Initial commit - Project start (July 17, 2025)

Original: feat: enhance security logging and ensure rate limit blocks are properly tracked

- Add comprehensive logging for rate limit blocks with full request details
  - IP address (with proper proxy detection), user agent, headers, timestamps
  - Rate limit info (current count, limit, remaining, reset time)
  - Separate tracking for auth vs general endpoints

- Enhance authentication failure logging
  - JWT validation failures with detailed error info
  - Admin auth attempts without token
  - Failed token validation with user context
  - All events include IP, path, method, user agent

- Improve Winston logger configuration for production
  - Add automatic log rotation (10MB errors, 50MB combined)
  - Create separate security.log for auth/rate limit events
  - Ensure logs directory exists automatically
  - Add structured JSON format for log aggregation
  - Support container logging with LOG_TO_CONSOLE env var

- Create comprehensive documentation
  - Security logging guide with examples
  - Monitoring recommendations
  - Configuration reference

- Add test script to verify logging functionality

All rate limit settings remain configurable via admin panel:
- Window duration, max requests, auth limits
- Skip authenticated requests option
- Public endpoints only option

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/routes/admin.js

@@ -0,0 +1,26 @@
+const express = require('express');
+const router = express.Router();
+
+// Import sub-routers
+const dashboardRoutes = require('./adminDashboard');
+const archiveRoutes = require('./adminArchives');
+const emailRoutes = require('./adminEmail');
+const settingsRoutes = require('./adminSettings');
+const eventsRoutes = require('./adminEvents');
+const photosRoutes = require('./adminPhotos');
+const categoriesRoutes = require('./adminCategories');
+const cmsRoutes = require('./adminCMS');
+const notificationsRoutes = require('./adminNotifications');
+
+// Mount sub-routers
+router.use('/dashboard', dashboardRoutes);
+router.use('/archives', archiveRoutes);
+router.use('/email', emailRoutes);
+router.use('/settings', settingsRoutes);
+router.use('/events', eventsRoutes);
+router.use('/events', photosRoutes);
+router.use('/categories', categoriesRoutes);
+router.use('/cms', cmsRoutes);
+router.use('/notifications', notificationsRoutes);
+
+module.exports = router;

backend/src/routes/adminArchives.js

@@ -0,0 +1,411 @@
+const express = require('express');
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const archiver = require('archiver');
+const AdmZip = require('adm-zip');
+const router = express.Router();
+
+// Get all archived events
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const page = parseInt(req.query.page) || 1;
+    const limit = parseInt(req.query.limit) || 20;
+    const offset = (page - 1) * limit;
+
+    // Get total count
+    const totalCount = await db('events')
+      .where('is_archived', formatBoolean(true))
+      .count('id as count')
+      .first();
+
+    // Get archived events
+    const archives = await db('events')
+      .select(
+        'events.*',
+        db.raw('COUNT(DISTINCT photos.id) as photo_count'),
+        db.raw('SUM(photos.size_bytes) as total_size')
+      )
+      .leftJoin('photos', 'events.id', 'photos.event_id')
+      .where('events.is_archived', formatBoolean(true))
+      .groupBy('events.id')
+      .orderBy('events.archived_at', 'desc')
+      .limit(limit)
+      .offset(offset);
+
+    // Check if archive files exist and get their sizes
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const archivesWithFileInfo = await Promise.all(archives.map(async (archive) => {
+      let archiveFileSize = 0;
+      if (archive.archive_path) {
+        try {
+          const fullArchivePath = path.join(storagePath, archive.archive_path);
+          const stats = await fs.stat(fullArchivePath);
+          archiveFileSize = stats.size;
+        } catch (error) {
+          console.error(`Archive file not found: ${archive.archive_path}`);
+        }
+      }
+
+      return {
+        id: archive.id,
+        slug: archive.slug,
+        eventName: archive.event_name,
+        eventDate: archive.event_date,
+        eventType: archive.event_type,
+        hostEmail: archive.host_email,
+        archivedAt: archive.archived_at ? new Date(archive.archived_at).toISOString() : null,
+        expiresAt: archive.expires_at ? new Date(archive.expires_at).toISOString() : null,
+        photoCount: archive.photo_count || 0,
+        originalSize: archive.total_size || 0,
+        archiveSize: archiveFileSize,
+        archivePath: archive.archive_path
+      };
+    }));
+
+    res.json({
+      archives: archivesWithFileInfo,
+      pagination: {
+        page,
+        limit,
+        total: totalCount.count,
+        totalPages: Math.ceil(totalCount.count / limit)
+      }
+    });
+  } catch (error) {
+    console.error('Archives list error:', error);
+    res.status(500).json({ error: 'Failed to fetch archives' });
+  }
+});
+
+// Get single archive details
+router.get('/:id', adminAuth, async (req, res) => {
+  try {
+    const archive = await db('events')
+      .where('id', req.params.id)
+      .where('is_archived', formatBoolean(true))
+      .first();
+
+    if (!archive) {
+      return res.status(404).json({ error: 'Archive not found' });
+    }
+
+    // Get photo details
+    const photos = await db('photos')
+      .where('event_id', archive.id)
+      .select('filename', 'type', 'size_bytes', 'uploaded_at');
+
+    // Check archive file
+    let archiveFileInfo = null;
+    if (archive.archive_path) {
+      try {
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const fullArchivePath = path.join(storagePath, archive.archive_path);
+        const stats = await fs.stat(fullArchivePath);
+        archiveFileInfo = {
+          size: stats.size,
+          createdAt: stats.birthtime,
+          path: archive.archive_path
+        };
+      } catch (error) {
+        console.error('Archive file not found:', error);
+      }
+    }
+
+    res.json({
+      id: archive.id,
+      slug: archive.slug,
+      eventName: archive.event_name,
+      eventDate: archive.event_date,
+      eventType: archive.event_type,
+      hostEmail: archive.host_email,
+      adminEmail: archive.admin_email,
+      welcomeMessage: archive.welcome_message,
+      colorTheme: archive.color_theme,
+      createdAt: archive.created_at,
+      expiresAt: archive.expires_at,
+      archivedAt: archive.archived_at,
+      photos: photos,
+      archiveFile: archiveFileInfo
+    });
+  } catch (error) {
+    console.error('Archive details error:', error);
+    res.status(500).json({ error: 'Failed to fetch archive details' });
+  }
+});
+
+// Restore archive
+router.post('/:id/restore', adminAuth, async (req, res) => {
+  try {
+    const archive = await db('events')
+      .where('id', req.params.id)
+      .where('is_archived', formatBoolean(true))
+      .first();
+
+    if (!archive) {
+      return res.status(404).json({ error: 'Archive not found' });
+    }
+
+    // Check if archive file exists
+    if (!archive.archive_path) {
+      return res.status(400).json({ error: 'No archive file found' });
+    }
+
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const fullArchivePath = path.join(storagePath, archive.archive_path);
+
+    try {
+      await fs.access(fullArchivePath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Archive file not found on disk' });
+    }
+
+    // Extract the archive
+    try {
+      const zip = new AdmZip(fullArchivePath);
+      const eventsDir = path.join(storagePath, 'events/active');
+      const eventDir = path.join(eventsDir, archive.slug);
+      
+      // Create event directory if it doesn't exist
+      await fs.mkdir(eventDir, { recursive: true });
+      
+      // Log ZIP contents for debugging
+      console.log(`Extracting archive to: ${eventDir}`);
+      const entries = zip.getEntries();
+      console.log(`Archive contains ${entries.length} entries`);
+      
+      // Extract files to the event directory
+      zip.extractAllTo(eventDir, true);
+      
+      // Get list of extracted files to update database
+      const extractedPhotos = [];
+      
+      // First, collect all category information from the ZIP structure
+      const categoriesMap = new Map();
+      
+      for (const entry of entries) {
+        if (!entry.isDirectory && entry.entryName.match(/\.(jpg|jpeg|png|gif|webp)$/i)) {
+          const filename = path.basename(entry.entryName);
+          const dirPath = path.dirname(entry.entryName);
+          const actualFilePath = path.join(eventDir, entry.entryName);
+          
+          try {
+            // Check if file was extracted successfully
+            const stats = await fs.stat(actualFilePath);
+            
+            // Determine category from directory structure
+            let categoryId = null;
+            if (dirPath && dirPath !== '.') {
+              // Get the first level directory as category
+              const categoryName = dirPath.split(path.sep)[0];
+              
+              if (!categoriesMap.has(categoryName)) {
+                // Check if this category exists in the database
+                const existingCategory = await db('photo_categories')
+                  .where('event_id', archive.id)
+                  .where('name', categoryName)
+                  .first();
+                
+                if (existingCategory) {
+                  categoriesMap.set(categoryName, existingCategory.id);
+                } else {
+                  // Create the category if it doesn't exist
+                  const insertResult = await db('photo_categories').insert({
+                    event_id: archive.id,
+                    name: categoryName,
+                    slug: categoryName.toLowerCase().replace(/[^a-z0-9]/g, '-'),
+                    created_at: new Date()
+                  }).returning('id');
+                  
+                  const newCategoryId = insertResult[0]?.id || insertResult[0];
+                  categoriesMap.set(categoryName, newCategoryId);
+                }
+              }
+              
+              categoryId = categoriesMap.get(categoryName);
+            }
+          
+            // Check if photo already exists in database
+            const existingPhoto = await db('photos')
+              .where('event_id', archive.id)
+              .where('filename', filename)
+              .first();
+            
+            if (!existingPhoto) {
+              // Store relative path from storage root
+              const relativePath = path.relative(storagePath, actualFilePath);
+              extractedPhotos.push({
+                event_id: archive.id,
+                filename: filename,
+                original_filename: filename,
+                path: relativePath,
+                thumbnail_path: null, // Will be regenerated by thumbnail service
+                type: path.extname(filename).substring(1).toLowerCase(),
+                size_bytes: stats.size,
+                category_id: categoryId,
+                uploaded_at: new Date()
+              });
+            }
+          } catch (statError) {
+            console.error(`Failed to stat file: ${actualFilePath}`);
+            console.error(`Entry name was: ${entry.entryName}`);
+            console.error('Error:', statError.message);
+            // Skip this file if we can't stat it
+            continue;
+          }
+        }
+      }
+      
+      // Insert new photos if any
+      if (extractedPhotos.length > 0) {
+        await db('photos').insert(extractedPhotos);
+      }
+      
+    } catch (extractError) {
+      console.error('Archive extraction error:', extractError);
+      return res.status(500).json({ error: 'Failed to extract archive: ' + extractError.message });
+    }
+    
+    // Update event status
+    const thirtyDaysFromNow = new Date();
+    thirtyDaysFromNow.setDate(thirtyDaysFromNow.getDate() + 30);
+    
+    await db('events')
+      .where('id', req.params.id)
+      .update({
+        is_archived: false,
+        is_active: true,
+        archive_path: null,
+        archived_at: null,
+        expires_at: thirtyDaysFromNow.toISOString() // Reset expiration - works on both DBs
+      });
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'archive_restored',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      event_id: archive.id,
+      metadata: JSON.stringify({ event_name: archive.event_name })
+    });
+
+    res.json({ message: 'Archive restored successfully' });
+  } catch (error) {
+    console.error('Archive restore error:', error);
+    res.status(500).json({ error: 'Failed to restore archive' });
+  }
+});
+
+// Download archive
+router.get('/:id/download', adminAuth, async (req, res) => {
+  try {
+    const archive = await db('events')
+      .where('id', req.params.id)
+      .where('is_archived', formatBoolean(true))
+      .first();
+
+    if (!archive) {
+      return res.status(404).json({ error: 'Archive not found' });
+    }
+
+    if (!archive.archive_path) {
+      return res.status(404).json({ error: 'Archive file not found' });
+    }
+
+    // Check if file exists
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const fullArchivePath = path.join(storagePath, archive.archive_path);
+    
+    try {
+      await fs.access(fullArchivePath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Archive file not found on disk' });
+    }
+
+    // Set headers for download
+    res.setHeader('Content-Type', 'application/zip');
+    res.setHeader('Content-Disposition', `attachment; filename="${archive.slug}.zip"`);
+
+    // Stream the file
+    const fileStream = require('fs').createReadStream(fullArchivePath);
+    fileStream.pipe(res);
+
+    // Log download
+    await db('activity_logs').insert({
+      activity_type: 'archive_downloaded',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      event_id: archive.id,
+      metadata: JSON.stringify({ event_name: archive.event_name })
+    });
+  } catch (error) {
+    console.error('Archive download error:', error);
+    res.status(500).json({ error: 'Failed to download archive' });
+  }
+});
+
+// Delete archive permanently
+router.delete('/:id', adminAuth, async (req, res) => {
+  try {
+    const archive = await db('events')
+      .where('id', req.params.id)
+      .where('is_archived', formatBoolean(true))
+      .first();
+
+    if (!archive) {
+      return res.status(404).json({ error: 'Archive not found' });
+    }
+
+    // Delete archive file if exists
+    if (archive.archive_path) {
+      try {
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const fullArchivePath = path.join(storagePath, archive.archive_path);
+        await fs.unlink(fullArchivePath);
+      } catch (error) {
+        console.error('Failed to delete archive file:', error);
+      }
+    }
+
+    // Delete thumbnails for this event
+    const photos = await db('photos').where('event_id', req.params.id).select('thumbnail_path');
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    
+    for (const photo of photos) {
+      if (photo.thumbnail_path) {
+        try {
+          const thumbPath = path.join(storagePath, photo.thumbnail_path.replace(/^\//, ''));
+          await fs.unlink(thumbPath);
+        } catch (error) {
+          // Ignore errors - thumbnail might already be deleted
+        }
+      }
+    }
+
+    // Delete from database (cascade will delete photos and logs)
+    await db('events').where('id', req.params.id).delete();
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'archive_deleted',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ 
+        event_name: archive.event_name,
+        archived_date: archive.archived_at 
+      })
+    });
+
+    res.json({ message: 'Archive deleted permanently' });
+  } catch (error) {
+    console.error('Archive delete error:', error);
+    res.status(500).json({ error: 'Failed to delete archive' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminAuth.js

@@ -0,0 +1,99 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const { endSession } = require('../middleware/sessionTimeout');
+const { validatePasswordStrength } = require('../utils/passwordGenerator');
+const router = express.Router();
+
+// Change password
+router.post('/change-password', [
+  adminAuth,
+  body('currentPassword').notEmpty().withMessage('Current password is required'),
+  body('newPassword').isLength({ min: 12 }).withMessage('New password must be at least 12 characters')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { currentPassword, newPassword } = req.body;
+    const userId = req.admin.id; // Changed from req.user.id to req.admin.id
+
+    // Validate new password strength
+    const passwordValidation = validatePasswordStrength(newPassword);
+    if (!passwordValidation.isValid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.messages
+      });
+    }
+
+    // Get user from database
+    const user = await db('admin_users')
+      .where('id', userId)
+      .first();
+
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
+    // Verify current password
+    const validPassword = await bcrypt.compare(currentPassword, user.password_hash);
+    if (!validPassword) {
+      return res.status(400).json({ error: 'Current password is incorrect' });
+    }
+
+    // Hash new password with more rounds
+    const newPasswordHash = await bcrypt.hash(newPassword, 12);
+
+    // Update password and clear must_change_password flag
+    await db('admin_users')
+      .where('id', userId)
+      .update({
+        password_hash: newPasswordHash,
+        must_change_password: false,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity('password_changed', 
+      { admin_id: userId }, 
+      null,
+      { type: 'admin', id: userId, name: user.username }
+    );
+
+    res.json({ message: 'Password changed successfully' });
+  } catch (error) {
+    console.error('Password change error:', error);
+    res.status(500).json({ error: 'Failed to change password' });
+  }
+});
+
+// Logout
+router.post('/logout', adminAuth, async (req, res) => {
+  try {
+    // Get token from header
+    const token = req.headers.authorization?.split(' ')[1];
+    if (token) {
+      // End the session
+      endSession(token);
+    }
+    
+    // Log activity
+    await logActivity('admin_logout', 
+      { admin_id: req.admin.id }, 
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: 'Logged out successfully' });
+  } catch (error) {
+    console.error('Logout error:', error);
+    res.status(500).json({ error: 'Failed to logout' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminCMS.js

@@ -0,0 +1,83 @@
+const express = require('express');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+
+// Get all CMS pages
+router.get('/pages', adminAuth, async (req, res) => {
+  try {
+    const pages = await db('cms_pages').select('*').orderBy('slug', 'asc');
+    res.json(pages);
+  } catch (error) {
+    console.error('Error fetching CMS pages:', error);
+    res.status(500).json({ error: 'Failed to fetch pages' });
+  }
+});
+
+// Get a single CMS page
+router.get('/pages/:slug', adminAuth, async (req, res) => {
+  try {
+    const { slug } = req.params;
+    const page = await db('cms_pages').where('slug', slug).first();
+    
+    if (!page) {
+      return res.status(404).json({ error: 'Page not found' });
+    }
+    
+    res.json(page);
+  } catch (error) {
+    console.error('Error fetching CMS page:', error);
+    res.status(500).json({ error: 'Failed to fetch page' });
+  }
+});
+
+// Update a CMS page
+router.put('/pages/:slug', adminAuth, [
+  body('title_en').optional().isString(),
+  body('title_de').optional().isString(),
+  body('content_en').optional().isString(),
+  body('content_de').optional().isString()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { slug } = req.params;
+    const { title_en, title_de, content_en, content_de } = req.body;
+    
+    const page = await db('cms_pages').where('slug', slug).first();
+    if (!page) {
+      return res.status(404).json({ error: 'Page not found' });
+    }
+    
+    // Update the page
+    await db('cms_pages')
+      .where('slug', slug)
+      .update({
+        title_en,
+        title_de,
+        content_en,
+        content_de,
+        updated_at: new Date()
+      });
+    
+    const updated = await db('cms_pages').where('slug', slug).first();
+    
+    // Log activity
+    await logActivity('cms_page_updated',
+      { page: slug },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json(updated);
+  } catch (error) {
+    console.error('Error updating CMS page:', error);
+    res.status(500).json({ error: 'Failed to update page' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminCategories.js

