Initial commit - Project start (July 17, 2025)

Original: feat: enhance security logging and ensure rate limit blocks are properly tracked

- Add comprehensive logging for rate limit blocks with full request details
  - IP address (with proper proxy detection), user agent, headers, timestamps
  - Rate limit info (current count, limit, remaining, reset time)
  - Separate tracking for auth vs general endpoints

- Enhance authentication failure logging
  - JWT validation failures with detailed error info
  - Admin auth attempts without token
  - Failed token validation with user context
  - All events include IP, path, method, user agent

- Improve Winston logger configuration for production
  - Add automatic log rotation (10MB errors, 50MB combined)
  - Create separate security.log for auth/rate limit events
  - Ensure logs directory exists automatically
  - Add structured JSON format for log aggregation
  - Support container logging with LOG_TO_CONSOLE env var

- Create comprehensive documentation
  - Security logging guide with examples
  - Monitoring recommendations
  - Configuration reference

- Add test script to verify logging functionality

All rate limit settings remain configurable via admin panel:
- Window duration, max requests, auth limits
- Skip authenticated requests option
- Public endpoints only option

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/utils/authSecurity.js

@@ -0,0 +1,190 @@
+/**
+ * Authentication Security Utilities
+ * Provides enhanced security features for authentication
+ */
+
+const { db } = require('../database/db');
+const { formatBoolean } = require('./dbCompat');
+const logger = require('./logger');
+
+// Configuration constants
+const MAX_LOGIN_ATTEMPTS = 5;
+const LOCKOUT_DURATION = 30 * 60 * 1000; // 30 minutes in milliseconds
+const ATTEMPT_WINDOW = 15 * 60 * 1000; // 15 minutes window for counting attempts
+
+/**
+ * Track failed login attempt
+ * @param {string} identifier - Username or email
+ * @param {string} ipAddress - IP address of the attempt
+ * @param {string} userAgent - User agent string
+ */
+async function trackFailedAttempt(identifier, ipAddress, userAgent) {
+  try {
+    await db('login_attempts').insert({
+      identifier,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      attempt_time: new Date().toISOString(),
+      success: false
+    });
+
+    // Log security event
+    logger.warn('Failed login attempt', {
+      identifier,
+      ipAddress,
+      userAgent,
+      timestamp: new Date().toISOString()
+    });
+  } catch (error) {
+    logger.error('Error tracking failed login attempt:', error);
+  }
+}
+
+/**
+ * Track successful login
+ * @param {string} identifier - Username or email
+ * @param {string} ipAddress - IP address
+ * @param {string} userAgent - User agent string
+ */
+async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
+  try {
+    await db('login_attempts').insert({
+      identifier,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      attempt_time: new Date().toISOString(),
+      success: true
+    });
+
+    // Clear old failed attempts for this user
+    const cutoffTime = new Date(Date.now() - ATTEMPT_WINDOW);
+    await db('login_attempts')
+      .where('identifier', identifier)
+      .where('success', formatBoolean(false))
+      .where('attempt_time', '<', cutoffTime.toISOString())
+      .delete();
+  } catch (error) {
+    logger.error('Error tracking successful login:', error);
+  }
+}
+
+/**
+ * Check if account is locked due to too many failed attempts
+ * @param {string} identifier - Username or email
+ * @returns {Promise<{isLocked: boolean, remainingTime?: number}>}
+ */
+async function checkAccountLockout(identifier) {
+  try {
+    const recentWindow = new Date(Date.now() - ATTEMPT_WINDOW);
+    
+    // Get recent failed attempts
+    const failedAttempts = await db('login_attempts')
+      .where('identifier', identifier)
+      .where('success', formatBoolean(false))
+      .where('attempt_time', '>=', recentWindow.toISOString())
+      .orderBy('attempt_time', 'desc')
+      .limit(MAX_LOGIN_ATTEMPTS);
+
+    if (failedAttempts.length >= MAX_LOGIN_ATTEMPTS) {
+      // Check if still within lockout period
+      const oldestAttempt = failedAttempts[failedAttempts.length - 1];
+      const lockoutEnd = new Date(oldestAttempt.attempt_time).getTime() + LOCKOUT_DURATION;
+      const now = Date.now();
+
+      if (now < lockoutEnd) {
+        return {
+          isLocked: true,
+          remainingTime: Math.ceil((lockoutEnd - now) / 1000) // seconds
+        };
+      }
+    }
+
+    return { isLocked: false };
+  } catch (error) {
+    logger.error('Error checking account lockout:', error);
+    return { isLocked: false }; // Fail open to avoid locking users out due to errors
+  }
+}
+
+/**
+ * Check for suspicious login patterns
+ * @param {string} identifier - Username or email
+ * @param {string} ipAddress - Current IP address
+ * @returns {Promise<boolean>} - True if suspicious
+ */
+async function checkSuspiciousActivity(identifier, ipAddress) {
+  try {
+    // Check for rapid attempts from different IPs
+    const recentWindow = new Date(Date.now() - 5 * 60 * 1000); // 5 minutes
+    
+    const recentAttempts = await db('login_attempts')
+      .where('identifier', identifier)
+      .where('attempt_time', '>=', recentWindow.toISOString())
+      .select('ip_address')
+      .distinct('ip_address');
+
+    // If more than 3 different IPs in 5 minutes, it's suspicious
+    if (recentAttempts.length > 3) {
+      logger.warn('Suspicious login activity detected', {
+        identifier,
+        uniqueIPs: recentAttempts.length,
+        currentIP: ipAddress
+      });
+      return true;
+    }
+
+    return false;
+  } catch (error) {
+    logger.error('Error checking suspicious activity:', error);
+    return false;
+  }
+}
+
+/**
+ * Get generic error message to prevent user enumeration
+ * @returns {string}
+ */
+function getGenericAuthError() {
+  return 'Invalid credentials';
+}
+
+/**
+ * Clean up old login attempts (should be run periodically)
+ */
+async function cleanupOldAttempts() {
+  try {
+    const cutoffDate = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000); // 7 days
+    
+    const deleted = await db('login_attempts')
+      .where('attempt_time', '<', cutoffDate.toISOString())
+      .delete();
+
+    if (deleted > 0) {
+      logger.info(`Cleaned up ${deleted} old login attempts`);
+    }
+  } catch (error) {
+    logger.error('Error cleaning up login attempts:', error);
+  }
+}
+
+/**
+ * Initialize cleanup job
+ */
+function initializeCleanupJob() {
+  // Run cleanup every 24 hours
+  setInterval(cleanupOldAttempts, 24 * 60 * 60 * 1000);
+  
+  // Run initial cleanup
+  cleanupOldAttempts();
+}
+
+module.exports = {
+  trackFailedAttempt,
+  trackSuccessfulLogin,
+  checkAccountLockout,
+  checkSuspiciousActivity,
+  getGenericAuthError,
+  initializeCleanupJob,
+  MAX_LOGIN_ATTEMPTS,
+  LOCKOUT_DURATION
+};

