Initial commit - Project start (July 17, 2025)

Original: feat: enhance security logging and ensure rate limit blocks are properly tracked

- Add comprehensive logging for rate limit blocks with full request details
  - IP address (with proper proxy detection), user agent, headers, timestamps
  - Rate limit info (current count, limit, remaining, reset time)
  - Separate tracking for auth vs general endpoints

- Enhance authentication failure logging
  - JWT validation failures with detailed error info
  - Admin auth attempts without token
  - Failed token validation with user context
  - All events include IP, path, method, user agent

- Improve Winston logger configuration for production
  - Add automatic log rotation (10MB errors, 50MB combined)
  - Create separate security.log for auth/rate limit events
  - Ensure logs directory exists automatically
  - Add structured JSON format for log aggregation
  - Support container logging with LOG_TO_CONSOLE env var

- Create comprehensive documentation
  - Security logging guide with examples
  - Monitoring recommendations
  - Configuration reference

- Add test script to verify logging functionality

All rate limit settings remain configurable via admin panel:
- Window duration, max requests, auth limits
- Skip authenticated requests option
- Public endpoints only option

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

backend/src/__tests__/dbCompat.test.js

@@ -0,0 +1,83 @@
+const { formatBoolean, isPostgreSQL, addDays, formatDateForDB, insertAndGetId } = require('../utils/dbCompat');
+
+describe('Database Compatibility', () => {
+  // Save original env
+  const originalEnv = process.env.DATABASE_CLIENT;
+  
+  afterEach(() => {
+    // Restore original env after each test
+    if (originalEnv) {
+      process.env.DATABASE_CLIENT = originalEnv;
+    } else {
+      delete process.env.DATABASE_CLIENT;
+    }
+  });
+
+  describe('formatBoolean', () => {
+    test('should format boolean values correctly', () => {
+      // Mock for SQLite
+      process.env.DATABASE_CLIENT = 'sqlite3';
+      expect(formatBoolean(true)).toBe(1);
+      expect(formatBoolean(false)).toBe(0);
+      
+      // Mock for PostgreSQL
+      process.env.DATABASE_CLIENT = 'pg';
+      expect(formatBoolean(true)).toBe(true);
+      expect(formatBoolean(false)).toBe(false);
+      
+      // Default (no env var) should be SQLite
+      delete process.env.DATABASE_CLIENT;
+      expect(formatBoolean(true)).toBe(1);
+      expect(formatBoolean(false)).toBe(0);
+    });
+  });
+
+  describe('isPostgreSQL', () => {
+    test('should detect PostgreSQL correctly', () => {
+      process.env.DATABASE_CLIENT = 'pg';
+      expect(isPostgreSQL()).toBe(true);
+      
+      process.env.DATABASE_CLIENT = 'sqlite3';
+      expect(isPostgreSQL()).toBe(false);
+      
+      delete process.env.DATABASE_CLIENT;
+      expect(isPostgreSQL()).toBe(false); // Default to SQLite
+    });
+  });
+
+  describe('formatDateForDB', () => {
+    test('should format dates as ISO strings', () => {
+      const date = new Date('2024-01-15T10:30:00Z');
+      expect(formatDateForDB(date)).toBe('2024-01-15T10:30:00.000Z');
+    });
+  });
+
+  describe('addDays', () => {
+    test('should add days correctly', () => {
+      const date = new Date('2024-01-15');
+      const result = addDays(date, 30);
+      expect(result.toISOString().split('T')[0]).toBe('2024-02-14');
+      
+      const negativeResult = addDays(date, -7);
+      expect(negativeResult.toISOString().split('T')[0]).toBe('2024-01-08');
+    });
+  });
+
+  describe('insertAndGetId', () => {
+    test('should handle PostgreSQL result format', async () => {
+      const mockQuery = {
+        returning: jest.fn().mockResolvedValue([{ id: 123 }])
+      };
+      const result = await insertAndGetId(mockQuery);
+      expect(result).toBe(123);
+    });
+
+    test('should handle SQLite result format', async () => {
+      const mockQuery = {
+        returning: jest.fn().mockResolvedValue([456])
+      };
+      const result = await insertAndGetId(mockQuery);
+      expect(result).toBe(456);
+    });
+  });
+});

backend/src/config/storage.js

@@ -0,0 +1,8 @@
+const path = require('path');
+
+// Get storage path from environment or default
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+module.exports = {
+  getStoragePath
+};

backend/src/config/validateEnv.js

@@ -0,0 +1,66 @@
+const logger = require('../utils/logger');
+
+/**
+ * Validates required environment variables are set
+ * Exits the process if critical variables are missing
+ */
+function validateEnvironment() {
+  const requiredVars = [
+    {
+      name: 'JWT_SECRET',
+      description: 'Secret key for JWT token signing',
+      critical: true
+    }
+  ];
+
+  const warnings = [];
+  const errors = [];
+
+  // Check each required variable
+  requiredVars.forEach(({ name, description, critical }) => {
+    const value = process.env[name];
+    
+    if (!value || value.trim() === '') {
+      const message = `Missing required environment variable: ${name} - ${description}`;
+      
+      if (critical) {
+        errors.push(message);
+      } else {
+        warnings.push(message);
+      }
+    }
+    
+    // Additional validation for JWT_SECRET
+    if (name === 'JWT_SECRET' && value) {
+      // Check for the insecure default value
+      if (value === 'your-secret-key') {
+        errors.push('CRITICAL: JWT_SECRET is set to the insecure default value. Please set a secure secret key.');
+      }
+      
+      // Check minimum length (should be at least 32 characters for security)
+      if (value.length < 32) {
+        warnings.push(`JWT_SECRET should be at least 32 characters long for better security (current: ${value.length} characters)`);
+      }
+    }
+  });
+
+  // Log warnings
+  warnings.forEach(warning => logger.warn(warning));
+
+  // If there are critical errors, log them and exit
+  if (errors.length > 0) {
+    logger.error('=== CRITICAL CONFIGURATION ERRORS ===');
+    errors.forEach(error => logger.error(error));
+    logger.error('=====================================');
+    logger.error('Server cannot start due to missing or invalid configuration.');
+    logger.error('Please set the required environment variables and try again.');
+    
+    // Exit with error code
+    process.exit(1);
+  }
+
+  // Log successful validation
+  logger.info('Environment validation passed');
+}
+
+module.exports = { validateEnvironment };

backend/src/database/connection-manager.js

@@ -0,0 +1,132 @@
+const knex = require('knex');
+const knexConfig = require('../../knexfile');
+const logger = require('../utils/logger');
+
+class ConnectionManager {
+  constructor() {
+    this.db = null;
+    this.reconnectAttempts = 0;
+    this.maxReconnectAttempts = 10;
+    this.reconnectDelay = 5000; // 5 seconds
+    this.isReconnecting = false;
+  }
+
+  async initialize() {
+    try {
+      this.db = knex(knexConfig);
+      
+      // Test the connection
+      await this.db.raw('SELECT 1');
+      logger.info('Database connection established successfully');
+      
+      // Set up connection error handling
+      this.setupErrorHandling();
+      
+      this.reconnectAttempts = 0;
+      return this.db;
+    } catch (error) {
+      logger.error('Failed to initialize database connection:', error);
+      throw error;
+    }
+  }
+
+  setupErrorHandling() {
+    if (!this.db) return;
+
+    // Handle connection errors
+    this.db.on('error', async (error) => {
+      logger.error('Database connection error:', error);
+      
+      if (this.shouldReconnect(error)) {
+        await this.reconnect();
+      }
+    });
+  }
+
+  shouldReconnect(error) {
+    const reconnectableErrors = [
+      'ECONNREFUSED',
+      'ETIMEDOUT',
+      'ECONNRESET',
+      'Connection terminated unexpectedly',
+      'Connection terminated'
+    ];
+    
+    return reconnectableErrors.some(msg => 
+      error.code === msg || error.message?.includes(msg)
+    );
+  }
+
+  async reconnect() {
+    if (this.isReconnecting) {
+      logger.info('Already attempting to reconnect...');
+      return;
+    }
+
+    this.isReconnecting = true;
+    
+    while (this.reconnectAttempts < this.maxReconnectAttempts) {
+      this.reconnectAttempts++;
+      
+      logger.info(`Attempting to reconnect to database (attempt ${this.reconnectAttempts}/${this.maxReconnectAttempts})...`);
+      
+      try {
+        // Destroy the old connection pool
+        if (this.db) {
+          await this.db.destroy();
+        }
+        
+        // Create new connection
+        await this.initialize();
+        
+        logger.info('Successfully reconnected to database');
+        this.isReconnecting = false;
+        return;
+      } catch (error) {
+        logger.error(`Reconnection attempt ${this.reconnectAttempts} failed:`, error.message);
+        
+        if (this.reconnectAttempts < this.maxReconnectAttempts) {
+          await new Promise(resolve => setTimeout(resolve, this.reconnectDelay));
+        }
+      }
+    }
+    
+    this.isReconnecting = false;
+    logger.error('Failed to reconnect to database after maximum attempts');
+    
+    // In production, you might want to alert monitoring systems or restart the process
+    if (process.env.NODE_ENV === 'production') {
+      logger.error('Exiting process due to database connection failure');
+      process.exit(1);
+    }
+  }
+
+  getConnection() {
+    if (!this.db) {
+      throw new Error('Database connection not initialized');
+    }
+    return this.db;
+  }
+
+  async healthCheck() {
+    try {
+      await this.db.raw('SELECT 1');
+      return { healthy: true };
+    } catch (error) {
+      logger.error('Database health check failed:', error);
+      return { healthy: false, error: error.message };
+    }
+  }
+
+  async destroy() {
+    if (this.db) {
+      await this.db.destroy();
+      this.db = null;
+    }
+  }
+}
+
+// Create singleton instance
+const connectionManager = new ConnectionManager();
+
+module.exports = connectionManager;

backend/src/database/db.js

@@ -0,0 +1,228 @@
+const knex = require('knex');
+const knexConfig = require('../../knexfile');
+
+// Create database connection with built-in retry logic
+const db = knex(knexConfig);
+
+async function initializeDatabase() {
+  // Events table
+  const hasEventsTable = await db.schema.hasTable('events');
+  if (!hasEventsTable) {
+    await db.schema.createTable('events', (table) => {
+      table.increments('id').primary();
+      table.string('slug').unique().notNullable();
+      table.string('event_type').notNullable();
+      table.string('event_name').notNullable();
+      table.date('event_date').notNullable();
+      table.string('host_email').notNullable();
+      table.string('admin_email').notNullable();
+      table.string('password_hash').notNullable();
+      table.text('welcome_message');
+      table.text('color_theme');
+      table.string('share_link').unique().notNullable();
+      table.datetime('created_at').defaultTo(db.fn.now());
+      table.datetime('expires_at').notNullable();
+      table.boolean('is_active').defaultTo(true);
+      table.boolean('is_archived').defaultTo(false);
+      table.string('archive_path');
+      table.datetime('archived_at');
+    });
+  } else {
+    // Check if color_theme needs to be updated to TEXT type
+    // This is needed for larger theme configurations
+    const isPostgres = knexConfig.client === 'pg';
+    
+    if (!isPostgres) {
+      // SQLite-specific migration
+      try {
+        await db.raw(`
+          CREATE TABLE IF NOT EXISTS events_new (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            slug TEXT UNIQUE NOT NULL,
+            event_type TEXT NOT NULL,
+            event_name TEXT NOT NULL,
+            event_date DATE NOT NULL,
+            host_email TEXT NOT NULL,
+            admin_email TEXT NOT NULL,
+            password_hash TEXT NOT NULL,
+            welcome_message TEXT,
+            color_theme TEXT,
+            share_link TEXT UNIQUE NOT NULL,
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+            expires_at DATETIME NOT NULL,
+            is_active BOOLEAN DEFAULT 1,
+            is_archived BOOLEAN DEFAULT 0,
+            archive_path TEXT,
+            archived_at DATETIME,
+            allow_user_uploads BOOLEAN DEFAULT 0,
+            upload_category_id INTEGER
+          )
+        `);
+        
+        await db.raw('INSERT INTO events_new SELECT * FROM events');
+        await db.raw('DROP TABLE events');
+        await db.raw('ALTER TABLE events_new RENAME TO events');
+      } catch (error) {
+        // If the migration fails, it might already have been applied
+        console.log('Color theme migration may have already been applied');
+      }
+    }
+  }
+
+  // Photo metadata table
+  const hasPhotosTable = await db.schema.hasTable('photos');
+  if (!hasPhotosTable) {
+    await db.schema.createTable('photos', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.string('filename').notNullable();
+      table.string('path').notNullable();
+      table.string('thumbnail_path');
+      table.string('type').notNullable(); // 'collage' or 'individual'
+      table.integer('size_bytes');
+      table.datetime('uploaded_at').defaultTo(db.fn.now());
+      table.integer('view_count').defaultTo(0);
+      table.integer('download_count').defaultTo(0);
+    });
+  }
+
+  // Access logs table
+  const hasAccessLogsTable = await db.schema.hasTable('access_logs');
+  if (!hasAccessLogsTable) {
+    await db.schema.createTable('access_logs', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').references('id').inTable('events');
+      table.string('ip_address');
+      table.string('user_agent');
+      table.string('action'); // 'view', 'download', 'login_success', 'login_fail'
+      table.string('photo_id');
+      table.datetime('timestamp').defaultTo(db.fn.now());
+    });
+  }
+
+  // Email queue table
+  const hasEmailQueueTable = await db.schema.hasTable('email_queue');
+  if (!hasEmailQueueTable) {
+    await db.schema.createTable('email_queue', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').references('id').inTable('events');
+      table.string('recipient_email').notNullable();
+      table.string('email_type').notNullable(); // 'creation', 'warning', 'expiration', 'archive_complete'
+      table.json('email_data');
+      table.string('status').defaultTo('pending'); // 'pending', 'sent', 'failed'
+      table.datetime('scheduled_at').defaultTo(db.fn.now());
+      table.datetime('sent_at');
+      table.text('error_message');
+      table.integer('retry_count').defaultTo(0);
+    });
+  }
+
+  // Admin users table
+  const hasAdminUsersTable = await db.schema.hasTable('admin_users');
+  if (!hasAdminUsersTable) {
+    await db.schema.createTable('admin_users', (table) => {
+      table.increments('id').primary();
+      table.string('username').unique().notNullable();
+      table.string('email').unique().notNullable();
+      table.string('password_hash').notNullable();
+      table.boolean('is_active').defaultTo(true);
+      table.datetime('created_at').defaultTo(db.fn.now());
+      table.datetime('updated_at').defaultTo(db.fn.now());
+      table.datetime('last_login');
+    });
+  } else {
+    // Check if updated_at column exists
+    const hasUpdatedAt = await db.schema.hasColumn('admin_users', 'updated_at');
+    if (!hasUpdatedAt) {
+      await db.schema.table('admin_users', (table) => {
+        table.datetime('updated_at');
+      });
+      // Set default value for existing rows
+      await db('admin_users').update({ updated_at: new Date() });
+    }
+  }
+
+  // Email configuration table
+  const hasEmailConfigTable = await db.schema.hasTable('email_configs');
+  if (!hasEmailConfigTable) {
+    await db.schema.createTable('email_configs', (table) => {
+      table.increments('id').primary();
+      table.string('smtp_host').notNullable();
+      table.integer('smtp_port').notNullable();
+      table.boolean('smtp_secure').defaultTo(false);
+      table.string('smtp_user');
+      table.string('smtp_pass');
+      table.string('from_email').notNullable();
+      table.string('from_name');
+      table.datetime('updated_at').defaultTo(db.fn.now());
+    });
+  }
+
+  // Email templates table
+  const hasEmailTemplatesTable = await db.schema.hasTable('email_templates');
+  if (!hasEmailTemplatesTable) {
+    await db.schema.createTable('email_templates', (table) => {
+      table.increments('id').primary();
+      table.string('template_key').unique().notNullable(); // 'gallery_created', 'expiration_warning', etc.
+      table.string('subject').notNullable();
+      table.text('body_html').notNullable();
+      table.text('body_text');
+      table.json('variables'); // Available template variables
+      table.datetime('updated_at').defaultTo(db.fn.now());
+    });
+  }
+
+  // App settings table
+  const hasAppSettingsTable = await db.schema.hasTable('app_settings');
+  if (!hasAppSettingsTable) {
+    await db.schema.createTable('app_settings', (table) => {
+      table.increments('id').primary();
+      table.string('setting_key').unique().notNullable();
+      table.json('setting_value');
+      table.string('setting_type'); // 'branding', 'theme', 'general'
+      table.datetime('updated_at').defaultTo(db.fn.now());
+    });
+  }
+
+  // Activity logs table
+  const hasActivityLogsTable = await db.schema.hasTable('activity_logs');
+  if (!hasActivityLogsTable) {
+    await db.schema.createTable('activity_logs', (table) => {
+      table.increments('id').primary();
+      table.string('activity_type').notNullable(); // 'event_created', 'photos_uploaded', etc.
+      table.string('actor_type'); // 'admin', 'system', 'guest'
+      table.integer('actor_id');
+      table.string('actor_name');
+      table.json('metadata'); // Additional data about the activity
+      table.integer('event_id').references('id').inTable('events');
+      table.datetime('created_at').defaultTo(db.fn.now());
+      table.datetime('read_at').nullable();
+    });
+  } else {
+    // Check if read_at column exists
+    const hasReadAt = await db.schema.hasColumn('activity_logs', 'read_at');
+    if (!hasReadAt) {
+      await db.schema.table('activity_logs', (table) => {
+        table.datetime('read_at').nullable();
+      });
+    }
+  }
+}
+
+// Helper function to log activities
+async function logActivity(activityType, metadata = {}, eventId = null, actor = null) {
+  try {
+    await db('activity_logs').insert({
+      activity_type: activityType,
+      actor_type: actor?.type || 'system',
+      actor_id: actor?.id || null,
+      actor_name: actor?.name || null,
+      metadata: JSON.stringify(metadata),
+      event_id: eventId
+    });
+  } catch (error) {
+    console.error('Failed to log activity:', error);
+  }
+}
+
+module.exports = { db, initializeDatabase, logActivity };

backend/src/middleware/auth-enhanced-v2.js

@@ -0,0 +1,167 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { isTokenRevoked } = require('../utils/tokenRevocation');
+const logger = require('../utils/logger');
+
+/**
+ * Enhanced admin authentication middleware with revocation checking
+ */
+async function adminAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if token is revoked
+    if (await isTokenRevoked(decoded)) {
+      logger.warn('Revoked token used', {
+        userId: decoded.id,
+        tokenType: decoded.type
+      });
+      return res.status(401).json({ error: 'Token has been revoked', code: 'TOKEN_REVOKED' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'admin') {
+      logger.warn('Non-admin token used for admin endpoint', { 
+        userId: decoded.id,
+        tokenType: decoded.type 
+      });
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+    
+    // IP validation (optional - can be strict or just log)
+    const currentIp = req.ip || req.connection.remoteAddress;
+    if (decoded.ip && decoded.ip !== currentIp) {
+      logger.warn('Token used from different IP', {
+        userId: decoded.id,
+        tokenIp: decoded.ip,
+        currentIp: currentIp
+      });
+    }
+    
+    // Check if admin still exists and is active
+    const admin = await db('admin_users')
+      .where({ id: decoded.id, is_active: formatBoolean(true) })
+      .first();
+    
+    if (!admin) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if password was changed after token was issued
+    if (admin.password_changed_at) {
+      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
+      if (decoded.iat < passwordChangedTime) {
+        logger.warn('Token used after password change', { userId: decoded.id });
+        return res.status(401).json({ 
+          error: 'Token invalid due to password change',
+          code: 'PASSWORD_CHANGED'
+        });
+      }
+    }
+    
+    // Add user info to request
+    req.admin = {
+      id: admin.id,
+      username: admin.username,
+      email: admin.email
+    };
+    req.token = token; // Store token for potential revocation
+    
+    next();
+  } catch (error) {
+    logger.error('Auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Enhanced gallery authentication middleware with revocation checking
+ */
+async function galleryAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid session' });
+    }
+    
+    // Check if token is revoked
+    if (await isTokenRevoked(decoded)) {
+      return res.status(401).json({ error: 'Session has been invalidated', code: 'TOKEN_REVOKED' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'gallery') {
+      return res.status(403).json({ error: 'Invalid access token' });
+    }
+    
+    // Check if event still exists and is active
+    const event = await db('events')
+      .where({ 
+        id: decoded.eventId, 
+        is_active: true, 
+        is_archived: false 
+      })
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    // Check if gallery has expired
+    if (new Date(event.expires_at) < new Date()) {
+      return res.status(410).json({ 
+        error: 'Gallery has expired',
+        code: 'GALLERY_EXPIRED'
+      });
+    }
+    
+    // Add event info to request
+    req.event = event;
+    req.galleryToken = decoded;
+    req.token = token;
+    
+    next();
+  } catch (error) {
+    logger.error('Gallery auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+// Export other middleware functions from original file...
+module.exports = { 
+  adminAuth, 
+  galleryAuth,
+  // ... other exports
+};

backend/src/middleware/auth-enhanced.js

@@ -0,0 +1,238 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const logger = require('../utils/logger');
+
+/**
+ * Enhanced admin authentication middleware
+ * Adds additional security checks beyond basic JWT validation
+ */
+async function adminAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload; // Extract payload when using complete: true
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'admin') {
+      logger.warn('Non-admin token used for admin endpoint', { 
+        userId: decoded.id,
+        tokenType: decoded.type 
+      });
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+    
+    // IP validation (optional - can be strict or just log)
+    const currentIp = req.ip || req.connection.remoteAddress;
+    if (decoded.ip && decoded.ip !== currentIp) {
+      logger.warn('Token used from different IP', {
+        userId: decoded.id,
+        tokenIp: decoded.ip,
+        currentIp: currentIp
+      });
+      // Optional: Reject if IP doesn't match
+      // return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if admin still exists and is active
+    const admin = await db('admin_users')
+      .where({ id: decoded.id, is_active: formatBoolean(true) })
+      .first();
+    
+    if (!admin) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if password was changed after token was issued
+    if (admin.password_changed_at) {
+      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
+      if (decoded.iat < passwordChangedTime) {
+        logger.warn('Token used after password change', { userId: decoded.id });
+        return res.status(401).json({ 
+          error: 'Token invalid due to password change',
+          code: 'PASSWORD_CHANGED'
+        });
+      }
+    }
+    
+    // Add user info to request
+    req.admin = {
+      id: admin.id,
+      username: admin.username,
+      email: admin.email
+    };
+    
+    next();
+  } catch (error) {
+    logger.error('Auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Enhanced gallery authentication middleware
+ */
+async function galleryAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid session' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'gallery') {
+      return res.status(403).json({ error: 'Invalid access token' });
+    }
+    
+    // Check if event still exists and is active
+    const event = await db('events')
+      .where({ 
+        id: decoded.eventId, 
+        is_active: true, 
+        is_archived: false 
+      })
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    // Check if gallery has expired
+    if (new Date(event.expires_at) < new Date()) {
+      return res.status(410).json({ 
+        error: 'Gallery has expired',
+        code: 'GALLERY_EXPIRED'
+      });
+    }
+    
+    // Add event info to request
+    req.event = event;
+    req.galleryToken = decoded;
+    
+    next();
+  } catch (error) {
+    logger.error('Gallery auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Photo access authentication
+ * Validates both admin and gallery tokens for photo access
+ */
+async function photoAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET);
+    } catch (err) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Allow both admin and gallery tokens
+    if (decoded.type === 'admin') {
+      const admin = await db('admin_users')
+        .where({ id: decoded.id, is_active: formatBoolean(true) })
+        .first();
+      
+      if (!admin) {
+        return res.status(401).json({ error: 'Invalid token' });
+      }
+      
+      req.auth = { type: 'admin', user: admin };
+    } else if (decoded.type === 'gallery') {
+      const event = await db('events')
+        .where({ 
+          id: decoded.eventId, 
+          is_active: true, 
+          is_archived: false 
+        })
+        .first();
+      
+      if (!event) {
+        return res.status(404).json({ error: 'Gallery not found' });
+      }
+      
+      // For gallery tokens, ensure they can only access their event's photos
+      req.auth = { type: 'gallery', event: event };
+    } else {
+      return res.status(403).json({ error: 'Invalid token type' });
+    }
+    
+    next();
+  } catch (error) {
+    logger.error('Photo auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Verify gallery access for specific operations
+ */
+async function verifyGalleryAccess(req, res, next) {
+  try {
+    if (!req.auth) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    
+    const { eventId } = req.params;
+    
+    // Admins can access any gallery
+    if (req.auth.type === 'admin') {
+      return next();
+    }
+    
+    // Gallery tokens can only access their own event
+    if (req.auth.type === 'gallery') {
+      if (req.auth.event.id !== parseInt(eventId)) {
+        return res.status(403).json({ error: 'Access denied' });
+      }
+      return next();
+    }
+    
+    res.status(403).json({ error: 'Access denied' });
+  } catch (error) {
+    res.status(500).json({ error: 'Access verification failed' });
+  }
+}
+
+module.exports = { 
+  adminAuth, 
+  galleryAuth,
+  photoAuth,
+  verifyGalleryAccess
+};

backend/src/middleware/auth.js

@@ -0,0 +1,85 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const logger = require('../utils/logger');
+
+async function adminAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      logger.warn('Admin auth attempt without token', {
+        ip: clientIp,
+        path: req.path,
+        method: req.method,
+        userAgent: req.headers['user-agent']
+      });
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET);
+    } catch (jwtError) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      
+      logger.warn('JWT validation failed', {
+        ip: clientIp,
+        path: req.path,
+        method: req.method,
+        userAgent: req.headers['user-agent'],
+        error: jwtError.name,
+        message: jwtError.message,
+        timestamp: new Date().toISOString()
+      });
+      
+      if (jwtError.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    const admin = await db('admin_users').where({ id: decoded.id, is_active: formatBoolean(true) }).first();
+    
+    if (!admin) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      
+      logger.warn('Admin auth failed - user not found or inactive', {
+        ip: clientIp,
+        userId: decoded.id,
+        path: req.path,
+        method: req.method,
+        timestamp: new Date().toISOString()
+      });
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    req.admin = admin;
+    next();
+  } catch (error) {
+    const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                   req.headers['x-real-ip'] || 
+                   req.connection.remoteAddress || 
+                   req.ip;
+    
+    logger.error('Admin auth middleware error', {
+      ip: clientIp,
+      path: req.path,
+      error: error.message,
+      stack: error.stack,
+      timestamp: new Date().toISOString()
+    });
+    res.status(401).json({ error: 'Invalid token' });
+  }
+}
+
+module.exports = { adminAuth };

backend/src/middleware/gallery.js

@@ -0,0 +1,36 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+
+// Middleware to verify gallery access
+async function verifyGalleryAccess(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    const event = await db('events')
+      .where({ 
+        id: decoded.eventId, 
+        is_active: formatBoolean(true),
+        is_archived: formatBoolean(false)
+      })
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    req.event = event;
+    next();
+  } catch (error) {
+    console.error('Error verifying gallery access:', error);
+    res.status(401).json({ error: 'Invalid token', details: error.message });
+  }
+}
+
+module.exports = {
+  verifyGalleryAccess
+};

backend/src/middleware/maintenance.js

@@ -0,0 +1,111 @@
+const { db } = require('../database/db');
+
+// Cache maintenance mode status to avoid DB queries on every request
+let maintenanceMode = false;
+let lastCheck = 0;
+const CACHE_DURATION = 60000; // 1 minute
+
+// Retry configuration for database queries
+const MAX_RETRIES = 3;
+const RETRY_DELAY = 1000; // 1 second
+
+async function queryWithRetry(queryFn, retries = MAX_RETRIES) {
+  for (let i = 0; i < retries; i++) {
+    try {
+      return await queryFn();
+    } catch (error) {
+      if (i === retries - 1) {
+        throw error;
+      }
+      
+      // Check if it's a connection error that might benefit from retry
+      const isConnectionError = 
+        error.message?.includes('Connection terminated') ||
+        error.message?.includes('ECONNREFUSED') ||
+        error.message?.includes('ETIMEDOUT') ||
+        error.code === 'ECONNRESET';
+      
+      if (isConnectionError) {
+        console.warn(`Database connection error, retrying in ${RETRY_DELAY}ms... (attempt ${i + 1}/${retries})`);
+        await new Promise(resolve => setTimeout(resolve, RETRY_DELAY));
+      } else {
+        throw error; // Don't retry non-connection errors
+      }
+    }
+  }
+}
+
+async function checkMaintenanceMode() {
+  const now = Date.now();
+  
+  // Use cached value if recent
+  if (now - lastCheck < CACHE_DURATION) {
+    return maintenanceMode;
+  }
+  
+  try {
+    const setting = await queryWithRetry(async () => {
+      return await db('app_settings')
+        .where('setting_key', 'general_maintenance_mode')
+        .where('setting_type', 'general')
+        .first();
+    });
+    
+    maintenanceMode = setting ? (setting.setting_value === 'true' || setting.setting_value === true) : false;
+    lastCheck = now;
+    
+    return maintenanceMode;
+  } catch (error) {
+    console.error('Error checking maintenance mode after retries:', error.message);
+    // Return cached value or false if no cache
+    return maintenanceMode;
+  }
+}
+
+// Middleware to enforce maintenance mode
+async function maintenanceMiddleware(req, res, next) {
+  // Skip maintenance check for certain paths
+  const skipPaths = [
+    '/api/admin/login',
+    '/api/admin/auth/login',
+    '/api/public/settings',
+    '/health'
+  ];
+  
+  // Allow static assets (uploads, favicons, logos)
+  const isStaticAsset = req.path.startsWith('/uploads/') || 
+                       req.path.startsWith('/favicons/') || 
+                       req.path.startsWith('/logos/');
+  
+  // Allow admin routes if admin is authenticated
+  const isAdminRoute = req.path.startsWith('/api/admin');
+  const hasAdminAuth = req.headers.authorization?.startsWith('Bearer ');
+  
+  if (skipPaths.includes(req.path) || isStaticAsset || (isAdminRoute && hasAdminAuth)) {
+    return next();
+  }
+  
+  try {
+    const inMaintenance = await checkMaintenanceMode();
+    
+    if (inMaintenance && !isAdminRoute) {
+      return res.status(503).json({
+        error: 'Service Unavailable',
+        message: 'The system is currently undergoing maintenance. Please try again later.',
+        maintenance: true
+      });
+    }
+  } catch (error) {
+    // If we can't check maintenance mode, allow the request to proceed
+    console.error('Failed to check maintenance mode, allowing request:', error.message);
+  }
+  
+  next();
+}
+
+// Function to clear cache when settings change
+function clearMaintenanceCache() {
+  lastCheck = 0;
+}
+
+module.exports = { maintenanceMiddleware, clearMaintenanceCache };

backend/src/middleware/photoAuth.js

@@ -0,0 +1,116 @@
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+
+async function photoAuth(req, res, next) {
+  try {
+    // Extract event slug from the path
+    let eventSlug;
+    
+    console.log('PhotoAuth middleware - path:', req.path);
+    
+    // For thumbnails, we need to parse the filename to get the event info
+    if (req.path.startsWith('/thumb_')) {
+      // For now, we'll rely on JWT token for thumbnail access
+      eventSlug = null;
+    } else {
+      // For regular photos, the slug is the first part of the path
+      eventSlug = req.path.split('/')[1];
+    }
+    
+    // First check for JWT token (from gallery access)
+    const authHeader = req.headers.authorization;
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+      const token = authHeader.replace('Bearer ', '');
+      try {
+        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+        
+        // Check if it's a gallery token
+        if (decoded.type === 'gallery') {
+          // For thumbnails, we need to verify the token is for a valid event
+          if (!eventSlug) {
+            // Extract event ID from the decoded token
+            if (decoded.eventId) {
+              const event = await db('events')
+                .where({ id: decoded.eventId, is_active: formatBoolean(true) })
+                .first();
+              if (event) {
+                req.event = event;
+                return next();
+              }
+            }
+            // Fallback to slug
+            const event = await db('events')
+              .where({ slug: decoded.eventSlug, is_active: formatBoolean(true) })
+              .first();
+            if (event) {
+              req.event = event;
+              return next();
+            }
+          }
+          // For regular photos, check if token matches the event
+          else if (decoded.eventSlug === eventSlug) {
+            const event = await db('events')
+              .where({ slug: eventSlug, is_active: formatBoolean(true) })
+              .first();
+            if (event) {
+              req.event = event;
+              return next();
+            }
+          }
+        }
+        
+        // Check if it's an admin token (admins can view all photos)
+        if (decoded.type === 'admin') {
+          // For both thumbnails and photos with admin token, allow access
+          return next();
+        }
+      } catch (err) {
+        // Token invalid, fall through to password check
+        console.error('JWT verification failed:', err.message);
+      }
+    }
+    
+    // Check for password header (legacy support)
+    const password = req.headers['x-gallery-password'];
+    
+    if (!password && !authHeader) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    
+    // If no eventSlug (thumbnails), and we don't have valid auth yet, deny access
+    if (!eventSlug && !password) {
+      return res.status(401).json({ error: 'Authentication required for thumbnails' });
+    }
+    
+    const event = await db('events').where({ slug: eventSlug, is_active: formatBoolean(true) }).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found' });
+    }
+    
+    if (password) {
+      const validPassword = await bcrypt.compare(password, event.password_hash);
+      if (!validPassword) {
+        await db('access_logs').insert({
+          event_id: event.id,
+          ip_address: req.ip,
+          user_agent: req.headers['user-agent'],
+          action: 'login_fail'
+        });
+        return res.status(401).json({ error: 'Invalid password' });
+      }
+    } else {
+      // No valid authentication
+      return res.status(401).json({ error: 'Invalid authentication' });
+    }
+    
+    req.event = event;
+    next();
+  } catch (error) {
+    console.error('Photo auth error:', error);
+    res.status(500).json({ error: 'Authentication error' });
+  }
+}
+
+module.exports = photoAuth;

backend/src/middleware/secureStatic.js

@@ -0,0 +1,46 @@
+const path = require('path');
+const express = require('express');
+const { safePathJoin, isPathSafe } = require('../utils/fileSecurityUtils');
+
+/**
+ * Create a secure static file serving middleware that prevents path traversal attacks
+ * @param {string} basePath - The base directory to serve files from
+ * @param {Object} options - Express static options
+ * @returns {Function} - Express middleware
+ */
+function secureStatic(basePath, options = {}) {
+  const normalizedBase = path.resolve(basePath);
+  
+  return (req, res, next) => {
+    // Get the requested file path - remove leading slash for validation
+    const requestedPath = req.path.startsWith('/') ? req.path.substring(1) : req.path;
+    
+    // Validate the path doesn't contain dangerous patterns
+    if (!isPathSafe(requestedPath)) {
+      console.warn(`Potential path traversal attempt blocked: ${requestedPath}`);
+      return res.status(403).json({ error: 'Access denied' });
+    }
+    
+    try {
+      // Validate the full path is within the base directory
+      const fullPath = safePathJoin(normalizedBase, requestedPath);
+      
+      // If validation passes, use express.static
+      const staticMiddleware = express.static(normalizedBase, {
+        ...options,
+        // Disable directory listing for security
+        index: false,
+        // Don't allow dotfiles
+        dotfiles: 'deny'
+      });
+      
+      return staticMiddleware(req, res, next);
+    } catch (error) {
+      // Path traversal detected
+      console.error(`Path traversal blocked: ${requestedPath}`, error.message);
+      return res.status(403).json({ error: 'Access denied' });
+    }
+  };
+}
+
+module.exports = secureStatic;

backend/src/middleware/sessionTimeout.js

@@ -0,0 +1,153 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+
+// In-memory session tracking (in production, use Redis)
+const sessions = new Map();
+
+// Default session timeout (60 minutes)
+const DEFAULT_SESSION_TIMEOUT = 60 * 60 * 1000;
+
+// Cache for session timeout setting
+let cachedTimeout = null;
+let cacheExpiry = 0;
+const CACHE_DURATION = 5 * 60 * 1000; // 5 minutes
+
+// Clean up expired sessions every 5 minutes
+setInterval(() => {
+  const now = Date.now();
+  for (const [token, lastActivity] of sessions.entries()) {
+    if (now - lastActivity > DEFAULT_SESSION_TIMEOUT) {
+      sessions.delete(token);
+    }
+  }
+}, 5 * 60 * 1000);
+
+async function getSessionTimeout() {
+  const now = Date.now();
+  
+  // Return cached value if still valid
+  if (cachedTimeout && now < cacheExpiry) {
+    return cachedTimeout;
+  }
+  
+  try {
+    const setting = await db('app_settings')
+      .where('setting_key', 'security_session_timeout_minutes')
+      .first()
+      .timeout(5000); // 5 second timeout
+    
+    if (setting && setting.setting_value) {
+      let value = setting.setting_value;
+      // Handle both string and object values
+      if (typeof value === 'string') {
+        try {
+          value = JSON.parse(value);
+        } catch (e) {
+          // If it's not JSON, try to parse as number directly
+          value = parseInt(value);
+        }
+      }
+      const minutes = parseInt(value);
+      if (!isNaN(minutes) && minutes > 0) {
+        cachedTimeout = minutes * 60 * 1000; // Convert to milliseconds
+        cacheExpiry = now + CACHE_DURATION;
+        return cachedTimeout;
+      }
+    }
+  } catch (error) {
+    // Only log if it's not a connection error (to avoid spam)
+    if (error.code !== 'ECONNRESET' && !error.message?.includes('Connection terminated')) {
+      console.error('Error getting session timeout:', error.message);
+    }
+  }
+  
+  // Use cached value if available, otherwise default
+  return cachedTimeout || DEFAULT_SESSION_TIMEOUT;
+}
+
+async function sessionTimeoutMiddleware(req, res, next) {
+  // Skip for non-authenticated routes
+  if (!req.headers.authorization) {
+    return next();
+  }
+  
+  const token = req.headers.authorization.split(' ')[1];
+  if (!token) {
+    return next();
+  }
+  
+  try {
+    // Verify token is valid
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    
+    // Check if this is an admin token
+    if (!decoded.id) {
+      return next();
+    }
+    
+    const now = Date.now();
+    const lastActivity = sessions.get(token);
+    const timeout = await getSessionTimeout();
+    
+    // If session exists, check if it's expired
+    if (lastActivity) {
+      if (now - lastActivity > timeout) {
+        sessions.delete(token);
+        return res.status(401).json({ 
+          error: 'Session expired', 
+          code: 'SESSION_TIMEOUT' 
+        });
+      }
+    }
+    
+    // Update last activity
+    sessions.set(token, now);
+    
+    // Clean up old token if user has a new one
+    // This prevents memory leaks from token renewals
+    const userId = decoded.id;
+    for (const [oldToken, _] of sessions.entries()) {
+      if (oldToken !== token) {
+        try {
+          const oldDecoded = jwt.verify(oldToken, process.env.JWT_SECRET);
+          if (oldDecoded.id === userId) {
+            sessions.delete(oldToken);
+          }
+        } catch (e) {
+          // Token is invalid, remove it
+          sessions.delete(oldToken);
+        }
+      }
+    }
+    
+    next();
+  } catch (error) {
+    // Token is invalid
+    next();
+  }
+}
+
+// Function to end a session
+function endSession(token) {
+  sessions.delete(token);
+}
+
+// Function to get active sessions count
+function getActiveSessions() {
+  const now = Date.now();
+  let active = 0;
+  
+  for (const [_, lastActivity] of sessions.entries()) {
+    if (now - lastActivity <= DEFAULT_SESSION_TIMEOUT) {
+      active++;
+    }
+  }
+  
+  return active;
+}
+
+module.exports = { 
+  sessionTimeoutMiddleware, 
+  endSession,
+  getActiveSessions 
+};