@@ -0,0 +1,185 @@
+const express = require('express');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+
+// Get all global categories
+router.get('/global', adminAuth, async (req, res) => {
+  try {
+    const categories = await db('photo_categories')
+      .where('is_global', formatBoolean(true))
+      .orderBy('name', 'asc');
+    
+    res.json(categories);
+  } catch (error) {
+    console.error('Error fetching categories:', error);
+    res.status(500).json({ error: 'Failed to fetch categories' });
+  }
+});
+
+// Get categories for a specific event (global + event-specific)
+router.get('/event/:eventId', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    
+    const categories = await db('photo_categories')
+      .where(function() {
+        this.where('is_global', formatBoolean(true))
+          .orWhere('event_id', eventId);
+      })
+      .orderBy('is_global', 'desc')
+      .orderBy('name', 'asc');
+    
+    res.json(categories);
+  } catch (error) {
+    console.error('Error fetching event categories:', error);
+    res.status(500).json({ error: 'Failed to fetch categories' });
+  }
+});
+
+// Create a new category
+router.post('/', adminAuth, [
+  body('name').notEmpty().withMessage('Category name is required'),
+  body('slug').optional(),
+  body('is_global').optional().isBoolean(),
+  body('event_id').optional().isInt()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { name, slug, is_global = true, event_id = null } = req.body;
+    
+    // Generate slug if not provided
+    const categorySlug = slug || name.toLowerCase()
+      .replace(/[^\w\s-]/g, '')
+      .replace(/\s+/g, '-')
+      .replace(/-+/g, '-')
+      .trim();
+    
+    // Check if slug already exists for this scope
+    const existing = await db('photo_categories')
+      .where('slug', categorySlug)
+      .where(function() {
+        if (is_global) {
+          this.where('is_global', formatBoolean(true));
+        } else {
+          this.where('event_id', event_id);
+        }
+      })
+      .first();
+    
+    if (existing) {
+      return res.status(400).json({ error: 'Category with this slug already exists' });
+    }
+    
+    // Create category
+    const insertResult = await db('photo_categories').insert({
+      name,
+      slug: categorySlug,
+      is_global,
+      event_id: is_global ? null : event_id
+    }).returning('id');
+    
+    const categoryId = insertResult[0]?.id || insertResult[0];
+    
+    const category = await db('photo_categories').where('id', categoryId).first();
+    
+    // Log activity
+    await logActivity('category_created', 
+      { categoryName: name, isGlobal: is_global },
+      event_id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json(category);
+  } catch (error) {
+    console.error('Error creating category:', error);
+    res.status(500).json({ error: 'Failed to create category' });
+  }
+});
+
+// Update a category
+router.put('/:id', adminAuth, [
+  body('name').notEmpty().withMessage('Category name is required')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { id } = req.params;
+    const { name } = req.body;
+    
+    const category = await db('photo_categories').where('id', id).first();
+    if (!category) {
+      return res.status(404).json({ error: 'Category not found' });
+    }
+    
+    await db('photo_categories')
+      .where('id', id)
+      .update({
+        name,
+        slug: name.toLowerCase()
+          .replace(/[^\w\s-]/g, '')
+          .replace(/\s+/g, '-')
+          .replace(/-+/g, '-')
+          .trim()
+      });
+    
+    const updated = await db('photo_categories').where('id', id).first();
+    
+    // Log activity
+    await logActivity('category_updated',
+      { categoryName: name },
+      category.event_id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json(updated);
+  } catch (error) {
+    console.error('Error updating category:', error);
+    res.status(500).json({ error: 'Failed to update category' });
+  }
+});
+
+// Delete a category
+router.delete('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    const category = await db('photo_categories').where('id', id).first();
+    if (!category) {
+      return res.status(404).json({ error: 'Category not found' });
+    }
+    
+    // Check if category has photos
+    const photoCount = await db('photos').where('category_id', id).count('id as count').first();
+    if (photoCount.count > 0) {
+      return res.status(400).json({ 
+        error: 'Cannot delete category with photos. Please reassign photos first.' 
+      });
+    }
+    
+    await db('photo_categories').where('id', id).delete();
+    
+    // Log activity
+    await logActivity('category_deleted',
+      { categoryName: category.name },
+      category.event_id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: 'Category deleted successfully' });
+  } catch (error) {
+    console.error('Error deleting category:', error);
+    res.status(500).json({ error: 'Failed to delete category' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminDashboard.js

@@ -0,0 +1,323 @@
+const express = require('express');
+const { db } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const { sanitizeDays, addDateRangeCondition } = require('../utils/sqlSecurity');
+const { formatBoolean } = require('../utils/dbCompat');
+const router = express.Router();
+
+// Get dashboard statistics
+router.get('/stats', adminAuth, async (req, res) => {
+  try {
+    // Get active events count
+    const activeEvents = await db('events')
+      .where('is_active', formatBoolean(true))
+      .where('is_archived', formatBoolean(false))
+      .count('id as count')
+      .first();
+
+    // Get events expiring within 7 days
+    const sevenDaysFromNow = new Date();
+    sevenDaysFromNow.setDate(sevenDaysFromNow.getDate() + 7);
+    const now = new Date();
+    
+    const expiringEvents = await db('events')
+      .where('is_active', formatBoolean(true))
+      .where('is_archived', formatBoolean(false))
+      .where('expires_at', '<=', sevenDaysFromNow.toISOString())
+      .where('expires_at', '>', now.toISOString())
+      .count('id as count')
+      .first();
+
+    // Get total photos count
+    const totalPhotos = await db('photos')
+      .count('id as count')
+      .first();
+
+    // Get storage usage (sum of all photo sizes)
+    const storageUsed = await db('photos')
+      .sum('size_bytes as total')
+      .first();
+
+    // Get total views (last 30 days)
+    const thirtyDaysAgo = new Date();
+    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+    
+    const totalViews = await db('access_logs')
+      .where('action', 'view')
+      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    // Get total downloads (last 30 days)
+    const totalDownloads = await db('access_logs')
+      .where('action', 'download')
+      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    // Get archived events count
+    const archivedEvents = await db('events')
+      .where('is_archived', formatBoolean(true))
+      .count('id as count')
+      .first();
+
+    // Calculate trends (compare with previous 30 days)
+    const sixtyDaysAgo = new Date();
+    sixtyDaysAgo.setDate(sixtyDaysAgo.getDate() - 60);
+    
+    const previousViews = await db('access_logs')
+      .where('action', 'view')
+      .where('timestamp', '>=', sixtyDaysAgo.toISOString())
+      .where('timestamp', '<', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    const previousDownloads = await db('access_logs')
+      .where('action', 'download')
+      .where('timestamp', '>=', sixtyDaysAgo.toISOString())
+      .where('timestamp', '<', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    // Calculate trend percentages
+    const viewsTrend = previousViews.count > 0 
+      ? ((totalViews.count - previousViews.count) / previousViews.count) * 100 
+      : 0;
+    
+    const downloadsTrend = previousDownloads.count > 0
+      ? ((totalDownloads.count - previousDownloads.count) / previousDownloads.count) * 100
+      : 0;
+
+    res.json({
+      activeEvents: activeEvents.count || 0,
+      expiringEvents: expiringEvents.count || 0,
+      totalPhotos: totalPhotos.count || 0,
+      storageUsed: storageUsed.total || 0,
+      totalViews: totalViews.count || 0,
+      totalDownloads: totalDownloads.count || 0,
+      viewsTrend: Math.round(viewsTrend * 10) / 10,
+      downloadsTrend: Math.round(downloadsTrend * 10) / 10,
+      archivedEvents: archivedEvents.count || 0
+    });
+  } catch (error) {
+    console.error('Dashboard stats error:', error);
+    res.status(500).json({ error: 'Failed to fetch dashboard statistics' });
+  }
+});
+
+// Get recent activity
+router.get('/activity', adminAuth, async (req, res) => {
+  try {
+    const limit = parseInt(req.query.limit) || 10;
+    
+    const activities = await db('activity_logs')
+      .select('activity_logs.*', 'events.event_name')
+      .leftJoin('events', 'activity_logs.event_id', 'events.id')
+      .orderBy('activity_logs.created_at', 'desc')
+      .limit(limit);
+
+    // Format activities
+    const formattedActivities = activities.map(activity => ({
+      id: activity.id,
+      type: activity.activity_type,
+      actorType: activity.actor_type,
+      actorName: activity.actor_name,
+      eventName: activity.event_name,
+      metadata: (() => {
+        try {
+          if (!activity.metadata) return {};
+          if (typeof activity.metadata === 'object') return activity.metadata;
+          return JSON.parse(activity.metadata);
+        } catch (e) {
+          console.warn('Failed to parse metadata for activity:', activity.id, e.message);
+          return {};
+        }
+      })(),
+      createdAt: activity.created_at
+    }));
+
+    res.json(formattedActivities);
+  } catch (error) {
+    console.error('Activity log error:', error);
+    res.status(500).json({ error: 'Failed to fetch activity log' });
+  }
+});
+
+// Get system health status
+router.get('/health', adminAuth, async (req, res) => {
+  try {
+    const os = require('os');
+    
+    // Check database connectivity
+    let dbStatus = 'healthy';
+    try {
+      await db.raw('SELECT 1');
+    } catch (error) {
+      dbStatus = 'error';
+    }
+
+    // Check email queue
+    const [pendingEmails] = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count');
+    
+    const twentyFourHoursAgo = new Date();
+    twentyFourHoursAgo.setHours(twentyFourHoursAgo.getHours() - 24);
+    
+    const [failedEmails] = await db('email_queue')
+      .where('status', 'failed')
+      .where('created_at', '>=', twentyFourHoursAgo.toISOString())
+      .count('* as count');
+
+    const emailStatus = failedEmails.count > 10 ? 'warning' : 'healthy';
+
+    // Check disk space (simplified)
+    const storageStatus = 'healthy'; // In production, check actual disk usage
+
+    // Memory usage
+    const memoryUsage = {
+      total: os.totalmem(),
+      free: os.freemem(),
+      used: os.totalmem() - os.freemem(),
+      percentage: Math.round(((os.totalmem() - os.freemem()) / os.totalmem()) * 100)
+    };
+
+    const memoryStatus = memoryUsage.percentage > 90 ? 'warning' : 'healthy';
+
+    // Overall health
+    const statuses = [dbStatus, emailStatus, storageStatus, memoryStatus];
+    let overallHealth = 'healthy';
+    if (statuses.includes('error')) overallHealth = 'error';
+    else if (statuses.includes('warning')) overallHealth = 'warning';
+
+    res.json({
+      overall: overallHealth,
+      services: {
+        database: dbStatus,
+        email: emailStatus,
+        storage: storageStatus,
+        memory: memoryStatus
+      },
+      details: {
+        emailQueue: {
+          pending: pendingEmails.count,
+          failed: failedEmails.count
+        },
+        memory: memoryUsage
+      }
+    });
+  } catch (error) {
+    console.error('Health check error:', error);
+    res.status(500).json({ 
+      overall: 'error',
+      error: 'Failed to check system health' 
+    });
+  }
+});
+
+// Get analytics data for charts
+router.get('/analytics', adminAuth, async (req, res) => {
+  try {
+    const days = sanitizeDays(req.query.days || 7);
+    
+    // Generate date range
+    const dates = [];
+    for (let i = days - 1; i >= 0; i--) {
+      dates.push({
+        date: new Date(Date.now() - i * 24 * 60 * 60 * 1000).toISOString().split('T')[0],
+        views: 0,
+        downloads: 0,
+        uniqueVisitors: 0
+      });
+    }
+
+    // Calculate the start date for queries
+    const startDate = new Date();
+    startDate.setDate(startDate.getDate() - days);
+    const startDateStr = startDate.toISOString();
+
+    // Get views per day
+    const viewsData = await db('access_logs')
+      .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
+      .where('action', 'view')
+      .where('timestamp', '>=', startDateStr)
+      .groupByRaw('DATE(timestamp)');
+
+    // Get downloads per day
+    const downloadsData = await db('access_logs')
+      .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
+      .where('action', 'download')
+      .where('timestamp', '>=', startDateStr)
+      .groupByRaw('DATE(timestamp)');
+
+    // Get unique visitors per day
+    const visitorsData = await db('access_logs')
+      .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(DISTINCT ip_address) as count'))
+      .where('timestamp', '>=', startDateStr)
+      .groupByRaw('DATE(timestamp)');
+
+    // Merge data into dates array
+    viewsData.forEach(row => {
+      const dateObj = dates.find(d => d.date === row.date);
+      if (dateObj) dateObj.views = row.count;
+    });
+
+    downloadsData.forEach(row => {
+      const dateObj = dates.find(d => d.date === row.date);
+      if (dateObj) dateObj.downloads = row.count;
+    });
+
+    visitorsData.forEach(row => {
+      const dateObj = dates.find(d => d.date === row.date);
+      if (dateObj) dateObj.uniqueVisitors = row.count;
+    });
+
+    // Get top galleries by views
+    const topGalleries = await db('access_logs')
+      .select('events.event_name', 'events.slug')
+      .select(db.raw('COUNT(*) as views'))
+      .join('events', 'access_logs.event_id', 'events.id')
+      .where('access_logs.action', 'view')
+      .where('access_logs.timestamp', '>=', startDateStr)
+      .groupBy('events.id')
+      .orderBy('views', 'desc')
+      .limit(5);
+
+    // Get device breakdown (simplified - based on user agent)
+    const deviceData = await db('access_logs')
+      .select(
+        db.raw(`
+          CASE 
+            WHEN user_agent LIKE '%Mobile%' THEN 'mobile'
+            WHEN user_agent LIKE '%Tablet%' OR user_agent LIKE '%iPad%' THEN 'tablet'
+            ELSE 'desktop'
+          END as device_type
+        `),
+        db.raw('COUNT(*) as count')
+      )
+      .where('timestamp', '>=', startDateStr)
+      .groupBy('device_type');
+
+    const totalDevices = deviceData.reduce((sum, d) => sum + d.count, 0);
+    const devices = {
+      desktop: 0,
+      mobile: 0,
+      tablet: 0
+    };
+
+    deviceData.forEach(d => {
+      devices[d.device_type] = Math.round((d.count / totalDevices) * 100);
+    });
+
+    res.json({
+      chartData: dates,
+      topGalleries,
+      devices
+    });
+  } catch (error) {
+    console.error('Analytics error:', error);
+    res.status(500).json({ error: 'Failed to fetch analytics data' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminEmail.js

@@ -0,0 +1,432 @@
+const express = require('express');
+const nodemailer = require('nodemailer');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+
+// Get email configuration
+router.get('/config', adminAuth, async (req, res) => {
+  try {
+    const config = await db('email_configs').first();
+    
+    if (!config) {
+      return res.json({
+        smtp_host: '',
+        smtp_port: 587,
+        smtp_secure: false,
+        smtp_user: '',
+        smtp_pass: '', // Don't send actual password
+        from_email: '',
+        from_name: ''
+      });
+    }
+
+    // Don't send the actual password
+    res.json({
+      ...config,
+      smtp_pass: config.smtp_pass ? '********' : ''
+    });
+  } catch (error) {
+    console.error('Email config fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch email configuration' });
+  }
+});
+
+// Update email configuration
+router.post('/config', [
+  adminAuth,
+  body('smtp_host').notEmpty().withMessage('SMTP host is required'),
+  body('smtp_port').isInt({ min: 1, max: 65535 }).withMessage('Invalid port number'),
+  body('from_email').isEmail().withMessage('Invalid from email address')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const {
+      smtp_host,
+      smtp_port,
+      smtp_secure,
+      smtp_user,
+      smtp_pass,
+      from_email,
+      from_name
+    } = req.body;
+
+    // Check if config exists
+    const existingConfig = await db('email_configs').first();
+    
+    const configData = {
+      smtp_host,
+      smtp_port: parseInt(smtp_port),
+      smtp_secure: smtp_secure || false,
+      smtp_user: smtp_user || '',
+      from_email,
+      from_name: from_name || 'Photo Sharing',
+      updated_at: new Date()
+    };
+
+    // Only update password if provided and not masked
+    if (smtp_pass && smtp_pass !== '********') {
+      configData.smtp_pass = smtp_pass;
+    }
+
+    if (existingConfig) {
+      await db('email_configs')
+        .where('id', existingConfig.id)
+        .update(configData);
+    } else {
+      await db('email_configs').insert(configData);
+    }
+
+    // Log activity
+    await logActivity('email_config_updated', 
+      { smtp_host, from_email }, 
+      null, 
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Email configuration updated successfully' });
+  } catch (error) {
+    console.error('Email config update error:', error);
+    res.status(500).json({ error: 'Failed to update email configuration' });
+  }
+});
+
+// Test email configuration
+router.post('/test', adminAuth, async (req, res) => {
+  try {
+    const { test_email } = req.body;
+    
+    if (!test_email) {
+      return res.status(400).json({ error: 'Test email address is required' });
+    }
+
+    // Get email config
+    const config = await db('email_configs').first();
+    
+    if (!config) {
+      return res.status(400).json({ error: 'Email configuration not found. Please configure SMTP settings first.' });
+    }
+
+    // Validate SMTP configuration
+    if (!config.smtp_host || !config.smtp_port) {
+      return res.status(400).json({ 
+        error: 'Incomplete email configuration',
+        details: 'SMTP host and port are required'
+      });
+    }
+    
+    // Check if password might be masked (this shouldn't happen when fetching from DB)
+    if (config.smtp_pass === '********') {
+      return res.status(400).json({
+        error: 'Invalid email configuration',
+        details: 'SMTP password appears to be masked. Please reconfigure your email settings.'
+      });
+    }
+
+    // Create transporter with detailed logging
+    const transportConfig = {
+      host: config.smtp_host,
+      port: parseInt(config.smtp_port),
+      secure: config.smtp_secure === true || config.smtp_secure === 1,
+      auth: config.smtp_user && config.smtp_pass ? {
+        user: config.smtp_user,
+        pass: config.smtp_pass
+      } : undefined,
+      logger: process.env.NODE_ENV === 'development',
+      debug: process.env.NODE_ENV === 'development'
+    };
+
+    console.log('Creating email transporter with config:', {
+      host: transportConfig.host,
+      port: transportConfig.port,
+      secure: transportConfig.secure,
+      auth: transportConfig.auth ? 'configured' : 'none'
+    });
+
+    const transporter = nodemailer.createTransport(transportConfig);
+
+    // Send test email
+    await transporter.sendMail({
+      from: `${config.from_name} <${config.from_email}>`,
+      to: test_email,
+      subject: 'Test Email - Photo Sharing Platform',
+      html: `
+        <h2>Test Email Successful!</h2>
+        <p>This is a test email from your Photo Sharing platform.</p>
+        <p>If you're seeing this, your email configuration is working correctly.</p>
+        <hr>
+        <p style="color: #666; font-size: 12px;">
+          Sent from: ${config.from_email}<br>
+          SMTP Host: ${config.smtp_host}<br>
+          Time: ${new Date().toISOString()}
+        </p>
+      `,
+      text: 'Test Email Successful! Your email configuration is working correctly.'
+    });
+
+    res.json({ message: 'Test email sent successfully' });
+  } catch (error) {
+    console.error('Test email error:', error);
+    console.error('Error stack:', error.stack);
+    
+    // Provide more specific error messages
+    let errorMessage = 'Failed to send test email';
+    let details = error.message;
+    
+    if (error.code === 'ECONNREFUSED') {
+      errorMessage = 'Failed to connect to SMTP server';
+      details = 'Please check your SMTP host and port settings';
+    } else if (error.code === 'EAUTH') {
+      errorMessage = 'SMTP authentication failed';
+      details = 'Please check your SMTP username and password';
+    } else if (error.code === 'ESOCKET') {
+      errorMessage = 'Network error';
+      details = 'Could not establish connection to SMTP server';
+    }
+    
+    res.status(500).json({ 
+      error: errorMessage,
+      details: details,
+      code: error.code
+    });
+  }
+});
+
+// Get email templates
+router.get('/templates', adminAuth, async (req, res) => {
+  try {
+    const templates = await db('email_templates')
+      .select('*')
+      .orderBy('template_key');
+
+    // Parse variables JSON and format for multi-language support
+    const formattedTemplates = templates.map(template => {
+      const result = {
+        id: template.id,
+        template_key: template.template_key,
+        variables: (() => {
+          try {
+            if (!template.variables) return [];
+            if (typeof template.variables === 'object') return template.variables;
+            return JSON.parse(template.variables);
+          } catch (e) {
+            console.warn('Failed to parse variables for template:', template.template_key, e.message);
+            return [];
+          }
+        })(),
+        updated_at: template.updated_at
+      };
+      
+      // Handle both old and new schema formats
+      if (template.subject_en !== undefined) {
+        // New schema with language columns
+        result.subject_en = template.subject_en;
+        result.body_html_en = template.body_html_en;
+        result.body_text_en = template.body_text_en;
+        result.subject_de = template.subject_de;
+        result.body_html_de = template.body_html_de;
+        result.body_text_de = template.body_text_de;
+      } else {
+        // Old schema - use basic columns for both languages
+        result.subject_en = template.subject;
+        result.body_html_en = template.body_html;
+        result.body_text_en = template.body_text;
+        result.subject_de = template.subject;
+        result.body_html_de = template.body_html;
+        result.body_text_de = template.body_text;
+      }
+      
+      return result;
+    });
+
+    res.json(formattedTemplates);
+  } catch (error) {
+    console.error('Email templates fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch email templates' });
+  }
+});
+
+// Get single template
+router.get('/templates/:key', adminAuth, async (req, res) => {
+  try {
+    const template = await db('email_templates')
+      .where('template_key', req.params.key)
+      .first();
+
+    if (!template) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    // Handle both old and new schema formats
+    const response = {
+      id: template.id,
+      template_key: template.template_key,
+      variables: (() => {
+        try {
+          if (!template.variables) return [];
+          if (typeof template.variables === 'object') return template.variables;
+          return JSON.parse(template.variables);
+        } catch (e) {
+          console.warn('Failed to parse variables for template:', template.template_key, e.message);
+          return [];
+        }
+      })(),
+      updated_at: template.updated_at
+    };
+    
+    // Check which columns exist and use them appropriately
+    if (template.subject_en !== undefined) {
+      // New schema with language columns
+      response.subject_en = template.subject_en;
+      response.body_html_en = template.body_html_en;
+      response.body_text_en = template.body_text_en;
+      response.subject_de = template.subject_de;
+      response.body_html_de = template.body_html_de;
+      response.body_text_de = template.body_text_de;
+    } else {
+      // Old schema - use basic columns for both languages
+      response.subject_en = template.subject;
+      response.body_html_en = template.body_html;
+      response.body_text_en = template.body_text;
+      response.subject_de = template.subject;
+      response.body_html_de = template.body_html;
+      response.body_text_de = template.body_text;
+    }
+    
+    res.json(response);
+  } catch (error) {
+    console.error('Email template fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch email template' });
+  }
+});
+
+// Update email template
+router.put('/templates/:key', [
+  adminAuth,
+  body('subject_en').optional().notEmpty().withMessage('English subject cannot be empty'),
+  body('subject_de').optional().notEmpty().withMessage('German subject cannot be empty'),
+  body('body_html_en').optional().notEmpty().withMessage('English HTML body cannot be empty'),
+  body('body_html_de').optional().notEmpty().withMessage('German HTML body cannot be empty')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const {
+      subject_en, subject_de,
+      body_html_en, body_html_de,
+      body_text_en, body_text_de
+    } = req.body;
+
+    const updateData = {
+      updated_at: new Date()
+    };
+
+    // Check which columns exist in the database
+    const template = await db('email_templates')
+      .where('template_key', req.params.key)
+      .first();
+      
+    if (!template) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    // Determine schema type and update accordingly
+    if (template.subject_en !== undefined) {
+      // New schema with language columns
+      if (subject_en !== undefined) updateData.subject_en = subject_en;
+      if (subject_de !== undefined) updateData.subject_de = subject_de;
+      if (body_html_en !== undefined) updateData.body_html_en = body_html_en;
+      if (body_html_de !== undefined) updateData.body_html_de = body_html_de;
+      if (body_text_en !== undefined) updateData.body_text_en = body_text_en || '';
+      if (body_text_de !== undefined) updateData.body_text_de = body_text_de || '';
+      
+      // Also update basic columns if they exist
+      if (template.subject !== undefined) {
+        updateData.subject = subject_en || updateData.subject_en;
+        updateData.body_html = body_html_en || updateData.body_html_en;
+        updateData.body_text = body_text_en || updateData.body_text_en || '';
+      }
+    } else {
+      // Old schema - only update basic columns
+      if (subject_en !== undefined) {
+        updateData.subject = subject_en;
+        updateData.body_html = body_html_en;
+        updateData.body_text = body_text_en || '';
+      }
+    }
+
+    const updated = await db('email_templates')
+      .where('template_key', req.params.key)
+      .update(updateData);
+
+    if (!updated) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    // Log activity
+    await logActivity('email_template_updated',
+      { template_key: req.params.key },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Email template updated successfully' });
+  } catch (error) {
+    console.error('Email template update error:', error);
+    res.status(500).json({ error: 'Failed to update email template' });
+  }
+});
+
+// Preview email template
+router.post('/templates/:key/preview', adminAuth, async (req, res) => {
+  try {
+    const template = await db('email_templates')
+      .where('template_key', req.params.key)
+      .first();
+
+    if (!template) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    const { preview_data, language = 'en' } = req.body;
+    
+    // Get the appropriate language version
+    const subjectField = language === 'de' && template.subject_de ? 'subject_de' : 'subject_en';
+    const htmlField = language === 'de' && template.body_html_de ? 'body_html_de' : 'body_html_en';
+    const textField = language === 'de' && template.body_text_de ? 'body_text_de' : 'body_text_en';
+    
+    // Handle backward compatibility
+    let htmlContent = template[htmlField] || template.body_html || '';
+    let textContent = template[textField] || template.body_text || '';
+    let subject = template[subjectField] || template.subject || '';
+
+    if (preview_data) {
+      Object.keys(preview_data).forEach(key => {
+        const regex = new RegExp(`{{${key}}}`, 'g');
+        htmlContent = htmlContent.replace(regex, preview_data[key]);
+        textContent = textContent.replace(regex, preview_data[key]);
+        subject = subject.replace(regex, preview_data[key]);
+      });
+    }
+
+    res.json({
+      subject,
+      body_html: htmlContent,
+      body_text: textContent,
+      language
+    });
+  } catch (error) {
+    console.error('Email template preview error:', error);
+    res.status(500).json({ error: 'Failed to preview email template' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminEvents-enhanced.js

