tableExists = await db.schema.hasTable('migrations');
+  if (!tableExists) {
+    await db.schema.createTable('migrations', (table) => {
+      table.increments('id').primary();
+      table.string('filename').unique().notNullable();
+      table.timestamp('applied_at').defaultTo(db.fn.now());
+    });
+    console.log('Created migrations table');
+  }
+}
+
+// Get list of applied migrations
+async function getAppliedMigrations() {
+  const migrations = await db('migrations').select('filename');
+  return migrations.map(m => m.filename);
+}
+
+// Run a single migration
+async function runMigration(filename) {
+  const migrationPath = path.join(__dirname, filename);
+  const migration = require(migrationPath);
+  
+  if (migration.up) {
+    console.log(`Running migration: ${filename}`);
+    await migration.up(db);
+    await db('migrations').insert({ filename });
+    console.log(`Migration ${filename} completed`);
+  }
+}
+
+// Main migration runner
+async function runMigrations() {
+  try {
+    console.log('Starting database migrations...');
+    
+    // First run the init.js if it exists but only if migrations table doesn't exist
+    const tableExists = await db.schema.hasTable('migrations');
+    if (!tableExists) {
+      const { initializeDatabase } = require('../src/database/db');
+      console.log('Running initial database setup...');
+      await initializeDatabase();
+    }
+    
+    // Create migrations table
+    await createMigrationsTable();
+    
+    // Get all migration files
+    const files = await fs.readdir(__dirname);
+    const migrationFiles = files
+      .filter(f => f.match(/^\d{3}_.*\.js$/))
+      .sort();
+    
+    // Get applied migrations
+    const appliedMigrations = await getAppliedMigrations();
+    
+    // Run pending migrations
+    let pendingCount = 0;
+    for (const file of migrationFiles) {
+      if (!appliedMigrations.includes(file)) {
+        await runMigration(file);
+        pendingCount++;
+      }
+    }
+    
+    if (pendingCount === 0) {
+      console.log('No pending migrations');
+    } else {
+      console.log(`Applied ${pendingCount} migration(s)`);
+    }
+    
+    console.log('All migrations completed successfully');
+    process.exit(0);
+  } catch (error) {
+    console.error('Migration failed:', error);
+    process.exit(1);
+  }
+}
+
+// Only run if called directly
+if (require.main === module) {
+  runMigrations();
+}
+
+module.exports = { runMigrations };

backend/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "picpeak-backend",
+  "version": "1.0.64",
+  "description": "Backend for PicPeak event photo sharing platform",
+  "main": "server.js",
+  "scripts": {
+    "start": "node server.js",
+    "dev": "nodemon server.js",
+    "migrate": "node migrations/run-migrations.js",
+    "migrate:safe": "node migrations/run-migrations-safe.js",
+    "fix-temp-photos": "node scripts/fix-temp-photos.js",
+    "test": "jest",
+    "lint": "eslint src/"
+  },
+  "dependencies": {
+    "adm-zip": "^0.5.16",
+    "archiver": "^5.3.1",
+    "axios": "^1.10.0",
+    "bcrypt": "^5.1.0",
+    "chokidar": "^3.5.3",
+    "cors": "^2.8.5",
+    "dotenv": "^16.0.3",
+    "express": "^4.18.2",
+    "express-rate-limit": "^6.7.0",
+    "express-validator": "^7.0.1",
+    "form-data": "^4.0.3",
+    "handlebars": "^4.7.8",
+    "helmet": "^7.0.0",
+    "i18next": "^25.3.1",
+    "i18next-browser-languagedetector": "^8.2.0",
+    "i18next-http-backend": "^3.0.2",
+    "joi": "^17.9.1",
+    "jsonwebtoken": "^9.0.0",
+    "knex": "^2.4.2",
+    "multer": "^2.0.1",
+    "node-cron": "^3.0.2",
+    "nodemailer": "^6.9.1",
+    "pg": "^8.16.3",
+    "react-i18next": "^15.6.0",
+    "sharp": "^0.32.0",
+    "sqlite3": "^5.1.6",
+    "uuid": "^11.1.0",
+    "winston": "^3.8.2",
+    "zxcvbn": "^4.4.2"
+  },
+  "devDependencies": {
+    "eslint": "^8.40.0",
+    "jest": "^29.5.0",
+    "nodemon": "^3.1.10",
+    "supertest": "^6.3.3"
+  }
+}

backend/scripts/check-db-issues.js

@@ -0,0 +1,60 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function checkDatabaseIssues() {
+  console.log('Checking database issues...\n');
+  
+  try {
+    // Check email_templates table structure
+    console.log('1. Checking email_templates table structure:');
+    const emailTemplateColumns = await db('email_templates').columnInfo();
+    console.log('Columns:', Object.keys(emailTemplateColumns));
+    
+    // Check if any templates exist
+    const templateCount = await db('email_templates').count('* as count');
+    console.log('Template count:', templateCount[0].count);
+    
+    // Check for specific template
+    const galleryCreatedTemplate = await db('email_templates')
+      .where('template_key', 'gallery_created')
+      .first();
+    console.log('gallery_created template exists:', !!galleryCreatedTemplate);
+    
+    // Check activity_logs table
+    console.log('\n2. Checking activity_logs table:');
+    const activityLogColumns = await db('activity_logs').columnInfo();
+    console.log('Columns:', Object.keys(activityLogColumns));
+    
+    // Check migrations table
+    console.log('\n3. Checking migrations status:');
+    const migrations = await db('migrations')
+      .orderBy('id', 'desc')
+      .limit(10);
+    console.log('Latest migrations:');
+    migrations.forEach(m => console.log(`  - ${m.filename}`));
+    
+    // Test a simple query from notifications route
+    console.log('\n4. Testing notifications query:');
+    try {
+      const notifications = await db('activity_logs')
+        .select(
+          'activity_logs.*',
+          'events.event_name'
+        )
+        .leftJoin('events', 'activity_logs.event_id', 'events.id')
+        .orderBy('activity_logs.created_at', 'desc')
+        .limit(5);
+      console.log(`Found ${notifications.length} notifications`);
+    } catch (error) {
+      console.error('Notifications query failed:', error.message);
+    }
+    
+  } catch (error) {
+    console.error('Error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+checkDatabaseIssues();

backend/scripts/check-db-schema.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+
+const sqlite3 = require('sqlite3').verbose();
+
+// Connect to the database
+const dbPath = '/app/data/photo_sharing.db';
+console.log(`Connecting to database at: ${dbPath}`);
+
+const db = new sqlite3.Database(dbPath, sqlite3.OPEN_READONLY, (err) => {
+  if (err) {
+    console.error('Error opening database:', err.message);
+    process.exit(1);
+  }
+  console.log('Connected to the SQLite database.\n');
+});
+
+// Get schema for events table
+console.log('=== EVENTS TABLE SCHEMA ===');
+db.all("PRAGMA table_info(events)", [], (err, rows) => {
+  if (err) {
+    console.error('Error getting events schema:', err.message);
+  } else {
+    rows.forEach(row => {
+      console.log(`${row.name} (${row.type})`);
+    });
+  }
+  
+  console.log('\n=== PHOTOS TABLE SCHEMA ===');
+  // Get schema for photos table
+  db.all("PRAGMA table_info(photos)", [], (err, rows) => {
+    if (err) {
+      console.error('Error getting photos schema:', err.message);
+    } else {
+      rows.forEach(row => {
+        console.log(`${row.name} (${row.type})`);
+      });
+    }
+    
+    // Close the database
+    db.close();
+  });
+});

backend/scripts/check-email-environment.js

@@ -0,0 +1,131 @@
+const { db } = require('../src/database/db');
+
+async function checkEmailEnvironment() {
+  console.log('=== Email Environment Check ===\n');
+  
+  // 1. Check environment variables
+  console.log('1. Environment Variables:');
+  const envVars = [
+    'SMTP_HOST',
+    'SMTP_PORT',
+    'SMTP_USER',
+    'SMTP_PASS',
+    'SMTP_FROM',
+    'SMTP_SECURE',
+    'EMAIL_PROCESSOR_ENABLED',
+    'NODE_ENV'
+  ];
+  
+  envVars.forEach(varName => {
+    const value = process.env[varName];
+    if (varName.includes('PASS')) {
+      console.log(`   ${varName}: ${value ? '***' : 'NOT SET'}`);
+    } else {
+      console.log(`   ${varName}: ${value || 'NOT SET'}`);
+    }
+  });
+  
+  // 2. Check database configuration
+  console.log('\n2. Database Email Configuration:');
+  try {
+    const emailConfig = await db('email_configs').first();
+    if (emailConfig) {
+      console.log('   Email configuration found in database:');
+      console.log(`   - SMTP Host: ${emailConfig.smtp_host}`);
+      console.log(`   - SMTP Port: ${emailConfig.smtp_port}`);
+      console.log(`   - SMTP User: ${emailConfig.smtp_user || 'NOT SET'}`);
+      console.log(`   - SMTP Secure: ${emailConfig.smtp_secure}`);
+      console.log(`   - From Address: ${emailConfig.smtp_from}`);
+    } else {
+      console.log('   ⚠️  No email configuration found in database!');
+      console.log('   This will prevent the email processor from initializing.');
+    }
+  } catch (error) {
+    console.log(`   ❌ Error reading email configuration: ${error.message}`);
+  }
+  
+  // 3. Check if the email processor should be disabled
+  console.log('\n3. Email Processor Status:');
+  const isDisabled = process.env.EMAIL_PROCESSOR_ENABLED === 'false';
+  if (isDisabled) {
+    console.log('   ⚠️  Email processor is DISABLED via EMAIL_PROCESSOR_ENABLED=false');
+  } else {
+    console.log('   ✅ Email processor is enabled (default)');
+  }
+  
+  // 4. Check pending emails
+  console.log('\n4. Email Queue Status:');
+  try {
+    const pending = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count')
+      .first();
+    
+    const failed = await db('email_queue')
+      .where('status', 'failed')
+      .where('retry_count', '>=', 3)
+      .count('* as count')
+      .first();
+    
+    const sent = await db('email_queue')
+      .where('status', 'sent')
+      .count('* as count')
+      .first();
+    
+    console.log(`   - Pending emails: ${pending.count}`);
+    console.log(`   - Failed emails (max retries): ${failed.count}`);
+    console.log(`   - Sent emails: ${sent.count}`);
+  } catch (error) {
+    console.log(`   ❌ Error querying email queue: ${error.message}`);
+  }
+  
+  // 5. Test database connection
+  console.log('\n5. Database Connection:');
+  try {
+    await db.raw('SELECT 1');
+    console.log('   ✅ Database connection successful');
+  } catch (error) {
+    console.log(`   ❌ Database connection failed: ${error.message}`);
+  }
+  
+  // 6. Check for any recent errors
+  console.log('\n6. Recent Email Errors:');
+  try {
+    const recentErrors = await db('email_queue')
+      .whereNotNull('error_message')
+      .orderBy('id', 'desc')
+      .limit(3)
+      .select('id', 'email_type', 'error_message', 'retry_count');
+    
+    if (recentErrors.length > 0) {
+      recentErrors.forEach((email, index) => {
+        console.log(`   ${index + 1}. Email ID ${email.id} (${email.email_type}):`);
+        console.log(`      Retries: ${email.retry_count}`);
+        console.log(`      Error: ${email.error_message}`);
+      });
+    } else {
+      console.log('   No recent errors found');
+    }
+  } catch (error) {
+    console.log(`   ❌ Error querying recent errors: ${error.message}`);
+  }
+  
+  console.log('\n=== Environment check complete ===');
+  console.log('\nRecommendations:');
+  
+  const emailConfig = await db('email_configs').first().catch(() => null);
+  if (!emailConfig) {
+    console.log('❗ Configure email settings in the admin panel or add email_configs record');
+  }
+  
+  if (!process.env.SMTP_HOST && !emailConfig) {
+    console.log('❗ Set SMTP environment variables or configure in database');
+  }
+  
+  await db.destroy();
+}
+
+checkEmailEnvironment().catch(error => {
+  console.error('Fatal error:', error);
+  process.exit(1);
+});

backend/scripts/check-email-processor.js

@@ -0,0 +1,157 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function checkEmailProcessor() {
+  try {
+    logger.info('=== Email Processor Diagnostic Check ===\n');
+    
+    // 1. Check pending emails
+    logger.info('1. Checking pending emails in queue...');
+    const pendingEmails = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .orderBy('created_at', 'asc');
+    
+    logger.info(`Found ${pendingEmails.length} pending emails\n`);
+    
+    if (pendingEmails.length > 0) {
+      logger.info('Pending email details:');
+      pendingEmails.forEach((email, index) => {
+        logger.info(`\nEmail ${index + 1}:`);
+        logger.info(`  ID: ${email.id}`);
+        logger.info(`  Type: ${email.email_type}`);
+        logger.info(`  Recipient: ${email.recipient_email}`);
+        logger.info(`  Event ID: ${email.event_id}`);
+        logger.info(`  Status: ${email.status}`);
+        logger.info(`  Retry Count: ${email.retry_count}`);
+        logger.info(`  Scheduled At: ${email.scheduled_at}`);
+        logger.info(`  Created At: ${email.created_at}`);
+        logger.info(`  Error: ${email.error_message || 'None'}`);
+        
+        // Check if email_data needs parsing
+        logger.info(`  Email Data Type: ${typeof email.email_data}`);
+        if (email.email_data) {
+          try {
+            const data = typeof email.email_data === 'string' 
+              ? JSON.parse(email.email_data) 
+              : email.email_data;
+            logger.info(`  Email Data Keys: ${Object.keys(data).join(', ')}`);
+          } catch (e) {
+            logger.error(`  Failed to parse email_data: ${e.message}`);
+          }
+        }
+      });
+    }
+    
+    // 2. Check failed emails
+    logger.info('\n\n2. Checking failed emails...');
+    const failedEmails = await db('email_queue')
+      .where('status', 'failed')
+      .orderBy('created_at', 'desc')
+      .limit(5);
+    
+    logger.info(`Found ${failedEmails.length} failed emails (showing last 5)\n`);
+    
+    if (failedEmails.length > 0) {
+      failedEmails.forEach((email, index) => {
+        logger.info(`\nFailed Email ${index + 1}:`);
+        logger.info(`  ID: ${email.id}`);
+        logger.info(`  Type: ${email.email_type}`);
+        logger.info(`  Retry Count: ${email.retry_count}`);
+        logger.info(`  Error: ${email.error_message || 'No error message'}`);
+        logger.info(`  Last Attempt: ${email.sent_at || 'Never'}`);
+      });
+    }
+    
+    // 3. Check if email processor should be running
+    logger.info('\n\n3. Checking email processor configuration...');
+    
+    // Check environment variables
+    const emailConfig = {
+      SMTP_HOST: process.env.SMTP_HOST,
+      SMTP_PORT: process.env.SMTP_PORT,
+      SMTP_USER: process.env.SMTP_USER,
+      SMTP_FROM: process.env.SMTP_FROM,
+      SMTP_SECURE: process.env.SMTP_SECURE,
+      EMAIL_PROCESSOR_ENABLED: process.env.EMAIL_PROCESSOR_ENABLED || 'true'
+    };
+    
+    logger.info('Email configuration:');
+    Object.entries(emailConfig).forEach(([key, value]) => {
+      if (key === 'SMTP_USER') {
+        logger.info(`  ${key}: ${value ? '***' : 'NOT SET'}`);
+      } else {
+        logger.info(`  ${key}: ${value || 'NOT SET'}`);
+      }
+    });
+    
+    // 4. Test email processor functionality
+    logger.info('\n\n4. Testing email processor functionality...');
+    
+    // Import the email processor
+    const { processEmailQueue, testEmailConnection } = require('../src/services/emailProcessor');
+    
+    // Test email connection
+    logger.info('Testing email connection...');
+    try {
+      const connectionTest = await testEmailConnection();
+      logger.info(`Email connection test: ${connectionTest ? 'SUCCESS' : 'FAILED'}`);
+    } catch (error) {
+      logger.error(`Email connection test failed: ${error.message}`);
+    }
+    
+    // Try to process queue once manually
+    if (pendingEmails.length > 0) {
+      logger.info('\n\n5. Attempting to process email queue manually...');
+      try {
+        await processEmailQueue();
+        logger.info('Manual queue processing completed');
+        
+        // Check status after processing
+        const stillPending = await db('email_queue')
+          .where('status', 'pending')
+          .where('retry_count', '<', 3)
+          .count('* as count')
+          .first();
+        
+        logger.info(`Emails still pending after processing: ${stillPending.count}`);
+      } catch (error) {
+        logger.error(`Error processing queue: ${error.message}`);
+        logger.error(`Stack trace: ${error.stack}`);
+      }
+    }
+    
+    // 5. Check for any recent successful emails
+    logger.info('\n\n6. Checking recent successful emails...');
+    const recentSuccess = await db('email_queue')
+      .where('status', 'sent')
+      .orderBy('sent_at', 'desc')
+      .limit(3);
+    
+    if (recentSuccess.length > 0) {
+      logger.info(`Last ${recentSuccess.length} successful emails:`);
+      recentSuccess.forEach((email, index) => {
+        logger.info(`  ${index + 1}. Type: ${email.email_type}, Sent: ${email.sent_at}`);
+      });
+    } else {
+      logger.info('No successfully sent emails found');
+    }
+    
+    logger.info('\n\n=== Diagnostic check complete ===');
+    
+  } catch (error) {
+    logger.error('Error running diagnostic check:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the check
+checkEmailProcessor();

backend/scripts/check-email-templates.js

@@ -0,0 +1,66 @@
+const { db } = require('../src/database/db');
+
+async function checkEmailTemplates() {
+  try {
+    console.log('=== Email Templates Check ===\n');
+    
+    // 1. Check table columns
+    console.log('1. Checking email_templates table structure...');
+    
+    // Check which columns exist
+    const columnChecks = [
+      'subject', 'subject_en', 'subject_de',
+      'body_html', 'body_html_en', 'body_html_de',
+      'body_text', 'body_text_en', 'body_text_de'
+    ];
+    
+    const existingColumns = [];
+    for (const col of columnChecks) {
+      const exists = await db.schema.hasColumn('email_templates', col);
+      if (exists) existingColumns.push(col);
+    }
+    
+    console.log('   Existing columns:', existingColumns.join(', '));
+    
+    // 2. Get all templates
+    console.log('\n2. Current email templates:');
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n   Template: ${template.template_key}`);
+      console.log('   -------------------');
+      
+      // Check which fields have content
+      const fields = ['subject', 'subject_en', 'subject_de', 
+                     'body_html', 'body_html_en', 'body_html_de',
+                     'body_text', 'body_text_en', 'body_text_de'];
+      
+      for (const field of fields) {
+        if (template[field]) {
+          const preview = template[field].substring(0, 50) + '...';
+          console.log(`   ${field}: ${preview}`);
+        }
+      }
+      
+      // Check for German translations
+      const hasGermanSubject = template.subject_de || template.body_html_de;
+      console.log(`   Has German translation: ${hasGermanSubject ? 'YES' : 'NO'}`);
+    }
+    
+    // 3. Summary
+    console.log('\n3. Summary:');
+    const totalTemplates = templates.length;
+    const templatesWithGerman = templates.filter(t => t.subject_de || t.body_html_de).length;
+    console.log(`   Total templates: ${totalTemplates}`);
+    console.log(`   Templates with German: ${templatesWithGerman}`);
+    console.log(`   Missing German: ${totalTemplates - templatesWithGerman}`);
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+checkEmailTemplates();

backend/scripts/check-german-templates.js

@@ -0,0 +1,53 @@
+const { db } = require('../src/database/db');
+
+async function checkGermanTemplates() {
+  try {
+    console.log('=== German Email Template Content Check ===\n');
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\nTemplate: ${template.template_key}`);
+      console.log('=====================================');
+      
+      // Check German subject
+      console.log('\nGERMAN SUBJECT:');
+      console.log(template.subject_de || 'MISSING');
+      
+      // Check if German HTML body has English content
+      console.log('\nGERMAN HTML BODY:');
+      const germanHtml = template.body_html_de || '';
+      
+      // Check for English phrases in German template
+      const englishPhrases = [
+        'Dear', 'Gallery', 'has been', 'Your photo', 'successfully',
+        'Details:', 'Link:', 'Password:', 'Expires:', 'Event Date:',
+        'Thank you', 'Best regards', 'View Gallery', 'days'
+      ];
+      
+      const foundEnglish = englishPhrases.filter(phrase => 
+        germanHtml.toLowerCase().includes(phrase.toLowerCase())
+      );
+      
+      if (foundEnglish.length > 0) {
+        console.log('⚠️  Found English phrases in German template:', foundEnglish.join(', '));
+      }
+      
+      // Show first 500 chars of German HTML
+      console.log(germanHtml.substring(0, 500) + '...\n');
+      
+      // Check German text body
+      console.log('GERMAN TEXT BODY:');
+      const germanText = template.body_text_de || '';
+      console.log(germanText.substring(0, 300) + '...\n');
+    }
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+checkGermanTemplates();

backend/scripts/check-storage.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+/**
+ * Script to check storage directory structure and verify files
+ * Usage: node scripts/check-storage.js [eventSlug]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+
+async function checkDirectory(dirPath, description) {
+  try {
+    await fs.access(dirPath);
+    const stats = await fs.stat(dirPath);
+    const files = await fs.readdir(dirPath);
+    console.log(`✓ ${description}: ${dirPath}`);
+    console.log(`  - Files/Folders: ${files.length}`);
+    console.log(`  - Permissions: ${(stats.mode & parseInt('777', 8)).toString(8)}`);
+    return true;
+  } catch (error) {
+    console.log(`✗ ${description}: ${dirPath} - ${error.message}`);
+    return false;
+  }
+}
+
+async function checkStorageStructure(eventSlug = null) {
+  console.log('Checking storage structure...');
+  console.log(`Storage base path: ${STORAGE_PATH}\n`);
+  
+  // Check main directories
+  await checkDirectory(STORAGE_PATH, 'Storage root');
+  await checkDirectory(path.join(STORAGE_PATH, 'events'), 'Events directory');
+  await checkDirectory(path.join(STORAGE_PATH, 'events/active'), 'Active events');
+  await checkDirectory(path.join(STORAGE_PATH, 'events/archived'), 'Archived events');
+  await checkDirectory(path.join(STORAGE_PATH, 'thumbnails'), 'Thumbnails');
+  await checkDirectory(path.join(STORAGE_PATH, 'uploads'), 'Uploads');
+  
+  console.log('\n---\n');
+  
+  // If event slug provided, check specific event
+  if (eventSlug) {
+    console.log(`Checking specific event: ${eventSlug}`);
+    
+    const event = await db('events').where('slug', eventSlug).first();
+    if (!event) {
+      console.log(`✗ Event not found in database: ${eventSlug}`);
+      return;
+    }
+    
+    console.log(`✓ Event found in database:`);
+    console.log(`  - ID: ${event.id}`);
+    console.log(`  - Name: ${event.event_name}`);
+    console.log(`  - Active: ${event.is_active}`);
+    console.log(`  - Archived: ${event.is_archived}`);
+    
+    // Check event directory
+    const eventDir = path.join(STORAGE_PATH, 'events/active', eventSlug);
+    const eventExists = await checkDirectory(eventDir, 'Event directory');
+    
+    if (eventExists) {
+      const files = await fs.readdir(eventDir);
+      console.log(`  - Photo files: ${files.filter(f => /\.(jpg|jpeg|png|gif)$/i.test(f)).length}`);
+    }
+    
+    // Check photos in database
+    const photos = await db('photos').where('event_id', event.id).select('id', 'filename', 'path', 'thumbnail_path');
+    console.log(`\nDatabase photos: ${photos.length}`);
+    
+    // Check if photo files exist
+    let existingPhotos = 0;
+    let missingPhotos = 0;
+    let existingThumbnails = 0;
+    let missingThumbnails = 0;
+    
+    for (const photo of photos) {
+      const photoPath = path.join(STORAGE_PATH, 'events/active', photo.path);
+      try {
+        await fs.access(photoPath);
+        existingPhotos++;
+      } catch {
+        missingPhotos++;
+        console.log(`  ✗ Missing photo: ${photo.path}`);
+      }
+      
+      if (photo.thumbnail_path) {
+        const thumbPath = path.join(STORAGE_PATH, photo.thumbnail_path.replace(/^\//, ''));
+        try {
+          await fs.access(thumbPath);
+          existingThumbnails++;
+        } catch {
+          missingThumbnails++;
+          console.log(`  ✗ Missing thumbnail: ${photo.thumbnail_path}`);
+        }
+      }
+    }
+    
+    console.log(`\nFile check summary:`);
+    console.log(`  - Photos: ${existingPhotos} exist, ${missingPhotos} missing`);
+    console.log(`  - Thumbnails: ${existingThumbnails} exist, ${missingThumbnails} missing`);
+  } else {
+    // List all event directories
+    try {
+      const activeDir = path.join(STORAGE_PATH, 'events/active');
+      const eventDirs = await fs.readdir(activeDir);
+      console.log(`Active event directories: ${eventDirs.length}`);
+      for (const dir of eventDirs.slice(0, 10)) {
+        console.log(`  - ${dir}`);
+      }
+      if (eventDirs.length > 10) {
+        console.log(`  ... and ${eventDirs.length - 10} more`);
+      }
+    } catch (error) {
+      console.log('Could not list event directories:', error.message);
+    }
+  }
+}
+
+// Parse command line arguments
+const eventSlug = process.argv[2] || null;
+
+// Run the script
+checkStorageStructure(eventSlug).then(async () => {
+  await db.destroy();
+  console.log('\nStorage check complete');
+}).catch(async error => {
+  console.error('Error:', error);
+  await db.destroy();
+  process.exit(1);
+});

backend/scripts/cleanup-thumbnails.js

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+
+/**
+ * Script to clean up orphaned and temporary thumbnails
+ * Usage: node scripts/cleanup-thumbnails.js [--dry-run]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function cleanupThumbnails(dryRun = false) {
+  console.log('Starting thumbnail cleanup...');
+  console.log(`Thumbnails directory: ${THUMBNAILS_DIR}`);
+  console.log(`Mode: ${dryRun ? 'DRY RUN' : 'LIVE'}\n`);
+  
+  try {
+    // Get all thumbnail files
+    const files = await fs.readdir(THUMBNAILS_DIR);
+    console.log(`Found ${files.length} files in thumbnails directory`);
+    
+    // Get all valid thumbnail paths from database
+    const validThumbnails = await db('photos')
+      .whereNotNull('thumbnail_path')
+      .select('thumbnail_path');
+    
+    const validPaths = new Set(
+      validThumbnails.map(t => path.basename(t.thumbnail_path))
+    );
+    
+    console.log(`Found ${validPaths.size} valid thumbnails in database\n`);
+    
+    let tempCount = 0;
+    let orphanedCount = 0;
+    let validCount = 0;
+    let deletedCount = 0;
+    
+    for (const file of files) {
+      // Skip directories
+      const filePath = path.join(THUMBNAILS_DIR, file);
+      const stats = await fs.stat(filePath);
+      if (stats.isDirectory()) continue;
+      
+      // Check if it's a temporary file
+      if (file.startsWith('thumb_temp_')) {
+        tempCount++;
+        console.log(`Temporary file: ${file}`);
+        
+        if (!dryRun) {
+          try {
+            await fs.unlink(filePath);
+            deletedCount++;
+          } catch (error) {
+            console.error(`  Failed to delete: ${error.message}`);
+          }
+        }
+      }
+      // Check if it's an orphaned thumbnail
+      else if (!validPaths.has(file)) {
+        orphanedCount++;
+        console.log(`Orphaned file: ${file}`);
+        
+        if (!dryRun) {
+          try {
+            await fs.unlink(filePath);
+            deletedCount++;
+          } catch (error) {
+            console.error(`  Failed to delete: ${error.message}`);
+          }
+        }
+      } else {
+        validCount++;
+      }
+    }
+    
+    console.log('\n--- Summary ---');
+    console.log(`Total files: ${files.length}`);
+    console.log(`Valid thumbnails: ${validCount}`);
+    console.log(`Temporary files: ${tempCount}`);
+    console.log(`Orphaned files: ${orphanedCount}`);
+    if (!dryRun) {
+      console.log(`Deleted files: ${deletedCount}`);
+    } else {
+      console.log(`Files to be deleted: ${tempCount + orphanedCount}`);
+    }
+    
+  } catch (error) {
+    console.error('Error during cleanup:', error);
+    process.exit(1);
+  }
+}
+
+// Parse command line arguments
+const dryRun = process.argv.includes('--dry-run');
+
+// Run the cleanup
+cleanupThumbnails(dryRun).then(async () => {
+  await db.destroy();
+  console.log('\nCleanup complete');
+}).catch(async error => {
+  console.error('Cleanup failed:', error);
+  await db.destroy();
+  process.exit(1);
+});

backend/scripts/create-admin.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+/**
+ * Script to create an admin user
+ * Usage: node scripts/create-admin.js --email [email protected] --username admin --password yourpassword
+ * 
+ * If no password is provided, a random one will be generated and displayed
+ */
+
+require('dotenv').config();
+const bcrypt = require('bcrypt');
+const { db } = require('../src/database/db');
+const crypto = require('crypto');
+
+// Parse command line arguments
+const args = process.argv.slice(2);
+const getArg = (name) => {
+  const index = args.findIndex(arg => arg === `--${name}`);
+  return index !== -1 && args[index + 1] ? args[index + 1] : null;
+};
+
+const email = getArg('email');
+const username = getArg('username') || email?.split('@')[0] || 'admin';
+let password = getArg('password');
+
+// Validate email
+if (!email) {
+  console.error('Error: Email is required. Use --email [email protected]');
+  process.exit(1);
+}
+
+// Generate password if not provided
+if (!password) {
+  password = crypto.randomBytes(12).toString('base64').slice(0, 16);
+  console.log(`Generated password: ${password}`);
+  console.log('Please save this password securely!');
+}
+
+async function createAdmin() {
+  try {
+    // Check if user already exists
+    const existingUser = await db('admin_users')
+      .where('email', email)
+      .orWhere('username', username)
+      .first();
+
+    if (existingUser) {
+      console.error(`Error: User with email "${email}" or username "${username}" already exists`);
+      process.exit(1);
+    }
+
+    // Hash password
+    const passwordHash = await bcrypt.hash(password, 10);
+
+    // Create admin user
+    await db('admin_users').insert({
+      username,
+      email,
+      password_hash: passwordHash,
+      is_active: true,
+      created_at: new Date(),
+      updated_at: new Date()
+    });
+
+    console.log(`✅ Admin user created successfully!`);
+    console.log(`   Email: ${email}`);
+    console.log(`   Username: ${username}`);
+    console.log(`   Login URL: ${process.env.ADMIN_URL || 'http://localhost:3000'}/admin/login`);
+    
+    process.exit(0);
+  } catch (error) {
+    console.error('Error creating admin user:', error.message);
+    process.exit(1);
+  }
+}
+
+createAdmin();

