Initial commit - Project start (July 17, 2025)

Original: feat: enhance security logging and ensure rate limit blocks are properly tracked

- Add comprehensive logging for rate limit blocks with full request details
  - IP address (with proper proxy detection), user agent, headers, timestamps
  - Rate limit info (current count, limit, remaining, reset time)
  - Separate tracking for auth vs general endpoints

- Enhance authentication failure logging
  - JWT validation failures with detailed error info
  - Admin auth attempts without token
  - Failed token validation with user context
  - All events include IP, path, method, user agent

- Improve Winston logger configuration for production
  - Add automatic log rotation (10MB errors, 50MB combined)
  - Create separate security.log for auth/rate limit events
  - Ensure logs directory exists automatically
  - Add structured JSON format for log aggregation
  - Support container logging with LOG_TO_CONSOLE env var

- Create comprehensive documentation
  - Security logging guide with examples
  - Monitoring recommendations
  - Configuration reference

- Add test script to verify logging functionality

All rate limit settings remain configurable via admin panel:
- Window duration, max requests, auth limits
- Skip authenticated requests option
- Public endpoints only option

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/middleware/auth-enhanced-v2.js

@@ -0,0 +1,167 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { isTokenRevoked } = require('../utils/tokenRevocation');
+const logger = require('../utils/logger');
+
+/**
+ * Enhanced admin authentication middleware with revocation checking
+ */
+async function adminAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if token is revoked
+    if (await isTokenRevoked(decoded)) {
+      logger.warn('Revoked token used', {
+        userId: decoded.id,
+        tokenType: decoded.type
+      });
+      return res.status(401).json({ error: 'Token has been revoked', code: 'TOKEN_REVOKED' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'admin') {
+      logger.warn('Non-admin token used for admin endpoint', { 
+        userId: decoded.id,
+        tokenType: decoded.type 
+      });
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+    
+    // IP validation (optional - can be strict or just log)
+    const currentIp = req.ip || req.connection.remoteAddress;
+    if (decoded.ip && decoded.ip !== currentIp) {
+      logger.warn('Token used from different IP', {
+        userId: decoded.id,
+        tokenIp: decoded.ip,
+        currentIp: currentIp
+      });
+    }
+    
+    // Check if admin still exists and is active
+    const admin = await db('admin_users')
+      .where({ id: decoded.id, is_active: formatBoolean(true) })
+      .first();
+    
+    if (!admin) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if password was changed after token was issued
+    if (admin.password_changed_at) {
+      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
+      if (decoded.iat < passwordChangedTime) {
+        logger.warn('Token used after password change', { userId: decoded.id });
+        return res.status(401).json({ 
+          error: 'Token invalid due to password change',
+          code: 'PASSWORD_CHANGED'
+        });
+      }
+    }
+    
+    // Add user info to request
+    req.admin = {
+      id: admin.id,
+      username: admin.username,
+      email: admin.email
+    };
+    req.token = token; // Store token for potential revocation
+    
+    next();
+  } catch (error) {
+    logger.error('Auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Enhanced gallery authentication middleware with revocation checking
+ */
+async function galleryAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid session' });
+    }
+    
+    // Check if token is revoked
+    if (await isTokenRevoked(decoded)) {
+      return res.status(401).json({ error: 'Session has been invalidated', code: 'TOKEN_REVOKED' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'gallery') {
+      return res.status(403).json({ error: 'Invalid access token' });
+    }
+    
+    // Check if event still exists and is active
+    const event = await db('events')
+      .where({ 
+        id: decoded.eventId, 
+        is_active: true, 
+        is_archived: false 
+      })
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    // Check if gallery has expired
+    if (new Date(event.expires_at) < new Date()) {
+      return res.status(410).json({ 
+        error: 'Gallery has expired',
+        code: 'GALLERY_EXPIRED'
+      });
+    }
+    
+    // Add event info to request
+    req.event = event;
+    req.galleryToken = decoded;
+    req.token = token;
+    
+    next();
+  } catch (error) {
+    logger.error('Gallery auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+// Export other middleware functions from original file...
+module.exports = { 
+  adminAuth, 
+  galleryAuth,
+  // ... other exports
+};