@@ -0,0 +1,124 @@
+// This is a partial file showing the enhanced event creation with password validation
+// Only the relevant parts are shown - merge with existing adminEvents.js
+
+const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
+
+// Enhanced event creation with password validation
+router.post('/', adminAuth, [
+  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
+  body('event_name').notEmpty().trim(),
+  body('event_date').isDate(),
+  body('host_email').isEmail().normalizeEmail(),
+  body('admin_email').isEmail().normalizeEmail(),
+  body('password').notEmpty(), // Remove the weak isLength validation
+  body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
+  body('welcome_message').optional().trim(),
+  body('color_theme').optional().trim(),
+  body('allow_user_uploads').optional().isBoolean().toBoolean(),
+  body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
+  body('host_name').notEmpty().trim()
+], async (req, res) => {
+  try {
+    console.log('Create event request body:', req.body);
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      console.error('Validation errors:', errors.array());
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const {
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password,
+      welcome_message = '',
+      color_theme = null,
+      expiration_days = 30,
+      allow_user_uploads = false,
+      upload_category_id = null
+    } = req.body;
+    
+    // Validate password strength for gallery
+    const passwordValidation = validatePasswordInContext(password, 'gallery', {
+      eventName: event_name
+    });
+    
+    if (!passwordValidation.valid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.errors,
+        score: passwordValidation.score,
+        feedback: passwordValidation.feedback
+      });
+    }
+    
+    // Generate unique slug
+    const baseSlug = `${event_type}-${event_name.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${event_date}`;
+    let slug = baseSlug;
+    let counter = 1;
+    
+    while (await db('events').where({ slug }).first()) {
+      slug = `${baseSlug}-${counter}`;
+      counter++;
+    }
+    
+    // Generate share link
+    const shareToken = crypto.randomBytes(16).toString('hex');
+    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    
+    // Hash password with configurable rounds
+    const password_hash = await bcrypt.hash(password, getBcryptRounds());
+    
+    // Calculate expiration date (days after event date)
+    const expires_at = new Date(event_date);
+    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
+    
+    // Create folder structure
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const eventPath = path.join(storagePath, 'events/active', slug);
+    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
+    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
+    
+    // Insert into database
+    const insertResult = await db('events').insert({
+      slug,
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password_hash,
+      welcome_message,
+      color_theme,
+      share_link: shareLink,
+      expires_at: expires_at.toISOString(),
+      created_at: new Date().toISOString(),
+      allow_user_uploads,
+      upload_category_id
+    }).returning('id');
+    
+    // Handle both PostgreSQL (returns array of objects) and SQLite (returns array of IDs)
+    const eventId = insertResult[0]?.id || insertResult[0];
+    
+    // Log activity
+    await logActivity('event_created', 
+      { 
+        event_type, 
+        expires_at,
+        password_strength: passwordValidation.score 
+      }, 
+      eventId, 
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    // Rest of the implementation remains the same...
+    // Queue creation email, etc.
+  } catch (error) {
+    console.error('Error creating event:', error);
+    res.status(500).json({ error: 'Failed to create event' });
+  }
+});

backend/src/routes/adminEvents.js

@@ -0,0 +1,758 @@
+const express = require('express');
+const { body, query, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+const bcrypt = require('bcrypt');
+const crypto = require('crypto');
+const fs = require('fs').promises;
+const path = require('path');
+const { archiveEvent } = require('../services/archiveService');
+const { queueEmail } = require('../services/emailProcessor');
+const { escapeLikePattern } = require('../utils/sqlSecurity');
+// formatDate import removed - dates are formatted by email processor
+const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
+const { formatBoolean } = require('../utils/dbCompat');
+
+// Create new event
+router.post('/', adminAuth, [
+  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
+  body('event_name').notEmpty().trim(),
+  body('event_date').isDate(),
+  body('host_email').isEmail().normalizeEmail(),
+  body('admin_email').isEmail().normalizeEmail(),
+  body('password').isLength({ min: 6 }),
+  body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
+  body('welcome_message').optional().trim(),
+  body('color_theme').optional().trim(),
+  body('allow_user_uploads').optional().isBoolean().toBoolean(),
+  body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
+  body('host_name').notEmpty().trim()
+], async (req, res) => {
+  try {
+    console.log('Create event request body:', req.body);
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      console.error('Validation errors:', errors.array());
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const {
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password,
+      welcome_message = '',
+      color_theme = null,
+      expiration_days = 30,
+      allow_user_uploads = false,
+      upload_category_id = null
+    } = req.body;
+    
+    // Validate password strength
+    const passwordValidation = validatePasswordInContext(password, 'gallery', {
+      eventName: event_name
+    });
+    
+    if (!passwordValidation.valid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.errors,
+        score: passwordValidation.score,
+        feedback: passwordValidation.feedback
+      });
+    }
+    
+    // Generate unique slug
+    const processedEventName = event_name
+      .toLowerCase()
+      .replace(/[^a-z0-9]/g, '-') // Replace non-alphanumeric with dash
+      .replace(/-+/g, '-')         // Replace multiple dashes with single dash
+      .replace(/^-|-$/g, '');      // Remove leading/trailing dashes
+    const baseSlug = `${event_type}-${processedEventName}-${event_date}`;
+    let slug = baseSlug;
+    let counter = 1;
+    
+    while (await db('events').where({ slug }).first()) {
+      slug = `${baseSlug}-${counter}`;
+      counter++;
+    }
+    
+    // Generate share link
+    const shareToken = crypto.randomBytes(16).toString('hex');
+    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    
+    // Hash password with configurable rounds
+    const password_hash = await bcrypt.hash(password, getBcryptRounds());
+    
+    // Calculate expiration date (days after event date)
+    // Parse YYYY-MM-DD format as local date to avoid timezone issues
+    let expires_at;
+    if (event_date.match(/^\d{4}-\d{2}-\d{2}$/)) {
+      const [year, month, day] = event_date.split('-').map(num => parseInt(num, 10));
+      expires_at = new Date(year, month - 1, day);
+    } else {
+      expires_at = new Date(event_date);
+    }
+    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
+    
+    // Create folder structure
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const eventPath = path.join(storagePath, 'events/active', slug);
+    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
+    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
+    
+    // Insert into database
+    const insertResult = await db('events').insert({
+      slug,
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password_hash,
+      welcome_message,
+      color_theme,
+      share_link: shareLink,
+      expires_at: expires_at.toISOString(),
+      created_at: new Date().toISOString(),
+      allow_user_uploads,
+      upload_category_id
+    }).returning('id');
+    
+    // Handle both PostgreSQL (returns array of objects) and SQLite (returns array of IDs)
+    const eventId = insertResult[0]?.id || insertResult[0];
+    
+    // Log activity
+    await logActivity('event_created', 
+      { event_type, expires_at }, 
+      eventId, 
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    // Queue creation email
+    // Language detection is handled by email processor
+    
+    await db('email_queue').insert({
+      event_id: eventId,
+      recipient_email: host_email,
+      email_type: 'gallery_created',
+      email_data: JSON.stringify({
+        host_name: host_name,
+        event_name,
+        event_date: event_date,  // Pass raw date - will be formatted by email processor
+        gallery_link: shareLink,
+        gallery_password: password,
+        expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
+        welcome_message: welcome_message || ''
+      }),
+      status: 'pending',
+      created_at: new Date()
+      // scheduled_at will use default value
+    });
+    
+    res.json({
+      id: eventId,
+      slug,
+      event_name,
+      event_type,
+      share_link: shareLink,
+      expires_at: expires_at.toISOString(),
+      created_at: new Date().toISOString()
+    });
+  } catch (error) {
+    console.error('Error creating event:', error);
+    res.status(500).json({ error: 'Failed to create event' });
+  }
+});
+
+// Get all events with pagination and filters
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const page = parseInt(req.query.page) || 1;
+    const limit = parseInt(req.query.limit) || 20;
+    const offset = (page - 1) * limit;
+    const search = req.query.search || '';
+    const status = req.query.status || 'all';
+    const sortBy = req.query.sortBy || 'created_at';
+    const sortOrder = req.query.sortOrder || 'desc';
+
+    // Build query
+    let query = db('events');
+    
+    // Apply search filter
+    if (search) {
+      const escapedSearch = escapeLikePattern(search);
+      query = query.where((builder) => {
+        builder.where('event_name', 'like', `%${escapedSearch}%`)
+          .orWhere('admin_email', 'like', `%${escapedSearch}%`)
+          .orWhere('slug', 'like', `%${escapedSearch}%`);
+      });
+    }
+
+    // Apply status filter
+    if (status === 'active') {
+      query = query.where('is_active', formatBoolean(true)).where('is_archived', formatBoolean(false));
+    } else if (status === 'archived') {
+      query = query.where('is_archived', formatBoolean(true));
+    } else if (status === 'inactive') {
+      query = query.where('is_active', formatBoolean(false)).where('is_archived', formatBoolean(false));
+    } else if (status === 'expiring') {
+      const sevenDaysFromNow = new Date();
+      sevenDaysFromNow.setDate(sevenDaysFromNow.getDate() + 7);
+      query = query
+        .where('is_active', formatBoolean(true))
+        .where('is_archived', formatBoolean(false))
+        .where('expires_at', '<=', sevenDaysFromNow.toISOString())
+        .where('expires_at', '>', new Date().toISOString());
+    }
+
+    // Get total count for pagination
+    const countQuery = query.clone();
+    const [{ count }] = await countQuery.count('* as count');
+
+    // Apply sorting and pagination
+    const events = await query
+      .orderBy(sortBy, sortOrder)
+      .limit(limit)
+      .offset(offset);
+
+    // Get photo counts for each event
+    const eventIds = events.map(e => e.id);
+    const photoCounts = await db('photos')
+      .whereIn('event_id', eventIds)
+      .groupBy('event_id')
+      .select('event_id')
+      .count('* as count');
+
+    // Map photo counts to events
+    const photoCountMap = photoCounts.reduce((acc, { event_id, count }) => {
+      acc[event_id] = parseInt(count);
+      return acc;
+    }, {});
+
+    // Add photo counts to events and convert dates
+    const eventsWithCounts = events.map(event => ({
+      ...event,
+      photo_count: photoCountMap[event.id] || 0,
+      // Convert Unix timestamps to ISO strings
+      created_at: event.created_at ? new Date(event.created_at).toISOString() : null,
+      expires_at: event.expires_at ? new Date(event.expires_at).toISOString() : null,
+      archived_at: event.archived_at ? new Date(event.archived_at).toISOString() : null
+    }));
+
+    res.json({
+      events: eventsWithCounts,
+      pagination: {
+        page,
+        limit,
+        total: parseInt(count),
+        totalPages: Math.ceil(count / limit)
+      }
+    });
+  } catch (error) {
+    console.error('Error fetching events:', error);
+    res.status(500).json({ error: 'Failed to fetch events' });
+  }
+});
+
+// Get single event details
+router.get('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    const event = await db('events')
+      .where('id', id)
+      .first();
+
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    // Get photo count
+    const [{ count: photoCount }] = await db('photos')
+      .where('event_id', id)
+      .count('* as count');
+
+    // Get total size
+    const [{ totalSize }] = await db('photos')
+      .where('event_id', id)
+      .sum('size_bytes as totalSize');
+
+    // Get recent photos
+    const recentPhotos = await db('photos')
+      .where('event_id', id)
+      .orderBy('uploaded_at', 'desc')
+      .limit(10)
+      .select('filename', 'type', 'size_bytes', 'uploaded_at');
+
+    // Get view and download statistics
+    const [{ totalViews }] = await db('access_logs')
+      .where('event_id', id)
+      .where('action', 'view')
+      .count('* as totalViews');
+
+    const [{ totalDownloads }] = await db('access_logs')
+      .where('event_id', id)
+      .where('action', 'download')
+      .count('* as totalDownloads');
+
+    const [{ uniqueVisitors }] = await db('access_logs')
+      .where('event_id', id)
+      .countDistinct('ip_address as uniqueVisitors');
+
+    res.json({
+      ...event,
+      photo_count: parseInt(photoCount) || 0,
+      total_size: parseInt(totalSize) || 0,
+      total_views: parseInt(totalViews) || 0,
+      total_downloads: parseInt(totalDownloads) || 0,
+      unique_visitors: parseInt(uniqueVisitors) || 0,
+      recent_photos: recentPhotos
+    });
+  } catch (error) {
+    console.error('Error fetching event:', error);
+    res.status(500).json({ error: 'Failed to fetch event details' });
+  }
+});
+
+// Update event
+router.put('/:id', adminAuth, [
+  body('event_name').optional().trim().notEmpty(),
+  body('admin_email').optional().isEmail(),
+  body('is_active').optional().isBoolean(),
+  body('expires_at').optional().isISO8601(),
+  body('welcome_message').optional({ nullable: true, checkFalsy: true }).trim(),
+  body('color_theme').optional({ nullable: true }),
+  body('allow_user_uploads').optional().isBoolean(),
+  body('host_name').optional().trim().notEmpty(),
+  body('upload_category_id').optional().custom((value) => {
+    // Accept null, undefined, or integer values
+    if (value === null || value === undefined) return true;
+    return Number.isInteger(Number(value));
+  }).withMessage('upload_category_id must be an integer or null'),
+  body('hero_photo_id').optional().custom((value) => {
+    // Accept null, undefined, or numeric values
+    if (value === null || value === undefined) return true;
+    // Check if it's a number or can be converted to a valid integer
+    const num = Number(value);
+    return !isNaN(num) && Number.isInteger(num);
+  }).withMessage('hero_photo_id must be an integer or null')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      console.log('Update event validation errors:', JSON.stringify(errors.array(), null, 2));
+      console.log('Request body:', req.body);
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { id } = req.params;
+    const updates = req.body;
+
+    // Log the update request for debugging
+    console.log('Update event request:', {
+      id,
+      updates,
+      color_theme_length: updates.color_theme ? updates.color_theme.length : 0,
+      color_theme_type: typeof updates.color_theme,
+      hero_photo_id: updates.hero_photo_id,
+      hero_photo_id_type: typeof updates.hero_photo_id
+    });
+
+    // Check if event exists
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    // Update event
+    await db('events')
+      .where('id', id)
+      .update(updates);
+
+    // Log activity
+    await logActivity('event_updated',
+      { changes: Object.keys(updates), eventName: event.event_name },
+      id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Event updated successfully' });
+  } catch (error) {
+    console.error('Error updating event:', error);
+    res.status(500).json({ error: 'Failed to update event' });
+  }
+});
+
+// Delete event
+router.delete('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    // Check if event exists
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    // Start a transaction to ensure all deletions succeed or fail together
+    await db.transaction(async (trx) => {
+      // 1. Delete activity logs (audit trail)
+      await trx('activity_logs').where('event_id', id).del();
+
+      // 2. Delete access logs
+      await trx('access_logs').where('event_id', id).del();
+
+      // 3. Delete email queue entries
+      await trx('email_queue').where('event_id', id).del();
+
+      // 4. Delete photos (this will also handle hero_photo_id foreign key)
+      await trx('photos').where('event_id', id).del();
+
+      // 5. Delete categories (photo_categories has CASCADE delete for event_id)
+      await trx('photo_categories').where('event_id', id).del();
+
+      // 6. Finally delete the event
+      await trx('events').where('id', id).del();
+
+      // Delete event folder from storage if it exists
+      if (event.folder_path) {
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const eventFolderPath = path.join(storagePath, 'events', 'active', event.folder_path);
+        
+        try {
+          const fsPromises = require('fs').promises;
+          await fsPromises.rm(eventFolderPath, { recursive: true, force: true });
+        } catch (err) {
+          console.error('Failed to delete event folder:', err);
+          // Don't fail the transaction if folder deletion fails
+        }
+      }
+
+      // Delete archive if exists
+      if (event.archive_path) {
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const archivePath = path.join(storagePath, event.archive_path);
+        
+        try {
+          const fsPromises = require('fs').promises;
+          await fsPromises.unlink(archivePath);
+        } catch (err) {
+          console.error('Failed to delete archive file:', err);
+          // Don't fail the transaction if file deletion fails
+        }
+      }
+    });
+
+    // Log activity (outside transaction)
+    await logActivity('event_deleted',
+      { event_name: event.event_name },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Event deleted successfully' });
+  } catch (error) {
+    console.error('Error deleting event:', error);
+    
+    // Provide more specific error messages
+    if (error.message && error.message.includes('foreign key constraint')) {
+      res.status(500).json({ 
+        error: 'Cannot delete event due to existing references. Please contact support.',
+        details: error.message 
+      });
+    } else {
+      res.status(500).json({ 
+        error: 'Failed to delete event',
+        details: process.env.NODE_ENV === 'development' ? error.message : undefined
+      });
+    }
+  }
+});
+
+// Toggle event status
+router.post('/:id/toggle-status', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    const newStatus = !event.is_active;
+    await db('events')
+      .where('id', id)
+      .update({
+        is_active: newStatus,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity(newStatus ? 'event_activated' : 'event_deactivated',
+      { eventName: event.event_name },
+      id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ 
+      message: `Event ${newStatus ? 'activated' : 'deactivated'} successfully`,
+      is_active: newStatus
+    });
+  } catch (error) {
+    console.error('Error toggling event status:', error);
+    res.status(500).json({ error: 'Failed to toggle event status' });
+  }
+});
+
+// Reset event password
+router.post('/:id/reset-password', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    const { sendEmail = true } = req.body;
+
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    if (event.is_archived) {
+      return res.status(400).json({ error: 'Cannot reset password for archived event' });
+    }
+
+    // Generate new password
+    const { generatePassword } = require('../utils/passwordGenerator');
+    const newPassword = generatePassword();
+    const passwordHash = await bcrypt.hash(newPassword, 10);
+
+    // Update event with new password
+    await db('events')
+      .where('id', id)
+      .update({
+        password_hash: passwordHash,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity('password_reset',
+      { eventName: event.event_name, emailSent: sendEmail },
+      id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    // Queue email notification if requested
+    if (sendEmail) {
+      // For password reset, we'll need to create a template or use a different approach
+      // For now, let's use the gallery_created template with updated password
+      await queueEmail(id, event.host_email, 'gallery_created', {
+        host_name: event.host_email.split('@')[0],
+        event_name: event.event_name,
+        event_date: event.event_date,  // Pass raw date - will be formatted by email processor
+        gallery_link: event.share_link,
+        gallery_password: newPassword,
+        expiry_date: event.expires_at  // Pass raw date - will be formatted by email processor
+      });
+    }
+
+    res.json({ 
+      message: 'Password reset successfully',
+      newPassword: newPassword,
+      emailSent: sendEmail
+    });
+  } catch (error) {
+    console.error('Error resetting password:', error);
+    res.status(500).json({ error: 'Failed to reset password' });
+  }
+});
+
+// Resend creation email
+router.post('/:id/resend-email', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    // Get event details
+    const event = await db('events')
+      .where('id', id)
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+    
+    // The email processor will determine the language based on:
+    // 1. Event language setting
+    // 2. App settings general_default_language  
+    // 3. Email config default language
+    // 4. Domain-based detection
+    // So we don't need to determine it here
+    
+    // For resending creation email, we need the actual password
+    // First, try to get it from the request body if provided
+    let galleryPassword = req.body.password;
+    
+    // If no password provided, we can't decrypt the existing one
+    // So we'll show a security message
+    if (!galleryPassword) {
+      // We'll let the email processor determine the language for the security message
+      galleryPassword = '{{password_security_message}}';
+    }
+    
+    // Dates will be formatted by the email processor based on recipient language
+    
+    // Queue the email
+    await queueEmail(id, event.host_email, 'gallery_created', {
+      host_name: event.host_name || event.host_email.split('@')[0],
+      event_name: event.event_name,
+      event_date: event.event_date,  // Pass raw date - will be formatted by email processor
+      gallery_link: event.share_link,
+      gallery_password: galleryPassword,
+      expiry_date: event.expires_at,  // Pass raw date - will be formatted by email processor
+      welcome_message: event.welcome_message || '',
+      eventId: id,
+      isResend: true // Flag to indicate this is a resend
+    });
+    
+    // Log the activity using the proper schema
+    try {
+      await logActivity('email_resent', {
+        email_type: 'gallery_created',
+        recipient: event.host_email,
+        ip_address: req.ip || '0.0.0.0',
+        user_agent: req.get('user-agent') || 'Unknown'
+      }, id, {
+        type: 'admin',
+        id: req.admin.id,
+        name: req.admin.username
+      });
+    } catch (logError) {
+      console.error('Warning: Failed to log activity:', logError);
+      // Don't fail the request if activity logging fails
+    }
+    
+    res.json({ 
+      success: true,
+      message: 'Creation email has been queued for sending'
+    });
+  } catch (error) {
+    console.error('Error resending creation email:', error);
+    console.error('Stack trace:', error.stack);
+    res.status(500).json({ error: 'Failed to resend creation email' });
+  }
+});
+
+// Archive event
+router.post('/:id/archive', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    if (event.is_archived) {
+      return res.status(400).json({ error: 'Event is already archived' });
+    }
+
+    // Use the archive service to create ZIP archive
+    await archiveEvent(event);
+
+    // Log activity
+    await logActivity('event_archived',
+      { eventName: event.event_name },
+      id,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Event archived successfully' });
+  } catch (error) {
+    console.error('Error archiving event:', error);
+    res.status(500).json({ error: 'Failed to archive event' });
+  }
+});
+
+// Bulk archive events
+router.post('/bulk-archive', adminAuth, [
+  body('eventIds').isArray().withMessage('eventIds must be an array'),
+  body('eventIds.*').isInt().withMessage('Each eventId must be an integer')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { eventIds } = req.body;
+    
+    if (eventIds.length === 0) {
+      return res.status(400).json({ error: 'No events selected for archiving' });
+    }
+
+    // Get all events to archive
+    const events = await db('events')
+      .whereIn('id', eventIds)
+      .where('is_archived', formatBoolean(false));
+
+    if (events.length === 0) {
+      return res.status(400).json({ error: 'No valid events found to archive' });
+    }
+
+    const results = {
+      successful: [],
+      failed: []
+    };
+
+    // Process each event
+    for (const event of events) {
+      try {
+        // Use the archive service to create ZIP archive
+        await archiveEvent(event);
+        
+        // Log activity
+        await logActivity('event_archived',
+          { eventName: event.event_name, bulkOperation: true },
+          event.id,
+          { type: 'admin', id: req.admin.id, name: req.admin.username }
+        );
+        
+        results.successful.push({
+          id: event.id,
+          name: event.event_name
+        });
+      } catch (error) {
+        console.error(`Failed to archive event ${event.id}:`, error);
+        results.failed.push({
+          id: event.id,
+          name: event.event_name,
+          error: error.message
+        });
+      }
+    }
+
+    // Log bulk archive activity
+    await logActivity('bulk_archive_completed',
+      { 
+        totalEvents: eventIds.length,
+        successfulCount: results.successful.length,
+        failedCount: results.failed.length
+      },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({
+      message: `Bulk archive completed: ${results.successful.length} succeeded, ${results.failed.length} failed`,
+      results
+    });
+  } catch (error) {
+    console.error('Error in bulk archive:', error);
+    res.status(500).json({ error: 'Failed to perform bulk archive' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminNotifications.js