backend/src/middleware/uploadValidation.js

@@ -0,0 +1,111 @@
+const fs = require('fs').promises;
+const path = require('path');
+const sharp = require('sharp');
+const logger = require('../utils/logger');
+
+/**
+ * Validate uploaded file is complete and not corrupted
+ */
+async function validateUploadedFile(filePath) {
+  try {
+    // Check file exists and has size
+    const stats = await fs.stat(filePath);
+    if (stats.size === 0) {
+      throw new Error('File is empty');
+    }
+    
+    // For image files, verify they can be read by Sharp
+    const ext = path.extname(filePath).toLowerCase();
+    const imageExtensions = ['.jpg', '.jpeg', '.png', '.gif', '.webp'];
+    
+    if (imageExtensions.includes(ext)) {
+      // Try to read metadata - this will fail if image is corrupted
+      let metadata;
+      try {
+        metadata = await sharp(filePath, {
+          failOnError: false, // Don't fail on recoverable errors
+          limitInputPixels: 268402689 // ~16k x 16k max
+        }).metadata();
+      } catch (metadataError) {
+        // If metadata reading fails, the file is likely incomplete
+        throw new Error(`Invalid image file: ${metadataError.message}`);
+      }
+      
+      if (!metadata || !metadata.width || !metadata.height) {
+        throw new Error('Invalid image dimensions - file may be incomplete');
+      }
+      
+      // Check for reasonable dimensions
+      if (metadata.width < 10 || metadata.height < 10) {
+        throw new Error('Image dimensions too small');
+      }
+      
+      // Additional check: verify we can actually decode a small portion of the image
+      try {
+        await sharp(filePath, {
+          failOnError: false,
+          limitInputPixels: 268402689
+        })
+        .resize(10, 10) // Try to resize to very small size
+        .toBuffer();
+      } catch (decodeError) {
+        throw new Error(`Image decode failed - file may be corrupted: ${decodeError.message}`);
+      }
+      
+      return true;
+    }
+    
+    return true;
+  } catch (error) {
+    logger.error(`File validation failed for ${filePath}:`, error.message);
+    throw error;
+  }
+}
+
+/**
+ * Middleware to validate uploaded files after multer processing
+ */
+async function validateUploadedFiles(req, res, next) {
+  if (!req.files || req.files.length === 0) {
+    return next();
+  }
+  
+  const validFiles = [];
+  const invalidFiles = [];
+  
+  // Validate each file
+  for (const file of req.files) {
+    try {
+      await validateUploadedFile(file.path);
+      validFiles.push(file);
+    } catch (error) {
+      logger.warn(`Removing invalid upload ${file.originalname}: ${error.message}`);
+      invalidFiles.push({
+        filename: file.originalname,
+        error: error.message
+      });
+      
+      // Delete the invalid file
+      try {
+        await fs.unlink(file.path);
+      } catch (unlinkErr) {
+        logger.error(`Failed to delete invalid file ${file.path}:`, unlinkErr.message);
+      }
+    }
+  }
+  
+  // Update req.files to only include valid files
+  req.files = validFiles;
+  
+  // Store invalid files info for response
+  if (invalidFiles.length > 0) {
+    req.invalidFiles = invalidFiles;
+  }
+  
+  next();
+}
+
+module.exports = {
+  validateUploadedFile,
+  validateUploadedFiles
+};

backend/src/routes/admin.js

@@ -0,0 +1,26 @@
+const express = require('express');
+const router = express.Router();
+
+// Import sub-routers
+const dashboardRoutes = require('./adminDashboard');
+const archiveRoutes = require('./adminArchives');
+const emailRoutes = require('./adminEmail');
+const settingsRoutes = require('./adminSettings');
+const eventsRoutes = require('./adminEvents');
+const photosRoutes = require('./adminPhotos');
+const categoriesRoutes = require('./adminCategories');
+const cmsRoutes = require('./adminCMS');
+const notificationsRoutes = require('./adminNotifications');
+
+// Mount sub-routers
+router.use('/dashboard', dashboardRoutes);
+router.use('/archives', archiveRoutes);
+router.use('/email', emailRoutes);
+router.use('/settings', settingsRoutes);
+router.use('/events', eventsRoutes);
+router.use('/events', photosRoutes);
+router.use('/categories', categoriesRoutes);
+router.use('/cms', cmsRoutes);
+router.use('/notifications', notificationsRoutes);
+
+module.exports = router;

backend/src/routes/adminArchives.js

@@ -0,0 +1,411 @@
+const express = require('express');
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const archiver = require('archiver');
+const AdmZip = require('adm-zip');
+const router = express.Router();
+
+// Get all archived events
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const page = parseInt(req.query.page) || 1;
+    const limit = parseInt(req.query.limit) || 20;
+    const offset = (page - 1) * limit;
+
+    // Get total count
+    const totalCount = await db('events')
+      .where('is_archived', formatBoolean(true))
+      .count('id as count')
+      .first();
+
+    // Get archived events
+    const archives = await db('events')
+      .select(
+        'events.*',
+        db.raw('COUNT(DISTINCT photos.id) as photo_count'),
+        db.raw('SUM(photos.size_bytes) as total_size')
+      )
+      .leftJoin('photos', 'events.id', 'photos.event_id')
+      .where('events.is_archived', formatBoolean(true))
+      .groupBy('events.id')
+      .orderBy('events.archived_at', 'desc')
+      .limit(limit)
+      .offset(offset);
+
+    // Check if archive files exist and get their sizes
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const archivesWithFileInfo = await Promise.all(archives.map(async (archive) => {
+      let archiveFileSize = 0;
+      if (archive.archive_path) {
+        try {
+          const fullArchivePath = path.join(storagePath, archive.archive_path);
+          const stats = await fs.stat(fullArchivePath);
+          archiveFileSize = stats.size;
+        } catch (error) {
+          console.error(`Archive file not found: ${archive.archive_path}`);
+        }
+      }
+
+      return {
+        id: archive.id,
+        slug: archive.slug,
+        eventName: archive.event_name,
+        eventDate: archive.event_date,
+        eventType: archive.event_type,
+        hostEmail: archive.host_email,
+        archivedAt: archive.archived_at ? new Date(archive.archived_at).toISOString() : null,
+        expiresAt: archive.expires_at ? new Date(archive.expires_at).toISOString() : null,
+        photoCount: archive.photo_count || 0,
+        originalSize: archive.total_size || 0,
+        archiveSize: archiveFileSize,
+        archivePath: archive.archive_path
+      };
+    }));
+
+    res.json({
+      archives: archivesWithFileInfo,
+      pagination: {
+        page,
+        limit,
+        total: totalCount.count,
+        totalPages: Math.ceil(totalCount.count / limit)
+      }
+    });
+  } catch (error) {
+    console.error('Archives list error:', error);
+    res.status(500).json({ error: 'Failed to fetch archives' });
+  }
+});
+
+// Get single archive details
+router.get('/:id', adminAuth, async (req, res) => {
+  try {
+    const archive = await db('events')
+      .where('id', req.params.id)
+      .where('is_archived', formatBoolean(true))
+      .first();
+
+    if (!archive) {
+      return res.status(404).json({ error: 'Archive not found' });
+    }
+
+    // Get photo details
+    const photos = await db('photos')
+      .where('event_id', archive.id)
+      .select('filename', 'type', 'size_bytes', 'uploaded_at');
+
+    // Check archive file
+    let archiveFileInfo = null;
+    if (archive.archive_path) {
+      try {
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const fullArchivePath = path.join(storagePath, archive.archive_path);
+        const stats = await fs.stat(fullArchivePath);
+        archiveFileInfo = {
+          size: stats.size,
+          createdAt: stats.birthtime,
+          path: archive.archive_path
+        };
+      } catch (error) {
+        console.error('Archive file not found:', error);
+      }
+    }
+
+    res.json({
+      id: archive.id,
+      slug: archive.slug,
+      eventName: archive.event_name,
+      eventDate: archive.event_date,
+      eventType: archive.event_type,
+      hostEmail: archive.host_email,
+      adminEmail: archive.admin_email,
+      welcomeMessage: archive.welcome_message,
+      colorTheme: archive.color_theme,
+      createdAt: archive.created_at,
+      expiresAt: archive.expires_at,
+      archivedAt: archive.archived_at,
+      photos: photos,
+      archiveFile: archiveFileInfo
+    });
+  } catch (error) {
+    console.error('Archive details error:', error);
+    res.status(500).json({ error: 'Failed to fetch archive details' });
+  }
+});
+
+// Restore archive
+router.post('/:id/restore', adminAuth, async (req, res) => {
+  try {
+    const archive = await db('events')
+      .where('id', req.params.id)
+      .where('is_archived', formatBoolean(true))
+      .first();
+
+    if (!archive) {
+      return res.status(404).json({ error: 'Archive not found' });
+    }
+
+    // Check if archive file exists
+    if (!archive.archive_path) {
+      return res.status(400).json({ error: 'No archive file found' });
+    }
+
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const fullArchivePath = path.join(storagePath, archive.archive_path);
+
+    try {
+      await fs.access(fullArchivePath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Archive file not found on disk' });
+    }
+
+    // Extract the archive
+    try {
+      const zip = new AdmZip(fullArchivePath);
+      const eventsDir = path.join(storagePath, 'events/active');
+      const eventDir = path.join(eventsDir, archive.slug);
+      
+      // Create event directory if it doesn't exist
+      await fs.mkdir(eventDir, { recursive: true });
+      
+      // Log ZIP contents for debugging
+      console.log(`Extracting archive to: ${eventDir}`);
+      const entries = zip.getEntries();
+      console.log(`Archive contains ${entries.length} entries`);
+      
+      // Extract files to the event directory
+      zip.extractAllTo(eventDir, true);
+      
+      // Get list of extracted files to update database
+      const extractedPhotos = [];
+      
+      // First, collect all category information from the ZIP structure
+      const categoriesMap = new Map();
+      
+      for (const entry of entries) {
+        if (!entry.isDirectory && entry.entryName.match(/\.(jpg|jpeg|png|gif|webp)$/i)) {
+          const filename = path.basename(entry.entryName);
+          const dirPath = path.dirname(entry.entryName);
+          const actualFilePath = path.join(eventDir, entry.entryName);
+          
+          try {
+            // Check if file was extracted successfully
+            const stats = await fs.stat(actualFilePath);
+            
+            // Determine category from directory structure
+            let categoryId = null;
+            if (dirPath && dirPath !== '.') {
+              // Get the first level directory as category
+              const categoryName = dirPath.split(path.sep)[0];
+              
+              if (!categoriesMap.has(categoryName)) {
+                // Check if this category exists in the database
+                const existingCategory = await db('photo_categories')
+                  .where('event_id', archive.id)
+                  .where('name', categoryName)
+                  .first();
+                
+                if (existingCategory) {
+                  categoriesMap.set(categoryName, existingCategory.id);
+                } else {
+                  // Create the category if it doesn't exist
+                  const insertResult = await db('photo_categories').insert({
+                    event_id: archive.id,
+                    name: categoryName,
+                    slug: categoryName.toLowerCase().replace(/[^a-z0-9]/g, '-'),
+                    created_at: new Date()
+                  }).returning('id');
+                  
+                  const newCategoryId = insertResult[0]?.id || insertResult[0];
+                  categoriesMap.set(categoryName, newCategoryId);
+                }
+              }
+              
+              categoryId = categoriesMap.get(categoryName);
+            }
+          
+            // Check if photo already exists in database
+            const existingPhoto = await db('photos')
+              .where('event_id', archive.id)
+              .where('filename', filename)
+              .first();
+            
+            if (!existingPhoto) {
+              // Store relative path from storage root
+              const relativePath = path.relative(storagePath, actualFilePath);
+              extractedPhotos.push({
+                event_id: archive.id,
+                filename: filename,
+                original_filename: filename,
+                path: relativePath,
+                thumbnail_path: null, // Will be regenerated by thumbnail service
+                type: path.extname(filename).substring(1).toLowerCase(),
+                size_bytes: stats.size,
+                category_id: categoryId,
+                uploaded_at: new Date()
+              });
+            }
+          } catch (statError) {
+            console.error(`Failed to stat file: ${actualFilePath}`);
+            console.error(`Entry name was: ${entry.entryName}`);
+            console.error('Error:', statError.message);
+            // Skip this file if we can't stat it
+            continue;
+          }
+        }
+      }
+      
+      // Insert new photos if any
+      if (extractedPhotos.length > 0) {
+        await db('photos').insert(extractedPhotos);
+      }
+      
+    } catch (extractError) {
+      console.error('Archive extraction error:', extractError);
+      return res.status(500).json({ error: 'Failed to extract archive: ' + extractError.message });
+    }
+    
+    // Update event status
+    const thirtyDaysFromNow = new Date();
+    thirtyDaysFromNow.setDate(thirtyDaysFromNow.getDate() + 30);
+    
+    await db('events')
+      .where('id', req.params.id)
+      .update({
+        is_archived: false,
+        is_active: true,
+        archive_path: null,
+        archived_at: null,
+        expires_at: thirtyDaysFromNow.toISOString() // Reset expiration - works on both DBs
+      });
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'archive_restored',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      event_id: archive.id,
+      metadata: JSON.stringify({ event_name: archive.event_name })
+    });
+
+    res.json({ message: 'Archive restored successfully' });
+  } catch (error) {
+    console.error('Archive restore error:', error);
+    res.status(500).json({ error: 'Failed to restore archive' });
+  }
+});
+
+// Download archive
+router.get('/:id/download', adminAuth, async (req, res) => {
+  try {
+    const archive = await db('events')
+      .where('id', req.params.id)
+      .where('is_archived', formatBoolean(true))
+      .first();
+
+    if (!archive) {
+      return res.status(404).json({ error: 'Archive not found' });
+    }
+
+    if (!archive.archive_path) {
+      return res.status(404).json({ error: 'Archive file not found' });
+    }
+
+    // Check if file exists
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const fullArchivePath = path.join(storagePath, archive.archive_path);
+    
+    try {
+      await fs.access(fullArchivePath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Archive file not found on disk' });
+    }
+
+    // Set headers for download
+    res.setHeader('Content-Type', 'application/zip');
+    res.setHeader('Content-Disposition', `attachment; filename="${archive.slug}.zip"`);
+
+    // Stream the file
+    const fileStream = require('fs').createReadStream(fullArchivePath);
+    fileStream.pipe(res);
+
+    // Log download
+    await db('activity_logs').insert({
+      activity_type: 'archive_downloaded',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      event_id: archive.id,
+      metadata: JSON.stringify({ event_name: archive.event_name })
+    });
+  } catch (error) {
+    console.error('Archive download error:', error);
+    res.status(500).json({ error: 'Failed to download archive' });
+  }
+});
+
+// Delete archive permanently
+router.delete('/:id', adminAuth, async (req, res) => {
+  try {
+    const archive = await db('events')
+      .where('id', req.params.id)
+      .where('is_archived', formatBoolean(true))
+      .first();
+
+    if (!archive) {
+      return res.status(404).json({ error: 'Archive not found' });
+    }
+
+    // Delete archive file if exists
+    if (archive.archive_path) {
+      try {
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const fullArchivePath = path.join(storagePath, archive.archive_path);
+        await fs.unlink(fullArchivePath);
+      } catch (error) {
+        console.error('Failed to delete archive file:', error);
+      }
+    }
+
+    // Delete thumbnails for this event
+    const photos = await db('photos').where('event_id', req.params.id).select('thumbnail_path');
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    
+    for (const photo of photos) {
+      if (photo.thumbnail_path) {
+        try {
+          const thumbPath = path.join(storagePath, photo.thumbnail_path.replace(/^\//, ''));
+          await fs.unlink(thumbPath);
+        } catch (error) {
+          // Ignore errors - thumbnail might already be deleted
+        }
+      }
+    }
+
+    // Delete from database (cascade will delete photos and logs)
+    await db('events').where('id', req.params.id).delete();
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'archive_deleted',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ 
+        event_name: archive.event_name,
+        archived_date: archive.archived_at 
+      })
+    });
+
+    res.json({ message: 'Archive deleted permanently' });
+  } catch (error) {
+    console.error('Archive delete error:', error);
+    res.status(500).json({ error: 'Failed to delete archive' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminAuth.js

@@ -0,0 +1,99 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const { endSession } = require('../middleware/sessionTimeout');
+const { validatePasswordStrength } = require('../utils/passwordGenerator');
+const router = express.Router();
+
+// Change password
+router.post('/change-password', [
+  adminAuth,
+  body('currentPassword').notEmpty().withMessage('Current password is required'),
+  body('newPassword').isLength({ min: 12 }).withMessage('New password must be at least 12 characters')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { currentPassword, newPassword } = req.body;
+    const userId = req.admin.id; // Changed from req.user.id to req.admin.id
+
+    // Validate new password strength
+    const passwordValidation = validatePasswordStrength(newPassword);
+    if (!passwordValidation.isValid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.messages
+      });
+    }
+
+    // Get user from database
+    const user = await db('admin_users')
+      .where('id', userId)
+      .first();
+
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
+    // Verify current password
+    const validPassword = await bcrypt.compare(currentPassword, user.password_hash);
+    if (!validPassword) {
+      return res.status(400).json({ error: 'Current password is incorrect' });
+    }
+
+    // Hash new password with more rounds
+    const newPasswordHash = await bcrypt.hash(newPassword, 12);
+
+    // Update password and clear must_change_password flag
+    await db('admin_users')
+      .where('id', userId)
+      .update({
+        password_hash: newPasswordHash,
+        must_change_password: false,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity('password_changed', 
+      { admin_id: userId }, 
+      null,
+      { type: 'admin', id: userId, name: user.username }
+    );
+
+    res.json({ message: 'Password changed successfully' });
+  } catch (error) {
+    console.error('Password change error:', error);
+    res.status(500).json({ error: 'Failed to change password' });
+  }
+});
+
+// Logout
+router.post('/logout', adminAuth, async (req, res) => {
+  try {
+    // Get token from header
+    const token = req.headers.authorization?.split(' ')[1];
+    if (token) {
+      // End the session
+      endSession(token);
+    }
+    
+    // Log activity
+    await logActivity('admin_logout', 
+      { admin_id: req.admin.id }, 
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: 'Logged out successfully' });
+  } catch (error) {
+    console.error('Logout error:', error);
+    res.status(500).json({ error: 'Failed to logout' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminCMS.js

@@ -0,0 +1,83 @@
+const express = require('express');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+
+// Get all CMS pages
+router.get('/pages', adminAuth, async (req, res) => {
+  try {
+    const pages = await db('cms_pages').select('*').orderBy('slug', 'asc');
+    res.json(pages);
+  } catch (error) {
+    console.error('Error fetching CMS pages:', error);
+    res.status(500).json({ error: 'Failed to fetch pages' });
+  }
+});
+
+// Get a single CMS page
+router.get('/pages/:slug', adminAuth, async (req, res) => {
+  try {
+    const { slug } = req.params;
+    const page = await db('cms_pages').where('slug', slug).first();
+    
+    if (!page) {
+      return res.status(404).json({ error: 'Page not found' });
+    }
+    
+    res.json(page);
+  } catch (error) {
+    console.error('Error fetching CMS page:', error);
+    res.status(500).json({ error: 'Failed to fetch page' });
+  }
+});
+
+// Update a CMS page
+router.put('/pages/:slug', adminAuth, [
+  body('title_en').optional().isString(),
+  body('title_de').optional().isString(),
+  body('content_en').optional().isString(),
+  body('content_de').optional().isString()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { slug } = req.params;
+    const { title_en, title_de, content_en, content_de } = req.body;
+    
+    const page = await db('cms_pages').where('slug', slug).first();
+    if (!page) {
+      return res.status(404).json({ error: 'Page not found' });
+    }
+    
+    // Update the page
+    await db('cms_pages')
+      .where('slug', slug)
+      .update({
+        title_en,
+        title_de,
+        content_en,
+        content_de,
+        updated_at: new Date()
+      });
+    
+    const updated = await db('cms_pages').where('slug', slug).first();
+    
+    // Log activity
+    await logActivity('cms_page_updated',
+      { page: slug },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json(updated);
+  } catch (error) {
+    console.error('Error updating CMS page:', error);
+    res.status(500).json({ error: 'Failed to update page' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminCategories.js

@@ -0,0 +1,185 @@
+const express = require('express');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+
+// Get all global categories
+router.get('/global', adminAuth, async (req, res) => {
+  try {
+    const categories = await db('photo_categories')
+      .where('is_global', formatBoolean(true))
+      .orderBy('name', 'asc');
+    
+    res.json(categories);
+  } catch (error) {
+    console.error('Error fetching categories:', error);
+    res.status(500).json({ error: 'Failed to fetch categories' });
+  }
+});
+
+// Get categories for a specific event (global + event-specific)
+router.get('/event/:eventId', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    
+    const categories = await db('photo_categories')
+      .where(function() {
+        this.where('is_global', formatBoolean(true))
+          .orWhere('event_id', eventId);
+      })
+      .orderBy('is_global', 'desc')
+      .orderBy('name', 'asc');
+    
+    res.json(categories);
+  } catch (error) {
+    console.error('Error fetching event categories:', error);
+    res.status(500).json({ error: 'Failed to fetch categories' });
+  }
+});
+
+// Create a new category
+router.post('/', adminAuth, [
+  body('name').notEmpty().withMessage('Category name is required'),
+  body('slug').optional(),
+  body('is_global').optional().isBoolean(),
+  body('event_id').optional().isInt()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { name, slug, is_global = true, event_id = null } = req.body;
+    
+    // Generate slug if not provided
+    const categorySlug = slug || name.toLowerCase()
+      .replace(/[^\w\s-]/g, '')
+      .replace(/\s+/g, '-')
+      .replace(/-+/g, '-')
+      .trim();
+    
+    // Check if slug already exists for this scope
+    const existing = await db('photo_categories')
+      .where('slug', categorySlug)
+      .where(function() {
+        if (is_global) {
+          this.where('is_global', formatBoolean(true));
+        } else {
+          this.where('event_id', event_id);
+        }
+      })
+      .first();
+    
+    if (existing) {
+      return res.status(400).json({ error: 'Category with this slug already exists' });
+    }
+    
+    // Create category
+    const insertResult = await db('photo_categories').insert({
+      name,
+      slug: categorySlug,
+      is_global,
+      event_id: is_global ? null : event_id
+    }).returning('id');
+    
+    const categoryId = insertResult[0]?.id || insertResult[0];
+    
+    const category = await db('photo_categories').where('id', categoryId).first();
+    
+    // Log activity
+    await logActivity('category_created', 
+      { categoryName: name, isGlobal: is_global },
+      event_id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json(category);
+  } catch (error) {
+    console.error('Error creating category:', error);
+    res.status(500).json({ error: 'Failed to create category' });
+  }
+});
+
+// Update a category
+router.put('/:id', adminAuth, [
+  body('name').notEmpty().withMessage('Category name is required')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { id } = req.params;
+    const { name } = req.body;
+    
+    const category = await db('photo_categories').where('id', id).first();
+    if (!category) {
+      return res.status(404).json({ error: 'Category not found' });
+    }
+    
+    await db('photo_categories')
+      .where('id', id)
+      .update({
+        name,
+        slug: name.toLowerCase()
+          .replace(/[^\w\s-]/g, '')
+          .replace(/\s+/g, '-')
+          .replace(/-+/g, '-')
+          .trim()
+      });
+    
+    const updated = await db('photo_categories').where('id', id).first();
+    
+    // Log activity
+    await logActivity('category_updated',
+      { categoryName: name },
+      category.event_id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json(updated);
+  } catch (error) {
+    console.error('Error updating category:', error);
+    res.status(500).json({ error: 'Failed to update category' });
+  }
+});
+
+// Delete a category
+router.delete('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    const category = await db('photo_categories').where('id', id).first();
+    if (!category) {
+      return res.status(404).json({ error: 'Category not found' });
+    }
+    
+    // Check if category has photos
+    const photoCount = await db('photos').where('category_id', id).count('id as count').first();
+    if (photoCount.count > 0) {
+      return res.status(400).json({ 
+        error: 'Cannot delete category with photos. Please reassign photos first.' 
+      });
+    }
+    
+    await db('photo_categories').where('id', id).delete();
+    
+    // Log activity
+    await logActivity('category_deleted',
+      { categoryName: category.name },
+      category.event_id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: 'Category deleted successfully' });
+  } catch (error) {
+    console.error('Error deleting category:', error);
+    res.status(500).json({ error: 'Failed to delete category' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminDashboard.js

@@ -0,0 +1,323 @@
+const express = require('express');
+const { db } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const { sanitizeDays, addDateRangeCondition } = require('../utils/sqlSecurity');
+const { formatBoolean } = require('../utils/dbCompat');
+const router = express.Router();
+
+// Get dashboard statistics
+router.get('/stats', adminAuth, async (req, res) => {
+  try {
+    // Get active events count
+    const activeEvents = await db('events')
+      .where('is_active', formatBoolean(true))
+      .where('is_archived', formatBoolean(false))
+      .count('id as count')
+      .first();
+
+    // Get events expiring within 7 days
+    const sevenDaysFromNow = new Date();
+    sevenDaysFromNow.setDate(sevenDaysFromNow.getDate() + 7);
+    const now = new Date();
+    
+    const expiringEvents = await db('events')
+      .where('is_active', formatBoolean(true))
+      .where('is_archived', formatBoolean(false))
+      .where('expires_at', '<=', sevenDaysFromNow.toISOString())
+      .where('expires_at', '>', now.toISOString())
+      .count('id as count')
+      .first();
+
+    // Get total photos count
+    const totalPhotos = await db('photos')
+      .count('id as count')
+      .first();
+
+    // Get storage usage (sum of all photo sizes)
+    const storageUsed = await db('photos')
+      .sum('size_bytes as total')
+      .first();
+
+    // Get total views (last 30 days)
+    const thirtyDaysAgo = new Date();
+    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+    
+    const totalViews = await db('access_logs')
+      .where('action', 'view')
+      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    // Get total downloads (last 30 days)
+    const totalDownloads = await db('access_logs')
+      .where('action', 'download')
+      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    // Get archived events count
+    const archivedEvents = await db('events')
+      .where('is_archived', formatBoolean(true))
+      .count('id as count')
+      .first();
+
+    // Calculate trends (compare with previous 30 days)
+    const sixtyDaysAgo = new Date();
+    sixtyDaysAgo.setDate(sixtyDaysAgo.getDate() - 60);
+    
+    const previousViews = await db('access_logs')
+      .where('action', 'view')
+      .where('timestamp', '>=', sixtyDaysAgo.toISOString())
+      .where('timestamp', '<', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    const previousDownloads = await db('access_logs')
+      .where('action', 'download')
+      .where('timestamp', '>=', sixtyDaysAgo.toISOString())
+      .where('timestamp', '<', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    // Calculate trend percentages
+    const viewsTrend = previousViews.count > 0 
+      ? ((totalViews.count - previousViews.count) / previousViews.count) * 100 
+      : 0;
+    
+    const downloadsTrend = previousDownloads.count > 0
+      ? ((totalDownloads.count - previousDownloads.count) / previousDownloads.count) * 100
+      : 0;
+
+    res.json({
+      activeEvents: activeEvents.count || 0,
+      expiringEvents: expiringEvents.count || 0,
+      totalPhotos: totalPhotos.count || 0,
+      storageUsed: storageUsed.total || 0,
+      totalViews: totalViews.count || 0,
+      totalDownloads: totalDownloads.count || 0,
+      viewsTrend: Math.round(viewsTrend * 10) / 10,
+      downloadsTrend: Math.round(downloadsTrend * 10) / 10,
+      archivedEvents: archivedEvents.count || 0
+    });
+  } catch (error) {
+    console.error('Dashboard stats error:', error);
+    res.status(500).json({ error: 'Failed to fetch dashboard statistics' });
+  }
+});
+
+// Get recent activity
+router.get('/activity', adminAuth, async (req, res) => {
+  try {
+    const limit = parseInt(req.query.limit) || 10;
+    
+    const activities = await db('activity_logs')
+      .select('activity_logs.*', 'events.event_name')
+      .leftJoin('events', 'activity_logs.event_id', 'events.id')
+      .orderBy('activity_logs.created_at', 'desc')
+      .limit(limit);
+
+    // Format activities
+    const formattedActivities = activities.map(activity => ({
+      id: activity.id,
+      type: activity.activity_type,
+      actorType: activity.actor_type,
+      actorName: activity.actor_name,
+      eventName: activity.event_name,
+      metadata: (() => {
+        try {
+          if (!activity.metadata) return {};
+          if (typeof activity.metadata === 'object') return activity.metadata;
+          return JSON.parse(activity.metadata);
+        } catch (e) {
+          console.warn('Failed to parse metadata for activity:', activity.id, e.message);
+          return {};
+        }
+      })(),
+      createdAt: activity.created_at
+    }));
+
+    res.json(formattedActivities);
+  } catch (error) {
+    console.error('Activity log error:', error);
+    res.status(500).json({ error: 'Failed to fetch activity log' });
+  }
+});
+
+// Get system health status
+router.get('/health', adminAuth, async (req, res) => {
+  try {
+    const os = require('os');
+    
+    // Check database connectivity
+    let dbStatus = 'healthy';
+    try {
+      await db.raw('SELECT 1');
+    } catch (error) {
+      dbStatus = 'error';
+    }
+
+    // Check email queue
+    const [pendingEmails] = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count');
+    
+    const twentyFourHoursAgo = new Date();
+    twentyFourHoursAgo.setHours(twentyFourHoursAgo.getHours() - 24);
+    
+    const [failedEmails] = await db('email_queue')
+      .where('status', 'failed')
+      .where('created_at', '>=', twentyFourHoursAgo.toISOString())
+      .count('* as count');
+
+    const emailStatus = failedEmails.count > 10 ? 'warning' : 'healthy';
+
+    // Check disk space (simplified)
+    const storageStatus = 'healthy'; // In production, check actual disk usage
+
+    // Memory usage
+    const memoryUsage = {
+      total: os.totalmem(),
+      free: os.freemem(),
+      used: os.totalmem() - os.freemem(),
+      percentage: Math.round(((os.totalmem() - os.freemem()) / os.totalmem()) * 100)
+    };
+
+    const memoryStatus = memoryUsage.percentage > 90 ? 'warning' : 'healthy';
+
+    // Overall health
+    const statuses = [dbStatus, emailStatus, storageStatus, memoryStatus];
+    let overallHealth = 'healthy';
+    if (statuses.includes('error')) overallHealth = 'error';
+    else if (statuses.includes('warning')) overallHealth = 'warning';
+
+    res.json({
+      overall: overallHealth,
+      services: {
+        database: dbStatus,
+        email: emailStatus,
+        storage: storageStatus,
+        memory: memoryStatus
+      },
+      details: {
+        emailQueue: {
+          pending: pendingEmails.count,
+          failed: failedEmails.count
+        },
+        memory: memoryUsage
+      }
+    });
+  } catch (error) {
+    console.error('Health check error:', error);
+    res.status(500).json({ 
+      overall: 'error',
+      error: 'Failed to check system health' 
+    });
+  }
+});
+
+// Get analytics data for charts
+router.get('/analytics', adminAuth, async (req, res) => {
+  try {
+    const days = sanitizeDays(req.query.days || 7);
+    
+    // Generate date range
+    const dates = [];
+    for (let i = days - 1; i >= 0; i--) {
+      dates.push({
+        date: new Date(Date.now() - i * 24 * 60 * 60 * 1000).toISOString().split('T')[0],
+        views: 0,
+        downloads: 0,
+        uniqueVisitors: 0
+      });
+    }
+
+    // Calculate the start date for queries
+    const startDate = new Date();
+    startDate.setDate(startDate.getDate() - days);
+    const startDateStr = startDate.toISOString();
+
+    // Get views per day
+    const viewsData = await db('access_logs')
+      .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
+      .where('action', 'view')
+      .where('timestamp', '>=', startDateStr)
+      .groupByRaw('DATE(timestamp)');
+
+    // Get downloads per day
+    const downloadsData = await db('access_logs')
+      .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
+      .where('action', 'download')
+      .where('timestamp', '>=', startDateStr)
+      .groupByRaw('DATE(timestamp)');
+
+    // Get unique visitors per day
+    const visitorsData = await db('access_logs')
+      .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(DISTINCT ip_address) as count'))
+      .where('timestamp', '>=', startDateStr)
+      .groupByRaw('DATE(timestamp)');
+
+    // Merge data into dates array
+    viewsData.forEach(row => {
+      const dateObj = dates.find(d => d.date === row.date);
+      if (dateObj) dateObj.views = row.count;
+    });
+
+    downloadsData.forEach(row => {
+      const dateObj = dates.find(d => d.date === row.date);
+      if (dateObj) dateObj.downloads = row.count;
+    });
+
+    visitorsData.forEach(row => {
+      const dateObj = dates.find(d => d.date === row.date);
+      if (dateObj) dateObj.uniqueVisitors = row.count;
+    });
+
+    // Get top galleries by views
+    const topGalleries = await db('access_logs')
+      .select('events.event_name', 'events.slug')
+      .select(db.raw('COUNT(*) as views'))
+      .join('events', 'access_logs.event_id', 'events.id')
+      .where('access_logs.action', 'view')
+      .where('access_logs.timestamp', '>=', startDateStr)
+      .groupBy('events.id')
+      .orderBy('views', 'desc')
+      .limit(5);
+
+    // Get device breakdown (simplified - based on user agent)
+    const deviceData = await db('access_logs')
+      .select(
+        db.raw(`
+          CASE 
+            WHEN user_agent LIKE '%Mobile%' THEN 'mobile'
+            WHEN user_agent LIKE '%Tablet%' OR user_agent LIKE '%iPad%' THEN 'tablet'
+            ELSE 'desktop'
+          END as device_type
+        `),
+        db.raw('COUNT(*) as count')
+      )
+      .where('timestamp', '>=', startDateStr)
+      .groupBy('device_type');
+
+    const totalDevices = deviceData.reduce((sum, d) => sum + d.count, 0);
+    const devices = {
+      desktop: 0,
+      mobile: 0,
+      tablet: 0
+    };
+
+    deviceData.forEach(d => {
+      devices[d.device_type] = Math.round((d.count / totalDevices) * 100);
+    });
+
+    res.json({
+      chartData: dates,
+      topGalleries,
+      devices
+    });
+  } catch (error) {
+    console.error('Analytics error:', error);
+    res.status(500).json({ error: 'Failed to fetch analytics data' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminEmail.js