backend/scripts/create-test-event.js

@@ -0,0 +1,58 @@
+const path = require('path');
+require('dotenv').config({ path: path.join(__dirname, '../.env') });
+const { db } = require('../src/database/db');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { v4: uuidv4 } = require('uuid');
+
+async function createTestEvent() {
+  try {
+    console.log('Creating test event...');
+    
+    // Hash a simple password
+    const passwordHash = await bcrypt.hash('test123', 10);
+    
+    // Generate share token
+    const shareToken = uuidv4().replace(/-/g, '');
+    const shareLink = `http://localhost:3005/gallery/wedding-test123-2025-07-07/${shareToken}`;
+    
+    // Create event
+    const eventData = {
+      slug: 'wedding-test123-2025-07-07',
+      event_type: 'wedding',
+      event_name: 'Test Wedding',
+      event_date: '2025-07-07',
+      host_email: '[email protected]',
+      admin_email: '[email protected]',
+      password_hash: passwordHash,
+      welcome_message: 'Welcome to our test wedding gallery!',
+      color_theme: null, // Use global theme
+      is_active: 1,
+      expires_at: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),
+      share_link: shareLink
+    };
+    
+    // Delete existing event if it exists
+    await db('events').where('slug', eventData.slug).delete();
+    
+    // Insert new event
+    const insertResult = await db('events').insert(eventData).returning('id');
+    const eventId = insertResult[0]?.id || insertResult[0];
+    console.log('Event created with ID:', eventId);
+    
+    console.log('\nTest event created successfully!');
+    console.log('Event details:');
+    console.log('- Name:', eventData.event_name);
+    console.log('- Slug:', eventData.slug);
+    console.log('- Password:', 'test123');
+    console.log('- Share link:', shareLink);
+    console.log('\nYou can now access the gallery at the share link above');
+    
+    process.exit(0);
+  } catch (error) {
+    console.error('Error creating test event:', error);
+    process.exit(1);
+  }
+}
+
+createTestEvent();

backend/scripts/debug-500-errors.js

@@ -0,0 +1,92 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function debugEndpoints() {
+  console.log('Debugging 500 errors...\n');
+  
+  try {
+    // Test email templates query
+    console.log('1. Testing email templates query:');
+    try {
+      const templates = await db('email_templates')
+        .select('*')
+        .orderBy('template_key');
+      
+      console.log(`Found ${templates.length} templates`);
+      if (templates.length > 0) {
+        console.log('First template columns:', Object.keys(templates[0]));
+        console.log('Template keys:', templates.map(t => t.template_key));
+      }
+    } catch (error) {
+      console.error('Email templates query failed:', error.message);
+      console.error('Error code:', error.code);
+    }
+    
+    // Test notifications query
+    console.log('\n2. Testing notifications query:');
+    try {
+      const notifications = await db('activity_logs')
+        .select(
+          'activity_logs.*',
+          'events.event_name'
+        )
+        .leftJoin('events', 'activity_logs.event_id', 'events.id')
+        .whereNull('activity_logs.read_at')
+        .orderBy('activity_logs.created_at', 'desc')
+        .limit(5);
+      
+      console.log(`Found ${notifications.length} unread notifications`);
+    } catch (error) {
+      console.error('Notifications query failed:', error.message);
+      console.error('Error code:', error.code);
+      
+      // Check if it's a column issue
+      if (error.message.includes('column')) {
+        console.log('\nChecking activity_logs columns:');
+        const columns = await db('activity_logs').columnInfo();
+        console.log('Columns:', Object.keys(columns));
+      }
+    }
+    
+    // Test specific template query
+    console.log('\n3. Testing specific template query (gallery_created):');
+    try {
+      const template = await db('email_templates')
+        .where('template_key', 'gallery_created')
+        .first();
+      
+      if (template) {
+        console.log('Template found:', template.template_key);
+        console.log('Has subject_en?', template.subject_en !== undefined);
+        console.log('Has subject?', template.subject !== undefined);
+      } else {
+        console.log('Template not found');
+      }
+    } catch (error) {
+      console.error('Template query failed:', error.message);
+    }
+    
+    // Check CMS pages
+    console.log('\n4. Checking CMS pages:');
+    try {
+      const pages = await db('cms_pages')
+        .select('slug', 'title', 'is_published')
+        .orderBy('slug');
+      
+      console.log(`Found ${pages.length} CMS pages:`);
+      pages.forEach(page => {
+        console.log(`  - ${page.slug}: ${page.title} (published: ${page.is_published})`);
+      });
+    } catch (error) {
+      console.error('CMS pages query failed:', error.message);
+    }
+    
+  } catch (error) {
+    console.error('General error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+debugEndpoints();

backend/scripts/debug-email-queue.js

@@ -0,0 +1,146 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function debugEmailQueue() {
+  try {
+    logger.info('=== Email Queue Debug Report ===\n');
+    
+    // 1. Count exactly like the admin dashboard does
+    logger.info('1. Admin Dashboard Query (ALL pending, no retry filter):');
+    const [adminCount] = await db('email_queue').where('status', 'pending').count('* as count');
+    logger.info(`   Pending emails (admin dashboard view): ${adminCount.count}\n`);
+    
+    // 2. Count like the email processor does
+    logger.info('2. Email Processor Query (pending with retry_count < 3):');
+    const [processorCount] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .count('* as count');
+    logger.info(`   Pending emails (processor view): ${processorCount.count}\n`);
+    
+    // 3. Show the discrepancy
+    logger.info('3. Discrepancy Analysis:');
+    if (adminCount.count !== processorCount.count) {
+      logger.info(`   ⚠️  DISCREPANCY FOUND!`);
+      logger.info(`   Admin shows: ${adminCount.count}`);
+      logger.info(`   Processor will process: ${processorCount.count}`);
+      logger.info(`   Difference: ${adminCount.count - processorCount.count} email(s)\n`);
+      
+      // Find the problematic emails
+      logger.info('4. Emails with retry_count >= 3 (still pending):');
+      const stuckEmails = await db('email_queue')
+        .where('status', 'pending')
+        .where('retry_count', '>=', 3)
+        .select('*');
+      
+      if (stuckEmails.length > 0) {
+        logger.info(`   Found ${stuckEmails.length} stuck email(s):\n`);
+        stuckEmails.forEach((email, index) => {
+          logger.info(`   Email ${index + 1}:`);
+          logger.info(`     ID: ${email.id}`);
+          logger.info(`     Type: ${email.email_type}`);
+          logger.info(`     Recipient: ${email.recipient_email}`);
+          logger.info(`     Status: ${email.status}`);
+          logger.info(`     Retry Count: ${email.retry_count} ⚠️`);
+          logger.info(`     Created: ${email.created_at}`);
+          logger.info(`     Last Error: ${email.error_message || 'None'}\n`);
+        });
+      }
+    } else {
+      logger.info(`   ✅ No discrepancy - counts match\n`);
+    }
+    
+    // 5. Show ALL pending emails with details
+    logger.info('5. ALL Pending Emails (regardless of retry count):');
+    const allPending = await db('email_queue')
+      .where('status', 'pending')
+      .orderBy('retry_count', 'desc')
+      .orderBy('created_at', 'asc');
+    
+    if (allPending.length > 0) {
+      allPending.forEach((email, index) => {
+        const willProcess = email.retry_count < 3;
+        logger.info(`\n   Email ${index + 1}: ${willProcess ? '✅ WILL PROCESS' : '❌ STUCK (max retries)'}`);
+        logger.info(`     ID: ${email.id}`);
+        logger.info(`     Type: ${email.email_type}`);
+        logger.info(`     Recipient: ${email.recipient_email}`);
+        logger.info(`     Event ID: ${email.event_id}`);
+        logger.info(`     Retry Count: ${email.retry_count}/3`);
+        logger.info(`     Created: ${email.created_at}`);
+        logger.info(`     Scheduled: ${email.scheduled_at}`);
+        if (email.error_message) {
+          logger.info(`     Last Error: ${email.error_message}`);
+        }
+      });
+    } else {
+      logger.info('   No pending emails found');
+    }
+    
+    // 6. Show counts by status
+    logger.info('\n\n6. Email Queue Summary by Status:');
+    const statusCounts = await db('email_queue')
+      .select('status')
+      .count('* as count')
+      .groupBy('status')
+      .orderBy('status');
+    
+    statusCounts.forEach(row => {
+      logger.info(`   ${row.status}: ${row.count}`);
+    });
+    
+    // 7. Failed emails summary
+    logger.info('\n7. Failed Emails Summary:');
+    const failedSummary = await db('email_queue')
+      .where('status', 'failed')
+      .select('retry_count')
+      .count('* as count')
+      .groupBy('retry_count')
+      .orderBy('retry_count');
+    
+    if (failedSummary.length > 0) {
+      failedSummary.forEach(row => {
+        logger.info(`   Retry count ${row.retry_count}: ${row.count} email(s)`);
+      });
+    } else {
+      logger.info('   No failed emails');
+    }
+    
+    // 8. Recommendations
+    logger.info('\n\n=== RECOMMENDATIONS ===');
+    
+    if (adminCount.count > processorCount.count) {
+      logger.info('\n❗ You have emails stuck with retry_count >= 3');
+      logger.info('   These emails will NOT be processed automatically.');
+      logger.info('\n   To fix this, you can:');
+      logger.info('   1. Reset retry count: UPDATE email_queue SET retry_count = 0 WHERE status = \'pending\' AND retry_count >= 3;');
+      logger.info('   2. Mark as failed: UPDATE email_queue SET status = \'failed\' WHERE status = \'pending\' AND retry_count >= 3;');
+      logger.info('   3. Delete them: DELETE FROM email_queue WHERE status = \'pending\' AND retry_count >= 3;');
+    }
+    
+    const anyPending = adminCount.count > 0;
+    if (anyPending && processorCount.count === 0) {
+      logger.info('\n❗ All pending emails have exceeded retry limit');
+      logger.info('   The email processor will not attempt to send them.');
+    } else if (anyPending && processorCount.count > 0) {
+      logger.info('\n✅ Email processor should process the pending emails on next run');
+      logger.info('   Make sure the email processor service is running.');
+    }
+    
+    logger.info('\n=== Debug report complete ===');
+    
+  } catch (error) {
+    logger.error('Error running debug report:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the debug
+debugEmailQueue();

backend/scripts/diagnose-thumbnails.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+/**
+ * Script to diagnose thumbnail serving issues
+ * Usage: node scripts/diagnose-thumbnails.js <eventId>
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function diagnoseThumbnails(eventId) {
+  if (!eventId) {
+    console.error('Usage: node scripts/diagnose-thumbnails.js <eventId>');
+    process.exit(1);
+  }
+  
+  console.log(`Diagnosing thumbnails for event ID: ${eventId}`);
+  console.log(`Storage path: ${STORAGE_PATH}`);
+  console.log(`Thumbnails directory: ${THUMBNAILS_DIR}\n`);
+  
+  try {
+    // Get event info
+    const event = await db('events').where('id', eventId).first();
+    if (!event) {
+      console.error(`Event not found with ID: ${eventId}`);
+      return;
+    }
+    
+    console.log(`Event: ${event.event_name} (${event.slug})`);
+    console.log(`Active: ${event.is_active}, Archived: ${event.is_archived}\n`);
+    
+    // Get photos for this event
+    const photos = await db('photos')
+      .where('event_id', eventId)
+      .select('id', 'filename', 'path', 'thumbnail_path');
+    
+    console.log(`Found ${photos.length} photos in database\n`);
+    
+    let missingThumbnails = 0;
+    let existingThumbnails = 0;
+    let pathIssues = [];
+    
+    for (const photo of photos.slice(0, 10)) { // Check first 10 photos
+      console.log(`Photo ID ${photo.id}: ${photo.filename}`);
+      console.log(`  Photo path: ${photo.path}`);
+      console.log(`  Thumbnail path in DB: ${photo.thumbnail_path}`);
+      
+      if (photo.thumbnail_path) {
+        // Expected thumbnail filename
+        const expectedThumbName = `thumb_${photo.filename}`;
+        const expectedThumbPath = path.join(THUMBNAILS_DIR, expectedThumbName);
+        
+        // Check if thumbnail exists
+        try {
+          await fs.access(expectedThumbPath);
+          console.log(`  ✓ Thumbnail exists at: ${expectedThumbName}`);
+          existingThumbnails++;
+          
+          // Check if DB path matches expected path
+          const dbThumbName = path.basename(photo.thumbnail_path);
+          if (dbThumbName !== expectedThumbName) {
+            console.log(`  ⚠ Path mismatch! DB has: ${dbThumbName}, Expected: ${expectedThumbName}`);
+            pathIssues.push({
+              photoId: photo.id,
+              dbPath: photo.thumbnail_path,
+              expectedPath: `thumbnails/${expectedThumbName}`
+            });
+          }
+        } catch {
+          console.log(`  ✗ Thumbnail missing: ${expectedThumbName}`);
+          missingThumbnails++;
+        }
+      } else {
+        console.log(`  ✗ No thumbnail path in database`);
+        missingThumbnails++;
+      }
+      console.log('');
+    }
+    
+    console.log('--- Summary ---');
+    console.log(`Existing thumbnails: ${existingThumbnails}`);
+    console.log(`Missing thumbnails: ${missingThumbnails}`);
+    console.log(`Path issues: ${pathIssues.length}`);
+    
+    if (pathIssues.length > 0) {
+      console.log('\n--- Path Issues ---');
+      console.log('The following photos have incorrect thumbnail paths in the database:');
+      for (const issue of pathIssues) {
+        console.log(`Photo ID ${issue.photoId}:`);
+        console.log(`  Current: ${issue.dbPath}`);
+        console.log(`  Should be: ${issue.expectedPath}`);
+      }
+      
+      console.log('\nTo fix path issues, run:');
+      console.log(`UPDATE photos SET thumbnail_path = 'thumbnails/thumb_' || filename WHERE event_id = ${eventId};`);
+    }
+    
+    // Check for any thumbnails in the directory that match this event
+    const files = await fs.readdir(THUMBNAILS_DIR);
+    const eventThumbnails = files.filter(f => {
+      // Try to match thumbnails for this event
+      for (const photo of photos) {
+        if (f === `thumb_${photo.filename}`) return true;
+      }
+      return false;
+    });
+    
+    console.log(`\n--- Filesystem Check ---`);
+    console.log(`Found ${eventThumbnails.length} thumbnails in directory for this event`);
+    
+  } catch (error) {
+    console.error('Error during diagnosis:', error);
+    process.exit(1);
+  }
+}
+
+// Parse command line arguments
+const eventId = process.argv[2] ? parseInt(process.argv[2]) : null;
+
+// Run the diagnosis
+diagnoseThumbnails(eventId).then(async () => {
+  await db.destroy();
+  console.log('\nDiagnosis complete');
+}).catch(async error => {
+  console.error('Diagnosis failed:', error);
+  await db.destroy();
+  process.exit(1);
+});

backend/scripts/fix-email-queue-schema.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+
+/**
+ * Script to diagnose and fix email_queue schema issues
+ * This helps resolve the "column updated_at does not exist" error
+ */
+
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function checkAndFixEmailQueueSchema() {
+  console.log('Checking email_queue table schema...');
+  
+  try {
+    // Get column information
+    const columns = await db('email_queue').columnInfo();
+    console.log('\nCurrent email_queue columns:', Object.keys(columns));
+    
+    // Check for updated_at column
+    if (columns.updated_at) {
+      console.log('\n⚠️  Found unexpected updated_at column in email_queue table!');
+      console.log('This column should not exist and is causing errors.');
+      
+      // Ask for confirmation before removing
+      console.log('\nRemoving updated_at column...');
+      await db.schema.table('email_queue', (table) => {
+        table.dropColumn('updated_at');
+      });
+      console.log('✅ Removed updated_at column from email_queue table');
+    } else {
+      console.log('✅ No updated_at column found (this is correct)');
+    }
+    
+    // Verify required columns exist
+    const requiredColumns = [
+      'id', 'event_id', 'recipient_email', 'email_type', 
+      'email_data', 'status', 'scheduled_at', 'sent_at', 
+      'error_message', 'retry_count', 'created_at'
+    ];
+    
+    const missingColumns = requiredColumns.filter(col => !columns[col]);
+    if (missingColumns.length > 0) {
+      console.log('\n⚠️  Missing required columns:', missingColumns);
+    } else {
+      console.log('✅ All required columns are present');
+    }
+    
+    // Check for any database triggers
+    if (process.env.DATABASE_CLIENT === 'pg') {
+      console.log('\nChecking for PostgreSQL triggers on email_queue...');
+      const triggers = await db.raw(`
+        SELECT trigger_name, event_manipulation, action_statement
+        FROM information_schema.triggers
+        WHERE event_object_table = 'email_queue'
+        AND trigger_schema = current_schema()
+      `);
+      
+      if (triggers.rows && triggers.rows.length > 0) {
+        console.log('⚠️  Found triggers on email_queue table:');
+        triggers.rows.forEach(trigger => {
+          console.log(`  - ${trigger.trigger_name} (${trigger.event_manipulation})`);
+        });
+      } else {
+        console.log('✅ No triggers found on email_queue table');
+      }
+    }
+    
+    // Test update query
+    console.log('\nTesting update query...');
+    const testEmail = await db('email_queue')
+      .where('status', 'pending')
+      .first();
+    
+    if (testEmail) {
+      try {
+        await db('email_queue')
+          .where('id', testEmail.id)
+          .update({
+            retry_count: testEmail.retry_count
+          });
+        console.log('✅ Update query works correctly');
+      } catch (error) {
+        console.log('❌ Update query failed:', error.message);
+      }
+    } else {
+      console.log('ℹ️  No pending emails to test with');
+    }
+    
+    console.log('\nSchema check complete!');
+    
+  } catch (error) {
+    console.error('Error checking schema:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Run the check
+checkAndFixEmailQueueSchema();

backend/scripts/fix-final-german-templates.js

@@ -0,0 +1,88 @@
+const { db } = require('../src/database/db');
+
+async function fixFinalGermanTemplates() {
+  try {
+    console.log('Fixing remaining English words in German templates...\n');
+    
+    // Get all templates
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      let updated = false;
+      let updates = {};
+      
+      // Fix subject_de
+      if (template.subject_de) {
+        updates.subject_de = template.subject_de;
+      }
+      
+      // Fix body_html_de
+      if (template.body_html_de) {
+        let html = template.body_html_de;
+        
+        // Replace English words with German
+        html = html.replace(/Gallery-Details:/g, 'Galerie-Details:');
+        html = html.replace(/Galerie-Details:/g, 'Galerie-Details:');
+        html = html.replace(/Details:/g, 'Details:');
+        html = html.replace(/Link:/g, 'Link:');
+        html = html.replace(/Gallery-Link:/g, 'Galerie-Link:');
+        html = html.replace(/Galerie-Link:/g, 'Galerie-Link:');
+        html = html.replace(/Archive-Details:/g, 'Archiv-Details:');
+        html = html.replace(/Archiv-Details:/g, 'Archiv-Details:');
+        
+        if (html !== template.body_html_de) {
+          updates.body_html_de = html;
+          updated = true;
+        }
+      }
+      
+      // Fix body_text_de
+      if (template.body_text_de) {
+        let text = template.body_text_de;
+        
+        text = text.replace(/Gallery-Details:/g, 'Galerie-Details:');
+        text = text.replace(/Galerie-Details:/g, 'Galerie-Details:');
+        text = text.replace(/Details:/g, 'Details:');
+        text = text.replace(/Link:/g, 'Link:');
+        text = text.replace(/Gallery-Link:/g, 'Galerie-Link:');
+        text = text.replace(/Galerie-Link:/g, 'Galerie-Link:');
+        text = text.replace(/Archive-Details:/g, 'Archiv-Details:');
+        text = text.replace(/Archiv-Details:/g, 'Archiv-Details:');
+        
+        if (text !== template.body_text_de) {
+          updates.body_text_de = text;
+          updated = true;
+        }
+      }
+      
+      // Also update the non-language-specific fields to match German
+      if (template.body_html_de) {
+        updates.body_html = template.body_html_de;
+      }
+      if (template.body_text_de) {
+        updates.body_text = template.body_text_de;
+      }
+      if (template.subject_de) {
+        updates.subject = template.subject_de;
+      }
+      
+      if (updated || Object.keys(updates).length > 0) {
+        await db('email_templates')
+          .where('template_key', template.template_key)
+          .update(updates);
+        console.log(`✅ Updated ${template.template_key}`);
+      } else {
+        console.log(`⏭️  No changes needed for ${template.template_key}`);
+      }
+    }
+    
+    console.log('\nDone!');
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+fixFinalGermanTemplates();

backend/scripts/fix-production-issues.js

@@ -0,0 +1,145 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function fixProductionIssues() {
+  console.log('Fixing production database issues...\n');
+  
+  try {
+    // 1. Check and fix email_templates structure
+    console.log('1. Checking email_templates structure:');
+    const emailColumns = await db('email_templates').columnInfo();
+    console.log('Current columns:', Object.keys(emailColumns));
+    
+    // Check if we need to add basic columns back
+    const hasSubject = 'subject' in emailColumns;
+    const hasSubjectEn = 'subject_en' in emailColumns;
+    
+    if (hasSubjectEn && !hasSubject) {
+      console.log('Adding basic columns back to email_templates...');
+      await db.schema.alterTable('email_templates', (table) => {
+        table.string('subject');
+        table.text('body_html');
+        table.text('body_text');
+      });
+      
+      // Copy values from _en columns
+      await db('email_templates').update({
+        subject: db.raw('subject_en'),
+        body_html: db.raw('body_html_en'),
+        body_text: db.raw('body_text_en')
+      });
+      console.log('Basic columns added successfully');
+    }
+    
+    // 2. Ensure default templates exist
+    console.log('\n2. Checking email templates:');
+    const templateCount = await db('email_templates').count('* as count');
+    console.log('Template count:', templateCount[0].count);
+    
+    if (templateCount[0].count === 0) {
+      console.log('No templates found, inserting defaults...');
+      const defaultTemplates = [
+        {
+          template_key: 'gallery_created',
+          subject: 'Your Photo Gallery is Ready!',
+          body_html: '<h2>Gallery Created Successfully</h2>...',
+          body_text: 'Gallery Created Successfully...',
+          variables: JSON.stringify(['host_name', 'event_name', 'event_date', 'gallery_link', 'gallery_password', 'expiry_date'])
+        },
+        {
+          template_key: 'expiration_warning',
+          subject: 'Your Photo Gallery Expires Soon',
+          body_html: '<h2>Gallery Expiring Soon</h2>...',
+          body_text: 'Gallery Expiring Soon...',
+          variables: JSON.stringify(['host_name', 'event_name', 'days_remaining', 'gallery_link'])
+        },
+        {
+          template_key: 'gallery_expired',
+          subject: 'Your Photo Gallery Has Expired',
+          body_html: '<h2>Gallery Expired</h2>...',
+          body_text: 'Gallery Expired...',
+          variables: JSON.stringify(['host_name', 'event_name'])
+        },
+        {
+          template_key: 'archive_complete',
+          subject: 'Gallery Archive Complete',
+          body_html: '<h2>Archive Complete</h2>...',
+          body_text: 'Archive Complete...',
+          variables: JSON.stringify(['host_name', 'event_name', 'archive_size'])
+        }
+      ];
+      
+      for (const template of defaultTemplates) {
+        // Add language columns if they exist
+        if (hasSubjectEn) {
+          template.subject_en = template.subject;
+          template.body_html_en = template.body_html;
+          template.body_text_en = template.body_text;
+          template.subject_de = template.subject;
+          template.body_html_de = template.body_html;
+          template.body_text_de = template.body_text;
+        }
+        
+        await db('email_templates').insert(template);
+      }
+      console.log('Default templates inserted');
+    }
+    
+    // 3. Check activity_logs structure
+    console.log('\n3. Checking activity_logs structure:');
+    const activityColumns = await db('activity_logs').columnInfo();
+    console.log('Columns:', Object.keys(activityColumns));
+    
+    // Check if read_at exists
+    if (!('read_at' in activityColumns)) {
+      console.log('Adding read_at column to activity_logs...');
+      await db.schema.alterTable('activity_logs', (table) => {
+        table.datetime('read_at').nullable();
+      });
+      console.log('read_at column added');
+    }
+    
+    // 4. Check and add CMS pages
+    console.log('\n4. Checking CMS pages:');
+    const cmsColumns = await db('cms_pages').columnInfo();
+    console.log('CMS columns:', Object.keys(cmsColumns));
+    
+    const impressum = await db('cms_pages').where('slug', 'impressum').first();
+    const datenschutz = await db('cms_pages').where('slug', 'datenschutz').first();
+    
+    if (!impressum) {
+      console.log('Adding Impressum page...');
+      await db('cms_pages').insert({
+        slug: 'impressum',
+        title_en: 'Legal Notice',
+        title_de: 'Impressum',
+        content_en: '<h1>Legal Notice</h1><p>Your legal information here...</p>',
+        content_de: '<h1>Impressum</h1><p>Ihre rechtlichen Informationen hier...</p>',
+        updated_at: new Date()
+      });
+    }
+    
+    if (!datenschutz) {
+      console.log('Adding Datenschutz page...');
+      await db('cms_pages').insert({
+        slug: 'datenschutz',
+        title_en: 'Privacy Policy',
+        title_de: 'Datenschutzerklärung',
+        content_en: '<h1>Privacy Policy</h1><p>Your privacy policy here...</p>',
+        content_de: '<h1>Datenschutzerklärung</h1><p>Ihre Datenschutzerklärung hier...</p>',
+        updated_at: new Date()
+      });
+    }
+    
+    console.log('\n✅ All fixes applied successfully!');
+    
+  } catch (error) {
+    console.error('Error fixing issues:', error);
+    console.error('Stack:', error.stack);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+fixProductionIssues();

backend/scripts/fix-stuck-emails.js

@@ -0,0 +1,126 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function fixStuckEmails() {
+  try {
+    logger.info('=== Fix Stuck Emails Script ===\n');
+    
+    // 1. Find stuck emails
+    logger.info('1. Finding stuck emails (pending with retry_count >= 3)...');
+    const stuckEmails = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '>=', 3)
+      .select('*');
+    
+    if (stuckEmails.length === 0) {
+      logger.info('   ✅ No stuck emails found!');
+      logger.info('\n=== Script complete ===');
+      await db.destroy();
+      process.exit(0);
+    }
+    
+    logger.info(`   Found ${stuckEmails.length} stuck email(s)\n`);
+    
+    // 2. Show details
+    logger.info('2. Stuck email details:');
+    stuckEmails.forEach((email, index) => {
+      logger.info(`\n   Email ${index + 1}:`);
+      logger.info(`     ID: ${email.id}`);
+      logger.info(`     Type: ${email.email_type}`);
+      logger.info(`     Recipient: ${email.recipient_email}`);
+      logger.info(`     Retry Count: ${email.retry_count}`);
+      logger.info(`     Last Error: ${email.error_message || 'None'}`);
+    });
+    
+    // 3. Ask for action
+    logger.info('\n\n3. Choose an action:');
+    logger.info('   1. Reset retry count to 0 (emails will be retried)');
+    logger.info('   2. Mark as failed (emails will not be retried)');
+    logger.info('   3. Delete these emails');
+    logger.info('   4. Cancel (do nothing)');
+    
+    // Get command line argument
+    const action = process.argv[2];
+    
+    if (!action || !['reset', 'fail', 'delete'].includes(action)) {
+      logger.info('\n❗ No valid action specified');
+      logger.info('\nUsage:');
+      logger.info('  node fix-stuck-emails.js reset   - Reset retry count to 0');
+      logger.info('  node fix-stuck-emails.js fail    - Mark as failed');
+      logger.info('  node fix-stuck-emails.js delete  - Delete stuck emails');
+      await db.destroy();
+      process.exit(1);
+    }
+    
+    // 4. Execute action
+    logger.info(`\n4. Executing action: ${action.toUpperCase()}`);
+    
+    const emailIds = stuckEmails.map(e => e.id);
+    
+    switch (action) {
+      case 'reset':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .update({
+            retry_count: 0,
+            error_message: null
+          });
+        logger.info(`   ✅ Reset retry count for ${emailIds.length} email(s)`);
+        logger.info('   These emails will be processed on the next run');
+        break;
+        
+      case 'fail':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .update({
+            status: 'failed'
+          });
+        logger.info(`   ✅ Marked ${emailIds.length} email(s) as failed`);
+        logger.info('   These emails will not be retried');
+        break;
+        
+      case 'delete':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .delete();
+        logger.info(`   ✅ Deleted ${emailIds.length} email(s)`);
+        break;
+    }
+    
+    // 5. Show updated counts
+    logger.info('\n5. Updated email queue status:');
+    const [pendingCount] = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count');
+    const [processableCount] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .count('* as count');
+    
+    logger.info(`   Total pending: ${pendingCount.count}`);
+    logger.info(`   Processable (retry < 3): ${processableCount.count}`);
+    
+    if (pendingCount.count !== processableCount.count) {
+      logger.info(`   ⚠️  Still have ${pendingCount.count - processableCount.count} stuck email(s)`);
+    } else {
+      logger.info('   ✅ No stuck emails remaining');
+    }
+    
+    logger.info('\n=== Script complete ===');
+    
+  } catch (error) {
+    logger.error('Error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the fix
+fixStuckEmails();

backend/scripts/fix-temp-photos.js

@@ -0,0 +1,171 @@
+require('dotenv').config({ path: '../.env' });
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+const { generatePhotoFilename } = require('../src/utils/filenameSanitizer');
+
+async function fixTempPhotos() {
+  console.log('Starting to fix temporary photo files...\n');
+  
+  try {
+    // Find all photos with temp_ filenames
+    const tempPhotos = await db('photos')
+      .where('filename', 'like', 'temp_%')
+      .orderBy('event_id', 'asc')
+      .orderBy('category_id', 'asc')
+      .orderBy('id', 'asc');
+    
+    console.log(`Found ${tempPhotos.length} photos with temporary filenames\n`);
+    
+    if (tempPhotos.length === 0) {
+      console.log('No temporary photos found. Exiting.');
+      return;
+    }
+    
+    // Group photos by event and category
+    const grouped = {};
+    for (const photo of tempPhotos) {
+      const key = `${photo.event_id}_${photo.category_id || 'null'}`;
+      if (!grouped[key]) {
+        grouped[key] = [];
+      }
+      grouped[key].push(photo);
+    }
+    
+    console.log(`Processing ${Object.keys(grouped).length} event/category groups...\n`);
+    
+    // Process each group
+    for (const [key, photos] of Object.entries(grouped)) {
+      const [eventId, categoryIdStr] = key.split('_');
+      const categoryId = categoryIdStr === 'null' ? null : parseInt(categoryIdStr);
+      
+      console.log(`\nProcessing Event ID: ${eventId}, Category ID: ${categoryId || 'uncategorized'}`);
+      console.log(`Photos in group: ${photos.length}`);
+      
+      // Get event details
+      const event = await db('events').where({ id: eventId }).first();
+      if (!event) {
+        console.error(`Event ${eventId} not found! Skipping...`);
+        continue;
+      }
+      
+      // Get category details if applicable
+      let category = null;
+      let startCounter = 1;
+      
+      if (categoryId) {
+        category = await db('photo_categories').where({ id: categoryId }).first();
+        if (!category) {
+          console.error(`Category ${categoryId} not found! Treating as uncategorized...`);
+        } else {
+          // Get the highest counter for this category
+          const maxPhoto = await db('photos')
+            .where({ event_id: eventId, category_id: categoryId })
+            .whereNot('filename', 'like', 'temp_%')
+            .orderBy('id', 'desc')
+            .first();
+          
+          if (maxPhoto && maxPhoto.filename) {
+            // Extract counter from filename
+            const match = maxPhoto.filename.match(/_(\d+)\.[^.]+$/);
+            if (match) {
+              startCounter = parseInt(match[1]) + 1;
+            }
+          }
+        }
+      } else {
+        // For uncategorized, get the highest counter
+        const maxPhoto = await db('photos')
+          .where({ event_id: eventId })
+          .whereNull('category_id')
+          .whereNot('filename', 'like', 'temp_%')
+          .orderBy('id', 'desc')
+          .first();
+        
+        if (maxPhoto && maxPhoto.filename) {
+          const match = maxPhoto.filename.match(/_(\d+)\.[^.]+$/);
+          if (match) {
+            startCounter = parseInt(match[1]) + 1;
+          }
+        }
+      }
+      
+      console.log(`Starting counter: ${startCounter}`);
+      
+      // Process each photo in the group
+      let successCount = 0;
+      let errorCount = 0;
+      
+      for (let i = 0; i < photos.length; i++) {
+        const photo = photos[i];
+        const counter = startCounter + i;
+        
+        try {
+          // Generate new filename
+          const extension = path.extname(photo.filename);
+          const newFilename = generatePhotoFilename(
+            event.event_name,
+            category ? category.name : 'uncategorized',
+            counter,
+            extension
+          );
+          
+          // Build full paths
+          const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+          const oldPath = path.join(storagePath, 'events/active', photo.path);
+          const newPath = path.join(path.dirname(oldPath), newFilename);
+          
+          // Check if old file exists
+          try {
+            await fs.access(oldPath);
+          } catch (e) {
+            console.error(`File not found: ${oldPath}`);
+            errorCount++;
+            continue;
+          }
+          
+          // Rename the file
+          await fs.rename(oldPath, newPath);
+          
+          // Update database
+          const newRelativePath = path.relative(path.join(storagePath, 'events/active'), newPath);
+          await db('photos')
+            .where({ id: photo.id })
+            .update({
+              filename: newFilename,
+              path: newRelativePath
+            });
+          
+          console.log(`✓ Renamed: ${photo.filename} → ${newFilename}`);
+          successCount++;
+          
+        } catch (error) {
+          console.error(`✗ Failed to process photo ${photo.id}: ${error.message}`);
+          errorCount++;
+        }
+      }
+      
+      // Update category counter if needed
+      if (category && successCount > 0) {
+        const newCounter = startCounter + photos.length - 1;
+        await db('photo_categories')
+          .where({ id: categoryId })
+          .update({ photo_counter: newCounter });
+        console.log(`Updated category counter to ${newCounter}`);
+      }
+      
+      console.log(`\nGroup summary: ${successCount} successful, ${errorCount} errors`);
+    }
+    
+    console.log('\n=== COMPLETE ===');
+    console.log('All temporary photos have been processed.');
+    
+  } catch (error) {
+    console.error('Fatal error:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Run the script
+fixTempPhotos().catch(console.error);