@@ -0,0 +1,122 @@
+const express = require('express');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const router = express.Router();
+
+// Get notifications (unread activity logs)
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const { limit = 20, includeRead = false } = req.query;
+
+    let query = db('activity_logs')
+      .select(
+        'activity_logs.*',
+        'events.event_name'
+      )
+      .leftJoin('events', 'activity_logs.event_id', 'events.id')
+      .orderBy('activity_logs.created_at', 'desc')
+      .limit(parseInt(limit));
+    
+    // By default, only show unread notifications
+    if (includeRead !== 'true') {
+      query = query.whereNull('activity_logs.read_at');
+    }
+
+    const notifications = await query;
+
+    // Format notifications
+    const formattedNotifications = notifications.map(notification => ({
+      id: notification.id,
+      type: notification.activity_type,
+      actorType: notification.actor_type,
+      actorName: notification.actor_name,
+      eventName: notification.event_name,
+      eventId: notification.event_id,
+      metadata: (() => {
+        try {
+          if (!notification.metadata) return {};
+          if (typeof notification.metadata === 'object') return notification.metadata;
+          return JSON.parse(notification.metadata);
+        } catch (e) {
+          console.warn('Failed to parse metadata for notification:', notification.id, e.message);
+          return {};
+        }
+      })(),
+      createdAt: notification.created_at,
+      readAt: notification.read_at,
+      isRead: !!notification.read_at
+    }));
+
+    // Get unread count
+    const unreadCount = await db('activity_logs')
+      .whereNull('read_at')
+      .count('id as count')
+      .first();
+
+    res.json({
+      notifications: formattedNotifications,
+      unreadCount: unreadCount.count || 0
+    });
+  } catch (error) {
+    console.error('Notifications fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch notifications' });
+  }
+});
+
+// Mark notification as read
+router.put('/:id/read', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    await db('activity_logs')
+      .where('id', id)
+      .update({
+        read_at: new Date()
+      });
+
+    res.json({ message: 'Notification marked as read' });
+  } catch (error) {
+    console.error('Mark notification read error:', error);
+    res.status(500).json({ error: 'Failed to mark notification as read' });
+  }
+});
+
+// Mark all notifications as read
+router.put('/read-all', adminAuth, async (req, res) => {
+  try {
+    await db('activity_logs')
+      .whereNull('read_at')
+      .update({
+        read_at: new Date()
+      });
+
+    res.json({ message: 'All notifications marked as read' });
+  } catch (error) {
+    console.error('Mark all notifications read error:', error);
+    res.status(500).json({ error: 'Failed to mark all notifications as read' });
+  }
+});
+
+// Delete old notifications (older than 30 days and read)
+router.delete('/clear-old', adminAuth, async (req, res) => {
+  try {
+    // Use database-agnostic date calculation
+    const thirtyDaysAgo = new Date();
+    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+    
+    const deletedCount = await db('activity_logs')
+      .whereNotNull('read_at')
+      .where('created_at', '<', thirtyDaysAgo)
+      .delete();
+
+    res.json({ 
+      message: 'Old notifications cleared',
+      deletedCount 
+    });
+  } catch (error) {
+    console.error('Clear old notifications error:', error);
+    res.status(500).json({ error: 'Failed to clear old notifications' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminPhotos.js