@@ -0,0 +1,432 @@
+const express = require('express');
+const nodemailer = require('nodemailer');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+
+// Get email configuration
+router.get('/config', adminAuth, async (req, res) => {
+  try {
+    const config = await db('email_configs').first();
+    
+    if (!config) {
+      return res.json({
+        smtp_host: '',
+        smtp_port: 587,
+        smtp_secure: false,
+        smtp_user: '',
+        smtp_pass: '', // Don't send actual password
+        from_email: '',
+        from_name: ''
+      });
+    }
+
+    // Don't send the actual password
+    res.json({
+      ...config,
+      smtp_pass: config.smtp_pass ? '********' : ''
+    });
+  } catch (error) {
+    console.error('Email config fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch email configuration' });
+  }
+});
+
+// Update email configuration
+router.post('/config', [
+  adminAuth,
+  body('smtp_host').notEmpty().withMessage('SMTP host is required'),
+  body('smtp_port').isInt({ min: 1, max: 65535 }).withMessage('Invalid port number'),
+  body('from_email').isEmail().withMessage('Invalid from email address')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const {
+      smtp_host,
+      smtp_port,
+      smtp_secure,
+      smtp_user,
+      smtp_pass,
+      from_email,
+      from_name
+    } = req.body;
+
+    // Check if config exists
+    const existingConfig = await db('email_configs').first();
+    
+    const configData = {
+      smtp_host,
+      smtp_port: parseInt(smtp_port),
+      smtp_secure: smtp_secure || false,
+      smtp_user: smtp_user || '',
+      from_email,
+      from_name: from_name || 'Photo Sharing',
+      updated_at: new Date()
+    };
+
+    // Only update password if provided and not masked
+    if (smtp_pass && smtp_pass !== '********') {
+      configData.smtp_pass = smtp_pass;
+    }
+
+    if (existingConfig) {
+      await db('email_configs')
+        .where('id', existingConfig.id)
+        .update(configData);
+    } else {
+      await db('email_configs').insert(configData);
+    }
+
+    // Log activity
+    await logActivity('email_config_updated', 
+      { smtp_host, from_email }, 
+      null, 
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Email configuration updated successfully' });
+  } catch (error) {
+    console.error('Email config update error:', error);
+    res.status(500).json({ error: 'Failed to update email configuration' });
+  }
+});
+
+// Test email configuration
+router.post('/test', adminAuth, async (req, res) => {
+  try {
+    const { test_email } = req.body;
+    
+    if (!test_email) {
+      return res.status(400).json({ error: 'Test email address is required' });
+    }
+
+    // Get email config
+    const config = await db('email_configs').first();
+    
+    if (!config) {
+      return res.status(400).json({ error: 'Email configuration not found. Please configure SMTP settings first.' });
+    }
+
+    // Validate SMTP configuration
+    if (!config.smtp_host || !config.smtp_port) {
+      return res.status(400).json({ 
+        error: 'Incomplete email configuration',
+        details: 'SMTP host and port are required'
+      });
+    }
+    
+    // Check if password might be masked (this shouldn't happen when fetching from DB)
+    if (config.smtp_pass === '********') {
+      return res.status(400).json({
+        error: 'Invalid email configuration',
+        details: 'SMTP password appears to be masked. Please reconfigure your email settings.'
+      });
+    }
+
+    // Create transporter with detailed logging
+    const transportConfig = {
+      host: config.smtp_host,
+      port: parseInt(config.smtp_port),
+      secure: config.smtp_secure === true || config.smtp_secure === 1,
+      auth: config.smtp_user && config.smtp_pass ? {
+        user: config.smtp_user,
+        pass: config.smtp_pass
+      } : undefined,
+      logger: process.env.NODE_ENV === 'development',
+      debug: process.env.NODE_ENV === 'development'
+    };
+
+    console.log('Creating email transporter with config:', {
+      host: transportConfig.host,
+      port: transportConfig.port,
+      secure: transportConfig.secure,
+      auth: transportConfig.auth ? 'configured' : 'none'
+    });
+
+    const transporter = nodemailer.createTransport(transportConfig);
+
+    // Send test email
+    await transporter.sendMail({
+      from: `${config.from_name} <${config.from_email}>`,
+      to: test_email,
+      subject: 'Test Email - Photo Sharing Platform',
+      html: `
+        <h2>Test Email Successful!</h2>
+        <p>This is a test email from your Photo Sharing platform.</p>
+        <p>If you're seeing this, your email configuration is working correctly.</p>
+        <hr>
+        <p style="color: #666; font-size: 12px;">
+          Sent from: ${config.from_email}<br>
+          SMTP Host: ${config.smtp_host}<br>
+          Time: ${new Date().toISOString()}
+        </p>
+      `,
+      text: 'Test Email Successful! Your email configuration is working correctly.'
+    });
+
+    res.json({ message: 'Test email sent successfully' });
+  } catch (error) {
+    console.error('Test email error:', error);
+    console.error('Error stack:', error.stack);
+    
+    // Provide more specific error messages
+    let errorMessage = 'Failed to send test email';
+    let details = error.message;
+    
+    if (error.code === 'ECONNREFUSED') {
+      errorMessage = 'Failed to connect to SMTP server';
+      details = 'Please check your SMTP host and port settings';
+    } else if (error.code === 'EAUTH') {
+      errorMessage = 'SMTP authentication failed';
+      details = 'Please check your SMTP username and password';
+    } else if (error.code === 'ESOCKET') {
+      errorMessage = 'Network error';
+      details = 'Could not establish connection to SMTP server';
+    }
+    
+    res.status(500).json({ 
+      error: errorMessage,
+      details: details,
+      code: error.code
+    });
+  }
+});
+
+// Get email templates
+router.get('/templates', adminAuth, async (req, res) => {
+  try {
+    const templates = await db('email_templates')
+      .select('*')
+      .orderBy('template_key');
+
+    // Parse variables JSON and format for multi-language support
+    const formattedTemplates = templates.map(template => {
+      const result = {
+        id: template.id,
+        template_key: template.template_key,
+        variables: (() => {
+          try {
+            if (!template.variables) return [];
+            if (typeof template.variables === 'object') return template.variables;
+            return JSON.parse(template.variables);
+          } catch (e) {
+            console.warn('Failed to parse variables for template:', template.template_key, e.message);
+            return [];
+          }
+        })(),
+        updated_at: template.updated_at
+      };
+      
+      // Handle both old and new schema formats
+      if (template.subject_en !== undefined) {
+        // New schema with language columns
+        result.subject_en = template.subject_en;
+        result.body_html_en = template.body_html_en;
+        result.body_text_en = template.body_text_en;
+        result.subject_de = template.subject_de;
+        result.body_html_de = template.body_html_de;
+        result.body_text_de = template.body_text_de;
+      } else {
+        // Old schema - use basic columns for both languages
+        result.subject_en = template.subject;
+        result.body_html_en = template.body_html;
+        result.body_text_en = template.body_text;
+        result.subject_de = template.subject;
+        result.body_html_de = template.body_html;
+        result.body_text_de = template.body_text;
+      }
+      
+      return result;
+    });
+
+    res.json(formattedTemplates);
+  } catch (error) {
+    console.error('Email templates fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch email templates' });
+  }
+});
+
+// Get single template
+router.get('/templates/:key', adminAuth, async (req, res) => {
+  try {
+    const template = await db('email_templates')
+      .where('template_key', req.params.key)
+      .first();
+
+    if (!template) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    // Handle both old and new schema formats
+    const response = {
+      id: template.id,
+      template_key: template.template_key,
+      variables: (() => {
+        try {
+          if (!template.variables) return [];
+          if (typeof template.variables === 'object') return template.variables;
+          return JSON.parse(template.variables);
+        } catch (e) {
+          console.warn('Failed to parse variables for template:', template.template_key, e.message);
+          return [];
+        }
+      })(),
+      updated_at: template.updated_at
+    };
+    
+    // Check which columns exist and use them appropriately
+    if (template.subject_en !== undefined) {
+      // New schema with language columns
+      response.subject_en = template.subject_en;
+      response.body_html_en = template.body_html_en;
+      response.body_text_en = template.body_text_en;
+      response.subject_de = template.subject_de;
+      response.body_html_de = template.body_html_de;
+      response.body_text_de = template.body_text_de;
+    } else {
+      // Old schema - use basic columns for both languages
+      response.subject_en = template.subject;
+      response.body_html_en = template.body_html;
+      response.body_text_en = template.body_text;
+      response.subject_de = template.subject;
+      response.body_html_de = template.body_html;
+      response.body_text_de = template.body_text;
+    }
+    
+    res.json(response);
+  } catch (error) {
+    console.error('Email template fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch email template' });
+  }
+});
+
+// Update email template
+router.put('/templates/:key', [
+  adminAuth,
+  body('subject_en').optional().notEmpty().withMessage('English subject cannot be empty'),
+  body('subject_de').optional().notEmpty().withMessage('German subject cannot be empty'),
+  body('body_html_en').optional().notEmpty().withMessage('English HTML body cannot be empty'),
+  body('body_html_de').optional().notEmpty().withMessage('German HTML body cannot be empty')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const {
+      subject_en, subject_de,
+      body_html_en, body_html_de,
+      body_text_en, body_text_de
+    } = req.body;
+
+    const updateData = {
+      updated_at: new Date()
+    };
+
+    // Check which columns exist in the database
+    const template = await db('email_templates')
+      .where('template_key', req.params.key)
+      .first();
+      
+    if (!template) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    // Determine schema type and update accordingly
+    if (template.subject_en !== undefined) {
+      // New schema with language columns
+      if (subject_en !== undefined) updateData.subject_en = subject_en;
+      if (subject_de !== undefined) updateData.subject_de = subject_de;
+      if (body_html_en !== undefined) updateData.body_html_en = body_html_en;
+      if (body_html_de !== undefined) updateData.body_html_de = body_html_de;
+      if (body_text_en !== undefined) updateData.body_text_en = body_text_en || '';
+      if (body_text_de !== undefined) updateData.body_text_de = body_text_de || '';
+      
+      // Also update basic columns if they exist
+      if (template.subject !== undefined) {
+        updateData.subject = subject_en || updateData.subject_en;
+        updateData.body_html = body_html_en || updateData.body_html_en;
+        updateData.body_text = body_text_en || updateData.body_text_en || '';
+      }
+    } else {
+      // Old schema - only update basic columns
+      if (subject_en !== undefined) {
+        updateData.subject = subject_en;
+        updateData.body_html = body_html_en;
+        updateData.body_text = body_text_en || '';
+      }
+    }
+
+    const updated = await db('email_templates')
+      .where('template_key', req.params.key)
+      .update(updateData);
+
+    if (!updated) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    // Log activity
+    await logActivity('email_template_updated',
+      { template_key: req.params.key },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Email template updated successfully' });
+  } catch (error) {
+    console.error('Email template update error:', error);
+    res.status(500).json({ error: 'Failed to update email template' });
+  }
+});
+
+// Preview email template
+router.post('/templates/:key/preview', adminAuth, async (req, res) => {
+  try {
+    const template = await db('email_templates')
+      .where('template_key', req.params.key)
+      .first();
+
+    if (!template) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    const { preview_data, language = 'en' } = req.body;
+    
+    // Get the appropriate language version
+    const subjectField = language === 'de' && template.subject_de ? 'subject_de' : 'subject_en';
+    const htmlField = language === 'de' && template.body_html_de ? 'body_html_de' : 'body_html_en';
+    const textField = language === 'de' && template.body_text_de ? 'body_text_de' : 'body_text_en';
+    
+    // Handle backward compatibility
+    let htmlContent = template[htmlField] || template.body_html || '';
+    let textContent = template[textField] || template.body_text || '';
+    let subject = template[subjectField] || template.subject || '';
+
+    if (preview_data) {
+      Object.keys(preview_data).forEach(key => {
+        const regex = new RegExp(`{{${key}}}`, 'g');
+        htmlContent = htmlContent.replace(regex, preview_data[key]);
+        textContent = textContent.replace(regex, preview_data[key]);
+        subject = subject.replace(regex, preview_data[key]);
+      });
+    }
+
+    res.json({
+      subject,
+      body_html: htmlContent,
+      body_text: textContent,
+      language
+    });
+  } catch (error) {
+    console.error('Email template preview error:', error);
+    res.status(500).json({ error: 'Failed to preview email template' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminEvents-enhanced.js

@@ -0,0 +1,124 @@
+// This is a partial file showing the enhanced event creation with password validation
+// Only the relevant parts are shown - merge with existing adminEvents.js
+
+const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
+
+// Enhanced event creation with password validation
+router.post('/', adminAuth, [
+  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
+  body('event_name').notEmpty().trim(),
+  body('event_date').isDate(),
+  body('host_email').isEmail().normalizeEmail(),
+  body('admin_email').isEmail().normalizeEmail(),
+  body('password').notEmpty(), // Remove the weak isLength validation
+  body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
+  body('welcome_message').optional().trim(),
+  body('color_theme').optional().trim(),
+  body('allow_user_uploads').optional().isBoolean().toBoolean(),
+  body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
+  body('host_name').notEmpty().trim()
+], async (req, res) => {
+  try {
+    console.log('Create event request body:', req.body);
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      console.error('Validation errors:', errors.array());
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const {
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password,
+      welcome_message = '',
+      color_theme = null,
+      expiration_days = 30,
+      allow_user_uploads = false,
+      upload_category_id = null
+    } = req.body;
+    
+    // Validate password strength for gallery
+    const passwordValidation = validatePasswordInContext(password, 'gallery', {
+      eventName: event_name
+    });
+    
+    if (!passwordValidation.valid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.errors,
+        score: passwordValidation.score,
+        feedback: passwordValidation.feedback
+      });
+    }
+    
+    // Generate unique slug
+    const baseSlug = `${event_type}-${event_name.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${event_date}`;
+    let slug = baseSlug;
+    let counter = 1;
+    
+    while (await db('events').where({ slug }).first()) {
+      slug = `${baseSlug}-${counter}`;
+      counter++;
+    }
+    
+    // Generate share link
+    const shareToken = crypto.randomBytes(16).toString('hex');
+    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    
+    // Hash password with configurable rounds
+    const password_hash = await bcrypt.hash(password, getBcryptRounds());
+    
+    // Calculate expiration date (days after event date)
+    const expires_at = new Date(event_date);
+    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
+    
+    // Create folder structure
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const eventPath = path.join(storagePath, 'events/active', slug);
+    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
+    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
+    
+    // Insert into database
+    const insertResult = await db('events').insert({
+      slug,
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password_hash,
+      welcome_message,
+      color_theme,
+      share_link: shareLink,
+      expires_at: expires_at.toISOString(),
+      created_at: new Date().toISOString(),
+      allow_user_uploads,
+      upload_category_id
+    }).returning('id');
+    
+    // Handle both PostgreSQL (returns array of objects) and SQLite (returns array of IDs)
+    const eventId = insertResult[0]?.id || insertResult[0];
+    
+    // Log activity
+    await logActivity('event_created', 
+      { 
+        event_type, 
+        expires_at,
+        password_strength: passwordValidation.score 
+      }, 
+      eventId, 
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    // Rest of the implementation remains the same...
+    // Queue creation email, etc.
+  } catch (error) {
+    console.error('Error creating event:', error);
+    res.status(500).json({ error: 'Failed to create event' });
+  }
+});

backend/src/routes/adminEvents.js

@@ -0,0 +1,758 @@
+const express = require('express');
+const { body, query, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+const bcrypt = require('bcrypt');
+const crypto = require('crypto');
+const fs = require('fs').promises;
+const path = require('path');
+const { archiveEvent } = require('../services/archiveService');
+const { queueEmail } = require('../services/emailProcessor');
+const { escapeLikePattern } = require('../utils/sqlSecurity');
+// formatDate import removed - dates are formatted by email processor
+const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
+const { formatBoolean } = require('../utils/dbCompat');
+
+// Create new event
+router.post('/', adminAuth, [
+  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
+  body('event_name').notEmpty().trim(),
+  body('event_date').isDate(),
+  body('host_email').isEmail().normalizeEmail(),
+  body('admin_email').isEmail().normalizeEmail(),
+  body('password').isLength({ min: 6 }),
+  body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
+  body('welcome_message').optional().trim(),
+  body('color_theme').optional().trim(),
+  body('allow_user_uploads').optional().isBoolean().toBoolean(),
+  body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
+  body('host_name').notEmpty().trim()
+], async (req, res) => {
+  try {
+    console.log('Create event request body:', req.body);
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      console.error('Validation errors:', errors.array());
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const {
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password,
+      welcome_message = '',
+      color_theme = null,
+      expiration_days = 30,
+      allow_user_uploads = false,
+      upload_category_id = null
+    } = req.body;
+    
+    // Validate password strength
+    const passwordValidation = validatePasswordInContext(password, 'gallery', {
+      eventName: event_name
+    });
+    
+    if (!passwordValidation.valid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.errors,
+        score: passwordValidation.score,
+        feedback: passwordValidation.feedback
+      });
+    }
+    
+    // Generate unique slug
+    const processedEventName = event_name
+      .toLowerCase()
+      .replace(/[^a-z0-9]/g, '-') // Replace non-alphanumeric with dash
+      .replace(/-+/g, '-')         // Replace multiple dashes with single dash
+      .replace(/^-|-$/g, '');      // Remove leading/trailing dashes
+    const baseSlug = `${event_type}-${processedEventName}-${event_date}`;
+    let slug = baseSlug;
+    let counter = 1;
+    
+    while (await db('events').where({ slug }).first()) {
+      slug = `${baseSlug}-${counter}`;
+      counter++;
+    }
+    
+    // Generate share link
+    const shareToken = crypto.randomBytes(16).toString('hex');
+    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    
+    // Hash password with configurable rounds
+    const password_hash = await bcrypt.hash(password, getBcryptRounds());
+    
+    // Calculate expiration date (days after event date)
+    // Parse YYYY-MM-DD format as local date to avoid timezone issues
+    let expires_at;
+    if (event_date.match(/^\d{4}-\d{2}-\d{2}$/)) {
+      const [year, month, day] = event_date.split('-').map(num => parseInt(num, 10));
+      expires_at = new Date(year, month - 1, day);
+    } else {
+      expires_at = new Date(event_date);
+    }
+    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
+    
+    // Create folder structure
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const eventPath = path.join(storagePath, 'events/active', slug);
+    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
+    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
+    
+    // Insert into database
+    const insertResult = await db('events').insert({
+      slug,
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password_hash,
+      welcome_message,
+      color_theme,
+      share_link: shareLink,
+      expires_at: expires_at.toISOString(),
+      created_at: new Date().toISOString(),
+      allow_user_uploads,
+      upload_category_id
+    }).returning('id');
+    
+    // Handle both PostgreSQL (returns array of objects) and SQLite (returns array of IDs)
+    const eventId = insertResult[0]?.id || insertResult[0];
+    
+    // Log activity
+    await logActivity('event_created', 
+      { event_type, expires_at }, 
+      eventId, 
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    // Queue creation email
+    // Language detection is handled by email processor
+    
+    await db('email_queue').insert({
+      event_id: eventId,
+      recipient_email: host_email,
+      email_type: 'gallery_created',
+      email_data: JSON.stringify({
+        host_name: host_name,
+        event_name,
+        event_date: event_date,  // Pass raw date - will be formatted by email processor
+        gallery_link: shareLink,
+        gallery_password: password,
+        expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
+        welcome_message: welcome_message || ''
+      }),
+      status: 'pending',
+      created_at: new Date()
+      // scheduled_at will use default value
+    });
+    
+    res.json({
+      id: eventId,
+      slug,
+      event_name,
+      event_type,
+      share_link: shareLink,
+      expires_at: expires_at.toISOString(),
+      created_at: new Date().toISOString()
+    });
+  } catch (error) {
+    console.error('Error creating event:', error);
+    res.status(500).json({ error: 'Failed to create event' });
+  }
+});
+
+// Get all events with pagination and filters
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const page = parseInt(req.query.page) || 1;
+    const limit = parseInt(req.query.limit) || 20;
+    const offset = (page - 1) * limit;
+    const search = req.query.search || '';
+    const status = req.query.status || 'all';
+    const sortBy = req.query.sortBy || 'created_at';
+    const sortOrder = req.query.sortOrder || 'desc';
+
+    // Build query
+    let query = db('events');
+    
+    // Apply search filter
+    if (search) {
+      const escapedSearch = escapeLikePattern(search);
+      query = query.where((builder) => {
+        builder.where('event_name', 'like', `%${escapedSearch}%`)
+          .orWhere('admin_email', 'like', `%${escapedSearch}%`)
+          .orWhere('slug', 'like', `%${escapedSearch}%`);
+      });
+    }
+
+    // Apply status filter
+    if (status === 'active') {
+      query = query.where('is_active', formatBoolean(true)).where('is_archived', formatBoolean(false));
+    } else if (status === 'archived') {
+      query = query.where('is_archived', formatBoolean(true));
+    } else if (status === 'inactive') {
+      query = query.where('is_active', formatBoolean(false)).where('is_archived', formatBoolean(false));
+    } else if (status === 'expiring') {
+      const sevenDaysFromNow = new Date();
+      sevenDaysFromNow.setDate(sevenDaysFromNow.getDate() + 7);
+      query = query
+        .where('is_active', formatBoolean(true))
+        .where('is_archived', formatBoolean(false))
+        .where('expires_at', '<=', sevenDaysFromNow.toISOString())
+        .where('expires_at', '>', new Date().toISOString());
+    }
+
+    // Get total count for pagination
+    const countQuery = query.clone();
+    const [{ count }] = await countQuery.count('* as count');
+
+    // Apply sorting and pagination
+    const events = await query
+      .orderBy(sortBy, sortOrder)
+      .limit(limit)
+      .offset(offset);
+
+    // Get photo counts for each event
+    const eventIds = events.map(e => e.id);
+    const photoCounts = await db('photos')
+      .whereIn('event_id', eventIds)
+      .groupBy('event_id')
+      .select('event_id')
+      .count('* as count');
+
+    // Map photo counts to events
+    const photoCountMap = photoCounts.reduce((acc, { event_id, count }) => {
+      acc[event_id] = parseInt(count);
+      return acc;
+    }, {});
+
+    // Add photo counts to events and convert dates
+    const eventsWithCounts = events.map(event => ({
+      ...event,
+      photo_count: photoCountMap[event.id] || 0,
+      // Convert Unix timestamps to ISO strings
+      created_at: event.created_at ? new Date(event.created_at).toISOString() : null,
+      expires_at: event.expires_at ? new Date(event.expires_at).toISOString() : null,
+      archived_at: event.archived_at ? new Date(event.archived_at).toISOString() : null
+    }));
+
+    res.json({
+      events: eventsWithCounts,
+      pagination: {
+        page,
+        limit,
+        total: parseInt(count),
+        totalPages: Math.ceil(count / limit)
+      }
+    });
+  } catch (error) {
+    console.error('Error fetching events:', error);
+    res.status(500).json({ error: 'Failed to fetch events' });
+  }
+});
+
+// Get single event details
+router.get('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    const event = await db('events')
+      .where('id', id)
+      .first();
+
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    // Get photo count
+    const [{ count: photoCount }] = await db('photos')
+      .where('event_id', id)
+      .count('* as count');
+
+    // Get total size
+    const [{ totalSize }] = await db('photos')
+      .where('event_id', id)
+      .sum('size_bytes as totalSize');
+
+    // Get recent photos
+    const recentPhotos = await db('photos')
+      .where('event_id', id)
+      .orderBy('uploaded_at', 'desc')
+      .limit(10)
+      .select('filename', 'type', 'size_bytes', 'uploaded_at');
+
+    // Get view and download statistics
+    const [{ totalViews }] = await db('access_logs')
+      .where('event_id', id)
+      .where('action', 'view')
+      .count('* as totalViews');
+
+    const [{ totalDownloads }] = await db('access_logs')
+      .where('event_id', id)
+      .where('action', 'download')
+      .count('* as totalDownloads');
+
+    const [{ uniqueVisitors }] = await db('access_logs')
+      .where('event_id', id)
+      .countDistinct('ip_address as uniqueVisitors');
+
+    res.json({
+      ...event,
+      photo_count: parseInt(photoCount) || 0,
+      total_size: parseInt(totalSize) || 0,
+      total_views: parseInt(totalViews) || 0,
+      total_downloads: parseInt(totalDownloads) || 0,
+      unique_visitors: parseInt(uniqueVisitors) || 0,
+      recent_photos: recentPhotos
+    });
+  } catch (error) {
+    console.error('Error fetching event:', error);
+    res.status(500).json({ error: 'Failed to fetch event details' });
+  }
+});
+
+// Update event
+router.put('/:id', adminAuth, [
+  body('event_name').optional().trim().notEmpty(),
+  body('admin_email').optional().isEmail(),
+  body('is_active').optional().isBoolean(),
+  body('expires_at').optional().isISO8601(),
+  body('welcome_message').optional({ nullable: true, checkFalsy: true }).trim(),
+  body('color_theme').optional({ nullable: true }),
+  body('allow_user_uploads').optional().isBoolean(),
+  body('host_name').optional().trim().notEmpty(),
+  body('upload_category_id').optional().custom((value) => {
+    // Accept null, undefined, or integer values
+    if (value === null || value === undefined) return true;
+    return Number.isInteger(Number(value));
+  }).withMessage('upload_category_id must be an integer or null'),
+  body('hero_photo_id').optional().custom((value) => {
+    // Accept null, undefined, or numeric values
+    if (value === null || value === undefined) return true;
+    // Check if it's a number or can be converted to a valid integer
+    const num = Number(value);
+    return !isNaN(num) && Number.isInteger(num);
+  }).withMessage('hero_photo_id must be an integer or null')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      console.log('Update event validation errors:', JSON.stringify(errors.array(), null, 2));
+      console.log('Request body:', req.body);
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { id } = req.params;
+    const updates = req.body;
+
+    // Log the update request for debugging
+    console.log('Update event request:', {
+      id,
+      updates,
+      color_theme_length: updates.color_theme ? updates.color_theme.length : 0,
+      color_theme_type: typeof updates.color_theme,
+      hero_photo_id: updates.hero_photo_id,
+      hero_photo_id_type: typeof updates.hero_photo_id
+    });
+
+    // Check if event exists
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    // Update event
+    await db('events')
+      .where('id', id)
+      .update(updates);
+
+    // Log activity
+    await logActivity('event_updated',
+      { changes: Object.keys(updates), eventName: event.event_name },
+      id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Event updated successfully' });
+  } catch (error) {
+    console.error('Error updating event:', error);
+    res.status(500).json({ error: 'Failed to update event' });
+  }
+});
+
+// Delete event
+router.delete('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    // Check if event exists
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    // Start a transaction to ensure all deletions succeed or fail together
+    await db.transaction(async (trx) => {
+      // 1. Delete activity logs (audit trail)
+      await trx('activity_logs').where('event_id', id).del();
+
+      // 2. Delete access logs
+      await trx('access_logs').where('event_id', id).del();
+
+      // 3. Delete email queue entries
+      await trx('email_queue').where('event_id', id).del();
+
+      // 4. Delete photos (this will also handle hero_photo_id foreign key)
+      await trx('photos').where('event_id', id).del();
+
+      // 5. Delete categories (photo_categories has CASCADE delete for event_id)
+      await trx('photo_categories').where('event_id', id).del();
+
+      // 6. Finally delete the event
+      await trx('events').where('id', id).del();
+
+      // Delete event folder from storage if it exists
+      if (event.folder_path) {
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const eventFolderPath = path.join(storagePath, 'events', 'active', event.folder_path);
+        
+        try {
+          const fsPromises = require('fs').promises;
+          await fsPromises.rm(eventFolderPath, { recursive: true, force: true });
+        } catch (err) {
+          console.error('Failed to delete event folder:', err);
+          // Don't fail the transaction if folder deletion fails
+        }
+      }
+
+      // Delete archive if exists
+      if (event.archive_path) {
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const archivePath = path.join(storagePath, event.archive_path);
+        
+        try {
+          const fsPromises = require('fs').promises;
+          await fsPromises.unlink(archivePath);
+        } catch (err) {
+          console.error('Failed to delete archive file:', err);
+          // Don't fail the transaction if file deletion fails
+        }
+      }
+    });
+
+    // Log activity (outside transaction)
+    await logActivity('event_deleted',
+      { event_name: event.event_name },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Event deleted successfully' });
+  } catch (error) {
+    console.error('Error deleting event:', error);
+    
+    // Provide more specific error messages
+    if (error.message && error.message.includes('foreign key constraint')) {
+      res.status(500).json({ 
+        error: 'Cannot delete event due to existing references. Please contact support.',
+        details: error.message 
+      });
+    } else {
+      res.status(500).json({ 
+        error: 'Failed to delete event',
+        details: process.env.NODE_ENV === 'development' ? error.message : undefined
+      });
+    }
+  }
+});
+
+// Toggle event status
+router.post('/:id/toggle-status', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    const newStatus = !event.is_active;
+    await db('events')
+      .where('id', id)
+      .update({
+        is_active: newStatus,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity(newStatus ? 'event_activated' : 'event_deactivated',
+      { eventName: event.event_name },
+      id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ 
+      message: `Event ${newStatus ? 'activated' : 'deactivated'} successfully`,
+      is_active: newStatus
+    });
+  } catch (error) {
+    console.error('Error toggling event status:', error);
+    res.status(500).json({ error: 'Failed to toggle event status' });
+  }
+});
+
+// Reset event password
+router.post('/:id/reset-password', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    const { sendEmail = true } = req.body;
+
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    if (event.is_archived) {
+      return res.status(400).json({ error: 'Cannot reset password for archived event' });
+    }
+
+    // Generate new password
+    const { generatePassword } = require('../utils/passwordGenerator');
+    const newPassword = generatePassword();
+    const passwordHash = await bcrypt.hash(newPassword, 10);
+
+    // Update event with new password
+    await db('events')
+      .where('id', id)
+      .update({
+        password_hash: passwordHash,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity('password_reset',
+      { eventName: event.event_name, emailSent: sendEmail },
+      id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    // Queue email notification if requested
+    if (sendEmail) {
+      // For password reset, we'll need to create a template or use a different approach
+      // For now, let's use the gallery_created template with updated password
+      await queueEmail(id, event.host_email, 'gallery_created', {
+        host_name: event.host_email.split('@')[0],
+        event_name: event.event_name,
+        event_date: event.event_date,  // Pass raw date - will be formatted by email processor
+        gallery_link: event.share_link,
+        gallery_password: newPassword,
+        expiry_date: event.expires_at  // Pass raw date - will be formatted by email processor
+      });
+    }
+
+    res.json({ 
+      message: 'Password reset successfully',
+      newPassword: newPassword,
+      emailSent: sendEmail
+    });
+  } catch (error) {
+    console.error('Error resetting password:', error);
+    res.status(500).json({ error: 'Failed to reset password' });
+  }
+});
+
+// Resend creation email
+router.post('/:id/resend-email', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    // Get event details
+    const event = await db('events')
+      .where('id', id)
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+    
+    // The email processor will determine the language based on:
+    // 1. Event language setting
+    // 2. App settings general_default_language  
+    // 3. Email config default language
+    // 4. Domain-based detection
+    // So we don't need to determine it here
+    
+    // For resending creation email, we need the actual password
+    // First, try to get it from the request body if provided
+    let galleryPassword = req.body.password;
+    
+    // If no password provided, we can't decrypt the existing one
+    // So we'll show a security message
+    if (!galleryPassword) {
+      // We'll let the email processor determine the language for the security message
+      galleryPassword = '{{password_security_message}}';
+    }
+    
+    // Dates will be formatted by the email processor based on recipient language
+    
+    // Queue the email
+    await queueEmail(id, event.host_email, 'gallery_created', {
+      host_name: event.host_name || event.host_email.split('@')[0],
+      event_name: event.event_name,
+      event_date: event.event_date,  // Pass raw date - will be formatted by email processor
+      gallery_link: event.share_link,
+      gallery_password: galleryPassword,
+      expiry_date: event.expires_at,  // Pass raw date - will be formatted by email processor
+      welcome_message: event.welcome_message || '',
+      eventId: id,
+      isResend: true // Flag to indicate this is a resend
+    });
+    
+    // Log the activity using the proper schema
+    try {
+      await logActivity('email_resent', {
+        email_type: 'gallery_created',
+        recipient: event.host_email,
+        ip_address: req.ip || '0.0.0.0',
+        user_agent: req.get('user-agent') || 'Unknown'
+      }, id, {
+        type: 'admin',
+        id: req.admin.id,
+        name: req.admin.username
+      });
+    } catch (logError) {
+      console.error('Warning: Failed to log activity:', logError);
+      // Don't fail the request if activity logging fails
+    }
+    
+    res.json({ 
+      success: true,
+      message: 'Creation email has been queued for sending'
+    });
+  } catch (error) {
+    console.error('Error resending creation email:', error);
+    console.error('Stack trace:', error.stack);
+    res.status(500).json({ error: 'Failed to resend creation email' });
+  }
+});
+
+// Archive event
+router.post('/:id/archive', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    if (event.is_archived) {
+      return res.status(400).json({ error: 'Event is already archived' });
+    }
+
+    // Use the archive service to create ZIP archive
+    await archiveEvent(event);
+
+    // Log activity
+    await logActivity('event_archived',
+      { eventName: event.event_name },
+      id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Event archived successfully' });
+  } catch (error) {
+    console.error('Error archiving event:', error);
+    res.status(500).json({ error: 'Failed to archive event' });
+  }
+});
+
+// Bulk archive events
+router.post('/bulk-archive', adminAuth, [
+  body('eventIds').isArray().withMessage('eventIds must be an array'),
+  body('eventIds.*').isInt().withMessage('Each eventId must be an integer')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { eventIds } = req.body;
+    
+    if (eventIds.length === 0) {
+      return res.status(400).json({ error: 'No events selected for archiving' });
+    }
+
+    // Get all events to archive
+    const events = await db('events')
+      .whereIn('id', eventIds)
+      .where('is_archived', formatBoolean(false));
+
+    if (events.length === 0) {
+      return res.status(400).json({ error: 'No valid events found to archive' });
+    }
+
+    const results = {
+      successful: [],
+      failed: []
+    };
+
+    // Process each event
+    for (const event of events) {
+      try {
+        // Use the archive service to create ZIP archive
+        await archiveEvent(event);
+        
+        // Log activity
+        await logActivity('event_archived',
+          { eventName: event.event_name, bulkOperation: true },
+          event.id,
+          { type: 'admin', id: req.admin.id, name: req.admin.username }
+        );
+        
+        results.successful.push({
+          id: event.id,
+          name: event.event_name
+        });
+      } catch (error) {
+        console.error(`Failed to archive event ${event.id}:`, error);
+        results.failed.push({
+          id: event.id,
+          name: event.event_name,
+          error: error.message
+        });
+      }
+    }
+
+    // Log bulk archive activity
+    await logActivity('bulk_archive_completed',
+      { 
+        totalEvents: eventIds.length,
+        successfulCount: results.successful.length,
+        failedCount: results.failed.length
+      },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({
+      message: `Bulk archive completed: ${results.successful.length} succeeded, ${results.failed.length} failed`,
+      results
+    });
+  } catch (error) {
+    console.error('Error in bulk archive:', error);
+    res.status(500).json({ error: 'Failed to perform bulk archive' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminNotifications.js

@@ -0,0 +1,122 @@
+const express = require('express');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+
+// Get notifications (unread activity logs)
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const { limit = 20, includeRead = false } = req.query;
+
+    let query = db('activity_logs')
+      .select(
+        'activity_logs.*',
+        'events.event_name'
+      )
+      .leftJoin('events', 'activity_logs.event_id', 'events.id')
+      .orderBy('activity_logs.created_at', 'desc')
+      .limit(parseInt(limit));
+    
+    // By default, only show unread notifications
+    if (includeRead !== 'true') {
+      query = query.whereNull('activity_logs.read_at');
+    }
+
+    const notifications = await query;
+
+    // Format notifications
+    const formattedNotifications = notifications.map(notification => ({
+      id: notification.id,
+      type: notification.activity_type,
+      actorType: notification.actor_type,
+      actorName: notification.actor_name,
+      eventName: notification.event_name,
+      eventId: notification.event_id,
+      metadata: (() => {
+        try {
+          if (!notification.metadata) return {};
+          if (typeof notification.metadata === 'object') return notification.metadata;
+          return JSON.parse(notification.metadata);
+        } catch (e) {
+          console.warn('Failed to parse metadata for notification:', notification.id, e.message);
+          return {};
+        }
+      })(),
+      createdAt: notification.created_at,
+      readAt: notification.read_at,
+      isRead: !!notification.read_at
+    }));
+
+    // Get unread count
+    const unreadCount = await db('activity_logs')
+      .whereNull('read_at')
+      .count('id as count')
+      .first();
+
+    res.json({
+      notifications: formattedNotifications,
+      unreadCount: unreadCount.count || 0
+    });
+  } catch (error) {
+    console.error('Notifications fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch notifications' });
+  }
+});
+
+// Mark notification as read
+router.put('/:id/read', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    await db('activity_logs')
+      .where('id', id)
+      .update({
+        read_at: new Date()
+      });
+
+    res.json({ message: 'Notification marked as read' });
+  } catch (error) {
+    console.error('Mark notification read error:', error);
+    res.status(500).json({ error: 'Failed to mark notification as read' });
+  }
+});
+
+// Mark all notifications as read
+router.put('/read-all', adminAuth, async (req, res) => {
+  try {
+    await db('activity_logs')
+      .whereNull('read_at')
+      .update({
+        read_at: new Date()
+      });
+
+    res.json({ message: 'All notifications marked as read' });
+  } catch (error) {
+    console.error('Mark all notifications read error:', error);
+    res.status(500).json({ error: 'Failed to mark all notifications as read' });
+  }
+});
+
+// Delete old notifications (older than 30 days and read)
+router.delete('/clear-old', adminAuth, async (req, res) => {
+  try {
+    // Use database-agnostic date calculation
+    const thirtyDaysAgo = new Date();
+    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+    
+    const deletedCount = await db('activity_logs')
+      .whereNotNull('read_at')
+      .where('created_at', '<', thirtyDaysAgo)
+      .delete();
+
+    res.json({ 
+      message: 'Old notifications cleared',
+      deletedCount 
+    });
+  } catch (error) {
+    console.error('Clear old notifications error:', error);
+    res.status(500).json({ error: 'Failed to clear old notifications' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminPhotos.js