backend/src/middleware/auth-enhanced.js

@@ -0,0 +1,238 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const logger = require('../utils/logger');
+
+/**
+ * Enhanced admin authentication middleware
+ * Adds additional security checks beyond basic JWT validation
+ */
+async function adminAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload; // Extract payload when using complete: true
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'admin') {
+      logger.warn('Non-admin token used for admin endpoint', { 
+        userId: decoded.id,
+        tokenType: decoded.type 
+      });
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+    
+    // IP validation (optional - can be strict or just log)
+    const currentIp = req.ip || req.connection.remoteAddress;
+    if (decoded.ip && decoded.ip !== currentIp) {
+      logger.warn('Token used from different IP', {
+        userId: decoded.id,
+        tokenIp: decoded.ip,
+        currentIp: currentIp
+      });
+      // Optional: Reject if IP doesn't match
+      // return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if admin still exists and is active
+    const admin = await db('admin_users')
+      .where({ id: decoded.id, is_active: formatBoolean(true) })
+      .first();
+    
+    if (!admin) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if password was changed after token was issued
+    if (admin.password_changed_at) {
+      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
+      if (decoded.iat < passwordChangedTime) {
+        logger.warn('Token used after password change', { userId: decoded.id });
+        return res.status(401).json({ 
+          error: 'Token invalid due to password change',
+          code: 'PASSWORD_CHANGED'
+        });
+      }
+    }
+    
+    // Add user info to request
+    req.admin = {
+      id: admin.id,
+      username: admin.username,
+      email: admin.email
+    };
+    
+    next();
+  } catch (error) {
+    logger.error('Auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Enhanced gallery authentication middleware
+ */
+async function galleryAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid session' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'gallery') {
+      return res.status(403).json({ error: 'Invalid access token' });
+    }
+    
+    // Check if event still exists and is active
+    const event = await db('events')
+      .where({ 
+        id: decoded.eventId, 
+        is_active: true, 
+        is_archived: false 
+      })
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    // Check if gallery has expired
+    if (new Date(event.expires_at) < new Date()) {
+      return res.status(410).json({ 
+        error: 'Gallery has expired',
+        code: 'GALLERY_EXPIRED'
+      });
+    }
+    
+    // Add event info to request
+    req.event = event;
+    req.galleryToken = decoded;
+    
+    next();
+  } catch (error) {
+    logger.error('Gallery auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Photo access authentication
+ * Validates both admin and gallery tokens for photo access
+ */
+async function photoAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET);
+    } catch (err) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Allow both admin and gallery tokens
+    if (decoded.type === 'admin') {
+      const admin = await db('admin_users')
+        .where({ id: decoded.id, is_active: formatBoolean(true) })
+        .first();
+      
+      if (!admin) {
+        return res.status(401).json({ error: 'Invalid token' });
+      }
+      
+      req.auth = { type: 'admin', user: admin };
+    } else if (decoded.type === 'gallery') {
+      const event = await db('events')
+        .where({ 
+          id: decoded.eventId, 
+          is_active: true, 
+          is_archived: false 
+        })
+        .first();
+      
+      if (!event) {
+        return res.status(404).json({ error: 'Gallery not found' });
+      }
+      
+      // For gallery tokens, ensure they can only access their event's photos
+      req.auth = { type: 'gallery', event: event };
+    } else {
+      return res.status(403).json({ error: 'Invalid token type' });
+    }
+    
+    next();
+  } catch (error) {
+    logger.error('Photo auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Verify gallery access for specific operations
+ */
+async function verifyGalleryAccess(req, res, next) {
+  try {
+    if (!req.auth) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    
+    const { eventId } = req.params;
+    
+    // Admins can access any gallery
+    if (req.auth.type === 'admin') {
+      return next();
+    }
+    
+    // Gallery tokens can only access their own event
+    if (req.auth.type === 'gallery') {
+      if (req.auth.event.id !== parseInt(eventId)) {
+        return res.status(403).json({ error: 'Access denied' });
+      }
+      return next();
+    }
+    
+    res.status(403).json({ error: 'Access denied' });
+  } catch (error) {
+    res.status(500).json({ error: 'Access verification failed' });
+  }
+}
+
+module.exports = { 
+  adminAuth, 
+  galleryAuth,
+  photoAuth,
+  verifyGalleryAccess
+};