backend/scripts/regenerate-thumbnails.js

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+
+/**
+ * Script to regenerate missing thumbnails for photos in the database
+ * Usage: node scripts/regenerate-thumbnails.js [eventId]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const sharp = require('sharp');
+const { db } = require('../src/database/db');
+
+// Configuration
+const THUMBNAIL_SIZE = 300;
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function ensureDirectoryExists(dirPath) {
+  try {
+    await fs.access(dirPath);
+  } catch {
+    await fs.mkdir(dirPath, { recursive: true });
+    console.log(`Created directory: ${dirPath}`);
+  }
+}
+
+async function generateThumbnail(photoPath, thumbnailPath) {
+  try {
+    await sharp(photoPath)
+      .resize(THUMBNAIL_SIZE, THUMBNAIL_SIZE, {
+        fit: 'cover',
+        position: 'center'
+      })
+      .jpeg({ quality: 80 })
+      .toFile(thumbnailPath);
+    
+    return true;
+  } catch (error) {
+    console.error(`Failed to generate thumbnail for ${photoPath}:`, error.message);
+    return false;
+  }
+}
+
+async function regenerateThumbnails(eventId = null) {
+  try {
+    console.log('Starting thumbnail regeneration...');
+    console.log(`Storage path: ${STORAGE_PATH}`);
+    console.log(`Thumbnails directory: ${THUMBNAILS_DIR}`);
+    
+    // Ensure thumbnails directory exists
+    await ensureDirectoryExists(THUMBNAILS_DIR);
+    
+    // Build query
+    let query = db('photos')
+      .join('events', 'photos.event_id', 'events.id')
+      .select(
+        'photos.id',
+        'photos.filename',
+        'photos.path',
+        'photos.thumbnail_path',
+        'events.slug as event_slug'
+      );
+    
+    if (eventId) {
+      query = query.where('photos.event_id', eventId);
+      console.log(`Filtering for event ID: ${eventId}`);
+    }
+    
+    const photos = await query;
+    console.log(`Found ${photos.length} photos to process`);
+    
+    let successCount = 0;
+    let skipCount = 0;
+    let errorCount = 0;
+    
+    for (const photo of photos) {
+      const photoPath = path.join(STORAGE_PATH, 'events/active', photo.path);
+      const thumbnailFilename = `thumb_${photo.filename}`;
+      const thumbnailPath = path.join(THUMBNAILS_DIR, thumbnailFilename);
+      
+      try {
+        // Check if photo file exists
+        await fs.access(photoPath);
+        
+        // Check if thumbnail already exists
+        try {
+          await fs.access(thumbnailPath);
+          console.log(`Thumbnail already exists for ${photo.filename}, skipping...`);
+          skipCount++;
+          continue;
+        } catch {
+          // Thumbnail doesn't exist, generate it
+        }
+        
+        console.log(`Generating thumbnail for ${photo.filename}...`);
+        const success = await generateThumbnail(photoPath, thumbnailPath);
+        
+        if (success) {
+          // Update database with thumbnail path
+          await db('photos')
+            .where('id', photo.id)
+            .update({
+              thumbnail_path: `thumbnails/${thumbnailFilename}`
+            });
+          
+          successCount++;
+          console.log(`✓ Generated thumbnail for ${photo.filename}`);
+        } else {
+          errorCount++;
+        }
+      } catch (error) {
+        console.error(`✗ Photo file not found: ${photoPath}`);
+        errorCount++;
+      }
+    }
+    
+    console.log('\nThumbnail regeneration complete!');
+    console.log(`- Successfully generated: ${successCount}`);
+    console.log(`- Skipped (already exist): ${skipCount}`);
+    console.log(`- Errors: ${errorCount}`);
+    console.log(`- Total processed: ${photos.length}`);
+    
+  } catch (error) {
+    console.error('Error during thumbnail regeneration:', error);
+    process.exit(1);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Parse command line arguments
+const eventId = process.argv[2] ? parseInt(process.argv[2]) : null;
+
+// Run the script
+regenerateThumbnails(eventId).then(() => {
+  console.log('Script completed successfully');
+  process.exit(0);
+}).catch(error => {
+  console.error('Script failed:', error);
+  process.exit(1);
+});

backend/scripts/reset-admin-password.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+
+const bcrypt = require('bcrypt');
+const { db } = require('../src/database/db');
+const { generateReadablePassword } = require('../src/utils/passwordGenerator');
+const fs = require('fs').promises;
+const path = require('path');
+const readline = require('readline');
+
+const rl = readline.createInterface({
+  input: process.stdin,
+  output: process.stdout
+});
+
+async function question(prompt) {
+  return new Promise((resolve) => {
+    rl.question(prompt, resolve);
+  });
+}
+
+async function resetAdminPassword() {
+  console.log('\n========================================');
+  console.log('PicPeak Admin Password Reset Tool');
+  console.log('========================================\n');
+
+  try {
+    // Check if admin user exists
+    const admin = await db('admin_users')
+      .where({ username: 'admin' })
+      .first();
+
+    if (!admin) {
+      console.error('❌ No admin user found in the database.');
+      console.log('Run migrations first: npm run migrate');
+      process.exit(1);
+    }
+
+    console.log('Found admin user:', admin.username);
+    console.log('Email:', admin.email);
+    console.log('\nThis will reset the password for this admin account.');
+    
+    const confirm = await question('\nDo you want to continue? (yes/no): ');
+    
+    if (confirm.toLowerCase() !== 'yes' && confirm.toLowerCase() !== 'y') {
+      console.log('\n❌ Password reset cancelled.');
+      process.exit(0);
+    }
+
+    // Generate new password
+    const newPassword = generateReadablePassword();
+    const passwordHash = await bcrypt.hash(newPassword, 12);
+
+    // Update the admin user
+    await db('admin_users')
+      .where({ username: 'admin' })
+      .update({
+        password_hash: passwordHash,
+        must_change_password: true,
+        updated_at: new Date()
+      });
+
+    // Save to file
+    const resetInfoPath = path.join(__dirname, '..', '..', 'ADMIN_PASSWORD_RESET.txt');
+    const resetInfo = `
+========================================
+PicPeak Admin Password Reset
+========================================
+
+Password has been reset for admin account:
+
+Username: admin
+New Password: ${newPassword}
+
+IMPORTANT:
+1. You MUST change this password on next login
+2. This file contains sensitive information
+3. Delete this file after noting the password
+
+Login URL: ${process.env.ADMIN_URL || 'http://localhost:3001'}/admin
+
+Reset performed on: ${new Date().toISOString()}
+========================================
+`;
+
+    await fs.writeFile(resetInfoPath, resetInfo, 'utf8');
+
+    console.log('\n✅ Password reset successful!\n');
+    console.log('========================================');
+    console.log('New Credentials:');
+    console.log('========================================');
+    console.log('Username: admin');
+    console.log(`Password: ${newPassword}`);
+    console.log('\n⚠️  IMPORTANT:');
+    console.log('1. You will be required to change this password on next login');
+    console.log('2. Credentials are also saved in: ADMIN_PASSWORD_RESET.txt');
+    console.log('3. Delete the file after noting the password');
+    console.log('========================================\n');
+
+  } catch (error) {
+    console.error('❌ Error resetting password:', error.message);
+    process.exit(1);
+  } finally {
+    rl.close();
+    process.exit(0);
+  }
+}
+
+// Run the reset
+resetAdminPassword();

backend/scripts/run-email-processor.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+
+const { db } = require('../src/database/db');
+const { 
+  initializeTransporter, 
+  processEmailQueue, 
+  testEmailConnection 
+} = require('../src/services/emailProcessor');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function runEmailProcessor(runOnce = false) {
+  try {
+    logger.info('=== Starting Email Processor ===\n');
+    
+    // Initialize transporter
+    logger.info('Initializing email transporter...');
+    await initializeTransporter();
+    
+    // Test connection
+    logger.info('Testing email connection...');
+    const connectionOk = await testEmailConnection();
+    
+    if (!connectionOk) {
+      logger.error('Email connection test failed! Check your SMTP configuration.');
+      logger.info('\nRequired environment variables:');
+      logger.info('- SMTP_HOST');
+      logger.info('- SMTP_PORT');
+      logger.info('- SMTP_USER');
+      logger.info('- SMTP_PASS');
+      logger.info('- SMTP_FROM');
+      process.exit(1);
+    }
+    
+    logger.info('Email connection test successful!\n');
+    
+    if (runOnce) {
+      // Process queue once
+      logger.info('Processing email queue once...');
+      await processEmailQueue();
+      logger.info('Email processing complete');
+      
+      // Show final status
+      const pendingCount = await db('email_queue')
+        .where('status', 'pending')
+        .where('retry_count', '<', 3)
+        .count('* as count')
+        .first();
+      
+      logger.info(`\nEmails still pending: ${pendingCount.count}`);
+      
+      await db.destroy();
+      process.exit(0);
+    } else {
+      // Run continuously
+      logger.info('Starting continuous email processor...');
+      logger.info('Processing emails every 60 seconds. Press Ctrl+C to stop.\n');
+      
+      // Process immediately
+      await processEmailQueue();
+      
+      // Then every minute
+      setInterval(async () => {
+        try {
+          await processEmailQueue();
+        } catch (error) {
+          logger.error('Error processing email queue:', error);
+        }
+      }, 60000);
+    }
+    
+  } catch (error) {
+    logger.error('Fatal error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+// Handle graceful shutdown
+process.on('SIGINT', async () => {
+  logger.info('\n\nShutting down email processor...');
+  await db.destroy();
+  process.exit(0);
+});
+
+// Check command line arguments
+const args = process.argv.slice(2);
+const runOnce = args.includes('--once') || args.includes('-o');
+
+if (args.includes('--help') || args.includes('-h')) {
+  console.log(`
+Email Processor Runner
+
+Usage: node run-email-processor.js [options]
+
+Options:
+  --once, -o     Process the email queue once and exit
+  --help, -h     Show this help message
+
+By default, the processor runs continuously, checking for emails every 60 seconds.
+  `);
+  process.exit(0);
+}
+
+// Run the processor
+runEmailProcessor(runOnce);

backend/scripts/run-migrations.js

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+
+/**
+ * Run database migrations using existing db connection
+ */
+
+const { db } = require('../src/database/db');
+
+async function runMigrations() {
+  console.log('Running database migrations...\n');
+  
+  try {
+    // Run all pending migrations
+    const result = await db.migrate.latest({
+      directory: './migrations'
+    });
+    
+    if (result[1].length === 0) {
+      console.log('✓ Database is already up to date');
+    } else {
+      console.log(`✓ Ran ${result[1].length} migrations:`);
+      result[1].forEach(migration => {
+        console.log(`  - ${migration}`);
+      });
+    }
+    
+    // Show current migration status
+    const list = await db.migrate.list();
+    console.log(`\nCurrent status: ${list[0].length} completed migrations`);
+    
+    await db.destroy();
+    process.exit(0);
+  } catch (error) {
+    console.error('Migration error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+runMigrations();

backend/scripts/test-cms-formatting.js

@@ -0,0 +1,52 @@
+/**
+ * Test script to verify CMS and email formatting improvements
+ */
+
+const { formatWelcomeMessage, nl2br } = require('../src/utils/formatters');
+
+console.log('Testing CMS and Email Formatting Improvements\n');
+
+// Test 1: Basic line break conversion
+console.log('Test 1: Basic line break conversion');
+const basicText = `Hello,
+This is line 1.
+This is line 2.
+
+This is line 4 with an extra break.`;
+
+console.log('Input:');
+console.log(basicText);
+console.log('\nOutput (nl2br):');
+console.log(nl2br(basicText));
+console.log('\n---\n');
+
+// Test 2: Welcome message formatting
+console.log('Test 2: Welcome message formatting');
+const welcomeMessage = `Dear guests,
+
+We're so excited to share these special moments with you!
+
+Please note:
+- Download your photos before the expiration date
+- The password is case-sensitive
+- Contact us if you have any issues
+
+Thank you for being part of our special day!
+
+Best regards,
+Sarah & John`;
+
+console.log('Input:');
+console.log(welcomeMessage);
+console.log('\nOutput (formatWelcomeMessage):');
+console.log(formatWelcomeMessage(welcomeMessage));
+console.log('\n---\n');
+
+// Test 3: Empty and edge cases
+console.log('Test 3: Edge cases');
+console.log('Empty string:', formatWelcomeMessage(''));
+console.log('Null:', formatWelcomeMessage(null));
+console.log('Only spaces:', formatWelcomeMessage('   \n   \n   '));
+console.log('Single line:', formatWelcomeMessage('This is a single line message'));
+
+console.log('\nAll tests completed!');

backend/scripts/test-german-emails.js

@@ -0,0 +1,85 @@
+const { db } = require('../src/database/db');
+const { processTemplate } = require('../src/services/emailProcessor');
+
+async function testGermanEmails() {
+  try {
+    console.log('=== Testing German Email Templates ===\n');
+    
+    // Test variables
+    const testVars = {
+      host_name: 'Max Mustermann',
+      event_name: 'Hochzeit Schmidt',
+      event_date: '15.07.2024',
+      gallery_link: 'https://example.com/gallery/test',
+      gallery_password: 'test1234',
+      expiry_date: '15.08.2024',
+      days_remaining: '7',
+      welcome_message: 'Herzlich willkommen zu unserer Hochzeitsgalerie!',
+      archive_size: '250 MB',
+      archive_date: '16.08.2024',
+      photo_count: '347',
+      admin_email: '[email protected]',
+      eventId: 1
+    };
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n========== ${template.template_key.toUpperCase()} ==========`);
+      
+      // Process German version
+      const germanResult = await processGermanTemplate(template, testVars);
+      
+      console.log('\n--- GERMAN VERSION ---');
+      console.log('Subject:', germanResult.subject);
+      console.log('\nHTML Preview (first 500 chars):');
+      console.log(germanResult.htmlBody.substring(0, 500) + '...\n');
+      
+      // Check for any remaining English text
+      const englishWords = ['Dear', 'Gallery', 'Details:', 'Link:', 'Password:', 'days', 'Thank you'];
+      const foundEnglish = englishWords.filter(word => 
+        germanResult.htmlBody.includes(word) || germanResult.subject.includes(word)
+      );
+      
+      if (foundEnglish.length > 0) {
+        console.log('⚠️  WARNING: Found English words:', foundEnglish.join(', '));
+      } else {
+        console.log('✅ No English words found in German template');
+      }
+    }
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+async function processGermanTemplate(template, variables) {
+  // Process template as German
+  const subjectField = 'subject_de';
+  const htmlField = 'body_html_de';
+  const textField = 'body_text_de';
+  
+  let subject = template[subjectField] || template.subject || '';
+  let htmlBody = template[htmlField] || template.body_html || '';
+  let textBody = template[textField] || template.body_text || '';
+  
+  // Replace variables
+  Object.keys(variables).forEach(key => {
+    const regex = new RegExp(`{{${key}}}`, 'g');
+    subject = subject.replace(regex, variables[key]);
+    htmlBody = htmlBody.replace(regex, variables[key]);
+    textBody = textBody.replace(regex, variables[key]);
+  });
+  
+  // Handle conditionals (simplified)
+  htmlBody = htmlBody.replace(/{{#if welcome_message}}[\s\S]*?{{\/if}}/g, (match) => {
+    return variables.welcome_message ? match.replace(/{{#if welcome_message}}|{{\/if}}/g, '') : '';
+  });
+  
+  return { subject, htmlBody, textBody };
+}
+
+testGermanEmails();

backend/scripts/test-photo-auth.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+
+/**
+ * Script to test photo authentication
+ * Usage: node scripts/test-photo-auth.js <jwt-token>
+ */
+
+const axios = require('axios');
+
+async function testPhotoAuth(token) {
+  if (!token) {
+    console.error('Usage: node scripts/test-photo-auth.js <jwt-token>');
+    console.error('\nTo get a token, login to a gallery and check localStorage for gallery_token_<slug>');
+    process.exit(1);
+  }
+
+  const baseUrl = process.env.API_URL || 'http://localhost:3001';
+  
+  console.log(`Testing photo authentication with token: ${token.substring(0, 20)}...`);
+  console.log(`Base URL: ${baseUrl}\n`);
+
+  // Test URLs
+  const tests = [
+    {
+      name: 'Thumbnail via static route',
+      url: `${baseUrl}/thumbnails/thumb_Test_Gallery_uncategorized_5210.jpg`,
+      headers: { 'Authorization': `Bearer ${token}` }
+    },
+    {
+      name: 'Photo via static route',
+      url: `${baseUrl}/photos/wedding-test-gallery-2025-07-14-1/Test_Gallery_uncategorized_5210.jpg`,
+      headers: { 'Authorization': `Bearer ${token}` }
+    },
+    {
+      name: 'Gallery photos API',
+      url: `${baseUrl}/api/gallery/wedding-test-gallery-2025-07-14-1/photos`,
+      headers: { 'Authorization': `Bearer ${token}` }
+    }
+  ];
+
+  for (const test of tests) {
+    console.log(`Testing: ${test.name}`);
+    console.log(`URL: ${test.url}`);
+    
+    try {
+      const response = await axios.get(test.url, {
+        headers: test.headers,
+        validateStatus: () => true // Don't throw on any status
+      });
+      
+      console.log(`Status: ${response.status}`);
+      console.log(`Headers:`, response.headers['content-type']);
+      
+      if (response.status === 200) {
+        if (test.name.includes('API')) {
+          console.log(`Photos count: ${response.data.photos?.length || 0}`);
+        } else {
+          console.log(`Content length: ${response.headers['content-length']} bytes`);
+        }
+      } else {
+        console.log(`Error:`, response.data);
+      }
+    } catch (error) {
+      console.log(`Network error:`, error.message);
+    }
+    
+    console.log('---\n');
+  }
+  
+  // Decode token to show info
+  try {
+    const parts = token.split('.');
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+    console.log('Token payload:', payload);
+  } catch (error) {
+    console.log('Failed to decode token');
+  }
+}
+
+// Get token from command line
+const token = process.argv[2];
+
+testPhotoAuth(token).catch(error => {
+  console.error('Test failed:', error);
+  process.exit(1);
+});

backend/scripts/test-security-logging.js

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+
+/**
+ * Test script to verify security logging is working correctly
+ * Run with: node scripts/test-security-logging.js
+ */
+
+require('dotenv').config({ path: '../.env' });
+const logger = require('../src/utils/logger');
+
+console.log('Testing Security Logging...\n');
+
+// Test 1: Basic logging
+console.log('1. Testing basic logging levels:');
+logger.info('Test info message', { test: true });
+logger.warn('Test warning message', { test: true });
+logger.error('Test error message', { test: true });
+
+// Test 2: Security event logging
+console.log('\n2. Testing security event logging:');
+
+// Rate limit exceeded
+logger.warn('Rate limit exceeded', {
+  ip: '192.168.1.100',
+  path: '/api/admin/login',
+  method: 'POST',
+  authenticated: false,
+  userAgent: 'Mozilla/5.0 Test',
+  timestamp: new Date().toISOString(),
+  rateLimitInfo: {
+    limit: 5,
+    current: 6,
+    remaining: 0,
+    resetTime: new Date(Date.now() + 900000).toISOString()
+  }
+});
+
+// Auth rate limit
+logger.warn('Auth rate limit exceeded', {
+  ip: '192.168.1.101',
+  path: '/api/auth/admin/login',
+  method: 'POST',
+  userAgent: 'Mozilla/5.0 Test',
+  authType: 'admin',
+  timestamp: new Date().toISOString()
+});
+
+// Failed login
+logger.warn('Failed login attempt', {
+  username: 'testuser',
+  ip: '192.168.1.102',
+  userAgent: 'Mozilla/5.0 Test',
+  reason: 'invalid_credentials',
+  timestamp: new Date().toISOString()
+});
+
+// JWT validation failure
+logger.warn('JWT validation failed', {
+  ip: '192.168.1.103',
+  path: '/api/admin/events',
+  method: 'GET',
+  userAgent: 'Mozilla/5.0 Test',
+  error: 'TokenExpiredError',
+  message: 'jwt expired',
+  timestamp: new Date().toISOString()
+});
+
+// Account lockout
+logger.warn('Login attempt on locked account', {
+  username: 'lockeduser',
+  ip: '192.168.1.104',
+  remainingLockTime: 1200,
+  timestamp: new Date().toISOString()
+});
+
+// Suspicious activity
+logger.warn('Suspicious login activity detected', {
+  username: 'suspicioususer',
+  ips: ['192.168.1.105', '192.168.1.106', '192.168.1.107'],
+  timeWindow: '15 minutes',
+  timestamp: new Date().toISOString()
+});
+
+console.log('\n3. Check log files:');
+console.log('- logs/security.log - Should contain all security warnings');
+console.log('- logs/error.log - Should contain error messages');
+console.log('- logs/combined.log - Should contain all messages');
+
+console.log('\n✅ Security logging test complete!');
+console.log('Review the log files to ensure all events are properly captured.');
+
+// Give logger time to flush
+setTimeout(() => {
+  process.exit(0);
+}, 1000);

backend/scripts/verify-template-equality.js

@@ -0,0 +1,110 @@
+const { db } = require('../src/database/db');
+
+async function verifyTemplateEquality() {
+  try {
+    console.log('Verifying template equality between German and English versions...\n');
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n=== ${template.template_key.toUpperCase()} ===`);
+      
+      // Check subject length similarity
+      const subjectEnLength = template.subject_en?.length || 0;
+      const subjectDeLength = template.subject_de?.length || 0;
+      console.log(`Subject length - EN: ${subjectEnLength}, DE: ${subjectDeLength}`);
+      
+      // Check HTML content features
+      const htmlEn = template.body_html_en || '';
+      const htmlDe = template.body_html_de || '';
+      
+      // Check for key features in both versions
+      const features = [
+        { name: 'Handlebars conditionals', pattern: /{{#if/g },
+        { name: 'Styled divs', pattern: /style="/g },
+        { name: 'Background colors', pattern: /background-color:/g },
+        { name: 'Buttons/CTAs', pattern: /<a.*style.*background-color.*>/g },
+        { name: 'Icons/Emojis', pattern: /[📧📞✅⚠️]/g },
+        { name: 'Lists', pattern: /<ul/g },
+        { name: 'Strong emphasis', pattern: /<strong>/g }
+      ];
+      
+      console.log('\nFeature comparison:');
+      for (const feature of features) {
+        const enCount = (htmlEn.match(feature.pattern) || []).length;
+        const deCount = (htmlDe.match(feature.pattern) || []).length;
+        const status = enCount === deCount ? '✅' : '❌';
+        console.log(`${status} ${feature.name}: EN=${enCount}, DE=${deCount}`);
+      }
+      
+      // Check text content length
+      const textEn = template.body_text_en || '';
+      const textDe = template.body_text_de || '';
+      console.log(`\nText content length - EN: ${textEn.length}, DE: ${textDe.length}`);
+      
+      // Check for specific variables usage
+      const variables = [
+        'host_name', 'event_name', 'event_date', 'gallery_link', 
+        'gallery_password', 'expiry_date', 'welcome_message',
+        'days_remaining', 'support_email', 'support_phone',
+        'archive_date', 'photo_count', 'archive_size'
+      ];
+      
+      const missingInEn = [];
+      const missingInDe = [];
+      
+      for (const variable of variables) {
+        const varPattern = new RegExp(`{{${variable}}}`, 'g');
+        const inEn = varPattern.test(htmlEn) || varPattern.test(textEn);
+        const inDe = varPattern.test(htmlDe) || varPattern.test(textDe);
+        
+        if (inDe && !inEn) missingInEn.push(variable);
+        if (inEn && !inDe) missingInDe.push(variable);
+      }
+      
+      if (missingInEn.length > 0) {
+        console.log(`\n⚠️  Variables in DE but missing in EN: ${missingInEn.join(', ')}`);
+      }
+      if (missingInDe.length > 0) {
+        console.log(`\n⚠️  Variables in EN but missing in DE: ${missingInDe.join(', ')}`);
+      }
+      
+      // Overall quality score
+      const enScore = [
+        htmlEn.includes('style='),
+        htmlEn.includes('{{#if'),
+        htmlEn.includes('background-color'),
+        htmlEn.includes('<strong>'),
+        htmlEn.includes('margin:'),
+        htmlEn.includes('padding:')
+      ].filter(Boolean).length;
+      
+      const deScore = [
+        htmlDe.includes('style='),
+        htmlDe.includes('{{#if'),
+        htmlDe.includes('background-color'),
+        htmlDe.includes('<strong>'),
+        htmlDe.includes('margin:'),
+        htmlDe.includes('padding:')
+      ].filter(Boolean).length;
+      
+      console.log(`\nQuality score (out of 6) - EN: ${enScore}, DE: ${deScore}`);
+      console.log(enScore === deScore ? '✅ Templates have equal quality!' : '❌ Quality mismatch');
+    }
+    
+    console.log('\n\nSummary:');
+    console.log('The English templates have been updated to match the German templates in:');
+    console.log('- HTML styling and structure');
+    console.log('- Conditional content blocks');
+    console.log('- Visual elements (buttons, alerts, icons)');
+    console.log('- Information completeness');
+    console.log('- Professional formatting');
+    
+  } catch (error) {
+    console.error('Error:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+verifyTemplateEquality();