@@ -0,0 +1,795 @@
+const express = require('express');
+const multer = require('multer');
+const path = require('path');
+const fs = require('fs').promises;
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth');
+const { generateThumbnail, ensureThumbnail } = require('../services/imageProcessor');
+const { generatePhotoFilename } = require('../utils/filenameSanitizer');
+const { escapeLikePattern } = require('../utils/sqlSecurity');
+const { validateUploadedFiles } = require('../middleware/uploadValidation');
+const router = express.Router();
+
+// Get storage path from environment or default
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+// Configure multer for file uploads
+// IMPORTANT: Using synchronous functions to prevent file corruption
+const storage = multer.diskStorage({
+  destination: (req, file, cb) => {
+    console.log('Multer destination called for file:', file.originalname);
+    const { eventId } = req.params;
+    
+    // We'll validate the event exists in the route handler
+    // For now, just create a temp destination
+    const tempPath = path.join(getStoragePath(), 'temp', `upload_${Date.now()}_${Math.random().toString(36).substring(7)}`);
+    
+    // Create directory synchronously
+    require('fs').mkdirSync(tempPath, { recursive: true });
+    console.log('Temp destination path:', tempPath);
+    
+    // Store temp path for cleanup
+    req.tempUploadPath = tempPath;
+    
+    cb(null, tempPath);
+  },
+  filename: (req, file, cb) => {
+    console.log('Multer filename called for file:', file.originalname);
+    // Use a simple temporary filename
+    const tempName = `temp_${Date.now()}_${Math.round(Math.random() * 1E9)}${path.extname(file.originalname)}`;
+    console.log('Temp filename:', tempName);
+    cb(null, tempName);
+  }
+});
+
+const { validateFileType } = require('../utils/fileSecurityUtils');
+
+const upload = multer({
+  storage: storage,
+  limits: {
+    fileSize: 50 * 1024 * 1024, // 50MB limit per file
+    files: 500, // Maximum 500 files
+    // Set a reasonable field size limit to prevent memory issues
+    fieldSize: 10 * 1024 * 1024, // 10MB for non-file fields
+    // Add part size limits to prevent incomplete uploads
+    parts: 10000, // Maximum number of parts (fields + files)
+    headerPairs: 2000 // Maximum number of header key-value pairs
+  },
+  fileFilter: (req, file, cb) => {
+    // Accept images only with proper validation
+    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/webp'];
+    
+    if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
+      return cb(null, true);
+    } else {
+      cb(new Error('Only JPEG, PNG and WebP images are allowed'));
+    }
+  },
+  // Add abort on limit to stop processing when limits are exceeded
+  abortOnLimit: true
+});
+
+const { createFileUploadValidator } = require('../utils/fileSecurityUtils');
+
+// Create content validator middleware
+const validateUploadContent = createFileUploadValidator({
+  allowedTypes: ['image/jpeg', 'image/png', 'image/webp'],
+  maxFileSize: 50 * 1024 * 1024,
+  validateContent: true
+});
+
+// Request timeout middleware for uploads
+const uploadTimeout = (timeout = 300000) => { // 5 minutes default
+  return (req, res, next) => {
+    // Set timeout for the request
+    req.setTimeout(timeout, () => {
+      console.error('Upload request timed out');
+      if (!res.headersSent) {
+        res.status(408).json({ error: 'Upload request timed out' });
+      }
+    });
+    
+    // Set response timeout as well
+    res.setTimeout(timeout, () => {
+      console.error('Upload response timed out');
+    });
+    
+    next();
+  };
+};
+
+// Upload photos for an event
+// Increased limit to 500 files, but recommend chunked uploads for better performance
+router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, next) => { // 10 minute timeout
+  upload.array('photos', 500)(req, res, (err) => {
+    if (err) {
+      console.error('Multer error:', err);
+      if (err instanceof multer.MulterError) {
+        if (err.code === 'LIMIT_FILE_SIZE') {
+          return res.status(400).json({ error: 'File too large. Maximum size is 50MB per file.' });
+        }
+        if (err.code === 'LIMIT_FILE_COUNT') {
+          return res.status(400).json({ error: 'Too many files. Maximum 500 files per upload.' });
+        }
+        return res.status(400).json({ error: `Upload error: ${err.message}` });
+      }
+      return res.status(400).json({ error: err.message || 'Upload failed' });
+    }
+    next();
+  });
+}, validateUploadContent, validateUploadedFiles, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { category_id } = req.body;
+    
+    console.log('Upload request received for event:', eventId);
+    console.log('Body:', req.body);
+    console.log('Files:', req.files ? req.files.length : 'none');
+    console.log('File details:', req.files?.map(f => ({ name: f.originalname, size: f.size, mimetype: f.mimetype })));
+    console.log('Category ID received:', category_id);
+    
+    // Verify event exists and admin has access
+    const event = await db('events').where({ id: eventId }).first();
+    if (!event) {
+      console.error('Event not found:', eventId);
+      // Clean up temp files
+      if (req.tempUploadPath) {
+        try {
+          await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+        } catch (e) {
+          console.error('Failed to clean up temp path:', e);
+        }
+      }
+      return res.status(404).json({ error: 'Event not found' });
+    }
+    
+    if (!req.files || req.files.length === 0) {
+      console.error('No files in request. req.files:', req.files);
+      console.error('Request body keys:', Object.keys(req.body));
+      // Clean up temp files
+      if (req.tempUploadPath) {
+        try {
+          await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+        } catch (e) {
+          console.error('Failed to clean up temp path:', e);
+        }
+      }
+      return res.status(400).json({ error: 'No files uploaded' });
+    }
+    
+    // Parse category_id to number if provided
+    const parsedCategoryId = category_id ? parseInt(category_id, 10) : null;
+    
+    // Get category details if provided
+    let category = null;
+    if (parsedCategoryId) {
+      category = await db('photo_categories').where({ id: parsedCategoryId }).first();
+      if (!category) {
+        // Clean up temp files
+        if (req.tempUploadPath) {
+          try {
+            await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+          } catch (e) {
+            console.error('Failed to clean up temp path:', e);
+          }
+        }
+        return res.status(400).json({ error: 'Invalid category' });
+      }
+    }
+    
+    // Create final destination directory
+    const finalDestPath = path.join(getStoragePath(), 'events/active', event.slug);
+    await fs.mkdir(finalDestPath, { recursive: true });
+    
+    const uploadedPhotos = [];
+    const errors = [];
+    
+    // Process files in batches to optimize database operations
+    const BATCH_SIZE = 25; // Increased batch size for better performance with large uploads
+    
+    for (let i = 0; i < req.files.length; i += BATCH_SIZE) {
+      const batch = req.files.slice(i, i + BATCH_SIZE);
+      
+      // Start a single transaction for the batch
+      const trx = await db.transaction();
+      
+      try {
+        // Get initial counter for this batch
+        let batchCounter = 1;
+        if (category) {
+          const categoryData = await trx('photo_categories')
+            .where({ id: parsedCategoryId })
+            .forUpdate()
+            .first();
+          batchCounter = (categoryData.photo_counter || 0) + 1;
+        } else {
+          const uncategorizedCount = await trx('photos')
+            .where({ event_id: eventId })
+            .whereNull('category_id')
+            .count('id as count')
+            .first();
+          batchCounter = (parseInt(uncategorizedCount.count) || 0) + 1;
+        }
+        
+        const batchPhotos = [];
+        const fileRenameOperations = []; // Store rename operations to do after commit
+        
+        // First pass: prepare data and move files from temp to final location
+        for (let fileIndex = 0; fileIndex < batch.length; fileIndex++) {
+          const file = batch[fileIndex];
+          const counter = batchCounter + fileIndex;
+          const tempPath = file.path; // Original temp path
+          
+          try {
+            // Verify file is complete before processing
+            const tempStats = await fs.stat(tempPath);
+            if (tempStats.size === 0) {
+              throw new Error('File is empty - upload may have been interrupted');
+            }
+            
+            // Generate new filename
+            const extension = path.extname(file.originalname);
+            const newFilename = generatePhotoFilename(
+              event.event_name,
+              category ? category.name : 'uncategorized',
+              counter,
+              extension
+            );
+            
+            // Calculate final path
+            const finalPath = path.join(finalDestPath, newFilename);
+            const storagePath = getStoragePath();
+            const relativePath = path.relative(path.join(storagePath, 'events/active'), finalPath);
+            
+            // Prepare photo data for batch insert
+            const photoData = {
+              event_id: parseInt(eventId),
+              filename: newFilename,
+              path: relativePath,
+              thumbnail_path: null, // Will generate after successful commit
+              category_id: parsedCategoryId ? parseInt(parsedCategoryId) : null,
+              type: 'individual',
+              size_bytes: tempStats.size // Use actual file size from stat
+            };
+            
+            batchPhotos.push(photoData);
+            
+            // Store move operation for later
+            fileRenameOperations.push({
+              tempPath: tempPath,
+              finalPath: finalPath,
+              filename: newFilename,
+              photoData: photoData
+            });
+          } catch (error) {
+            console.error(`Error preparing file ${file.originalname}:`, error);
+            errors.push({ filename: file.originalname, error: error.message });
+          }
+        }
+        
+        // Insert all photos in this batch
+        if (batchPhotos.length > 0) {
+          console.log(`Inserting batch of ${batchPhotos.length} photos with category_id: ${parsedCategoryId}`);
+          
+          const insertedIds = await trx('photos').insert(batchPhotos).returning('id');
+          
+          // Update category counter if needed
+          if (category && parsedCategoryId) {
+            const newCounter = batchCounter + batchPhotos.length - 1;
+            await trx('photo_categories')
+              .where({ id: parsedCategoryId })
+              .update({ photo_counter: newCounter });
+            console.log(`Updated category ${parsedCategoryId} counter to ${newCounter}`);
+          }
+          
+          // Commit the transaction first
+          await trx.commit();
+          console.log(`Successfully committed batch of ${batchPhotos.length} photos`);
+          
+          // Now move files from temp to final location after successful commit
+          for (let idx = 0; idx < fileRenameOperations.length; idx++) {
+            const operation = fileRenameOperations[idx];
+            try {
+              // Move the file from temp to final location
+              await fs.rename(operation.tempPath, operation.finalPath);
+              console.log(`Moved file from ${operation.tempPath} to ${operation.finalPath}`);
+              
+              // Verify the file was moved successfully
+              const finalStats = await fs.stat(operation.finalPath);
+              if (finalStats.size !== operation.photoData.size_bytes) {
+                throw new Error(`File size mismatch after move: expected ${operation.photoData.size_bytes}, got ${finalStats.size}`);
+              }
+              
+              // Generate thumbnail with final path
+              let thumbnailPath = null;
+              try {
+                thumbnailPath = await generateThumbnail(operation.finalPath);
+                
+                // Update the database with thumbnail path
+                if (thumbnailPath && insertedIds[idx]) {
+                  const photoId = insertedIds[idx]?.id || insertedIds[idx];
+                  await db('photos')
+                    .where({ id: photoId })
+                    .update({ thumbnail_path: thumbnailPath });
+                }
+              } catch (thumbError) {
+                console.error(`Thumbnail generation failed for ${operation.filename}:`, thumbError.message);
+              }
+              
+              // Add to successful uploads
+              uploadedPhotos.push({
+                id: insertedIds[idx]?.id || insertedIds[idx],
+                filename: operation.filename,
+                size: operation.photoData.size_bytes,
+                category_id: operation.photoData.category_id
+              });
+            } catch (moveError) {
+              console.error(`Failed to move file ${operation.tempPath} to ${operation.finalPath}:`, moveError);
+              errors.push({ 
+                filename: operation.filename, 
+                error: `File move failed: ${moveError.message}` 
+              });
+              
+              // Try to clean up the database entry if file move failed
+              if (insertedIds[idx]) {
+                const photoId = insertedIds[idx]?.id || insertedIds[idx];
+                try {
+                  await db('photos').where({ id: photoId }).delete();
+                  console.log(`Cleaned up database entry for failed photo ${photoId}`);
+                } catch (cleanupError) {
+                  console.error(`Failed to clean up database entry:`, cleanupError);
+                }
+              }
+            }
+          }
+        } else {
+          // No photos to insert, just rollback
+          await trx.rollback();
+        }
+      } catch (error) {
+        console.error(`Error processing batch starting at index ${i}:`, error);
+        console.error('Stack trace:', error.stack);
+        
+        // Rollback if not already committed
+        if (!trx.isCompleted()) {
+          await trx.rollback();
+        }
+        
+        // Add all files in this batch to errors
+        for (const file of batch) {
+          errors.push({ 
+            filename: file.originalname, 
+            error: `Batch processing failed: ${error.message}` 
+          });
+        }
+      }
+    }
+    
+    // Clean up temp upload directory
+    if (req.tempUploadPath) {
+      try {
+        await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+        console.log(`Cleaned up temp upload directory: ${req.tempUploadPath}`);
+      } catch (e) {
+        console.error('Failed to clean up temp upload directory:', e);
+      }
+    }
+    
+    // Log activity
+    await logActivity('photos_uploaded',
+      { count: uploadedPhotos.length, eventName: event.event_name },
+      eventId,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    // Include any files that were invalid from the validation middleware
+    const totalInvalidFiles = (req.invalidFiles || []).concat(errors);
+    
+    // Prepare response
+    const totalAttempted = req.files.length + (req.invalidFiles ? req.invalidFiles.length : 0);
+    const response = {
+      message: `Successfully uploaded ${uploadedPhotos.length} photos`,
+      photos: uploadedPhotos,
+      totalFiles: totalAttempted,
+      successCount: uploadedPhotos.length,
+      failureCount: totalInvalidFiles.length
+    };
+    
+    // Include error details if any files failed
+    if (totalInvalidFiles.length > 0) {
+      response.errors = totalInvalidFiles;
+      response.message = `Uploaded ${uploadedPhotos.length} of ${totalAttempted} photos. ${totalInvalidFiles.length} failed.`;
+    }
+    
+    res.json(response);
+  } catch (error) {
+    console.error('Error uploading photos:', error);
+    
+    // Clean up temp upload directory on error
+    if (req.tempUploadPath) {
+      try {
+        await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+        console.log(`Cleaned up temp upload directory after error: ${req.tempUploadPath}`);
+      } catch (e) {
+        console.error('Failed to clean up temp upload directory:', e);
+      }
+    }
+    
+    res.status(500).json({ error: 'Failed to upload photos' });
+  }
+});
+
+// Delete a photo
+router.delete('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    
+    // Get photo details
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Delete physical files
+    const storagePath = getStoragePath();
+    const photoPath = path.join(storagePath, 'events/active', photo.path);
+    
+    try {
+      await fs.unlink(photoPath);
+    } catch (error) {
+      console.error('Error deleting photo file:', error);
+    }
+    
+    // Delete thumbnail if exists
+    if (photo.thumbnail_path) {
+      const thumbPath = path.join(storagePath, 'events/active', photo.thumbnail_path);
+      try {
+        await fs.unlink(thumbPath);
+      } catch (error) {
+        console.error('Error deleting thumbnail:', error);
+      }
+    }
+    
+    // Remove from database
+    await db('photos').where({ id: photoId }).delete();
+    
+    // Log activity
+    const event = await db('events').where({ id: eventId }).first();
+    await logActivity('photo_deleted',
+      { filename: photo.filename, eventName: event.event_name },
+      eventId,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: 'Photo deleted successfully' });
+  } catch (error) {
+    console.error('Error deleting photo:', error);
+    res.status(500).json({ error: 'Failed to delete photo' });
+  }
+});
+
+// Update a photo (e.g., change category)
+router.patch('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    const { category_id } = req.body;
+    
+    // Verify photo belongs to event
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Update photo
+    await db('photos')
+      .where({ id: photoId })
+      .update({ category_id: category_id || null });
+    
+    res.json({ message: 'Photo updated successfully' });
+  } catch (error) {
+    console.error('Error updating photo:', error);
+    res.status(500).json({ error: 'Failed to update photo' });
+  }
+});
+
+// Bulk delete photos
+router.post('/:eventId/photos/bulk-delete', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { photoIds } = req.body;
+    
+    if (!Array.isArray(photoIds) || photoIds.length === 0) {
+      return res.status(400).json({ error: 'Invalid photo IDs' });
+    }
+    
+    // Get all photos to delete
+    const photos = await db('photos')
+      .whereIn('id', photoIds)
+      .where('event_id', eventId);
+    
+    if (photos.length === 0) {
+      return res.status(404).json({ error: 'No photos found' });
+    }
+    
+    // Delete physical files
+    const storagePath = getStoragePath();
+    const event = await db('events').where({ id: eventId }).first();
+    
+    for (const photo of photos) {
+      // Delete photo file
+      const photoPath = path.join(storagePath, 'events/active', photo.path);
+      try {
+        await fs.unlink(photoPath);
+      } catch (error) {
+        console.error('Error deleting photo file:', error);
+      }
+      
+      // Delete thumbnail
+      if (photo.thumbnail_path) {
+        const thumbPath = path.join(storagePath, photo.thumbnail_path);
+        try {
+          await fs.unlink(thumbPath);
+        } catch (error) {
+          console.error('Error deleting thumbnail:', error);
+        }
+      }
+    }
+    
+    // Delete from database
+    await db('photos')
+      .whereIn('id', photoIds)
+      .where('event_id', eventId)
+      .delete();
+    
+    // Log activity
+    await logActivity('photos_bulk_deleted',
+      { count: photos.length, eventName: event.event_name },
+      eventId,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: `${photos.length} photos deleted successfully` });
+  } catch (error) {
+    console.error('Error bulk deleting photos:', error);
+    res.status(500).json({ error: 'Failed to delete photos' });
+  }
+});
+
+// Bulk update photos
+router.post('/:eventId/photos/bulk-update', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { photoIds, updates } = req.body;
+    
+    if (!Array.isArray(photoIds) || photoIds.length === 0) {
+      return res.status(400).json({ error: 'Invalid photo IDs' });
+    }
+    
+    // Verify all photos belong to the event
+    const photoCount = await db('photos')
+      .whereIn('id', photoIds)
+      .where('event_id', eventId)
+      .count('id as count')
+      .first();
+    
+    if (photoCount.count !== photoIds.length) {
+      return res.status(400).json({ error: 'Some photos do not belong to this event' });
+    }
+    
+    // Update photos
+    const updateData = {};
+    if (updates.category_id !== undefined) {
+      updateData.category_id = updates.category_id || null;
+    }
+    
+    await db('photos')
+      .whereIn('id', photoIds)
+      .where('event_id', eventId)
+      .update(updateData);
+    
+    res.json({ message: `${photoIds.length} photos updated successfully` });
+  } catch (error) {
+    console.error('Error bulk updating photos:', error);
+    res.status(500).json({ error: 'Failed to update photos' });
+  }
+});
+
+// Download a photo
+router.get('/:eventId/photos/:photoId/download', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    const storagePath = getStoragePath();
+    const filePath = path.join(storagePath, 'events/active', photo.path);
+    
+    // Check if file exists
+    try {
+      await fs.access(filePath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Photo file not found' });
+    }
+    
+    // Send file
+    res.download(filePath, photo.filename);
+  } catch (error) {
+    console.error('Error downloading photo:', error);
+    res.status(500).json({ error: 'Failed to download photo' });
+  }
+});
+
+// Get all photos for an event
+router.get('/:eventId/photos', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { category_id, type, search, sort = 'date', order = 'desc' } = req.query;
+    
+    let query = db('photos')
+      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
+      .where({ 'photos.event_id': eventId })
+      .select(
+        'photos.*',
+        'photo_categories.name as category_name',
+        'photo_categories.slug as category_slug'
+      );
+    
+    // Filter by category (including uncategorized)
+    if (category_id !== undefined) {
+      if (category_id === '' || category_id === '0') {
+        query = query.whereNull('photos.category_id');
+      } else {
+        query = query.where({ 'photos.category_id': category_id });
+      }
+    }
+    
+    // Keep type filter for backwards compatibility
+    if (type) {
+      query = query.where({ 'photos.type': type });
+    }
+    
+    // Search by filename
+    if (search) {
+      const escapedSearch = escapeLikePattern(search);
+      query = query.where('photos.filename', 'like', `%${escapedSearch}%`);
+    }
+    
+    // Sorting
+    let orderByColumn = 'photos.uploaded_at';
+    if (sort === 'name') {
+      orderByColumn = 'photos.filename';
+    } else if (sort === 'size') {
+      orderByColumn = 'photos.size_bytes';
+    }
+    
+    const photos = await query.orderBy(orderByColumn, order);
+    
+    res.json({
+      photos: photos.map(photo => ({
+        id: photo.id,
+        filename: photo.filename,
+        url: `/admin/events/${eventId}/photo/${photo.id}`,
+        thumbnail_url: photo.thumbnail_path ? `/admin/events/${eventId}/thumbnail/${photo.id}` : null,
+        type: photo.type,
+        category_id: photo.category_id,
+        category_name: photo.category_name,
+        category_slug: photo.category_slug,
+        size: photo.size_bytes,
+        uploaded_at: photo.uploaded_at
+      }))
+    });
+  } catch (error) {
+    console.error('Error fetching photos:', error);
+    res.status(500).json({ error: 'Failed to fetch photos' });
+  }
+});
+
+// Serve photo with admin authentication
+router.get('/:eventId/photo/:photoId', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    const storagePath = getStoragePath();
+    const filePath = path.join(storagePath, 'events/active', photo.path);
+    
+    // Check if file exists
+    try {
+      await fs.access(filePath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Photo file not found' });
+    }
+    
+    // Set appropriate headers
+    res.setHeader('Content-Type', `image/${path.extname(photo.filename).slice(1)}`);
+    res.setHeader('Cache-Control', 'private, max-age=3600');
+    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+    
+    // Send file (sendFile requires absolute path)
+    res.sendFile(path.resolve(filePath));
+  } catch (error) {
+    console.error('Error serving photo:', error);
+    res.status(500).json({ error: 'Failed to serve photo' });
+  }
+});
+
+// Serve thumbnail with admin authentication
+router.get('/:eventId/thumbnail/:photoId', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      console.error(`Photo not found: ${photoId}, event ${eventId}`);
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Ensure thumbnail exists and is valid, regenerate if needed
+    const thumbnailPath = await ensureThumbnail(photo);
+    
+    if (!thumbnailPath) {
+      console.error(`Failed to generate thumbnail for photo ${photoId}`);
+      return res.status(404).json({ error: 'Thumbnail generation failed' });
+    }
+    
+    const storagePath = getStoragePath();
+    const filePath = path.join(storagePath, thumbnailPath);
+    
+    // Set appropriate headers
+    res.setHeader('Content-Type', 'image/jpeg'); // Thumbnails are always JPEG
+    res.setHeader('Cache-Control', 'private, max-age=3600');
+    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+    
+    // Send file (sendFile requires absolute path)
+    res.sendFile(path.resolve(filePath));
+  } catch (error) {
+    console.error('Error serving thumbnail:', error);
+    console.error('Photo ID:', req.params.photoId);
+    console.error('Event ID:', req.params.eventId);
+    res.status(500).json({ error: 'Failed to serve thumbnail' });
+  }
+});
+
+// Debug endpoint to check photo existence
+router.get('/:eventId/debug', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    
+    const event = await db('events').where({ id: eventId }).first();
+    const photoCount = await db('photos').where({ event_id: eventId }).count('id as count').first();
+    const photos = await db('photos').where({ event_id: eventId }).limit(5);
+    
+    res.json({
+      event: event || 'Not found',
+      photoCount: photoCount.count,
+      samplePhotos: photos,
+      storagePath: getStoragePath()
+    });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminSettings.js

@@ -0,0 +1,650 @@
+const express = require('express');
+const multer = require('multer');
+const path = require('path');
+const fs = require('fs').promises;
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { adminAuth } = require('../middleware/auth');
+const { clearMaintenanceCache } = require('../middleware/maintenance');
+const { clearSettingsCache } = require('../services/rateLimitService');
+const router = express.Router();
+
+// Configure multer for logo uploads
+const storage = multer.diskStorage({
+  destination: async (req, file, cb) => {
+    const uploadDir = path.join(__dirname, '../../storage/uploads/logos');
+    await fs.mkdir(uploadDir, { recursive: true });
+    cb(null, uploadDir);
+  },
+  filename: (req, file, cb) => {
+    const ext = path.extname(file.originalname);
+    cb(null, `logo-${Date.now()}${ext}`);
+  }
+});
+
+const { validateFileType } = require('../utils/fileSecurityUtils');
+
+const upload = multer({
+  storage,
+  limits: { fileSize: 5 * 1024 * 1024 }, // 5MB
+  fileFilter: (req, file, cb) => {
+    // Note: SVG files are excluded from magic number validation for logos
+    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/svg+xml'];
+    
+    if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
+      return cb(null, true);
+    } else {
+      cb(new Error('Only JPEG, PNG, GIF and SVG image files are allowed'));
+    }
+  }
+});
+
+// Configure multer for favicon uploads
+const faviconStorage = multer.diskStorage({
+  destination: async (req, file, cb) => {
+    const uploadDir = path.join(__dirname, '../../storage/uploads/favicons');
+    await fs.mkdir(uploadDir, { recursive: true });
+    cb(null, uploadDir);
+  },
+  filename: (req, file, cb) => {
+    const ext = path.extname(file.originalname);
+    cb(null, `favicon-${Date.now()}${ext}`);
+  }
+});
+
+const faviconUpload = multer({
+  storage: faviconStorage,
+  limits: { fileSize: 1 * 1024 * 1024 }, // 1MB
+  fileFilter: (req, file, cb) => {
+    const allowedMimeTypes = ['image/png', 'image/x-icon', 'image/vnd.microsoft.icon'];
+    
+    // For ICO files, we can't use the standard validateFileType
+    if (file.mimetype === 'image/png') {
+      if (validateFileType(file.originalname, file.mimetype, ['image/png'])) {
+        cb(null, true);
+      } else {
+        cb(new Error('Invalid PNG file'));
+      }
+    } else if (allowedMimeTypes.includes(file.mimetype) && 
+               (file.originalname.toLowerCase().endsWith('.ico') || 
+                file.originalname.toLowerCase().endsWith('.png'))) {
+      cb(null, true);
+    } else {
+      cb(new Error('Favicon must be PNG or ICO format'));
+    }
+  }
+});
+
+// Get all settings
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const settings = await db('app_settings').select('*');
+    
+    // Convert to object format
+    const settingsObject = {};
+    settings.forEach(setting => {
+      if (setting.setting_value) {
+        try {
+          // Try to parse as JSON first
+          settingsObject[setting.setting_key] = JSON.parse(setting.setting_value);
+        } catch (e) {
+          // If it's not valid JSON, use the raw value
+          settingsObject[setting.setting_key] = setting.setting_value;
+        }
+      } else {
+        settingsObject[setting.setting_key] = null;
+      }
+    });
+
+    res.json(settingsObject);
+  } catch (error) {
+    console.error('Settings fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch settings' });
+  }
+});
+
+// Get settings by type
+router.get('/:type', adminAuth, async (req, res) => {
+  try {
+    const { type } = req.params;
+    const settings = await db('app_settings')
+      .where('setting_type', type)
+      .select('*');
+    
+    // Convert to object format
+    const settingsObject = {};
+    settings.forEach(setting => {
+      if (setting.setting_value) {
+        try {
+          // Try to parse as JSON first
+          settingsObject[setting.setting_key] = JSON.parse(setting.setting_value);
+        } catch (e) {
+          // If it's not valid JSON, use the raw value
+          settingsObject[setting.setting_key] = setting.setting_value;
+        }
+      } else {
+        settingsObject[setting.setting_key] = null;
+      }
+    });
+
+    res.json(settingsObject);
+  } catch (error) {
+    console.error('Settings fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch settings' });
+  }
+});
+
+// Update branding settings
+router.put('/branding', adminAuth, async (req, res) => {
+  try {
+    const {
+      company_name,
+      company_tagline,
+      support_email,
+      footer_text,
+      watermark_enabled,
+      watermark_position,
+      watermark_opacity,
+      watermark_size,
+      favicon_url,
+      logo_url,
+      watermark_logo_url
+    } = req.body;
+
+    const brandingSettings = {
+      company_name,
+      company_tagline,
+      support_email,
+      footer_text,
+      watermark_enabled,
+      watermark_position,
+      watermark_opacity,
+      watermark_size,
+      favicon_url,
+      logo_url,
+      watermark_logo_url
+    };
+
+    // Handle favicon deletion if empty string or null is provided
+    if (favicon_url === '' || favicon_url === null || favicon_url === undefined) {
+      // Get current favicon path to delete file
+      const currentFaviconSetting = await db('app_settings')
+        .where('setting_key', 'branding_favicon_url')
+        .first();
+      
+      if (currentFaviconSetting && currentFaviconSetting.setting_value) {
+        let currentFaviconUrl;
+        try {
+          // Try to parse as JSON first
+          currentFaviconUrl = JSON.parse(currentFaviconSetting.setting_value);
+        } catch (e) {
+          // If it's not valid JSON, use the raw value
+          currentFaviconUrl = currentFaviconSetting.setting_value;
+        }
+        
+        if (currentFaviconUrl && typeof currentFaviconUrl === 'string' && currentFaviconUrl.startsWith('/uploads/favicons/')) {
+          // Delete the file from filesystem
+          const faviconPath = path.join(__dirname, '..', '..', 'storage', currentFaviconUrl.replace('/uploads/', ''));
+          try {
+            await fs.unlink(faviconPath);
+            console.log('Deleted favicon file:', faviconPath);
+          } catch (err) {
+            console.error('Error deleting favicon file:', err);
+          }
+        }
+      }
+    }
+
+    // Handle logo deletion if empty string or null is provided
+    if (logo_url === '' || logo_url === null || logo_url === undefined) {
+      // Get current logo path to delete file
+      const currentLogoSetting = await db('app_settings')
+        .where('setting_key', 'branding_logo_url')
+        .first();
+      
+      if (currentLogoSetting && currentLogoSetting.setting_value) {
+        let currentLogoUrl;
+        try {
+          // Try to parse as JSON first
+          currentLogoUrl = JSON.parse(currentLogoSetting.setting_value);
+        } catch (e) {
+          // If it's not valid JSON, use the raw value
+          currentLogoUrl = currentLogoSetting.setting_value;
+        }
+        
+        if (currentLogoUrl && typeof currentLogoUrl === 'string' && currentLogoUrl.startsWith('/uploads/logos/')) {
+          // Delete the file from filesystem
+          const logoPath = path.join(__dirname, '..', '..', 'storage', currentLogoUrl.replace('/uploads/', ''));
+          try {
+            await fs.unlink(logoPath);
+            console.log('Deleted logo file:', logoPath);
+          } catch (err) {
+            console.error('Error deleting logo file:', err);
+          }
+        }
+      }
+    }
+
+    // Update or insert each setting
+    for (const [key, value] of Object.entries(brandingSettings)) {
+      await db('app_settings')
+        .insert({
+          setting_key: `branding_${key}`,
+          setting_value: JSON.stringify(value),
+          setting_type: 'branding',
+          updated_at: new Date()
+        })
+        .onConflict('setting_key')
+        .merge({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'branding_updated',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ company_name })
+    });
+
+    res.json({ message: 'Branding settings updated successfully' });
+  } catch (error) {
+    console.error('Branding update error:', error);
+    res.status(500).json({ error: 'Failed to update branding settings' });
+  }
+});
+
+// Upload logo
+router.post('/logo', adminAuth, upload.single('logo'), async (req, res) => {
+  try {
+    if (!req.file) {
+      return res.status(400).json({ error: 'No logo file uploaded' });
+    }
+
+    // Get old logo to delete
+    const oldLogoSetting = await db('app_settings')
+      .where('setting_key', 'branding_logo_path')
+      .first();
+
+    if (oldLogoSetting && oldLogoSetting.setting_value) {
+      const oldPath = JSON.parse(oldLogoSetting.setting_value);
+      try {
+        await fs.unlink(oldPath);
+      } catch (error) {
+        console.error('Failed to delete old logo:', error);
+      }
+    }
+
+    // Save new logo path
+    const logoPath = req.file.path;
+    const publicPath = `/uploads/logos/${req.file.filename}`;
+
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_logo_path',
+        setting_value: JSON.stringify(logoPath),
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: JSON.stringify(logoPath),
+        updated_at: new Date()
+      });
+
+    // Save public URL
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_logo_url',
+        setting_value: publicPath,
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: publicPath,
+        updated_at: new Date()
+      });
+
+    res.json({ 
+      message: 'Logo uploaded successfully',
+      logoUrl: publicPath
+    });
+  } catch (error) {
+    console.error('Logo upload error:', error);
+    res.status(500).json({ error: 'Failed to upload logo' });
+  }
+});
+
+// Upload watermark logo
+router.post('/branding/watermark-logo', adminAuth, upload.single('watermarkLogo'), async (req, res) => {
+  try {
+    if (!req.file) {
+      return res.status(400).json({ error: 'No file uploaded' });
+    }
+
+    // Delete old watermark logo if exists
+    const oldWatermarkLogoSetting = await db('app_settings')
+      .where('setting_key', 'branding_watermark_logo_path')
+      .first();
+
+    if (oldWatermarkLogoSetting && oldWatermarkLogoSetting.setting_value) {
+      const oldPath = JSON.parse(oldWatermarkLogoSetting.setting_value);
+      try {
+        await fs.unlink(oldPath);
+      } catch (error) {
+        console.error('Failed to delete old watermark logo:', error);
+      }
+    }
+
+    // Save new watermark logo path
+    const logoPath = req.file.path;
+    const publicPath = `/uploads/logos/${req.file.filename}`;
+
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_watermark_logo_path',
+        setting_value: JSON.stringify(logoPath),
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: JSON.stringify(logoPath),
+        updated_at: new Date()
+      });
+
+    // Save public URL
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_watermark_logo_url',
+        setting_value: publicPath,
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: publicPath,
+        updated_at: new Date()
+      });
+
+    res.json({ 
+      message: 'Watermark logo uploaded successfully',
+      watermarkLogoUrl: publicPath
+    });
+  } catch (error) {
+    console.error('Watermark logo upload error:', error);
+    res.status(500).json({ error: 'Failed to upload watermark logo' });
+  }
+});
+
+// Update theme settings
+router.put('/theme', adminAuth, async (req, res) => {
+  try {
+    const themeSettings = req.body;
+
+    // Save theme settings
+    await db('app_settings')
+      .insert({
+        setting_key: 'theme_config',
+        setting_value: JSON.stringify(themeSettings),
+        setting_type: 'theme',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: JSON.stringify(themeSettings),
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'theme_updated',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ theme_name: themeSettings.name || 'custom' })
+    });
+
+    res.json({ message: 'Theme settings updated successfully' });
+  } catch (error) {
+    console.error('Theme update error:', error);
+    res.status(500).json({ error: 'Failed to update theme settings' });
+  }
+});
+
+// Update general settings
+router.put('/general', adminAuth, async (req, res) => {
+  try {
+    const settings = req.body;
+
+    // Update or insert each setting
+    for (const [key, value] of Object.entries(settings)) {
+      await db('app_settings')
+        .insert({
+          setting_key: key,
+          setting_value: JSON.stringify(value),
+          setting_type: 'general',
+          updated_at: new Date()
+        })
+        .onConflict('setting_key')
+        .merge({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+    
+    // Clear maintenance mode cache if it was updated
+    if ('general_maintenance_mode' in settings) {
+      clearMaintenanceCache();
+    }
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'general_settings_updated',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ settings_count: Object.keys(settings).length })
+    });
+
+    res.json({ message: 'General settings updated successfully' });
+  } catch (error) {
+    console.error('General settings update error:', error);
+    res.status(500).json({ error: 'Failed to update general settings' });
+  }
+});
+
+// Update security settings
+router.put('/security', adminAuth, async (req, res) => {
+  try {
+    const settings = req.body;
+
+    // Update or insert each setting
+    for (const [key, value] of Object.entries(settings)) {
+      await db('app_settings')
+        .insert({
+          setting_key: key,
+          setting_value: JSON.stringify(value),
+          setting_type: 'security',
+          updated_at: new Date()
+        })
+        .onConflict('setting_key')
+        .merge({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'security_settings_updated',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ settings_count: Object.keys(settings).length })
+    });
+
+    res.json({ message: 'Security settings updated successfully' });
+  } catch (error) {
+    console.error('Security settings update error:', error);
+    res.status(500).json({ error: 'Failed to update security settings' });
+  }
+});
+
+// Get storage info
+router.get('/storage/info', adminAuth, async (req, res) => {
+  try {
+    // Get total storage used
+    const totalStorage = await db('photos')
+      .sum('size_bytes as total')
+      .first();
+
+    // Get storage by event
+    const storageByEvent = await db('photos')
+      .select('events.event_name', 'events.id')
+      .sum('photos.size_bytes as size')
+      .join('events', 'photos.event_id', 'events.id')
+      .groupBy('events.id')
+      .orderBy('size', 'desc')
+      .limit(10);
+
+    // Get archive storage
+    const archives = await db('events')
+      .where('is_archived', formatBoolean(true))
+      .whereNotNull('archive_path')
+      .select('archive_path');
+
+    let archiveStorage = 0;
+    for (const archive of archives) {
+      if (archive.archive_path) {
+        try {
+          const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+          const fullArchivePath = path.join(storagePath, archive.archive_path);
+          const stats = await fs.stat(fullArchivePath);
+          archiveStorage += stats.size;
+        } catch (error) {
+          console.error('Archive file not found:', archive.archive_path, error.message);
+        }
+      }
+    }
+
+    res.json({
+      total_used: totalStorage.total || 0,
+      archive_storage: archiveStorage,
+      storage_by_event: storageByEvent,
+      storage_limit: 10 * 1024 * 1024 * 1024 // 10GB default
+    });
+  } catch (error) {
+    console.error('Storage info error:', error);
+    res.status(500).json({ error: 'Failed to fetch storage information' });
+  }
+});
+
+// Upload favicon endpoint
+router.post('/favicon', adminAuth, faviconUpload.single('favicon'), async (req, res) => {
+  try {
+    if (!req.file) {
+      return res.status(400).json({ error: 'No favicon file provided' });
+    }
+
+    // The file is already in the correct location from multer
+    const faviconUrl = `/uploads/favicons/${req.file.filename}`;
+    
+    // Save to database
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_favicon_url',
+        setting_value: faviconUrl,
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: faviconUrl,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity('favicon_uploaded', 
+      { faviconUrl }, 
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ faviconUrl });
+  } catch (error) {
+    console.error('Error uploading favicon:', error);
+    res.status(500).json({ error: 'Failed to upload favicon' });
+  }
+});
+
+// Update rate limit settings
+router.put('/security/rate-limit', adminAuth, [
+  body('rate_limit_enabled').isBoolean().withMessage('Enabled must be a boolean'),
+  body('rate_limit_window_minutes').isInt({ min: 1, max: 60 }).withMessage('Window must be between 1 and 60 minutes'),
+  body('rate_limit_max_requests').isInt({ min: 10, max: 10000 }).withMessage('Max requests must be between 10 and 10000'),
+  body('rate_limit_auth_max_requests').isInt({ min: 1, max: 100 }).withMessage('Auth max requests must be between 1 and 100'),
+  body('rate_limit_skip_authenticated').isBoolean().withMessage('Skip authenticated must be a boolean'),
+  body('rate_limit_public_endpoints_only').isBoolean().withMessage('Public endpoints only must be a boolean')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const {
+      rate_limit_enabled,
+      rate_limit_window_minutes,
+      rate_limit_max_requests,
+      rate_limit_auth_max_requests,
+      rate_limit_skip_authenticated,
+      rate_limit_public_endpoints_only
+    } = req.body;
+
+    // Update each setting
+    const settings = [
+      { key: 'rate_limit_enabled', value: rate_limit_enabled },
+      { key: 'rate_limit_window_minutes', value: rate_limit_window_minutes },
+      { key: 'rate_limit_max_requests', value: rate_limit_max_requests },
+      { key: 'rate_limit_auth_max_requests', value: rate_limit_auth_max_requests },
+      { key: 'rate_limit_skip_authenticated', value: rate_limit_skip_authenticated },
+      { key: 'rate_limit_public_endpoints_only', value: rate_limit_public_endpoints_only }
+    ];
+
+    for (const { key, value } of settings) {
+      await db('app_settings')
+        .where('setting_key', key)
+        .update({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+
+    // Clear the rate limit settings cache to apply changes immediately
+    clearSettingsCache();
+
+    // Log activity
+    await logActivity('settings_updated', 
+      { 
+        category: 'security',
+        subcategory: 'rate_limit',
+        changes: settings.length
+      },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Rate limit settings updated successfully' });
+  } catch (error) {
+    console.error('Rate limit settings update error:', error);
+    res.status(500).json({ error: 'Failed to update rate limit settings' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminSystem.js