backend/src/utils/cleanupTempUploads.js

@@ -0,0 +1,78 @@
+const path = require('path');
+const fs = require('fs').promises;
+const logger = require('./logger');
+
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+/**
+ * Clean up old temporary upload directories
+ * Removes temp directories older than 1 hour
+ */
+async function cleanupTempUploads() {
+  const tempPath = path.join(getStoragePath(), 'temp');
+  
+  try {
+    // Ensure temp directory exists
+    await fs.mkdir(tempPath, { recursive: true });
+    
+    // Read all items in temp directory
+    const items = await fs.readdir(tempPath);
+    
+    let cleanedCount = 0;
+    const oneHourAgo = Date.now() - (60 * 60 * 1000); // 1 hour
+    
+    for (const item of items) {
+      const itemPath = path.join(tempPath, item);
+      
+      try {
+        const stats = await fs.stat(itemPath);
+        
+        // Only process directories that match our upload pattern
+        if (stats.isDirectory() && item.startsWith('upload_')) {
+          // Extract timestamp from directory name
+          const parts = item.split('_');
+          if (parts.length >= 2) {
+            const timestamp = parseInt(parts[1]);
+            
+            // Remove if older than 1 hour
+            if (!isNaN(timestamp) && timestamp < oneHourAgo) {
+              logger.info(`Cleaning up old temp upload directory: ${item}`);
+              await fs.rm(itemPath, { recursive: true, force: true });
+              cleanedCount++;
+            }
+          }
+        }
+      } catch (error) {
+        logger.error(`Error processing temp item ${item}:`, error.message);
+      }
+    }
+    
+    if (cleanedCount > 0) {
+      logger.info(`Cleaned up ${cleanedCount} old temp upload directories`);
+    }
+    
+  } catch (error) {
+    logger.error('Error during temp upload cleanup:', error);
+  }
+}
+
+/**
+ * Start periodic cleanup of temp uploads
+ * Runs every hour
+ */
+function startTempUploadCleanup() {
+  // Run immediately on startup
+  cleanupTempUploads();
+  
+  // Then run every hour
+  setInterval(() => {
+    cleanupTempUploads();
+  }, 60 * 60 * 1000); // 1 hour
+  
+  logger.info('Temp upload cleanup service started');
+}
+
+module.exports = {
+  cleanupTempUploads,
+  startTempUploadCleanup
+};