backend/server.js

@@ -0,0 +1,260 @@
+require('dotenv').config();
+
+// Validate critical environment variables before proceeding
+const { validateEnvironment } = require('./src/config/validateEnv');
+validateEnvironment();
+
+// Initialize logger early to capture startup logs
+const logger = require('./src/utils/logger');
+logger.info('Server starting up', {
+  nodeVersion: process.version,
+  environment: process.env.NODE_ENV || 'development',
+  timestamp: new Date().toISOString()
+});
+
+const express = require('express');
+const helmet = require('helmet');
+const cors = require('cors');
+const path = require('path');
+const { initializeDatabase, db } = require('./src/database/db');
+const { startFileWatcher } = require('./src/services/fileWatcher');
+const { startExpirationChecker } = require('./src/services/expirationChecker');
+const { initializeTransporter, startEmailQueueProcessor } = require('./src/services/emailProcessor');
+const { maintenanceMiddleware } = require('./src/middleware/maintenance');
+const { sessionTimeoutMiddleware } = require('./src/middleware/sessionTimeout');
+const { createRateLimiter, createAuthRateLimiter } = require('./src/services/rateLimitService');
+const logger = require('./src/utils/logger');
+
+// Import routes
+const authRoutes = require('./src/routes/auth-enhanced');
+const eventRoutes = require('./src/routes/events');
+const galleryRoutes = require('./src/routes/gallery');
+const adminRoutes = require('./src/routes/admin');
+const adminAuthRoutes = require('./src/routes/adminAuth');
+
+const app = express();
+const PORT = process.env.PORT || 3000;
+
+// Trust proxy headers (required for Traefik/nginx)
+// Set to specific number of proxies or loopback to be more secure
+app.set('trust proxy', 'loopback, linklocal, uniquelocal');
+
+// Security middleware with custom CSP
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'", "'unsafe-inline'"], // Required for React
+      styleSrc: ["'self'", "'unsafe-inline'", "https:"], // Required for styled components
+      imgSrc: ["'self'", "data:", "https:", "blob:"], // Allow data URLs and external images
+      connectSrc: ["'self'"], // API connections
+      fontSrc: ["'self'", "https:", "data:"], // Web fonts
+      objectSrc: ["'none'"], // Disable plugins
+      mediaSrc: ["'self'"], // Audio/video
+      frameSrc: ["'none'"], // Disable iframes
+    },
+  },
+  hsts: {
+    maxAge: 31536000, // 1 year
+    includeSubDomains: true,
+    preload: true
+  },
+  permittedCrossDomainPolicies: false,
+  referrerPolicy: { policy: "strict-origin-when-cross-origin" }
+}));
+
+// Additional security headers
+app.use((req, res, next) => {
+  // Permissions Policy (controls browser features)
+  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()');
+  next();
+});
+
+// CORS configuration
+const corsOptions = {
+  origin: function (origin, callback) {
+    const allowedOrigins = [
+      process.env.FRONTEND_URL || 'http://localhost:3005',
+      process.env.ADMIN_URL || 'http://localhost:3005'
+    ];
+    
+    // In development, also allow localhost origins
+    if (process.env.NODE_ENV === 'development') {
+      allowedOrigins.push(
+        'http://localhost:5173', // Vite dev server
+        'http://localhost:3002', // Backend server
+        'http://localhost:3001', // For API testing
+        'http://localhost:3000'  // Direct backend access
+      );
+    }
+    
+    // Allow requests with no origin (like mobile apps or curl)
+    if (!origin || allowedOrigins.indexOf(origin) !== -1) {
+      callback(null, true);
+    } else {
+      callback(new Error('Not allowed by CORS'));
+    }
+  },
+  credentials: true
+};
+
+app.use(cors(corsOptions));
+
+// Initialize rate limiters (they will be created dynamically)
+let generalRateLimiter;
+let authRateLimiter;
+
+// Function to initialize rate limiters
+async function initializeRateLimiters() {
+  generalRateLimiter = await createRateLimiter();
+  authRateLimiter = await createAuthRateLimiter();
+  
+  // Apply rate limiting
+  app.use('/api/', generalRateLimiter);
+  app.use('/api/auth', authRateLimiter);
+  app.use('/api/gallery/:slug/verify', authRateLimiter);
+  app.use('/api/admin/auth/login', authRateLimiter);
+}
+
+// Note: Rate limiters will be initialized after database connection
+
+// Body parsing middleware with increased limits for large uploads
+app.use(express.json({ limit: '100mb' }));
+app.use(express.urlencoded({ extended: true, limit: '100mb' }));
+
+// Maintenance mode middleware - add after body parsing but before routes
+app.use(maintenanceMiddleware);
+
+// Session timeout middleware for admin routes
+app.use('/api/admin', sessionTimeoutMiddleware);
+
+// Middleware to set CORS headers for static files
+const setCorsHeaders = (req, res, next) => {
+  res.header('Access-Control-Allow-Origin', req.headers.origin || '*');
+  res.header('Access-Control-Allow-Credentials', 'true');
+  res.header('Cross-Origin-Resource-Policy', 'cross-origin');
+  next();
+};
+
+// Import secure static middleware
+const secureStatic = require('./src/middleware/secureStatic');
+
+// Get storage path from environment or use default
+const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../storage');
+
+// Static file serving for photos (protected)
+app.use('/photos', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(storagePath, 'events/active')));
+
+// Static file serving for thumbnails (protected)
+app.use('/thumbnails', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(storagePath, 'thumbnails')));
+
+// Static file serving for uploads (public - logos, favicons)
+app.use('/uploads', setCorsHeaders, secureStatic(path.join(storagePath, 'uploads')));
+
+// Debug endpoint to check IP detection (only in development)
+if (process.env.NODE_ENV === 'development') {
+  app.get('/api/debug/ip', (req, res) => {
+    const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+    
+    res.json({
+      detectedIp: clientIp,
+      reqIp: req.ip,
+      headers: {
+        'x-forwarded-for': req.headers['x-forwarded-for'],
+        'x-real-ip': req.headers['x-real-ip'],
+        'x-forwarded-proto': req.headers['x-forwarded-proto'],
+        'x-forwarded-host': req.headers['x-forwarded-host']
+      },
+      trustProxy: app.get('trust proxy')
+    });
+  });
+}
+
+// Health check endpoint
+app.get('/health', async (req, res) => {
+  try {
+    // Check database connectivity
+    await db.raw('SELECT 1');
+    
+    res.json({ 
+      status: 'ok', 
+      database: 'connected',
+      timestamp: new Date().toISOString() 
+    });
+  } catch (error) {
+    logger.error('Health check failed:', error);
+    res.status(503).json({ 
+      status: 'error', 
+      database: 'disconnected',
+      error: error.message,
+      timestamp: new Date().toISOString() 
+    });
+  }
+});
+
+// Routes
+app.use('/api/auth', authRoutes);
+app.use('/api/events', eventRoutes);
+app.use('/api/gallery', galleryRoutes);
+app.use('/api/admin', adminRoutes);
+app.use('/api/admin/auth', adminAuthRoutes);
+app.use('/api/admin/system', require('./src/routes/adminSystem'));
+app.use('/api/public/settings', require('./src/routes/publicSettings'));
+app.use('/api/public', require('./src/routes/publicCMS'));
+app.use('/api/images', require('./src/routes/protectedImages'));
+
+// Error handling middleware
+app.use((err, req, res, next) => {
+  logger.error(err.stack);
+  res.status(500).json({ error: 'Something went wrong!' });
+});
+
+// Initialize services
+async function startServer() {
+  try {
+    // Initialize database
+    await initializeDatabase();
+
+    // Initialize rate limiters after database is ready
+    await initializeRateLimiters();
+    logger.info('Rate limiters initialized with database configuration');
+
+    // Initialize auth security cleanup job
+    const { initializeCleanupJob } = require('./src/utils/authSecurity');
+    initializeCleanupJob();
+    
+    // Initialize temp upload cleanup job
+    const { cleanupTempUploads } = require('./src/utils/cleanupTempUploads');
+    // Run cleanup on startup
+    cleanupTempUploads();
+    // Schedule periodic cleanup every hour
+    setInterval(cleanupTempUploads, 60 * 60 * 1000);
+    logger.info('Temp upload cleanup scheduled');
+    
+    // Start file watcher
+    startFileWatcher();
+    
+    // Start expiration checker
+    startExpirationChecker();
+    
+    // Initialize email transporter and start queue processor
+    await initializeTransporter();
+    startEmailQueueProcessor();
+    
+    app.listen(PORT, () => {
+      logger.info(`Server running on port ${PORT}`);
+      logger.info(`Admin interface: ${process.env.ADMIN_URL || 'http://localhost:3000'}`);
+      logger.info(`Frontend: ${process.env.FRONTEND_URL || 'http://localhost:3001'}`);
+    });
+  } catch (error) {
+    logger.error('Failed to start server:', error);
+    process.exit(1);
+  }
+}
+
+startServer();
+
+module.exports = app; // For testing

backend/src/__tests__/dbCompat.test.js

@@ -0,0 +1,83 @@
+const { formatBoolean, isPostgreSQL, addDays, formatDateForDB, insertAndGetId } = require('../utils/dbCompat');
+
+describe('Database Compatibility', () => {
+  // Save original env
+  const originalEnv = process.env.DATABASE_CLIENT;
+  
+  afterEach(() => {
+    // Restore original env after each test
+    if (originalEnv) {
+      process.env.DATABASE_CLIENT = originalEnv;
+    } else {
+      delete process.env.DATABASE_CLIENT;
+    }
+  });
+
+  describe('formatBoolean', () => {
+    test('should format boolean values correctly', () => {
+      // Mock for SQLite
+      process.env.DATABASE_CLIENT = 'sqlite3';
+      expect(formatBoolean(true)).toBe(1);
+      expect(formatBoolean(false)).toBe(0);
+      
+      // Mock for PostgreSQL
+      process.env.DATABASE_CLIENT = 'pg';
+      expect(formatBoolean(true)).toBe(true);
+      expect(formatBoolean(false)).toBe(false);
+      
+      // Default (no env var) should be SQLite
+      delete process.env.DATABASE_CLIENT;
+      expect(formatBoolean(true)).toBe(1);
+      expect(formatBoolean(false)).toBe(0);
+    });
+  });
+
+  describe('isPostgreSQL', () => {
+    test('should detect PostgreSQL correctly', () => {
+      process.env.DATABASE_CLIENT = 'pg';
+      expect(isPostgreSQL()).toBe(true);
+      
+      process.env.DATABASE_CLIENT = 'sqlite3';
+      expect(isPostgreSQL()).toBe(false);
+      
+      delete process.env.DATABASE_CLIENT;
+      expect(isPostgreSQL()).toBe(false); // Default to SQLite
+    });
+  });
+
+  describe('formatDateForDB', () => {
+    test('should format dates as ISO strings', () => {
+      const date = new Date('2024-01-15T10:30:00Z');
+      expect(formatDateForDB(date)).toBe('2024-01-15T10:30:00.000Z');
+    });
+  });
+
+  describe('addDays', () => {
+    test('should add days correctly', () => {
+      const date = new Date('2024-01-15');
+      const result = addDays(date, 30);
+      expect(result.toISOString().split('T')[0]).toBe('2024-02-14');
+      
+      const negativeResult = addDays(date, -7);
+      expect(negativeResult.toISOString().split('T')[0]).toBe('2024-01-08');
+    });
+  });
+
+  describe('insertAndGetId', () => {
+    test('should handle PostgreSQL result format', async () => {
+      const mockQuery = {
+        returning: jest.fn().mockResolvedValue([{ id: 123 }])
+      };
+      const result = await insertAndGetId(mockQuery);
+      expect(result).toBe(123);
+    });
+
+    test('should handle SQLite result format', async () => {
+      const mockQuery = {
+        returning: jest.fn().mockResolvedValue([456])
+      };
+      const result = await insertAndGetId(mockQuery);
+      expect(result).toBe(456);
+    });
+  });
+});

backend/src/config/storage.js

@@ -0,0 +1,8 @@
+const path = require('path');
+
+// Get storage path from environment or default
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+module.exports = {
+  getStoragePath
+};

backend/src/config/validateEnv.js

@@ -0,0 +1,66 @@
+const logger = require('../utils/logger');
+
+/**
+ * Validates required environment variables are set
+ * Exits the process if critical variables are missing
+ */
+function validateEnvironment() {
+  const requiredVars = [
+    {
+      name: 'JWT_SECRET',
+      description: 'Secret key for JWT token signing',
+      critical: true
+    }
+  ];
+
+  const warnings = [];
+  const errors = [];
+
+  // Check each required variable
+  requiredVars.forEach(({ name, description, critical }) => {
+    const value = process.env[name];
+    
+    if (!value || value.trim() === '') {
+      const message = `Missing required environment variable: ${name} - ${description}`;
+      
+      if (critical) {
+        errors.push(message);
+      } else {
+        warnings.push(message);
+      }
+    }
+    
+    // Additional validation for JWT_SECRET
+    if (name === 'JWT_SECRET' && value) {
+      // Check for the insecure default value
+      if (value === 'your-secret-key') {
+        errors.push('CRITICAL: JWT_SECRET is set to the insecure default value. Please set a secure secret key.');
+      }
+      
+      // Check minimum length (should be at least 32 characters for security)
+      if (value.length < 32) {
+        warnings.push(`JWT_SECRET should be at least 32 characters long for better security (current: ${value.length} characters)`);
+      }
+    }
+  });
+
+  // Log warnings
+  warnings.forEach(warning => logger.warn(warning));
+
+  // If there are critical errors, log them and exit
+  if (errors.length > 0) {
+    logger.error('=== CRITICAL CONFIGURATION ERRORS ===');
+    errors.forEach(error => logger.error(error));
+    logger.error('=====================================');
+    logger.error('Server cannot start due to missing or invalid configuration.');
+    logger.error('Please set the required environment variables and try again.');
+    
+    // Exit with error code
+    process.exit(1);
+  }
+
+  // Log successful validation
+  logger.info('Environment validation passed');
+}
+
+module.exports = { validateEnvironment };

backend/src/database/connection-manager.js

@@ -0,0 +1,132 @@
+const knex = require('knex');
+const knexConfig = require('../../knexfile');
+const logger = require('../utils/logger');
+
+class ConnectionManager {
+  constructor() {
+    this.db = null;
+    this.reconnectAttempts = 0;
+    this.maxReconnectAttempts = 10;
+    this.reconnectDelay = 5000; // 5 seconds
+    this.isReconnecting = false;
+  }
+
+  async initialize() {
+    try {
+      this.db = knex(knexConfig);
+      
+      // Test the connection
+      await this.db.raw('SELECT 1');
+      logger.info('Database connection established successfully');
+      
+      // Set up connection error handling
+      this.setupErrorHandling();
+      
+      this.reconnectAttempts = 0;
+      return this.db;
+    } catch (error) {
+      logger.error('Failed to initialize database connection:', error);
+      throw error;
+    }
+  }
+
+  setupErrorHandling() {
+    if (!this.db) return;
+
+    // Handle connection errors
+    this.db.on('error', async (error) => {
+      logger.error('Database connection error:', error);
+      
+      if (this.shouldReconnect(error)) {
+        await this.reconnect();
+      }
+    });
+  }
+
+  shouldReconnect(error) {
+    const reconnectableErrors = [
+      'ECONNREFUSED',
+      'ETIMEDOUT',
+      'ECONNRESET',
+      'Connection terminated unexpectedly',
+      'Connection terminated'
+    ];
+    
+    return reconnectableErrors.some(msg => 
+      error.code === msg || error.message?.includes(msg)
+    );
+  }
+
+  async reconnect() {
+    if (this.isReconnecting) {
+      logger.info('Already attempting to reconnect...');
+      return;
+    }
+
+    this.isReconnecting = true;
+    
+    while (this.reconnectAttempts < this.maxReconnectAttempts) {
+      this.reconnectAttempts++;
+      
+      logger.info(`Attempting to reconnect to database (attempt ${this.reconnectAttempts}/${this.maxReconnectAttempts})...`);
+      
+      try {
+        // Destroy the old connection pool
+        if (this.db) {
+          await this.db.destroy();
+        }
+        
+        // Create new connection
+        await this.initialize();
+        
+        logger.info('Successfully reconnected to database');
+        this.isReconnecting = false;
+        return;
+      } catch (error) {
+        logger.error(`Reconnection attempt ${this.reconnectAttempts} failed:`, error.message);
+        
+        if (this.reconnectAttempts < this.maxReconnectAttempts) {
+          await new Promise(resolve => setTimeout(resolve, this.reconnectDelay));
+        }
+      }
+    }
+    
+    this.isReconnecting = false;
+    logger.error('Failed to reconnect to database after maximum attempts');
+    
+    // In production, you might want to alert monitoring systems or restart the process
+    if (process.env.NODE_ENV === 'production') {
+      logger.error('Exiting process due to database connection failure');
+      process.exit(1);
+    }
+  }
+
+  getConnection() {
+    if (!this.db) {
+      throw new Error('Database connection not initialized');
+    }
+    return this.db;
+  }
+
+  async healthCheck() {
+    try {
+      await this.db.raw('SELECT 1');
+      return { healthy: true };
+    } catch (error) {
+      logger.error('Database health check failed:', error);
+      return { healthy: false, error: error.message };
+    }
+  }
+
+  async destroy() {
+    if (this.db) {
+      await this.db.destroy();
+      this.db = null;
+    }
+  }
+}
+
+// Create singleton instance
+const connectionManager = new ConnectionManager();
+
+module.exports = connectionManager;

backend/src/database/db.js

@@ -0,0 +1,228 @@
+const knex = require('knex');
+const knexConfig = require('../../knexfile');
+
+// Create database connection with built-in retry logic
+const db = knex(knexConfig);
+
+async function initializeDatabase() {
+  // Events table
+  const hasEventsTable = await db.schema.hasTable('events');
+  if (!hasEventsTable) {
+    await db.schema.createTable('events', (table) => {
+      table.increments('id').primary();
+      table.string('slug').unique().notNullable();
+      table.string('event_type').notNullable();
+      table.string('event_name').notNullable();
+      table.date('event_date').notNullable();
+      table.string('host_email').notNullable();
+      table.string('admin_email').notNullable();
+      table.string('password_hash').notNullable();
+      table.text('welcome_message');
+      table.text('color_theme');
+      table.string('share_link').unique().notNullable();
+      table.datetime('created_at').defaultTo(db.fn.now());
+      table.datetime('expires_at').notNullable();
+      table.boolean('is_active').defaultTo(true);
+      table.boolean('is_archived').defaultTo(false);
+      table.string('archive_path');
+      table.datetime('archived_at');
+    });
+  } else {
+    // Check if color_theme needs to be updated to TEXT type
+    // This is needed for larger theme configurations
+    const isPostgres = knexConfig.client === 'pg';
+    
+    if (!isPostgres) {
+      // SQLite-specific migration
+      try {
+        await db.raw(`
+          CREATE TABLE IF NOT EXISTS events_new (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            slug TEXT UNIQUE NOT NULL,
+            event_type TEXT NOT NULL,
+            event_name TEXT NOT NULL,
+            event_date DATE NOT NULL,
+            host_email TEXT NOT NULL,
+            admin_email TEXT NOT NULL,
+            password_hash TEXT NOT NULL,
+            welcome_message TEXT,
+            color_theme TEXT,
+            share_link TEXT UNIQUE NOT NULL,
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+            expires_at DATETIME NOT NULL,
+            is_active BOOLEAN DEFAULT 1,
+            is_archived BOOLEAN DEFAULT 0,
+            archive_path TEXT,
+            archived_at DATETIME,
+            allow_user_uploads BOOLEAN DEFAULT 0,
+            upload_category_id INTEGER
+          )
+        `);
+        
+        await db.raw('INSERT INTO events_new SELECT * FROM events');
+        await db.raw('DROP TABLE events');
+        await db.raw('ALTER TABLE events_new RENAME TO events');
+      } catch (error) {
+        // If the migration fails, it might already have been applied
+        console.log('Color theme migration may have already been applied');
+      }
+    }
+  }
+
+  // Photo metadata table
+  const hasPhotosTable = await db.schema.hasTable('photos');
+  if (!hasPhotosTable) {
+    await db.schema.createTable('photos', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.string('filename').notNullable();
+      table.string('path').notNullable();
+      table.string('thumbnail_path');
+      table.string('type').notNullable(); // 'collage' or 'individual'
+      table.integer('size_bytes');
+      table.datetime('uploaded_at').defaultTo(db.fn.now());
+      table.integer('view_count').defaultTo(0);
+      table.integer('download_count').defaultTo(0);
+    });
+  }
+
+  // Access logs table
+  const hasAccessLogsTable = await db.schema.hasTable('access_logs');
+  if (!hasAccessLogsTable) {
+    await db.schema.createTable('access_logs', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').references('id').inTable('events');
+      table.string('ip_address');
+      table.string('user_agent');
+      table.string('action'); // 'view', 'download', 'login_success', 'login_fail'
+      table.string('photo_id');
+      table.datetime('timestamp').defaultTo(db.fn.now());
+    });
+  }
+
+  // Email queue table
+  const hasEmailQueueTable = await db.schema.hasTable('email_queue');
+  if (!hasEmailQueueTable) {
+    await db.schema.createTable('email_queue', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').references('id').inTable('events');
+      table.string('recipient_email').notNullable();
+      table.string('email_type').notNullable(); // 'creation', 'warning', 'expiration', 'archive_complete'
+      table.json('email_data');
+      table.string('status').defaultTo('pending'); // 'pending', 'sent', 'failed'
+      table.datetime('scheduled_at').defaultTo(db.fn.now());
+      table.datetime('sent_at');
+      table.text('error_message');
+      table.integer('retry_count').defaultTo(0);
+    });
+  }
+
+  // Admin users table
+  const hasAdminUsersTable = await db.schema.hasTable('admin_users');
+  if (!hasAdminUsersTable) {
+    await db.schema.createTable('admin_users', (table) => {
+      table.increments('id').primary();
+      table.string('username').unique().notNullable();
+      table.string('email').unique().notNullable();
+      table.string('password_hash').notNullable();
+      table.boolean('is_active').defaultTo(true);
+      table.datetime('created_at').defaultTo(db.fn.now());
+      table.datetime('updated_at').defaultTo(db.fn.now());
+      table.datetime('last_login');
+    });
+  } else {
+    // Check if updated_at column exists
+    const hasUpdatedAt = await db.schema.hasColumn('admin_users', 'updated_at');
+    if (!hasUpdatedAt) {
+      await db.schema.table('admin_users', (table) => {
+        table.datetime('updated_at');
+      });
+      // Set default value for existing rows
+      await db('admin_users').update({ updated_at: new Date() });
+    }
+  }
+
+  // Email configuration table
+  const hasEmailConfigTable = await db.schema.hasTable('email_configs');
+  if (!hasEmailConfigTable) {
+    await db.schema.createTable('email_configs', (table) => {
+      table.increments('id').primary();
+      table.string('smtp_host').notNullable();
+      table.integer('smtp_port').notNullable();
+      table.boolean('smtp_secure').defaultTo(false);
+      table.string('smtp_user');
+      table.string('smtp_pass');
+      table.string('from_email').notNullable();
+      table.string('from_name');
+      table.datetime('updated_at').defaultTo(db.fn.now());
+    });
+  }
+
+  // Email templates table
+  const hasEmailTemplatesTable = await db.schema.hasTable('email_templates');
+  if (!hasEmailTemplatesTable) {
+    await db.schema.createTable('email_templates', (table) => {
+      table.increments('id').primary();
+      table.string('template_key').unique().notNullable(); // 'gallery_created', 'expiration_warning', etc.
+      table.string('subject').notNullable();
+      table.text('body_html').notNullable();
+      table.text('body_text');
+      table.json('variables'); // Available template variables
+      table.datetime('updated_at').defaultTo(db.fn.now());
+    });
+  }
+
+  // App settings table
+  const hasAppSettingsTable = await db.schema.hasTable('app_settings');
+  if (!hasAppSettingsTable) {
+    await db.schema.createTable('app_settings', (table) => {
+      table.increments('id').primary();
+      table.string('setting_key').unique().notNullable();
+      table.json('setting_value');
+      table.string('setting_type'); // 'branding', 'theme', 'general'
+      table.datetime('updated_at').defaultTo(db.fn.now());
+    });
+  }
+
+  // Activity logs table
+  const hasActivityLogsTable = await db.schema.hasTable('activity_logs');
+  if (!hasActivityLogsTable) {
+    await db.schema.createTable('activity_logs', (table) => {
+      table.increments('id').primary();
+      table.string('activity_type').notNullable(); // 'event_created', 'photos_uploaded', etc.
+      table.string('actor_type'); // 'admin', 'system', 'guest'
+      table.integer('actor_id');
+      table.string('actor_name');
+      table.json('metadata'); // Additional data about the activity
+      table.integer('event_id').references('id').inTable('events');
+      table.datetime('created_at').defaultTo(db.fn.now());
+      table.datetime('read_at').nullable();
+    });
+  } else {
+    // Check if read_at column exists
+    const hasReadAt = await db.schema.hasColumn('activity_logs', 'read_at');
+    if (!hasReadAt) {
+      await db.schema.table('activity_logs', (table) => {
+        table.datetime('read_at').nullable();
+      });
+    }
+  }
+}
+
+// Helper function to log activities
+async function logActivity(activityType, metadata = {}, eventId = null, actor = null) {
+  try {
+    await db('activity_logs').insert({
+      activity_type: activityType,
+      actor_type: actor?.type || 'system',
+      actor_id: actor?.id || null,
+      actor_name: actor?.name || null,
+      metadata: JSON.stringify(metadata),
+      event_id: eventId
+    });
+  } catch (error) {
+    console.error('Failed to log activity:', error);
+  }
+}
+
+module.exports = { db, initializeDatabase, logActivity };

backend/src/middleware/auth-enhanced-v2.js

@@ -0,0 +1,167 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { isTokenRevoked } = require('../utils/tokenRevocation');
+const logger = require('../utils/logger');
+
+/**
+ * Enhanced admin authentication middleware with revocation checking
+ */
+async function adminAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if token is revoked
+    if (await isTokenRevoked(decoded)) {
+      logger.warn('Revoked token used', {
+        userId: decoded.id,
+        tokenType: decoded.type
+      });
+      return res.status(401).json({ error: 'Token has been revoked', code: 'TOKEN_REVOKED' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'admin') {
+      logger.warn('Non-admin token used for admin endpoint', { 
+        userId: decoded.id,
+        tokenType: decoded.type 
+      });
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+    
+    // IP validation (optional - can be strict or just log)
+    const currentIp = req.ip || req.connection.remoteAddress;
+    if (decoded.ip && decoded.ip !== currentIp) {
+      logger.warn('Token used from different IP', {
+        userId: decoded.id,
+        tokenIp: decoded.ip,
+        currentIp: currentIp
+      });
+    }
+    
+    // Check if admin still exists and is active
+    const admin = await db('admin_users')
+      .where({ id: decoded.id, is_active: formatBoolean(true) })
+      .first();
+    
+    if (!admin) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if password was changed after token was issued
+    if (admin.password_changed_at) {
+      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
+      if (decoded.iat < passwordChangedTime) {
+        logger.warn('Token used after password change', { userId: decoded.id });
+        return res.status(401).json({ 
+          error: 'Token invalid due to password change',
+          code: 'PASSWORD_CHANGED'
+        });
+      }
+    }
+    
+    // Add user info to request
+    req.admin = {
+      id: admin.id,
+      username: admin.username,
+      email: admin.email
+    };
+    req.token = token; // Store token for potential revocation
+    
+    next();
+  } catch (error) {
+    logger.error('Auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Enhanced gallery authentication middleware with revocation checking
+ */
+async function galleryAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid session' });
+    }
+    
+    // Check if token is revoked
+    if (await isTokenRevoked(decoded)) {
+      return res.status(401).json({ error: 'Session has been invalidated', code: 'TOKEN_REVOKED' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'gallery') {
+      return res.status(403).json({ error: 'Invalid access token' });
+    }
+    
+    // Check if event still exists and is active
+    const event = await db('events')
+      .where({ 
+        id: decoded.eventId, 
+        is_active: true, 
+        is_archived: false 
+      })
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    // Check if gallery has expired
+    if (new Date(event.expires_at) < new Date()) {
+      return res.status(410).json({ 
+        error: 'Gallery has expired',
+        code: 'GALLERY_EXPIRED'
+      });
+    }
+    
+    // Add event info to request
+    req.event = event;
+    req.galleryToken = decoded;
+    req.token = token;
+    
+    next();
+  } catch (error) {
+    logger.error('Gallery auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+// Export other middleware functions from original file...
+module.exports = { 
+  adminAuth, 
+  galleryAuth,
+  // ... other exports
+};

backend/src/middleware/auth-enhanced.js

@@ -0,0 +1,238 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const logger = require('../utils/logger');
+
+/**
+ * Enhanced admin authentication middleware
+ * Adds additional security checks beyond basic JWT validation
+ */
+async function adminAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload; // Extract payload when using complete: true
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'admin') {
+      logger.warn('Non-admin token used for admin endpoint', { 
+        userId: decoded.id,
+        tokenType: decoded.type 
+      });
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+    
+    // IP validation (optional - can be strict or just log)
+    const currentIp = req.ip || req.connection.remoteAddress;
+    if (decoded.ip && decoded.ip !== currentIp) {
+      logger.warn('Token used from different IP', {
+        userId: decoded.id,
+        tokenIp: decoded.ip,
+        currentIp: currentIp
+      });
+      // Optional: Reject if IP doesn't match
+      // return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if admin still exists and is active
+    const admin = await db('admin_users')
+      .where({ id: decoded.id, is_active: formatBoolean(true) })
+      .first();
+    
+    if (!admin) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if password was changed after token was issued
+    if (admin.password_changed_at) {
+      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
+      if (decoded.iat < passwordChangedTime) {
+        logger.warn('Token used after password change', { userId: decoded.id });
+        return res.status(401).json({ 
+          error: 'Token invalid due to password change',
+          code: 'PASSWORD_CHANGED'
+        });
+      }
+    }
+    
+    // Add user info to request
+    req.admin = {
+      id: admin.id,
+      username: admin.username,
+      email: admin.email
+    };
+    
+    next();
+  } catch (error) {
+    logger.error('Auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Enhanced gallery authentication middleware
+ */
+async function galleryAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid session' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'gallery') {
+      return res.status(403).json({ error: 'Invalid access token' });
+    }
+    
+    // Check if event still exists and is active
+    const event = await db('events')
+      .where({ 
+        id: decoded.eventId, 
+        is_active: true, 
+        is_archived: false 
+      })
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    // Check if gallery has expired
+    if (new Date(event.expires_at) < new Date()) {
+      return res.status(410).json({ 
+        error: 'Gallery has expired',
+        code: 'GALLERY_EXPIRED'
+      });
+    }
+    
+    // Add event info to request
+    req.event = event;
+    req.galleryToken = decoded;
+    
+    next();
+  } catch (error) {
+    logger.error('Gallery auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Photo access authentication
+ * Validates both admin and gallery tokens for photo access
+ */
+async function photoAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET);
+    } catch (err) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Allow both admin and gallery tokens
+    if (decoded.type === 'admin') {
+      const admin = await db('admin_users')
+        .where({ id: decoded.id, is_active: formatBoolean(true) })
+        .first();
+      
+      if (!admin) {
+        return res.status(401).json({ error: 'Invalid token' });
+      }
+      
+      req.auth = { type: 'admin', user: admin };
+    } else if (decoded.type === 'gallery') {
+      const event = await db('events')
+        .where({ 
+          id: decoded.eventId, 
+          is_active: true, 
+          is_archived: false 
+        })
+        .first();
+      
+      if (!event) {
+        return res.status(404).json({ error: 'Gallery not found' });
+      }
+      
+      // For gallery tokens, ensure they can only access their event's photos
+      req.auth = { type: 'gallery', event: event };
+    } else {
+      return res.status(403).json({ error: 'Invalid token type' });
+    }
+    
+    next();
+  } catch (error) {
+    logger.error('Photo auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Verify gallery access for specific operations
+ */
+async function verifyGalleryAccess(req, res, next) {
+  try {
+    if (!req.auth) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    
+    const { eventId } = req.params;
+    
+    // Admins can access any gallery
+    if (req.auth.type === 'admin') {
+      return next();
+    }
+    
+    // Gallery tokens can only access their own event
+    if (req.auth.type === 'gallery') {
+      if (req.auth.event.id !== parseInt(eventId)) {
+        return res.status(403).json({ error: 'Access denied' });
+      }
+      return next();
+    }
+    
+    res.status(403).json({ error: 'Access denied' });
+  } catch (error) {
+    res.status(500).json({ error: 'Access verification failed' });
+  }
+}
+
+module.exports = { 
+  adminAuth, 
+  galleryAuth,
+  photoAuth,
+  verifyGalleryAccess
+};

backend/src/middleware/auth.js

@@ -0,0 +1,85 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const logger = require('../utils/logger');
+
+async function adminAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      logger.warn('Admin auth attempt without token', {
+        ip: clientIp,
+        path: req.path,
+        method: req.method,
+        userAgent: req.headers['user-agent']
+      });
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET);
+    } catch (jwtError) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      
+      logger.warn('JWT validation failed', {
+        ip: clientIp,
+        path: req.path,
+        method: req.method,
+        userAgent: req.headers['user-agent'],
+        error: jwtError.name,
+        message: jwtError.message,
+        timestamp: new Date().toISOString()
+      });
+      
+      if (jwtError.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    const admin = await db('admin_users').where({ id: decoded.id, is_active: formatBoolean(true) }).first();
+    
+    if (!admin) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      
+      logger.warn('Admin auth failed - user not found or inactive', {
+        ip: clientIp,
+        userId: decoded.id,
+        path: req.path,
+        method: req.method,
+        timestamp: new Date().toISOString()
+      });
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    req.admin = admin;
+    next();
+  } catch (error) {
+    const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                   req.headers['x-real-ip'] || 
+                   req.connection.remoteAddress || 
+                   req.ip;
+    
+    logger.error('Admin auth middleware error', {
+      ip: clientIp,
+      path: req.path,
+      error: error.message,
+      stack: error.stack,
+      timestamp: new Date().toISOString()
+    });
+    res.status(401).json({ error: 'Invalid token' });
+  }
+}
+
+module.exports = { adminAuth };

backend/src/middleware/gallery.js

@@ -0,0 +1,36 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+
+// Middleware to verify gallery access
+async function verifyGalleryAccess(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    const event = await db('events')
+      .where({ 
+        id: decoded.eventId, 
+        is_active: formatBoolean(true),
+        is_archived: formatBoolean(false)
+      })
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    req.event = event;
+    next();
+  } catch (error) {
+    console.error('Error verifying gallery access:', error);
+    res.status(401).json({ error: 'Invalid token', details: error.message });
+  }
+}
+
+module.exports = {
+  verifyGalleryAccess
+};