backend/src/middleware/auth.js

@@ -0,0 +1,85 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const logger = require('../utils/logger');
+
+async function adminAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      logger.warn('Admin auth attempt without token', {
+        ip: clientIp,
+        path: req.path,
+        method: req.method,
+        userAgent: req.headers['user-agent']
+      });
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET);
+    } catch (jwtError) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      
+      logger.warn('JWT validation failed', {
+        ip: clientIp,
+        path: req.path,
+        method: req.method,
+        userAgent: req.headers['user-agent'],
+        error: jwtError.name,
+        message: jwtError.message,
+        timestamp: new Date().toISOString()
+      });
+      
+      if (jwtError.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    const admin = await db('admin_users').where({ id: decoded.id, is_active: formatBoolean(true) }).first();
+    
+    if (!admin) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      
+      logger.warn('Admin auth failed - user not found or inactive', {
+        ip: clientIp,
+        userId: decoded.id,
+        path: req.path,
+        method: req.method,
+        timestamp: new Date().toISOString()
+      });
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    req.admin = admin;
+    next();
+  } catch (error) {
+    const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                   req.headers['x-real-ip'] || 
+                   req.connection.remoteAddress || 
+                   req.ip;
+    
+    logger.error('Admin auth middleware error', {
+      ip: clientIp,
+      path: req.path,
+      error: error.message,
+      stack: error.stack,
+      timestamp: new Date().toISOString()
+    });
+    res.status(401).json({ error: 'Invalid token' });
+  }
+}
+
+module.exports = { adminAuth };

backend/src/middleware/gallery.js

@@ -0,0 +1,36 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+
+// Middleware to verify gallery access
+async function verifyGalleryAccess(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    const event = await db('events')
+      .where({ 
+        id: decoded.eventId, 
+        is_active: formatBoolean(true),
+        is_archived: formatBoolean(false)
+      })
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    req.event = event;
+    next();
+  } catch (error) {
+    console.error('Error verifying gallery access:', error);
+    res.status(401).json({ error: 'Invalid token', details: error.message });
+  }
+}
+
+module.exports = {
+  verifyGalleryAccess
+};

backend/src/middleware/maintenance.js

@@ -0,0 +1,111 @@
+const { db } = require('../database/db');
+
+// Cache maintenance mode status to avoid DB queries on every request
+let maintenanceMode = false;
+let lastCheck = 0;
+const CACHE_DURATION = 60000; // 1 minute
+
+// Retry configuration for database queries
+const MAX_RETRIES = 3;
+const RETRY_DELAY = 1000; // 1 second
+
+async function queryWithRetry(queryFn, retries = MAX_RETRIES) {
+  for (let i = 0; i < retries; i++) {
+    try {
+      return await queryFn();
+    } catch (error) {
+      if (i === retries - 1) {
+        throw error;
+      }
+      
+      // Check if it's a connection error that might benefit from retry
+      const isConnectionError = 
+        error.message?.includes('Connection terminated') ||
+        error.message?.includes('ECONNREFUSED') ||
+        error.message?.includes('ETIMEDOUT') ||
+        error.code === 'ECONNRESET';
+      
+      if (isConnectionError) {
+        console.warn(`Database connection error, retrying in ${RETRY_DELAY}ms... (attempt ${i + 1}/${retries})`);
+        await new Promise(resolve => setTimeout(resolve, RETRY_DELAY));
+      } else {
+        throw error; // Don't retry non-connection errors
+      }
+    }
+  }
+}
+
+async function checkMaintenanceMode() {
+  const now = Date.now();
+  
+  // Use cached value if recent
+  if (now - lastCheck < CACHE_DURATION) {
+    return maintenanceMode;
+  }
+  
+  try {
+    const setting = await queryWithRetry(async () => {
+      return await db('app_settings')
+        .where('setting_key', 'general_maintenance_mode')
+        .where('setting_type', 'general')
+        .first();
+    });
+    
+    maintenanceMode = setting ? (setting.setting_value === 'true' || setting.setting_value === true) : false;
+    lastCheck = now;
+    
+    return maintenanceMode;
+  } catch (error) {
+    console.error('Error checking maintenance mode after retries:', error.message);
+    // Return cached value or false if no cache
+    return maintenanceMode;
+  }
+}
+
+// Middleware to enforce maintenance mode
+async function maintenanceMiddleware(req, res, next) {
+  // Skip maintenance check for certain paths
+  const skipPaths = [
+    '/api/admin/login',
+    '/api/admin/auth/login',
+    '/api/public/settings',
+    '/health'
+  ];
+  
+  // Allow static assets (uploads, favicons, logos)
+  const isStaticAsset = req.path.startsWith('/uploads/') || 
+                       req.path.startsWith('/favicons/') || 
+                       req.path.startsWith('/logos/');
+  
+  // Allow admin routes if admin is authenticated
+  const isAdminRoute = req.path.startsWith('/api/admin');
+  const hasAdminAuth = req.headers.authorization?.startsWith('Bearer ');
+  
+  if (skipPaths.includes(req.path) || isStaticAsset || (isAdminRoute && hasAdminAuth)) {
+    return next();
+  }
+  
+  try {
+    const inMaintenance = await checkMaintenanceMode();
+    
+    if (inMaintenance && !isAdminRoute) {
+      return res.status(503).json({
+        error: 'Service Unavailable',
+        message: 'The system is currently undergoing maintenance. Please try again later.',
+        maintenance: true
+      });
+    }
+  } catch (error) {
+    // If we can't check maintenance mode, allow the request to proceed
+    console.error('Failed to check maintenance mode, allowing request:', error.message);
+  }
+  
+  next();
+}
+
+// Function to clear cache when settings change
+function clearMaintenanceCache() {
+  lastCheck = 0;
+}
+
+module.exports = { maintenanceMiddleware, clearMaintenanceCache };