@@ -0,0 +1,229 @@
+const express = require('express');
+const { db } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const fs = require('fs').promises;
+const path = require('path');
+const os = require('os');
+const { formatBoolean } = require('../utils/dbCompat');
+const router = express.Router();
+
+// Get system version
+router.get('/version', adminAuth, async (req, res) => {
+  try {
+    // Read backend version from package.json
+    let backendVersion = '1.0.0';
+    try {
+      const packagePath = path.join(__dirname, '../../package.json');
+      const packageContent = await fs.readFile(packagePath, 'utf8');
+      const packageJson = JSON.parse(packageContent);
+      backendVersion = packageJson.version || '1.0.0';
+    } catch (err) {
+      console.error('Could not read package.json:', err);
+    }
+    
+    res.json({
+      backend: backendVersion,
+      frontend: '1.0.0', // This will be set by frontend
+      node: process.version,
+      environment: process.env.NODE_ENV || 'production'
+    });
+  } catch (error) {
+    console.error('Error fetching version:', error);
+    res.status(500).json({ error: 'Failed to fetch version information' });
+  }
+});
+
+// Get comprehensive system status
+router.get('/status', adminAuth, async (req, res) => {
+  try {
+    // Database size - check if PostgreSQL or SQLite
+    let dbSize = 0;
+    const dbClient = process.env.DATABASE_CLIENT || 'sqlite3';
+    
+    if (dbClient === 'pg') {
+      // PostgreSQL - query database size
+      try {
+        const dbName = process.env.DB_NAME || 'picpeak';
+        const result = await db.raw(`
+          SELECT pg_database_size(?) as size
+        `, [dbName]);
+        dbSize = result.rows[0]?.size || 0;
+      } catch (error) {
+        console.error('Error getting PostgreSQL database size:', error);
+      }
+    } else {
+      // SQLite - check file size
+      const dbPath = path.join(__dirname, '../../data/photo_sharing.db');
+      try {
+        const stats = await fs.stat(dbPath);
+        dbSize = stats.size;
+      } catch (error) {
+        console.error('Error getting SQLite database size:', error);
+      }
+    }
+
+    // Count various entities
+    const [eventsCount] = await db('events').count('* as count');
+    const [photosCount] = await db('photos').count('* as count');
+    const [adminsCount] = await db('admin_users').count('* as count');
+    const [categoriesCount] = await db('photo_categories').count('* as count');
+    
+    // Email queue status
+    const [pendingEmails] = await db('email_queue').where('status', 'pending').count('* as count');
+    const [processableEmails] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .count('* as count');
+    const [sentEmails] = await db('email_queue').where('status', 'sent').count('* as count');
+    const [failedEmails] = await db('email_queue').where('status', 'failed').count('* as count');
+    const [stuckEmails] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '>=', 3)
+      .count('* as count');
+
+    // Activity logs count
+    const [activityCount] = await db('activity_logs').count('* as count');
+    
+    // Storage info
+    const [{ totalPhotoStorage }] = await db('photos')
+      .sum('size_bytes as totalPhotoStorage');
+
+    const archives = await db('events')
+      .where('is_archived', formatBoolean(true))
+      .whereNotNull('archive_path')
+      .select('archive_path');
+
+    let archiveStorage = 0;
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    
+    for (const archive of archives) {
+      if (archive.archive_path) {
+        try {
+          const fullArchivePath = path.join(storagePath, archive.archive_path);
+          const stats = await fs.stat(fullArchivePath);
+          archiveStorage += stats.size;
+        } catch (error) {
+          console.error('Archive file not found:', archive.archive_path);
+        }
+      }
+    }
+
+    const totalStorage = (parseInt(totalPhotoStorage) || 0) + archiveStorage;
+    
+    // System info
+    const systemInfo = {
+      platform: os.platform(),
+      arch: os.arch(),
+      hostname: os.hostname(),
+      uptime: Math.floor(process.uptime()),
+      nodeVersion: process.version,
+      memory: {
+        total: os.totalmem(),
+        free: os.freemem(),
+        used: os.totalmem() - os.freemem()
+      },
+      cpu: {
+        model: os.cpus()[0]?.model || 'Unknown',
+        cores: os.cpus().length
+      }
+    };
+
+    // Build response
+    const status = {
+      database: {
+        size: dbSize,
+        tables: {
+          events: eventsCount.count,
+          photos: photosCount.count,
+          admins: adminsCount.count,
+          categories: categoriesCount.count,
+          activityLogs: activityCount.count
+        }
+      },
+      storage: {
+        totalUsed: totalStorage,
+        photoStorage: parseInt(totalPhotoStorage) || 0,
+        archiveStorage: archiveStorage
+      },
+      emailQueue: {
+        pending: pendingEmails.count,
+        processable: processableEmails.count,
+        stuck: stuckEmails.count,
+        sent: sentEmails.count,
+        failed: failedEmails.count
+      },
+      system: systemInfo,
+      services: {
+        fileWatcher: { status: 'active' }, // These would ideally check actual service status
+        expirationChecker: { status: 'active' },
+        emailProcessor: { status: 'active' }
+      },
+      timestamp: new Date()
+    };
+
+    res.json(status);
+  } catch (error) {
+    console.error('Error fetching system status:', error);
+    res.status(500).json({ error: 'Failed to fetch system status' });
+  }
+});
+
+// Get database statistics
+router.get('/database', adminAuth, async (req, res) => {
+  try {
+    // Get table info
+    const tables = [
+      'events', 'photos', 'admin_users', 'photo_categories', 
+      'cms_pages', 'email_templates', 'email_queue', 'activity_logs',
+      'app_settings', 'email_configs', 'access_logs', 'migrations'
+    ];
+    
+    const tableInfo = [];
+    
+    for (const table of tables) {
+      try {
+        const [count] = await db(table).count('* as count');
+        
+        // Get last update time
+        let lastUpdate = null;
+        try {
+          const lastRow = await db(table)
+            .orderBy('updated_at', 'desc')
+            .orOrderBy('created_at', 'desc')
+            .orOrderBy('timestamp', 'desc')
+            .orOrderBy('applied_at', 'desc')
+            .first();
+          
+          if (lastRow) {
+            lastUpdate = lastRow.updated_at || lastRow.created_at || lastRow.timestamp || lastRow.applied_at;
+          }
+        } catch (e) {
+          // Table might not have timestamp columns
+        }
+        
+        tableInfo.push({
+          name: table,
+          rows: count.count,
+          lastUpdate
+        });
+      } catch (error) {
+        // Table might not exist
+        tableInfo.push({
+          name: table,
+          rows: 0,
+          error: error.message
+        });
+      }
+    }
+    
+    res.json({
+      tables: tableInfo,
+      timestamp: new Date()
+    });
+  } catch (error) {
+    console.error('Error fetching database info:', error);
+    res.status(500).json({ error: 'Failed to fetch database information' });
+  }
+});
+
+module.exports = router;

backend/src/routes/auth-enhanced-v2.js

@@ -0,0 +1,375 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { body, validationResult } = require('express-validator');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { verifyRecaptcha } = require('../services/recaptcha');
+const { 
+  trackFailedAttempt,
+  trackSuccessfulLogin,
+  checkAccountLockout,
+  checkSuspiciousActivity,
+  getGenericAuthError
+} = require('../utils/authSecurity');
+const { 
+  validatePasswordInContext,
+  getBcryptRounds,
+  logPasswordValidationFailure
+} = require('../utils/passwordValidation');
+const { endSession } = require('../middleware/sessionTimeout');
+const logger = require('../utils/logger');
+const router = express.Router();
+
+// Admin login with enhanced security
+router.post('/admin/login', [
+  body('username').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { username, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check account lockout first
+    const lockoutStatus = await checkAccountLockout(username);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Login attempt on locked account', { username, ipAddress });
+      return res.status(423).json({ 
+        error: 'Account temporarily locked due to too many failed attempts',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    // Check for suspicious activity
+    const isSuspicious = await checkSuspiciousActivity(username, ipAddress);
+    if (isSuspicious) {
+      // Still allow login but log it
+      logger.warn('Suspicious login pattern detected', { username, ipAddress });
+    }
+    
+    const admin = await db('admin_users')
+      .where({ username })
+      .orWhere({ email: username })
+      .first();
+    
+    // Use generic error to prevent user enumeration
+    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    if (!admin.is_active) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    // Successful login
+    await trackSuccessfulLogin(username, ipAddress, userAgent);
+    
+    // Update last login and login metadata
+    await db('admin_users').where('id', admin.id).update({ 
+      last_login: new Date(),
+      last_login_ip: ipAddress
+    });
+    
+    // Generate token with additional claims
+    const token = jwt.sign({ 
+      id: admin.id,
+      username: admin.username,
+      type: 'admin',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      user: {
+        id: admin.id,
+        username: admin.username,
+        email: admin.email,
+        mustChangePassword: admin.must_change_password || false
+      }
+    });
+  } catch (error) {
+    logger.error('Login error:', error);
+    res.status(500).json({ error: 'Login failed' });
+  }
+});
+
+// Admin password change with validation
+router.post('/admin/change-password', [
+  body('currentPassword').notEmpty(),
+  body('newPassword').notEmpty(),
+  body('confirmPassword').notEmpty()
+    .custom((value, { req }) => value === req.body.newPassword)
+    .withMessage('Passwords do not match')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { currentPassword, newPassword } = req.body;
+    const adminId = req.admin.id; // From auth middleware
+    
+    // Get admin user
+    const admin = await db('admin_users').where({ id: adminId }).first();
+    if (!admin) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    
+    // Verify current password
+    const validPassword = await bcrypt.compare(currentPassword, admin.password_hash);
+    if (!validPassword) {
+      return res.status(401).json({ error: 'Current password is incorrect' });
+    }
+    
+    // Validate new password
+    const passwordValidation = validatePasswordInContext(newPassword, 'admin', {
+      username: admin.username,
+      email: admin.email
+    });
+    
+    if (!passwordValidation.valid) {
+      logPasswordValidationFailure('admin_password_change', passwordValidation.errors, {
+        userId: adminId,
+        username: admin.username
+      });
+      
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.errors,
+        score: passwordValidation.score,
+        feedback: passwordValidation.feedback
+      });
+    }
+    
+    // Hash new password with configurable rounds
+    const hashedPassword = await bcrypt.hash(newPassword, getBcryptRounds());
+    
+    // Update password and track change time
+    await db('admin_users').where('id', adminId).update({
+      password_hash: hashedPassword,
+      password_changed_at: new Date(),
+      must_change_password: false
+    });
+    
+    // Log password change
+    logger.info('Admin password changed', {
+      userId: adminId,
+      username: admin.username,
+      ip: req.ip
+    });
+    
+    res.json({ 
+      message: 'Password changed successfully',
+      score: passwordValidation.score
+    });
+  } catch (error) {
+    logger.error('Password change error:', error);
+    res.status(500).json({ error: 'Failed to change password' });
+  }
+});
+
+// Logout endpoint
+router.post('/logout', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (token) {
+      // End the session
+      endSession(token);
+      
+      // Log the logout
+      try {
+        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+        logger.info('User logged out', { 
+          userId: decoded.id,
+          username: decoded.username,
+          type: decoded.type
+        });
+      } catch (err) {
+        // Token might be invalid, but still process logout
+      }
+    }
+    
+    res.json({ message: 'Logged out successfully' });
+  } catch (error) {
+    logger.error('Logout error:', error);
+    res.status(500).json({ error: 'Logout failed' });
+  }
+});
+
+// Gallery password verification with enhanced security
+router.post('/gallery/verify', [
+  body('slug').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { slug, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check gallery-specific lockout
+    const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
+      return res.status(423).json({ 
+        error: 'Too many failed attempts. Please try again later.',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
+    if (!event) {
+      // Don't reveal if gallery exists
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    const validPassword = await bcrypt.compare(password, event.password_hash);
+    if (!validPassword) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      await db('access_logs').insert({
+        event_id: event.id,
+        ip_address: ipAddress,
+        user_agent: userAgent,
+        action: 'login_fail'
+      });
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    // Successful access
+    await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
+    
+    // Log successful access
+    await db('access_logs').insert({
+      event_id: event.id,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      action: 'login_success'
+    });
+    
+    // Generate session token with additional security info
+    const token = jwt.sign({ 
+      eventId: event.id, 
+      eventSlug: event.slug,
+      type: 'gallery',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      event: {
+        id: event.id,
+        event_name: event.event_name,
+        event_type: event.event_type,
+        event_date: event.event_date,
+        welcome_message: event.welcome_message,
+        color_theme: event.color_theme,
+        expires_at: event.expires_at,
+        allow_user_uploads: event.allow_user_uploads,
+        upload_category_id: event.upload_category_id
+      }
+    });
+  } catch (error) {
+    logger.error('Gallery verification error:', error);
+    res.status(500).json({ error: 'Verification failed' });
+  }
+});
+
+// Get current session info
+router.get('/session', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    try {
+      const decoded = jwt.verify(token, process.env.JWT_SECRET);
+      
+      // Calculate remaining time
+      const now = Date.now() / 1000;
+      const remainingTime = Math.max(0, decoded.exp - now);
+      
+      res.json({
+        valid: true,
+        type: decoded.type,
+        expiresIn: Math.floor(remainingTime),
+        user: decoded.username || decoded.eventSlug
+      });
+    } catch (err) {
+      res.json({
+        valid: false,
+        error: 'Invalid or expired token'
+      });
+    }
+  } catch (error) {
+    res.status(500).json({ error: 'Session check failed' });
+  }
+});
+
+// Password strength check endpoint (for real-time validation)
+router.post('/password-strength', [
+  body('password').notEmpty(),
+  body('context').isIn(['admin', 'gallery']).optional()
+], async (req, res) => {
+  try {
+    const { password, context = 'gallery' } = req.body;
+    
+    // Get user data if available (for context-aware validation)
+    const userData = {};
+    if (context === 'admin' && req.admin) {
+      userData.username = req.admin.username;
+      userData.email = req.admin.email;
+    }
+    
+    const validation = validatePasswordInContext(password, context, userData);
+    
+    res.json({
+      valid: validation.valid,
+      score: validation.score,
+      errors: validation.errors,
+      feedback: validation.feedback
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to check password strength' });
+  }
+});
+
+module.exports = router;

backend/src/routes/auth-enhanced.js

@@ -0,0 +1,266 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { body, validationResult } = require('express-validator');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { verifyRecaptcha } = require('../services/recaptcha');
+const { 
+  trackFailedAttempt,
+  trackSuccessfulLogin,
+  checkAccountLockout,
+  checkSuspiciousActivity,
+  getGenericAuthError
+} = require('../utils/authSecurity');
+const { endSession } = require('../middleware/sessionTimeout');
+const logger = require('../utils/logger');
+const router = express.Router();
+
+// Admin login with enhanced security
+router.post('/admin/login', [
+  body('username').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { username, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check account lockout first
+    const lockoutStatus = await checkAccountLockout(username);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Login attempt on locked account', { username, ipAddress });
+      return res.status(423).json({ 
+        error: 'Account temporarily locked due to too many failed attempts',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    // Check for suspicious activity
+    const isSuspicious = await checkSuspiciousActivity(username, ipAddress);
+    if (isSuspicious) {
+      // Still allow login but log it
+      logger.warn('Suspicious login pattern detected', { username, ipAddress });
+    }
+    
+    const admin = await db('admin_users')
+      .where({ username })
+      .orWhere({ email: username })
+      .first();
+    
+    // Use generic error to prevent user enumeration
+    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    if (!admin.is_active) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    // Successful login
+    await trackSuccessfulLogin(username, ipAddress, userAgent);
+    
+    // Update last login and login metadata
+    await db('admin_users').where('id', admin.id).update({ 
+      last_login: new Date(),
+      last_login_ip: ipAddress
+    });
+    
+    // Generate token with additional claims
+    const token = jwt.sign({ 
+      id: admin.id,
+      username: admin.username,
+      type: 'admin',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      user: {
+        id: admin.id,
+        username: admin.username,
+        email: admin.email,
+        mustChangePassword: admin.must_change_password || false
+      }
+    });
+  } catch (error) {
+    logger.error('Login error:', error);
+    res.status(500).json({ error: 'Login failed' });
+  }
+});
+
+// Logout endpoint
+router.post('/logout', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (token) {
+      // End the session
+      endSession(token);
+      
+      // Log the logout
+      try {
+        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+        logger.info('User logged out', { 
+          userId: decoded.id,
+          username: decoded.username,
+          type: decoded.type
+        });
+      } catch (err) {
+        // Token might be invalid, but still process logout
+      }
+    }
+    
+    res.json({ message: 'Logged out successfully' });
+  } catch (error) {
+    logger.error('Logout error:', error);
+    res.status(500).json({ error: 'Logout failed' });
+  }
+});
+
+// Gallery password verification with enhanced security
+router.post('/gallery/verify', [
+  body('slug').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { slug, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check gallery-specific lockout
+    const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
+      return res.status(423).json({ 
+        error: 'Too many failed attempts. Please try again later.',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
+    if (!event) {
+      // Don't reveal if gallery exists
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    const validPassword = await bcrypt.compare(password, event.password_hash);
+    if (!validPassword) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      await db('access_logs').insert({
+        event_id: event.id,
+        ip_address: ipAddress,
+        user_agent: userAgent,
+        action: 'login_fail'
+      });
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    // Successful access
+    await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
+    
+    // Log successful access
+    await db('access_logs').insert({
+      event_id: event.id,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      action: 'login_success'
+    });
+    
+    // Generate session token with additional security info
+    const token = jwt.sign({ 
+      eventId: event.id, 
+      eventSlug: event.slug,
+      type: 'gallery',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      event: {
+        id: event.id,
+        event_name: event.event_name,
+        event_type: event.event_type,
+        event_date: event.event_date,
+        welcome_message: event.welcome_message,
+        color_theme: event.color_theme,
+        expires_at: event.expires_at,
+        allow_user_uploads: event.allow_user_uploads,
+        upload_category_id: event.upload_category_id
+      }
+    });
+  } catch (error) {
+    logger.error('Gallery verification error:', error);
+    res.status(500).json({ error: 'Verification failed' });
+  }
+});
+
+// Get current session info
+router.get('/session', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    try {
+      const decoded = jwt.verify(token, process.env.JWT_SECRET);
+      
+      // Calculate remaining time
+      const now = Date.now() / 1000;
+      const remainingTime = Math.max(0, decoded.exp - now);
+      
+      res.json({
+        valid: true,
+        type: decoded.type,
+        expiresIn: Math.floor(remainingTime),
+        user: decoded.username || decoded.eventSlug
+      });
+    } catch (err) {
+      res.json({
+        valid: false,
+        error: 'Invalid or expired token'
+      });
+    }
+  } catch (error) {
+    res.status(500).json({ error: 'Session check failed' });
+  }
+});
+
+module.exports = router;

backend/src/routes/auth.js

@@ -0,0 +1,131 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { body, validationResult } = require('express-validator');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { verifyRecaptcha } = require('../services/recaptcha');
+const router = express.Router();
+
+// Admin login
+router.post('/admin/login', [
+  body('username').notEmpty(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { username, password, recaptchaToken } = req.body;
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    const admin = await db('admin_users')
+      .where({ username })
+      .orWhere({ email: username })
+      .first();
+    
+    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
+      return res.status(401).json({ error: 'Invalid credentials' });
+    }
+    
+    if (!admin.is_active) {
+      return res.status(401).json({ error: 'Account disabled' });
+    }
+    
+    // Update last login
+    await db('admin_users').where('id', admin.id).update({ last_login: new Date() });
+    
+    const token = jwt.sign({ id: admin.id, type: 'admin' }, process.env.JWT_SECRET, { expiresIn: '24h' });
+    
+    res.json({
+      token,
+      user: {
+        id: admin.id,
+        username: admin.username,
+        email: admin.email,
+        mustChangePassword: admin.must_change_password || false
+      }
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Login failed' });
+  }
+});
+
+// Gallery password verification
+router.post('/gallery/verify', [
+  body('slug').notEmpty(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { slug, password, recaptchaToken } = req.body;
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    const validPassword = await bcrypt.compare(password, event.password_hash);
+    if (!validPassword) {
+      await db('access_logs').insert({
+        event_id: event.id,
+        ip_address: req.ip,
+        user_agent: req.headers['user-agent'],
+        action: 'login_fail'
+      });
+      return res.status(401).json({ error: 'Invalid password' });
+    }
+    
+    // Log successful access
+    await db('access_logs').insert({
+      event_id: event.id,
+      ip_address: req.ip,
+      user_agent: req.headers['user-agent'],
+      action: 'login_success'
+    });
+    
+    // Generate session token
+    const token = jwt.sign({ 
+      eventId: event.id, 
+      eventSlug: event.slug,
+      type: 'gallery' 
+    }, process.env.JWT_SECRET, { expiresIn: '24h' });
+    
+    res.json({
+      token,
+      event: {
+        id: event.id,
+        event_name: event.event_name,
+        event_type: event.event_type,
+        event_date: event.event_date,
+        welcome_message: event.welcome_message,
+        color_theme: event.color_theme,
+        expires_at: event.expires_at,
+        allow_user_uploads: event.allow_user_uploads,
+        upload_category_id: event.upload_category_id,
+        hero_photo_id: event.hero_photo_id
+      }
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Verification failed' });
+  }
+});
+
+module.exports = router;

backend/src/routes/events.js

@@ -0,0 +1,201 @@
+const express = require('express');
+const { body, validationResult } = require('express-validator');
+const bcrypt = require('bcrypt');
+const crypto = require('crypto');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const fs = require('fs').promises;
+const path = require('path');
+const router = express.Router();
+
+// Create new event
+router.post('/', adminAuth, [
+  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
+  body('event_name').notEmpty(),
+  body('event_date').isDate(),
+  body('host_email').isEmail(),
+  body('admin_email').isEmail(),
+  body('password').isLength({ min: 6 }),
+  body('expiration_days').isInt({ min: 1, max: 365 }).optional()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const {
+      event_type,
+      event_name,
+      event_date,
+      host_email,
+      admin_email,
+      password,
+      welcome_message,
+      color_theme,
+      expiration_days = 30
+    } = req.body;
+    
+    // Generate unique slug
+    const baseSlug = `${event_type}-${event_name.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${event_date}`;
+    let slug = baseSlug;
+    let counter = 1;
+    
+    while (await db('events').where({ slug }).first()) {
+      slug = `${baseSlug}-${counter}`;
+      counter++;
+    }
+    
+    // Generate share link
+    const shareToken = crypto.randomBytes(16).toString('hex');
+    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    
+    // Hash password
+    const password_hash = await bcrypt.hash(password, 10);
+    
+    // Calculate expiration date (days after event date)
+    const expires_at = new Date(event_date);
+    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
+    
+    // Create folder structure
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const eventPath = path.join(storagePath, 'events/active', slug);
+    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
+    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
+    
+    // Insert into database
+    const insertResult = await db('events').insert({
+      slug,
+      event_type,
+      event_name,
+      event_date,
+      host_email,
+      admin_email,
+      password_hash,
+      welcome_message,
+      color_theme,
+      share_link: shareLink,
+      expires_at
+    }).returning('id');
+    
+    // Handle both PostgreSQL (returns array of objects) and SQLite (returns array of IDs)
+    const eventId = insertResult[0]?.id || insertResult[0];
+    
+    // Queue creation email
+    const { queueEmail } = require('../services/emailProcessor');
+    await queueEmail(eventId, host_email, 'gallery_created', {
+      host_name: host_email.split('@')[0], // Extract name from email
+      event_name,
+      event_date: event_date,  // Pass raw date - will be formatted by email processor
+      gallery_link: shareLink,
+      gallery_password: password,
+      expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
+      welcome_message: welcome_message || ''
+    });
+    
+    res.json({
+      id: eventId,
+      slug,
+      share_link: shareLink,
+      expires_at
+    });
+  } catch (error) {
+    console.error(error);
+    res.status(500).json({ error: 'Failed to create event' });
+  }
+});
+
+// Get all events (admin)
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const { status = 'all' } = req.query;
+    
+    let query = db('events').select('*');
+    
+    if (status === 'active') {
+      query = query.where('is_active', formatBoolean(true));
+    } else if (status === 'archived') {
+      query = query.where('is_archived', formatBoolean(true));
+    }
+    
+    const events = await query.orderBy('created_at', 'desc');
+    
+    // Add photo counts
+    for (const event of events) {
+      const photoCount = await db('photos').where('event_id', event.id).count('id as count').first();
+      event.photo_count = photoCount.count;
+    }
+    
+    res.json(events);
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to fetch events' });
+  }
+});
+
+// Update event
+router.put('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    const updates = req.body;
+    
+    // Don't allow updating certain fields
+    delete updates.id;
+    delete updates.slug;
+    delete updates.created_at;
+    
+    // If updating password, hash it
+    if (updates.password) {
+      updates.password_hash = await bcrypt.hash(updates.password, 10);
+      delete updates.password;
+    }
+    
+    await db('events').where('id', id).update(updates);
+    
+    res.json({ success: true });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to update event' });
+  }
+});
+
+// Delete event (mark as inactive)
+router.delete('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    await db('events').where('id', id).update({ is_active: formatBoolean(false) });
+    
+    res.json({ success: true });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to delete event' });
+  }
+});
+
+// Extend expiration
+router.post('/:id/extend', adminAuth, [
+  body('days').isInt({ min: 1, max: 365 })
+], async (req, res) => {
+  try {
+    const { id } = req.params;
+    const { days } = req.body;
+    
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+    
+    const newExpiration = new Date(event.expires_at);
+    newExpiration.setDate(newExpiration.getDate() + days);
+    
+    await db('events').where('id', id).update({ 
+      expires_at: newExpiration,
+      is_active: formatBoolean(true) // Reactivate if expired
+    });
+    
+    res.json({ expires_at: newExpiration });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to extend expiration' });
+  }
+});
+
+module.exports = router;

backend/src/routes/gallery.js

@@ -0,0 +1,467 @@
+const express = require('express');
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const archiver = require('archiver');
+const path = require('path');
+const router = express.Router();
+const watermarkService = require('../services/watermarkService');
+const { verifyGalleryAccess } = require('../middleware/gallery');
+
+// Get storage path from environment or default
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+// Verify share token
+router.get('/:slug/verify-token/:token', async (req, res) => {
+  try {
+    const { slug, token } = req.params;
+    
+    const event = await db('events')
+      .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
+      .select('id', 'share_link')
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found' });
+    }
+    
+    // Extract token from share link and verify
+    const expectedToken = event.share_link.split('/').pop();
+    if (token !== expectedToken) {
+      return res.status(404).json({ error: 'Invalid gallery link' });
+    }
+    
+    res.json({ valid: true });
+  } catch (error) {
+    console.error('Error verifying token:', error);
+    res.status(500).json({ error: 'Failed to verify token', details: error.message });
+  }
+});
+
+// Get gallery info (with optional token verification)
+router.get('/:slug/info', async (req, res) => {
+  try {
+    const { slug } = req.params;
+    const { token } = req.query;
+    
+    const event = await db('events')
+      .where({ slug })
+      .select('event_name', 'event_type', 'event_date', 'expires_at', 'is_active', 'is_archived', 'share_link')
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found' });
+    }
+    
+    // Check if event is archived
+    if (event.is_archived) {
+      return res.status(404).json({ error: 'Gallery has been archived and is no longer available' });
+    }
+    
+    // If token provided, verify it matches the share link
+    if (token) {
+      let expectedToken = event.share_link;
+      // Handle both formats: full URL or just token
+      if (event.share_link && event.share_link.includes('/')) {
+        expectedToken = event.share_link.split('/').pop();
+      }
+      if (token !== expectedToken) {
+        return res.status(404).json({ error: 'Invalid gallery link' });
+      }
+    }
+    
+    res.json({
+      event_name: event.event_name,
+      event_type: event.event_type,
+      event_date: event.event_date,
+      expires_at: event.expires_at,
+      is_active: event.is_active,
+      is_expired: !event.is_active || new Date(event.expires_at) < new Date(),
+      requires_password: true,
+      color_theme: event.color_theme
+    });
+  } catch (error) {
+    console.error('Error fetching gallery info:', error);
+    res.status(500).json({ error: 'Failed to fetch gallery info', details: error.message });
+  }
+});
+
+// Get all photos
+router.get('/:slug/photos', verifyGalleryAccess, async (req, res) => {
+  try {
+    const photos = await db('photos')
+      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
+      .where('photos.event_id', req.event.id)
+      .select(
+        'photos.*',
+        'photo_categories.name as category_name',
+        'photo_categories.slug as category_slug'
+      )
+      .orderBy('photos.uploaded_at', 'desc');
+    
+    // Get all categories for this event
+    const categories = await db('photo_categories')
+      .where(function() {
+        this.where('is_global', formatBoolean(true))
+          .orWhere('event_id', req.event.id);
+      })
+      .orderBy('is_global', 'desc')
+      .orderBy('name', 'asc');
+    
+    // Log view
+    await db('access_logs').insert({
+      event_id: req.event.id,
+      ip_address: req.ip,
+      user_agent: req.headers['user-agent'],
+      action: 'view'
+    });
+    
+    res.json({
+      event: {
+        id: req.event.id,
+        event_name: req.event.event_name,
+        event_type: req.event.event_type,
+        event_date: req.event.event_date,
+        welcome_message: req.event.welcome_message,
+        color_theme: req.event.color_theme,
+        expires_at: req.event.expires_at,
+        hero_photo_id: req.event.hero_photo_id
+      },
+      categories: categories.map(cat => ({
+        id: cat.id,
+        name: cat.name,
+        slug: cat.slug,
+        is_global: cat.is_global
+      })),
+      photos: photos.map(photo => ({
+        id: photo.id,
+        filename: photo.filename,
+        url: `/api/gallery/${req.params.slug}/photo/${photo.id}`,
+        thumbnail_url: photo.thumbnail_path ? `/api/gallery/${req.params.slug}/thumbnail/${photo.id}` : null,
+        type: photo.type,
+        category_id: photo.category_id,
+        category_name: photo.category_name,
+        category_slug: photo.category_slug,
+        size: photo.size_bytes,
+        uploaded_at: photo.uploaded_at
+      }))
+    });
+  } catch (error) {
+    console.error('Error fetching photos:', error);
+    res.status(500).json({ error: 'Failed to fetch photos', details: error.message });
+  }
+});
+
+// Download single photo
+router.get('/:slug/download/:photoId', verifyGalleryAccess, async (req, res) => {
+  try {
+    const { photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: req.event.id })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Update download count
+    await db('photos').where('id', photoId).increment('download_count', 1);
+    
+    // Log download
+    await db('access_logs').insert({
+      event_id: req.event.id,
+      ip_address: req.ip,
+      user_agent: req.headers['user-agent'],
+      action: 'download',
+      photo_id: photoId
+    });
+    
+    const filePath = path.join(getStoragePath(), 'events/active', photo.path);
+    
+    // Get watermark settings
+    const watermarkSettings = await watermarkService.getWatermarkSettings();
+    
+    if (watermarkSettings && watermarkSettings.enabled) {
+      // Apply watermark and send
+      const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
+      
+      res.set({
+        'Content-Type': photo.mime_type || 'image/jpeg',
+        'Content-Disposition': `attachment; filename="${photo.filename}"`,
+        'Content-Length': watermarkedBuffer.length
+      });
+      
+      res.send(watermarkedBuffer);
+    } else {
+      // Send original file
+      res.download(filePath, photo.filename);
+    }
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to download photo' });
+  }
+});
+
+// Download all photos as ZIP
+router.get('/:slug/download-all', verifyGalleryAccess, async (req, res) => {
+  try {
+    // Fetch photos with category information
+    const photos = await db('photos')
+      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
+      .where('photos.event_id', req.event.id)
+      .select(
+        'photos.*',
+        'photo_categories.name as category_name',
+        'photo_categories.slug as category_slug'
+      )
+      .orderBy('photo_categories.name', 'asc')
+      .orderBy('photos.uploaded_at', 'desc');
+    
+    if (photos.length === 0) {
+      return res.status(404).json({ error: 'No photos found' });
+    }
+    
+    // Count unique categories (excluding null)
+    const uniqueCategories = new Set(photos.filter(p => p.category_id).map(p => p.category_id)).size;
+    const hasMultipleCategories = uniqueCategories > 1;
+    
+    res.setHeader('Content-Type', 'application/zip');
+    res.setHeader('Content-Disposition', `attachment; filename="${req.event.slug}.zip"`);
+    
+    const archive = archiver('zip', { zlib: { level: 5 } });
+    archive.on('error', (err) => {
+      throw err;
+    });
+    
+    archive.pipe(res);
+    
+    // Get watermark settings
+    const watermarkSettings = await watermarkService.getWatermarkSettings();
+    
+    // Add photos to archive
+    for (const photo of photos) {
+      const filePath = path.join(getStoragePath(), 'events/active', photo.path);
+      
+      // Determine the file name in the archive
+      let archiveName;
+      if (hasMultipleCategories) {
+        if (photo.category_name) {
+          // Use category name as folder (sanitize for filesystem)
+          const folderName = photo.category_name.replace(/[^a-zA-Z0-9-_ ]/g, '').trim();
+          archiveName = path.join(folderName, photo.filename);
+        } else {
+          // Put uncategorized photos in 'Uncategorized' folder
+          archiveName = path.join('Uncategorized', photo.filename);
+        }
+      } else {
+        // No folders, just the filename
+        archiveName = photo.filename;
+      }
+      
+      if (watermarkSettings && watermarkSettings.enabled) {
+        // Apply watermark
+        const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
+        archive.append(watermarkedBuffer, { name: archiveName });
+      } else {
+        // Add original file
+        archive.file(filePath, { name: archiveName });
+      }
+    }
+    
+    await archive.finalize();
+    
+    // Log bulk download
+    await db('access_logs').insert({
+      event_id: req.event.id,
+      ip_address: req.ip,
+      user_agent: req.headers['user-agent'],
+      action: 'download_all'
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to create download archive' });
+  }
+});
+
+// View single photo (with watermark if enabled)
+router.get('/:slug/photo/:photoId', verifyGalleryAccess, async (req, res) => {
+  try {
+    const { photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: req.event.id })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    const filePath = path.join(getStoragePath(), 'events/active', photo.path);
+    
+    // Get watermark settings
+    const watermarkSettings = await watermarkService.getWatermarkSettings();
+    
+    if (watermarkSettings && watermarkSettings.enabled) {
+      // Apply watermark and send
+      const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
+      
+      res.set({
+        'Content-Type': photo.mime_type || 'image/jpeg',
+        'Cache-Control': 'public, max-age=3600' // Cache for 1 hour
+      });
+      
+      res.send(watermarkedBuffer);
+    } else {
+      // Send original file
+      res.sendFile(filePath);
+    }
+  } catch (error) {
+    console.error('Error serving photo:', error);
+    res.status(500).json({ error: 'Failed to serve photo' });
+  }
+});
+
+// Serve thumbnail
+router.get('/:slug/thumbnail/:photoId', verifyGalleryAccess, async (req, res) => {
+  try {
+    const { photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: req.event.id })
+      .first();
+    
+    if (!photo || !photo.thumbnail_path) {
+      return res.status(404).json({ error: 'Thumbnail not found' });
+    }
+    
+    const thumbPath = path.join(getStoragePath(), photo.thumbnail_path);
+    
+    // Check if file exists
+    const fs = require('fs').promises;
+    try {
+      await fs.access(thumbPath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Thumbnail file not found' });
+    }
+    
+    // Set appropriate headers
+    res.setHeader('Content-Type', 'image/jpeg');
+    res.setHeader('Cache-Control', 'private, max-age=3600');
+    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+    
+    // Send file
+    res.sendFile(path.resolve(thumbPath));
+  } catch (error) {
+    console.error('Error serving thumbnail:', error);
+    res.status(500).json({ error: 'Failed to serve thumbnail' });
+  }
+});
+
+// Get photo stats
+router.get('/:slug/stats', verifyGalleryAccess, async (req, res) => {
+  try {
+    const totalPhotos = await db('photos')
+      .where('event_id', req.event.id)
+      .count('id as count')
+      .first();
+    
+    const totalViews = await db('access_logs')
+      .where('event_id', req.event.id)
+      .where('action', 'view')
+      .count('id as count')
+      .first();
+    
+    const totalDownloads = await db('photos')
+      .where('event_id', req.event.id)
+      .sum('download_count as total')
+      .first();
+    
+    const uniqueVisitors = await db('access_logs')
+      .where('event_id', req.event.id)
+      .countDistinct('ip_address as count')
+      .first();
+    
+    res.json({
+      total_photos: totalPhotos.count,
+      total_views: totalViews.count,
+      total_downloads: totalDownloads.total || 0,
+      unique_visitors: uniqueVisitors.count
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to fetch stats' });
+  }
+});
+
+// User photo upload endpoint
+router.post('/:eventId/upload', verifyGalleryAccess, async (req, res) => {
+  try {
+    const eventId = parseInt(req.params.eventId);
+    
+    // Verify the event matches the token
+    if (req.event.id !== eventId) {
+      return res.status(403).json({ error: 'Access denied' });
+    }
+    
+    // Check if user uploads are allowed
+    if (!req.event.allow_user_uploads) {
+      return res.status(403).json({ error: 'User uploads are not allowed for this event' });
+    }
+    
+    // Import multer and photo processing
+    const multer = require('multer');
+    const upload = multer({ 
+      dest: '/tmp/uploads/',
+      limits: { 
+        fileSize: 50 * 1024 * 1024, // 50MB
+        files: 10 // Max 10 files at once
+      },
+      fileFilter: (req, file, cb) => {
+        const allowedTypes = ['image/jpeg', 'image/png', 'image/webp'];
+        if (allowedTypes.includes(file.mimetype)) {
+          cb(null, true);
+        } else {
+          cb(new Error('Invalid file type'));
+        }
+      }
+    }).array('photos', 10);
+    
+    // Handle upload
+    upload(req, res, async (err) => {
+      if (err) {
+        console.error('Upload error:', err);
+        return res.status(400).json({ error: err.message });
+      }
+      
+      if (!req.files || req.files.length === 0) {
+        return res.status(400).json({ error: 'No files uploaded' });
+      }
+      
+      const { processUploadedPhotos } = require('../services/photoProcessor');
+      const categoryId = req.body.category_id || req.event.upload_category_id || null;
+      
+      try {
+        // Process uploaded photos
+        const results = await processUploadedPhotos(req.files, eventId, 'user', categoryId);
+        
+        // Clean up temp files
+        const fs = require('fs').promises;
+        for (const file of req.files) {
+          await fs.unlink(file.path).catch(console.error);
+        }
+        
+        res.json({ 
+          message: 'Photos uploaded successfully',
+          count: results.length,
+          photos: results
+        });
+      } catch (processError) {
+        console.error('Photo processing error:', processError);
+        res.status(500).json({ error: 'Failed to process photos' });
+      }
+    });
+  } catch (error) {
+    console.error('Upload route error:', error);
+    res.status(500).json({ error: 'Failed to upload photos' });
+  }
+});
+
+module.exports = router;