backend/src/utils/dateFormatter.js

@@ -0,0 +1,100 @@
+const { db } = require('../database/db');
+
+// Default date format settings
+const DEFAULT_FORMAT = {
+  format: 'DD/MM/YYYY',
+  locale: 'en-GB'
+};
+
+// Format date based on system settings
+async function formatDate(date, language = 'en') {
+  try {
+    // Get date format setting from database
+    const setting = await db('app_settings').where('setting_key', 'general_date_format').first();
+    let dateConfig = DEFAULT_FORMAT;
+    
+    if (setting && setting.setting_value) {
+      // Handle both string and object values
+      if (typeof setting.setting_value === 'string') {
+        try {
+          dateConfig = JSON.parse(setting.setting_value);
+        } catch (e) {
+          console.warn('Failed to parse date format setting:', e.message);
+          dateConfig = DEFAULT_FORMAT;
+        }
+      } else {
+        dateConfig = setting.setting_value;
+      }
+    }
+    
+    // Ensure proper date parsing
+    let dateObj;
+    if (date instanceof Date) {
+      dateObj = date;
+    } else if (typeof date === 'string') {
+      // For date strings like "2025-07-16", parse as local date to avoid timezone issues
+      if (date.match(/^\d{4}-\d{2}-\d{2}$/)) {
+        // Parse YYYY-MM-DD format as local date
+        const [year, month, day] = date.split('-').map(num => parseInt(num, 10));
+        dateObj = new Date(year, month - 1, day);
+      } else {
+        dateObj = new Date(date);
+      }
+    } else {
+      dateObj = new Date(date);
+    }
+    
+    // Check if date is valid
+    if (isNaN(dateObj.getTime())) {
+      console.error('Invalid date provided to formatDate:', date);
+      throw new Error('Invalid date');
+    }
+    
+    // Use appropriate locale based on language
+    let locale = dateConfig.locale || 'en-GB';
+    if (language === 'de') {
+      locale = 'de-DE';
+    } else if (language === 'en' && dateConfig.format === 'MM/DD/YYYY') {
+      locale = 'en-US';
+    }
+    
+    // Format based on the configured format
+    switch (dateConfig.format) {
+    case 'MM/DD/YYYY':
+      return dateObj.toLocaleDateString(locale, {
+        month: '2-digit',
+        day: '2-digit',
+        year: 'numeric'
+      });
+    case 'DD/MM/YYYY':
+      return dateObj.toLocaleDateString(locale, {
+        day: '2-digit',
+        month: '2-digit',
+        year: 'numeric'
+      });
+    case 'YYYY-MM-DD':
+      return dateObj.toISOString().split('T')[0];
+    case 'DD.MM.YYYY':
+      return dateObj.toLocaleDateString('de-DE', {
+        day: '2-digit',
+        month: '2-digit',
+        year: 'numeric'
+      });
+    default:
+      // Use long format as fallback
+      return dateObj.toLocaleDateString(locale, {
+        year: 'numeric',
+        month: 'long',
+        day: 'numeric'
+      });
+    }
+  } catch (error) {
+    console.error('Error formatting date:', error);
+    // Fallback to basic formatting
+    return date instanceof Date ? date.toLocaleDateString() : new Date(date).toLocaleDateString();
+  }
+}
+
+module.exports = {
+  formatDate
+};

backend/src/utils/dbCompat.js

@@ -0,0 +1,133 @@
+/**
+ * Database Compatibility Utilities
+ * Handles differences between PostgreSQL and SQLite
+ */
+
+// Note: Requiring db here creates circular dependency
+// db should be passed as parameter or required where needed
+
+/**
+ * Get database client type
+ * @returns {string} 'pg' or 'sqlite3'
+ */
+function getDbClient() {
+  return process.env.DATABASE_CLIENT || 'sqlite3';
+}
+
+/**
+ * Check if using PostgreSQL
+ * @returns {boolean}
+ */
+function isPostgreSQL() {
+  return getDbClient() === 'pg';
+}
+
+/**
+ * Handle insert operations that return IDs
+ * Works with both PostgreSQL and SQLite
+ * @param {object} query - Knex query builder
+ * @returns {Promise<number>} The inserted ID
+ */
+async function insertAndGetId(query) {
+  const result = await query.returning('id');
+  
+  // PostgreSQL returns array of objects [{id: 1}]
+  // SQLite returns array of IDs [1]
+  return result[0]?.id || result[0];
+}
+
+/**
+ * Format date for database compatibility
+ * @param {Date} date - JavaScript Date object
+ * @returns {string} ISO string format that works on both databases
+ */
+function formatDateForDB(date) {
+  return date.toISOString();
+}
+
+/**
+ * Add days to a date (database agnostic)
+ * @param {Date} date - Starting date
+ * @param {number} days - Number of days to add
+ * @returns {Date} New date
+ */
+function addDays(date, days) {
+  const result = new Date(date);
+  result.setDate(result.getDate() + days);
+  return result;
+}
+
+/**
+ * Get date extraction SQL that works on both databases
+ * @param {object} db - Knex database instance
+ * @param {string} column - Column name
+ * @returns {object} Knex raw query
+ */
+function dateExtractSQL(db, column) {
+  if (isPostgreSQL()) {
+    return db.raw(`DATE(${column})`);
+  } else {
+    // SQLite uses date() function
+    return db.raw(`date(${column})`);
+  }
+}
+
+/**
+ * Get database size query
+ * @param {object} db - Knex database instance
+ * @param {string} dbName - Database name
+ * @returns {Promise<number>} Size in bytes
+ */
+async function getDatabaseSize(db, dbName) {
+  if (isPostgreSQL()) {
+    const result = await db.raw('SELECT pg_database_size(?) as size', [dbName]);
+    return result.rows[0]?.size || 0;
+  } else {
+    // For SQLite, check file size
+    const fs = require('fs').promises;
+    const path = require('path');
+    const dbPath = process.env.DATABASE_PATH || path.join(__dirname, '../../data/photo_sharing.db');
+    try {
+      const stats = await fs.stat(dbPath);
+      return stats.size;
+    } catch (error) {
+      console.error('Error getting SQLite database size:', error);
+      return 0;
+    }
+  }
+}
+
+/**
+ * Handle boolean values for database compatibility
+ * @param {boolean} value - Boolean value
+ * @returns {any} Database-appropriate boolean representation
+ */
+function formatBoolean(value) {
+  if (isPostgreSQL()) {
+    return value;
+  } else {
+    // SQLite stores booleans as 0/1
+    return value ? 1 : 0;
+  }
+}
+
+/**
+ * Parse boolean from database
+ * @param {any} value - Database boolean value
+ * @returns {boolean} JavaScript boolean
+ */
+function parseBoolean(value) {
+  return Boolean(value);
+}
+
+module.exports = {
+  getDbClient,
+  isPostgreSQL,
+  insertAndGetId,
+  formatDateForDB,
+  addDays,
+  dateExtractSQL,
+  getDatabaseSize,
+  formatBoolean,
+  parseBoolean
+};