@@ -0,0 +1,795 @@
+const express = require('express');
+const multer = require('multer');
+const path = require('path');
+const fs = require('fs').promises;
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth');
+const { generateThumbnail, ensureThumbnail } = require('../services/imageProcessor');
+const { generatePhotoFilename } = require('../utils/filenameSanitizer');
+const { escapeLikePattern } = require('../utils/sqlSecurity');
+const { validateUploadedFiles } = require('../middleware/uploadValidation');
+const router = express.Router();
+
+// Get storage path from environment or default
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+// Configure multer for file uploads
+// IMPORTANT: Using synchronous functions to prevent file corruption
+const storage = multer.diskStorage({
+  destination: (req, file, cb) => {
+    console.log('Multer destination called for file:', file.originalname);
+    const { eventId } = req.params;
+    
+    // We'll validate the event exists in the route handler
+    // For now, just create a temp destination
+    const tempPath = path.join(getStoragePath(), 'temp', `upload_${Date.now()}_${Math.random().toString(36).substring(7)}`);
+    
+    // Create directory synchronously
+    require('fs').mkdirSync(tempPath, { recursive: true });
+    console.log('Temp destination path:', tempPath);
+    
+    // Store temp path for cleanup
+    req.tempUploadPath = tempPath;
+    
+    cb(null, tempPath);
+  },
+  filename: (req, file, cb) => {
+    console.log('Multer filename called for file:', file.originalname);
+    // Use a simple temporary filename
+    const tempName = `temp_${Date.now()}_${Math.round(Math.random() * 1E9)}${path.extname(file.originalname)}`;
+    console.log('Temp filename:', tempName);
+    cb(null, tempName);
+  }
+});
+
+const { validateFileType } = require('../utils/fileSecurityUtils');
+
+const upload = multer({
+  storage: storage,
+  limits: {
+    fileSize: 50 * 1024 * 1024, // 50MB limit per file
+    files: 500, // Maximum 500 files
+    // Set a reasonable field size limit to prevent memory issues
+    fieldSize: 10 * 1024 * 1024, // 10MB for non-file fields
+    // Add part size limits to prevent incomplete uploads
+    parts: 10000, // Maximum number of parts (fields + files)
+    headerPairs: 2000 // Maximum number of header key-value pairs
+  },
+  fileFilter: (req, file, cb) => {
+    // Accept images only with proper validation
+    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/webp'];
+    
+    if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
+      return cb(null, true);
+    } else {
+      cb(new Error('Only JPEG, PNG and WebP images are allowed'));
+    }
+  },
+  // Add abort on limit to stop processing when limits are exceeded
+  abortOnLimit: true
+});
+
+const { createFileUploadValidator } = require('../utils/fileSecurityUtils');
+
+// Create content validator middleware
+const validateUploadContent = createFileUploadValidator({
+  allowedTypes: ['image/jpeg', 'image/png', 'image/webp'],
+  maxFileSize: 50 * 1024 * 1024,
+  validateContent: true
+});
+
+// Request timeout middleware for uploads
+const uploadTimeout = (timeout = 300000) => { // 5 minutes default
+  return (req, res, next) => {
+    // Set timeout for the request
+    req.setTimeout(timeout, () => {
+      console.error('Upload request timed out');
+      if (!res.headersSent) {
+        res.status(408).json({ error: 'Upload request timed out' });
+      }
+    });
+    
+    // Set response timeout as well
+    res.setTimeout(timeout, () => {
+      console.error('Upload response timed out');
+    });
+    
+    next();
+  };
+};
+
+// Upload photos for an event
+// Increased limit to 500 files, but recommend chunked uploads for better performance
+router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, next) => { // 10 minute timeout
+  upload.array('photos', 500)(req, res, (err) => {
+    if (err) {
+      console.error('Multer error:', err);
+      if (err instanceof multer.MulterError) {
+        if (err.code === 'LIMIT_FILE_SIZE') {
+          return res.status(400).json({ error: 'File too large. Maximum size is 50MB per file.' });
+        }
+        if (err.code === 'LIMIT_FILE_COUNT') {
+          return res.status(400).json({ error: 'Too many files. Maximum 500 files per upload.' });
+        }
+        return res.status(400).json({ error: `Upload error: ${err.message}` });
+      }
+      return res.status(400).json({ error: err.message || 'Upload failed' });
+    }
+    next();
+  });
+}, validateUploadContent, validateUploadedFiles, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { category_id } = req.body;
+    
+    console.log('Upload request received for event:', eventId);
+    console.log('Body:', req.body);
+    console.log('Files:', req.files ? req.files.length : 'none');
+    console.log('File details:', req.files?.map(f => ({ name: f.originalname, size: f.size, mimetype: f.mimetype })));
+    console.log('Category ID received:', category_id);
+    
+    // Verify event exists and admin has access
+    const event = await db('events').where({ id: eventId }).first();
+    if (!event) {
+      console.error('Event not found:', eventId);
+      // Clean up temp files
+      if (req.tempUploadPath) {
+        try {
+          await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+        } catch (e) {
+          console.error('Failed to clean up temp path:', e);
+        }
+      }
+      return res.status(404).json({ error: 'Event not found' });
+    }
+    
+    if (!req.files || req.files.length === 0) {
+      console.error('No files in request. req.files:', req.files);
+      console.error('Request body keys:', Object.keys(req.body));
+      // Clean up temp files
+      if (req.tempUploadPath) {
+        try {
+          await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+        } catch (e) {
+          console.error('Failed to clean up temp path:', e);
+        }
+      }
+      return res.status(400).json({ error: 'No files uploaded' });
+    }
+    
+    // Parse category_id to number if provided
+    const parsedCategoryId = category_id ? parseInt(category_id, 10) : null;
+    
+    // Get category details if provided
+    let category = null;
+    if (parsedCategoryId) {
+      category = await db('photo_categories').where({ id: parsedCategoryId }).first();
+      if (!category) {
+        // Clean up temp files
+        if (req.tempUploadPath) {
+          try {
+            await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+          } catch (e) {
+            console.error('Failed to clean up temp path:', e);
+          }
+        }
+        return res.status(400).json({ error: 'Invalid category' });
+      }
+    }
+    
+    // Create final destination directory
+    const finalDestPath = path.join(getStoragePath(), 'events/active', event.slug);
+    await fs.mkdir(finalDestPath, { recursive: true });
+    
+    const uploadedPhotos = [];
+    const errors = [];
+    
+    // Process files in batches to optimize database operations
+    const BATCH_SIZE = 25; // Increased batch size for better performance with large uploads
+    
+    for (let i = 0; i < req.files.length; i += BATCH_SIZE) {
+      const batch = req.files.slice(i, i + BATCH_SIZE);
+      
+      // Start a single transaction for the batch
+      const trx = await db.transaction();
+      
+      try {
+        // Get initial counter for this batch
+        let batchCounter = 1;
+        if (category) {
+          const categoryData = await trx('photo_categories')
+            .where({ id: parsedCategoryId })
+            .forUpdate()
+            .first();
+          batchCounter = (categoryData.photo_counter || 0) + 1;
+        } else {
+          const uncategorizedCount = await trx('photos')
+            .where({ event_id: eventId })
+            .whereNull('category_id')
+            .count('id as count')
+            .first();
+          batchCounter = (parseInt(uncategorizedCount.count) || 0) + 1;
+        }
+        
+        const batchPhotos = [];
+        const fileRenameOperations = []; // Store rename operations to do after commit
+        
+        // First pass: prepare data and move files from temp to final location
+        for (let fileIndex = 0; fileIndex < batch.length; fileIndex++) {
+          const file = batch[fileIndex];
+          const counter = batchCounter + fileIndex;
+          const tempPath = file.path; // Original temp path
+          
+          try {
+            // Verify file is complete before processing
+            const tempStats = await fs.stat(tempPath);
+            if (tempStats.size === 0) {
+              throw new Error('File is empty - upload may have been interrupted');
+            }
+            
+            // Generate new filename
+            const extension = path.extname(file.originalname);
+            const newFilename = generatePhotoFilename(
+              event.event_name,
+              category ? category.name : 'uncategorized',
+              counter,
+              extension
+            );
+            
+            // Calculate final path
+            const finalPath = path.join(finalDestPath, newFilename);
+            const storagePath = getStoragePath();
+            const relativePath = path.relative(path.join(storagePath, 'events/active'), finalPath);
+            
+            // Prepare photo data for batch insert
+            const photoData = {
+              event_id: parseInt(eventId),
+              filename: newFilename,
+              path: relativePath,
+              thumbnail_path: null, // Will generate after successful commit
+              category_id: parsedCategoryId ? parseInt(parsedCategoryId) : null,
+              type: 'individual',
+              size_bytes: tempStats.size // Use actual file size from stat
+            };
+            
+            batchPhotos.push(photoData);
+            
+            // Store move operation for later
+            fileRenameOperations.push({
+              tempPath: tempPath,
+              finalPath: finalPath,
+              filename: newFilename,
+              photoData: photoData
+            });
+          } catch (error) {
+            console.error(`Error preparing file ${file.originalname}:`, error);
+            errors.push({ filename: file.originalname, error: error.message });
+          }
+        }
+        
+        // Insert all photos in this batch
+        if (batchPhotos.length > 0) {
+          console.log(`Inserting batch of ${batchPhotos.length} photos with category_id: ${parsedCategoryId}`);
+          
+          const insertedIds = await trx('photos').insert(batchPhotos).returning('id');
+          
+          // Update category counter if needed
+          if (category && parsedCategoryId) {
+            const newCounter = batchCounter + batchPhotos.length - 1;
+            await trx('photo_categories')
+              .where({ id: parsedCategoryId })
+              .update({ photo_counter: newCounter });
+            console.log(`Updated category ${parsedCategoryId} counter to ${newCounter}`);
+          }
+          
+          // Commit the transaction first
+          await trx.commit();
+          console.log(`Successfully committed batch of ${batchPhotos.length} photos`);
+          
+          // Now move files from temp to final location after successful commit
+          for (let idx = 0; idx < fileRenameOperations.length; idx++) {
+            const operation = fileRenameOperations[idx];
+            try {
+              // Move the file from temp to final location
+              await fs.rename(operation.tempPath, operation.finalPath);
+              console.log(`Moved file from ${operation.tempPath} to ${operation.finalPath}`);
+              
+              // Verify the file was moved successfully
+              const finalStats = await fs.stat(operation.finalPath);
+              if (finalStats.size !== operation.photoData.size_bytes) {
+                throw new Error(`File size mismatch after move: expected ${operation.photoData.size_bytes}, got ${finalStats.size}`);
+              }
+              
+              // Generate thumbnail with final path
+              let thumbnailPath = null;
+              try {
+                thumbnailPath = await generateThumbnail(operation.finalPath);
+                
+                // Update the database with thumbnail path
+                if (thumbnailPath && insertedIds[idx]) {
+                  const photoId = insertedIds[idx]?.id || insertedIds[idx];
+                  await db('photos')
+                    .where({ id: photoId })
+                    .update({ thumbnail_path: thumbnailPath });
+                }
+              } catch (thumbError) {
+                console.error(`Thumbnail generation failed for ${operation.filename}:`, thumbError.message);
+              }
+              
+              // Add to successful uploads
+              uploadedPhotos.push({
+                id: insertedIds[idx]?.id || insertedIds[idx],
+                filename: operation.filename,
+                size: operation.photoData.size_bytes,
+                category_id: operation.photoData.category_id
+              });
+            } catch (moveError) {
+              console.error(`Failed to move file ${operation.tempPath} to ${operation.finalPath}:`, moveError);
+              errors.push({ 
+                filename: operation.filename, 
+                error: `File move failed: ${moveError.message}` 
+              });
+              
+              // Try to clean up the database entry if file move failed
+              if (insertedIds[idx]) {
+                const photoId = insertedIds[idx]?.id || insertedIds[idx];
+                try {
+                  await db('photos').where({ id: photoId }).delete();
+                  console.log(`Cleaned up database entry for failed photo ${photoId}`);
+                } catch (cleanupError) {
+                  console.error(`Failed to clean up database entry:`, cleanupError);
+                }
+              }
+            }
+          }
+        } else {
+          // No photos to insert, just rollback
+          await trx.rollback();
+        }
+      } catch (error) {
+        console.error(`Error processing batch starting at index ${i}:`, error);
+        console.error('Stack trace:', error.stack);
+        
+        // Rollback if not already committed
+        if (!trx.isCompleted()) {
+          await trx.rollback();
+        }
+        
+        // Add all files in this batch to errors
+        for (const file of batch) {
+          errors.push({ 
+            filename: file.originalname, 
+            error: `Batch processing failed: ${error.message}` 
+          });
+        }
+      }
+    }
+    
+    // Clean up temp upload directory
+    if (req.tempUploadPath) {
+      try {
+        await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+        console.log(`Cleaned up temp upload directory: ${req.tempUploadPath}`);
+      } catch (e) {
+        console.error('Failed to clean up temp upload directory:', e);
+      }
+    }
+    
+    // Log activity
+    await logActivity('photos_uploaded',
+      { count: uploadedPhotos.length, eventName: event.event_name },
+      eventId,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    // Include any files that were invalid from the validation middleware
+    const totalInvalidFiles = (req.invalidFiles || []).concat(errors);
+    
+    // Prepare response
+    const totalAttempted = req.files.length + (req.invalidFiles ? req.invalidFiles.length : 0);
+    const response = {
+      message: `Successfully uploaded ${uploadedPhotos.length} photos`,
+      photos: uploadedPhotos,
+      totalFiles: totalAttempted,
+      successCount: uploadedPhotos.length,
+      failureCount: totalInvalidFiles.length
+    };
+    
+    // Include error details if any files failed
+    if (totalInvalidFiles.length > 0) {
+      response.errors = totalInvalidFiles;
+      response.message = `Uploaded ${uploadedPhotos.length} of ${totalAttempted} photos. ${totalInvalidFiles.length} failed.`;
+    }
+    
+    res.json(response);
+  } catch (error) {
+    console.error('Error uploading photos:', error);
+    
+    // Clean up temp upload directory on error
+    if (req.tempUploadPath) {
+      try {
+        await fs.rm(req.tempUploadPath, { recursive: true, force: true });
+        console.log(`Cleaned up temp upload directory after error: ${req.tempUploadPath}`);
+      } catch (e) {
+        console.error('Failed to clean up temp upload directory:', e);
+      }
+    }
+    
+    res.status(500).json({ error: 'Failed to upload photos' });
+  }
+});
+
+// Delete a photo
+router.delete('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    
+    // Get photo details
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Delete physical files
+    const storagePath = getStoragePath();
+    const photoPath = path.join(storagePath, 'events/active', photo.path);
+    
+    try {
+      await fs.unlink(photoPath);
+    } catch (error) {
+      console.error('Error deleting photo file:', error);
+    }
+    
+    // Delete thumbnail if exists
+    if (photo.thumbnail_path) {
+      const thumbPath = path.join(storagePath, 'events/active', photo.thumbnail_path);
+      try {
+        await fs.unlink(thumbPath);
+      } catch (error) {
+        console.error('Error deleting thumbnail:', error);
+      }
+    }
+    
+    // Remove from database
+    await db('photos').where({ id: photoId }).delete();
+    
+    // Log activity
+    const event = await db('events').where({ id: eventId }).first();
+    await logActivity('photo_deleted',
+      { filename: photo.filename, eventName: event.event_name },
+      eventId,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: 'Photo deleted successfully' });
+  } catch (error) {
+    console.error('Error deleting photo:', error);
+    res.status(500).json({ error: 'Failed to delete photo' });
+  }
+});
+
+// Update a photo (e.g., change category)
+router.patch('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    const { category_id } = req.body;
+    
+    // Verify photo belongs to event
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Update photo
+    await db('photos')
+      .where({ id: photoId })
+      .update({ category_id: category_id || null });
+    
+    res.json({ message: 'Photo updated successfully' });
+  } catch (error) {
+    console.error('Error updating photo:', error);
+    res.status(500).json({ error: 'Failed to update photo' });
+  }
+});
+
+// Bulk delete photos
+router.post('/:eventId/photos/bulk-delete', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { photoIds } = req.body;
+    
+    if (!Array.isArray(photoIds) || photoIds.length === 0) {
+      return res.status(400).json({ error: 'Invalid photo IDs' });
+    }
+    
+    // Get all photos to delete
+    const photos = await db('photos')
+      .whereIn('id', photoIds)
+      .where('event_id', eventId);
+    
+    if (photos.length === 0) {
+      return res.status(404).json({ error: 'No photos found' });
+    }
+    
+    // Delete physical files
+    const storagePath = getStoragePath();
+    const event = await db('events').where({ id: eventId }).first();
+    
+    for (const photo of photos) {
+      // Delete photo file
+      const photoPath = path.join(storagePath, 'events/active', photo.path);
+      try {
+        await fs.unlink(photoPath);
+      } catch (error) {
+        console.error('Error deleting photo file:', error);
+      }
+      
+      // Delete thumbnail
+      if (photo.thumbnail_path) {
+        const thumbPath = path.join(storagePath, photo.thumbnail_path);
+        try {
+          await fs.unlink(thumbPath);
+        } catch (error) {
+          console.error('Error deleting thumbnail:', error);
+        }
+      }
+    }
+    
+    // Delete from database
+    await db('photos')
+      .whereIn('id', photoIds)
+      .where('event_id', eventId)
+      .delete();
+    
+    // Log activity
+    await logActivity('photos_bulk_deleted',
+      { count: photos.length, eventName: event.event_name },
+      eventId,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: `${photos.length} photos deleted successfully` });
+  } catch (error) {
+    console.error('Error bulk deleting photos:', error);
+    res.status(500).json({ error: 'Failed to delete photos' });
+  }
+});
+
+// Bulk update photos
+router.post('/:eventId/photos/bulk-update', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { photoIds, updates } = req.body;
+    
+    if (!Array.isArray(photoIds) || photoIds.length === 0) {
+      return res.status(400).json({ error: 'Invalid photo IDs' });
+    }
+    
+    // Verify all photos belong to the event
+    const photoCount = await db('photos')
+      .whereIn('id', photoIds)
+      .where('event_id', eventId)
+      .count('id as count')
+      .first();
+    
+    if (photoCount.count !== photoIds.length) {
+      return res.status(400).json({ error: 'Some photos do not belong to this event' });
+    }
+    
+    // Update photos
+    const updateData = {};
+    if (updates.category_id !== undefined) {
+      updateData.category_id = updates.category_id || null;
+    }
+    
+    await db('photos')
+      .whereIn('id', photoIds)
+      .where('event_id', eventId)
+      .update(updateData);
+    
+    res.json({ message: `${photoIds.length} photos updated successfully` });
+  } catch (error) {
+    console.error('Error bulk updating photos:', error);
+    res.status(500).json({ error: 'Failed to update photos' });
+  }
+});
+
+// Download a photo
+router.get('/:eventId/photos/:photoId/download', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    const storagePath = getStoragePath();
+    const filePath = path.join(storagePath, 'events/active', photo.path);
+    
+    // Check if file exists
+    try {
+      await fs.access(filePath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Photo file not found' });
+    }
+    
+    // Send file
+    res.download(filePath, photo.filename);
+  } catch (error) {
+    console.error('Error downloading photo:', error);
+    res.status(500).json({ error: 'Failed to download photo' });
+  }
+});
+
+// Get all photos for an event
+router.get('/:eventId/photos', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { category_id, type, search, sort = 'date', order = 'desc' } = req.query;
+    
+    let query = db('photos')
+      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
+      .where({ 'photos.event_id': eventId })
+      .select(
+        'photos.*',
+        'photo_categories.name as category_name',
+        'photo_categories.slug as category_slug'
+      );
+    
+    // Filter by category (including uncategorized)
+    if (category_id !== undefined) {
+      if (category_id === '' || category_id === '0') {
+        query = query.whereNull('photos.category_id');
+      } else {
+        query = query.where({ 'photos.category_id': category_id });
+      }
+    }
+    
+    // Keep type filter for backwards compatibility
+    if (type) {
+      query = query.where({ 'photos.type': type });
+    }
+    
+    // Search by filename
+    if (search) {
+      const escapedSearch = escapeLikePattern(search);
+      query = query.where('photos.filename', 'like', `%${escapedSearch}%`);
+    }
+    
+    // Sorting
+    let orderByColumn = 'photos.uploaded_at';
+    if (sort === 'name') {
+      orderByColumn = 'photos.filename';
+    } else if (sort === 'size') {
+      orderByColumn = 'photos.size_bytes';
+    }
+    
+    const photos = await query.orderBy(orderByColumn, order);
+    
+    res.json({
+      photos: photos.map(photo => ({
+        id: photo.id,
+        filename: photo.filename,
+        url: `/admin/events/${eventId}/photo/${photo.id}`,
+        thumbnail_url: photo.thumbnail_path ? `/admin/events/${eventId}/thumbnail/${photo.id}` : null,
+        type: photo.type,
+        category_id: photo.category_id,
+        category_name: photo.category_name,
+        category_slug: photo.category_slug,
+        size: photo.size_bytes,
+        uploaded_at: photo.uploaded_at
+      }))
+    });
+  } catch (error) {
+    console.error('Error fetching photos:', error);
+    res.status(500).json({ error: 'Failed to fetch photos' });
+  }
+});
+
+// Serve photo with admin authentication
+router.get('/:eventId/photo/:photoId', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    const storagePath = getStoragePath();
+    const filePath = path.join(storagePath, 'events/active', photo.path);
+    
+    // Check if file exists
+    try {
+      await fs.access(filePath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Photo file not found' });
+    }
+    
+    // Set appropriate headers
+    res.setHeader('Content-Type', `image/${path.extname(photo.filename).slice(1)}`);
+    res.setHeader('Cache-Control', 'private, max-age=3600');
+    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+    
+    // Send file (sendFile requires absolute path)
+    res.sendFile(path.resolve(filePath));
+  } catch (error) {
+    console.error('Error serving photo:', error);
+    res.status(500).json({ error: 'Failed to serve photo' });
+  }
+});
+
+// Serve thumbnail with admin authentication
+router.get('/:eventId/thumbnail/:photoId', adminAuth, async (req, res) => {
+  try {
+    const { eventId, photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: eventId })
+      .first();
+    
+    if (!photo) {
+      console.error(`Photo not found: ${photoId}, event ${eventId}`);
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Ensure thumbnail exists and is valid, regenerate if needed
+    const thumbnailPath = await ensureThumbnail(photo);
+    
+    if (!thumbnailPath) {
+      console.error(`Failed to generate thumbnail for photo ${photoId}`);
+      return res.status(404).json({ error: 'Thumbnail generation failed' });
+    }
+    
+    const storagePath = getStoragePath();
+    const filePath = path.join(storagePath, thumbnailPath);
+    
+    // Set appropriate headers
+    res.setHeader('Content-Type', 'image/jpeg'); // Thumbnails are always JPEG
+    res.setHeader('Cache-Control', 'private, max-age=3600');
+    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+    
+    // Send file (sendFile requires absolute path)
+    res.sendFile(path.resolve(filePath));
+  } catch (error) {
+    console.error('Error serving thumbnail:', error);
+    console.error('Photo ID:', req.params.photoId);
+    console.error('Event ID:', req.params.eventId);
+    res.status(500).json({ error: 'Failed to serve thumbnail' });
+  }
+});
+
+// Debug endpoint to check photo existence
+router.get('/:eventId/debug', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    
+    const event = await db('events').where({ id: eventId }).first();
+    const photoCount = await db('photos').where({ event_id: eventId }).count('id as count').first();
+    const photos = await db('photos').where({ event_id: eventId }).limit(5);
+    
+    res.json({
+      event: event || 'Not found',
+      photoCount: photoCount.count,
+      samplePhotos: photos,
+      storagePath: getStoragePath()
+    });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminSettings.js