backend/src/middleware/maintenance.js

@@ -0,0 +1,111 @@
+const { db } = require('../database/db');
+
+// Cache maintenance mode status to avoid DB queries on every request
+let maintenanceMode = false;
+let lastCheck = 0;
+const CACHE_DURATION = 60000; // 1 minute
+
+// Retry configuration for database queries
+const MAX_RETRIES = 3;
+const RETRY_DELAY = 1000; // 1 second
+
+async function queryWithRetry(queryFn, retries = MAX_RETRIES) {
+  for (let i = 0; i < retries; i++) {
+    try {
+      return await queryFn();
+    } catch (error) {
+      if (i === retries - 1) {
+        throw error;
+      }
+      
+      // Check if it's a connection error that might benefit from retry
+      const isConnectionError = 
+        error.message?.includes('Connection terminated') ||
+        error.message?.includes('ECONNREFUSED') ||
+        error.message?.includes('ETIMEDOUT') ||
+        error.code === 'ECONNRESET';
+      
+      if (isConnectionError) {
+        console.warn(`Database connection error, retrying in ${RETRY_DELAY}ms... (attempt ${i + 1}/${retries})`);
+        await new Promise(resolve => setTimeout(resolve, RETRY_DELAY));
+      } else {
+        throw error; // Don't retry non-connection errors
+      }
+    }
+  }
+}
+
+async function checkMaintenanceMode() {
+  const now = Date.now();
+  
+  // Use cached value if recent
+  if (now - lastCheck < CACHE_DURATION) {
+    return maintenanceMode;
+  }
+  
+  try {
+    const setting = await queryWithRetry(async () => {
+      return await db('app_settings')
+        .where('setting_key', 'general_maintenance_mode')
+        .where('setting_type', 'general')
+        .first();
+    });
+    
+    maintenanceMode = setting ? (setting.setting_value === 'true' || setting.setting_value === true) : false;
+    lastCheck = now;
+    
+    return maintenanceMode;
+  } catch (error) {
+    console.error('Error checking maintenance mode after retries:', error.message);
+    // Return cached value or false if no cache
+    return maintenanceMode;
+  }
+}
+
+// Middleware to enforce maintenance mode
+async function maintenanceMiddleware(req, res, next) {
+  // Skip maintenance check for certain paths
+  const skipPaths = [
+    '/api/admin/login',
+    '/api/admin/auth/login',
+    '/api/public/settings',
+    '/health'
+  ];
+  
+  // Allow static assets (uploads, favicons, logos)
+  const isStaticAsset = req.path.startsWith('/uploads/') || 
+                       req.path.startsWith('/favicons/') || 
+                       req.path.startsWith('/logos/');
+  
+  // Allow admin routes if admin is authenticated
+  const isAdminRoute = req.path.startsWith('/api/admin');
+  const hasAdminAuth = req.headers.authorization?.startsWith('Bearer ');
+  
+  if (skipPaths.includes(req.path) || isStaticAsset || (isAdminRoute && hasAdminAuth)) {
+    return next();
+  }
+  
+  try {
+    const inMaintenance = await checkMaintenanceMode();
+    
+    if (inMaintenance && !isAdminRoute) {
+      return res.status(503).json({
+        error: 'Service Unavailable',
+        message: 'The system is currently undergoing maintenance. Please try again later.',
+        maintenance: true
+      });
+    }
+  } catch (error) {
+    // If we can't check maintenance mode, allow the request to proceed
+    console.error('Failed to check maintenance mode, allowing request:', error.message);
+  }
+  
+  next();
+}
+
+// Function to clear cache when settings change
+function clearMaintenanceCache() {
+  lastCheck = 0;
+}
+
+module.exports = { maintenanceMiddleware, clearMaintenanceCache };

backend/src/middleware/photoAuth.js

@@ -0,0 +1,116 @@
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+
+async function photoAuth(req, res, next) {
+  try {
+    // Extract event slug from the path
+    let eventSlug;
+    
+    console.log('PhotoAuth middleware - path:', req.path);
+    
+    // For thumbnails, we need to parse the filename to get the event info
+    if (req.path.startsWith('/thumb_')) {
+      // For now, we'll rely on JWT token for thumbnail access
+      eventSlug = null;
+    } else {
+      // For regular photos, the slug is the first part of the path
+      eventSlug = req.path.split('/')[1];
+    }
+    
+    // First check for JWT token (from gallery access)
+    const authHeader = req.headers.authorization;
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+      const token = authHeader.replace('Bearer ', '');
+      try {
+        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+        
+        // Check if it's a gallery token
+        if (decoded.type === 'gallery') {
+          // For thumbnails, we need to verify the token is for a valid event
+          if (!eventSlug) {
+            // Extract event ID from the decoded token
+            if (decoded.eventId) {
+              const event = await db('events')
+                .where({ id: decoded.eventId, is_active: formatBoolean(true) })
+                .first();
+              if (event) {
+                req.event = event;
+                return next();
+              }
+            }
+            // Fallback to slug
+            const event = await db('events')
+              .where({ slug: decoded.eventSlug, is_active: formatBoolean(true) })
+              .first();
+            if (event) {
+              req.event = event;
+              return next();
+            }
+          }
+          // For regular photos, check if token matches the event
+          else if (decoded.eventSlug === eventSlug) {
+            const event = await db('events')
+              .where({ slug: eventSlug, is_active: formatBoolean(true) })
+              .first();
+            if (event) {
+              req.event = event;
+              return next();
+            }
+          }
+        }
+        
+        // Check if it's an admin token (admins can view all photos)
+        if (decoded.type === 'admin') {
+          // For both thumbnails and photos with admin token, allow access
+          return next();
+        }
+      } catch (err) {
+        // Token invalid, fall through to password check
+        console.error('JWT verification failed:', err.message);
+      }
+    }
+    
+    // Check for password header (legacy support)
+    const password = req.headers['x-gallery-password'];
+    
+    if (!password && !authHeader) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    
+    // If no eventSlug (thumbnails), and we don't have valid auth yet, deny access
+    if (!eventSlug && !password) {
+      return res.status(401).json({ error: 'Authentication required for thumbnails' });
+    }
+    
+    const event = await db('events').where({ slug: eventSlug, is_active: formatBoolean(true) }).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found' });
+    }
+    
+    if (password) {
+      const validPassword = await bcrypt.compare(password, event.password_hash);
+      if (!validPassword) {
+        await db('access_logs').insert({
+          event_id: event.id,
+          ip_address: req.ip,
+          user_agent: req.headers['user-agent'],
+          action: 'login_fail'
+        });
+        return res.status(401).json({ error: 'Invalid password' });
+      }
+    } else {
+      // No valid authentication
+      return res.status(401).json({ error: 'Invalid authentication' });
+    }
+    
+    req.event = event;
+    next();
+  } catch (error) {
+    console.error('Photo auth error:', error);
+    res.status(500).json({ error: 'Authentication error' });
+  }
+}
+
+module.exports = photoAuth;

backend/src/middleware/secureStatic.js

@@ -0,0 +1,46 @@
+const path = require('path');
+const express = require('express');
+const { safePathJoin, isPathSafe } = require('../utils/fileSecurityUtils');
+
+/**
+ * Create a secure static file serving middleware that prevents path traversal attacks
+ * @param {string} basePath - The base directory to serve files from
+ * @param {Object} options - Express static options
+ * @returns {Function} - Express middleware
+ */
+function secureStatic(basePath, options = {}) {
+  const normalizedBase = path.resolve(basePath);
+  
+  return (req, res, next) => {
+    // Get the requested file path - remove leading slash for validation
+    const requestedPath = req.path.startsWith('/') ? req.path.substring(1) : req.path;
+    
+    // Validate the path doesn't contain dangerous patterns
+    if (!isPathSafe(requestedPath)) {
+      console.warn(`Potential path traversal attempt blocked: ${requestedPath}`);
+      return res.status(403).json({ error: 'Access denied' });
+    }
+    
+    try {
+      // Validate the full path is within the base directory
+      const fullPath = safePathJoin(normalizedBase, requestedPath);
+      
+      // If validation passes, use express.static
+      const staticMiddleware = express.static(normalizedBase, {
+        ...options,
+        // Disable directory listing for security
+        index: false,
+        // Don't allow dotfiles
+        dotfiles: 'deny'
+      });
+      
+      return staticMiddleware(req, res, next);
+    } catch (error) {
+      // Path traversal detected
+      console.error(`Path traversal blocked: ${requestedPath}`, error.message);
+      return res.status(403).json({ error: 'Access denied' });
+    }
+  };
+}
+
+module.exports = secureStatic;

backend/src/middleware/sessionTimeout.js

@@ -0,0 +1,153 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+
+// In-memory session tracking (in production, use Redis)
+const sessions = new Map();
+
+// Default session timeout (60 minutes)
+const DEFAULT_SESSION_TIMEOUT = 60 * 60 * 1000;
+
+// Cache for session timeout setting
+let cachedTimeout = null;
+let cacheExpiry = 0;
+const CACHE_DURATION = 5 * 60 * 1000; // 5 minutes
+
+// Clean up expired sessions every 5 minutes
+setInterval(() => {
+  const now = Date.now();
+  for (const [token, lastActivity] of sessions.entries()) {
+    if (now - lastActivity > DEFAULT_SESSION_TIMEOUT) {
+      sessions.delete(token);
+    }
+  }
+}, 5 * 60 * 1000);
+
+async function getSessionTimeout() {
+  const now = Date.now();
+  
+  // Return cached value if still valid
+  if (cachedTimeout && now < cacheExpiry) {
+    return cachedTimeout;
+  }
+  
+  try {
+    const setting = await db('app_settings')
+      .where('setting_key', 'security_session_timeout_minutes')
+      .first()
+      .timeout(5000); // 5 second timeout
+    
+    if (setting && setting.setting_value) {
+      let value = setting.setting_value;
+      // Handle both string and object values
+      if (typeof value === 'string') {
+        try {
+          value = JSON.parse(value);
+        } catch (e) {
+          // If it's not JSON, try to parse as number directly
+          value = parseInt(value);
+        }
+      }
+      const minutes = parseInt(value);
+      if (!isNaN(minutes) && minutes > 0) {
+        cachedTimeout = minutes * 60 * 1000; // Convert to milliseconds
+        cacheExpiry = now + CACHE_DURATION;
+        return cachedTimeout;
+      }
+    }
+  } catch (error) {
+    // Only log if it's not a connection error (to avoid spam)
+    if (error.code !== 'ECONNRESET' && !error.message?.includes('Connection terminated')) {
+      console.error('Error getting session timeout:', error.message);
+    }
+  }
+  
+  // Use cached value if available, otherwise default
+  return cachedTimeout || DEFAULT_SESSION_TIMEOUT;
+}
+
+async function sessionTimeoutMiddleware(req, res, next) {
+  // Skip for non-authenticated routes
+  if (!req.headers.authorization) {
+    return next();
+  }
+  
+  const token = req.headers.authorization.split(' ')[1];
+  if (!token) {
+    return next();
+  }
+  
+  try {
+    // Verify token is valid
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    
+    // Check if this is an admin token
+    if (!decoded.id) {
+      return next();
+    }
+    
+    const now = Date.now();
+    const lastActivity = sessions.get(token);
+    const timeout = await getSessionTimeout();
+    
+    // If session exists, check if it's expired
+    if (lastActivity) {
+      if (now - lastActivity > timeout) {
+        sessions.delete(token);
+        return res.status(401).json({ 
+          error: 'Session expired', 
+          code: 'SESSION_TIMEOUT' 
+        });
+      }
+    }
+    
+    // Update last activity
+    sessions.set(token, now);
+    
+    // Clean up old token if user has a new one
+    // This prevents memory leaks from token renewals
+    const userId = decoded.id;
+    for (const [oldToken, _] of sessions.entries()) {
+      if (oldToken !== token) {
+        try {
+          const oldDecoded = jwt.verify(oldToken, process.env.JWT_SECRET);
+          if (oldDecoded.id === userId) {
+            sessions.delete(oldToken);
+          }
+        } catch (e) {
+          // Token is invalid, remove it
+          sessions.delete(oldToken);
+        }
+      }
+    }
+    
+    next();
+  } catch (error) {
+    // Token is invalid
+    next();
+  }
+}
+
+// Function to end a session
+function endSession(token) {
+  sessions.delete(token);
+}
+
+// Function to get active sessions count
+function getActiveSessions() {
+  const now = Date.now();
+  let active = 0;
+  
+  for (const [_, lastActivity] of sessions.entries()) {
+    if (now - lastActivity <= DEFAULT_SESSION_TIMEOUT) {
+      active++;
+    }
+  }
+  
+  return active;
+}
+
+module.exports = { 
+  sessionTimeoutMiddleware, 
+  endSession,
+  getActiveSessions 
+};

backend/src/middleware/uploadValidation.js

@@ -0,0 +1,111 @@
+const fs = require('fs').promises;
+const path = require('path');
+const sharp = require('sharp');
+const logger = require('../utils/logger');
+
+/**
+ * Validate uploaded file is complete and not corrupted
+ */
+async function validateUploadedFile(filePath) {
+  try {
+    // Check file exists and has size
+    const stats = await fs.stat(filePath);
+    if (stats.size === 0) {
+      throw new Error('File is empty');
+    }
+    
+    // For image files, verify they can be read by Sharp
+    const ext = path.extname(filePath).toLowerCase();
+    const imageExtensions = ['.jpg', '.jpeg', '.png', '.gif', '.webp'];
+    
+    if (imageExtensions.includes(ext)) {
+      // Try to read metadata - this will fail if image is corrupted
+      let metadata;
+      try {
+        metadata = await sharp(filePath, {
+          failOnError: false, // Don't fail on recoverable errors
+          limitInputPixels: 268402689 // ~16k x 16k max
+        }).metadata();
+      } catch (metadataError) {
+        // If metadata reading fails, the file is likely incomplete
+        throw new Error(`Invalid image file: ${metadataError.message}`);
+      }
+      
+      if (!metadata || !metadata.width || !metadata.height) {
+        throw new Error('Invalid image dimensions - file may be incomplete');
+      }
+      
+      // Check for reasonable dimensions
+      if (metadata.width < 10 || metadata.height < 10) {
+        throw new Error('Image dimensions too small');
+      }
+      
+      // Additional check: verify we can actually decode a small portion of the image
+      try {
+        await sharp(filePath, {
+          failOnError: false,
+          limitInputPixels: 268402689
+        })
+        .resize(10, 10) // Try to resize to very small size
+        .toBuffer();
+      } catch (decodeError) {
+        throw new Error(`Image decode failed - file may be corrupted: ${decodeError.message}`);
+      }
+      
+      return true;
+    }
+    
+    return true;
+  } catch (error) {
+    logger.error(`File validation failed for ${filePath}:`, error.message);
+    throw error;
+  }
+}
+
+/**
+ * Middleware to validate uploaded files after multer processing
+ */
+async function validateUploadedFiles(req, res, next) {
+  if (!req.files || req.files.length === 0) {
+    return next();
+  }
+  
+  const validFiles = [];
+  const invalidFiles = [];
+  
+  // Validate each file
+  for (const file of req.files) {
+    try {
+      await validateUploadedFile(file.path);
+      validFiles.push(file);
+    } catch (error) {
+      logger.warn(`Removing invalid upload ${file.originalname}: ${error.message}`);
+      invalidFiles.push({
+        filename: file.originalname,
+        error: error.message
+      });
+      
+      // Delete the invalid file
+      try {
+        await fs.unlink(file.path);
+      } catch (unlinkErr) {
+        logger.error(`Failed to delete invalid file ${file.path}:`, unlinkErr.message);
+      }
+    }
+  }
+  
+  // Update req.files to only include valid files
+  req.files = validFiles;
+  
+  // Store invalid files info for response
+  if (invalidFiles.length > 0) {
+    req.invalidFiles = invalidFiles;
+  }
+  
+  next();
+}
+
+module.exports = {
+  validateUploadedFile,
+  validateUploadedFiles
+};

backend/src/routes/admin.js

@@ -0,0 +1,26 @@
+const express = require('express');
+const router = express.Router();
+
+// Import sub-routers
+const dashboardRoutes = require('./adminDashboard');
+const archiveRoutes = require('./adminArchives');
+const emailRoutes = require('./adminEmail');
+const settingsRoutes = require('./adminSettings');
+const eventsRoutes = require('./adminEvents');
+const photosRoutes = require('./adminPhotos');
+const categoriesRoutes = require('./adminCategories');
+const cmsRoutes = require('./adminCMS');
+const notificationsRoutes = require('./adminNotifications');
+
+// Mount sub-routers
+router.use('/dashboard', dashboardRoutes);
+router.use('/archives', archiveRoutes);
+router.use('/email', emailRoutes);
+router.use('/settings', settingsRoutes);
+router.use('/events', eventsRoutes);
+router.use('/events', photosRoutes);
+router.use('/categories', categoriesRoutes);
+router.use('/cms', cmsRoutes);
+router.use('/notifications', notificationsRoutes);
+
+module.exports = router;

backend/src/routes/adminArchives.js

@@ -0,0 +1,411 @@
+const express = require('express');
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const archiver = require('archiver');
+const AdmZip = require('adm-zip');
+const router = express.Router();
+
+// Get all archived events
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const page = parseInt(req.query.page) || 1;
+    const limit = parseInt(req.query.limit) || 20;
+    const offset = (page - 1) * limit;
+
+    // Get total count
+    const totalCount = await db('events')
+      .where('is_archived', formatBoolean(true))
+      .count('id as count')
+      .first();
+
+    // Get archived events
+    const archives = await db('events')
+      .select(
+        'events.*',
+        db.raw('COUNT(DISTINCT photos.id) as photo_count'),
+        db.raw('SUM(photos.size_bytes) as total_size')
+      )
+      .leftJoin('photos', 'events.id', 'photos.event_id')
+      .where('events.is_archived', formatBoolean(true))
+      .groupBy('events.id')
+      .orderBy('events.archived_at', 'desc')
+      .limit(limit)
+      .offset(offset);
+
+    // Check if archive files exist and get their sizes
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const archivesWithFileInfo = await Promise.all(archives.map(async (archive) => {
+      let archiveFileSize = 0;
+      if (archive.archive_path) {
+        try {
+          const fullArchivePath = path.join(storagePath, archive.archive_path);
+          const stats = await fs.stat(fullArchivePath);
+          archiveFileSize = stats.size;
+        } catch (error) {
+          console.error(`Archive file not found: ${archive.archive_path}`);
+        }
+      }
+
+      return {
+        id: archive.id,
+        slug: archive.slug,
+        eventName: archive.event_name,
+        eventDate: archive.event_date,
+        eventType: archive.event_type,
+        hostEmail: archive.host_email,
+        archivedAt: archive.archived_at ? new Date(archive.archived_at).toISOString() : null,
+        expiresAt: archive.expires_at ? new Date(archive.expires_at).toISOString() : null,
+        photoCount: archive.photo_count || 0,
+        originalSize: archive.total_size || 0,
+        archiveSize: archiveFileSize,
+        archivePath: archive.archive_path
+      };
+    }));
+
+    res.json({
+      archives: archivesWithFileInfo,
+      pagination: {
+        page,
+        limit,
+        total: totalCount.count,
+        totalPages: Math.ceil(totalCount.count / limit)
+      }
+    });
+  } catch (error) {
+    console.error('Archives list error:', error);
+    res.status(500).json({ error: 'Failed to fetch archives' });
+  }
+});
+
+// Get single archive details
+router.get('/:id', adminAuth, async (req, res) => {
+  try {
+    const archive = await db('events')
+      .where('id', req.params.id)
+      .where('is_archived', formatBoolean(true))
+      .first();
+
+    if (!archive) {
+      return res.status(404).json({ error: 'Archive not found' });
+    }
+
+    // Get photo details
+    const photos = await db('photos')
+      .where('event_id', archive.id)
+      .select('filename', 'type', 'size_bytes', 'uploaded_at');
+
+    // Check archive file
+    let archiveFileInfo = null;
+    if (archive.archive_path) {
+      try {
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const fullArchivePath = path.join(storagePath, archive.archive_path);
+        const stats = await fs.stat(fullArchivePath);
+        archiveFileInfo = {
+          size: stats.size,
+          createdAt: stats.birthtime,
+          path: archive.archive_path
+        };
+      } catch (error) {
+        console.error('Archive file not found:', error);
+      }
+    }
+
+    res.json({
+      id: archive.id,
+      slug: archive.slug,
+      eventName: archive.event_name,
+      eventDate: archive.event_date,
+      eventType: archive.event_type,
+      hostEmail: archive.host_email,
+      adminEmail: archive.admin_email,
+      welcomeMessage: archive.welcome_message,
+      colorTheme: archive.color_theme,
+      createdAt: archive.created_at,
+      expiresAt: archive.expires_at,
+      archivedAt: archive.archived_at,
+      photos: photos,
+      archiveFile: archiveFileInfo
+    });
+  } catch (error) {
+    console.error('Archive details error:', error);
+    res.status(500).json({ error: 'Failed to fetch archive details' });
+  }
+});
+
+// Restore archive
+router.post('/:id/restore', adminAuth, async (req, res) => {
+  try {
+    const archive = await db('events')
+      .where('id', req.params.id)
+      .where('is_archived', formatBoolean(true))
+      .first();
+
+    if (!archive) {
+      return res.status(404).json({ error: 'Archive not found' });
+    }
+
+    // Check if archive file exists
+    if (!archive.archive_path) {
+      return res.status(400).json({ error: 'No archive file found' });
+    }
+
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const fullArchivePath = path.join(storagePath, archive.archive_path);
+
+    try {
+      await fs.access(fullArchivePath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Archive file not found on disk' });
+    }
+
+    // Extract the archive
+    try {
+      const zip = new AdmZip(fullArchivePath);
+      const eventsDir = path.join(storagePath, 'events/active');
+      const eventDir = path.join(eventsDir, archive.slug);
+      
+      // Create event directory if it doesn't exist
+      await fs.mkdir(eventDir, { recursive: true });
+      
+      // Log ZIP contents for debugging
+      console.log(`Extracting archive to: ${eventDir}`);
+      const entries = zip.getEntries();
+      console.log(`Archive contains ${entries.length} entries`);
+      
+      // Extract files to the event directory
+      zip.extractAllTo(eventDir, true);
+      
+      // Get list of extracted files to update database
+      const extractedPhotos = [];
+      
+      // First, collect all category information from the ZIP structure
+      const categoriesMap = new Map();
+      
+      for (const entry of entries) {
+        if (!entry.isDirectory && entry.entryName.match(/\.(jpg|jpeg|png|gif|webp)$/i)) {
+          const filename = path.basename(entry.entryName);
+          const dirPath = path.dirname(entry.entryName);
+          const actualFilePath = path.join(eventDir, entry.entryName);
+          
+          try {
+            // Check if file was extracted successfully
+            const stats = await fs.stat(actualFilePath);
+            
+            // Determine category from directory structure
+            let categoryId = null;
+            if (dirPath && dirPath !== '.') {
+              // Get the first level directory as category
+              const categoryName = dirPath.split(path.sep)[0];
+              
+              if (!categoriesMap.has(categoryName)) {
+                // Check if this category exists in the database
+                const existingCategory = await db('photo_categories')
+                  .where('event_id', archive.id)
+                  .where('name', categoryName)
+                  .first();
+                
+                if (existingCategory) {
+                  categoriesMap.set(categoryName, existingCategory.id);
+                } else {
+                  // Create the category if it doesn't exist
+                  const insertResult = await db('photo_categories').insert({
+                    event_id: archive.id,
+                    name: categoryName,
+                    slug: categoryName.toLowerCase().replace(/[^a-z0-9]/g, '-'),
+                    created_at: new Date()
+                  }).returning('id');
+                  
+                  const newCategoryId = insertResult[0]?.id || insertResult[0];
+                  categoriesMap.set(categoryName, newCategoryId);
+                }
+              }
+              
+              categoryId = categoriesMap.get(categoryName);
+            }
+          
+            // Check if photo already exists in database
+            const existingPhoto = await db('photos')
+              .where('event_id', archive.id)
+              .where('filename', filename)
+              .first();
+            
+            if (!existingPhoto) {
+              // Store relative path from storage root
+              const relativePath = path.relative(storagePath, actualFilePath);
+              extractedPhotos.push({
+                event_id: archive.id,
+                filename: filename,
+                original_filename: filename,
+                path: relativePath,
+                thumbnail_path: null, // Will be regenerated by thumbnail service
+                type: path.extname(filename).substring(1).toLowerCase(),
+                size_bytes: stats.size,
+                category_id: categoryId,
+                uploaded_at: new Date()
+              });
+            }
+          } catch (statError) {
+            console.error(`Failed to stat file: ${actualFilePath}`);
+            console.error(`Entry name was: ${entry.entryName}`);
+            console.error('Error:', statError.message);
+            // Skip this file if we can't stat it
+            continue;
+          }
+        }
+      }
+      
+      // Insert new photos if any
+      if (extractedPhotos.length > 0) {
+        await db('photos').insert(extractedPhotos);
+      }
+      
+    } catch (extractError) {
+      console.error('Archive extraction error:', extractError);
+      return res.status(500).json({ error: 'Failed to extract archive: ' + extractError.message });
+    }
+    
+    // Update event status
+    const thirtyDaysFromNow = new Date();
+    thirtyDaysFromNow.setDate(thirtyDaysFromNow.getDate() + 30);
+    
+    await db('events')
+      .where('id', req.params.id)
+      .update({
+        is_archived: false,
+        is_active: true,
+        archive_path: null,
+        archived_at: null,
+        expires_at: thirtyDaysFromNow.toISOString() // Reset expiration - works on both DBs
+      });
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'archive_restored',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      event_id: archive.id,
+      metadata: JSON.stringify({ event_name: archive.event_name })
+    });
+
+    res.json({ message: 'Archive restored successfully' });
+  } catch (error) {
+    console.error('Archive restore error:', error);
+    res.status(500).json({ error: 'Failed to restore archive' });
+  }
+});
+
+// Download archive
+router.get('/:id/download', adminAuth, async (req, res) => {
+  try {
+    const archive = await db('events')
+      .where('id', req.params.id)
+      .where('is_archived', formatBoolean(true))
+      .first();
+
+    if (!archive) {
+      return res.status(404).json({ error: 'Archive not found' });
+    }
+
+    if (!archive.archive_path) {
+      return res.status(404).json({ error: 'Archive file not found' });
+    }
+
+    // Check if file exists
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const fullArchivePath = path.join(storagePath, archive.archive_path);
+    
+    try {
+      await fs.access(fullArchivePath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Archive file not found on disk' });
+    }
+
+    // Set headers for download
+    res.setHeader('Content-Type', 'application/zip');
+    res.setHeader('Content-Disposition', `attachment; filename="${archive.slug}.zip"`);
+
+    // Stream the file
+    const fileStream = require('fs').createReadStream(fullArchivePath);
+    fileStream.pipe(res);
+
+    // Log download
+    await db('activity_logs').insert({
+      activity_type: 'archive_downloaded',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      event_id: archive.id,
+      metadata: JSON.stringify({ event_name: archive.event_name })
+    });
+  } catch (error) {
+    console.error('Archive download error:', error);
+    res.status(500).json({ error: 'Failed to download archive' });
+  }
+});
+
+// Delete archive permanently
+router.delete('/:id', adminAuth, async (req, res) => {
+  try {
+    const archive = await db('events')
+      .where('id', req.params.id)
+      .where('is_archived', formatBoolean(true))
+      .first();
+
+    if (!archive) {
+      return res.status(404).json({ error: 'Archive not found' });
+    }
+
+    // Delete archive file if exists
+    if (archive.archive_path) {
+      try {
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const fullArchivePath = path.join(storagePath, archive.archive_path);
+        await fs.unlink(fullArchivePath);
+      } catch (error) {
+        console.error('Failed to delete archive file:', error);
+      }
+    }
+
+    // Delete thumbnails for this event
+    const photos = await db('photos').where('event_id', req.params.id).select('thumbnail_path');
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    
+    for (const photo of photos) {
+      if (photo.thumbnail_path) {
+        try {
+          const thumbPath = path.join(storagePath, photo.thumbnail_path.replace(/^\//, ''));
+          await fs.unlink(thumbPath);
+        } catch (error) {
+          // Ignore errors - thumbnail might already be deleted
+        }
+      }
+    }
+
+    // Delete from database (cascade will delete photos and logs)
+    await db('events').where('id', req.params.id).delete();
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'archive_deleted',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ 
+        event_name: archive.event_name,
+        archived_date: archive.archived_at 
+      })
+    });
+
+    res.json({ message: 'Archive deleted permanently' });
+  } catch (error) {
+    console.error('Archive delete error:', error);
+    res.status(500).json({ error: 'Failed to delete archive' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminAuth.js

@@ -0,0 +1,99 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const { endSession } = require('../middleware/sessionTimeout');
+const { validatePasswordStrength } = require('../utils/passwordGenerator');
+const router = express.Router();
+
+// Change password
+router.post('/change-password', [
+  adminAuth,
+  body('currentPassword').notEmpty().withMessage('Current password is required'),
+  body('newPassword').isLength({ min: 12 }).withMessage('New password must be at least 12 characters')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { currentPassword, newPassword } = req.body;
+    const userId = req.admin.id; // Changed from req.user.id to req.admin.id
+
+    // Validate new password strength
+    const passwordValidation = validatePasswordStrength(newPassword);
+    if (!passwordValidation.isValid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.messages
+      });
+    }
+
+    // Get user from database
+    const user = await db('admin_users')
+      .where('id', userId)
+      .first();
+
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
+    // Verify current password
+    const validPassword = await bcrypt.compare(currentPassword, user.password_hash);
+    if (!validPassword) {
+      return res.status(400).json({ error: 'Current password is incorrect' });
+    }
+
+    // Hash new password with more rounds
+    const newPasswordHash = await bcrypt.hash(newPassword, 12);
+
+    // Update password and clear must_change_password flag
+    await db('admin_users')
+      .where('id', userId)
+      .update({
+        password_hash: newPasswordHash,
+        must_change_password: false,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity('password_changed', 
+      { admin_id: userId }, 
+      null,
+      { type: 'admin', id: userId, name: user.username }
+    );
+
+    res.json({ message: 'Password changed successfully' });
+  } catch (error) {
+    console.error('Password change error:', error);
+    res.status(500).json({ error: 'Failed to change password' });
+  }
+});
+
+// Logout
+router.post('/logout', adminAuth, async (req, res) => {
+  try {
+    // Get token from header
+    const token = req.headers.authorization?.split(' ')[1];
+    if (token) {
+      // End the session
+      endSession(token);
+    }
+    
+    // Log activity
+    await logActivity('admin_logout', 
+      { admin_id: req.admin.id }, 
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: 'Logged out successfully' });
+  } catch (error) {
+    console.error('Logout error:', error);
+    res.status(500).json({ error: 'Failed to logout' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminCMS.js

@@ -0,0 +1,83 @@
+const express = require('express');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+
+// Get all CMS pages
+router.get('/pages', adminAuth, async (req, res) => {
+  try {
+    const pages = await db('cms_pages').select('*').orderBy('slug', 'asc');
+    res.json(pages);
+  } catch (error) {
+    console.error('Error fetching CMS pages:', error);
+    res.status(500).json({ error: 'Failed to fetch pages' });
+  }
+});
+
+// Get a single CMS page
+router.get('/pages/:slug', adminAuth, async (req, res) => {
+  try {
+    const { slug } = req.params;
+    const page = await db('cms_pages').where('slug', slug).first();
+    
+    if (!page) {
+      return res.status(404).json({ error: 'Page not found' });
+    }
+    
+    res.json(page);
+  } catch (error) {
+    console.error('Error fetching CMS page:', error);
+    res.status(500).json({ error: 'Failed to fetch page' });
+  }
+});
+
+// Update a CMS page
+router.put('/pages/:slug', adminAuth, [
+  body('title_en').optional().isString(),
+  body('title_de').optional().isString(),
+  body('content_en').optional().isString(),
+  body('content_de').optional().isString()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { slug } = req.params;
+    const { title_en, title_de, content_en, content_de } = req.body;
+    
+    const page = await db('cms_pages').where('slug', slug).first();
+    if (!page) {
+      return res.status(404).json({ error: 'Page not found' });
+    }
+    
+    // Update the page
+    await db('cms_pages')
+      .where('slug', slug)
+      .update({
+        title_en,
+        title_de,
+        content_en,
+        content_de,
+        updated_at: new Date()
+      });
+    
+    const updated = await db('cms_pages').where('slug', slug).first();
+    
+    // Log activity
+    await logActivity('cms_page_updated',
+      { page: slug },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json(updated);
+  } catch (error) {
+    console.error('Error updating CMS page:', error);
+    res.status(500).json({ error: 'Failed to update page' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminCategories.js