backend/src/utils/fileSecurityUtils.js

@@ -0,0 +1,233 @@
+const path = require('path');
+const fs = require('fs').promises;
+
+/**
+ * Secure file security utilities to prevent path traversal and validate file types
+ */
+
+/**
+ * Safely join paths and prevent directory traversal attacks
+ * @param {string} basePath - The base directory path
+ * @param {string} userPath - The user-provided path to join
+ * @returns {string} - Safe joined path
+ * @throws {Error} - If path traversal is detected
+ */
+function safePathJoin(basePath, userPath) {
+  // Normalize the base path
+  const normalizedBase = path.resolve(basePath);
+  
+  // Join and resolve the full path
+  const joinedPath = path.join(normalizedBase, userPath);
+  const resolvedPath = path.resolve(joinedPath);
+  
+  // Ensure the resolved path starts with the base path
+  if (!resolvedPath.startsWith(normalizedBase + path.sep) && resolvedPath !== normalizedBase) {
+    throw new Error('Path traversal attempt detected');
+  }
+  
+  return resolvedPath;
+}
+
+/**
+ * Validate file path to prevent directory traversal
+ * @param {string} filePath - The file path to validate
+ * @returns {boolean} - True if path is safe
+ */
+function isPathSafe(filePath) {
+  // Check for common path traversal patterns
+  const dangerousPatterns = [
+    /\.\.[\/\\]/,  // ../ or ..\
+    /^[A-Za-z]:/,  // Windows drive letters
+    /[\x00-\x1f]/  // Control characters
+  ];
+  
+  return !dangerousPatterns.some(pattern => pattern.test(filePath));
+}
+
+/**
+ * Enhanced MIME type validation
+ */
+const ALLOWED_IMAGE_TYPES = {
+  'image/jpeg': {
+    extensions: ['.jpg', '.jpeg'],
+    magicNumbers: [
+      { offset: 0, bytes: [0xFF, 0xD8, 0xFF] } // JPEG
+    ]
+  },
+  'image/png': {
+    extensions: ['.png'],
+    magicNumbers: [
+      { offset: 0, bytes: [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A] } // PNG
+    ]
+  },
+  'image/webp': {
+    extensions: ['.webp'],
+    magicNumbers: [
+      { offset: 0, bytes: [0x52, 0x49, 0x46, 0x46] }, // RIFF
+      { offset: 8, bytes: [0x57, 0x45, 0x42, 0x50] }  // WEBP
+    ]
+  },
+  'image/gif': {
+    extensions: ['.gif'],
+    magicNumbers: [
+      { offset: 0, bytes: [0x47, 0x49, 0x46, 0x38, 0x37, 0x61] }, // GIF87a
+      { offset: 0, bytes: [0x47, 0x49, 0x46, 0x38, 0x39, 0x61] }  // GIF89a
+    ]
+  },
+  'image/svg+xml': {
+    extensions: ['.svg'],
+    // SVG files are XML-based text files, so we skip magic number validation
+    magicNumbers: null
+  }
+};
+
+/**
+ * Validate file type by MIME type and extension
+ * @param {string} filename - The filename
+ * @param {string} mimetype - The MIME type
+ * @param {string[]} allowedTypes - Array of allowed MIME types
+ * @returns {boolean} - True if file type is valid
+ */
+function validateFileType(filename, mimetype, allowedTypes) {
+  // Check if MIME type is allowed
+  if (!allowedTypes.includes(mimetype)) {
+    return false;
+  }
+  
+  // Get file extension
+  const ext = path.extname(filename).toLowerCase();
+  
+  // Check if extension matches the MIME type
+  const typeConfig = ALLOWED_IMAGE_TYPES[mimetype];
+  if (!typeConfig || !typeConfig.extensions.includes(ext)) {
+    return false;
+  }
+  
+  return true;
+}
+
+/**
+ * Validate file content by checking magic numbers (file signatures)
+ * @param {string} filePath - Path to the file
+ * @param {string} expectedMimeType - Expected MIME type
+ * @returns {Promise<boolean>} - True if file content matches expected type
+ */
+async function validateFileContent(filePath, expectedMimeType) {
+  try {
+    const typeConfig = ALLOWED_IMAGE_TYPES[expectedMimeType];
+    if (!typeConfig) {
+      return false;
+    }
+    
+    // Skip validation for file types without magic numbers (like SVG)
+    if (!typeConfig.magicNumbers) {
+      return true;
+    }
+    
+    // Read the first 20 bytes of the file (enough for most magic numbers)
+    const buffer = Buffer.alloc(20);
+    const fileHandle = await fs.open(filePath, 'r');
+    await fileHandle.read(buffer, 0, 20, 0);
+    await fileHandle.close();
+    
+    // Check magic numbers
+    return typeConfig.magicNumbers.every(magic => {
+      for (let i = 0; i < magic.bytes.length; i++) {
+        if (buffer[magic.offset + i] !== magic.bytes[i]) {
+          return false;
+        }
+      }
+      return true;
+    });
+  } catch (error) {
+    console.error('Error validating file content:', error);
+    return false;
+  }
+}
+
+/**
+ * Get safe filename for storage
+ * @param {string} originalFilename - Original filename
+ * @returns {string} - Safe filename
+ */
+function getSafeFilename(originalFilename) {
+  const timestamp = Date.now();
+  const randomString = Math.random().toString(36).substring(2, 15);
+  const ext = path.extname(originalFilename).toLowerCase();
+  
+  // Validate extension
+  const validExtensions = ['.jpg', '.jpeg', '.png', '.webp', '.gif', '.svg', '.ico'];
+  if (!validExtensions.includes(ext)) {
+    throw new Error('Invalid file extension');
+  }
+  
+  return `upload_${timestamp}_${randomString}${ext}`;
+}
+
+/**
+ * Create a file upload validator middleware
+ * @param {Object} options - Validation options
+ * @returns {Function} - Express middleware function
+ */
+function createFileUploadValidator(options = {}) {
+  const {
+    allowedTypes = ['image/jpeg', 'image/png', 'image/webp'],
+    maxFileSize = 50 * 1024 * 1024, // 50MB default
+    validateContent = true
+  } = options;
+  
+  return async (req, res, next) => {
+    try {
+      if (!req.files || req.files.length === 0) {
+        return next();
+      }
+      
+      for (const file of req.files) {
+        // Validate file type
+        if (!validateFileType(file.originalname, file.mimetype, allowedTypes)) {
+          return res.status(400).json({ 
+            error: `Invalid file type: ${file.originalname}. Allowed types: ${allowedTypes.join(', ')}` 
+          });
+        }
+        
+        // Validate file size
+        if (file.size > maxFileSize) {
+          return res.status(400).json({ 
+            error: `File too large: ${file.originalname}. Maximum size: ${maxFileSize / 1024 / 1024}MB` 
+          });
+        }
+        
+        // Validate file content if enabled
+        if (validateContent && file.path) {
+          const isValidContent = await validateFileContent(file.path, file.mimetype);
+          if (!isValidContent) {
+            // Remove the file if content doesn't match
+            try {
+              await fs.unlink(file.path);
+            } catch (err) {
+              console.error('Error removing invalid file:', err);
+            }
+            return res.status(400).json({ 
+              error: `File content does not match declared type: ${file.originalname}` 
+            });
+          }
+        }
+      }
+      
+      next();
+    } catch (error) {
+      console.error('File validation error:', error);
+      res.status(500).json({ error: 'File validation failed' });
+    }
+  };
+}
+
+module.exports = {
+  safePathJoin,
+  isPathSafe,
+  validateFileType,
+  validateFileContent,
+  getSafeFilename,
+  createFileUploadValidator,
+  ALLOWED_IMAGE_TYPES
+};