@@ -0,0 +1,650 @@
+const express = require('express');
+const multer = require('multer');
+const path = require('path');
+const fs = require('fs').promises;
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { adminAuth } = require('../middleware/auth');
+const { clearMaintenanceCache } = require('../middleware/maintenance');
+const { clearSettingsCache } = require('../services/rateLimitService');
+const router = express.Router();
+
+// Configure multer for logo uploads
+const storage = multer.diskStorage({
+  destination: async (req, file, cb) => {
+    const uploadDir = path.join(__dirname, '../../storage/uploads/logos');
+    await fs.mkdir(uploadDir, { recursive: true });
+    cb(null, uploadDir);
+  },
+  filename: (req, file, cb) => {
+    const ext = path.extname(file.originalname);
+    cb(null, `logo-${Date.now()}${ext}`);
+  }
+});
+
+const { validateFileType } = require('../utils/fileSecurityUtils');
+
+const upload = multer({
+  storage,
+  limits: { fileSize: 5 * 1024 * 1024 }, // 5MB
+  fileFilter: (req, file, cb) => {
+    // Note: SVG files are excluded from magic number validation for logos
+    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/svg+xml'];
+    
+    if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
+      return cb(null, true);
+    } else {
+      cb(new Error('Only JPEG, PNG, GIF and SVG image files are allowed'));
+    }
+  }
+});
+
+// Configure multer for favicon uploads
+const faviconStorage = multer.diskStorage({
+  destination: async (req, file, cb) => {
+    const uploadDir = path.join(__dirname, '../../storage/uploads/favicons');
+    await fs.mkdir(uploadDir, { recursive: true });
+    cb(null, uploadDir);
+  },
+  filename: (req, file, cb) => {
+    const ext = path.extname(file.originalname);
+    cb(null, `favicon-${Date.now()}${ext}`);
+  }
+});
+
+const faviconUpload = multer({
+  storage: faviconStorage,
+  limits: { fileSize: 1 * 1024 * 1024 }, // 1MB
+  fileFilter: (req, file, cb) => {
+    const allowedMimeTypes = ['image/png', 'image/x-icon', 'image/vnd.microsoft.icon'];
+    
+    // For ICO files, we can't use the standard validateFileType
+    if (file.mimetype === 'image/png') {
+      if (validateFileType(file.originalname, file.mimetype, ['image/png'])) {
+        cb(null, true);
+      } else {
+        cb(new Error('Invalid PNG file'));
+      }
+    } else if (allowedMimeTypes.includes(file.mimetype) && 
+               (file.originalname.toLowerCase().endsWith('.ico') || 
+                file.originalname.toLowerCase().endsWith('.png'))) {
+      cb(null, true);
+    } else {
+      cb(new Error('Favicon must be PNG or ICO format'));
+    }
+  }
+});
+
+// Get all settings
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const settings = await db('app_settings').select('*');
+    
+    // Convert to object format
+    const settingsObject = {};
+    settings.forEach(setting => {
+      if (setting.setting_value) {
+        try {
+          // Try to parse as JSON first
+          settingsObject[setting.setting_key] = JSON.parse(setting.setting_value);
+        } catch (e) {
+          // If it's not valid JSON, use the raw value
+          settingsObject[setting.setting_key] = setting.setting_value;
+        }
+      } else {
+        settingsObject[setting.setting_key] = null;
+      }
+    });
+
+    res.json(settingsObject);
+  } catch (error) {
+    console.error('Settings fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch settings' });
+  }
+});
+
+// Get settings by type
+router.get('/:type', adminAuth, async (req, res) => {
+  try {
+    const { type } = req.params;
+    const settings = await db('app_settings')
+      .where('setting_type', type)
+      .select('*');
+    
+    // Convert to object format
+    const settingsObject = {};
+    settings.forEach(setting => {
+      if (setting.setting_value) {
+        try {
+          // Try to parse as JSON first
+          settingsObject[setting.setting_key] = JSON.parse(setting.setting_value);
+        } catch (e) {
+          // If it's not valid JSON, use the raw value
+          settingsObject[setting.setting_key] = setting.setting_value;
+        }
+      } else {
+        settingsObject[setting.setting_key] = null;
+      }
+    });
+
+    res.json(settingsObject);
+  } catch (error) {
+    console.error('Settings fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch settings' });
+  }
+});
+
+// Update branding settings
+router.put('/branding', adminAuth, async (req, res) => {
+  try {
+    const {
+      company_name,
+      company_tagline,
+      support_email,
+      footer_text,
+      watermark_enabled,
+      watermark_position,
+      watermark_opacity,
+      watermark_size,
+      favicon_url,
+      logo_url,
+      watermark_logo_url
+    } = req.body;
+
+    const brandingSettings = {
+      company_name,
+      company_tagline,
+      support_email,
+      footer_text,
+      watermark_enabled,
+      watermark_position,
+      watermark_opacity,
+      watermark_size,
+      favicon_url,
+      logo_url,
+      watermark_logo_url
+    };
+
+    // Handle favicon deletion if empty string or null is provided
+    if (favicon_url === '' || favicon_url === null || favicon_url === undefined) {
+      // Get current favicon path to delete file
+      const currentFaviconSetting = await db('app_settings')
+        .where('setting_key', 'branding_favicon_url')
+        .first();
+      
+      if (currentFaviconSetting && currentFaviconSetting.setting_value) {
+        let currentFaviconUrl;
+        try {
+          // Try to parse as JSON first
+          currentFaviconUrl = JSON.parse(currentFaviconSetting.setting_value);
+        } catch (e) {
+          // If it's not valid JSON, use the raw value
+          currentFaviconUrl = currentFaviconSetting.setting_value;
+        }
+        
+        if (currentFaviconUrl && typeof currentFaviconUrl === 'string' && currentFaviconUrl.startsWith('/uploads/favicons/')) {
+          // Delete the file from filesystem
+          const faviconPath = path.join(__dirname, '..', '..', 'storage', currentFaviconUrl.replace('/uploads/', ''));
+          try {
+            await fs.unlink(faviconPath);
+            console.log('Deleted favicon file:', faviconPath);
+          } catch (err) {
+            console.error('Error deleting favicon file:', err);
+          }
+        }
+      }
+    }
+
+    // Handle logo deletion if empty string or null is provided
+    if (logo_url === '' || logo_url === null || logo_url === undefined) {
+      // Get current logo path to delete file
+      const currentLogoSetting = await db('app_settings')
+        .where('setting_key', 'branding_logo_url')
+        .first();
+      
+      if (currentLogoSetting && currentLogoSetting.setting_value) {
+        let currentLogoUrl;
+        try {
+          // Try to parse as JSON first
+          currentLogoUrl = JSON.parse(currentLogoSetting.setting_value);
+        } catch (e) {
+          // If it's not valid JSON, use the raw value
+          currentLogoUrl = currentLogoSetting.setting_value;
+        }
+        
+        if (currentLogoUrl && typeof currentLogoUrl === 'string' && currentLogoUrl.startsWith('/uploads/logos/')) {
+          // Delete the file from filesystem
+          const logoPath = path.join(__dirname, '..', '..', 'storage', currentLogoUrl.replace('/uploads/', ''));
+          try {
+            await fs.unlink(logoPath);
+            console.log('Deleted logo file:', logoPath);
+          } catch (err) {
+            console.error('Error deleting logo file:', err);
+          }
+        }
+      }
+    }
+
+    // Update or insert each setting
+    for (const [key, value] of Object.entries(brandingSettings)) {
+      await db('app_settings')
+        .insert({
+          setting_key: `branding_${key}`,
+          setting_value: JSON.stringify(value),
+          setting_type: 'branding',
+          updated_at: new Date()
+        })
+        .onConflict('setting_key')
+        .merge({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'branding_updated',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ company_name })
+    });
+
+    res.json({ message: 'Branding settings updated successfully' });
+  } catch (error) {
+    console.error('Branding update error:', error);
+    res.status(500).json({ error: 'Failed to update branding settings' });
+  }
+});
+
+// Upload logo
+router.post('/logo', adminAuth, upload.single('logo'), async (req, res) => {
+  try {
+    if (!req.file) {
+      return res.status(400).json({ error: 'No logo file uploaded' });
+    }
+
+    // Get old logo to delete
+    const oldLogoSetting = await db('app_settings')
+      .where('setting_key', 'branding_logo_path')
+      .first();
+
+    if (oldLogoSetting && oldLogoSetting.setting_value) {
+      const oldPath = JSON.parse(oldLogoSetting.setting_value);
+      try {
+        await fs.unlink(oldPath);
+      } catch (error) {
+        console.error('Failed to delete old logo:', error);
+      }
+    }
+
+    // Save new logo path
+    const logoPath = req.file.path;
+    const publicPath = `/uploads/logos/${req.file.filename}`;
+
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_logo_path',
+        setting_value: JSON.stringify(logoPath),
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: JSON.stringify(logoPath),
+        updated_at: new Date()
+      });
+
+    // Save public URL
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_logo_url',
+        setting_value: publicPath,
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: publicPath,
+        updated_at: new Date()
+      });
+
+    res.json({ 
+      message: 'Logo uploaded successfully',
+      logoUrl: publicPath
+    });
+  } catch (error) {
+    console.error('Logo upload error:', error);
+    res.status(500).json({ error: 'Failed to upload logo' });
+  }
+});
+
+// Upload watermark logo
+router.post('/branding/watermark-logo', adminAuth, upload.single('watermarkLogo'), async (req, res) => {
+  try {
+    if (!req.file) {
+      return res.status(400).json({ error: 'No file uploaded' });
+    }
+
+    // Delete old watermark logo if exists
+    const oldWatermarkLogoSetting = await db('app_settings')
+      .where('setting_key', 'branding_watermark_logo_path')
+      .first();
+
+    if (oldWatermarkLogoSetting && oldWatermarkLogoSetting.setting_value) {
+      const oldPath = JSON.parse(oldWatermarkLogoSetting.setting_value);
+      try {
+        await fs.unlink(oldPath);
+      } catch (error) {
+        console.error('Failed to delete old watermark logo:', error);
+      }
+    }
+
+    // Save new watermark logo path
+    const logoPath = req.file.path;
+    const publicPath = `/uploads/logos/${req.file.filename}`;
+
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_watermark_logo_path',
+        setting_value: JSON.stringify(logoPath),
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: JSON.stringify(logoPath),
+        updated_at: new Date()
+      });
+
+    // Save public URL
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_watermark_logo_url',
+        setting_value: publicPath,
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: publicPath,
+        updated_at: new Date()
+      });
+
+    res.json({ 
+      message: 'Watermark logo uploaded successfully',
+      watermarkLogoUrl: publicPath
+    });
+  } catch (error) {
+    console.error('Watermark logo upload error:', error);
+    res.status(500).json({ error: 'Failed to upload watermark logo' });
+  }
+});
+
+// Update theme settings
+router.put('/theme', adminAuth, async (req, res) => {
+  try {
+    const themeSettings = req.body;
+
+    // Save theme settings
+    await db('app_settings')
+      .insert({
+        setting_key: 'theme_config',
+        setting_value: JSON.stringify(themeSettings),
+        setting_type: 'theme',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: JSON.stringify(themeSettings),
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'theme_updated',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ theme_name: themeSettings.name || 'custom' })
+    });
+
+    res.json({ message: 'Theme settings updated successfully' });
+  } catch (error) {
+    console.error('Theme update error:', error);
+    res.status(500).json({ error: 'Failed to update theme settings' });
+  }
+});
+
+// Update general settings
+router.put('/general', adminAuth, async (req, res) => {
+  try {
+    const settings = req.body;
+
+    // Update or insert each setting
+    for (const [key, value] of Object.entries(settings)) {
+      await db('app_settings')
+        .insert({
+          setting_key: key,
+          setting_value: JSON.stringify(value),
+          setting_type: 'general',
+          updated_at: new Date()
+        })
+        .onConflict('setting_key')
+        .merge({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+    
+    // Clear maintenance mode cache if it was updated
+    if ('general_maintenance_mode' in settings) {
+      clearMaintenanceCache();
+    }
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'general_settings_updated',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ settings_count: Object.keys(settings).length })
+    });
+
+    res.json({ message: 'General settings updated successfully' });
+  } catch (error) {
+    console.error('General settings update error:', error);
+    res.status(500).json({ error: 'Failed to update general settings' });
+  }
+});
+
+// Update security settings
+router.put('/security', adminAuth, async (req, res) => {
+  try {
+    const settings = req.body;
+
+    // Update or insert each setting
+    for (const [key, value] of Object.entries(settings)) {
+      await db('app_settings')
+        .insert({
+          setting_key: key,
+          setting_value: JSON.stringify(value),
+          setting_type: 'security',
+          updated_at: new Date()
+        })
+        .onConflict('setting_key')
+        .merge({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+
+    // Log activity
+    await db('activity_logs').insert({
+      activity_type: 'security_settings_updated',
+      actor_type: 'admin',
+      actor_id: req.admin.id,
+      actor_name: req.admin.username,
+      metadata: JSON.stringify({ settings_count: Object.keys(settings).length })
+    });
+
+    res.json({ message: 'Security settings updated successfully' });
+  } catch (error) {
+    console.error('Security settings update error:', error);
+    res.status(500).json({ error: 'Failed to update security settings' });
+  }
+});
+
+// Get storage info
+router.get('/storage/info', adminAuth, async (req, res) => {
+  try {
+    // Get total storage used
+    const totalStorage = await db('photos')
+      .sum('size_bytes as total')
+      .first();
+
+    // Get storage by event
+    const storageByEvent = await db('photos')
+      .select('events.event_name', 'events.id')
+      .sum('photos.size_bytes as size')
+      .join('events', 'photos.event_id', 'events.id')
+      .groupBy('events.id')
+      .orderBy('size', 'desc')
+      .limit(10);
+
+    // Get archive storage
+    const archives = await db('events')
+      .where('is_archived', formatBoolean(true))
+      .whereNotNull('archive_path')
+      .select('archive_path');
+
+    let archiveStorage = 0;
+    for (const archive of archives) {
+      if (archive.archive_path) {
+        try {
+          const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+          const fullArchivePath = path.join(storagePath, archive.archive_path);
+          const stats = await fs.stat(fullArchivePath);
+          archiveStorage += stats.size;
+        } catch (error) {
+          console.error('Archive file not found:', archive.archive_path, error.message);
+        }
+      }
+    }
+
+    res.json({
+      total_used: totalStorage.total || 0,
+      archive_storage: archiveStorage,
+      storage_by_event: storageByEvent,
+      storage_limit: 10 * 1024 * 1024 * 1024 // 10GB default
+    });
+  } catch (error) {
+    console.error('Storage info error:', error);
+    res.status(500).json({ error: 'Failed to fetch storage information' });
+  }
+});
+
+// Upload favicon endpoint
+router.post('/favicon', adminAuth, faviconUpload.single('favicon'), async (req, res) => {
+  try {
+    if (!req.file) {
+      return res.status(400).json({ error: 'No favicon file provided' });
+    }
+
+    // The file is already in the correct location from multer
+    const faviconUrl = `/uploads/favicons/${req.file.filename}`;
+    
+    // Save to database
+    await db('app_settings')
+      .insert({
+        setting_key: 'branding_favicon_url',
+        setting_value: faviconUrl,
+        setting_type: 'branding',
+        updated_at: new Date()
+      })
+      .onConflict('setting_key')
+      .merge({
+        setting_value: faviconUrl,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity('favicon_uploaded', 
+      { faviconUrl }, 
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ faviconUrl });
+  } catch (error) {
+    console.error('Error uploading favicon:', error);
+    res.status(500).json({ error: 'Failed to upload favicon' });
+  }
+});
+
+// Update rate limit settings
+router.put('/security/rate-limit', adminAuth, [
+  body('rate_limit_enabled').isBoolean().withMessage('Enabled must be a boolean'),
+  body('rate_limit_window_minutes').isInt({ min: 1, max: 60 }).withMessage('Window must be between 1 and 60 minutes'),
+  body('rate_limit_max_requests').isInt({ min: 10, max: 10000 }).withMessage('Max requests must be between 10 and 10000'),
+  body('rate_limit_auth_max_requests').isInt({ min: 1, max: 100 }).withMessage('Auth max requests must be between 1 and 100'),
+  body('rate_limit_skip_authenticated').isBoolean().withMessage('Skip authenticated must be a boolean'),
+  body('rate_limit_public_endpoints_only').isBoolean().withMessage('Public endpoints only must be a boolean')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const {
+      rate_limit_enabled,
+      rate_limit_window_minutes,
+      rate_limit_max_requests,
+      rate_limit_auth_max_requests,
+      rate_limit_skip_authenticated,
+      rate_limit_public_endpoints_only
+    } = req.body;
+
+    // Update each setting
+    const settings = [
+      { key: 'rate_limit_enabled', value: rate_limit_enabled },
+      { key: 'rate_limit_window_minutes', value: rate_limit_window_minutes },
+      { key: 'rate_limit_max_requests', value: rate_limit_max_requests },
+      { key: 'rate_limit_auth_max_requests', value: rate_limit_auth_max_requests },
+      { key: 'rate_limit_skip_authenticated', value: rate_limit_skip_authenticated },
+      { key: 'rate_limit_public_endpoints_only', value: rate_limit_public_endpoints_only }
+    ];
+
+    for (const { key, value } of settings) {
+      await db('app_settings')
+        .where('setting_key', key)
+        .update({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+
+    // Clear the rate limit settings cache to apply changes immediately
+    clearSettingsCache();
+
+    // Log activity
+    await logActivity('settings_updated', 
+      { 
+        category: 'security',
+        subcategory: 'rate_limit',
+        changes: settings.length
+      },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({ message: 'Rate limit settings updated successfully' });
+  } catch (error) {
+    console.error('Rate limit settings update error:', error);
+    res.status(500).json({ error: 'Failed to update rate limit settings' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminSystem.js

@@ -0,0 +1,229 @@
+const express = require('express');
+const { db } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const fs = require('fs').promises;
+const path = require('path');
+const os = require('os');
+const { formatBoolean } = require('../utils/dbCompat');
+const router = express.Router();
+
+// Get system version
+router.get('/version', adminAuth, async (req, res) => {
+  try {
+    // Read backend version from package.json
+    let backendVersion = '1.0.0';
+    try {
+      const packagePath = path.join(__dirname, '../../package.json');
+      const packageContent = await fs.readFile(packagePath, 'utf8');
+      const packageJson = JSON.parse(packageContent);
+      backendVersion = packageJson.version || '1.0.0';
+    } catch (err) {
+      console.error('Could not read package.json:', err);
+    }
+    
+    res.json({
+      backend: backendVersion,
+      frontend: '1.0.0', // This will be set by frontend
+      node: process.version,
+      environment: process.env.NODE_ENV || 'production'
+    });
+  } catch (error) {
+    console.error('Error fetching version:', error);
+    res.status(500).json({ error: 'Failed to fetch version information' });
+  }
+});
+
+// Get comprehensive system status
+router.get('/status', adminAuth, async (req, res) => {
+  try {
+    // Database size - check if PostgreSQL or SQLite
+    let dbSize = 0;
+    const dbClient = process.env.DATABASE_CLIENT || 'sqlite3';
+    
+    if (dbClient === 'pg') {
+      // PostgreSQL - query database size
+      try {
+        const dbName = process.env.DB_NAME || 'picpeak';
+        const result = await db.raw(`
+          SELECT pg_database_size(?) as size
+        `, [dbName]);
+        dbSize = result.rows[0]?.size || 0;
+      } catch (error) {
+        console.error('Error getting PostgreSQL database size:', error);
+      }
+    } else {
+      // SQLite - check file size
+      const dbPath = path.join(__dirname, '../../data/photo_sharing.db');
+      try {
+        const stats = await fs.stat(dbPath);
+        dbSize = stats.size;
+      } catch (error) {
+        console.error('Error getting SQLite database size:', error);
+      }
+    }
+
+    // Count various entities
+    const [eventsCount] = await db('events').count('* as count');
+    const [photosCount] = await db('photos').count('* as count');
+    const [adminsCount] = await db('admin_users').count('* as count');
+    const [categoriesCount] = await db('photo_categories').count('* as count');
+    
+    // Email queue status
+    const [pendingEmails] = await db('email_queue').where('status', 'pending').count('* as count');
+    const [processableEmails] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .count('* as count');
+    const [sentEmails] = await db('email_queue').where('status', 'sent').count('* as count');
+    const [failedEmails] = await db('email_queue').where('status', 'failed').count('* as count');
+    const [stuckEmails] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '>=', 3)
+      .count('* as count');
+
+    // Activity logs count
+    const [activityCount] = await db('activity_logs').count('* as count');
+    
+    // Storage info
+    const [{ totalPhotoStorage }] = await db('photos')
+      .sum('size_bytes as totalPhotoStorage');
+
+    const archives = await db('events')
+      .where('is_archived', formatBoolean(true))
+      .whereNotNull('archive_path')
+      .select('archive_path');
+
+    let archiveStorage = 0;
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    
+    for (const archive of archives) {
+      if (archive.archive_path) {
+        try {
+          const fullArchivePath = path.join(storagePath, archive.archive_path);
+          const stats = await fs.stat(fullArchivePath);
+          archiveStorage += stats.size;
+        } catch (error) {
+          console.error('Archive file not found:', archive.archive_path);
+        }
+      }
+    }
+
+    const totalStorage = (parseInt(totalPhotoStorage) || 0) + archiveStorage;
+    
+    // System info
+    const systemInfo = {
+      platform: os.platform(),
+      arch: os.arch(),
+      hostname: os.hostname(),
+      uptime: Math.floor(process.uptime()),
+      nodeVersion: process.version,
+      memory: {
+        total: os.totalmem(),
+        free: os.freemem(),
+        used: os.totalmem() - os.freemem()
+      },
+      cpu: {
+        model: os.cpus()[0]?.model || 'Unknown',
+        cores: os.cpus().length
+      }
+    };
+
+    // Build response
+    const status = {
+      database: {
+        size: dbSize,
+        tables: {
+          events: eventsCount.count,
+          photos: photosCount.count,
+          admins: adminsCount.count,
+          categories: categoriesCount.count,
+          activityLogs: activityCount.count
+        }
+      },
+      storage: {
+        totalUsed: totalStorage,
+        photoStorage: parseInt(totalPhotoStorage) || 0,
+        archiveStorage: archiveStorage
+      },
+      emailQueue: {
+        pending: pendingEmails.count,
+        processable: processableEmails.count,
+        stuck: stuckEmails.count,
+        sent: sentEmails.count,
+        failed: failedEmails.count
+      },
+      system: systemInfo,
+      services: {
+        fileWatcher: { status: 'active' }, // These would ideally check actual service status
+        expirationChecker: { status: 'active' },
+        emailProcessor: { status: 'active' }
+      },
+      timestamp: new Date()
+    };
+
+    res.json(status);
+  } catch (error) {
+    console.error('Error fetching system status:', error);
+    res.status(500).json({ error: 'Failed to fetch system status' });
+  }
+});
+
+// Get database statistics
+router.get('/database', adminAuth, async (req, res) => {
+  try {
+    // Get table info
+    const tables = [
+      'events', 'photos', 'admin_users', 'photo_categories', 
+      'cms_pages', 'email_templates', 'email_queue', 'activity_logs',
+      'app_settings', 'email_configs', 'access_logs', 'migrations'
+    ];
+    
+    const tableInfo = [];
+    
+    for (const table of tables) {
+      try {
+        const [count] = await db(table).count('* as count');
+        
+        // Get last update time
+        let lastUpdate = null;
+        try {
+          const lastRow = await db(table)
+            .orderBy('updated_at', 'desc')
+            .orOrderBy('created_at', 'desc')
+            .orOrderBy('timestamp', 'desc')
+            .orOrderBy('applied_at', 'desc')
+            .first();
+          
+          if (lastRow) {
+            lastUpdate = lastRow.updated_at || lastRow.created_at || lastRow.timestamp || lastRow.applied_at;
+          }
+        } catch (e) {
+          // Table might not have timestamp columns
+        }
+        
+        tableInfo.push({
+          name: table,
+          rows: count.count,
+          lastUpdate
+        });
+      } catch (error) {
+        // Table might not exist
+        tableInfo.push({
+          name: table,
+          rows: 0,
+          error: error.message
+        });
+      }
+    }
+    
+    res.json({
+      tables: tableInfo,
+      timestamp: new Date()
+    });
+  } catch (error) {
+    console.error('Error fetching database info:', error);
+    res.status(500).json({ error: 'Failed to fetch database information' });
+  }
+});
+
+module.exports = router;