@@ -0,0 +1,185 @@
+const express = require('express');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+
+// Get all global categories
+router.get('/global', adminAuth, async (req, res) => {
+  try {
+    const categories = await db('photo_categories')
+      .where('is_global', formatBoolean(true))
+      .orderBy('name', 'asc');
+    
+    res.json(categories);
+  } catch (error) {
+    console.error('Error fetching categories:', error);
+    res.status(500).json({ error: 'Failed to fetch categories' });
+  }
+});
+
+// Get categories for a specific event (global + event-specific)
+router.get('/event/:eventId', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    
+    const categories = await db('photo_categories')
+      .where(function() {
+        this.where('is_global', formatBoolean(true))
+          .orWhere('event_id', eventId);
+      })
+      .orderBy('is_global', 'desc')
+      .orderBy('name', 'asc');
+    
+    res.json(categories);
+  } catch (error) {
+    console.error('Error fetching event categories:', error);
+    res.status(500).json({ error: 'Failed to fetch categories' });
+  }
+});
+
+// Create a new category
+router.post('/', adminAuth, [
+  body('name').notEmpty().withMessage('Category name is required'),
+  body('slug').optional(),
+  body('is_global').optional().isBoolean(),
+  body('event_id').optional().isInt()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { name, slug, is_global = true, event_id = null } = req.body;
+    
+    // Generate slug if not provided
+    const categorySlug = slug || name.toLowerCase()
+      .replace(/[^\w\s-]/g, '')
+      .replace(/\s+/g, '-')
+      .replace(/-+/g, '-')
+      .trim();
+    
+    // Check if slug already exists for this scope
+    const existing = await db('photo_categories')
+      .where('slug', categorySlug)
+      .where(function() {
+        if (is_global) {
+          this.where('is_global', formatBoolean(true));
+        } else {
+          this.where('event_id', event_id);
+        }
+      })
+      .first();
+    
+    if (existing) {
+      return res.status(400).json({ error: 'Category with this slug already exists' });
+    }
+    
+    // Create category
+    const insertResult = await db('photo_categories').insert({
+      name,
+      slug: categorySlug,
+      is_global,
+      event_id: is_global ? null : event_id
+    }).returning('id');
+    
+    const categoryId = insertResult[0]?.id || insertResult[0];
+    
+    const category = await db('photo_categories').where('id', categoryId).first();
+    
+    // Log activity
+    await logActivity('category_created', 
+      { categoryName: name, isGlobal: is_global },
+      event_id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json(category);
+  } catch (error) {
+    console.error('Error creating category:', error);
+    res.status(500).json({ error: 'Failed to create category' });
+  }
+});
+
+// Update a category
+router.put('/:id', adminAuth, [
+  body('name').notEmpty().withMessage('Category name is required')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { id } = req.params;
+    const { name } = req.body;
+    
+    const category = await db('photo_categories').where('id', id).first();
+    if (!category) {
+      return res.status(404).json({ error: 'Category not found' });
+    }
+    
+    await db('photo_categories')
+      .where('id', id)
+      .update({
+        name,
+        slug: name.toLowerCase()
+          .replace(/[^\w\s-]/g, '')
+          .replace(/\s+/g, '-')
+          .replace(/-+/g, '-')
+          .trim()
+      });
+    
+    const updated = await db('photo_categories').where('id', id).first();
+    
+    // Log activity
+    await logActivity('category_updated',
+      { categoryName: name },
+      category.event_id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json(updated);
+  } catch (error) {
+    console.error('Error updating category:', error);
+    res.status(500).json({ error: 'Failed to update category' });
+  }
+});
+
+// Delete a category
+router.delete('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    const category = await db('photo_categories').where('id', id).first();
+    if (!category) {
+      return res.status(404).json({ error: 'Category not found' });
+    }
+    
+    // Check if category has photos
+    const photoCount = await db('photos').where('category_id', id).count('id as count').first();
+    if (photoCount.count > 0) {
+      return res.status(400).json({ 
+        error: 'Cannot delete category with photos. Please reassign photos first.' 
+      });
+    }
+    
+    await db('photo_categories').where('id', id).delete();
+    
+    // Log activity
+    await logActivity('category_deleted',
+      { categoryName: category.name },
+      category.event_id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: 'Category deleted successfully' });
+  } catch (error) {
+    console.error('Error deleting category:', error);
+    res.status(500).json({ error: 'Failed to delete category' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminDashboard.js

@@ -0,0 +1,323 @@
+const express = require('express');
+const { db } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const { sanitizeDays, addDateRangeCondition } = require('../utils/sqlSecurity');
+const { formatBoolean } = require('../utils/dbCompat');
+const router = express.Router();
+
+// Get dashboard statistics
+router.get('/stats', adminAuth, async (req, res) => {
+  try {
+    // Get active events count
+    const activeEvents = await db('events')
+      .where('is_active', formatBoolean(true))
+      .where('is_archived', formatBoolean(false))
+      .count('id as count')
+      .first();
+
+    // Get events expiring within 7 days
+    const sevenDaysFromNow = new Date();
+    sevenDaysFromNow.setDate(sevenDaysFromNow.getDate() + 7);
+    const now = new Date();
+    
+    const expiringEvents = await db('events')
+      .where('is_active', formatBoolean(true))
+      .where('is_archived', formatBoolean(false))
+      .where('expires_at', '<=', sevenDaysFromNow.toISOString())
+      .where('expires_at', '>', now.toISOString())
+      .count('id as count')
+      .first();
+
+    // Get total photos count
+    const totalPhotos = await db('photos')
+      .count('id as count')
+      .first();
+
+    // Get storage usage (sum of all photo sizes)
+    const storageUsed = await db('photos')
+      .sum('size_bytes as total')
+      .first();
+
+    // Get total views (last 30 days)
+    const thirtyDaysAgo = new Date();
+    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+    
+    const totalViews = await db('access_logs')
+      .where('action', 'view')
+      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    // Get total downloads (last 30 days)
+    const totalDownloads = await db('access_logs')
+      .where('action', 'download')
+      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    // Get archived events count
+    const archivedEvents = await db('events')
+      .where('is_archived', formatBoolean(true))
+      .count('id as count')
+      .first();
+
+    // Calculate trends (compare with previous 30 days)
+    const sixtyDaysAgo = new Date();
+    sixtyDaysAgo.setDate(sixtyDaysAgo.getDate() - 60);
+    
+    const previousViews = await db('access_logs')
+      .where('action', 'view')
+      .where('timestamp', '>=', sixtyDaysAgo.toISOString())
+      .where('timestamp', '<', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    const previousDownloads = await db('access_logs')
+      .where('action', 'download')
+      .where('timestamp', '>=', sixtyDaysAgo.toISOString())
+      .where('timestamp', '<', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    // Calculate trend percentages
+    const viewsTrend = previousViews.count > 0 
+      ? ((totalViews.count - previousViews.count) / previousViews.count) * 100 
+      : 0;
+    
+    const downloadsTrend = previousDownloads.count > 0
+      ? ((totalDownloads.count - previousDownloads.count) / previousDownloads.count) * 100
+      : 0;
+
+    res.json({
+      activeEvents: activeEvents.count || 0,
+      expiringEvents: expiringEvents.count || 0,
+      totalPhotos: totalPhotos.count || 0,
+      storageUsed: storageUsed.total || 0,
+      totalViews: totalViews.count || 0,
+      totalDownloads: totalDownloads.count || 0,
+      viewsTrend: Math.round(viewsTrend * 10) / 10,
+      downloadsTrend: Math.round(downloadsTrend * 10) / 10,
+      archivedEvents: archivedEvents.count || 0
+    });
+  } catch (error) {
+    console.error('Dashboard stats error:', error);
+    res.status(500).json({ error: 'Failed to fetch dashboard statistics' });
+  }
+});
+
+// Get recent activity
+router.get('/activity', adminAuth, async (req, res) => {
+  try {
+    const limit = parseInt(req.query.limit) || 10;
+    
+    const activities = await db('activity_logs')
+      .select('activity_logs.*', 'events.event_name')
+      .leftJoin('events', 'activity_logs.event_id', 'events.id')
+      .orderBy('activity_logs.created_at', 'desc')
+      .limit(limit);
+
+    // Format activities
+    const formattedActivities = activities.map(activity => ({
+      id: activity.id,
+      type: activity.activity_type,
+      actorType: activity.actor_type,
+      actorName: activity.actor_name,
+      eventName: activity.event_name,
+      metadata: (() => {
+        try {
+          if (!activity.metadata) return {};
+          if (typeof activity.metadata === 'object') return activity.metadata;
+          return JSON.parse(activity.metadata);
+        } catch (e) {
+          console.warn('Failed to parse metadata for activity:', activity.id, e.message);
+          return {};
+        }
+      })(),
+      createdAt: activity.created_at
+    }));
+
+    res.json(formattedActivities);
+  } catch (error) {
+    console.error('Activity log error:', error);
+    res.status(500).json({ error: 'Failed to fetch activity log' });
+  }
+});
+
+// Get system health status
+router.get('/health', adminAuth, async (req, res) => {
+  try {
+    const os = require('os');
+    
+    // Check database connectivity
+    let dbStatus = 'healthy';
+    try {
+      await db.raw('SELECT 1');
+    } catch (error) {
+      dbStatus = 'error';
+    }
+
+    // Check email queue
+    const [pendingEmails] = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count');
+    
+    const twentyFourHoursAgo = new Date();
+    twentyFourHoursAgo.setHours(twentyFourHoursAgo.getHours() - 24);
+    
+    const [failedEmails] = await db('email_queue')
+      .where('status', 'failed')
+      .where('created_at', '>=', twentyFourHoursAgo.toISOString())
+      .count('* as count');
+
+    const emailStatus = failedEmails.count > 10 ? 'warning' : 'healthy';
+
+    // Check disk space (simplified)
+    const storageStatus = 'healthy'; // In production, check actual disk usage
+
+    // Memory usage
+    const memoryUsage = {
+      total: os.totalmem(),
+      free: os.freemem(),
+      used: os.totalmem() - os.freemem(),
+      percentage: Math.round(((os.totalmem() - os.freemem()) / os.totalmem()) * 100)
+    };
+
+    const memoryStatus = memoryUsage.percentage > 90 ? 'warning' : 'healthy';
+
+    // Overall health
+    const statuses = [dbStatus, emailStatus, storageStatus, memoryStatus];
+    let overallHealth = 'healthy';
+    if (statuses.includes('error')) overallHealth = 'error';
+    else if (statuses.includes('warning')) overallHealth = 'warning';
+
+    res.json({
+      overall: overallHealth,
+      services: {
+        database: dbStatus,
+        email: emailStatus,
+        storage: storageStatus,
+        memory: memoryStatus
+      },
+      details: {
+        emailQueue: {
+          pending: pendingEmails.count,
+          failed: failedEmails.count
+        },
+        memory: memoryUsage
+      }
+    });
+  } catch (error) {
+    console.error('Health check error:', error);
+    res.status(500).json({ 
+      overall: 'error',
+      error: 'Failed to check system health' 
+    });
+  }
+});
+
+// Get analytics data for charts
+router.get('/analytics', adminAuth, async (req, res) => {
+  try {
+    const days = sanitizeDays(req.query.days || 7);
+    
+    // Generate date range
+    const dates = [];
+    for (let i = days - 1; i >= 0; i--) {
+      dates.push({
+        date: new Date(Date.now() - i * 24 * 60 * 60 * 1000).toISOString().split('T')[0],
+        views: 0,
+        downloads: 0,
+        uniqueVisitors: 0
+      });
+    }
+
+    // Calculate the start date for queries
+    const startDate = new Date();
+    startDate.setDate(startDate.getDate() - days);
+    const startDateStr = startDate.toISOString();
+
+    // Get views per day
+    const viewsData = await db('access_logs')
+      .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
+      .where('action', 'view')
+      .where('timestamp', '>=', startDateStr)
+      .groupByRaw('DATE(timestamp)');
+
+    // Get downloads per day
+    const downloadsData = await db('access_logs')
+      .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
+      .where('action', 'download')
+      .where('timestamp', '>=', startDateStr)
+      .groupByRaw('DATE(timestamp)');
+
+    // Get unique visitors per day
+    const visitorsData = await db('access_logs')
+      .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(DISTINCT ip_address) as count'))
+      .where('timestamp', '>=', startDateStr)
+      .groupByRaw('DATE(timestamp)');
+
+    // Merge data into dates array
+    viewsData.forEach(row => {
+      const dateObj = dates.find(d => d.date === row.date);
+      if (dateObj) dateObj.views = row.count;
+    });
+
+    downloadsData.forEach(row => {
+      const dateObj = dates.find(d => d.date === row.date);
+      if (dateObj) dateObj.downloads = row.count;
+    });
+
+    visitorsData.forEach(row => {
+      const dateObj = dates.find(d => d.date === row.date);
+      if (dateObj) dateObj.uniqueVisitors = row.count;
+    });
+
+    // Get top galleries by views
+    const topGalleries = await db('access_logs')
+      .select('events.event_name', 'events.slug')
+      .select(db.raw('COUNT(*) as views'))
+      .join('events', 'access_logs.event_id', 'events.id')
+      .where('access_logs.action', 'view')
+      .where('access_logs.timestamp', '>=', startDateStr)
+      .groupBy('events.id')
+      .orderBy('views', 'desc')
+      .limit(5);
+
+    // Get device breakdown (simplified - based on user agent)
+    const deviceData = await db('access_logs')
+      .select(
+        db.raw(`
+          CASE 
+            WHEN user_agent LIKE '%Mobile%' THEN 'mobile'
+            WHEN user_agent LIKE '%Tablet%' OR user_agent LIKE '%iPad%' THEN 'tablet'
+            ELSE 'desktop'
+          END as device_type
+        `),
+        db.raw('COUNT(*) as count')
+      )
+      .where('timestamp', '>=', startDateStr)
+      .groupBy('device_type');
+
+    const totalDevices = deviceData.reduce((sum, d) => sum + d.count, 0);
+    const devices = {
+      desktop: 0,
+      mobile: 0,
+      tablet: 0
+    };
+
+    deviceData.forEach(d => {
+      devices[d.device_type] = Math.round((d.count / totalDevices) * 100);
+    });
+
+    res.json({
+      chartData: dates,
+      topGalleries,
+      devices
+    });
+  } catch (error) {
+    console.error('Analytics error:', error);
+    res.status(500).json({ error: 'Failed to fetch analytics data' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminEmail.js

@@ -0,0 +1,432 @@
+const express = require('express');
+const nodemailer = require('nodemailer');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+
+// Get email configuration
+router.get('/config', adminAuth, async (req, res) => {
+  try {
+    const config = await db('email_configs').first();
+    
+    if (!config) {
+      return res.json({
+        smtp_host: '',
+        smtp_port: 587,
+        smtp_secure: false,
+        smtp_user: '',
+        smtp_pass: '', // Don't send actual password
+        from_email: '',
+        from_name: ''
+      });
+    }
+
+    // Don't send the actual password
+    res.json({
+      ...config,
+      smtp_pass: config.smtp_pass ? '********' : ''
+    });
+  } catch (error) {
+    console.error('Email config fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch email configuration' });
+  }
+});
+
+// Update email configuration
+router.post('/config', [
+  adminAuth,
+  body('smtp_host').notEmpty().withMessage('SMTP host is required'),
+  body('smtp_port').isInt({ min: 1, max: 65535 }).withMessage('Invalid port number'),
+  body('from_email').isEmail().withMessage('Invalid from email address')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const {
+      smtp_host,
+      smtp_port,
+      smtp_secure,
+      smtp_user,
+      smtp_pass,
+      from_email,
+      from_name
+    } = req.body;
+
+    // Check if config exists
+    const existingConfig = await db('email_configs').first();
+    
+    const configData = {
+      smtp_host,
+      smtp_port: parseInt(smtp_port),
+      smtp_secure: smtp_secure || false,
+      smtp_user: smtp_user || '',
+      from_email,
+      from_name: from_name || 'Photo Sharing',
+      updated_at: new Date()
+    };
+
+    // Only update password if provided and not masked
+    if (smtp_pass && smtp_pass !== '********') {
+      configData.smtp_pass = smtp_pass;
+    }
+
+    if (existingConfig) {
+      await db('email_configs')
+        .where('id', existingConfig.id)
+        .update(configData);
+    } else {
+      await db('email_configs').insert(configData);
+    }
+
+    // Log activity
+    await logActivity('email_config_updated', 
+      { smtp_host, from_email }, 
+      null, 
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Email configuration updated successfully' });
+  } catch (error) {
+    console.error('Email config update error:', error);
+    res.status(500).json({ error: 'Failed to update email configuration' });
+  }
+});
+
+// Test email configuration
+router.post('/test', adminAuth, async (req, res) => {
+  try {
+    const { test_email } = req.body;
+    
+    if (!test_email) {
+      return res.status(400).json({ error: 'Test email address is required' });
+    }
+
+    // Get email config
+    const config = await db('email_configs').first();
+    
+    if (!config) {
+      return res.status(400).json({ error: 'Email configuration not found. Please configure SMTP settings first.' });
+    }
+
+    // Validate SMTP configuration
+    if (!config.smtp_host || !config.smtp_port) {
+      return res.status(400).json({ 
+        error: 'Incomplete email configuration',
+        details: 'SMTP host and port are required'
+      });
+    }
+    
+    // Check if password might be masked (this shouldn't happen when fetching from DB)
+    if (config.smtp_pass === '********') {
+      return res.status(400).json({
+        error: 'Invalid email configuration',
+        details: 'SMTP password appears to be masked. Please reconfigure your email settings.'
+      });
+    }
+
+    // Create transporter with detailed logging
+    const transportConfig = {
+      host: config.smtp_host,
+      port: parseInt(config.smtp_port),
+      secure: config.smtp_secure === true || config.smtp_secure === 1,
+      auth: config.smtp_user && config.smtp_pass ? {
+        user: config.smtp_user,
+        pass: config.smtp_pass
+      } : undefined,
+      logger: process.env.NODE_ENV === 'development',
+      debug: process.env.NODE_ENV === 'development'
+    };
+
+    console.log('Creating email transporter with config:', {
+      host: transportConfig.host,
+      port: transportConfig.port,
+      secure: transportConfig.secure,
+      auth: transportConfig.auth ? 'configured' : 'none'
+    });
+
+    const transporter = nodemailer.createTransport(transportConfig);
+
+    // Send test email
+    await transporter.sendMail({
+      from: `${config.from_name} <${config.from_email}>`,
+      to: test_email,
+      subject: 'Test Email - Photo Sharing Platform',
+      html: `
+        <h2>Test Email Successful!</h2>
+        <p>This is a test email from your Photo Sharing platform.</p>
+        <p>If you're seeing this, your email configuration is working correctly.</p>
+        <hr>
+        <p style="color: #666; font-size: 12px;">
+          Sent from: ${config.from_email}<br>
+          SMTP Host: ${config.smtp_host}<br>
+          Time: ${new Date().toISOString()}
+        </p>
+      `,
+      text: 'Test Email Successful! Your email configuration is working correctly.'
+    });
+
+    res.json({ message: 'Test email sent successfully' });
+  } catch (error) {
+    console.error('Test email error:', error);
+    console.error('Error stack:', error.stack);
+    
+    // Provide more specific error messages
+    let errorMessage = 'Failed to send test email';
+    let details = error.message;
+    
+    if (error.code === 'ECONNREFUSED') {
+      errorMessage = 'Failed to connect to SMTP server';
+      details = 'Please check your SMTP host and port settings';
+    } else if (error.code === 'EAUTH') {
+      errorMessage = 'SMTP authentication failed';
+      details = 'Please check your SMTP username and password';
+    } else if (error.code === 'ESOCKET') {
+      errorMessage = 'Network error';
+      details = 'Could not establish connection to SMTP server';
+    }
+    
+    res.status(500).json({ 
+      error: errorMessage,
+      details: details,
+      code: error.code
+    });
+  }
+});
+
+// Get email templates
+router.get('/templates', adminAuth, async (req, res) => {
+  try {
+    const templates = await db('email_templates')
+      .select('*')
+      .orderBy('template_key');
+
+    // Parse variables JSON and format for multi-language support
+    const formattedTemplates = templates.map(template => {
+      const result = {
+        id: template.id,
+        template_key: template.template_key,
+        variables: (() => {
+          try {
+            if (!template.variables) return [];
+            if (typeof template.variables === 'object') return template.variables;
+            return JSON.parse(template.variables);
+          } catch (e) {
+            console.warn('Failed to parse variables for template:', template.template_key, e.message);
+            return [];
+          }
+        })(),
+        updated_at: template.updated_at
+      };
+      
+      // Handle both old and new schema formats
+      if (template.subject_en !== undefined) {
+        // New schema with language columns
+        result.subject_en = template.subject_en;
+        result.body_html_en = template.body_html_en;
+        result.body_text_en = template.body_text_en;
+        result.subject_de = template.subject_de;
+        result.body_html_de = template.body_html_de;
+        result.body_text_de = template.body_text_de;
+      } else {
+        // Old schema - use basic columns for both languages
+        result.subject_en = template.subject;
+        result.body_html_en = template.body_html;
+        result.body_text_en = template.body_text;
+        result.subject_de = template.subject;
+        result.body_html_de = template.body_html;
+        result.body_text_de = template.body_text;
+      }
+      
+      return result;
+    });
+
+    res.json(formattedTemplates);
+  } catch (error) {
+    console.error('Email templates fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch email templates' });
+  }
+});
+
+// Get single template
+router.get('/templates/:key', adminAuth, async (req, res) => {
+  try {
+    const template = await db('email_templates')
+      .where('template_key', req.params.key)
+      .first();
+
+    if (!template) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    // Handle both old and new schema formats
+    const response = {
+      id: template.id,
+      template_key: template.template_key,
+      variables: (() => {
+        try {
+          if (!template.variables) return [];
+          if (typeof template.variables === 'object') return template.variables;
+          return JSON.parse(template.variables);
+        } catch (e) {
+          console.warn('Failed to parse variables for template:', template.template_key, e.message);
+          return [];
+        }
+      })(),
+      updated_at: template.updated_at
+    };
+    
+    // Check which columns exist and use them appropriately
+    if (template.subject_en !== undefined) {
+      // New schema with language columns
+      response.subject_en = template.subject_en;
+      response.body_html_en = template.body_html_en;
+      response.body_text_en = template.body_text_en;
+      response.subject_de = template.subject_de;
+      response.body_html_de = template.body_html_de;
+      response.body_text_de = template.body_text_de;
+    } else {
+      // Old schema - use basic columns for both languages
+      response.subject_en = template.subject;
+      response.body_html_en = template.body_html;
+      response.body_text_en = template.body_text;
+      response.subject_de = template.subject;
+      response.body_html_de = template.body_html;
+      response.body_text_de = template.body_text;
+    }
+    
+    res.json(response);
+  } catch (error) {
+    console.error('Email template fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch email template' });
+  }
+});
+
+// Update email template
+router.put('/templates/:key', [
+  adminAuth,
+  body('subject_en').optional().notEmpty().withMessage('English subject cannot be empty'),
+  body('subject_de').optional().notEmpty().withMessage('German subject cannot be empty'),
+  body('body_html_en').optional().notEmpty().withMessage('English HTML body cannot be empty'),
+  body('body_html_de').optional().notEmpty().withMessage('German HTML body cannot be empty')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const {
+      subject_en, subject_de,
+      body_html_en, body_html_de,
+      body_text_en, body_text_de
+    } = req.body;
+
+    const updateData = {
+      updated_at: new Date()
+    };
+
+    // Check which columns exist in the database
+    const template = await db('email_templates')
+      .where('template_key', req.params.key)
+      .first();
+      
+    if (!template) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    // Determine schema type and update accordingly
+    if (template.subject_en !== undefined) {
+      // New schema with language columns
+      if (subject_en !== undefined) updateData.subject_en = subject_en;
+      if (subject_de !== undefined) updateData.subject_de = subject_de;
+      if (body_html_en !== undefined) updateData.body_html_en = body_html_en;
+      if (body_html_de !== undefined) updateData.body_html_de = body_html_de;
+      if (body_text_en !== undefined) updateData.body_text_en = body_text_en || '';
+      if (body_text_de !== undefined) updateData.body_text_de = body_text_de || '';
+      
+      // Also update basic columns if they exist
+      if (template.subject !== undefined) {
+        updateData.subject = subject_en || updateData.subject_en;
+        updateData.body_html = body_html_en || updateData.body_html_en;
+        updateData.body_text = body_text_en || updateData.body_text_en || '';
+      }
+    } else {
+      // Old schema - only update basic columns
+      if (subject_en !== undefined) {
+        updateData.subject = subject_en;
+        updateData.body_html = body_html_en;
+        updateData.body_text = body_text_en || '';
+      }
+    }
+
+    const updated = await db('email_templates')
+      .where('template_key', req.params.key)
+      .update(updateData);
+
+    if (!updated) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    // Log activity
+    await logActivity('email_template_updated',
+      { template_key: req.params.key },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Email template updated successfully' });
+  } catch (error) {
+    console.error('Email template update error:', error);
+    res.status(500).json({ error: 'Failed to update email template' });
+  }
+});
+
+// Preview email template
+router.post('/templates/:key/preview', adminAuth, async (req, res) => {
+  try {
+    const template = await db('email_templates')
+      .where('template_key', req.params.key)
+      .first();
+
+    if (!template) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    const { preview_data, language = 'en' } = req.body;
+    
+    // Get the appropriate language version
+    const subjectField = language === 'de' && template.subject_de ? 'subject_de' : 'subject_en';
+    const htmlField = language === 'de' && template.body_html_de ? 'body_html_de' : 'body_html_en';
+    const textField = language === 'de' && template.body_text_de ? 'body_text_de' : 'body_text_en';
+    
+    // Handle backward compatibility
+    let htmlContent = template[htmlField] || template.body_html || '';
+    let textContent = template[textField] || template.body_text || '';
+    let subject = template[subjectField] || template.subject || '';
+
+    if (preview_data) {
+      Object.keys(preview_data).forEach(key => {
+        const regex = new RegExp(`{{${key}}}`, 'g');
+        htmlContent = htmlContent.replace(regex, preview_data[key]);
+        textContent = textContent.replace(regex, preview_data[key]);
+        subject = subject.replace(regex, preview_data[key]);
+      });
+    }
+
+    res.json({
+      subject,
+      body_html: htmlContent,
+      body_text: textContent,
+      language
+    });
+  } catch (error) {
+    console.error('Email template preview error:', error);
+    res.status(500).json({ error: 'Failed to preview email template' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminEvents-enhanced.js