backend/src/routes/protectedImages.js

@@ -0,0 +1,190 @@
+const express = require('express');
+const path = require('path');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { verifyGalleryAccess } = require('../middleware/gallery');
+const watermarkService = require('../services/watermarkService');
+const { getStoragePath } = require('../config/storage');
+const crypto = require('crypto');
+
+const router = express.Router();
+
+/**
+ * Generate a signed URL token for image access
+ */
+function generateImageToken(photoId, expiresIn = 3600) {
+  const secret = process.env.JWT_SECRET;
+  const expires = Date.now() + (expiresIn * 1000);
+  const data = `${photoId}:${expires}`;
+  const signature = crypto.createHmac('sha256', secret).update(data).digest('hex');
+  return `${Buffer.from(data).toString('base64')}.${signature}`;
+}
+
+/**
+ * Verify image token
+ */
+function verifyImageToken(token) {
+  try {
+    const secret = process.env.JWT_SECRET;
+    const [data, signature] = token.split('.');
+    const decoded = Buffer.from(data, 'base64').toString();
+    const [photoId, expires] = decoded.split(':');
+    
+    // Verify signature
+    const expectedSignature = crypto.createHmac('sha256', secret).update(decoded).digest('hex');
+    if (signature !== expectedSignature) {
+      return null;
+    }
+    
+    // Check expiration
+    if (Date.now() > parseInt(expires)) {
+      return null;
+    }
+    
+    return { photoId: parseInt(photoId), expires: parseInt(expires) };
+  } catch (error) {
+    return null;
+  }
+}
+
+/**
+ * Serve watermarked image
+ */
+router.get('/:slug/photo/:photoId/view', verifyGalleryAccess, async (req, res) => {
+  try {
+    const { photoId } = req.params;
+    
+    // Get photo details
+    const photo = await db('photos')
+      .where({
+        id: photoId,
+        event_id: req.event.id
+      })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Get watermark settings
+    const watermarkSettings = await watermarkService.getWatermarkSettings();
+    
+    // Build full path to photo
+    const photoPath = path.join(getStoragePath(), 'events/active', req.event.slug, photo.path);
+    
+    // Apply watermark if enabled
+    const imageBuffer = await watermarkService.applyWatermark(photoPath, watermarkSettings);
+    
+    // Set appropriate headers
+    res.set({
+      'Content-Type': photo.mime_type || 'image/jpeg',
+      'Content-Length': imageBuffer.length,
+      'Cache-Control': 'private, max-age=3600',
+      'X-Content-Type-Options': 'nosniff'
+    });
+    
+    // Send the watermarked image
+    res.send(imageBuffer);
+    
+  } catch (error) {
+    console.error('Error serving watermarked image:', error);
+    res.status(500).json({ error: 'Failed to serve image' });
+  }
+});
+
+/**
+ * Generate signed URL for image access
+ */
+router.post('/:slug/photo/:photoId/generate-url', verifyGalleryAccess, async (req, res) => {
+  try {
+    const { photoId } = req.params;
+    
+    // Verify photo belongs to this event
+    const photo = await db('photos')
+      .where({
+        id: photoId,
+        event_id: req.event.id
+      })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Generate signed token
+    const token = generateImageToken(photoId);
+    const signedUrl = `/api/images/${req.params.slug}/photo/${photoId}/signed/${token}`;
+    
+    res.json({ 
+      url: signedUrl,
+      expiresIn: 3600 // 1 hour
+    });
+    
+  } catch (error) {
+    console.error('Error generating signed URL:', error);
+    res.status(500).json({ error: 'Failed to generate URL' });
+  }
+});
+
+/**
+ * Serve image with signed URL (no gallery auth required, token is the auth)
+ */
+router.get('/:slug/photo/:photoId/signed/:token', async (req, res) => {
+  try {
+    const { slug, photoId, token } = req.params;
+    
+    // Verify token
+    const tokenData = verifyImageToken(token);
+    if (!tokenData || tokenData.photoId !== parseInt(photoId)) {
+      return res.status(403).json({ error: 'Invalid or expired token' });
+    }
+    
+    // Get event
+    const event = await db('events')
+      .where({ slug })
+      .where('is_active', formatBoolean(true))
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+    
+    // Get photo
+    const photo = await db('photos')
+      .where({
+        id: photoId,
+        event_id: event.id
+      })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Get watermark settings
+    const watermarkSettings = await watermarkService.getWatermarkSettings();
+    
+    // Build full path to photo
+    const photoPath = path.join(getStoragePath(), 'events/active', event.slug, photo.path);
+    
+    // Apply watermark if enabled
+    const imageBuffer = await watermarkService.applyWatermark(photoPath, watermarkSettings);
+    
+    // Set appropriate headers
+    res.set({
+      'Content-Type': photo.mime_type || 'image/jpeg',
+      'Content-Length': imageBuffer.length,
+      'Cache-Control': 'private, max-age=3600',
+      'X-Content-Type-Options': 'nosniff'
+    });
+    
+    // Send the watermarked image
+    res.send(imageBuffer);
+    
+  } catch (error) {
+    console.error('Error serving signed image:', error);
+    res.status(500).json({ error: 'Failed to serve image' });
+  }
+});
+
+module.exports = router;

backend/src/routes/publicCMS.js

@@ -0,0 +1,33 @@
+const express = require('express');
+const { db } = require('../database/db');
+const router = express.Router();
+
+// Get public CMS page
+router.get('/pages/:slug', async (req, res) => {
+  try {
+    const { slug } = req.params;
+    const { lang = 'en' } = req.query;
+    
+    const page = await db('cms_pages').where('slug', slug).first();
+    
+    if (!page) {
+      return res.status(404).json({ error: 'Page not found' });
+    }
+    
+    // Return the appropriate language version
+    const title = lang === 'de' ? page.title_de : page.title_en;
+    const content = lang === 'de' ? page.content_de : page.content_en;
+    
+    res.json({
+      title,
+      content,
+      slug: page.slug,
+      updated_at: page.updated_at
+    });
+  } catch (error) {
+    console.error('Error fetching public CMS page:', error);
+    res.status(500).json({ error: 'Failed to fetch page' });
+  }
+});
+
+module.exports = router;

backend/src/routes/publicSettings.js

@@ -0,0 +1,54 @@
+const express = require('express');
+const { db } = require('../database/db');
+const router = express.Router();
+
+// Get public settings (branding and theme)
+router.get('/', async (req, res) => {
+  try {
+    // Fetch branding, theme, general, and select security settings
+    const settings = await db('app_settings')
+      .whereIn('setting_type', ['branding', 'theme', 'general', 'security'])
+      .select('setting_key', 'setting_value');
+    
+    // Convert to object format
+    const settingsObject = {};
+    settings.forEach(setting => {
+      try {
+        settingsObject[setting.setting_key] = setting.setting_value 
+          ? JSON.parse(setting.setting_value) 
+          : null;
+      } catch (e) {
+        // If parsing fails, use the raw value
+        settingsObject[setting.setting_key] = setting.setting_value;
+      }
+    });
+
+    // Return only safe public settings
+    const publicSettings = {
+      branding_company_name: settingsObject.branding_company_name || '',
+      branding_company_tagline: settingsObject.branding_company_tagline || '',
+      branding_support_email: settingsObject.branding_support_email || '',
+      branding_footer_text: settingsObject.branding_footer_text || '',
+      branding_watermark_enabled: settingsObject.branding_watermark_enabled || false,
+      branding_watermark_logo_url: settingsObject.branding_watermark_logo_url || '',
+      branding_watermark_position: settingsObject.branding_watermark_position || 'bottom-right',
+      branding_watermark_opacity: settingsObject.branding_watermark_opacity || 50,
+      branding_watermark_size: settingsObject.branding_watermark_size || 15,
+      branding_favicon_url: settingsObject.branding_favicon_url || '',
+      branding_logo_url: settingsObject.branding_logo_url || '',
+      theme_config: settingsObject.theme_config || null,
+      default_language: settingsObject.general_default_language || 'en',
+      enable_analytics: settingsObject.general_enable_analytics !== false,
+      enable_recaptcha: settingsObject.security_enable_recaptcha === true || settingsObject.security_enable_recaptcha === 'true',
+      recaptcha_site_key: settingsObject.security_recaptcha_site_key || null,
+      maintenance_mode: settingsObject.general_maintenance_mode === true || settingsObject.general_maintenance_mode === 'true'
+    };
+
+    res.json(publicSettings);
+  } catch (error) {
+    console.error('Public settings fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch settings' });
+  }
+});
+
+module.exports = router;

backend/src/services/archiveService.js

@@ -0,0 +1,70 @@
+const archiver = require('archiver');
+const fs = require('fs').promises;
+const path = require('path');
+const { db } = require('../database/db');
+const { queueEmail } = require('./emailProcessor');
+const logger = require('../utils/logger');
+
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+const ACTIVE_PATH = () => path.join(getStoragePath(), 'events/active');
+const ARCHIVE_PATH = () => path.join(getStoragePath(), 'events/archived');
+
+async function archiveEvent(event) {
+  try {
+    const eventPath = path.join(ACTIVE_PATH(), event.slug);
+    const archiveName = `${event.slug}.zip`;
+    const archivePath = path.join(ARCHIVE_PATH(), archiveName);
+    
+    // Ensure archive directory exists
+    await fs.mkdir(ARCHIVE_PATH(), { recursive: true });
+    
+    // Create archive
+    const output = require('fs').createWriteStream(archivePath);
+    const archive = archiver('zip', {
+      zlib: { level: 9 } // Maximum compression
+    });
+    
+    archive.on('error', (err) => {
+      throw err;
+    });
+    
+    output.on('close', async () => {
+      logger.info(`Archive created: ${archiveName} (${archive.pointer()} bytes)`);
+      
+      // Update database
+      await db('events').where('id', event.id).update({
+        is_archived: true,
+        archive_path: path.relative(getStoragePath(), archivePath),
+        archived_at: new Date()
+      });
+      
+      // Delete original files
+      await fs.rm(eventPath, { recursive: true });
+      
+      // Delete thumbnails
+      const photos = await db('photos').where('event_id', event.id);
+      for (const photo of photos) {
+        if (photo.thumbnail_path) {
+          const thumbPath = path.join(getStoragePath(), photo.thumbnail_path);
+          await fs.unlink(thumbPath).catch(() => {}); // Ignore if already deleted
+        }
+      }
+      
+      // Queue completion email
+      await queueEmail(event.id, event.admin_email, 'archive_complete', {
+        event_name: event.event_name,
+        archive_size: (archive.pointer() / 1024 / 1024).toFixed(2) + ' MB'
+      });
+    });
+    
+    archive.pipe(output);
+    archive.directory(eventPath, false);
+    await archive.finalize();
+    
+  } catch (error) {
+    logger.error(`Error archiving event ${event.slug}:`, error);
+    throw error;
+  }
+}
+
+module.exports = { archiveEvent };

backend/src/services/emailProcessor.js

@@ -0,0 +1,549 @@
+const nodemailer = require('nodemailer');
+const Handlebars = require('handlebars');
+const { db } = require('../database/db');
+const logger = require('../utils/logger');
+
+let transporter = null;
+let lastConfigHash = null;
+
+// Generate hash from config for change detection
+function generateConfigHash(config) {
+  const crypto = require('crypto');
+  const configString = `${config.smtp_host}:${config.smtp_port}:${config.smtp_user}:${config.smtp_pass}:${config.smtp_secure}`;
+  return crypto.createHash('md5').update(configString).digest('hex');
+}
+
+// Initialize transporter from database config
+async function initializeTransporter(forceReinit = false) {
+  try {
+    const config = await db('email_configs').first();
+    
+    if (!config) {
+      logger.warn('No email configuration found');
+      return null;
+    }
+
+    // Check if configuration has changed
+    const currentConfigHash = generateConfigHash(config);
+    if (!forceReinit && transporter && currentConfigHash === lastConfigHash) {
+      // Configuration hasn't changed, return existing transporter
+      return transporter;
+    }
+
+    // Configuration has changed or first initialization
+    logger.info('Initializing email transporter' + (lastConfigHash && currentConfigHash !== lastConfigHash ? ' (configuration changed)' : ''));
+
+    transporter = nodemailer.createTransport({
+      host: config.smtp_host,
+      port: config.smtp_port,
+      secure: config.smtp_secure,
+      auth: config.smtp_user ? {
+        user: config.smtp_user,
+        pass: config.smtp_pass
+      } : undefined
+    });
+
+    // Verify configuration
+    await transporter.verify();
+    logger.info('Email transporter initialized successfully');
+    
+    // Update the config hash
+    lastConfigHash = currentConfigHash;
+    
+    return transporter;
+  } catch (error) {
+    logger.error('Failed to initialize email transporter:', error);
+    transporter = null;
+    lastConfigHash = null;
+    return null;
+  }
+}
+
+// Get the appropriate language for a recipient
+async function getRecipientLanguage(email, eventId = null) {
+  // First priority: Check event language setting if eventId is provided
+  if (eventId) {
+    try {
+      const event = await db('events').where('id', eventId).first();
+      if (event && event.language) {
+        return event.language;
+      }
+    } catch (error) {
+      logger.error('Error fetching event language:', error);
+    }
+  }
+  
+  // Second priority: Check app_settings for general default language
+  try {
+    const langSetting = await db('app_settings')
+      .where('setting_key', 'general_default_language')
+      .first();
+    if (langSetting && langSetting.setting_value) {
+      return langSetting.setting_value;
+    }
+  } catch (error) {
+    logger.error('Error fetching app settings language:', error);
+  }
+  
+  // Third priority: Check email configs for default language
+  try {
+    const emailConfig = await db('email_configs').first();
+    if (emailConfig && emailConfig.default_language) {
+      return emailConfig.default_language;
+    }
+  } catch (error) {
+    logger.error('Error fetching email config language:', error);
+  }
+  
+  // Fourth priority: Check if the email domain suggests German
+  if (email) {
+    const germanDomains = ['.de', '.at', '.ch', '.li'];
+    const domain = email.toLowerCase();
+    if (germanDomains.some(d => domain.endsWith(d))) {
+      return 'de';
+    }
+  }
+  
+  return 'en'; // Default to English
+}
+
+// Process email template with variables
+async function processTemplate(template, variables, language = 'en') {
+  // Import date formatter and text formatters
+  const { formatDate } = require('../utils/dateFormatter');
+  const { formatWelcomeMessage } = require('../utils/formatters');
+  
+  // Get the appropriate language fields
+  const subjectField = language === 'de' ? 'subject_de' : 'subject_en';
+  const htmlField = language === 'de' ? 'body_html_de' : 'body_html_en';
+  const textField = language === 'de' ? 'body_text_de' : 'body_text_en';
+  
+  // Fall back to non-language-specific fields for backward compatibility
+  let subject = template[subjectField] || template.subject || '';
+  let htmlBody = template[htmlField] || template.body_html || '';
+  let textBody = template[textField] || template.body_text || '';
+  
+  // Process variables before template compilation
+  const processedVariables = { ...variables };
+  
+  // Handle password security message
+  if (processedVariables.gallery_password === '{{password_security_message}}') {
+    processedVariables.gallery_password = language === 'de' 
+      ? '(Aus Sicherheitsgründen nicht angezeigt)' 
+      : '(Not shown for security reasons)';
+  }
+  
+  // Format dates if they exist
+  if (processedVariables.event_date) {
+    processedVariables.event_date = await formatDate(processedVariables.event_date, language);
+  }
+  if (processedVariables.expiry_date) {
+    processedVariables.expiry_date = await formatDate(processedVariables.expiry_date, language);
+  }
+  if (processedVariables.archive_date) {
+    processedVariables.archive_date = await formatDate(processedVariables.archive_date, language);
+  }
+  
+  // Format welcome message for HTML display (preserve line breaks)
+  if (processedVariables.welcome_message) {
+    processedVariables.welcome_message = formatWelcomeMessage(processedVariables.welcome_message);
+  }
+
+  // Get branding settings for logo
+  let logoUrl = '';
+  let companyName = 'PicPeak';
+  try {
+    const brandingSettings = await db('app_settings')
+      .whereIn('setting_key', ['branding_logo_url', 'branding_company_name'])
+      .select('setting_key', 'setting_value');
+    
+    brandingSettings.forEach(setting => {
+      if (setting.setting_key === 'branding_logo_url' && setting.setting_value) {
+        try {
+          logoUrl = JSON.parse(setting.setting_value);
+        } catch (e) {
+          logoUrl = setting.setting_value;
+        }
+      } else if (setting.setting_key === 'branding_company_name' && setting.setting_value) {
+        try {
+          companyName = JSON.parse(setting.setting_value);
+        } catch (e) {
+          companyName = setting.setting_value;
+        }
+      }
+    });
+  } catch (error) {
+    logger.error('Error fetching branding settings:', error);
+  }
+
+  // If no custom logo, use default PicPeak logo
+  const apiUrl = process.env.API_URL || 'http://localhost:3001';
+  const frontendUrl = process.env.FRONTEND_URL || 'http://localhost:3005';
+  const logoFullUrl = logoUrl ? `${apiUrl}${logoUrl}` : `${frontendUrl}/picpeak-logo-transparent.png`;
+
+  // Compile templates with Handlebars
+  const subjectTemplate = Handlebars.compile(subject);
+  const htmlTemplate = Handlebars.compile(htmlBody);
+  const textTemplate = Handlebars.compile(textBody);
+  
+  // Process templates with processedVariables (includes formatted dates and security messages)
+  subject = subjectTemplate(processedVariables);
+  htmlBody = htmlTemplate(processedVariables);
+  textBody = textTemplate(processedVariables);
+
+  // Wrap HTML body in styled template
+  const styledHtmlBody = `
+<!DOCTYPE html>
+<html lang="${language}">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>${subject}</title>
+  <style>
+    body {
+      margin: 0;
+      padding: 0;
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+      background-color: #f5f5f5;
+      color: #333;
+    }
+    .email-wrapper {
+      background-color: #f5f5f5;
+      padding: 40px 20px;
+    }
+    .email-container {
+      max-width: 600px;
+      margin: 0 auto;
+      background-color: #ffffff;
+      border-radius: 8px;
+      box-shadow: 0 2px 4px rgba(0, 0, 0, 0.1);
+      overflow: hidden;
+    }
+    .email-header {
+      background-color: #5C8762;
+      padding: 30px;
+      text-align: center;
+    }
+    .logo {
+      max-width: 180px;
+      height: auto;
+      margin-bottom: 10px;
+    }
+    .email-content {
+      padding: 40px 30px;
+    }
+    .email-content h2 {
+      color: #5C8762;
+      margin-top: 0;
+      margin-bottom: 20px;
+      font-size: 24px;
+    }
+    .email-content p {
+      line-height: 1.6;
+      margin-bottom: 15px;
+    }
+    .email-content ul {
+      background-color: #f9f9f9;
+      padding: 20px 20px 20px 40px;
+      border-radius: 5px;
+      margin: 20px 0;
+    }
+    .email-content li {
+      margin-bottom: 10px;
+    }
+    .button {
+      display: inline-block;
+      padding: 12px 30px;
+      background-color: #5C8762;
+      color: white !important;
+      text-decoration: none;
+      border-radius: 5px;
+      font-weight: 500;
+      margin: 20px 0;
+    }
+    .button:hover {
+      background-color: #4a6f4f;
+    }
+    .email-footer {
+      background-color: #f9f9f9;
+      padding: 30px;
+      text-align: center;
+      border-top: 1px solid #eee;
+    }
+    .email-footer img {
+      max-width: 120px;
+      height: auto;
+      margin-bottom: 15px;
+      opacity: 0.8;
+    }
+    .email-footer p {
+      color: #666;
+      font-size: 14px;
+      margin: 5px 0;
+    }
+    a {
+      color: #5C8762;
+      text-decoration: underline;
+    }
+    a:hover {
+      color: #4a6f4f;
+    }
+    strong {
+      color: #333;
+    }
+    @media only screen and (max-width: 600px) {
+      .email-wrapper {
+        padding: 20px 10px;
+      }
+      .email-content {
+        padding: 30px 20px;
+      }
+      .email-header {
+        padding: 20px;
+      }
+      .logo {
+        max-width: 150px;
+      }
+    }
+  </style>
+</head>
+<body>
+  <div class="email-wrapper">
+    <div class="email-container">
+      <div class="email-header">
+        <img src="${logoFullUrl}" alt="${companyName}" class="logo">
+      </div>
+      <div class="email-content">
+        ${htmlBody}
+      </div>
+      <div class="email-footer">
+        <img src="${logoFullUrl}" alt="${companyName}">
+        <p>${companyName}</p>
+        <p style="font-size: 12px; color: #999;">© ${new Date().getFullYear()} ${companyName}. All rights reserved.</p>
+      </div>
+    </div>
+  </div>
+</body>
+</html>`;
+
+  return { subject, htmlBody: styledHtmlBody, textBody };
+}
+
+// Send email using template
+async function sendTemplateEmail(to, templateKey, variables) {
+  try {
+    // Always check for configuration changes before sending
+    transporter = await initializeTransporter();
+    if (!transporter) {
+      throw new Error('Email service not configured');
+    }
+
+    // Get email template
+    const template = await db('email_templates')
+      .where('template_key', templateKey)
+      .first();
+    
+    if (!template) {
+      throw new Error(`Email template '${templateKey}' not found`);
+    }
+
+    // Get email config for from address
+    const config = await db('email_configs').first();
+    if (!config) {
+      throw new Error('Email configuration not found');
+    }
+
+    // Determine recipient language (pass eventId if available in variables)
+    const language = await getRecipientLanguage(to, variables.eventId || null);
+    
+    // Process template with variables
+    const { subject, htmlBody, textBody } = await processTemplate(template, variables, language);
+
+    // Send email
+    const info = await transporter.sendMail({
+      from: `${config.from_name} <${config.from_email}>`,
+      to: to,
+      subject: subject,
+      html: htmlBody,
+      text: textBody || htmlBody.replace(/<[^>]*>/g, '') // Strip HTML if no text version
+    });
+
+    logger.info(`Email sent successfully: ${info.messageId} (${language})`);
+    return { success: true, messageId: info.messageId, language };
+  } catch (error) {
+    logger.error('Error sending template email:', error);
+    throw error;
+  }
+}
+
+// Process email queue
+async function processEmailQueue() {
+  logger.info('Email queue processor: Checking for pending emails...');
+  
+  try {
+    // Try to initialize transporter if it's null (in case it failed at startup)
+    if (!transporter) {
+      logger.info('Transporter not initialized, attempting to initialize...');
+      transporter = await initializeTransporter();
+      if (!transporter) {
+        logger.warn('Email transporter could not be initialized, skipping queue processing');
+        return;
+      }
+    }
+    
+    let pendingEmails = [];
+    try {
+      pendingEmails = await db('email_queue')
+        .where('status', 'pending')
+        .where('retry_count', '<', 3)
+        .orderBy('created_at', 'asc')
+        .limit(10);
+    } catch (dbError) {
+      logger.error('Failed to query email queue:', dbError);
+      return;
+    }
+    
+    if (pendingEmails.length === 0) {
+      logger.info('Email queue processor: No pending emails found');
+      return;
+    }
+
+    logger.info(`Processing ${pendingEmails.length} emails from queue`);
+    
+    for (const email of pendingEmails) {
+      try {
+        const emailData = typeof email.email_data === 'string' 
+          ? JSON.parse(email.email_data || '{}')
+          : email.email_data || {};
+        
+        await sendTemplateEmail(
+          email.recipient_email,
+          email.email_type,
+          emailData
+        );
+        
+        // Mark as sent
+        await db('email_queue')
+          .where('id', email.id)
+          .update({
+            status: 'sent',
+            sent_at: new Date()
+          });
+          
+        logger.info(`Email ${email.id} sent successfully`);
+      } catch (error) {
+        // Increment retry count
+        try {
+          await db('email_queue')
+            .where('id', email.id)
+            .update({
+              retry_count: email.retry_count + 1,
+              error_message: error.message
+            });
+        } catch (updateError) {
+          logger.error(`Failed to update email retry count for ${email.id}:`, updateError);
+          // If update fails due to column issue, try without any potential auto-added fields
+          if (updateError.message && updateError.message.includes('updated_at')) {
+            logger.warn('Detected updated_at column issue, attempting raw query...');
+            await db.raw(
+              'UPDATE email_queue SET retry_count = ?, error_message = ? WHERE id = ?',
+              [email.retry_count + 1, error.message, email.id]
+            );
+          }
+        }
+          
+        logger.error(`Failed to send email ${email.id}:`, error);
+      }
+    }
+  } catch (error) {
+    logger.error('Error processing email queue:', error);
+  }
+}
+
+// Queue an email for sending
+async function queueEmail(eventId, recipientEmail, emailType, emailData) {
+  try {
+    // Add eventId to emailData for language detection
+    emailData.eventId = eventId;
+    await db('email_queue').insert({
+      event_id: eventId,
+      recipient_email: recipientEmail,
+      email_type: emailType,
+      email_data: JSON.stringify(emailData),
+      status: 'pending',
+      retry_count: 0,
+      created_at: new Date()
+    });
+    
+    logger.info(`Email queued: ${emailType} to ${recipientEmail}`);
+  } catch (error) {
+    logger.error('Error queueing email:', error);
+    throw error;
+  }
+}
+
+// Test email connection
+async function testEmailConnection() {
+  try {
+    if (!transporter) {
+      await initializeTransporter();
+    }
+    if (!transporter) {
+      return false;
+    }
+    await transporter.verify();
+    return true;
+  } catch (error) {
+    logger.error('Email connection test failed:', error);
+    return false;
+  }
+}
+
+// Start email queue processor
+let emailQueueInterval = null;
+
+function startEmailQueueProcessor() {
+  logger.info('Email queue processor: Attempting to start...');
+  
+  if (!emailQueueInterval) {
+    // Process immediately on start
+    processEmailQueue().catch(err => {
+      logger.error('Email queue processor: Initial processing failed:', err);
+    });
+    
+    // Then process every minute
+    emailQueueInterval = setInterval(() => {
+      processEmailQueue().catch(err => {
+        logger.error('Email queue processor: Periodic processing failed:', err);
+      });
+    }, 60000);
+    
+    logger.info('Email queue processor started successfully');
+  } else {
+    logger.info('Email queue processor: Already running');
+  }
+}
+
+function stopEmailQueueProcessor() {
+  if (emailQueueInterval) {
+    clearInterval(emailQueueInterval);
+    emailQueueInterval = null;
+    logger.info('Email queue processor stopped');
+  }
+}
+
+// Initialize on module load - DISABLED for production startup
+// This will be called from server.js after database is ready
+// initializeTransporter().then(() => {
+//   startEmailQueueProcessor();
+// });
+
+module.exports = {
+  initializeTransporter,
+  startEmailQueueProcessor,
+  sendTemplateEmail,
+  processEmailQueue,
+  queueEmail,
+  stopEmailQueueProcessor,
+  testEmailConnection
+};

backend/src/services/emailService.js

@@ -0,0 +1,65 @@
+const nodemailer = require('nodemailer');
+const { db } = require('../database/db');
+const { emailTemplates } = require('./emailTemplates');
+const logger = require('../utils/logger');
+
+// Create transporter
+const transporter = nodemailer.createTransport({
+  host: process.env.SMTP_HOST,
+  port: process.env.SMTP_PORT,
+  secure: process.env.SMTP_SECURE === 'true',
+  auth: {
+    user: process.env.SMTP_USER,
+    pass: process.env.SMTP_PASS
+  }
+});
+
+async function sendEmail(to, type, data) {
+  try {
+    const template = emailTemplates[type](data);
+    
+    const info = await transporter.sendMail({
+      from: process.env.EMAIL_FROM,
+      to: to,
+      subject: template.subject,
+      html: template.html,
+      text: template.text
+    });
+    
+    logger.info(`Email sent: ${info.messageId}`);
+    return info;
+  } catch (error) {
+    logger.error('Error sending email:', error);
+    throw error;
+  }
+}
+
+// Process email queue
+async function processEmailQueue() {
+  const pendingEmails = await db('email_queue')
+    .where('status', 'pending')
+    .where('retry_count', '<', 3)
+    .limit(10);
+  
+  for (const email of pendingEmails) {
+    try {
+      const emailData = JSON.parse(email.email_data);
+      await sendEmail(email.recipient_email, email.email_type, emailData);
+      
+      await db('email_queue').where('id', email.id).update({
+        status: 'sent',
+        sent_at: new Date()
+      });
+    } catch (error) {
+      await db('email_queue').where('id', email.id).update({
+        retry_count: email.retry_count + 1,
+        error_message: error.message
+      });
+    }
+  }
+}
+
+// Start email queue processor
+setInterval(processEmailQueue, 60000); // Process every minute
+
+module.exports = { sendEmail, processEmailQueue };

backend/src/services/expirationChecker.js

@@ -0,0 +1,101 @@
+const cron = require('node-cron');
+const { db } = require('../database/db');
+const { archiveEvent } = require('./archiveService');
+const { queueEmail } = require('./emailProcessor');
+const logger = require('../utils/logger');
+const { formatDate } = require('../utils/dateFormatter');
+const { formatBoolean } = require('../utils/dbCompat');
+
+function startExpirationChecker() {
+  // Check every hour for expired events and warnings
+  cron.schedule('0 * * * *', async () => {
+    await checkExpirations();
+  });
+  
+  logger.info('Expiration checker started');
+}
+
+async function checkExpirations() {
+  try {
+    const now = new Date();
+    const warningDate = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000); // 7 days from now
+    
+    // Check for events needing warning emails
+    const eventsNeedingWarning = await db('events')
+      .where('is_active', formatBoolean(true))
+      .where('is_archived', formatBoolean(false))
+      .where('expires_at', '<=', warningDate)
+      .where('expires_at', '>', now);
+    
+    for (const event of eventsNeedingWarning) {
+      // Check if warning email already sent
+      const existingWarning = await db('email_queue')
+        .where('event_id', event.id)
+        .where('email_type', 'expiration_warning')
+        .first();
+      
+      if (!existingWarning) {
+        await queueExpirationWarning(event);
+      }
+    }
+    
+    // Check for expired events
+    const expiredEvents = await db('events')
+      .where('is_active', formatBoolean(true))
+      .where('is_archived', formatBoolean(false))
+      .where('expires_at', '<=', now);
+    
+    for (const event of expiredEvents) {
+      await handleExpiredEvent(event);
+    }
+    
+  } catch (error) {
+    logger.error('Error checking expirations:', error);
+  }
+}
+
+async function queueExpirationWarning(event) {
+  const daysRemaining = Math.ceil((new Date(event.expires_at) - new Date()) / (1000 * 60 * 60 * 24));
+  
+  // Determine language based on email domain
+  const emailLang = event.host_email.endsWith('.de') ? 'de' : 'en';
+  
+  // Queue email to host
+  await queueEmail(event.id, event.host_email, 'expiration_warning', {
+    host_name: event.host_name || event.host_email.split('@')[0],
+    event_name: event.event_name,
+    days_remaining: daysRemaining.toString(),
+    expiration_date: await formatDate(event.expires_at, emailLang),
+    gallery_link: event.share_link
+  });
+  
+  logger.info(`Queued expiration warning for event ${event.slug}`);
+}
+
+async function handleExpiredEvent(event) {
+  try {
+    // Mark as inactive
+    await db('events').where('id', event.id).update({ is_active: formatBoolean(false) });
+    
+    // Queue expiration emails
+    await queueEmail(event.id, event.host_email, 'gallery_expired', {
+      event_name: event.event_name,
+      admin_email: event.admin_email
+    });
+    
+    // Also notify admin
+    await queueEmail(event.id, event.admin_email, 'gallery_expired', {
+      event_name: event.event_name,
+      admin_email: event.admin_email
+    });
+    
+    // Start archiving process
+    await archiveEvent(event);
+    
+    logger.info(`Handled expiration for event ${event.slug}`);
+  } catch (error) {
+    logger.error(`Error handling expired event ${event.slug}:`, error);
+  }
+}
+
+module.exports = { startExpirationChecker };

backend/src/services/fileWatcher.js

@@ -0,0 +1,105 @@
+const chokidar = require('chokidar');
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { generateThumbnail } = require('./imageProcessor');
+const logger = require('../utils/logger');
+
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+const WATCH_PATH = () => path.join(getStoragePath(), 'events/active');
+
+function startFileWatcher() {
+  const watcher = chokidar.watch(WATCH_PATH(), {
+    ignored: /(^|[\/\\])\../, // ignore dotfiles
+    persistent: true,
+    awaitWriteFinish: {
+      stabilityThreshold: 2000,
+      pollInterval: 100
+    }
+  });
+
+  watcher
+    .on('add', async (filePath) => {
+      try {
+        await processNewPhoto(filePath);
+      } catch (error) {
+        logger.error('Error processing new photo:', error);
+      }
+    })
+    .on('unlink', async (filePath) => {
+      try {
+        await removePhoto(filePath);
+      } catch (error) {
+        logger.error('Error removing photo:', error);
+      }
+    });
+
+  logger.info('File watcher started');
+}
+
+async function processNewPhoto(filePath) {
+  const relativePath = path.relative(WATCH_PATH(), filePath);
+  const pathParts = relativePath.split(path.sep);
+  
+  if (pathParts.length < 2) return; // Not in correct folder structure
+  
+  const eventSlug = pathParts[0];
+  const photoType = pathParts[1] === 'collages' ? 'collage' : 'individual';
+  
+  // Check if this is an image file
+  const ext = path.extname(filePath).toLowerCase();
+  if (!['.jpg', '.jpeg', '.png', '.webp'].includes(ext)) return;
+  
+  // Skip temporary upload files
+  const filename = path.basename(filePath);
+  if (filename.startsWith('temp_')) {
+    logger.debug(`Skipping temporary upload file: ${filename}`);
+    return;
+  }
+  
+  // Find the event
+  const event = await db('events').where({ slug: eventSlug, is_active: formatBoolean(true) }).first();
+  if (!event) return;
+  
+  // Get file stats
+  const stats = await fs.stat(filePath);
+  
+  // Generate thumbnail
+  const thumbnailPath = await generateThumbnail(filePath);
+  
+  // Calculate relative thumbnail path
+  const relativeThumbPath = thumbnailPath; // thumbnailPath is already relative to storage root
+  
+  // Check if photo already exists
+  const existingPhoto = await db('photos')
+    .where({ event_id: event.id, filename: path.basename(filePath) })
+    .first();
+  
+  if (!existingPhoto) {
+    // Add to database
+    await db('photos').insert({
+      event_id: event.id,
+      filename: path.basename(filePath),
+      path: relativePath,
+      thumbnail_path: relativeThumbPath,
+      type: photoType,
+      size_bytes: stats.size
+    });
+    
+    logger.info(`Added new photo: ${relativePath}`);
+  } else {
+    logger.debug(`Photo already exists: ${relativePath}`);
+  }
+}
+
+async function removePhoto(filePath) {
+  const relativePath = path.relative(WATCH_PATH(), filePath);
+  
+  // Remove from database
+  await db('photos').where({ path: relativePath }).delete();
+  
+  logger.info(`Removed photo: ${relativePath}`);
+}
+
+module.exports = { startFileWatcher };