backend/src/utils/filenameSanitizer.js

@@ -0,0 +1,57 @@
+/**
+ * Sanitize a string to be used as a filename component
+ * @param {string} str - The string to sanitize
+ * @param {number} maxLength - Maximum length of the sanitized string
+ * @returns {string} - Sanitized string
+ */
+function sanitizeFilename(str, maxLength = 50) {
+  if (!str) return 'unnamed';
+  
+  // Convert to string and trim
+  let sanitized = String(str).trim();
+  
+  // Replace spaces with underscores
+  sanitized = sanitized.replace(/\s+/g, '_');
+  
+  // Remove special characters except hyphens, underscores, and dots
+  sanitized = sanitized.replace(/[^a-zA-Z0-9_\-\.]/g, '');
+  
+  // Remove multiple consecutive underscores or hyphens
+  sanitized = sanitized.replace(/[_\-]{2,}/g, '_');
+  
+  // Remove leading/trailing underscores or hyphens
+  sanitized = sanitized.replace(/^[_\-]+|[_\-]+$/g, '');
+  
+  // Limit length
+  if (sanitized.length > maxLength) {
+    sanitized = sanitized.substring(0, maxLength);
+  }
+  
+  // If empty after sanitization, use default
+  if (!sanitized) {
+    sanitized = 'unnamed';
+  }
+  
+  return sanitized;
+}
+
+/**
+ * Generate a photo filename based on event name, category, and counter
+ * @param {string} eventName - The event name
+ * @param {string} categoryName - The category name
+ * @param {number} counter - The photo counter
+ * @param {string} extension - The file extension (including dot)
+ * @returns {string} - Generated filename
+ */
+function generatePhotoFilename(eventName, categoryName, counter, extension) {
+  const sanitizedEvent = sanitizeFilename(eventName, 30);
+  const sanitizedCategory = sanitizeFilename(categoryName || 'uncategorized', 20);
+  const paddedCounter = String(counter).padStart(4, '0');
+  
+  return `${sanitizedEvent}_${sanitizedCategory}_${paddedCounter}${extension}`;
+}
+
+module.exports = {
+  sanitizeFilename,
+  generatePhotoFilename
+};