backend/src/routes/auth-enhanced-v2.js

@@ -0,0 +1,375 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { body, validationResult } = require('express-validator');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { verifyRecaptcha } = require('../services/recaptcha');
+const { 
+  trackFailedAttempt,
+  trackSuccessfulLogin,
+  checkAccountLockout,
+  checkSuspiciousActivity,
+  getGenericAuthError
+} = require('../utils/authSecurity');
+const { 
+  validatePasswordInContext,
+  getBcryptRounds,
+  logPasswordValidationFailure
+} = require('../utils/passwordValidation');
+const { endSession } = require('../middleware/sessionTimeout');
+const logger = require('../utils/logger');
+const router = express.Router();
+
+// Admin login with enhanced security
+router.post('/admin/login', [
+  body('username').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { username, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check account lockout first
+    const lockoutStatus = await checkAccountLockout(username);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Login attempt on locked account', { username, ipAddress });
+      return res.status(423).json({ 
+        error: 'Account temporarily locked due to too many failed attempts',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    // Check for suspicious activity
+    const isSuspicious = await checkSuspiciousActivity(username, ipAddress);
+    if (isSuspicious) {
+      // Still allow login but log it
+      logger.warn('Suspicious login pattern detected', { username, ipAddress });
+    }
+    
+    const admin = await db('admin_users')
+      .where({ username })
+      .orWhere({ email: username })
+      .first();
+    
+    // Use generic error to prevent user enumeration
+    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    if (!admin.is_active) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    // Successful login
+    await trackSuccessfulLogin(username, ipAddress, userAgent);
+    
+    // Update last login and login metadata
+    await db('admin_users').where('id', admin.id).update({ 
+      last_login: new Date(),
+      last_login_ip: ipAddress
+    });
+    
+    // Generate token with additional claims
+    const token = jwt.sign({ 
+      id: admin.id,
+      username: admin.username,
+      type: 'admin',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      user: {
+        id: admin.id,
+        username: admin.username,
+        email: admin.email,
+        mustChangePassword: admin.must_change_password || false
+      }
+    });
+  } catch (error) {
+    logger.error('Login error:', error);
+    res.status(500).json({ error: 'Login failed' });
+  }
+});
+
+// Admin password change with validation
+router.post('/admin/change-password', [
+  body('currentPassword').notEmpty(),
+  body('newPassword').notEmpty(),
+  body('confirmPassword').notEmpty()
+    .custom((value, { req }) => value === req.body.newPassword)
+    .withMessage('Passwords do not match')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { currentPassword, newPassword } = req.body;
+    const adminId = req.admin.id; // From auth middleware
+    
+    // Get admin user
+    const admin = await db('admin_users').where({ id: adminId }).first();
+    if (!admin) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    
+    // Verify current password
+    const validPassword = await bcrypt.compare(currentPassword, admin.password_hash);
+    if (!validPassword) {
+      return res.status(401).json({ error: 'Current password is incorrect' });
+    }
+    
+    // Validate new password
+    const passwordValidation = validatePasswordInContext(newPassword, 'admin', {
+      username: admin.username,
+      email: admin.email
+    });
+    
+    if (!passwordValidation.valid) {
+      logPasswordValidationFailure('admin_password_change', passwordValidation.errors, {
+        userId: adminId,
+        username: admin.username
+      });
+      
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.errors,
+        score: passwordValidation.score,
+        feedback: passwordValidation.feedback
+      });
+    }
+    
+    // Hash new password with configurable rounds
+    const hashedPassword = await bcrypt.hash(newPassword, getBcryptRounds());
+    
+    // Update password and track change time
+    await db('admin_users').where('id', adminId).update({
+      password_hash: hashedPassword,
+      password_changed_at: new Date(),
+      must_change_password: false
+    });
+    
+    // Log password change
+    logger.info('Admin password changed', {
+      userId: adminId,
+      username: admin.username,
+      ip: req.ip
+    });
+    
+    res.json({ 
+      message: 'Password changed successfully',
+      score: passwordValidation.score
+    });
+  } catch (error) {
+    logger.error('Password change error:', error);
+    res.status(500).json({ error: 'Failed to change password' });
+  }
+});
+
+// Logout endpoint
+router.post('/logout', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (token) {
+      // End the session
+      endSession(token);
+      
+      // Log the logout
+      try {
+        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+        logger.info('User logged out', { 
+          userId: decoded.id,
+          username: decoded.username,
+          type: decoded.type
+        });
+      } catch (err) {
+        // Token might be invalid, but still process logout
+      }
+    }
+    
+    res.json({ message: 'Logged out successfully' });
+  } catch (error) {
+    logger.error('Logout error:', error);
+    res.status(500).json({ error: 'Logout failed' });
+  }
+});
+
+// Gallery password verification with enhanced security
+router.post('/gallery/verify', [
+  body('slug').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { slug, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check gallery-specific lockout
+    const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
+      return res.status(423).json({ 
+        error: 'Too many failed attempts. Please try again later.',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
+    if (!event) {
+      // Don't reveal if gallery exists
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    const validPassword = await bcrypt.compare(password, event.password_hash);
+    if (!validPassword) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      await db('access_logs').insert({
+        event_id: event.id,
+        ip_address: ipAddress,
+        user_agent: userAgent,
+        action: 'login_fail'
+      });
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    // Successful access
+    await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
+    
+    // Log successful access
+    await db('access_logs').insert({
+      event_id: event.id,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      action: 'login_success'
+    });
+    
+    // Generate session token with additional security info
+    const token = jwt.sign({ 
+      eventId: event.id, 
+      eventSlug: event.slug,
+      type: 'gallery',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      event: {
+        id: event.id,
+        event_name: event.event_name,
+        event_type: event.event_type,
+        event_date: event.event_date,
+        welcome_message: event.welcome_message,
+        color_theme: event.color_theme,
+        expires_at: event.expires_at,
+        allow_user_uploads: event.allow_user_uploads,
+        upload_category_id: event.upload_category_id
+      }
+    });
+  } catch (error) {
+    logger.error('Gallery verification error:', error);
+    res.status(500).json({ error: 'Verification failed' });
+  }
+});
+
+// Get current session info
+router.get('/session', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    try {
+      const decoded = jwt.verify(token, process.env.JWT_SECRET);
+      
+      // Calculate remaining time
+      const now = Date.now() / 1000;
+      const remainingTime = Math.max(0, decoded.exp - now);
+      
+      res.json({
+        valid: true,
+        type: decoded.type,
+        expiresIn: Math.floor(remainingTime),
+        user: decoded.username || decoded.eventSlug
+      });
+    } catch (err) {
+      res.json({
+        valid: false,
+        error: 'Invalid or expired token'
+      });
+    }
+  } catch (error) {
+    res.status(500).json({ error: 'Session check failed' });
+  }
+});
+
+// Password strength check endpoint (for real-time validation)
+router.post('/password-strength', [
+  body('password').notEmpty(),
+  body('context').isIn(['admin', 'gallery']).optional()
+], async (req, res) => {
+  try {
+    const { password, context = 'gallery' } = req.body;
+    
+    // Get user data if available (for context-aware validation)
+    const userData = {};
+    if (context === 'admin' && req.admin) {
+      userData.username = req.admin.username;
+      userData.email = req.admin.email;
+    }
+    
+    const validation = validatePasswordInContext(password, context, userData);
+    
+    res.json({
+      valid: validation.valid,
+      score: validation.score,
+      errors: validation.errors,
+      feedback: validation.feedback
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to check password strength' });
+  }
+});
+
+module.exports = router;

backend/src/routes/auth-enhanced.js

@@ -0,0 +1,266 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { body, validationResult } = require('express-validator');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { verifyRecaptcha } = require('../services/recaptcha');
+const { 
+  trackFailedAttempt,
+  trackSuccessfulLogin,
+  checkAccountLockout,
+  checkSuspiciousActivity,
+  getGenericAuthError
+} = require('../utils/authSecurity');
+const { endSession } = require('../middleware/sessionTimeout');
+const logger = require('../utils/logger');
+const router = express.Router();
+
+// Admin login with enhanced security
+router.post('/admin/login', [
+  body('username').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { username, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check account lockout first
+    const lockoutStatus = await checkAccountLockout(username);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Login attempt on locked account', { username, ipAddress });
+      return res.status(423).json({ 
+        error: 'Account temporarily locked due to too many failed attempts',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    // Check for suspicious activity
+    const isSuspicious = await checkSuspiciousActivity(username, ipAddress);
+    if (isSuspicious) {
+      // Still allow login but log it
+      logger.warn('Suspicious login pattern detected', { username, ipAddress });
+    }
+    
+    const admin = await db('admin_users')
+      .where({ username })
+      .orWhere({ email: username })
+      .first();
+    
+    // Use generic error to prevent user enumeration
+    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    if (!admin.is_active) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    // Successful login
+    await trackSuccessfulLogin(username, ipAddress, userAgent);
+    
+    // Update last login and login metadata
+    await db('admin_users').where('id', admin.id).update({ 
+      last_login: new Date(),
+      last_login_ip: ipAddress
+    });
+    
+    // Generate token with additional claims
+    const token = jwt.sign({ 
+      id: admin.id,
+      username: admin.username,
+      type: 'admin',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      user: {
+        id: admin.id,
+        username: admin.username,
+        email: admin.email,
+        mustChangePassword: admin.must_change_password || false
+      }
+    });
+  } catch (error) {
+    logger.error('Login error:', error);
+    res.status(500).json({ error: 'Login failed' });
+  }
+});
+
+// Logout endpoint
+router.post('/logout', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (token) {
+      // End the session
+      endSession(token);
+      
+      // Log the logout
+      try {
+        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+        logger.info('User logged out', { 
+          userId: decoded.id,
+          username: decoded.username,
+          type: decoded.type
+        });
+      } catch (err) {
+        // Token might be invalid, but still process logout
+      }
+    }
+    
+    res.json({ message: 'Logged out successfully' });
+  } catch (error) {
+    logger.error('Logout error:', error);
+    res.status(500).json({ error: 'Logout failed' });
+  }
+});
+
+// Gallery password verification with enhanced security
+router.post('/gallery/verify', [
+  body('slug').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { slug, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check gallery-specific lockout
+    const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
+      return res.status(423).json({ 
+        error: 'Too many failed attempts. Please try again later.',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
+    if (!event) {
+      // Don't reveal if gallery exists
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    const validPassword = await bcrypt.compare(password, event.password_hash);
+    if (!validPassword) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      await db('access_logs').insert({
+        event_id: event.id,
+        ip_address: ipAddress,
+        user_agent: userAgent,
+        action: 'login_fail'
+      });
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    // Successful access
+    await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
+    
+    // Log successful access
+    await db('access_logs').insert({
+      event_id: event.id,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      action: 'login_success'
+    });
+    
+    // Generate session token with additional security info
+    const token = jwt.sign({ 
+      eventId: event.id, 
+      eventSlug: event.slug,
+      type: 'gallery',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      event: {
+        id: event.id,
+        event_name: event.event_name,
+        event_type: event.event_type,
+        event_date: event.event_date,
+        welcome_message: event.welcome_message,
+        color_theme: event.color_theme,
+        expires_at: event.expires_at,
+        allow_user_uploads: event.allow_user_uploads,
+        upload_category_id: event.upload_category_id
+      }
+    });
+  } catch (error) {
+    logger.error('Gallery verification error:', error);
+    res.status(500).json({ error: 'Verification failed' });
+  }
+});
+
+// Get current session info
+router.get('/session', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    try {
+      const decoded = jwt.verify(token, process.env.JWT_SECRET);
+      
+      // Calculate remaining time
+      const now = Date.now() / 1000;
+      const remainingTime = Math.max(0, decoded.exp - now);
+      
+      res.json({
+        valid: true,
+        type: decoded.type,
+        expiresIn: Math.floor(remainingTime),
+        user: decoded.username || decoded.eventSlug
+      });
+    } catch (err) {
+      res.json({
+        valid: false,
+        error: 'Invalid or expired token'
+      });
+    }
+  } catch (error) {
+    res.status(500).json({ error: 'Session check failed' });
+  }
+});
+
+module.exports = router;

backend/src/routes/auth.js

@@ -0,0 +1,131 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { body, validationResult } = require('express-validator');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { verifyRecaptcha } = require('../services/recaptcha');
+const router = express.Router();
+
+// Admin login
+router.post('/admin/login', [
+  body('username').notEmpty(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { username, password, recaptchaToken } = req.body;
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    const admin = await db('admin_users')
+      .where({ username })
+      .orWhere({ email: username })
+      .first();
+    
+    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
+      return res.status(401).json({ error: 'Invalid credentials' });
+    }
+    
+    if (!admin.is_active) {
+      return res.status(401).json({ error: 'Account disabled' });
+    }
+    
+    // Update last login
+    await db('admin_users').where('id', admin.id).update({ last_login: new Date() });
+    
+    const token = jwt.sign({ id: admin.id, type: 'admin' }, process.env.JWT_SECRET, { expiresIn: '24h' });
+    
+    res.json({
+      token,
+      user: {
+        id: admin.id,
+        username: admin.username,
+        email: admin.email,
+        mustChangePassword: admin.must_change_password || false
+      }
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Login failed' });
+  }
+});
+
+// Gallery password verification
+router.post('/gallery/verify', [
+  body('slug').notEmpty(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { slug, password, recaptchaToken } = req.body;
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    const validPassword = await bcrypt.compare(password, event.password_hash);
+    if (!validPassword) {
+      await db('access_logs').insert({
+        event_id: event.id,
+        ip_address: req.ip,
+        user_agent: req.headers['user-agent'],
+        action: 'login_fail'
+      });
+      return res.status(401).json({ error: 'Invalid password' });
+    }
+    
+    // Log successful access
+    await db('access_logs').insert({
+      event_id: event.id,
+      ip_address: req.ip,
+      user_agent: req.headers['user-agent'],
+      action: 'login_success'
+    });
+    
+    // Generate session token
+    const token = jwt.sign({ 
+      eventId: event.id, 
+      eventSlug: event.slug,
+      type: 'gallery' 
+    }, process.env.JWT_SECRET, { expiresIn: '24h' });
+    
+    res.json({
+      token,
+      event: {
+        id: event.id,
+        event_name: event.event_name,
+        event_type: event.event_type,
+        event_date: event.event_date,
+        welcome_message: event.welcome_message,
+        color_theme: event.color_theme,
+        expires_at: event.expires_at,
+        allow_user_uploads: event.allow_user_uploads,
+        upload_category_id: event.upload_category_id,
+        hero_photo_id: event.hero_photo_id
+      }
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Verification failed' });
+  }
+});
+
+module.exports = router;

backend/src/routes/events.js

@@ -0,0 +1,201 @@
+const express = require('express');
+const { body, validationResult } = require('express-validator');
+const bcrypt = require('bcrypt');
+const crypto = require('crypto');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const fs = require('fs').promises;
+const path = require('path');
+const router = express.Router();
+
+// Create new event
+router.post('/', adminAuth, [
+  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
+  body('event_name').notEmpty(),
+  body('event_date').isDate(),
+  body('host_email').isEmail(),
+  body('admin_email').isEmail(),
+  body('password').isLength({ min: 6 }),
+  body('expiration_days').isInt({ min: 1, max: 365 }).optional()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const {
+      event_type,
+      event_name,
+      event_date,
+      host_email,
+      admin_email,
+      password,
+      welcome_message,
+      color_theme,
+      expiration_days = 30
+    } = req.body;
+    
+    // Generate unique slug
+    const baseSlug = `${event_type}-${event_name.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${event_date}`;
+    let slug = baseSlug;
+    let counter = 1;
+    
+    while (await db('events').where({ slug }).first()) {
+      slug = `${baseSlug}-${counter}`;
+      counter++;
+    }
+    
+    // Generate share link
+    const shareToken = crypto.randomBytes(16).toString('hex');
+    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    
+    // Hash password
+    const password_hash = await bcrypt.hash(password, 10);
+    
+    // Calculate expiration date (days after event date)
+    const expires_at = new Date(event_date);
+    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
+    
+    // Create folder structure
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const eventPath = path.join(storagePath, 'events/active', slug);
+    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
+    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
+    
+    // Insert into database
+    const insertResult = await db('events').insert({
+      slug,
+      event_type,
+      event_name,
+      event_date,
+      host_email,
+      admin_email,
+      password_hash,
+      welcome_message,
+      color_theme,
+      share_link: shareLink,
+      expires_at
+    }).returning('id');
+    
+    // Handle both PostgreSQL (returns array of objects) and SQLite (returns array of IDs)
+    const eventId = insertResult[0]?.id || insertResult[0];
+    
+    // Queue creation email
+    const { queueEmail } = require('../services/emailProcessor');
+    await queueEmail(eventId, host_email, 'gallery_created', {
+      host_name: host_email.split('@')[0], // Extract name from email
+      event_name,
+      event_date: event_date,  // Pass raw date - will be formatted by email processor
+      gallery_link: shareLink,
+      gallery_password: password,
+      expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
+      welcome_message: welcome_message || ''
+    });
+    
+    res.json({
+      id: eventId,
+      slug,
+      share_link: shareLink,
+      expires_at
+    });
+  } catch (error) {
+    console.error(error);
+    res.status(500).json({ error: 'Failed to create event' });
+  }
+});
+
+// Get all events (admin)
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const { status = 'all' } = req.query;
+    
+    let query = db('events').select('*');
+    
+    if (status === 'active') {
+      query = query.where('is_active', formatBoolean(true));
+    } else if (status === 'archived') {
+      query = query.where('is_archived', formatBoolean(true));
+    }
+    
+    const events = await query.orderBy('created_at', 'desc');
+    
+    // Add photo counts
+    for (const event of events) {
+      const photoCount = await db('photos').where('event_id', event.id).count('id as count').first();
+      event.photo_count = photoCount.count;
+    }
+    
+    res.json(events);
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to fetch events' });
+  }
+});
+
+// Update event
+router.put('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    const updates = req.body;
+    
+    // Don't allow updating certain fields
+    delete updates.id;
+    delete updates.slug;
+    delete updates.created_at;
+    
+    // If updating password, hash it
+    if (updates.password) {
+      updates.password_hash = await bcrypt.hash(updates.password, 10);
+      delete updates.password;
+    }
+    
+    await db('events').where('id', id).update(updates);
+    
+    res.json({ success: true });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to update event' });
+  }
+});
+
+// Delete event (mark as inactive)
+router.delete('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    await db('events').where('id', id).update({ is_active: formatBoolean(false) });
+    
+    res.json({ success: true });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to delete event' });
+  }
+});
+
+// Extend expiration
+router.post('/:id/extend', adminAuth, [
+  body('days').isInt({ min: 1, max: 365 })
+], async (req, res) => {
+  try {
+    const { id } = req.params;
+    const { days } = req.body;
+    
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+    
+    const newExpiration = new Date(event.expires_at);
+    newExpiration.setDate(newExpiration.getDate() + days);
+    
+    await db('events').where('id', id).update({ 
+      expires_at: newExpiration,
+      is_active: formatBoolean(true) // Reactivate if expired
+    });
+    
+    res.json({ expires_at: newExpiration });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to extend expiration' });
+  }
+});
+
+module.exports = router;