backend/src/services/imageProcessor.js

@@ -0,0 +1,134 @@
+const sharp = require('sharp');
+const path = require('path');
+const fs = require('fs').promises;
+const logger = require('../utils/logger');
+
+// Configure sharp for better memory management with large batches
+sharp.cache(false); // Disable cache to prevent memory buildup
+sharp.concurrency(2); // Limit concurrent operations
+
+const THUMBNAIL_WIDTH = 300;
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+const getThumbnailPath = () => path.join(getStoragePath(), 'thumbnails');
+
+async function generateThumbnail(imagePath, options = {}) {
+  const filename = path.basename(imagePath);
+  const thumbnailFilename = `thumb_${filename}`;
+  const thumbnailDir = getThumbnailPath();
+  const thumbnailPath = path.join(thumbnailDir, thumbnailFilename);
+  
+  // Ensure thumbnail directory exists
+  await fs.mkdir(thumbnailDir, { recursive: true });
+  
+  // Check if we need to regenerate (for broken thumbnails)
+  if (options.regenerate) {
+    try {
+      await fs.unlink(thumbnailPath);
+      logger.info(`Deleted broken thumbnail: ${thumbnailPath}`);
+    } catch (err) {
+      // File might not exist, that's okay
+    }
+  }
+  
+  try {
+    // First, verify the source image is complete and valid
+    const metadata = await sharp(imagePath).metadata();
+    
+    if (!metadata.width || !metadata.height) {
+      throw new Error('Invalid image metadata - file may be incomplete');
+    }
+    
+    // Generate thumbnail with memory-efficient settings and error handling
+    await sharp(imagePath, { 
+      limitInputPixels: 268402689, // ~16k x 16k max
+      sequentialRead: true, // More memory efficient for large images
+      failOnError: false // Don't fail on minor issues
+    })
+      .resize(THUMBNAIL_WIDTH, null, {
+        withoutEnlargement: true,
+        fit: 'inside'
+      })
+      .jpeg({ 
+        quality: 80,
+        progressive: true, // Progressive JPEG for better loading
+        mozjpeg: true // Better compression
+      })
+      .toFile(thumbnailPath);
+    
+    // Verify the thumbnail was created successfully
+    const stats = await fs.stat(thumbnailPath);
+    if (stats.size === 0) {
+      throw new Error('Generated thumbnail is empty');
+    }
+    
+    return path.relative(getStoragePath(), thumbnailPath);
+  } catch (error) {
+    logger.error(`Failed to generate thumbnail for ${filename}:`, error.message);
+    
+    // Clean up any partially created file
+    try {
+      await fs.unlink(thumbnailPath);
+    } catch (unlinkErr) {
+      // Ignore unlink errors
+    }
+    
+    // Return null if thumbnail generation fails, don't fail the whole upload
+    return null;
+  }
+}
+
+/**
+ * Check if a thumbnail exists and is valid
+ */
+async function isThumbnailValid(thumbnailPath) {
+  try {
+    const fullPath = path.join(getStoragePath(), thumbnailPath);
+    const stats = await fs.stat(fullPath);
+    
+    // Check if file exists and has content
+    if (stats.size === 0) {
+      return false;
+    }
+    
+    // Try to read metadata to ensure it's a valid image
+    await sharp(fullPath).metadata();
+    return true;
+  } catch (error) {
+    return false;
+  }
+}
+
+/**
+ * Regenerate thumbnail if it's broken or missing
+ */
+async function ensureThumbnail(photo) {
+  const storagePath = getStoragePath();
+  const originalPath = path.join(storagePath, 'events/active', photo.path);
+  
+  // Check if thumbnail exists and is valid
+  if (photo.thumbnail_path) {
+    const isValid = await isThumbnailValid(photo.thumbnail_path);
+    if (isValid) {
+      return photo.thumbnail_path;
+    }
+    logger.warn(`Invalid thumbnail detected for photo ${photo.id}, regenerating...`);
+  }
+  
+  // Generate new thumbnail
+  const newThumbnailPath = await generateThumbnail(originalPath, { regenerate: true });
+  
+  if (newThumbnailPath) {
+    // Update database with new thumbnail path
+    const { db } = require('../database/db');
+    await db('photos')
+      .where({ id: photo.id })
+      .update({ thumbnail_path: newThumbnailPath });
+    
+    logger.info(`Regenerated thumbnail for photo ${photo.id}`);
+    return newThumbnailPath;
+  }
+  
+  return null;
+}
+
+module.exports = { generateThumbnail, isThumbnailValid, ensureThumbnail };

backend/src/services/photoProcessor.js

@@ -0,0 +1,112 @@
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../database/db');
+const { generateThumbnail } = require('./imageProcessor');
+const { generatePhotoFilename } = require('../utils/filenameSanitizer');
+
+// Get storage path from environment or default
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+async function processUploadedPhotos(files, eventId, uploadedBy = 'admin', categoryId = null) {
+  const uploadedPhotos = [];
+  
+  // Get event details
+  const event = await db('events').where({ id: eventId }).first();
+  if (!event) {
+    throw new Error('Event not found');
+  }
+  
+  // Process each file
+  for (const file of files) {
+    const trx = await db.transaction();
+    
+    try {
+      // Get category info if provided
+      let category = null;
+      let counter = 1;
+      const parsedCategoryId = categoryId ? parseInt(categoryId) : null;
+      
+      if (parsedCategoryId) {
+        // Get category and update counter
+        category = await trx('photo_categories')
+          .where({ id: parsedCategoryId })
+          .first();
+        
+        if (category) {
+          counter = (category.photo_counter || 0) + 1;
+          await trx('photo_categories')
+            .where({ id: parsedCategoryId })
+            .update({ photo_counter: counter });
+        }
+      } else {
+        // For uncategorized photos, count existing uncategorized photos
+        const uncategorizedCount = await trx('photos')
+          .where({ event_id: eventId })
+          .whereNull('category_id')
+          .count('id as count')
+          .first();
+        
+        counter = (uncategorizedCount.count || 0) + 1;
+      }
+      
+      // Generate new filename
+      const extension = path.extname(file.originalname);
+      const newFilename = generatePhotoFilename(
+        event.event_name,
+        category ? category.name : 'uncategorized',
+        counter,
+        extension
+      );
+      
+      // Move file to event folder
+      const destPath = path.join(getStoragePath(), 'events/active', event.slug);
+      await fs.mkdir(destPath, { recursive: true });
+      
+      const newPath = path.join(destPath, newFilename);
+      // Use copyFile and unlink instead of rename to avoid cross-device issues
+      await fs.copyFile(file.path, newPath);
+      await fs.unlink(file.path);
+      
+      // Generate thumbnail
+      const thumbnailPath = await generateThumbnail(newPath);
+      
+      // Calculate relative paths
+      const storagePath = getStoragePath();
+      const relativePath = path.relative(path.join(storagePath, 'events/active'), newPath);
+      const relativeThumbPath = thumbnailPath; // thumbnailPath is already relative to storage root
+      
+      // Add to database with uploaded_by field
+      const [photoId] = await trx('photos').insert({
+        event_id: eventId,
+        filename: newFilename,
+        path: relativePath,
+        thumbnail_path: relativeThumbPath,
+        category_id: parsedCategoryId || null,
+        type: 'individual',
+        size_bytes: file.size,
+        uploaded_by: uploadedBy
+      });
+      
+      // Commit transaction
+      await trx.commit();
+      
+      uploadedPhotos.push({
+        id: photoId,
+        filename: newFilename,
+        size: file.size,
+        category_id: parsedCategoryId || null,
+        uploaded_by: uploadedBy
+      });
+    } catch (error) {
+      console.error(`Error processing file ${file.originalname}:`, error);
+      if (trx) await trx.rollback();
+      // Continue with other files
+    }
+  }
+  
+  return uploadedPhotos;
+}
+
+module.exports = {
+  processUploadedPhotos
+};

backend/src/services/rateLimitService.js

@@ -0,0 +1,283 @@
+const rateLimit = require('express-rate-limit');
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const logger = require('../utils/logger');
+
+// Cache for rate limit settings
+let settingsCache = null;
+let cacheExpiry = 0;
+const CACHE_DURATION = 60000; // 1 minute cache
+
+/**
+ * Get rate limit settings from database with caching
+ */
+async function getRateLimitSettings() {
+  try {
+    // Check cache
+    if (settingsCache && Date.now() < cacheExpiry) {
+      return settingsCache;
+    }
+
+    // Fetch from database
+    const settings = await db('app_settings')
+      .whereIn('setting_key', [
+        'rate_limit_enabled',
+        'rate_limit_window_minutes',
+        'rate_limit_max_requests',
+        'rate_limit_auth_max_requests',
+        'rate_limit_skip_authenticated',
+        'rate_limit_public_endpoints_only'
+      ]);
+
+    // Parse settings into object
+    const config = {
+      enabled: true,
+      windowMinutes: 15,
+      maxRequests: 100,
+      authMaxRequests: 5,
+      skipAuthenticated: true,
+      publicEndpointsOnly: false
+    };
+
+    settings.forEach(setting => {
+      const value = JSON.parse(setting.setting_value);
+      switch (setting.setting_key) {
+      case 'rate_limit_enabled':
+        config.enabled = value;
+        break;
+      case 'rate_limit_window_minutes':
+        config.windowMinutes = value;
+        break;
+      case 'rate_limit_max_requests':
+        config.maxRequests = value;
+        break;
+      case 'rate_limit_auth_max_requests':
+        config.authMaxRequests = value;
+        break;
+      case 'rate_limit_skip_authenticated':
+        config.skipAuthenticated = value;
+        break;
+      case 'rate_limit_public_endpoints_only':
+        config.publicEndpointsOnly = value;
+        break;
+      }
+    });
+
+    // Update cache
+    settingsCache = config;
+    cacheExpiry = Date.now() + CACHE_DURATION;
+
+    return config;
+  } catch (error) {
+    logger.error('Failed to fetch rate limit settings:', error);
+    // Return defaults on error
+    return {
+      enabled: true,
+      windowMinutes: 15,
+      maxRequests: 100,
+      authMaxRequests: 5,
+      skipAuthenticated: true,
+      publicEndpointsOnly: false
+    };
+  }
+}
+
+/**
+ * Clear settings cache (call when settings are updated)
+ */
+function clearSettingsCache() {
+  settingsCache = null;
+  cacheExpiry = 0;
+}
+
+/**
+ * Check if request has valid authentication
+ */
+function isAuthenticated(req) {
+  try {
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return false;
+    }
+
+    const token = authHeader.substring(7);
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    
+    // Check if token is valid
+    if (!decoded || typeof decoded !== 'object') {
+      return false;
+    }
+
+    // Valid token found - check type
+    req.tokenType = decoded.type; // 'admin' or 'gallery'
+    req.tokenPayload = decoded;
+    
+    return true;
+  } catch (error) {
+    return false;
+  }
+}
+
+/**
+ * Determine if rate limiting should be applied to this request
+ */
+function shouldSkipRateLimit(req, config) {
+  // If rate limiting is disabled globally
+  if (!config.enabled) {
+    return true;
+  }
+
+  // Never skip rate limiting for auth endpoints
+  const isAuthEndpoint = req.path.match(/\/(auth|login|gallery\/[^/]+\/verify)$/);
+  if (isAuthEndpoint) {
+    return false;
+  }
+
+  // Check if we should skip authenticated requests
+  if (config.skipAuthenticated && isAuthenticated(req)) {
+    return true;
+  }
+
+  // Check if we only rate limit public endpoints
+  if (config.publicEndpointsOnly) {
+    const isPublicEndpoint = req.path.startsWith('/api/public/') || 
+                           req.path.startsWith('/api/gallery/') ||
+                           isAuthEndpoint;
+    return !isPublicEndpoint;
+  }
+
+  return false;
+}
+
+/**
+ * Create dynamic rate limiter
+ */
+async function createRateLimiter() {
+  const config = await getRateLimitSettings();
+  
+  return rateLimit({
+    windowMs: config.windowMinutes * 60 * 1000,
+    max: async (req) => {
+      // Refresh config for each request
+      const currentConfig = await getRateLimitSettings();
+      
+      // Different limits for auth endpoints
+      const isAuthEndpoint = req.path.match(/\/(auth|login|gallery\/[^/]+\/verify)$/);
+      return isAuthEndpoint ? currentConfig.authMaxRequests : currentConfig.maxRequests;
+    },
+    keyGenerator: (req) => {
+      // Use correct client IP when behind proxy
+      return req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+             req.headers['x-real-ip'] || 
+             req.connection.remoteAddress || 
+             req.ip;
+    },
+    skip: async (req) => {
+      const currentConfig = await getRateLimitSettings();
+      return shouldSkipRateLimit(req, currentConfig);
+    },
+    handler: (req, res) => {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      
+      // Enhanced logging for production analysis
+      logger.warn('Rate limit exceeded', {
+        ip: clientIp,
+        path: req.path,
+        method: req.method,
+        authenticated: isAuthenticated(req),
+        tokenType: req.tokenType,
+        userAgent: req.headers['user-agent'],
+        referer: req.headers['referer'],
+        origin: req.headers['origin'],
+        timestamp: new Date().toISOString(),
+        headers: {
+          'x-forwarded-for': req.headers['x-forwarded-for'],
+          'x-real-ip': req.headers['x-real-ip']
+        },
+        requestUrl: req.originalUrl,
+        rateLimitInfo: {
+          limit: req.rateLimit?.limit,
+          current: req.rateLimit?.current,
+          remaining: req.rateLimit?.remaining,
+          resetTime: req.rateLimit?.resetTime ? new Date(req.rateLimit.resetTime).toISOString() : null
+        }
+      });
+      
+      res.status(429).json({ 
+        error: 'Too many requests, please try again later.',
+        retryAfter: res.getHeader('Retry-After')
+      });
+    },
+    standardHeaders: true, // Return rate limit info in headers
+    legacyHeaders: false, // Disable X-RateLimit headers
+  });
+}
+
+/**
+ * Create auth-specific rate limiter
+ */
+async function createAuthRateLimiter() {
+  const config = await getRateLimitSettings();
+  
+  return rateLimit({
+    windowMs: config.windowMinutes * 60 * 1000,
+    max: config.authMaxRequests,
+    keyGenerator: (req) => {
+      // Use correct client IP when behind proxy
+      return req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+             req.headers['x-real-ip'] || 
+             req.connection.remoteAddress || 
+             req.ip;
+    },
+    skip: async () => {
+      const currentConfig = await getRateLimitSettings();
+      return !currentConfig.enabled;
+    },
+    handler: (req, res) => {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      
+      // Enhanced logging for auth failures
+      logger.warn('Auth rate limit exceeded', {
+        ip: clientIp,
+        path: req.path,
+        method: req.method,
+        userAgent: req.headers['user-agent'],
+        timestamp: new Date().toISOString(),
+        headers: {
+          'x-forwarded-for': req.headers['x-forwarded-for'],
+          'x-real-ip': req.headers['x-real-ip'
+        },
+        requestUrl: req.originalUrl,
+        authType: req.path.includes('admin') ? 'admin' : 'gallery',
+        rateLimitInfo: {
+          limit: req.rateLimit?.limit,
+          current: req.rateLimit?.current,
+          remaining: req.rateLimit?.remaining,
+          resetTime: req.rateLimit?.resetTime ? new Date(req.rateLimit.resetTime).toISOString() : null
+        }
+      });
+      
+      res.status(429).json({ 
+        error: 'Too many authentication attempts, please try again later.',
+        retryAfter: res.getHeader('Retry-After')
+      });
+    },
+    standardHeaders: true,
+    legacyHeaders: false,
+  });
+}
+
+module.exports = {
+  getRateLimitSettings,
+  clearSettingsCache,
+  createRateLimiter,
+  createAuthRateLimiter,
+  isAuthenticated,
+  shouldSkipRateLimit
+};

backend/src/services/recaptcha.js

@@ -0,0 +1,58 @@
+const axios = require('axios');
+const { db } = require('../database/db');
+
+async function verifyRecaptcha(token) {
+  // Check if reCAPTCHA is enabled
+  const settings = await db('app_settings')
+    .whereIn('setting_key', ['security_enable_recaptcha', 'security_recaptcha_secret_key'])
+    .select('setting_key', 'setting_value');
+  
+  const settingsMap = {};
+  settings.forEach(setting => {
+    try {
+      settingsMap[setting.setting_key] = JSON.parse(setting.setting_value);
+    } catch (e) {
+      settingsMap[setting.setting_key] = setting.setting_value;
+    }
+  });
+  
+  const isEnabled = settingsMap.security_enable_recaptcha === true || 
+                    settingsMap.security_enable_recaptcha === 'true';
+  const secretKey = settingsMap.security_recaptcha_secret_key;
+  
+  // If reCAPTCHA is not enabled, always return true
+  if (!isEnabled) {
+    return true;
+  }
+  
+  // If enabled but no token provided, fail
+  if (!token) {
+    return false;
+  }
+  
+  // If no secret key configured, log warning but pass
+  if (!secretKey) {
+    console.warn('reCAPTCHA enabled but no secret key configured');
+    return true;
+  }
+  
+  try {
+    const response = await axios.post(
+      'https://www.google.com/recaptcha/api/siteverify',
+      null,
+      {
+        params: {
+          secret: secretKey,
+          response: token
+        }
+      }
+    );
+    
+    return response.data.success === true;
+  } catch (error) {
+    console.error('reCAPTCHA verification error:', error);
+    return false;
+  }
+}
+
+module.exports = { verifyRecaptcha };

backend/src/services/watermarkService.js

@@ -0,0 +1,226 @@
+const sharp = require('sharp');
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../database/db');
+
+class WatermarkService {
+  constructor() {
+    this.cache = new Map();
+    this.cacheMaxAge = 3600000; // 1 hour in milliseconds
+  }
+
+  /**
+   * Get watermark settings from database
+   */
+  async getWatermarkSettings() {
+    try {
+      const settings = await db('app_settings')
+        .whereIn('setting_key', [
+          'branding_watermark_enabled',
+          'branding_watermark_logo_path',
+          'branding_watermark_position',
+          'branding_watermark_opacity',
+          'branding_watermark_size',
+          'branding_company_name'
+        ])
+        .select('setting_key', 'setting_value');
+
+      const settingsObj = {};
+      settings.forEach(setting => {
+        try {
+          settingsObj[setting.setting_key] = JSON.parse(setting.setting_value);
+        } catch (e) {
+          settingsObj[setting.setting_key] = setting.setting_value;
+        }
+      });
+
+      return {
+        enabled: settingsObj.branding_watermark_enabled || false,
+        logoPath: settingsObj.branding_watermark_logo_path || null,
+        position: settingsObj.branding_watermark_position || 'bottom-right',
+        opacity: parseInt(settingsObj.branding_watermark_opacity || 50),
+        size: parseInt(settingsObj.branding_watermark_size || 15),
+        companyName: settingsObj.branding_company_name || 'Photo Gallery'
+      };
+    } catch (error) {
+      console.error('Error fetching watermark settings:', error);
+      return null;
+    }
+  }
+
+  /**
+   * Calculate position coordinates based on position string
+   */
+  getPositionCoordinates(imageWidth, imageHeight, watermarkWidth, watermarkHeight, position) {
+    const padding = 20;
+    let left, top;
+
+    switch (position) {
+    case 'top-left':
+      left = padding;
+      top = padding;
+      break;
+    case 'top-right':
+      left = imageWidth - watermarkWidth - padding;
+      top = padding;
+      break;
+    case 'bottom-left':
+      left = padding;
+      top = imageHeight - watermarkHeight - padding;
+      break;
+    case 'bottom-right':
+      left = imageWidth - watermarkWidth - padding;
+      top = imageHeight - watermarkHeight - padding;
+      break;
+    case 'center':
+      left = Math.floor((imageWidth - watermarkWidth) / 2);
+      top = Math.floor((imageHeight - watermarkHeight) / 2);
+      break;
+    default:
+      // Default to bottom-right
+      left = imageWidth - watermarkWidth - padding;
+      top = imageHeight - watermarkHeight - padding;
+    }
+
+    return { left: Math.max(0, left), top: Math.max(0, top) };
+  }
+
+  /**
+   * Apply watermark to an image
+   */
+  async applyWatermark(imagePath, settings) {
+    try {
+      if (!settings || !settings.enabled) {
+        // Return original image if watermarking is disabled
+        return await fs.readFile(imagePath);
+      }
+
+      // Check cache first
+      const cacheKey = `${imagePath}_${JSON.stringify(settings)}`;
+      const cached = this.cache.get(cacheKey);
+      if (cached && Date.now() - cached.timestamp < this.cacheMaxAge) {
+        return cached.buffer;
+      }
+
+      // Load the main image
+      const image = sharp(imagePath);
+      const metadata = await image.metadata();
+
+      let watermarkBuffer;
+      let watermarkMetadata;
+
+      // Try to use logo watermark first
+      if (settings.logoPath) {
+        try {
+          const watermarkImage = sharp(settings.logoPath);
+          watermarkMetadata = await watermarkImage.metadata();
+          
+          // Calculate watermark size based on percentage of main image
+          const scaleFactor = settings.size / 100;
+          const targetWidth = Math.floor(metadata.width * scaleFactor);
+          const targetHeight = Math.floor(watermarkMetadata.height * (targetWidth / watermarkMetadata.width));
+
+          // Resize watermark and apply opacity
+          watermarkBuffer = await watermarkImage
+            .resize(targetWidth, targetHeight, { fit: 'inside' })
+            .composite([{
+              input: Buffer.from([255, 255, 255, Math.floor(255 * (settings.opacity / 100))]),
+              raw: {
+                width: 1,
+                height: 1,
+                channels: 4
+              },
+              tile: true,
+              blend: 'dest-in'
+            }])
+            .toBuffer();
+
+          watermarkMetadata = { width: targetWidth, height: targetHeight };
+        } catch (error) {
+          console.error('Error processing watermark logo:', error);
+          watermarkBuffer = null;
+        }
+      }
+
+      // If no logo or logo failed, create text watermark
+      if (!watermarkBuffer) {
+        const fontSize = Math.max(16, Math.floor(metadata.width * 0.03));
+        const padding = 10;
+        
+        // Create SVG text watermark
+        const svg = `
+          <svg width="${settings.companyName.length * fontSize * 0.6 + padding * 2}" height="${fontSize + padding * 2}">
+            <rect x="0" y="0" width="100%" height="100%" fill="black" opacity="0.5" rx="5"/>
+            <text x="${padding}" y="${fontSize + padding/2}" 
+              font-family="Arial, sans-serif" 
+              font-size="${fontSize}" 
+              fill="white" 
+              opacity="${settings.opacity / 100}">
+              ${settings.companyName}
+            </text>
+          </svg>
+        `;
+        
+        watermarkBuffer = Buffer.from(svg);
+        watermarkMetadata = {
+          width: settings.companyName.length * fontSize * 0.6 + padding * 2,
+          height: fontSize + padding * 2
+        };
+      }
+
+      // Calculate position
+      const position = this.getPositionCoordinates(
+        metadata.width,
+        metadata.height,
+        watermarkMetadata.width,
+        watermarkMetadata.height,
+        settings.position
+      );
+
+      // Apply watermark
+      const watermarkedBuffer = await image
+        .composite([{
+          input: watermarkBuffer,
+          top: position.top,
+          left: position.left
+        }])
+        .toBuffer();
+
+      // Cache the result
+      this.cache.set(cacheKey, {
+        buffer: watermarkedBuffer,
+        timestamp: Date.now()
+      });
+
+      // Clean old cache entries
+      this.cleanCache();
+
+      return watermarkedBuffer;
+    } catch (error) {
+      console.error('Error applying watermark:', error);
+      // Return original image on error
+      return await fs.readFile(imagePath);
+    }
+  }
+
+  /**
+   * Clean old cache entries
+   */
+  cleanCache() {
+    const now = Date.now();
+    for (const [key, value] of this.cache.entries()) {
+      if (now - value.timestamp > this.cacheMaxAge) {
+        this.cache.delete(key);
+      }
+    }
+  }
+
+  /**
+   * Clear entire cache
+   */
+  clearCache() {
+    this.cache.clear();
+  }
+}
+
+module.exports = new WatermarkService();

backend/src/utils/authSecurity.js

@@ -0,0 +1,190 @@
+/**
+ * Authentication Security Utilities
+ * Provides enhanced security features for authentication
+ */
+
+const { db } = require('../database/db');
+const { formatBoolean } = require('./dbCompat');
+const logger = require('./logger');
+
+// Configuration constants
+const MAX_LOGIN_ATTEMPTS = 5;
+const LOCKOUT_DURATION = 30 * 60 * 1000; // 30 minutes in milliseconds
+const ATTEMPT_WINDOW = 15 * 60 * 1000; // 15 minutes window for counting attempts
+
+/**
+ * Track failed login attempt
+ * @param {string} identifier - Username or email
+ * @param {string} ipAddress - IP address of the attempt
+ * @param {string} userAgent - User agent string
+ */
+async function trackFailedAttempt(identifier, ipAddress, userAgent) {
+  try {
+    await db('login_attempts').insert({
+      identifier,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      attempt_time: new Date().toISOString(),
+      success: false
+    });
+
+    // Log security event
+    logger.warn('Failed login attempt', {
+      identifier,
+      ipAddress,
+      userAgent,
+      timestamp: new Date().toISOString()
+    });
+  } catch (error) {
+    logger.error('Error tracking failed login attempt:', error);
+  }
+}
+
+/**
+ * Track successful login
+ * @param {string} identifier - Username or email
+ * @param {string} ipAddress - IP address
+ * @param {string} userAgent - User agent string
+ */
+async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
+  try {
+    await db('login_attempts').insert({
+      identifier,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      attempt_time: new Date().toISOString(),
+      success: true
+    });
+
+    // Clear old failed attempts for this user
+    const cutoffTime = new Date(Date.now() - ATTEMPT_WINDOW);
+    await db('login_attempts')
+      .where('identifier', identifier)
+      .where('success', formatBoolean(false))
+      .where('attempt_time', '<', cutoffTime.toISOString())
+      .delete();
+  } catch (error) {
+    logger.error('Error tracking successful login:', error);
+  }
+}
+
+/**
+ * Check if account is locked due to too many failed attempts
+ * @param {string} identifier - Username or email
+ * @returns {Promise<{isLocked: boolean, remainingTime?: number}>}
+ */
+async function checkAccountLockout(identifier) {
+  try {
+    const recentWindow = new Date(Date.now() - ATTEMPT_WINDOW);
+    
+    // Get recent failed attempts
+    const failedAttempts = await db('login_attempts')
+      .where('identifier', identifier)
+      .where('success', formatBoolean(false))
+      .where('attempt_time', '>=', recentWindow.toISOString())
+      .orderBy('attempt_time', 'desc')
+      .limit(MAX_LOGIN_ATTEMPTS);
+
+    if (failedAttempts.length >= MAX_LOGIN_ATTEMPTS) {
+      // Check if still within lockout period
+      const oldestAttempt = failedAttempts[failedAttempts.length - 1];
+      const lockoutEnd = new Date(oldestAttempt.attempt_time).getTime() + LOCKOUT_DURATION;
+      const now = Date.now();
+
+      if (now < lockoutEnd) {
+        return {
+          isLocked: true,
+          remainingTime: Math.ceil((lockoutEnd - now) / 1000) // seconds
+        };
+      }
+    }
+
+    return { isLocked: false };
+  } catch (error) {
+    logger.error('Error checking account lockout:', error);
+    return { isLocked: false }; // Fail open to avoid locking users out due to errors
+  }
+}
+
+/**
+ * Check for suspicious login patterns
+ * @param {string} identifier - Username or email
+ * @param {string} ipAddress - Current IP address
+ * @returns {Promise<boolean>} - True if suspicious
+ */
+async function checkSuspiciousActivity(identifier, ipAddress) {
+  try {
+    // Check for rapid attempts from different IPs
+    const recentWindow = new Date(Date.now() - 5 * 60 * 1000); // 5 minutes
+    
+    const recentAttempts = await db('login_attempts')
+      .where('identifier', identifier)
+      .where('attempt_time', '>=', recentWindow.toISOString())
+      .select('ip_address')
+      .distinct('ip_address');
+
+    // If more than 3 different IPs in 5 minutes, it's suspicious
+    if (recentAttempts.length > 3) {
+      logger.warn('Suspicious login activity detected', {
+        identifier,
+        uniqueIPs: recentAttempts.length,
+        currentIP: ipAddress
+      });
+      return true;
+    }
+
+    return false;
+  } catch (error) {
+    logger.error('Error checking suspicious activity:', error);
+    return false;
+  }
+}
+
+/**
+ * Get generic error message to prevent user enumeration
+ * @returns {string}
+ */
+function getGenericAuthError() {
+  return 'Invalid credentials';
+}
+
+/**
+ * Clean up old login attempts (should be run periodically)
+ */
+async function cleanupOldAttempts() {
+  try {
+    const cutoffDate = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000); // 7 days
+    
+    const deleted = await db('login_attempts')
+      .where('attempt_time', '<', cutoffDate.toISOString())
+      .delete();
+
+    if (deleted > 0) {
+      logger.info(`Cleaned up ${deleted} old login attempts`);
+    }
+  } catch (error) {
+    logger.error('Error cleaning up login attempts:', error);
+  }
+}
+
+/**
+ * Initialize cleanup job
+ */
+function initializeCleanupJob() {
+  // Run cleanup every 24 hours
+  setInterval(cleanupOldAttempts, 24 * 60 * 60 * 1000);
+  
+  // Run initial cleanup
+  cleanupOldAttempts();
+}
+
+module.exports = {
+  trackFailedAttempt,
+  trackSuccessfulLogin,
+  checkAccountLockout,
+  checkSuspiciousActivity,
+  getGenericAuthError,
+  initializeCleanupJob,
+  MAX_LOGIN_ATTEMPTS,
+  LOCKOUT_DURATION
+};

backend/src/utils/cleanupTempUploads.js

@@ -0,0 +1,78 @@
+const path = require('path');
+const fs = require('fs').promises;
+const logger = require('./logger');
+
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+/**
+ * Clean up old temporary upload directories
+ * Removes temp directories older than 1 hour
+ */
+async function cleanupTempUploads() {
+  const tempPath = path.join(getStoragePath(), 'temp');
+  
+  try {
+    // Ensure temp directory exists
+    await fs.mkdir(tempPath, { recursive: true });
+    
+    // Read all items in temp directory
+    const items = await fs.readdir(tempPath);
+    
+    let cleanedCount = 0;
+    const oneHourAgo = Date.now() - (60 * 60 * 1000); // 1 hour
+    
+    for (const item of items) {
+      const itemPath = path.join(tempPath, item);
+      
+      try {
+        const stats = await fs.stat(itemPath);
+        
+        // Only process directories that match our upload pattern
+        if (stats.isDirectory() && item.startsWith('upload_')) {
+          // Extract timestamp from directory name
+          const parts = item.split('_');
+          if (parts.length >= 2) {
+            const timestamp = parseInt(parts[1]);
+            
+            // Remove if older than 1 hour
+            if (!isNaN(timestamp) && timestamp < oneHourAgo) {
+              logger.info(`Cleaning up old temp upload directory: ${item}`);
+              await fs.rm(itemPath, { recursive: true, force: true });
+              cleanedCount++;
+            }
+          }
+        }
+      } catch (error) {
+        logger.error(`Error processing temp item ${item}:`, error.message);
+      }
+    }
+    
+    if (cleanedCount > 0) {
+      logger.info(`Cleaned up ${cleanedCount} old temp upload directories`);
+    }
+    
+  } catch (error) {
+    logger.error('Error during temp upload cleanup:', error);
+  }
+}
+
+/**
+ * Start periodic cleanup of temp uploads
+ * Runs every hour
+ */
+function startTempUploadCleanup() {
+  // Run immediately on startup
+  cleanupTempUploads();
+  
+  // Then run every hour
+  setInterval(() => {
+    cleanupTempUploads();
+  }, 60 * 60 * 1000); // 1 hour
+  
+  logger.info('Temp upload cleanup service started');
+}
+
+module.exports = {
+  cleanupTempUploads,
+  startTempUploadCleanup
+};

backend/src/utils/dateFormatter.js

@@ -0,0 +1,100 @@
+const { db } = require('../database/db');
+
+// Default date format settings
+const DEFAULT_FORMAT = {
+  format: 'DD/MM/YYYY',
+  locale: 'en-GB'
+};
+
+// Format date based on system settings
+async function formatDate(date, language = 'en') {
+  try {
+    // Get date format setting from database
+    const setting = await db('app_settings').where('setting_key', 'general_date_format').first();
+    let dateConfig = DEFAULT_FORMAT;
+    
+    if (setting && setting.setting_value) {
+      // Handle both string and object values
+      if (typeof setting.setting_value === 'string') {
+        try {
+          dateConfig = JSON.parse(setting.setting_value);
+        } catch (e) {
+          console.warn('Failed to parse date format setting:', e.message);
+          dateConfig = DEFAULT_FORMAT;
+        }
+      } else {
+        dateConfig = setting.setting_value;
+      }
+    }
+    
+    // Ensure proper date parsing
+    let dateObj;
+    if (date instanceof Date) {
+      dateObj = date;
+    } else if (typeof date === 'string') {
+      // For date strings like "2025-07-16", parse as local date to avoid timezone issues
+      if (date.match(/^\d{4}-\d{2}-\d{2}$/)) {
+        // Parse YYYY-MM-DD format as local date
+        const [year, month, day] = date.split('-').map(num => parseInt(num, 10));
+        dateObj = new Date(year, month - 1, day);
+      } else {
+        dateObj = new Date(date);
+      }
+    } else {
+      dateObj = new Date(date);
+    }
+    
+    // Check if date is valid
+    if (isNaN(dateObj.getTime())) {
+      console.error('Invalid date provided to formatDate:', date);
+      throw new Error('Invalid date');
+    }
+    
+    // Use appropriate locale based on language
+    let locale = dateConfig.locale || 'en-GB';
+    if (language === 'de') {
+      locale = 'de-DE';
+    } else if (language === 'en' && dateConfig.format === 'MM/DD/YYYY') {
+      locale = 'en-US';
+    }
+    
+    // Format based on the configured format
+    switch (dateConfig.format) {
+    case 'MM/DD/YYYY':
+      return dateObj.toLocaleDateString(locale, {
+        month: '2-digit',
+        day: '2-digit',
+        year: 'numeric'
+      });
+    case 'DD/MM/YYYY':
+      return dateObj.toLocaleDateString(locale, {
+        day: '2-digit',
+        month: '2-digit',
+        year: 'numeric'
+      });
+    case 'YYYY-MM-DD':
+      return dateObj.toISOString().split('T')[0];
+    case 'DD.MM.YYYY':
+      return dateObj.toLocaleDateString('de-DE', {
+        day: '2-digit',
+        month: '2-digit',
+        year: 'numeric'
+      });
+    default:
+      // Use long format as fallback
+      return dateObj.toLocaleDateString(locale, {
+        year: 'numeric',
+        month: 'long',
+        day: 'numeric'
+      });
+    }
+  } catch (error) {
+    console.error('Error formatting date:', error);
+    // Fallback to basic formatting
+    return date instanceof Date ? date.toLocaleDateString() : new Date(date).toLocaleDateString();
+  }
+}
+
+module.exports = {
+  formatDate
+};

backend/src/utils/dbCompat.js

@@ -0,0 +1,133 @@
+/**
+ * Database Compatibility Utilities
+ * Handles differences between PostgreSQL and SQLite
+ */
+
+// Note: Requiring db here creates circular dependency
+// db should be passed as parameter or required where needed
+
+/**
+ * Get database client type
+ * @returns {string} 'pg' or 'sqlite3'
+ */
+function getDbClient() {
+  return process.env.DATABASE_CLIENT || 'sqlite3';
+}
+
+/**
+ * Check if using PostgreSQL
+ * @returns {boolean}
+ */
+function isPostgreSQL() {
+  return getDbClient() === 'pg';
+}
+
+/**
+ * Handle insert operations that return IDs
+ * Works with both PostgreSQL and SQLite
+ * @param {object} query - Knex query builder
+ * @returns {Promise<number>} The inserted ID
+ */
+async function insertAndGetId(query) {
+  const result = await query.returning('id');
+  
+  // PostgreSQL returns array of objects [{id: 1}]
+  // SQLite returns array of IDs [1]
+  return result[0]?.id || result[0];
+}
+
+/**
+ * Format date for database compatibility
+ * @param {Date} date - JavaScript Date object
+ * @returns {string} ISO string format that works on both databases
+ */
+function formatDateForDB(date) {
+  return date.toISOString();
+}
+
+/**
+ * Add days to a date (database agnostic)
+ * @param {Date} date - Starting date
+ * @param {number} days - Number of days to add
+ * @returns {Date} New date
+ */
+function addDays(date, days) {
+  const result = new Date(date);
+  result.setDate(result.getDate() + days);
+  return result;
+}
+
+/**
+ * Get date extraction SQL that works on both databases
+ * @param {object} db - Knex database instance
+ * @param {string} column - Column name
+ * @returns {object} Knex raw query
+ */
+function dateExtractSQL(db, column) {
+  if (isPostgreSQL()) {
+    return db.raw(`DATE(${column})`);
+  } else {
+    // SQLite uses date() function
+    return db.raw(`date(${column})`);
+  }
+}
+
+/**
+ * Get database size query
+ * @param {object} db - Knex database instance
+ * @param {string} dbName - Database name
+ * @returns {Promise<number>} Size in bytes
+ */
+async function getDatabaseSize(db, dbName) {
+  if (isPostgreSQL()) {
+    const result = await db.raw('SELECT pg_database_size(?) as size', [dbName]);
+    return result.rows[0]?.size || 0;
+  } else {
+    // For SQLite, check file size
+    const fs = require('fs').promises;
+    const path = require('path');
+    const dbPath = process.env.DATABASE_PATH || path.join(__dirname, '../../data/photo_sharing.db');
+    try {
+      const stats = await fs.stat(dbPath);
+      return stats.size;
+    } catch (error) {
+      console.error('Error getting SQLite database size:', error);
+      return 0;
+    }
+  }
+}
+
+/**
+ * Handle boolean values for database compatibility
+ * @param {boolean} value - Boolean value
+ * @returns {any} Database-appropriate boolean representation
+ */
+function formatBoolean(value) {
+  if (isPostgreSQL()) {
+    return value;
+  } else {
+    // SQLite stores booleans as 0/1
+    return value ? 1 : 0;
+  }
+}
+
+/**
+ * Parse boolean from database
+ * @param {any} value - Database boolean value
+ * @returns {boolean} JavaScript boolean
+ */
+function parseBoolean(value) {
+  return Boolean(value);
+}
+
+module.exports = {
+  getDbClient,
+  isPostgreSQL,
+  insertAndGetId,
+  formatDateForDB,
+  addDays,
+  dateExtractSQL,
+  getDatabaseSize,
+  formatBoolean,
+  parseBoolean
+};