backend/src/utils/formatters.js

@@ -0,0 +1,40 @@
+/**
+ * Formatters for email content and other text transformations
+ */
+
+/**
+ * Convert plain text line breaks to HTML line breaks
+ * @param {string} text - The text to format
+ * @returns {string} - Text with HTML line breaks
+ */
+function nl2br(text) {
+  if (!text) return '';
+  
+  // Normalize line endings
+  text = text.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+  
+  // Convert newlines to <br> tags
+  return text
+    .split('\n')
+    .map(line => line.trim())
+    .filter(line => line.length > 0)
+    .join('<br />');
+}
+
+/**
+ * Format welcome message for email templates
+ * @param {string} message - The welcome message
+ * @returns {string} - Formatted message for HTML emails
+ */
+function formatWelcomeMessage(message) {
+  if (!message || message.trim() === '') {
+    return '';
+  }
+  
+  return nl2br(message);
+}
+
+module.exports = {
+  nl2br,
+  formatWelcomeMessage
+};

backend/src/utils/logger.js

@@ -0,0 +1,98 @@
+const winston = require('winston');
+const path = require('path');
+const fs = require('fs');
+
+// Ensure logs directory exists
+const logDir = path.join(__dirname, '../../logs');
+if (!fs.existsSync(logDir)) {
+  fs.mkdirSync(logDir, { recursive: true });
+}
+
+// Custom format for production logs
+const productionFormat = winston.format.combine(
+  winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss.SSS' }),
+  winston.format.errors({ stack: true }),
+  winston.format.json(),
+  winston.format.printf(info => {
+    // Ensure all security events are properly formatted
+    if (info.level === 'warn' && (info.message.includes('rate limit') || 
+                                   info.message.includes('auth') ||
+                                   info.message.includes('login') ||
+                                   info.message.includes('JWT'))) {
+      return JSON.stringify({
+        timestamp: info.timestamp,
+        level: info.level,
+        message: info.message,
+        security: true,
+        ...info
+      });
+    }
+    return JSON.stringify(info);
+  })
+);
+
+const logger = winston.createLogger({
+  level: process.env.LOG_LEVEL || 'info',
+  format: productionFormat,
+  transports: [
+    new winston.transports.File({ 
+      filename: path.join(logDir, 'error.log'), 
+      level: 'error',
+      maxsize: 10 * 1024 * 1024, // 10MB
+      maxFiles: 5,
+      tailable: true
+    }),
+    new winston.transports.File({ 
+      filename: path.join(logDir, 'combined.log'),
+      maxsize: 50 * 1024 * 1024, // 50MB
+      maxFiles: 10,
+      tailable: true
+    }),
+    // Separate security log for authentication and rate limiting
+    new winston.transports.File({
+      filename: path.join(logDir, 'security.log'),
+      level: 'warn',
+      maxsize: 20 * 1024 * 1024, // 20MB
+      maxFiles: 10,
+      tailable: true,
+      format: winston.format.combine(
+        winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss.SSS' }),
+        winston.format.json(),
+        winston.format.printf(info => {
+          // Only log security-related warnings
+          if (info.message.includes('rate limit') || 
+              info.message.includes('auth') ||
+              info.message.includes('login') ||
+              info.message.includes('JWT') ||
+              info.message.includes('lockout') ||
+              info.message.includes('suspicious')) {
+            return JSON.stringify(info);
+          }
+          return null;
+        })
+      )
+    })
+  ].filter(Boolean)
+});
+
+// Add console logging for non-production environments
+if (process.env.NODE_ENV !== 'production') {
+  logger.add(new winston.transports.Console({
+    format: winston.format.combine(
+      winston.format.colorize(),
+      winston.format.timestamp({ format: 'HH:mm:ss' }),
+      winston.format.printf(info => {
+        return `[${info.timestamp}] ${info.level}: ${info.message} ${info.stack || ''}`;
+      })
+    )
+  }));
+} else {
+  // In production, also log to console for container environments
+  if (process.env.LOG_TO_CONSOLE === 'true') {
+    logger.add(new winston.transports.Console({
+      format: productionFormat
+    }));
+  }
+}
+
+module.exports = logger;