backend/src/routes/gallery.js

@@ -0,0 +1,467 @@
+const express = require('express');
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const archiver = require('archiver');
+const path = require('path');
+const router = express.Router();
+const watermarkService = require('../services/watermarkService');
+const { verifyGalleryAccess } = require('../middleware/gallery');
+
+// Get storage path from environment or default
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+// Verify share token
+router.get('/:slug/verify-token/:token', async (req, res) => {
+  try {
+    const { slug, token } = req.params;
+    
+    const event = await db('events')
+      .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
+      .select('id', 'share_link')
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found' });
+    }
+    
+    // Extract token from share link and verify
+    const expectedToken = event.share_link.split('/').pop();
+    if (token !== expectedToken) {
+      return res.status(404).json({ error: 'Invalid gallery link' });
+    }
+    
+    res.json({ valid: true });
+  } catch (error) {
+    console.error('Error verifying token:', error);
+    res.status(500).json({ error: 'Failed to verify token', details: error.message });
+  }
+});
+
+// Get gallery info (with optional token verification)
+router.get('/:slug/info', async (req, res) => {
+  try {
+    const { slug } = req.params;
+    const { token } = req.query;
+    
+    const event = await db('events')
+      .where({ slug })
+      .select('event_name', 'event_type', 'event_date', 'expires_at', 'is_active', 'is_archived', 'share_link')
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found' });
+    }
+    
+    // Check if event is archived
+    if (event.is_archived) {
+      return res.status(404).json({ error: 'Gallery has been archived and is no longer available' });
+    }
+    
+    // If token provided, verify it matches the share link
+    if (token) {
+      let expectedToken = event.share_link;
+      // Handle both formats: full URL or just token
+      if (event.share_link && event.share_link.includes('/')) {
+        expectedToken = event.share_link.split('/').pop();
+      }
+      if (token !== expectedToken) {
+        return res.status(404).json({ error: 'Invalid gallery link' });
+      }
+    }
+    
+    res.json({
+      event_name: event.event_name,
+      event_type: event.event_type,
+      event_date: event.event_date,
+      expires_at: event.expires_at,
+      is_active: event.is_active,
+      is_expired: !event.is_active || new Date(event.expires_at) < new Date(),
+      requires_password: true,
+      color_theme: event.color_theme
+    });
+  } catch (error) {
+    console.error('Error fetching gallery info:', error);
+    res.status(500).json({ error: 'Failed to fetch gallery info', details: error.message });
+  }
+});
+
+// Get all photos
+router.get('/:slug/photos', verifyGalleryAccess, async (req, res) => {
+  try {
+    const photos = await db('photos')
+      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
+      .where('photos.event_id', req.event.id)
+      .select(
+        'photos.*',
+        'photo_categories.name as category_name',
+        'photo_categories.slug as category_slug'
+      )
+      .orderBy('photos.uploaded_at', 'desc');
+    
+    // Get all categories for this event
+    const categories = await db('photo_categories')
+      .where(function() {
+        this.where('is_global', formatBoolean(true))
+          .orWhere('event_id', req.event.id);
+      })
+      .orderBy('is_global', 'desc')
+      .orderBy('name', 'asc');
+    
+    // Log view
+    await db('access_logs').insert({
+      event_id: req.event.id,
+      ip_address: req.ip,
+      user_agent: req.headers['user-agent'],
+      action: 'view'
+    });
+    
+    res.json({
+      event: {
+        id: req.event.id,
+        event_name: req.event.event_name,
+        event_type: req.event.event_type,
+        event_date: req.event.event_date,
+        welcome_message: req.event.welcome_message,
+        color_theme: req.event.color_theme,
+        expires_at: req.event.expires_at,
+        hero_photo_id: req.event.hero_photo_id
+      },
+      categories: categories.map(cat => ({
+        id: cat.id,
+        name: cat.name,
+        slug: cat.slug,
+        is_global: cat.is_global
+      })),
+      photos: photos.map(photo => ({
+        id: photo.id,
+        filename: photo.filename,
+        url: `/api/gallery/${req.params.slug}/photo/${photo.id}`,
+        thumbnail_url: photo.thumbnail_path ? `/api/gallery/${req.params.slug}/thumbnail/${photo.id}` : null,
+        type: photo.type,
+        category_id: photo.category_id,
+        category_name: photo.category_name,
+        category_slug: photo.category_slug,
+        size: photo.size_bytes,
+        uploaded_at: photo.uploaded_at
+      }))
+    });
+  } catch (error) {
+    console.error('Error fetching photos:', error);
+    res.status(500).json({ error: 'Failed to fetch photos', details: error.message });
+  }
+});
+
+// Download single photo
+router.get('/:slug/download/:photoId', verifyGalleryAccess, async (req, res) => {
+  try {
+    const { photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: req.event.id })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Update download count
+    await db('photos').where('id', photoId).increment('download_count', 1);
+    
+    // Log download
+    await db('access_logs').insert({
+      event_id: req.event.id,
+      ip_address: req.ip,
+      user_agent: req.headers['user-agent'],
+      action: 'download',
+      photo_id: photoId
+    });
+    
+    const filePath = path.join(getStoragePath(), 'events/active', photo.path);
+    
+    // Get watermark settings
+    const watermarkSettings = await watermarkService.getWatermarkSettings();
+    
+    if (watermarkSettings && watermarkSettings.enabled) {
+      // Apply watermark and send
+      const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
+      
+      res.set({
+        'Content-Type': photo.mime_type || 'image/jpeg',
+        'Content-Disposition': `attachment; filename="${photo.filename}"`,
+        'Content-Length': watermarkedBuffer.length
+      });
+      
+      res.send(watermarkedBuffer);
+    } else {
+      // Send original file
+      res.download(filePath, photo.filename);
+    }
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to download photo' });
+  }
+});
+
+// Download all photos as ZIP
+router.get('/:slug/download-all', verifyGalleryAccess, async (req, res) => {
+  try {
+    // Fetch photos with category information
+    const photos = await db('photos')
+      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
+      .where('photos.event_id', req.event.id)
+      .select(
+        'photos.*',
+        'photo_categories.name as category_name',
+        'photo_categories.slug as category_slug'
+      )
+      .orderBy('photo_categories.name', 'asc')
+      .orderBy('photos.uploaded_at', 'desc');
+    
+    if (photos.length === 0) {
+      return res.status(404).json({ error: 'No photos found' });
+    }
+    
+    // Count unique categories (excluding null)
+    const uniqueCategories = new Set(photos.filter(p => p.category_id).map(p => p.category_id)).size;
+    const hasMultipleCategories = uniqueCategories > 1;
+    
+    res.setHeader('Content-Type', 'application/zip');
+    res.setHeader('Content-Disposition', `attachment; filename="${req.event.slug}.zip"`);
+    
+    const archive = archiver('zip', { zlib: { level: 5 } });
+    archive.on('error', (err) => {
+      throw err;
+    });
+    
+    archive.pipe(res);
+    
+    // Get watermark settings
+    const watermarkSettings = await watermarkService.getWatermarkSettings();
+    
+    // Add photos to archive
+    for (const photo of photos) {
+      const filePath = path.join(getStoragePath(), 'events/active', photo.path);
+      
+      // Determine the file name in the archive
+      let archiveName;
+      if (hasMultipleCategories) {
+        if (photo.category_name) {
+          // Use category name as folder (sanitize for filesystem)
+          const folderName = photo.category_name.replace(/[^a-zA-Z0-9-_ ]/g, '').trim();
+          archiveName = path.join(folderName, photo.filename);
+        } else {
+          // Put uncategorized photos in 'Uncategorized' folder
+          archiveName = path.join('Uncategorized', photo.filename);
+        }
+      } else {
+        // No folders, just the filename
+        archiveName = photo.filename;
+      }
+      
+      if (watermarkSettings && watermarkSettings.enabled) {
+        // Apply watermark
+        const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
+        archive.append(watermarkedBuffer, { name: archiveName });
+      } else {
+        // Add original file
+        archive.file(filePath, { name: archiveName });
+      }
+    }
+    
+    await archive.finalize();
+    
+    // Log bulk download
+    await db('access_logs').insert({
+      event_id: req.event.id,
+      ip_address: req.ip,
+      user_agent: req.headers['user-agent'],
+      action: 'download_all'
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to create download archive' });
+  }
+});
+
+// View single photo (with watermark if enabled)
+router.get('/:slug/photo/:photoId', verifyGalleryAccess, async (req, res) => {
+  try {
+    const { photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: req.event.id })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    const filePath = path.join(getStoragePath(), 'events/active', photo.path);
+    
+    // Get watermark settings
+    const watermarkSettings = await watermarkService.getWatermarkSettings();
+    
+    if (watermarkSettings && watermarkSettings.enabled) {
+      // Apply watermark and send
+      const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
+      
+      res.set({
+        'Content-Type': photo.mime_type || 'image/jpeg',
+        'Cache-Control': 'public, max-age=3600' // Cache for 1 hour
+      });
+      
+      res.send(watermarkedBuffer);
+    } else {
+      // Send original file
+      res.sendFile(filePath);
+    }
+  } catch (error) {
+    console.error('Error serving photo:', error);
+    res.status(500).json({ error: 'Failed to serve photo' });
+  }
+});
+
+// Serve thumbnail
+router.get('/:slug/thumbnail/:photoId', verifyGalleryAccess, async (req, res) => {
+  try {
+    const { photoId } = req.params;
+    
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: req.event.id })
+      .first();
+    
+    if (!photo || !photo.thumbnail_path) {
+      return res.status(404).json({ error: 'Thumbnail not found' });
+    }
+    
+    const thumbPath = path.join(getStoragePath(), photo.thumbnail_path);
+    
+    // Check if file exists
+    const fs = require('fs').promises;
+    try {
+      await fs.access(thumbPath);
+    } catch (error) {
+      return res.status(404).json({ error: 'Thumbnail file not found' });
+    }
+    
+    // Set appropriate headers
+    res.setHeader('Content-Type', 'image/jpeg');
+    res.setHeader('Cache-Control', 'private, max-age=3600');
+    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+    
+    // Send file
+    res.sendFile(path.resolve(thumbPath));
+  } catch (error) {
+    console.error('Error serving thumbnail:', error);
+    res.status(500).json({ error: 'Failed to serve thumbnail' });
+  }
+});
+
+// Get photo stats
+router.get('/:slug/stats', verifyGalleryAccess, async (req, res) => {
+  try {
+    const totalPhotos = await db('photos')
+      .where('event_id', req.event.id)
+      .count('id as count')
+      .first();
+    
+    const totalViews = await db('access_logs')
+      .where('event_id', req.event.id)
+      .where('action', 'view')
+      .count('id as count')
+      .first();
+    
+    const totalDownloads = await db('photos')
+      .where('event_id', req.event.id)
+      .sum('download_count as total')
+      .first();
+    
+    const uniqueVisitors = await db('access_logs')
+      .where('event_id', req.event.id)
+      .countDistinct('ip_address as count')
+      .first();
+    
+    res.json({
+      total_photos: totalPhotos.count,
+      total_views: totalViews.count,
+      total_downloads: totalDownloads.total || 0,
+      unique_visitors: uniqueVisitors.count
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to fetch stats' });
+  }
+});
+
+// User photo upload endpoint
+router.post('/:eventId/upload', verifyGalleryAccess, async (req, res) => {
+  try {
+    const eventId = parseInt(req.params.eventId);
+    
+    // Verify the event matches the token
+    if (req.event.id !== eventId) {
+      return res.status(403).json({ error: 'Access denied' });
+    }
+    
+    // Check if user uploads are allowed
+    if (!req.event.allow_user_uploads) {
+      return res.status(403).json({ error: 'User uploads are not allowed for this event' });
+    }
+    
+    // Import multer and photo processing
+    const multer = require('multer');
+    const upload = multer({ 
+      dest: '/tmp/uploads/',
+      limits: { 
+        fileSize: 50 * 1024 * 1024, // 50MB
+        files: 10 // Max 10 files at once
+      },
+      fileFilter: (req, file, cb) => {
+        const allowedTypes = ['image/jpeg', 'image/png', 'image/webp'];
+        if (allowedTypes.includes(file.mimetype)) {
+          cb(null, true);
+        } else {
+          cb(new Error('Invalid file type'));
+        }
+      }
+    }).array('photos', 10);
+    
+    // Handle upload
+    upload(req, res, async (err) => {
+      if (err) {
+        console.error('Upload error:', err);
+        return res.status(400).json({ error: err.message });
+      }
+      
+      if (!req.files || req.files.length === 0) {
+        return res.status(400).json({ error: 'No files uploaded' });
+      }
+      
+      const { processUploadedPhotos } = require('../services/photoProcessor');
+      const categoryId = req.body.category_id || req.event.upload_category_id || null;
+      
+      try {
+        // Process uploaded photos
+        const results = await processUploadedPhotos(req.files, eventId, 'user', categoryId);
+        
+        // Clean up temp files
+        const fs = require('fs').promises;
+        for (const file of req.files) {
+          await fs.unlink(file.path).catch(console.error);
+        }
+        
+        res.json({ 
+          message: 'Photos uploaded successfully',
+          count: results.length,
+          photos: results
+        });
+      } catch (processError) {
+        console.error('Photo processing error:', processError);
+        res.status(500).json({ error: 'Failed to process photos' });
+      }
+    });
+  } catch (error) {
+    console.error('Upload route error:', error);
+    res.status(500).json({ error: 'Failed to upload photos' });
+  }
+});
+
+module.exports = router;

backend/src/routes/protectedImages.js

@@ -0,0 +1,190 @@
+const express = require('express');
+const path = require('path');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { verifyGalleryAccess } = require('../middleware/gallery');
+const watermarkService = require('../services/watermarkService');
+const { getStoragePath } = require('../config/storage');
+const crypto = require('crypto');
+
+const router = express.Router();
+
+/**
+ * Generate a signed URL token for image access
+ */
+function generateImageToken(photoId, expiresIn = 3600) {
+  const secret = process.env.JWT_SECRET;
+  const expires = Date.now() + (expiresIn * 1000);
+  const data = `${photoId}:${expires}`;
+  const signature = crypto.createHmac('sha256', secret).update(data).digest('hex');
+  return `${Buffer.from(data).toString('base64')}.${signature}`;
+}
+
+/**
+ * Verify image token
+ */
+function verifyImageToken(token) {
+  try {
+    const secret = process.env.JWT_SECRET;
+    const [data, signature] = token.split('.');
+    const decoded = Buffer.from(data, 'base64').toString();
+    const [photoId, expires] = decoded.split(':');
+    
+    // Verify signature
+    const expectedSignature = crypto.createHmac('sha256', secret).update(decoded).digest('hex');
+    if (signature !== expectedSignature) {
+      return null;
+    }
+    
+    // Check expiration
+    if (Date.now() > parseInt(expires)) {
+      return null;
+    }
+    
+    return { photoId: parseInt(photoId), expires: parseInt(expires) };
+  } catch (error) {
+    return null;
+  }
+}
+
+/**
+ * Serve watermarked image
+ */
+router.get('/:slug/photo/:photoId/view', verifyGalleryAccess, async (req, res) => {
+  try {
+    const { photoId } = req.params;
+    
+    // Get photo details
+    const photo = await db('photos')
+      .where({
+        id: photoId,
+        event_id: req.event.id
+      })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Get watermark settings
+    const watermarkSettings = await watermarkService.getWatermarkSettings();
+    
+    // Build full path to photo
+    const photoPath = path.join(getStoragePath(), 'events/active', req.event.slug, photo.path);
+    
+    // Apply watermark if enabled
+    const imageBuffer = await watermarkService.applyWatermark(photoPath, watermarkSettings);
+    
+    // Set appropriate headers
+    res.set({
+      'Content-Type': photo.mime_type || 'image/jpeg',
+      'Content-Length': imageBuffer.length,
+      'Cache-Control': 'private, max-age=3600',
+      'X-Content-Type-Options': 'nosniff'
+    });
+    
+    // Send the watermarked image
+    res.send(imageBuffer);
+    
+  } catch (error) {
+    console.error('Error serving watermarked image:', error);
+    res.status(500).json({ error: 'Failed to serve image' });
+  }
+});
+
+/**
+ * Generate signed URL for image access
+ */
+router.post('/:slug/photo/:photoId/generate-url', verifyGalleryAccess, async (req, res) => {
+  try {
+    const { photoId } = req.params;
+    
+    // Verify photo belongs to this event
+    const photo = await db('photos')
+      .where({
+        id: photoId,
+        event_id: req.event.id
+      })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Generate signed token
+    const token = generateImageToken(photoId);
+    const signedUrl = `/api/images/${req.params.slug}/photo/${photoId}/signed/${token}`;
+    
+    res.json({ 
+      url: signedUrl,
+      expiresIn: 3600 // 1 hour
+    });
+    
+  } catch (error) {
+    console.error('Error generating signed URL:', error);
+    res.status(500).json({ error: 'Failed to generate URL' });
+  }
+});
+
+/**
+ * Serve image with signed URL (no gallery auth required, token is the auth)
+ */
+router.get('/:slug/photo/:photoId/signed/:token', async (req, res) => {
+  try {
+    const { slug, photoId, token } = req.params;
+    
+    // Verify token
+    const tokenData = verifyImageToken(token);
+    if (!tokenData || tokenData.photoId !== parseInt(photoId)) {
+      return res.status(403).json({ error: 'Invalid or expired token' });
+    }
+    
+    // Get event
+    const event = await db('events')
+      .where({ slug })
+      .where('is_active', formatBoolean(true))
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+    
+    // Get photo
+    const photo = await db('photos')
+      .where({
+        id: photoId,
+        event_id: event.id
+      })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+    
+    // Get watermark settings
+    const watermarkSettings = await watermarkService.getWatermarkSettings();
+    
+    // Build full path to photo
+    const photoPath = path.join(getStoragePath(), 'events/active', event.slug, photo.path);
+    
+    // Apply watermark if enabled
+    const imageBuffer = await watermarkService.applyWatermark(photoPath, watermarkSettings);
+    
+    // Set appropriate headers
+    res.set({
+      'Content-Type': photo.mime_type || 'image/jpeg',
+      'Content-Length': imageBuffer.length,
+      'Cache-Control': 'private, max-age=3600',
+      'X-Content-Type-Options': 'nosniff'
+    });
+    
+    // Send the watermarked image
+    res.send(imageBuffer);
+    
+  } catch (error) {
+    console.error('Error serving signed image:', error);
+    res.status(500).json({ error: 'Failed to serve image' });
+  }
+});
+
+module.exports = router;

backend/src/routes/publicCMS.js

@@ -0,0 +1,33 @@
+const express = require('express');
+const { db } = require('../database/db');
+const router = express.Router();
+
+// Get public CMS page
+router.get('/pages/:slug', async (req, res) => {
+  try {
+    const { slug } = req.params;
+    const { lang = 'en' } = req.query;
+    
+    const page = await db('cms_pages').where('slug', slug).first();
+    
+    if (!page) {
+      return res.status(404).json({ error: 'Page not found' });
+    }
+    
+    // Return the appropriate language version
+    const title = lang === 'de' ? page.title_de : page.title_en;
+    const content = lang === 'de' ? page.content_de : page.content_en;
+    
+    res.json({
+      title,
+      content,
+      slug: page.slug,
+      updated_at: page.updated_at
+    });
+  } catch (error) {
+    console.error('Error fetching public CMS page:', error);
+    res.status(500).json({ error: 'Failed to fetch page' });
+  }
+});
+
+module.exports = router;

backend/src/routes/publicSettings.js

@@ -0,0 +1,54 @@
+const express = require('express');
+const { db } = require('../database/db');
+const router = express.Router();
+
+// Get public settings (branding and theme)
+router.get('/', async (req, res) => {
+  try {
+    // Fetch branding, theme, general, and select security settings
+    const settings = await db('app_settings')
+      .whereIn('setting_type', ['branding', 'theme', 'general', 'security'])
+      .select('setting_key', 'setting_value');
+    
+    // Convert to object format
+    const settingsObject = {};
+    settings.forEach(setting => {
+      try {
+        settingsObject[setting.setting_key] = setting.setting_value 
+          ? JSON.parse(setting.setting_value) 
+          : null;
+      } catch (e) {
+        // If parsing fails, use the raw value
+        settingsObject[setting.setting_key] = setting.setting_value;
+      }
+    });
+
+    // Return only safe public settings
+    const publicSettings = {
+      branding_company_name: settingsObject.branding_company_name || '',
+      branding_company_tagline: settingsObject.branding_company_tagline || '',
+      branding_support_email: settingsObject.branding_support_email || '',
+      branding_footer_text: settingsObject.branding_footer_text || '',
+      branding_watermark_enabled: settingsObject.branding_watermark_enabled || false,
+      branding_watermark_logo_url: settingsObject.branding_watermark_logo_url || '',
+      branding_watermark_position: settingsObject.branding_watermark_position || 'bottom-right',
+      branding_watermark_opacity: settingsObject.branding_watermark_opacity || 50,
+      branding_watermark_size: settingsObject.branding_watermark_size || 15,
+      branding_favicon_url: settingsObject.branding_favicon_url || '',
+      branding_logo_url: settingsObject.branding_logo_url || '',
+      theme_config: settingsObject.theme_config || null,
+      default_language: settingsObject.general_default_language || 'en',
+      enable_analytics: settingsObject.general_enable_analytics !== false,
+      enable_recaptcha: settingsObject.security_enable_recaptcha === true || settingsObject.security_enable_recaptcha === 'true',
+      recaptcha_site_key: settingsObject.security_recaptcha_site_key || null,
+      maintenance_mode: settingsObject.general_maintenance_mode === true || settingsObject.general_maintenance_mode === 'true'
+    };
+
+    res.json(publicSettings);
+  } catch (error) {
+    console.error('Public settings fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch settings' });
+  }
+});
+
+module.exports = router;