@@ -0,0 +1,124 @@
+// This is a partial file showing the enhanced event creation with password validation
+// Only the relevant parts are shown - merge with existing adminEvents.js
+
+const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
+
+// Enhanced event creation with password validation
+router.post('/', adminAuth, [
+  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
+  body('event_name').notEmpty().trim(),
+  body('event_date').isDate(),
+  body('host_email').isEmail().normalizeEmail(),
+  body('admin_email').isEmail().normalizeEmail(),
+  body('password').notEmpty(), // Remove the weak isLength validation
+  body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
+  body('welcome_message').optional().trim(),
+  body('color_theme').optional().trim(),
+  body('allow_user_uploads').optional().isBoolean().toBoolean(),
+  body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
+  body('host_name').notEmpty().trim()
+], async (req, res) => {
+  try {
+    console.log('Create event request body:', req.body);
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      console.error('Validation errors:', errors.array());
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const {
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password,
+      welcome_message = '',
+      color_theme = null,
+      expiration_days = 30,
+      allow_user_uploads = false,
+      upload_category_id = null
+    } = req.body;
+    
+    // Validate password strength for gallery
+    const passwordValidation = validatePasswordInContext(password, 'gallery', {
+      eventName: event_name
+    });
+    
+    if (!passwordValidation.valid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.errors,
+        score: passwordValidation.score,
+        feedback: passwordValidation.feedback
+      });
+    }
+    
+    // Generate unique slug
+    const baseSlug = `${event_type}-${event_name.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${event_date}`;
+    let slug = baseSlug;
+    let counter = 1;
+    
+    while (await db('events').where({ slug }).first()) {
+      slug = `${baseSlug}-${counter}`;
+      counter++;
+    }
+    
+    // Generate share link
+    const shareToken = crypto.randomBytes(16).toString('hex');
+    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    
+    // Hash password with configurable rounds
+    const password_hash = await bcrypt.hash(password, getBcryptRounds());
+    
+    // Calculate expiration date (days after event date)
+    const expires_at = new Date(event_date);
+    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
+    
+    // Create folder structure
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const eventPath = path.join(storagePath, 'events/active', slug);
+    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
+    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
+    
+    // Insert into database
+    const insertResult = await db('events').insert({
+      slug,
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password_hash,
+      welcome_message,
+      color_theme,
+      share_link: shareLink,
+      expires_at: expires_at.toISOString(),
+      created_at: new Date().toISOString(),
+      allow_user_uploads,
+      upload_category_id
+    }).returning('id');
+    
+    // Handle both PostgreSQL (returns array of objects) and SQLite (returns array of IDs)
+    const eventId = insertResult[0]?.id || insertResult[0];
+    
+    // Log activity
+    await logActivity('event_created', 
+      { 
+        event_type, 
+        expires_at,
+        password_strength: passwordValidation.score 
+      }, 
+      eventId, 
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    // Rest of the implementation remains the same...
+    // Queue creation email, etc.
+  } catch (error) {
+    console.error('Error creating event:', error);
+    res.status(500).json({ error: 'Failed to create event' });
+  }
+});

backend/src/routes/adminEvents.js

@@ -0,0 +1,758 @@
+const express = require('express');
+const { body, query, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+const bcrypt = require('bcrypt');
+const crypto = require('crypto');
+const fs = require('fs').promises;
+const path = require('path');
+const { archiveEvent } = require('../services/archiveService');
+const { queueEmail } = require('../services/emailProcessor');
+const { escapeLikePattern } = require('../utils/sqlSecurity');
+// formatDate import removed - dates are formatted by email processor
+const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
+const { formatBoolean } = require('../utils/dbCompat');
+
+// Create new event
+router.post('/', adminAuth, [
+  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
+  body('event_name').notEmpty().trim(),
+  body('event_date').isDate(),
+  body('host_email').isEmail().normalizeEmail(),
+  body('admin_email').isEmail().normalizeEmail(),
+  body('password').isLength({ min: 6 }),
+  body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
+  body('welcome_message').optional().trim(),
+  body('color_theme').optional().trim(),
+  body('allow_user_uploads').optional().isBoolean().toBoolean(),
+  body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
+  body('host_name').notEmpty().trim()
+], async (req, res) => {
+  try {
+    console.log('Create event request body:', req.body);
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      console.error('Validation errors:', errors.array());
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const {
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password,
+      welcome_message = '',
+      color_theme = null,
+      expiration_days = 30,
+      allow_user_uploads = false,
+      upload_category_id = null
+    } = req.body;
+    
+    // Validate password strength
+    const passwordValidation = validatePasswordInContext(password, 'gallery', {
+      eventName: event_name
+    });
+    
+    if (!passwordValidation.valid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.errors,
+        score: passwordValidation.score,
+        feedback: passwordValidation.feedback
+      });
+    }
+    
+    // Generate unique slug
+    const processedEventName = event_name
+      .toLowerCase()
+      .replace(/[^a-z0-9]/g, '-') // Replace non-alphanumeric with dash
+      .replace(/-+/g, '-')         // Replace multiple dashes with single dash
+      .replace(/^-|-$/g, '');      // Remove leading/trailing dashes
+    const baseSlug = `${event_type}-${processedEventName}-${event_date}`;
+    let slug = baseSlug;
+    let counter = 1;
+    
+    while (await db('events').where({ slug }).first()) {
+      slug = `${baseSlug}-${counter}`;
+      counter++;
+    }
+    
+    // Generate share link
+    const shareToken = crypto.randomBytes(16).toString('hex');
+    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    
+    // Hash password with configurable rounds
+    const password_hash = await bcrypt.hash(password, getBcryptRounds());
+    
+    // Calculate expiration date (days after event date)
+    // Parse YYYY-MM-DD format as local date to avoid timezone issues
+    let expires_at;
+    if (event_date.match(/^\d{4}-\d{2}-\d{2}$/)) {
+      const [year, month, day] = event_date.split('-').map(num => parseInt(num, 10));
+      expires_at = new Date(year, month - 1, day);
+    } else {
+      expires_at = new Date(event_date);
+    }
+    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
+    
+    // Create folder structure
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const eventPath = path.join(storagePath, 'events/active', slug);
+    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
+    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
+    
+    // Insert into database
+    const insertResult = await db('events').insert({
+      slug,
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password_hash,
+      welcome_message,
+      color_theme,
+      share_link: shareLink,
+      expires_at: expires_at.toISOString(),
+      created_at: new Date().toISOString(),
+      allow_user_uploads,
+      upload_category_id
+    }).returning('id');
+    
+    // Handle both PostgreSQL (returns array of objects) and SQLite (returns array of IDs)
+    const eventId = insertResult[0]?.id || insertResult[0];
+    
+    // Log activity
+    await logActivity('event_created', 
+      { event_type, expires_at }, 
+      eventId, 
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    // Queue creation email
+    // Language detection is handled by email processor
+    
+    await db('email_queue').insert({
+      event_id: eventId,
+      recipient_email: host_email,
+      email_type: 'gallery_created',
+      email_data: JSON.stringify({
+        host_name: host_name,
+        event_name,
+        event_date: event_date,  // Pass raw date - will be formatted by email processor
+        gallery_link: shareLink,
+        gallery_password: password,
+        expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
+        welcome_message: welcome_message || ''
+      }),
+      status: 'pending',
+      created_at: new Date()
+      // scheduled_at will use default value
+    });
+    
+    res.json({
+      id: eventId,
+      slug,
+      event_name,
+      event_type,
+      share_link: shareLink,
+      expires_at: expires_at.toISOString(),
+      created_at: new Date().toISOString()
+    });
+  } catch (error) {
+    console.error('Error creating event:', error);
+    res.status(500).json({ error: 'Failed to create event' });
+  }
+});
+
+// Get all events with pagination and filters
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const page = parseInt(req.query.page) || 1;
+    const limit = parseInt(req.query.limit) || 20;
+    const offset = (page - 1) * limit;
+    const search = req.query.search || '';
+    const status = req.query.status || 'all';
+    const sortBy = req.query.sortBy || 'created_at';
+    const sortOrder = req.query.sortOrder || 'desc';
+
+    // Build query
+    let query = db('events');
+    
+    // Apply search filter
+    if (search) {
+      const escapedSearch = escapeLikePattern(search);
+      query = query.where((builder) => {
+        builder.where('event_name', 'like', `%${escapedSearch}%`)
+          .orWhere('admin_email', 'like', `%${escapedSearch}%`)
+          .orWhere('slug', 'like', `%${escapedSearch}%`);
+      });
+    }
+
+    // Apply status filter
+    if (status === 'active') {
+      query = query.where('is_active', formatBoolean(true)).where('is_archived', formatBoolean(false));
+    } else if (status === 'archived') {
+      query = query.where('is_archived', formatBoolean(true));
+    } else if (status === 'inactive') {
+      query = query.where('is_active', formatBoolean(false)).where('is_archived', formatBoolean(false));
+    } else if (status === 'expiring') {
+      const sevenDaysFromNow = new Date();
+      sevenDaysFromNow.setDate(sevenDaysFromNow.getDate() + 7);
+      query = query
+        .where('is_active', formatBoolean(true))
+        .where('is_archived', formatBoolean(false))
+        .where('expires_at', '<=', sevenDaysFromNow.toISOString())
+        .where('expires_at', '>', new Date().toISOString());
+    }
+
+    // Get total count for pagination
+    const countQuery = query.clone();
+    const [{ count }] = await countQuery.count('* as count');
+
+    // Apply sorting and pagination
+    const events = await query
+      .orderBy(sortBy, sortOrder)
+      .limit(limit)
+      .offset(offset);
+
+    // Get photo counts for each event
+    const eventIds = events.map(e => e.id);
+    const photoCounts = await db('photos')
+      .whereIn('event_id', eventIds)
+      .groupBy('event_id')
+      .select('event_id')
+      .count('* as count');
+
+    // Map photo counts to events
+    const photoCountMap = photoCounts.reduce((acc, { event_id, count }) => {
+      acc[event_id] = parseInt(count);
+      return acc;
+    }, {});
+
+    // Add photo counts to events and convert dates
+    const eventsWithCounts = events.map(event => ({
+      ...event,
+      photo_count: photoCountMap[event.id] || 0,
+      // Convert Unix timestamps to ISO strings
+      created_at: event.created_at ? new Date(event.created_at).toISOString() : null,
+      expires_at: event.expires_at ? new Date(event.expires_at).toISOString() : null,
+      archived_at: event.archived_at ? new Date(event.archived_at).toISOString() : null
+    }));
+
+    res.json({
+      events: eventsWithCounts,
+      pagination: {
+        page,
+        limit,
+        total: parseInt(count),
+        totalPages: Math.ceil(count / limit)
+      }
+    });
+  } catch (error) {
+    console.error('Error fetching events:', error);
+    res.status(500).json({ error: 'Failed to fetch events' });
+  }
+});
+
+// Get single event details
+router.get('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    const event = await db('events')
+      .where('id', id)
+      .first();
+
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    // Get photo count
+    const [{ count: photoCount }] = await db('photos')
+      .where('event_id', id)
+      .count('* as count');
+
+    // Get total size
+    const [{ totalSize }] = await db('photos')
+      .where('event_id', id)
+      .sum('size_bytes as totalSize');
+
+    // Get recent photos
+    const recentPhotos = await db('photos')
+      .where('event_id', id)
+      .orderBy('uploaded_at', 'desc')
+      .limit(10)
+      .select('filename', 'type', 'size_bytes', 'uploaded_at');
+
+    // Get view and download statistics
+    const [{ totalViews }] = await db('access_logs')
+      .where('event_id', id)
+      .where('action', 'view')
+      .count('* as totalViews');
+
+    const [{ totalDownloads }] = await db('access_logs')
+      .where('event_id', id)
+      .where('action', 'download')
+      .count('* as totalDownloads');
+
+    const [{ uniqueVisitors }] = await db('access_logs')
+      .where('event_id', id)
+      .countDistinct('ip_address as uniqueVisitors');
+
+    res.json({
+      ...event,
+      photo_count: parseInt(photoCount) || 0,
+      total_size: parseInt(totalSize) || 0,
+      total_views: parseInt(totalViews) || 0,
+      total_downloads: parseInt(totalDownloads) || 0,
+      unique_visitors: parseInt(uniqueVisitors) || 0,
+      recent_photos: recentPhotos
+    });
+  } catch (error) {
+    console.error('Error fetching event:', error);
+    res.status(500).json({ error: 'Failed to fetch event details' });
+  }
+});
+
+// Update event
+router.put('/:id', adminAuth, [
+  body('event_name').optional().trim().notEmpty(),
+  body('admin_email').optional().isEmail(),
+  body('is_active').optional().isBoolean(),
+  body('expires_at').optional().isISO8601(),
+  body('welcome_message').optional({ nullable: true, checkFalsy: true }).trim(),
+  body('color_theme').optional({ nullable: true }),
+  body('allow_user_uploads').optional().isBoolean(),
+  body('host_name').optional().trim().notEmpty(),
+  body('upload_category_id').optional().custom((value) => {
+    // Accept null, undefined, or integer values
+    if (value === null || value === undefined) return true;
+    return Number.isInteger(Number(value));
+  }).withMessage('upload_category_id must be an integer or null'),
+  body('hero_photo_id').optional().custom((value) => {
+    // Accept null, undefined, or numeric values
+    if (value === null || value === undefined) return true;
+    // Check if it's a number or can be converted to a valid integer
+    const num = Number(value);
+    return !isNaN(num) && Number.isInteger(num);
+  }).withMessage('hero_photo_id must be an integer or null')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      console.log('Update event validation errors:', JSON.stringify(errors.array(), null, 2));
+      console.log('Request body:', req.body);
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { id } = req.params;
+    const updates = req.body;
+
+    // Log the update request for debugging
+    console.log('Update event request:', {
+      id,
+      updates,
+      color_theme_length: updates.color_theme ? updates.color_theme.length : 0,
+      color_theme_type: typeof updates.color_theme,
+      hero_photo_id: updates.hero_photo_id,
+      hero_photo_id_type: typeof updates.hero_photo_id
+    });
+
+    // Check if event exists
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    // Update event
+    await db('events')
+      .where('id', id)
+      .update(updates);
+
+    // Log activity
+    await logActivity('event_updated',
+      { changes: Object.keys(updates), eventName: event.event_name },
+      id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Event updated successfully' });
+  } catch (error) {
+    console.error('Error updating event:', error);
+    res.status(500).json({ error: 'Failed to update event' });
+  }
+});
+
+// Delete event
+router.delete('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    // Check if event exists
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    // Start a transaction to ensure all deletions succeed or fail together
+    await db.transaction(async (trx) => {
+      // 1. Delete activity logs (audit trail)
+      await trx('activity_logs').where('event_id', id).del();
+
+      // 2. Delete access logs
+      await trx('access_logs').where('event_id', id).del();
+
+      // 3. Delete email queue entries
+      await trx('email_queue').where('event_id', id).del();
+
+      // 4. Delete photos (this will also handle hero_photo_id foreign key)
+      await trx('photos').where('event_id', id).del();
+
+      // 5. Delete categories (photo_categories has CASCADE delete for event_id)
+      await trx('photo_categories').where('event_id', id).del();
+
+      // 6. Finally delete the event
+      await trx('events').where('id', id).del();
+
+      // Delete event folder from storage if it exists
+      if (event.folder_path) {
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const eventFolderPath = path.join(storagePath, 'events', 'active', event.folder_path);
+        
+        try {
+          const fsPromises = require('fs').promises;
+          await fsPromises.rm(eventFolderPath, { recursive: true, force: true });
+        } catch (err) {
+          console.error('Failed to delete event folder:', err);
+          // Don't fail the transaction if folder deletion fails
+        }
+      }
+
+      // Delete archive if exists
+      if (event.archive_path) {
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const archivePath = path.join(storagePath, event.archive_path);
+        
+        try {
+          const fsPromises = require('fs').promises;
+          await fsPromises.unlink(archivePath);
+        } catch (err) {
+          console.error('Failed to delete archive file:', err);
+          // Don't fail the transaction if file deletion fails
+        }
+      }
+    });
+
+    // Log activity (outside transaction)
+    await logActivity('event_deleted',
+      { event_name: event.event_name },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Event deleted successfully' });
+  } catch (error) {
+    console.error('Error deleting event:', error);
+    
+    // Provide more specific error messages
+    if (error.message && error.message.includes('foreign key constraint')) {
+      res.status(500).json({ 
+        error: 'Cannot delete event due to existing references. Please contact support.',
+        details: error.message 
+      });
+    } else {
+      res.status(500).json({ 
+        error: 'Failed to delete event',
+        details: process.env.NODE_ENV === 'development' ? error.message : undefined
+      });
+    }
+  }
+});
+
+// Toggle event status
+router.post('/:id/toggle-status', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    const newStatus = !event.is_active;
+    await db('events')
+      .where('id', id)
+      .update({
+        is_active: newStatus,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity(newStatus ? 'event_activated' : 'event_deactivated',
+      { eventName: event.event_name },
+      id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ 
+      message: `Event ${newStatus ? 'activated' : 'deactivated'} successfully`,
+      is_active: newStatus
+    });
+  } catch (error) {
+    console.error('Error toggling event status:', error);
+    res.status(500).json({ error: 'Failed to toggle event status' });
+  }
+});
+
+// Reset event password
+router.post('/:id/reset-password', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    const { sendEmail = true } = req.body;
+
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    if (event.is_archived) {
+      return res.status(400).json({ error: 'Cannot reset password for archived event' });
+    }
+
+    // Generate new password
+    const { generatePassword } = require('../utils/passwordGenerator');
+    const newPassword = generatePassword();
+    const passwordHash = await bcrypt.hash(newPassword, 10);
+
+    // Update event with new password
+    await db('events')
+      .where('id', id)
+      .update({
+        password_hash: passwordHash,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity('password_reset',
+      { eventName: event.event_name, emailSent: sendEmail },
+      id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    // Queue email notification if requested
+    if (sendEmail) {
+      // For password reset, we'll need to create a template or use a different approach
+      // For now, let's use the gallery_created template with updated password
+      await queueEmail(id, event.host_email, 'gallery_created', {
+        host_name: event.host_email.split('@')[0],
+        event_name: event.event_name,
+        event_date: event.event_date,  // Pass raw date - will be formatted by email processor
+        gallery_link: event.share_link,
+        gallery_password: newPassword,
+        expiry_date: event.expires_at  // Pass raw date - will be formatted by email processor
+      });
+    }
+
+    res.json({ 
+      message: 'Password reset successfully',
+      newPassword: newPassword,
+      emailSent: sendEmail
+    });
+  } catch (error) {
+    console.error('Error resetting password:', error);
+    res.status(500).json({ error: 'Failed to reset password' });
+  }
+});
+
+// Resend creation email
+router.post('/:id/resend-email', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    // Get event details
+    const event = await db('events')
+      .where('id', id)
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+    
+    // The email processor will determine the language based on:
+    // 1. Event language setting
+    // 2. App settings general_default_language  
+    // 3. Email config default language
+    // 4. Domain-based detection
+    // So we don't need to determine it here
+    
+    // For resending creation email, we need the actual password
+    // First, try to get it from the request body if provided
+    let galleryPassword = req.body.password;
+    
+    // If no password provided, we can't decrypt the existing one
+    // So we'll show a security message
+    if (!galleryPassword) {
+      // We'll let the email processor determine the language for the security message
+      galleryPassword = '{{password_security_message}}';
+    }
+    
+    // Dates will be formatted by the email processor based on recipient language
+    
+    // Queue the email
+    await queueEmail(id, event.host_email, 'gallery_created', {
+      host_name: event.host_name || event.host_email.split('@')[0],
+      event_name: event.event_name,
+      event_date: event.event_date,  // Pass raw date - will be formatted by email processor
+      gallery_link: event.share_link,
+      gallery_password: galleryPassword,
+      expiry_date: event.expires_at,  // Pass raw date - will be formatted by email processor
+      welcome_message: event.welcome_message || '',
+      eventId: id,
+      isResend: true // Flag to indicate this is a resend
+    });
+    
+    // Log the activity using the proper schema
+    try {
+      await logActivity('email_resent', {
+        email_type: 'gallery_created',
+        recipient: event.host_email,
+        ip_address: req.ip || '0.0.0.0',
+        user_agent: req.get('user-agent') || 'Unknown'
+      }, id, {
+        type: 'admin',
+        id: req.admin.id,
+        name: req.admin.username
+      });
+    } catch (logError) {
+      console.error('Warning: Failed to log activity:', logError);
+      // Don't fail the request if activity logging fails
+    }
+    
+    res.json({ 
+      success: true,
+      message: 'Creation email has been queued for sending'
+    });
+  } catch (error) {
+    console.error('Error resending creation email:', error);
+    console.error('Stack trace:', error.stack);
+    res.status(500).json({ error: 'Failed to resend creation email' });
+  }
+});
+
+// Archive event
+router.post('/:id/archive', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    if (event.is_archived) {
+      return res.status(400).json({ error: 'Event is already archived' });
+    }
+
+    // Use the archive service to create ZIP archive
+    await archiveEvent(event);
+
+    // Log activity
+    await logActivity('event_archived',
+      { eventName: event.event_name },
+      id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Event archived successfully' });
+  } catch (error) {
+    console.error('Error archiving event:', error);
+    res.status(500).json({ error: 'Failed to archive event' });
+  }
+});
+
+// Bulk archive events
+router.post('/bulk-archive', adminAuth, [
+  body('eventIds').isArray().withMessage('eventIds must be an array'),
+  body('eventIds.*').isInt().withMessage('Each eventId must be an integer')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { eventIds } = req.body;
+    
+    if (eventIds.length === 0) {
+      return res.status(400).json({ error: 'No events selected for archiving' });
+    }
+
+    // Get all events to archive
+    const events = await db('events')
+      .whereIn('id', eventIds)
+      .where('is_archived', formatBoolean(false));
+
+    if (events.length === 0) {
+      return res.status(400).json({ error: 'No valid events found to archive' });
+    }
+
+    const results = {
+      successful: [],
+      failed: []
+    };
+
+    // Process each event
+    for (const event of events) {
+      try {
+        // Use the archive service to create ZIP archive
+        await archiveEvent(event);
+        
+        // Log activity
+        await logActivity('event_archived',
+          { eventName: event.event_name, bulkOperation: true },
+          event.id,
+          { type: 'admin', id: req.admin.id, name: req.admin.username }
+        );
+        
+        results.successful.push({
+          id: event.id,
+          name: event.event_name
+        });
+      } catch (error) {
+        console.error(`Failed to archive event ${event.id}:`, error);
+        results.failed.push({
+          id: event.id,
+          name: event.event_name,
+          error: error.message
+        });
+      }
+    }
+
+    // Log bulk archive activity
+    await logActivity('bulk_archive_completed',
+      { 
+        totalEvents: eventIds.length,
+        successfulCount: results.successful.length,
+        failedCount: results.failed.length
+      },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({
+      message: `Bulk archive completed: ${results.successful.length} succeeded, ${results.failed.length} failed`,
+      results
+    });
+  } catch (error) {
+    console.error('Error in bulk archive:', error);
+    res.status(500).json({ error: 'Failed to perform bulk archive' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminNotifications.js

@@ -0,0 +1,122 @@
+const express = require('express');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+
+// Get notifications (unread activity logs)
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const { limit = 20, includeRead = false } = req.query;
+
+    let query = db('activity_logs')
+      .select(
+        'activity_logs.*',
+        'events.event_name'
+      )
+      .leftJoin('events', 'activity_logs.event_id', 'events.id')
+      .orderBy('activity_logs.created_at', 'desc')
+      .limit(parseInt(limit));
+    
+    // By default, only show unread notifications
+    if (includeRead !== 'true') {
+      query = query.whereNull('activity_logs.read_at');
+    }
+
+    const notifications = await query;
+
+    // Format notifications
+    const formattedNotifications = notifications.map(notification => ({
+      id: notification.id,
+      type: notification.activity_type,
+      actorType: notification.actor_type,
+      actorName: notification.actor_name,
+      eventName: notification.event_name,
+      eventId: notification.event_id,
+      metadata: (() => {
+        try {
+          if (!notification.metadata) return {};
+          if (typeof notification.metadata === 'object') return notification.metadata;
+          return JSON.parse(notification.metadata);
+        } catch (e) {
+          console.warn('Failed to parse metadata for notification:', notification.id, e.message);
+          return {};
+        }
+      })(),
+      createdAt: notification.created_at,
+      readAt: notification.read_at,
+      isRead: !!notification.read_at
+    }));
+
+    // Get unread count
+    const unreadCount = await db('activity_logs')
+      .whereNull('read_at')
+      .count('id as count')
+      .first();
+
+    res.json({
+      notifications: formattedNotifications,
+      unreadCount: unreadCount.count || 0
+    });
+  } catch (error) {
+    console.error('Notifications fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch notifications' });
+  }
+});
+
+// Mark notification as read
+router.put('/:id/read', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    await db('activity_logs')
+      .where('id', id)
+      .update({
+        read_at: new Date()
+      });
+
+    res.json({ message: 'Notification marked as read' });
+  } catch (error) {
+    console.error('Mark notification read error:', error);
+    res.status(500).json({ error: 'Failed to mark notification as read' });
+  }
+});
+
+// Mark all notifications as read
+router.put('/read-all', adminAuth, async (req, res) => {
+  try {
+    await db('activity_logs')
+      .whereNull('read_at')
+      .update({
+        read_at: new Date()
+      });
+
+    res.json({ message: 'All notifications marked as read' });
+  } catch (error) {
+    console.error('Mark all notifications read error:', error);
+    res.status(500).json({ error: 'Failed to mark all notifications as read' });
+  }
+});
+
+// Delete old notifications (older than 30 days and read)
+router.delete('/clear-old', adminAuth, async (req, res) => {
+  try {
+    // Use database-agnostic date calculation
+    const thirtyDaysAgo = new Date();
+    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+    
+    const deletedCount = await db('activity_logs')
+      .whereNotNull('read_at')
+      .where('created_at', '<', thirtyDaysAgo)
+      .delete();
+
+    res.json({ 
+      message: 'Old notifications cleared',
+      deletedCount 
+    });
+  } catch (error) {
+    console.error('Clear old notifications error:', error);
+    res.status(500).json({ error: 'Failed to clear old notifications' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminPhotos.js