backend/src/utils/passwordGenerator.js

@@ -0,0 +1,122 @@
+const crypto = require('crypto');
+
+/**
+ * Generate a secure random password
+ * @param {number} length - Password length (default: 16)
+ * @returns {string} Generated password
+ */
+function generateSecurePassword(length = 16) {
+  const charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+-=[]{}|;:,.<>?';
+  let password = '';
+  
+  // Ensure at least one of each required character type
+  const lowercase = 'abcdefghijklmnopqrstuvwxyz';
+  const uppercase = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+  const numbers = '0123456789';
+  const special = '!@#$%^&*()_+-=[]{}|;:,.<>?';
+  
+  // Add one of each required type
+  password += lowercase[crypto.randomInt(lowercase.length)];
+  password += uppercase[crypto.randomInt(uppercase.length)];
+  password += numbers[crypto.randomInt(numbers.length)];
+  password += special[crypto.randomInt(special.length)];
+  
+  // Fill the rest randomly
+  for (let i = password.length; i < length; i++) {
+    password += charset[crypto.randomInt(charset.length)];
+  }
+  
+  // Shuffle the password
+  return password.split('').sort(() => crypto.randomInt(3) - 1).join('');
+}
+
+/**
+ * Generate a human-readable password using words and numbers
+ * @returns {string} Generated password
+ */
+function generateReadablePassword() {
+  const adjectives = [
+    'Swift', 'Bright', 'Strong', 'Happy', 'Clever',
+    'Brave', 'Noble', 'Quick', 'Sharp', 'Bold'
+  ];
+  
+  const nouns = [
+    'Eagle', 'Mountain', 'River', 'Thunder', 'Forest',
+    'Ocean', 'Falcon', 'Dragon', 'Phoenix', 'Tiger'
+  ];
+  
+  const adjective = adjectives[crypto.randomInt(adjectives.length)];
+  const noun = nouns[crypto.randomInt(nouns.length)];
+  const number = crypto.randomInt(1000, 9999);
+  const special = '!@#$%'[crypto.randomInt(5)];
+  
+  return `${adjective}${noun}${number}${special}`;
+}
+
+/**
+ * Validate password strength
+ * @param {string} password - Password to validate
+ * @returns {object} Validation result with score and messages
+ */
+function validatePasswordStrength(password) {
+  const result = {
+    score: 0,
+    messages: [],
+    isValid: false
+  };
+  
+  // Length check
+  if (password.length < 8) {
+    result.messages.push('Password must be at least 8 characters long');
+  } else if (password.length < 12) {
+    result.score += 1;
+  } else {
+    result.score += 2;
+  }
+  
+  // Character type checks
+  if (!/[a-z]/.test(password)) {
+    result.messages.push('Password must contain lowercase letters');
+  } else {
+    result.score += 1;
+  }
+  
+  if (!/[A-Z]/.test(password)) {
+    result.messages.push('Password must contain uppercase letters');
+  } else {
+    result.score += 1;
+  }
+  
+  if (!/[0-9]/.test(password)) {
+    result.messages.push('Password must contain numbers');
+  } else {
+    result.score += 1;
+  }
+  
+  if (!/[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]/.test(password)) {
+    result.messages.push('Password must contain special characters');
+  } else {
+    result.score += 1;
+  }
+  
+  // Common password check
+  const commonPasswords = [
+    'password', 'admin123', '12345678', 'qwerty', 'abc123',
+    'password123', 'admin', 'letmein', 'welcome', 'monkey'
+  ];
+  
+  if (commonPasswords.includes(password.toLowerCase())) {
+    result.score = 0;
+    result.messages.push('Password is too common');
+  }
+  
+  result.isValid = result.score >= 4 && result.messages.length === 0;
+  
+  return result;
+}
+
+module.exports = {
+  generateSecurePassword,
+  generateReadablePassword,
+  validatePasswordStrength
+};

