Initial commit - Project start (July 17, 2025)

Original: feat: enhance security logging and ensure rate limit blocks are properly tracked

- Add comprehensive logging for rate limit blocks with full request details
  - IP address (with proper proxy detection), user agent, headers, timestamps
  - Rate limit info (current count, limit, remaining, reset time)
  - Separate tracking for auth vs general endpoints

- Enhance authentication failure logging
  - JWT validation failures with detailed error info
  - Admin auth attempts without token
  - Failed token validation with user context
  - All events include IP, path, method, user agent

- Improve Winston logger configuration for production
  - Add automatic log rotation (10MB errors, 50MB combined)
  - Create separate security.log for auth/rate limit events
  - Ensure logs directory exists automatically
  - Add structured JSON format for log aggregation
  - Support container logging with LOG_TO_CONSOLE env var

- Create comprehensive documentation
  - Security logging guide with examples
  - Monitoring recommendations
  - Configuration reference

- Add test script to verify logging functionality

All rate limit settings remain configurable via admin panel:
- Window duration, max requests, auth limits
- Skip authenticated requests option
- Public endpoints only option

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/services/archiveService.js

@@ -0,0 +1,70 @@
+const archiver = require('archiver');
+const fs = require('fs').promises;
+const path = require('path');
+const { db } = require('../database/db');
+const { queueEmail } = require('./emailProcessor');
+const logger = require('../utils/logger');
+
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+const ACTIVE_PATH = () => path.join(getStoragePath(), 'events/active');
+const ARCHIVE_PATH = () => path.join(getStoragePath(), 'events/archived');
+
+async function archiveEvent(event) {
+  try {
+    const eventPath = path.join(ACTIVE_PATH(), event.slug);
+    const archiveName = `${event.slug}.zip`;
+    const archivePath = path.join(ARCHIVE_PATH(), archiveName);
+    
+    // Ensure archive directory exists
+    await fs.mkdir(ARCHIVE_PATH(), { recursive: true });
+    
+    // Create archive
+    const output = require('fs').createWriteStream(archivePath);
+    const archive = archiver('zip', {
+      zlib: { level: 9 } // Maximum compression
+    });
+    
+    archive.on('error', (err) => {
+      throw err;
+    });
+    
+    output.on('close', async () => {
+      logger.info(`Archive created: ${archiveName} (${archive.pointer()} bytes)`);
+      
+      // Update database
+      await db('events').where('id', event.id).update({
+        is_archived: true,
+        archive_path: path.relative(getStoragePath(), archivePath),
+        archived_at: new Date()
+      });
+      
+      // Delete original files
+      await fs.rm(eventPath, { recursive: true });
+      
+      // Delete thumbnails
+      const photos = await db('photos').where('event_id', event.id);
+      for (const photo of photos) {
+        if (photo.thumbnail_path) {
+          const thumbPath = path.join(getStoragePath(), photo.thumbnail_path);
+          await fs.unlink(thumbPath).catch(() => {}); // Ignore if already deleted
+        }
+      }
+      
+      // Queue completion email
+      await queueEmail(event.id, event.admin_email, 'archive_complete', {
+        event_name: event.event_name,
+        archive_size: (archive.pointer() / 1024 / 1024).toFixed(2) + ' MB'
+      });
+    });
+    
+    archive.pipe(output);
+    archive.directory(eventPath, false);
+    await archive.finalize();
+    
+  } catch (error) {
+    logger.error(`Error archiving event ${event.slug}:`, error);
+    throw error;
+  }
+}
+
+module.exports = { archiveEvent };