@@ -0,0 +1,795 @@
+const express = require('express');
+const multer = require('multer');
+const path = require('path');
+const fs = require('fs').promises;
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth');
+const { generateThumbnail, ensureThumbnail } = require('../services/imageProcessor');
+const { generatePhotoFilename } = require('../utils/filenameSanitizer');
+const { escapeLikePattern } = require('../utils/sqlSecurity');
+const { validateUploadedFiles } = require('../middleware/uploadValidation');
+const router = express.Router();
+
+// Get storage path from environment or default
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+// Configure multer for file uploads
+// IMPORTANT: Using synchronous functions to prevent file corruption
+const storage = multer.diskStorage({
+  destination: (req, file, cb) => {
+    console.log('Multer destination called for file:', file.originalname);
+    const { eventId } = req.params;
+    
+    // We'll validate the event exists in the route handler
+    // For now, just create a temp destination
+    const tempPath = path.join(getStoragePath(), 'temp', `upload_${Date.now()}_${Math.random().toString(36).substring(7)}`);
+    
+    // Create directory synchronously
+    require('fs').mkdirSync(tempPath, { recursive: true });
+    console.log('Temp destination path:', tempPath);
+    
+    // Store temp path for cleanup
+    req.tempUploadPath = tempPath;
+    
+    cb(null, tempPath);
+  },
+  filename: (req, file, cb) => {
+    console.log('Multer filename called for file:', file.originalname);
+    // Use a simple temporary filename
+    const tempName = `temp_${Date.now()}_${Math.round(Math.random() * 1E9)}${path.extname(file.originalname)}`;
+    console.log('Temp filename:', tempName);
+    cb(null, tempName);
+  }
+});
+
+const { validateFileType } = require('../utils/fileSecurityUtils');
+
+const upload = multer({
+  storage: storage,
+  limits: {
+    fileSize: 50 * 1024 * 1024, // 50MB limit per file
+    files: 500, // Maximum 500 files
+    // Set a reasonable field size limit to prevent memory issues
+    fieldSize: 10 * 1024 * 1024, // 10MB for non-file fields
+    // Add part size limits to prevent incomplete uploads
+    parts: 10000, // Maximum number of parts (fields + files)
+    headerPairs: 2000 // Maximum number of header key-value pairs
+  },
+  fileFilter: (req, file, cb) => {
+    // Accept images only with proper validation
+    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/webp'];
+    
+    if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
+      return cb(null, true);
+    } else {
+      cb(new Error('Only JPEG, PNG and WebP images are allowed'));
+    }
+  },
+  // Add abort on limit to stop processing when limits are exceeded
+  abortOnLimit: true
+});
+
+const { createFileUploadValidator } = require('../utils/fileSecurityUtils');
+
+// Create content validator middleware
+const validateUploadContent = createFileUploadValidator({
+  allowedTypes: ['image/jpeg', 'image/png', 'image/webp'],
+  maxFileSize: 50 * 1024 * 1024,
+  validateContent: true
+});
+
+// Request timeout middleware for uploads
+const uploadTimeout = (timeout = 300000) => { // 5 minutes default
+  return (req, res, next) => {
+    // Set timeout for the request
+    req.setTimeout(timeout, () => {
+      console.error('Upload request timed out');
+      if (!res.headersSent) {
+        res.status(408).json({ error: 'Upload request timed out' });
+      }
+    });
+    
+    // Set response timeout as well
+    res.setTimeout(timeout, () => {
+      console.error('Upload response timed out');
+    });
+    
+    next();
+  };
+};
+
+// Upload photos for an event
+// Increased limit to 500 files, but recommend chunked uploads for better performance
+router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, next) => { // 10 minute timeout
+  upload.array('photos', 500)(req, res, (err) => {
+    if (err) {
+      console.error('Multer error:', err);
+      if (err instanceof multer.MulterError) {
+        if (err.code === 'LIMIT_FILE_SIZE') {
+          return res.status(400).json({ error: 'File too large. Maximum size is 50MB per file.' });
+        }
+        if (err.code === 'LIMIT_FILE_COUNT') {
+          return res.status(400).json({ error: 'Too many files. Maximum 500 files per upload.' });
+        }
+        return res.status(400).json({ error: `Upload error: ${err.message}` });
+      }
+      return res.status(400).json({ error: err.message || 'Upload failed' });
+    }
+    next();
+  });
+}, validateUploadContent, validateUploadedFiles, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { category_id } = req.body;
+    
+    console.log('Upload request received for event:', eventId);
+    console.log('Body:', req.body);
+    console.log('Files:', req.files ? req.files.length : 'none');
+    console.log('File details:', req.files?.map(f => ({ name: f.originalname, size: f.size, mimetype: f.mimetype })));
+    console.log('Category ID received:', category_id);
+    
+    // Verify event exists and admin has access
+    const event = await db('events').where({ id: eventId }).first();
+    if (!event) {
+      console.error('Event not found:', eventId);
+      // Clean up temp files
+      if (req.tempUploadPath) {
+        try {
+          await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+        } catch (e) {
+          console.error('Failed to clean up temp path:', e);
+        }
+      }
+      return res.status(404).json({ error: 'Event not found' });
+    }
+    
+    if (!req.files || req.files.length === 0) {
+      console.error('No files in request. req.files:', req.files);
+      console.error('Request body keys:', Object.keys(req.body));
+      // Clean up temp files
+      if (req.tempUploadPath) {
+        try {
+          await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+        } catch (e) {
+          console.error('Failed to clean up temp path:', e);
+        }
+      }
+      return res.status(400).json({ error: 'No files uploaded' });
+    }
+    
+    // Parse category_id to number if provided
+    const parsedCategoryId = category_id ? parseInt(category_id, 10) : null;
+    
+    // Get category details if provided
+    let category = null;
+    if (parsedCategoryId) {
+      category = await db('photo_categories').where({ id: parsedCategoryId }).first();
+      if (!category) {
+        // Clean up temp files
+        if (req.tempUploadPath) {
+          try {
+            await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+          } catch (e) {
+            console.error('Failed to clean up temp path:', e);
+          }
+        }
+        return res.status(400).json({ error: 'Invalid category' });
+      }
+    }
+    
+    // Create final destination directory
+    const finalDestPath = path.join(getStoragePath(), 'events/active', event.slug);
+    await fs.mkdir(finalDestPath, { recursive: true });
+    
+    const uploadedPhotos = [];
+    const errors = [];
+    
+    // Process files in batches to optimize database operations
+    const BATCH_SIZE = 25; // Increased batch size for better performance with large uploads
+    
+    for (let i = 0; i < req.files.length; i += BATCH_SIZE) {
+      const batch = req.files.slice(i, i + BATCH_SIZE);
+      
+      // Start a single transaction for the batch
+      const trx = await db.transaction();
+      
+      try {
+        // Get initial counter for this batch
+        let batchCounter = 1;
+        if (category) {
+          const categoryData = await trx('photo_categories')
+            .where({ id: parsedCategoryId })
+            .forUpdate()
+            .first();
+          batchCounter = (categoryData.photo_counter || 0) + 1;
+        } else {
+          const uncategorizedCount = await trx('photos')
+            .where({ event_id: eventId })
+            .whereNull('category_id')
+            .count('id as count')
+            .first();
+          batchCounter = (parseInt(uncategorizedCount.count) || 0) + 1;
+        }
+        
+        const batchPhotos = [];
+        const fileRenameOperations = []; // Store rename operations to do after commit
+        
+        // First pass: prepare data and move files from temp to final location
+        for (let fileIndex = 0; fileIndex < batch.length; fileIndex++) {
+          const file = batch[fileIndex];
+          const counter = batchCounter + fileIndex;
+          const tempPath = file.path; // Original temp path
+          
+          try {
+            // Verify file is complete before processing
+            const tempStats = await fs.stat(tempPath);
+            if (tempStats.size === 0) {
+              throw new Error('File is empty - upload may have been interrupted');
+            }
+            
+            // Generate new filename
+            const extension = path.extname(file.originalname);
+            const newFilename = generatePhotoFilename(
+              event.event_name,
+              category ? category.name : 'uncategorized',
+              counter,
+              extension
+            );
+            
+            // Calculate final path
+            const finalPath = path.join(finalDestPath, newFilename);
+            const storagePath = getStoragePath();
+            const relativePath = path.relative(path.join(storagePath, 'events/active'), finalPath);
+            
+            // Prepare photo data for batch insert
+            const photoData = {
+              event_id: parseInt(eventId),
+              filename: newFilename,
+              path: relativePath,
+              thumbnail_path: null, // Will generate after successful commit
+              category_id: parsedCategoryId ? parseInt(parsedCategoryId) : null,
+              type: 'individual',
+              size_bytes: tempStats.size // Use actual file size from stat
+            };
+            
+            batchPhotos.push(photoData);
+            
+            // Store move operation for later
+            fileRenameOperations.push({
+              tempPath: tempPath,
+              finalPath: finalPath,
+              filename: newFilename,
+              photoData: photoData
+            });
+          } catch (error) {
+            console.error(`Error preparing file ${file.originalname}:`, error);
+            errors.push({ filename: file.originalname, error: error.message });
+          }
+        }
+        
+        // Insert all photos in this batch
+        if (batchPhotos.length > 0) {
+          console.log(`Inserting batch of ${batchPhotos.length} photos with category_id: ${parsedCategoryId}`);
+          
+          const insertedIds = await trx('photos').insert(batchPhotos).returning('id');
+          
+          // Update category counter if needed
+          if (category && parsedCategoryId) {
+            const newCounter = batchCounter + batchPhotos.length - 1;
+            await trx('photo_categories')
+              .where({ id: parsedCategoryId })
+              .update({ photo_counter: newCounter });
+            console.log(`Updated category ${parsedCategoryId} counter to ${newCounter}`);
+          }
+          
+          // Commit the transaction first
+          await trx.commit();
+          console.log(`Successfully committed batch of ${batchPhotos.length} photos`);
+          
+          // Now move files from temp to final location after successful commit
+          for (let idx = 0; idx < fileRenameOperations.length; idx++) {
+            const operation = fileRenameOperations[idx];
+            try {
+              // Move the file from temp to final location
+              await fs.rename(operation.tempPath, operation.finalPath);
+              console.log(`Moved file from ${operation.tempPath} to ${operation.finalPath}`);
+              
+              // Verify the file was moved successfully
+              const finalStats = await fs.stat(operation.finalPath);
+              if (finalStats.size !== operation.photoData.size_bytes) {
+                throw new Error(`File size mismatch after move: expected ${operation.photoData.size_bytes}, got ${finalStats.size}`);
+              }
+              
+              // Generate thumbnail with final path
+              let thumbnailPath = null;
+              try {
+                thumbnailPath = await generateThumbnail(operation.finalPath);
+                
+                // Update the database with thumbnail path
+                if (thumbnailPath && insertedIds[idx]) {
+                  const photoId = insertedIds[idx]?.id || insertedIds[idx];
+                  await db('photos')
+                    .where({ id: photoId })
+                    .update({ thumbnail_path: thumbnailPath });
+                }
+              } catch (thumbError) {
+                console.error(`Thumbnail generation failed for ${operation.filename}:`, thumbError.message);
+              }
+              
+              // Add to successful uploads
+              uploadedPhotos.push({
+                id: insertedIds[idx]?.id || insertedIds[idx],
+                filename: operation.filename,
+                size: operation.photoData.size_bytes,
+                category_id: operation.photoData.category_id
+              });
+            } catch (moveError) {
+              console.error(`Failed to move file ${operation.tempPath} to ${operation.finalPath}:`, moveError);
+              errors.push({ 
+                filename: operation.filename, 
+                error: `File move failed: ${moveError.message}` 
+              });
+              
+              // Try to clean up the database entry if file move failed
+              if (insertedIds[idx]) {
+                const photoId = insertedIds[idx]?.id || insertedIds[idx];
+                try {
+                  await db('photos').where({ id: photoId }).delete();
+                  console.log(`Cleaned up database entry for failed photo ${photoId}`);
+                } catch (cleanupError) {
+                  console.error(`Failed to clean up database entry:`, cleanupError);
+                }
+              }
+            }
+          }
+        } else {
+          // No photos to insert, just rollback
+          await trx.rollback();
+        }
+      } catch (error) {
+        console.error(`Error processing batch starting at index ${i}:`, error);
+        console.error('Stack trace:', error.stack);
+        
+        // Rollback if not already committed
+        if (!trx.isCompleted()) {
+          await trx.rollback();
+        }
+        
+        // Add all files in this batch to errors
+        for (const file of batch) {
+          errors.push({ 
+            filename: file.originalname, 
+            error: `Batch processing failed: ${error.message}` 
+          });
+        }
+      }
+    }
+    
+    // Clean up temp upload directory
+    if (req.tempUploadPath) {
+      try {
+        await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+        console.log(`Cleaned up temp upload directory: ${req.tempUploadPath}`);
+      } catch (e) {
+        console.error('Failed to clean up temp upload directory:', e);
+      }
+    }
+    
+    // Log activity
+    await logActivity('photos_uploaded',
+      { count: uploadedPhotos.length, eventName: event.event_name },
+      eventId,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    // Include any files that were invalid from the validation middleware
+    const totalInvalidFiles = (req.invalidFiles || []).concat(errors);
+    
+    // Prepare response
+    const totalAttempted = req.files.length + (req.invalidFiles ? req.invalidFiles.length : 0);
+    const response = {
+      message: `Successfully uploaded ${uploadedPhotos.length} photos`,
+      photos: uploadedPhotos,
+      totalFiles: totalAttempted,
+      successCount: uploadedPhotos.length,
+      failureCount: totalInvalidFiles.length
+    };
+    
+    // Include error details if any files failed
+    if (totalInvalidFiles.length > 0) {
+      response.errors = totalInvalidFiles;
+      response.message = `Uploaded ${uploadedPhotos.length} of ${totalAttempted} photos. ${totalInvalidFiles.length} failed.`;
+    }
+    
+    res.json(response);
+  } catch (error) {
+    console.error('Error uploading photos:', error);
+    
+    // Clean up temp upload directory on error
+    if (req.tempUploadPath) {
+      try {
+        await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+        console.log(`Cleaned up temp upload directory after error: ${req.tempUploadPath}`);
+      } catch (e) {
+        console.error('Failed to clean up temp upload directory:', e);
+      }
+    }
+    
+    res.status(500).json({ error: 'Failed to upload photos' });
+  }
+});
+
+// Delete a photo
+router.delete('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    
+    // Get photo details
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Delete physical files
+    const storagePath = getStoragePath();
+    const photoPath = path.join(storagePath, 'events/active', photo.path);
+    
+    try {
+      await fs.unlink(photoPath);
+    } catch (error) {
+      console.error('Error deleting photo file:', error);
+    }
+    
+    // Delete thumbnail if exists
+    if (photo.thumbnail_path) {
+      const thumbPath = path.join(storagePath, 'events/active', photo.thumbnail_path);
+      try {
+        await fs.unlink(thumbPath);
+      } catch (error) {
+        console.error('Error deleting thumbnail:', error);
+      }
+    }
+    
+    // Remove from database
+    await db('photos').where({ id: photoId }).delete();
+    
+    // Log activity
+    const event = await db('events').where({ id: eventId }).first();
+    await logActivity('photo_deleted',
+      { filename: photo.filename, eventName: event.event_name },
+      eventId,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: 'Photo deleted successfully' });
+  } catch (error) {
+    console.error('Error deleting photo:', error);
+    res.status(500).json({ error: 'Failed to delete photo' });
+  }
+});
+
+// Update a photo (e.g., change category)
+router.patch('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    const { category_id } = req.body;
+    
+    // Verify photo belongs to event
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Update photo
+    await db('photos')
+      .where({ id: photoId })
+      .update({ category_id: category_id || null });
+    
+    res.json({ message: 'Photo updated successfully' });
+  } catch (error) {
+    console.error('Error updating photo:', error);
+    res.status(500).json({ error: 'Failed to update photo' });
+  }
+});
+
+// Bulk delete photos
+router.post('/:eventId/photos/bulk-delete', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { photoIds } = req.body;
+    
+    if (!Array.isArray(photoIds) || photoIds.length === 0) {
+      return res.status(400).json({ error: 'Invalid photo IDs' });
+    }
+    
+    // Get all photos to delete
+    const photos = await db('photos')
+      .whereIn('id', photoIds)
+      .where('event_id', eventId);
+    
+    if (photos.length === 0) {
+      return res.status(404).json({ error: 'No photos found' });
+    }
+    
+    // Delete physical files
+    const storagePath = getStoragePath();
+    const event = await db('events').where({ id: eventId }).first();
+    
+    for (const photo of photos) {
+      // Delete photo file
+      const photoPath = path.join(storagePath, 'events/active', photo.path);
+      try {
+        await fs.unlink(photoPath);
+      } catch (error) {
+        console.error('Error deleting photo file:', error);
+      }
+      
+      // Delete thumbnail
+      if (photo.thumbnail_path) {
+        const thumbPath = path.join(storagePath, photo.thumbnail_path);
+        try {
+          await fs.unlink(thumbPath);
+        } catch (error) {
+          console.error('Error deleting thumbnail:', error);
+        }
+      }
+    }
+    
+    // Delete from database
+    await db('photos')
+      .whereIn('id', photoIds)
+      .where('event_id', eventId)
+      .delete();
+    
+    // Log activity
+    await logActivity('photos_bulk_deleted',
+      { count: photos.length, eventName: event.event_name },
+      eventId,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: `${photos.length} photos deleted successfully` });
+  } catch (error) {
+    console.error('Error bulk deleting photos:', error);
+    res.status(500).json({ error: 'Failed to delete photos' });
+  }
+});
+
+// Bulk update photos
+router.post('/:eventId/photos/bulk-update', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { photoIds, updates } = req.body;
+    
+    if (!Array.isArray(photoIds) || photoIds.length === 0) {
+      return res.status(400).json({ error: 'Invalid photo IDs' });
+    }
+    
+    // Verify all photos belong to the event
+    const photoCount = await db('photos')
+      .whereIn('id', photoIds)
+      .where('event_id', eventId)
+      .count('id as count')
+      .first();
+    
+    if (photoCount.count !== photoIds.length) {
+      return res.status(400).json({ error: 'Some photos do not belong to this event' });
+    }
+    
+    // Update photos
+    const updateData = {};
+    if (updates.category_id !== undefined) {
+      updateData.category_id = updates.category_id || null;
+    }
+    
+    await db('photos')
+      .whereIn('id', photoIds)
+      .where('event_id', eventId)
+      .update(updateData);
+    
+    res.json({ message: `${photoIds.length} photos updated successfully` });
+  } catch (error) {
+    console.error('Error bulk updating photos:', error);
+    res.status(500).json({ error: 'Failed to update photos' });
+  }
+});
+
+// Download a photo
+router.get('/:eventId/photos/:photoId/download', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    const storagePath = getStoragePath();
+    const filePath = path.join(storagePath, 'events/active', photo.path);
+    
+    // Check if file exists
+    try {
+      await fs.access(filePath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Photo file not found' });
+    }
+    
+    // Send file
+    res.download(filePath, photo.filename);
+  } catch (error) {
+    console.error('Error downloading photo:', error);
+    res.status(500).json({ error: 'Failed to download photo' });
+  }
+});
+
+// Get all photos for an event
+router.get('/:eventId/photos', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { category_id, type, search, sort = 'date', order = 'desc' } = req.query;
+    
+    let query = db('photos')
+      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
+      .where({ 'photos.event_id': eventId })
+      .select(
+        'photos.*',
+        'photo_categories.name as category_name',
+        'photo_categories.slug as category_slug'
+      );
+    
+    // Filter by category (including uncategorized)
+    if (category_id !== undefined) {
+      if (category_id === '' || category_id === '0') {
+        query = query.whereNull('photos.category_id');
+      } else {
+        query = query.where({ 'photos.category_id': category_id });
+      }
+    }
+    
+    // Keep type filter for backwards compatibility
+    if (type) {
+      query = query.where({ 'photos.type': type });
+    }
+    
+    // Search by filename
+    if (search) {
+      const escapedSearch = escapeLikePattern(search);
+      query = query.where('photos.filename', 'like', `%${escapedSearch}%`);
+    }
+    
+    // Sorting
+    let orderByColumn = 'photos.uploaded_at';
+    if (sort === 'name') {
+      orderByColumn = 'photos.filename';
+    } else if (sort === 'size') {
+      orderByColumn = 'photos.size_bytes';
+    }
+    
+    const photos = await query.orderBy(orderByColumn, order);
+    
+    res.json({
+      photos: photos.map(photo => ({
+        id: photo.id,
+        filename: photo.filename,
+        url: `/admin/events/${eventId}/photo/${photo.id}`,
+        thumbnail_url: photo.thumbnail_path ? `/admin/events/${eventId}/thumbnail/${photo.id}` : null,
+        type: photo.type,
+        category_id: photo.category_id,
+        category_name: photo.category_name,
+        category_slug: photo.category_slug,
+        size: photo.size_bytes,
+        uploaded_at: photo.uploaded_at
+      }))
+    });
+  } catch (error) {
+    console.error('Error fetching photos:', error);
+    res.status(500).json({ error: 'Failed to fetch photos' });
+  }
+});
+
+// Serve photo with admin authentication
+router.get('/:eventId/photo/:photoId', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    const storagePath = getStoragePath();
+    const filePath = path.join(storagePath, 'events/active', photo.path);
+    
+    // Check if file exists
+    try {
+      await fs.access(filePath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Photo file not found' });
+    }
+    
+    // Set appropriate headers
+    res.setHeader('Content-Type', `image/${path.extname(photo.filename).slice(1)}`);
+    res.setHeader('Cache-Control', 'private, max-age=3600');
+    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+    
+    // Send file (sendFile requires absolute path)
+    res.sendFile(path.resolve(filePath));
+  } catch (error) {
+    console.error('Error serving photo:', error);
+    res.status(500).json({ error: 'Failed to serve photo' });
+  }
+});
+
+// Serve thumbnail with admin authentication
+router.get('/:eventId/thumbnail/:photoId', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      console.error(`Photo not found: ${photoId}, event ${eventId}`);
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Ensure thumbnail exists and is valid, regenerate if needed
+    const thumbnailPath = await ensureThumbnail(photo);
+    
+    if (!thumbnailPath) {
+      console.error(`Failed to generate thumbnail for photo ${photoId}`);
+      return res.status(404).json({ error: 'Thumbnail generation failed' });
+    }
+    
+    const storagePath = getStoragePath();
+    const filePath = path.join(storagePath, thumbnailPath);
+    
+    // Set appropriate headers
+    res.setHeader('Content-Type', 'image/jpeg'); // Thumbnails are always JPEG
+    res.setHeader('Cache-Control', 'private, max-age=3600');
+    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+    
+    // Send file (sendFile requires absolute path)
+    res.sendFile(path.resolve(filePath));
+  } catch (error) {
+    console.error('Error serving thumbnail:', error);
+    console.error('Photo ID:', req.params.photoId);
+    console.error('Event ID:', req.params.eventId);
+    res.status(500).json({ error: 'Failed to serve thumbnail' });
+  }
+});
+
+// Debug endpoint to check photo existence
+router.get('/:eventId/debug', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    
+    const event = await db('events').where({ id: eventId }).first();
+    const photoCount = await db('photos').where({ event_id: eventId }).count('id as count').first();
+    const photos = await db('photos').where({ event_id: eventId }).limit(5);
+    
+    res.json({
+      event: event || 'Not found',
+      photoCount: photoCount.count,
+      samplePhotos: photos,
+      storagePath: getStoragePath()
+    });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminSettings.js

@@ -0,0 +1,650 @@
+const express = require('express');
+const multer = require('multer');
+const path = require('path');
+const fs = require('fs').promises;
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { adminAuth } = require('../middleware/auth');
+const { clearMaintenanceCache } = require('../middleware/maintenance');
+const { clearSettingsCache } = require('../services/rateLimitService');
+const router = express.Router();
+
+// Configure multer for logo uploads
+const storage = multer.diskStorage({
+  destination: async (req, file, cb) => {
+    const uploadDir = path.join(__dirname, '../../storage/uploads/logos');
+    await fs.mkdir(uploadDir, { recursive: true });
+    cb(null, uploadDir);
+  },
+  filename: (req, file, cb) => {
+    const ext = path.extname(file.originalname);
+    cb(null, `logo-${Date.now()}${ext}`);
+  }
+});
+
+const { validateFileType } = require('../utils/fileSecurityUtils');
+
+const upload = multer({
+  storage,
+  limits: { fileSize: 5 * 1024 * 1024 }, // 5MB
+  fileFilter: (req, file, cb) => {
+    // Note: SVG files are excluded from magic number validation for logos
+    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/svg+xml'];
+    
+    if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
+      return cb(null, true);
+    } else {
+      cb(new Error('Only JPEG, PNG, GIF and SVG image files are allowed'));
+    }
+  }
+});
+
+// Configure multer for favicon uploads
+const faviconStorage = multer.diskStorage({
+  destination: async (req, file, cb) => {
+    const uploadDir = path.join(__dirname, '../../storage/uploads/favicons');
+    await fs.mkdir(uploadDir, { recursive: true });
+    cb(null, uploadDir);
+  },
+  filename: (req, file, cb) => {
+    const ext = path.extname(file.originalname);
+    cb(null, `favicon-${Date.now()}${ext}`);
+  }
+});
+
+const faviconUpload = multer({
+  storage: faviconStorage,
+  limits: { fileSize: 1 * 1024 * 1024 }, // 1MB
+  fileFilter: (req, file, cb) => {
+    const allowedMimeTypes = ['image/png', 'image/x-icon', 'image/vnd.microsoft.icon'];
+    
+    // For ICO files, we can't use the standard validateFileType
+    if (file.mimetype === 'image/png') {
+      if (validateFileType(file.originalname, file.mimetype, ['image/png'])) {
+        cb(null, true);
+      } else {
+        cb(new Error('Invalid PNG file'));
+      }
+    } else if (allowedMimeTypes.includes(file.mimetype) && 
+               (file.originalname.toLowerCase().endsWith('.ico') || 
+                file.originalname.toLowerCase().endsWith('.png'))) {
+      cb(null, true);
+    } else {
+      cb(new Error('Favicon must be PNG or ICO format'));
+    }
+  }
+});
+
+// Get all settings
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const settings = await db('app_settings').select('*');
+    
+    // Convert to object format
+    const settingsObject = {};
+    settings.forEach(setting => {
+      if (setting.setting_value) {
+        try {
+          // Try to parse as JSON first
+          settingsObject[setting.setting_key] = JSON.parse(setting.setting_value);
+        } catch (e) {
+          // If it's not valid JSON, use the raw value
+          settingsObject[setting.setting_key] = setting.setting_value;
+        }
+      } else {
+        settingsObject[setting.setting_key] = null;
+      }
+    });
+
+    res.json(settingsObject);
+  } catch (error) {
+    console.error('Settings fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch settings' });
+  }
+});
+
+// Get settings by type
+router.get('/:type', adminAuth, async (req, res) => {
+  try {
+    const { type } = req.params;
+    const settings = await db('app_settings')
+      .where('setting_type', type)
+      .select('*');
+    
+    // Convert to object format
+    const settingsObject = {};
+    settings.forEach(setting => {
+      if (setting.setting_value) {
+        try {
+          // Try to parse as JSON first
+          settingsObject[setting.setting_key] = JSON.parse(setting.setting_value);
+        } catch (e) {
+          // If it's not valid JSON, use the raw value
+          settingsObject[setting.setting_key] = setting.setting_value;
+        }
+      } else {
+        settingsObject[setting.setting_key] = null;
+      }
+    });
+
+    res.json(settingsObject);
+  } catch (error) {
+    console.error('Settings fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch settings' });
+  }
+});
+
+// Update branding settings
+router.put('/branding', adminAuth, async (req, res) => {
+  try {
+    const {
+      company_name,
+      company_tagline,
+      support_email,
+      footer_text,
+      watermark_enabled,
+      watermark_position,
+      watermark_opacity,
+      watermark_size,
+      favicon_url,
+      logo_url,
+      watermark_logo_url
+    } = req.body;
+
+    const brandingSettings = {
+      company_name,
+      company_tagline,
+      support_email,
+      footer_text,
+      watermark_enabled,
+      watermark_position,
+      watermark_opacity,
+      watermark_size,
+      favicon_url,
+      logo_url,
+      watermark_logo_url
+    };
+
+    // Handle favicon deletion if empty string or null is provided
+    if (favicon_url === '' || favicon_url === null || favicon_url === undefined) {
+      // Get current favicon path to delete file
+      const currentFaviconSetting = await db('app_settings')
+        .where('setting_key', 'branding_favicon_url')
+        .first();
+      
+      if (currentFaviconSetting && currentFaviconSetting.setting_value) {
+        let currentFaviconUrl;
+        try {
+          // Try to parse as JSON first
+          currentFaviconUrl = JSON.parse(currentFaviconSetting.setting_value);
+        } catch (e) {
+          // If it's not valid JSON, use the raw value
+          currentFaviconUrl = currentFaviconSetting.setting_value;
+        }
+        
+        if (currentFaviconUrl && typeof currentFaviconUrl === 'string' && currentFaviconUrl.startsWith('/uploads/favicons/')) {
+          // Delete the file from filesystem
+          const faviconPath = path.join(__dirname, '..', '..', 'storage', currentFaviconUrl.replace('/uploads/', ''));
+          try {
+            await fs.unlink(faviconPath);
+            console.log('Deleted favicon file:', faviconPath);
+          } catch (err) {
+            console.error('Error deleting favicon file:', err);
+          }
+        }
+      }
+    }
+
+    // Handle logo deletion if empty string or null is provided
+    if (logo_url === '' || logo_url === null || logo_url === undefined) {
+      // Get current logo path to delete file
+      const currentLogoSetting = await db('app_settings')
+        .where('setting_key', 'branding_logo_url')
+        .first();
+      
+      if (currentLogoSetting && currentLogoSetting.setting_value) {
+        let currentLogoUrl;
+        try {
+          // Try to parse as JSON first
+          currentLogoUrl = JSON.parse(currentLogoSetting.setting_value);
+        } catch (e) {
+          // If it's not valid JSON, use the raw value
+          currentLogoUrl = currentLogoSetting.setting_value;
+        }
+        
+        if (currentLogoUrl && typeof currentLogoUrl === 'string' && currentLogoUrl.startsWith('/uploads/logos/')) {
+          // Delete the file from filesystem
+          const logoPath = path.join(__dirname, '..', '..', 'storage', currentLogoUrl.replace('/uploads/', ''));
+          try {
+            await fs.unlink(logoPath);
+            console.log('Deleted logo file:', logoPath);
+          } catch (err) {
+            console.error('Error deleting logo file:', err);
+          }
+        }
+      }
+    }
+
+    // Update or insert each setting
+    for (const [key, value] of Object.entries(brandingSettings)) {
+      await db('app_settings')
+        .insert({
+          setting_key: `branding_${key}`,
+          setting_value: JSON.stringify(value),
+          setting_type: 'branding',
+          updated_at: new Date()
+        })
+        .onConflict('setting_key')
+        .merge({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'branding_updated',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ company_name })
+    });
+
+    res.json({ message: 'Branding settings updated successfully' });
+  } catch (error) {
+    console.error('Branding update error:', error);
+    res.status(500).json({ error: 'Failed to update branding settings' });
+  }
+});
+
+// Upload logo
+router.post('/logo', adminAuth, upload.single('logo'), async (req, res) => {
+  try {
+    if (!req.file) {
+      return res.status(400).json({ error: 'No logo file uploaded' });
+    }
+
+    // Get old logo to delete
+    const oldLogoSetting = await db('app_settings')
+      .where('setting_key', 'branding_logo_path')
+      .first();
+
+    if (oldLogoSetting && oldLogoSetting.setting_value) {
+      const oldPath = JSON.parse(oldLogoSetting.setting_value);
+      try {
+        await fs.unlink(oldPath);
+      } catch (error) {
+        console.error('Failed to delete old logo:', error);
+      }
+    }
+
+    // Save new logo path
+    const logoPath = req.file.path;
+    const publicPath = `/uploads/logos/${req.file.filename}`;
+
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_logo_path',
+        setting_value: JSON.stringify(logoPath),
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: JSON.stringify(logoPath),
+        updated_at: new Date()
+      });
+
+    // Save public URL
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_logo_url',
+        setting_value: publicPath,
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: publicPath,
+        updated_at: new Date()
+      });
+
+    res.json({ 
+      message: 'Logo uploaded successfully',
+      logoUrl: publicPath
+    });
+  } catch (error) {
+    console.error('Logo upload error:', error);
+    res.status(500).json({ error: 'Failed to upload logo' });
+  }
+});
+
+// Upload watermark logo
+router.post('/branding/watermark-logo', adminAuth, upload.single('watermarkLogo'), async (req, res) => {
+  try {
+    if (!req.file) {
+      return res.status(400).json({ error: 'No file uploaded' });
+    }
+
+    // Delete old watermark logo if exists
+    const oldWatermarkLogoSetting = await db('app_settings')
+      .where('setting_key', 'branding_watermark_logo_path')
+      .first();
+
+    if (oldWatermarkLogoSetting && oldWatermarkLogoSetting.setting_value) {
+      const oldPath = JSON.parse(oldWatermarkLogoSetting.setting_value);
+      try {
+        await fs.unlink(oldPath);
+      } catch (error) {
+        console.error('Failed to delete old watermark logo:', error);
+      }
+    }
+
+    // Save new watermark logo path
+    const logoPath = req.file.path;
+    const publicPath = `/uploads/logos/${req.file.filename}`;
+
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_watermark_logo_path',
+        setting_value: JSON.stringify(logoPath),
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: JSON.stringify(logoPath),
+        updated_at: new Date()
+      });
+
+    // Save public URL
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_watermark_logo_url',
+        setting_value: publicPath,
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: publicPath,
+        updated_at: new Date()
+      });
+
+    res.json({ 
+      message: 'Watermark logo uploaded successfully',
+      watermarkLogoUrl: publicPath
+    });
+  } catch (error) {
+    console.error('Watermark logo upload error:', error);
+    res.status(500).json({ error: 'Failed to upload watermark logo' });
+  }
+});
+
+// Update theme settings
+router.put('/theme', adminAuth, async (req, res) => {
+  try {
+    const themeSettings = req.body;
+
+    // Save theme settings
+    await db('app_settings')
+      .insert({
+        setting_key: 'theme_config',
+        setting_value: JSON.stringify(themeSettings),
+        setting_type: 'theme',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: JSON.stringify(themeSettings),
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'theme_updated',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ theme_name: themeSettings.name || 'custom' })
+    });
+
+    res.json({ message: 'Theme settings updated successfully' });
+  } catch (error) {
+    console.error('Theme update error:', error);
+    res.status(500).json({ error: 'Failed to update theme settings' });
+  }
+});
+
+// Update general settings
+router.put('/general', adminAuth, async (req, res) => {
+  try {
+    const settings = req.body;
+
+    // Update or insert each setting
+    for (const [key, value] of Object.entries(settings)) {
+      await db('app_settings')
+        .insert({
+          setting_key: key,
+          setting_value: JSON.stringify(value),
+          setting_type: 'general',
+          updated_at: new Date()
+        })
+        .onConflict('setting_key')
+        .merge({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+    
+    // Clear maintenance mode cache if it was updated
+    if ('general_maintenance_mode' in settings) {
+      clearMaintenanceCache();
+    }
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'general_settings_updated',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ settings_count: Object.keys(settings).length })
+    });
+
+    res.json({ message: 'General settings updated successfully' });
+  } catch (error) {
+    console.error('General settings update error:', error);
+    res.status(500).json({ error: 'Failed to update general settings' });
+  }
+});
+
+// Update security settings
+router.put('/security', adminAuth, async (req, res) => {
+  try {
+    const settings = req.body;
+
+    // Update or insert each setting
+    for (const [key, value] of Object.entries(settings)) {
+      await db('app_settings')
+        .insert({
+          setting_key: key,
+          setting_value: JSON.stringify(value),
+          setting_type: 'security',
+          updated_at: new Date()
+        })
+        .onConflict('setting_key')
+        .merge({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'security_settings_updated',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ settings_count: Object.keys(settings).length })
+    });
+
+    res.json({ message: 'Security settings updated successfully' });
+  } catch (error) {
+    console.error('Security settings update error:', error);
+    res.status(500).json({ error: 'Failed to update security settings' });
+  }
+});
+
+// Get storage info
+router.get('/storage/info', adminAuth, async (req, res) => {
+  try {
+    // Get total storage used
+    const totalStorage = await db('photos')
+      .sum('size_bytes as total')
+      .first();
+
+    // Get storage by event
+    const storageByEvent = await db('photos')
+      .select('events.event_name', 'events.id')
+      .sum('photos.size_bytes as size')
+      .join('events', 'photos.event_id', 'events.id')
+      .groupBy('events.id')
+      .orderBy('size', 'desc')
+      .limit(10);
+
+    // Get archive storage
+    const archives = await db('events')
+      .where('is_archived', formatBoolean(true))
+      .whereNotNull('archive_path')
+      .select('archive_path');
+
+    let archiveStorage = 0;
+    for (const archive of archives) {
+      if (archive.archive_path) {
+        try {
+          const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+          const fullArchivePath = path.join(storagePath, archive.archive_path);
+          const stats = await fs.stat(fullArchivePath);
+          archiveStorage += stats.size;
+        } catch (error) {
+          console.error('Archive file not found:', archive.archive_path, error.message);
+        }
+      }
+    }
+
+    res.json({
+      total_used: totalStorage.total || 0,
+      archive_storage: archiveStorage,
+      storage_by_event: storageByEvent,
+      storage_limit: 10 * 1024 * 1024 * 1024 // 10GB default
+    });
+  } catch (error) {
+    console.error('Storage info error:', error);
+    res.status(500).json({ error: 'Failed to fetch storage information' });
+  }
+});
+
+// Upload favicon endpoint
+router.post('/favicon', adminAuth, faviconUpload.single('favicon'), async (req, res) => {
+  try {
+    if (!req.file) {
+      return res.status(400).json({ error: 'No favicon file provided' });
+    }
+
+    // The file is already in the correct location from multer
+    const faviconUrl = `/uploads/favicons/${req.file.filename}`;
+    
+    // Save to database
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_favicon_url',
+        setting_value: faviconUrl,
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: faviconUrl,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity('favicon_uploaded', 
+      { faviconUrl }, 
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ faviconUrl });
+  } catch (error) {
+    console.error('Error uploading favicon:', error);
+    res.status(500).json({ error: 'Failed to upload favicon' });
+  }
+});
+
+// Update rate limit settings
+router.put('/security/rate-limit', adminAuth, [
+  body('rate_limit_enabled').isBoolean().withMessage('Enabled must be a boolean'),
+  body('rate_limit_window_minutes').isInt({ min: 1, max: 60 }).withMessage('Window must be between 1 and 60 minutes'),
+  body('rate_limit_max_requests').isInt({ min: 10, max: 10000 }).withMessage('Max requests must be between 10 and 10000'),
+  body('rate_limit_auth_max_requests').isInt({ min: 1, max: 100 }).withMessage('Auth max requests must be between 1 and 100'),
+  body('rate_limit_skip_authenticated').isBoolean().withMessage('Skip authenticated must be a boolean'),
+  body('rate_limit_public_endpoints_only').isBoolean().withMessage('Public endpoints only must be a boolean')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const {
+      rate_limit_enabled,
+      rate_limit_window_minutes,
+      rate_limit_max_requests,
+      rate_limit_auth_max_requests,
+      rate_limit_skip_authenticated,
+      rate_limit_public_endpoints_only
+    } = req.body;
+
+    // Update each setting
+    const settings = [
+      { key: 'rate_limit_enabled', value: rate_limit_enabled },
+      { key: 'rate_limit_window_minutes', value: rate_limit_window_minutes },
+      { key: 'rate_limit_max_requests', value: rate_limit_max_requests },
+      { key: 'rate_limit_auth_max_requests', value: rate_limit_auth_max_requests },
+      { key: 'rate_limit_skip_authenticated', value: rate_limit_skip_authenticated },
+      { key: 'rate_limit_public_endpoints_only', value: rate_limit_public_endpoints_only }
+    ];
+
+    for (const { key, value } of settings) {
+      await db('app_settings')
+        .where('setting_key', key)
+        .update({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+
+    // Clear the rate limit settings cache to apply changes immediately
+    clearSettingsCache();
+
+    // Log activity
+    await logActivity('settings_updated', 
+      { 
+        category: 'security',
+        subcategory: 'rate_limit',
+        changes: settings.length
+      },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Rate limit settings updated successfully' });
+  } catch (error) {
+    console.error('Rate limit settings update error:', error);
+    res.status(500).json({ error: 'Failed to update rate limit settings' });
+  }
+});
+
+module.exports = router;