backend/src/middleware/photoAuth.js

@@ -0,0 +1,116 @@
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+
+async function photoAuth(req, res, next) {
+  try {
+    // Extract event slug from the path
+    let eventSlug;
+    
+    console.log('PhotoAuth middleware - path:', req.path);
+    
+    // For thumbnails, we need to parse the filename to get the event info
+    if (req.path.startsWith('/thumb_')) {
+      // For now, we'll rely on JWT token for thumbnail access
+      eventSlug = null;
+    } else {
+      // For regular photos, the slug is the first part of the path
+      eventSlug = req.path.split('/')[1];
+    }
+    
+    // First check for JWT token (from gallery access)
+    const authHeader = req.headers.authorization;
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+      const token = authHeader.replace('Bearer ', '');
+      try {
+        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+        
+        // Check if it's a gallery token
+        if (decoded.type === 'gallery') {
+          // For thumbnails, we need to verify the token is for a valid event
+          if (!eventSlug) {
+            // Extract event ID from the decoded token
+            if (decoded.eventId) {
+              const event = await db('events')
+                .where({ id: decoded.eventId, is_active: formatBoolean(true) })
+                .first();
+              if (event) {
+                req.event = event;
+                return next();
+              }
+            }
+            // Fallback to slug
+            const event = await db('events')
+              .where({ slug: decoded.eventSlug, is_active: formatBoolean(true) })
+              .first();
+            if (event) {
+              req.event = event;
+              return next();
+            }
+          }
+          // For regular photos, check if token matches the event
+          else if (decoded.eventSlug === eventSlug) {
+            const event = await db('events')
+              .where({ slug: eventSlug, is_active: formatBoolean(true) })
+              .first();
+            if (event) {
+              req.event = event;
+              return next();
+            }
+          }
+        }
+        
+        // Check if it's an admin token (admins can view all photos)
+        if (decoded.type === 'admin') {
+          // For both thumbnails and photos with admin token, allow access
+          return next();
+        }
+      } catch (err) {
+        // Token invalid, fall through to password check
+        console.error('JWT verification failed:', err.message);
+      }
+    }
+    
+    // Check for password header (legacy support)
+    const password = req.headers['x-gallery-password'];
+    
+    if (!password && !authHeader) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    
+    // If no eventSlug (thumbnails), and we don't have valid auth yet, deny access
+    if (!eventSlug && !password) {
+      return res.status(401).json({ error: 'Authentication required for thumbnails' });
+    }
+    
+    const event = await db('events').where({ slug: eventSlug, is_active: formatBoolean(true) }).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found' });
+    }
+    
+    if (password) {
+      const validPassword = await bcrypt.compare(password, event.password_hash);
+      if (!validPassword) {
+        await db('access_logs').insert({
+          event_id: event.id,
+          ip_address: req.ip,
+          user_agent: req.headers['user-agent'],
+          action: 'login_fail'
+        });
+        return res.status(401).json({ error: 'Invalid password' });
+      }
+    } else {
+      // No valid authentication
+      return res.status(401).json({ error: 'Invalid authentication' });
+    }
+    
+    req.event = event;
+    next();
+  } catch (error) {
+    console.error('Photo auth error:', error);
+    res.status(500).json({ error: 'Authentication error' });
+  }
+}
+
+module.exports = photoAuth;