backend/src/utils/fileSecurityUtils.js

@@ -0,0 +1,233 @@
+const path = require('path');
+const fs = require('fs').promises;
+
+/**
+ * Secure file security utilities to prevent path traversal and validate file types
+ */
+
+/**
+ * Safely join paths and prevent directory traversal attacks
+ * @param {string} basePath - The base directory path
+ * @param {string} userPath - The user-provided path to join
+ * @returns {string} - Safe joined path
+ * @throws {Error} - If path traversal is detected
+ */
+function safePathJoin(basePath, userPath) {
+  // Normalize the base path
+  const normalizedBase = path.resolve(basePath);
+  
+  // Join and resolve the full path
+  const joinedPath = path.join(normalizedBase, userPath);
+  const resolvedPath = path.resolve(joinedPath);
+  
+  // Ensure the resolved path starts with the base path
+  if (!resolvedPath.startsWith(normalizedBase + path.sep) && resolvedPath !== normalizedBase) {
+    throw new Error('Path traversal attempt detected');
+  }
+  
+  return resolvedPath;
+}
+
+/**
+ * Validate file path to prevent directory traversal
+ * @param {string} filePath - The file path to validate
+ * @returns {boolean} - True if path is safe
+ */
+function isPathSafe(filePath) {
+  // Check for common path traversal patterns
+  const dangerousPatterns = [
+    /\.\.[\/\\]/,  // ../ or ..\
+    /^[A-Za-z]:/,  // Windows drive letters
+    /[\x00-\x1f]/  // Control characters
+  ];
+  
+  return !dangerousPatterns.some(pattern => pattern.test(filePath));
+}
+
+/**
+ * Enhanced MIME type validation
+ */
+const ALLOWED_IMAGE_TYPES = {
+  'image/jpeg': {
+    extensions: ['.jpg', '.jpeg'],
+    magicNumbers: [
+      { offset: 0, bytes: [0xFF, 0xD8, 0xFF] } // JPEG
+    ]
+  },
+  'image/png': {
+    extensions: ['.png'],
+    magicNumbers: [
+      { offset: 0, bytes: [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A] } // PNG
+    ]
+  },
+  'image/webp': {
+    extensions: ['.webp'],
+    magicNumbers: [
+      { offset: 0, bytes: [0x52, 0x49, 0x46, 0x46] }, // RIFF
+      { offset: 8, bytes: [0x57, 0x45, 0x42, 0x50] }  // WEBP
+    ]
+  },
+  'image/gif': {
+    extensions: ['.gif'],
+    magicNumbers: [
+      { offset: 0, bytes: [0x47, 0x49, 0x46, 0x38, 0x37, 0x61] }, // GIF87a
+      { offset: 0, bytes: [0x47, 0x49, 0x46, 0x38, 0x39, 0x61] }  // GIF89a
+    ]
+  },
+  'image/svg+xml': {
+    extensions: ['.svg'],
+    // SVG files are XML-based text files, so we skip magic number validation
+    magicNumbers: null
+  }
+};
+
+/**
+ * Validate file type by MIME type and extension
+ * @param {string} filename - The filename
+ * @param {string} mimetype - The MIME type
+ * @param {string[]} allowedTypes - Array of allowed MIME types
+ * @returns {boolean} - True if file type is valid
+ */
+function validateFileType(filename, mimetype, allowedTypes) {
+  // Check if MIME type is allowed
+  if (!allowedTypes.includes(mimetype)) {
+    return false;
+  }
+  
+  // Get file extension
+  const ext = path.extname(filename).toLowerCase();
+  
+  // Check if extension matches the MIME type
+  const typeConfig = ALLOWED_IMAGE_TYPES[mimetype];
+  if (!typeConfig || !typeConfig.extensions.includes(ext)) {
+    return false;
+  }
+  
+  return true;
+}
+
+/**
+ * Validate file content by checking magic numbers (file signatures)
+ * @param {string} filePath - Path to the file
+ * @param {string} expectedMimeType - Expected MIME type
+ * @returns {Promise<boolean>} - True if file content matches expected type
+ */
+async function validateFileContent(filePath, expectedMimeType) {
+  try {
+    const typeConfig = ALLOWED_IMAGE_TYPES[expectedMimeType];
+    if (!typeConfig) {
+      return false;
+    }
+    
+    // Skip validation for file types without magic numbers (like SVG)
+    if (!typeConfig.magicNumbers) {
+      return true;
+    }
+    
+    // Read the first 20 bytes of the file (enough for most magic numbers)
+    const buffer = Buffer.alloc(20);
+    const fileHandle = await fs.open(filePath, 'r');
+    await fileHandle.read(buffer, 0, 20, 0);
+    await fileHandle.close();
+    
+    // Check magic numbers
+    return typeConfig.magicNumbers.every(magic => {
+      for (let i = 0; i < magic.bytes.length; i++) {
+        if (buffer[magic.offset + i] !== magic.bytes[i]) {
+          return false;
+        }
+      }
+      return true;
+    });
+  } catch (error) {
+    console.error('Error validating file content:', error);
+    return false;
+  }
+}
+
+/**
+ * Get safe filename for storage
+ * @param {string} originalFilename - Original filename
+ * @returns {string} - Safe filename
+ */
+function getSafeFilename(originalFilename) {
+  const timestamp = Date.now();
+  const randomString = Math.random().toString(36).substring(2, 15);
+  const ext = path.extname(originalFilename).toLowerCase();
+  
+  // Validate extension
+  const validExtensions = ['.jpg', '.jpeg', '.png', '.webp', '.gif', '.svg', '.ico'];
+  if (!validExtensions.includes(ext)) {
+    throw new Error('Invalid file extension');
+  }
+  
+  return `upload_${timestamp}_${randomString}${ext}`;
+}
+
+/**
+ * Create a file upload validator middleware
+ * @param {Object} options - Validation options
+ * @returns {Function} - Express middleware function
+ */
+function createFileUploadValidator(options = {}) {
+  const {
+    allowedTypes = ['image/jpeg', 'image/png', 'image/webp'],
+    maxFileSize = 50 * 1024 * 1024, // 50MB default
+    validateContent = true
+  } = options;
+  
+  return async (req, res, next) => {
+    try {
+      if (!req.files || req.files.length === 0) {
+        return next();
+      }
+      
+      for (const file of req.files) {
+        // Validate file type
+        if (!validateFileType(file.originalname, file.mimetype, allowedTypes)) {
+          return res.status(400).json({ 
+            error: `Invalid file type: ${file.originalname}. Allowed types: ${allowedTypes.join(', ')}` 
+          });
+        }
+        
+        // Validate file size
+        if (file.size > maxFileSize) {
+          return res.status(400).json({ 
+            error: `File too large: ${file.originalname}. Maximum size: ${maxFileSize / 1024 / 1024}MB` 
+          });
+        }
+        
+        // Validate file content if enabled
+        if (validateContent && file.path) {
+          const isValidContent = await validateFileContent(file.path, file.mimetype);
+          if (!isValidContent) {
+            // Remove the file if content doesn't match
+            try {
+              await fs.unlink(file.path);
+            } catch (err) {
+              console.error('Error removing invalid file:', err);
+            }
+            return res.status(400).json({ 
+              error: `File content does not match declared type: ${file.originalname}` 
+            });
+          }
+        }
+      }
+      
+      next();
+    } catch (error) {
+      console.error('File validation error:', error);
+      res.status(500).json({ error: 'File validation failed' });
+    }
+  };
+}
+
+module.exports = {
+  safePathJoin,
+  isPathSafe,
+  validateFileType,
+  validateFileContent,
+  getSafeFilename,
+  createFileUploadValidator,
+  ALLOWED_IMAGE_TYPES
+};

backend/src/utils/filenameSanitizer.js

@@ -0,0 +1,57 @@
+/**
+ * Sanitize a string to be used as a filename component
+ * @param {string} str - The string to sanitize
+ * @param {number} maxLength - Maximum length of the sanitized string
+ * @returns {string} - Sanitized string
+ */
+function sanitizeFilename(str, maxLength = 50) {
+  if (!str) return 'unnamed';
+  
+  // Convert to string and trim
+  let sanitized = String(str).trim();
+  
+  // Replace spaces with underscores
+  sanitized = sanitized.replace(/\s+/g, '_');
+  
+  // Remove special characters except hyphens, underscores, and dots
+  sanitized = sanitized.replace(/[^a-zA-Z0-9_\-\.]/g, '');
+  
+  // Remove multiple consecutive underscores or hyphens
+  sanitized = sanitized.replace(/[_\-]{2,}/g, '_');
+  
+  // Remove leading/trailing underscores or hyphens
+  sanitized = sanitized.replace(/^[_\-]+|[_\-]+$/g, '');
+  
+  // Limit length
+  if (sanitized.length > maxLength) {
+    sanitized = sanitized.substring(0, maxLength);
+  }
+  
+  // If empty after sanitization, use default
+  if (!sanitized) {
+    sanitized = 'unnamed';
+  }
+  
+  return sanitized;
+}
+
+/**
+ * Generate a photo filename based on event name, category, and counter
+ * @param {string} eventName - The event name
+ * @param {string} categoryName - The category name
+ * @param {number} counter - The photo counter
+ * @param {string} extension - The file extension (including dot)
+ * @returns {string} - Generated filename
+ */
+function generatePhotoFilename(eventName, categoryName, counter, extension) {
+  const sanitizedEvent = sanitizeFilename(eventName, 30);
+  const sanitizedCategory = sanitizeFilename(categoryName || 'uncategorized', 20);
+  const paddedCounter = String(counter).padStart(4, '0');
+  
+  return `${sanitizedEvent}_${sanitizedCategory}_${paddedCounter}${extension}`;
+}
+
+module.exports = {
+  sanitizeFilename,
+  generatePhotoFilename
+};

backend/src/utils/formatters.js

@@ -0,0 +1,40 @@
+/**
+ * Formatters for email content and other text transformations
+ */
+
+/**
+ * Convert plain text line breaks to HTML line breaks
+ * @param {string} text - The text to format
+ * @returns {string} - Text with HTML line breaks
+ */
+function nl2br(text) {
+  if (!text) return '';
+  
+  // Normalize line endings
+  text = text.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+  
+  // Convert newlines to <br> tags
+  return text
+    .split('\n')
+    .map(line => line.trim())
+    .filter(line => line.length > 0)
+    .join('<br />');
+}
+
+/**
+ * Format welcome message for email templates
+ * @param {string} message - The welcome message
+ * @returns {string} - Formatted message for HTML emails
+ */
+function formatWelcomeMessage(message) {
+  if (!message || message.trim() === '') {
+    return '';
+  }
+  
+  return nl2br(message);
+}
+
+module.exports = {
+  nl2br,
+  formatWelcomeMessage
+};

backend/src/utils/logger.js

@@ -0,0 +1,98 @@
+const winston = require('winston');
+const path = require('path');
+const fs = require('fs');
+
+// Ensure logs directory exists
+const logDir = path.join(__dirname, '../../logs');
+if (!fs.existsSync(logDir)) {
+  fs.mkdirSync(logDir, { recursive: true });
+}
+
+// Custom format for production logs
+const productionFormat = winston.format.combine(
+  winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss.SSS' }),
+  winston.format.errors({ stack: true }),
+  winston.format.json(),
+  winston.format.printf(info => {
+    // Ensure all security events are properly formatted
+    if (info.level === 'warn' && (info.message.includes('rate limit') || 
+                                   info.message.includes('auth') ||
+                                   info.message.includes('login') ||
+                                   info.message.includes('JWT'))) {
+      return JSON.stringify({
+        timestamp: info.timestamp,
+        level: info.level,
+        message: info.message,
+        security: true,
+        ...info
+      });
+    }
+    return JSON.stringify(info);
+  })
+);
+
+const logger = winston.createLogger({
+  level: process.env.LOG_LEVEL || 'info',
+  format: productionFormat,
+  transports: [
+    new winston.transports.File({ 
+      filename: path.join(logDir, 'error.log'), 
+      level: 'error',
+      maxsize: 10 * 1024 * 1024, // 10MB
+      maxFiles: 5,
+      tailable: true
+    }),
+    new winston.transports.File({ 
+      filename: path.join(logDir, 'combined.log'),
+      maxsize: 50 * 1024 * 1024, // 50MB
+      maxFiles: 10,
+      tailable: true
+    }),
+    // Separate security log for authentication and rate limiting
+    new winston.transports.File({
+      filename: path.join(logDir, 'security.log'),
+      level: 'warn',
+      maxsize: 20 * 1024 * 1024, // 20MB
+      maxFiles: 10,
+      tailable: true,
+      format: winston.format.combine(
+        winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss.SSS' }),
+        winston.format.json(),
+        winston.format.printf(info => {
+          // Only log security-related warnings
+          if (info.message.includes('rate limit') || 
+              info.message.includes('auth') ||
+              info.message.includes('login') ||
+              info.message.includes('JWT') ||
+              info.message.includes('lockout') ||
+              info.message.includes('suspicious')) {
+            return JSON.stringify(info);
+          }
+          return null;
+        })
+      )
+    })
+  ].filter(Boolean)
+});
+
+// Add console logging for non-production environments
+if (process.env.NODE_ENV !== 'production') {
+  logger.add(new winston.transports.Console({
+    format: winston.format.combine(
+      winston.format.colorize(),
+      winston.format.timestamp({ format: 'HH:mm:ss' }),
+      winston.format.printf(info => {
+        return `[${info.timestamp}] ${info.level}: ${info.message} ${info.stack || ''}`;
+      })
+    )
+  }));
+} else {
+  // In production, also log to console for container environments
+  if (process.env.LOG_TO_CONSOLE === 'true') {
+    logger.add(new winston.transports.Console({
+      format: productionFormat
+    }));
+  }
+}
+
+module.exports = logger;

backend/src/utils/passwordGenerator.js

@@ -0,0 +1,122 @@
+const crypto = require('crypto');
+
+/**
+ * Generate a secure random password
+ * @param {number} length - Password length (default: 16)
+ * @returns {string} Generated password
+ */
+function generateSecurePassword(length = 16) {
+  const charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+-=[]{}|;:,.<>?';
+  let password = '';
+  
+  // Ensure at least one of each required character type
+  const lowercase = 'abcdefghijklmnopqrstuvwxyz';
+  const uppercase = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+  const numbers = '0123456789';
+  const special = '!@#$%^&*()_+-=[]{}|;:,.<>?';
+  
+  // Add one of each required type
+  password += lowercase[crypto.randomInt(lowercase.length)];
+  password += uppercase[crypto.randomInt(uppercase.length)];
+  password += numbers[crypto.randomInt(numbers.length)];
+  password += special[crypto.randomInt(special.length)];
+  
+  // Fill the rest randomly
+  for (let i = password.length; i < length; i++) {
+    password += charset[crypto.randomInt(charset.length)];
+  }
+  
+  // Shuffle the password
+  return password.split('').sort(() => crypto.randomInt(3) - 1).join('');
+}
+
+/**
+ * Generate a human-readable password using words and numbers
+ * @returns {string} Generated password
+ */
+function generateReadablePassword() {
+  const adjectives = [
+    'Swift', 'Bright', 'Strong', 'Happy', 'Clever',
+    'Brave', 'Noble', 'Quick', 'Sharp', 'Bold'
+  ];
+  
+  const nouns = [
+    'Eagle', 'Mountain', 'River', 'Thunder', 'Forest',
+    'Ocean', 'Falcon', 'Dragon', 'Phoenix', 'Tiger'
+  ];
+  
+  const adjective = adjectives[crypto.randomInt(adjectives.length)];
+  const noun = nouns[crypto.randomInt(nouns.length)];
+  const number = crypto.randomInt(1000, 9999);
+  const special = '!@#$%'[crypto.randomInt(5)];
+  
+  return `${adjective}${noun}${number}${special}`;
+}
+
+/**
+ * Validate password strength
+ * @param {string} password - Password to validate
+ * @returns {object} Validation result with score and messages
+ */
+function validatePasswordStrength(password) {
+  const result = {
+    score: 0,
+    messages: [],
+    isValid: false
+  };
+  
+  // Length check
+  if (password.length < 8) {
+    result.messages.push('Password must be at least 8 characters long');
+  } else if (password.length < 12) {
+    result.score += 1;
+  } else {
+    result.score += 2;
+  }
+  
+  // Character type checks
+  if (!/[a-z]/.test(password)) {
+    result.messages.push('Password must contain lowercase letters');
+  } else {
+    result.score += 1;
+  }
+  
+  if (!/[A-Z]/.test(password)) {
+    result.messages.push('Password must contain uppercase letters');
+  } else {
+    result.score += 1;
+  }
+  
+  if (!/[0-9]/.test(password)) {
+    result.messages.push('Password must contain numbers');
+  } else {
+    result.score += 1;
+  }
+  
+  if (!/[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]/.test(password)) {
+    result.messages.push('Password must contain special characters');
+  } else {
+    result.score += 1;
+  }
+  
+  // Common password check
+  const commonPasswords = [
+    'password', 'admin123', '12345678', 'qwerty', 'abc123',
+    'password123', 'admin', 'letmein', 'welcome', 'monkey'
+  ];
+  
+  if (commonPasswords.includes(password.toLowerCase())) {
+    result.score = 0;
+    result.messages.push('Password is too common');
+  }
+  
+  result.isValid = result.score >= 4 && result.messages.length === 0;
+  
+  return result;
+}
+
+module.exports = {
+  generateSecurePassword,
+  generateReadablePassword,
+  validatePasswordStrength
+};

backend/src/utils/passwordValidation.js

@@ -0,0 +1,285 @@
+/**
+ * Password Validation and Security Utilities
+ * Implements strong password requirements and security checks
+ */
+
+const zxcvbn = require('zxcvbn');
+const logger = require('./logger');
+
+// Configuration
+const PASSWORD_CONFIG = {
+  minLength: 8, // Reduced from 12 to 8 for better usability
+  requireUppercase: true,
+  requireLowercase: true,
+  requireNumbers: true,
+  requireSpecialChars: false, // Made optional for gallery passwords
+  preventCommonPasswords: true,
+  minStrengthScore: 2, // Reduced from 3 to 2 (moderate strength)
+  bcryptRounds: parseInt(process.env.BCRYPT_ROUNDS) || 12 // Configurable, default 12
+};
+
+// Common passwords to block (extend this list)
+const COMMON_PASSWORDS = [
+  'password', 'password123', 'admin123', 'welcome123', 'test123',
+  'qwerty', 'abc123', '123456', 'password1', 'admin',
+  'letmein', 'welcome', 'monkey', 'dragon', 'baseball'
+];
+
+/**
+ * Validate password meets security requirements
+ * @param {string} password - Password to validate
+ * @param {Object} options - Optional configuration overrides
+ * @returns {Object} - { valid: boolean, errors: string[], score: number, feedback: Object }
+ */
+function validatePassword(password, options = {}) {
+  const config = { ...PASSWORD_CONFIG, ...options };
+  const errors = [];
+  
+  // Check if password exists
+  if (!password || typeof password !== 'string') {
+    return {
+      valid: false,
+      errors: ['Password is required'],
+      score: 0,
+      feedback: {}
+    };
+  }
+  
+  // Check minimum length
+  if (password.length < config.minLength) {
+    errors.push(`Password must be at least ${config.minLength} characters long`);
+  }
+  
+  // Check uppercase requirement
+  if (config.requireUppercase && !/[A-Z]/.test(password)) {
+    errors.push('Password must contain at least one uppercase letter');
+  }
+  
+  // Check lowercase requirement
+  if (config.requireLowercase && !/[a-z]/.test(password)) {
+    errors.push('Password must contain at least one lowercase letter');
+  }
+  
+  // Check number requirement
+  if (config.requireNumbers && !/[0-9]/.test(password)) {
+    errors.push('Password must contain at least one number');
+  }
+  
+  // Check special character requirement
+  if (config.requireSpecialChars && !/[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password)) {
+    errors.push('Password must contain at least one special character');
+  }
+  
+  // Check against common passwords
+  if (config.preventCommonPasswords) {
+    const lowerPassword = password.toLowerCase();
+    if (COMMON_PASSWORDS.includes(lowerPassword)) {
+      errors.push('This password is too common. Please choose a more unique password');
+    }
+  }
+  
+  // Skip zxcvbn check if explicitly disabled (for gallery passwords)
+  if (options.skipStrengthCheck) {
+    return {
+      valid: errors.length === 0,
+      errors,
+      score: 2, // Default moderate score for gallery passwords
+      feedback: {}
+    };
+  }
+  
+  // Use zxcvbn for strength analysis
+  const strength = zxcvbn(password);
+  
+  // Check minimum strength score
+  if (strength.score < config.minStrengthScore) {
+    errors.push('Password is too weak. Please choose a stronger password');
+  }
+  
+  // Add zxcvbn suggestions
+  if (strength.feedback.suggestions.length > 0) {
+    errors.push(...strength.feedback.suggestions);
+  }
+  
+  return {
+    valid: errors.length === 0,
+    errors,
+    score: strength.score,
+    feedback: {
+      warning: strength.feedback.warning,
+      suggestions: strength.feedback.suggestions,
+      crackTime: strength.crack_times_display.offline_slow_hashing_1e4_per_second
+    }
+  };
+}
+
+/**
+ * Validate password for specific contexts (admin, gallery)
+ * @param {string} password - Password to validate
+ * @param {string} context - Context ('admin' or 'gallery')
+ * @param {Object} userData - Additional user data for context-aware validation
+ * @returns {Object} - Validation result
+ */
+function validatePasswordInContext(password, context, userData = {}) {
+  // For gallery context, use more lenient validation
+  if (context === 'gallery') {
+    // Gallery-specific validation options
+    const galleryOptions = {
+      minLength: 6, // Reduced minimum length
+      requireUppercase: false, // Don't require uppercase for galleries
+      requireLowercase: false, // Don't require lowercase for galleries
+      requireNumbers: false, // Numbers are optional
+      requireSpecialChars: false, // Special chars are optional
+      preventCommonPasswords: true, // Still prevent common passwords
+      minStrengthScore: 0, // Accept any score for galleries
+      skipStrengthCheck: true // Skip zxcvbn strength analysis for galleries
+    };
+    
+    // Base validation with gallery-specific options
+    const result = validatePassword(password, galleryOptions);
+    
+    // Override validation for common date formats
+    // Allow passwords like "04.07.2025", "04/07/2025", "04-07-2025"
+    const datePattern = /^\d{1,2}[.\/-]\d{1,2}[.\/-]\d{4}$/;
+    if (datePattern.test(password)) {
+      // Date format is valid for gallery passwords
+      return {
+        valid: true,
+        errors: [],
+        score: 2,
+        feedback: {}
+      };
+    }
+    
+    // Additional gallery-specific checks
+    if (password.length < 6) {
+      result.valid = false;
+      result.errors = ['Password must be at least 6 characters long'];
+    }
+    
+    // Check if it's too simple (e.g., just "123456")
+    if (/^\d{1,6}$/.test(password)) {
+      result.valid = false;
+      result.errors.push('Password cannot be just numbers. Consider using a date format like "04.07.2025"');
+    }
+    
+    return result;
+  }
+  
+  // Base validation for other contexts
+  const result = validatePassword(password);
+  
+  // Context-specific validation
+  if (context === 'admin') {
+    // Admins need stronger passwords
+    if (result.score < 4) {
+      result.valid = false;
+      result.errors.push('Admin passwords must be very strong (score 4/4)');
+    }
+    
+    // Check password doesn't contain username
+    if (userData.username && password.toLowerCase().includes(userData.username.toLowerCase())) {
+      result.valid = false;
+      result.errors.push('Password must not contain your username');
+    }
+    
+    // Check password doesn't contain email
+    if (userData.email) {
+      const emailUser = userData.email.split('@')[0];
+      if (password.toLowerCase().includes(emailUser.toLowerCase())) {
+        result.valid = false;
+        result.errors.push('Password must not contain parts of your email');
+      }
+    }
+  }
+  
+  return result;
+}
+
+/**
+ * Generate a secure random password
+ * @param {Object} options - Generation options
+ * @returns {string} - Generated password
+ */
+function generateSecurePassword(options = {}) {
+  const config = {
+    length: options.length || 16,
+    includeUppercase: options.includeUppercase !== false,
+    includeLowercase: options.includeLowercase !== false,
+    includeNumbers: options.includeNumbers !== false,
+    includeSpecialChars: options.includeSpecialChars !== false,
+    excludeAmbiguous: options.excludeAmbiguous !== false
+  };
+  
+  let charset = '';
+  
+  if (config.includeLowercase) {
+    charset += config.excludeAmbiguous ? 'abcdefghjkmnpqrstuvwxyz' : 'abcdefghijklmnopqrstuvwxyz';
+  }
+  
+  if (config.includeUppercase) {
+    charset += config.excludeAmbiguous ? 'ABCDEFGHJKLMNPQRSTUVWXYZ' : 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+  }
+  
+  if (config.includeNumbers) {
+    charset += config.excludeAmbiguous ? '23456789' : '0123456789';
+  }
+  
+  if (config.includeSpecialChars) {
+    charset += '!@#$%^&*()_+-=[]{}|;:,.<>?';
+  }
+  
+  if (charset.length === 0) {
+    throw new Error('At least one character type must be included');
+  }
+  
+  // Generate password
+  const crypto = require('crypto');
+  let password = '';
+  
+  for (let i = 0; i < config.length; i++) {
+    const randomIndex = crypto.randomInt(charset.length);
+    password += charset[randomIndex];
+  }
+  
+  // Ensure password meets requirements
+  const validation = validatePassword(password);
+  if (!validation.valid) {
+    // Recursively generate until we get a valid password
+    return generateSecurePassword(options);
+  }
+  
+  return password;
+}
+
+/**
+ * Get bcrypt rounds configuration
+ * @returns {number} - Number of bcrypt rounds to use
+ */
+function getBcryptRounds() {
+  return PASSWORD_CONFIG.bcryptRounds;
+}
+
+/**
+ * Log password validation failures for security monitoring
+ * @param {string} context - Context of validation failure
+ * @param {Array} errors - Validation errors
+ * @param {Object} metadata - Additional metadata
+ */
+function logPasswordValidationFailure(context, errors, metadata = {}) {
+  logger.warn('Password validation failed', {
+    context,
+    errorCount: errors.length,
+    errors: errors.slice(0, 3), // Log first 3 errors only
+    ...metadata
+  });
+}
+
+module.exports = {
+  validatePassword,
+  validatePasswordInContext,
+  generateSecurePassword,
+  getBcryptRounds,
+  logPasswordValidationFailure,
+  PASSWORD_CONFIG
+};

backend/src/utils/rateLimitSecurity.js

@@ -0,0 +1,119 @@
+/**
+ * Rate Limiting Security Utilities
+ * Provides secure rate limiting that prevents bypass attempts
+ */
+
+const jwt = require('jsonwebtoken');
+const logger = require('./logger');
+
+/**
+ * Safely check if a request has a valid admin token
+ * Used to determine if rate limiting should be skipped
+ * 
+ * IMPORTANT: This prevents the bypass vulnerability where
+ * invalid tokens could skip rate limiting
+ * 
+ * @param {Object} req - Express request object
+ * @returns {boolean} - True only if token is valid AND admin type
+ */
+function hasValidAdminToken(req) {
+  try {
+    // Only check admin paths
+    if (!req.path.startsWith('/api/admin/')) {
+      return false;
+    }
+
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return false;
+    }
+
+    const token = authHeader.substring(7); // Remove 'Bearer ' prefix
+    
+    // Critical: Verify token is valid before skipping rate limit
+    // This prevents invalid tokens from bypassing rate limiting
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    
+    // Additional validation
+    if (!decoded || typeof decoded !== 'object') {
+      return false;
+    }
+    
+    // Must be admin type to skip rate limiting
+    if (decoded.type !== 'admin') {
+      logger.warn('Non-admin token attempted to bypass rate limit', {
+        path: req.path,
+        tokenType: decoded.type,
+        ip: req.ip
+      });
+      return false;
+    }
+    
+    // Optional: Check token age (prevent old tokens)
+    const tokenAge = Date.now() - (decoded.iat * 1000);
+    const maxAge = 24 * 60 * 60 * 1000; // 24 hours
+    
+    if (tokenAge > maxAge) {
+      logger.warn('Old admin token attempted to bypass rate limit', {
+        path: req.path,
+        tokenAge: Math.floor(tokenAge / 1000 / 60) + ' minutes',
+        ip: req.ip
+      });
+      return false;
+    }
+    
+    // Valid admin token - can skip rate limiting
+    return true;
+    
+  } catch (error) {
+    // Any error means token is invalid
+    // Log attempts with invalid tokens (potential attacks)
+    if (error.name === 'JsonWebTokenError') {
+      logger.warn('Invalid token attempted to bypass rate limit', {
+        path: req.path,
+        error: error.message,
+        ip: req.ip
+      });
+    }
+    
+    // Apply rate limiting for any invalid token
+    return false;
+  }
+}
+
+/**
+ * Create a skip function for rate limiter that prevents bypass
+ * @returns {Function} Skip function for express-rate-limit
+ */
+function createSecureSkipFunction() {
+  return (req) => {
+    // In development, be more lenient with public settings
+    if (process.env.NODE_ENV === 'development' && req.path === '/api/public/settings') {
+      return true;
+    }
+    
+    // Only skip for valid admin tokens
+    return hasValidAdminToken(req);
+  };
+}
+
+/**
+ * Log rate limit hits for security monitoring
+ * @param {Object} req - Express request object
+ * @param {Object} res - Express response object
+ */
+function logRateLimitHit(req, res) {
+  logger.warn('Rate limit exceeded', {
+    ip: req.ip,
+    path: req.path,
+    userAgent: req.headers['user-agent'],
+    remaining: res.getHeader('X-RateLimit-Remaining'),
+    limit: res.getHeader('X-RateLimit-Limit')
+  });
+}
+
+module.exports = {
+  hasValidAdminToken,
+  createSecureSkipFunction,
+  logRateLimitHit
+};

backend/src/utils/sqlSecurity.js

@@ -0,0 +1,117 @@
+/**
+ * SQL Security Utilities
+ * Provides safe methods for handling user input in SQL queries
+ */
+
+/**
+ * Validate and sanitize days parameter for date range queries
+ * @param {any} days - The days parameter from user input
+ * @returns {number} Safe integer between 1 and 365
+ */
+function sanitizeDays(days) {
+  const parsed = parseInt(days);
+  
+  // Check if it's a valid number
+  if (isNaN(parsed)) {
+    return 7; // Default to 7 days
+  }
+  
+  // Ensure it's within reasonable bounds
+  if (parsed < 1) {
+    return 1;
+  }
+  
+  if (parsed > 365) {
+    return 365; // Maximum 1 year
+  }
+  
+  return parsed;
+}
+
+/**
+ * Escape special characters in LIKE queries
+ * @param {string} input - The search string from user input
+ * @returns {string} Escaped string safe for LIKE queries
+ */
+function escapeLikePattern(input) {
+  if (!input || typeof input !== 'string') {
+    return '';
+  }
+  
+  // Escape special LIKE pattern characters
+  // In SQL LIKE patterns:
+  // % matches any sequence of characters
+  // _ matches any single character
+  // \ is the escape character
+  return input
+    .replace(/\\/g, '\\\\') // Escape backslashes first
+    .replace(/%/g, '\\%')   // Escape percent signs
+    .replace(/_/g, '\\_')   // Escape underscores
+    .replace(/'/g, '\'\'');   // Escape single quotes for safety
+}
+
+/**
+ * Create a safe date range condition using Knex
+ * @param {object} query - Knex query builder instance
+ * @param {string} column - The timestamp column name
+ * @param {number} days - Number of days to go back
+ * @returns {object} Modified query with safe date range condition
+ */
+function addDateRangeCondition(query, column, days) {
+  const safeDays = sanitizeDays(days);
+  const startDate = new Date();
+  startDate.setDate(startDate.getDate() - safeDays);
+  
+  // Use Knex's built-in date comparison which handles parameterization
+  return query.where(column, '>=', startDate.toISOString());
+}
+
+/**
+ * Create a safe LIKE condition using Knex
+ * @param {object} query - Knex query builder instance
+ * @param {string} column - The column to search
+ * @param {string} pattern - The search pattern
+ * @returns {object} Modified query with safe LIKE condition
+ */
+function addLikeCondition(query, column, pattern) {
+  if (!pattern || typeof pattern !== 'string') {
+    return query;
+  }
+  
+  const escapedPattern = escapeLikePattern(pattern);
+  // Knex handles parameterization of the LIKE value
+  return query.where(column, 'like', `%${escapedPattern}%`);
+}
+
+/**
+ * Validate sort column against whitelist
+ * @param {string} column - The column name to sort by
+ * @param {string[]} allowedColumns - Array of allowed column names
+ * @param {string} defaultColumn - Default column if invalid
+ * @returns {string} Safe column name
+ */
+function validateSortColumn(column, allowedColumns, defaultColumn) {
+  if (!column || !allowedColumns.includes(column)) {
+    return defaultColumn;
+  }
+  return column;
+}
+
+/**
+ * Validate sort order
+ * @param {string} order - The sort order (asc/desc)
+ * @returns {string} Safe sort order
+ */
+function validateSortOrder(order) {
+  const lowerOrder = (order || '').toLowerCase();
+  return lowerOrder === 'asc' ? 'asc' : 'desc';
+}
+
+module.exports = {
+  sanitizeDays,
+  escapeLikePattern,
+  addDateRangeCondition,
+  addLikeCondition,
+  validateSortColumn,
+  validateSortOrder
+};

backend/src/utils/tokenRevocation.js

@@ -0,0 +1,133 @@
+/**
+ * Token Revocation System
+ * Provides ability to invalidate tokens before expiration
+ */
+
+const { db } = require('../database/db');
+const logger = require('./logger');
+
+/**
+ * Add a token to the revocation list
+ * @param {string} token - JWT token to revoke
+ * @param {string} reason - Reason for revocation
+ * @param {Object} metadata - Additional metadata
+ */
+async function revokeToken(token, reason, metadata = {}) {
+  try {
+    // Extract token info without full verification (it might be compromised)
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+      throw new Error('Invalid token format');
+    }
+    
+    // Decode payload
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+    
+    await db('revoked_tokens').insert({
+      token_id: payload.jti || `${payload.id}-${payload.iat}`, // JWT ID or fallback
+      user_id: payload.id,
+      token_type: payload.type,
+      revoked_at: new Date().toISOString(),
+      expires_at: new Date(payload.exp * 1000).toISOString(),
+      reason,
+      metadata: JSON.stringify(metadata)
+    });
+    
+    logger.info('Token revoked', {
+      userId: payload.id,
+      tokenType: payload.type,
+      reason
+    });
+    
+    return true;
+  } catch (error) {
+    logger.error('Failed to revoke token', error);
+    return false;
+  }
+}
+
+/**
+ * Check if a token is revoked
+ * @param {Object} decodedToken - Decoded JWT payload
+ * @returns {boolean} - True if token is revoked
+ */
+async function isTokenRevoked(decodedToken) {
+  try {
+    const tokenId = decodedToken.jti || `${decodedToken.id}-${decodedToken.iat}`;
+    
+    const revoked = await db('revoked_tokens')
+      .where('token_id', tokenId)
+      .orWhere((builder) => {
+        builder
+          .where('user_id', decodedToken.id)
+          .where('revoked_at', '<=', new Date(decodedToken.iat * 1000).toISOString());
+      })
+      .first();
+    
+    return !!revoked;
+  } catch (error) {
+    logger.error('Failed to check token revocation', error);
+    // Fail closed - treat as revoked if we can't check
+    return true;
+  }
+}
+
+/**
+ * Revoke all tokens for a user
+ * @param {number} userId - User ID
+ * @param {string} reason - Reason for revocation
+ */
+async function revokeAllUserTokens(userId, reason) {
+  try {
+    // This effectively revokes all tokens by setting a revocation time
+    // Any token issued before this time will be considered revoked
+    await db('user_token_revocations').insert({
+      user_id: userId,
+      revoked_at: new Date().toISOString(),
+      reason
+    }).onConflict('user_id').merge();
+    
+    logger.info('All user tokens revoked', { userId, reason });
+    return true;
+  } catch (error) {
+    logger.error('Failed to revoke user tokens', error);
+    return false;
+  }
+}
+
+/**
+ * Clean up expired revoked tokens
+ * Should be run periodically
+ */
+async function cleanupExpiredRevocations() {
+  try {
+    const deleted = await db('revoked_tokens')
+      .where('expires_at', '<', new Date().toISOString())
+      .delete();
+    
+    if (deleted > 0) {
+      logger.info(`Cleaned up ${deleted} expired token revocations`);
+    }
+  } catch (error) {
+    logger.error('Failed to cleanup revoked tokens', error);
+  }
+}
+
+/**
+ * Initialize cleanup job for expired revocations
+ */
+function initializeRevocationCleanup() {
+  // Run cleanup every 6 hours
+  setInterval(cleanupExpiredRevocations, 6 * 60 * 60 * 1000);
+  
+  // Run initial cleanup
+  cleanupExpiredRevocations();
+}
+
+module.exports = {
+  revokeToken,
+  isTokenRevoked,
+  revokeAllUserTokens,
+  cleanupExpiredRevocations,
+  initializeRevocationCleanup
+};