backend/src/middleware/secureStatic.js

@@ -0,0 +1,46 @@
+const path = require('path');
+const express = require('express');
+const { safePathJoin, isPathSafe } = require('../utils/fileSecurityUtils');
+
+/**
+ * Create a secure static file serving middleware that prevents path traversal attacks
+ * @param {string} basePath - The base directory to serve files from
+ * @param {Object} options - Express static options
+ * @returns {Function} - Express middleware
+ */
+function secureStatic(basePath, options = {}) {
+  const normalizedBase = path.resolve(basePath);
+  
+  return (req, res, next) => {
+    // Get the requested file path - remove leading slash for validation
+    const requestedPath = req.path.startsWith('/') ? req.path.substring(1) : req.path;
+    
+    // Validate the path doesn't contain dangerous patterns
+    if (!isPathSafe(requestedPath)) {
+      console.warn(`Potential path traversal attempt blocked: ${requestedPath}`);
+      return res.status(403).json({ error: 'Access denied' });
+    }
+    
+    try {
+      // Validate the full path is within the base directory
+      const fullPath = safePathJoin(normalizedBase, requestedPath);
+      
+      // If validation passes, use express.static
+      const staticMiddleware = express.static(normalizedBase, {
+        ...options,
+        // Disable directory listing for security
+        index: false,
+        // Don't allow dotfiles
+        dotfiles: 'deny'
+      });
+      
+      return staticMiddleware(req, res, next);
+    } catch (error) {
+      // Path traversal detected
+      console.error(`Path traversal blocked: ${requestedPath}`, error.message);
+      return res.status(403).json({ error: 'Access denied' });
+    }
+  };
+}
+
+module.exports = secureStatic;

backend/src/middleware/sessionTimeout.js

@@ -0,0 +1,153 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+
+// In-memory session tracking (in production, use Redis)
+const sessions = new Map();
+
+// Default session timeout (60 minutes)
+const DEFAULT_SESSION_TIMEOUT = 60 * 60 * 1000;
+
+// Cache for session timeout setting
+let cachedTimeout = null;
+let cacheExpiry = 0;
+const CACHE_DURATION = 5 * 60 * 1000; // 5 minutes
+
+// Clean up expired sessions every 5 minutes
+setInterval(() => {
+  const now = Date.now();
+  for (const [token, lastActivity] of sessions.entries()) {
+    if (now - lastActivity > DEFAULT_SESSION_TIMEOUT) {
+      sessions.delete(token);
+    }
+  }
+}, 5 * 60 * 1000);
+
+async function getSessionTimeout() {
+  const now = Date.now();
+  
+  // Return cached value if still valid
+  if (cachedTimeout && now < cacheExpiry) {
+    return cachedTimeout;
+  }
+  
+  try {
+    const setting = await db('app_settings')
+      .where('setting_key', 'security_session_timeout_minutes')
+      .first()
+      .timeout(5000); // 5 second timeout
+    
+    if (setting && setting.setting_value) {
+      let value = setting.setting_value;
+      // Handle both string and object values
+      if (typeof value === 'string') {
+        try {
+          value = JSON.parse(value);
+        } catch (e) {
+          // If it's not JSON, try to parse as number directly
+          value = parseInt(value);
+        }
+      }
+      const minutes = parseInt(value);
+      if (!isNaN(minutes) && minutes > 0) {
+        cachedTimeout = minutes * 60 * 1000; // Convert to milliseconds
+        cacheExpiry = now + CACHE_DURATION;
+        return cachedTimeout;
+      }
+    }
+  } catch (error) {
+    // Only log if it's not a connection error (to avoid spam)
+    if (error.code !== 'ECONNRESET' && !error.message?.includes('Connection terminated')) {
+      console.error('Error getting session timeout:', error.message);
+    }
+  }
+  
+  // Use cached value if available, otherwise default
+  return cachedTimeout || DEFAULT_SESSION_TIMEOUT;
+}
+
+async function sessionTimeoutMiddleware(req, res, next) {
+  // Skip for non-authenticated routes
+  if (!req.headers.authorization) {
+    return next();
+  }
+  
+  const token = req.headers.authorization.split(' ')[1];
+  if (!token) {
+    return next();
+  }
+  
+  try {
+    // Verify token is valid
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    
+    // Check if this is an admin token
+    if (!decoded.id) {
+      return next();
+    }
+    
+    const now = Date.now();
+    const lastActivity = sessions.get(token);
+    const timeout = await getSessionTimeout();
+    
+    // If session exists, check if it's expired
+    if (lastActivity) {
+      if (now - lastActivity > timeout) {
+        sessions.delete(token);
+        return res.status(401).json({ 
+          error: 'Session expired', 
+          code: 'SESSION_TIMEOUT' 
+        });
+      }
+    }
+    
+    // Update last activity
+    sessions.set(token, now);
+    
+    // Clean up old token if user has a new one
+    // This prevents memory leaks from token renewals
+    const userId = decoded.id;
+    for (const [oldToken, _] of sessions.entries()) {
+      if (oldToken !== token) {
+        try {
+          const oldDecoded = jwt.verify(oldToken, process.env.JWT_SECRET);
+          if (oldDecoded.id === userId) {
+            sessions.delete(oldToken);
+          }
+        } catch (e) {
+          // Token is invalid, remove it
+          sessions.delete(oldToken);
+        }
+      }
+    }
+    
+    next();
+  } catch (error) {
+    // Token is invalid
+    next();
+  }
+}
+
+// Function to end a session
+function endSession(token) {
+  sessions.delete(token);
+}
+
+// Function to get active sessions count
+function getActiveSessions() {
+  const now = Date.now();
+  let active = 0;
+  
+  for (const [_, lastActivity] of sessions.entries()) {
+    if (now - lastActivity <= DEFAULT_SESSION_TIMEOUT) {
+      active++;
+    }
+  }
+  
+  return active;
+}
+
+module.exports = { 
+  sessionTimeoutMiddleware, 
+  endSession,
+  getActiveSessions 
+};

backend/src/middleware/uploadValidation.js

@@ -0,0 +1,111 @@
+const fs = require('fs').promises;
+const path = require('path');
+const sharp = require('sharp');
+const logger = require('../utils/logger');
+
+/**
+ * Validate uploaded file is complete and not corrupted
+ */
+async function validateUploadedFile(filePath) {
+  try {
+    // Check file exists and has size
+    const stats = await fs.stat(filePath);
+    if (stats.size === 0) {
+      throw new Error('File is empty');
+    }
+    
+    // For image files, verify they can be read by Sharp
+    const ext = path.extname(filePath).toLowerCase();
+    const imageExtensions = ['.jpg', '.jpeg', '.png', '.gif', '.webp'];
+    
+    if (imageExtensions.includes(ext)) {
+      // Try to read metadata - this will fail if image is corrupted
+      let metadata;
+      try {
+        metadata = await sharp(filePath, {
+          failOnError: false, // Don't fail on recoverable errors
+          limitInputPixels: 268402689 // ~16k x 16k max
+        }).metadata();
+      } catch (metadataError) {
+        // If metadata reading fails, the file is likely incomplete
+        throw new Error(`Invalid image file: ${metadataError.message}`);
+      }
+      
+      if (!metadata || !metadata.width || !metadata.height) {
+        throw new Error('Invalid image dimensions - file may be incomplete');
+      }
+      
+      // Check for reasonable dimensions
+      if (metadata.width < 10 || metadata.height < 10) {
+        throw new Error('Image dimensions too small');
+      }
+      
+      // Additional check: verify we can actually decode a small portion of the image
+      try {
+        await sharp(filePath, {
+          failOnError: false,
+          limitInputPixels: 268402689
+        })
+        .resize(10, 10) // Try to resize to very small size
+        .toBuffer();
+      } catch (decodeError) {
+        throw new Error(`Image decode failed - file may be corrupted: ${decodeError.message}`);
+      }
+      
+      return true;
+    }
+    
+    return true;
+  } catch (error) {
+    logger.error(`File validation failed for ${filePath}:`, error.message);
+    throw error;
+  }
+}
+
+/**
+ * Middleware to validate uploaded files after multer processing
+ */
+async function validateUploadedFiles(req, res, next) {
+  if (!req.files || req.files.length === 0) {
+    return next();
+  }
+  
+  const validFiles = [];
+  const invalidFiles = [];
+  
+  // Validate each file
+  for (const file of req.files) {
+    try {
+      await validateUploadedFile(file.path);
+      validFiles.push(file);
+    } catch (error) {
+      logger.warn(`Removing invalid upload ${file.originalname}: ${error.message}`);
+      invalidFiles.push({
+        filename: file.originalname,
+        error: error.message
+      });
+      
+      // Delete the invalid file
+      try {
+        await fs.unlink(file.path);
+      } catch (unlinkErr) {
+        logger.error(`Failed to delete invalid file ${file.path}:`, unlinkErr.message);
+      }
+    }
+  }
+  
+  // Update req.files to only include valid files
+  req.files = validFiles;
+  
+  // Store invalid files info for response
+  if (invalidFiles.length > 0) {
+    req.invalidFiles = invalidFiles;
+  }
+  
+  next();
+}
+
+module.exports = {
+  validateUploadedFile,
+  validateUploadedFiles
+};