backend/src/utils/passwordValidation.js

@@ -0,0 +1,285 @@
+/**
+ * Password Validation and Security Utilities
+ * Implements strong password requirements and security checks
+ */
+
+const zxcvbn = require('zxcvbn');
+const logger = require('./logger');
+
+// Configuration
+const PASSWORD_CONFIG = {
+  minLength: 8, // Reduced from 12 to 8 for better usability
+  requireUppercase: true,
+  requireLowercase: true,
+  requireNumbers: true,
+  requireSpecialChars: false, // Made optional for gallery passwords
+  preventCommonPasswords: true,
+  minStrengthScore: 2, // Reduced from 3 to 2 (moderate strength)
+  bcryptRounds: parseInt(process.env.BCRYPT_ROUNDS) || 12 // Configurable, default 12
+};
+
+// Common passwords to block (extend this list)
+const COMMON_PASSWORDS = [
+  'password', 'password123', 'admin123', 'welcome123', 'test123',
+  'qwerty', 'abc123', '123456', 'password1', 'admin',
+  'letmein', 'welcome', 'monkey', 'dragon', 'baseball'
+];
+
+/**
+ * Validate password meets security requirements
+ * @param {string} password - Password to validate
+ * @param {Object} options - Optional configuration overrides
+ * @returns {Object} - { valid: boolean, errors: string[], score: number, feedback: Object }
+ */
+function validatePassword(password, options = {}) {
+  const config = { ...PASSWORD_CONFIG, ...options };
+  const errors = [];
+  
+  // Check if password exists
+  if (!password || typeof password !== 'string') {
+    return {
+      valid: false,
+      errors: ['Password is required'],
+      score: 0,
+      feedback: {}
+    };
+  }
+  
+  // Check minimum length
+  if (password.length < config.minLength) {
+    errors.push(`Password must be at least ${config.minLength} characters long`);
+  }
+  
+  // Check uppercase requirement
+  if (config.requireUppercase && !/[A-Z]/.test(password)) {
+    errors.push('Password must contain at least one uppercase letter');
+  }
+  
+  // Check lowercase requirement
+  if (config.requireLowercase && !/[a-z]/.test(password)) {
+    errors.push('Password must contain at least one lowercase letter');
+  }
+  
+  // Check number requirement
+  if (config.requireNumbers && !/[0-9]/.test(password)) {
+    errors.push('Password must contain at least one number');
+  }
+  
+  // Check special character requirement
+  if (config.requireSpecialChars && !/[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password)) {
+    errors.push('Password must contain at least one special character');
+  }
+  
+  // Check against common passwords
+  if (config.preventCommonPasswords) {
+    const lowerPassword = password.toLowerCase();
+    if (COMMON_PASSWORDS.includes(lowerPassword)) {
+      errors.push('This password is too common. Please choose a more unique password');
+    }
+  }
+  
+  // Skip zxcvbn check if explicitly disabled (for gallery passwords)
+  if (options.skipStrengthCheck) {
+    return {
+      valid: errors.length === 0,
+      errors,
+      score: 2, // Default moderate score for gallery passwords
+      feedback: {}
+    };
+  }
+  
+  // Use zxcvbn for strength analysis
+  const strength = zxcvbn(password);
+  
+  // Check minimum strength score
+  if (strength.score < config.minStrengthScore) {
+    errors.push('Password is too weak. Please choose a stronger password');
+  }
+  
+  // Add zxcvbn suggestions
+  if (strength.feedback.suggestions.length > 0) {
+    errors.push(...strength.feedback.suggestions);
+  }
+  
+  return {
+    valid: errors.length === 0,
+    errors,
+    score: strength.score,
+    feedback: {
+      warning: strength.feedback.warning,
+      suggestions: strength.feedback.suggestions,
+      crackTime: strength.crack_times_display.offline_slow_hashing_1e4_per_second
+    }
+  };
+}
+
+/**
+ * Validate password for specific contexts (admin, gallery)
+ * @param {string} password - Password to validate
+ * @param {string} context - Context ('admin' or 'gallery')
+ * @param {Object} userData - Additional user data for context-aware validation
+ * @returns {Object} - Validation result
+ */
+function validatePasswordInContext(password, context, userData = {}) {
+  // For gallery context, use more lenient validation
+  if (context === 'gallery') {
+    // Gallery-specific validation options
+    const galleryOptions = {
+      minLength: 6, // Reduced minimum length
+      requireUppercase: false, // Don't require uppercase for galleries
+      requireLowercase: false, // Don't require lowercase for galleries
+      requireNumbers: false, // Numbers are optional
+      requireSpecialChars: false, // Special chars are optional
+      preventCommonPasswords: true, // Still prevent common passwords
+      minStrengthScore: 0, // Accept any score for galleries
+      skipStrengthCheck: true // Skip zxcvbn strength analysis for galleries
+    };
+    
+    // Base validation with gallery-specific options
+    const result = validatePassword(password, galleryOptions);
+    
+    // Override validation for common date formats
+    // Allow passwords like "04.07.2025", "04/07/2025", "04-07-2025"
+    const datePattern = /^\d{1,2}[.\/-]\d{1,2}[.\/-]\d{4}$/;
+    if (datePattern.test(password)) {
+      // Date format is valid for gallery passwords
+      return {
+        valid: true,
+        errors: [],
+        score: 2,
+        feedback: {}
+      };
+    }
+    
+    // Additional gallery-specific checks
+    if (password.length < 6) {
+      result.valid = false;
+      result.errors = ['Password must be at least 6 characters long'];
+    }
+    
+    // Check if it's too simple (e.g., just "123456")
+    if (/^\d{1,6}$/.test(password)) {
+      result.valid = false;
+      result.errors.push('Password cannot be just numbers. Consider using a date format like "04.07.2025"');
+    }
+    
+    return result;
+  }
+  
+  // Base validation for other contexts
+  const result = validatePassword(password);
+  
+  // Context-specific validation
+  if (context === 'admin') {
+    // Admins need stronger passwords
+    if (result.score < 4) {
+      result.valid = false;
+      result.errors.push('Admin passwords must be very strong (score 4/4)');
+    }
+    
+    // Check password doesn't contain username
+    if (userData.username && password.toLowerCase().includes(userData.username.toLowerCase())) {
+      result.valid = false;
+      result.errors.push('Password must not contain your username');
+    }
+    
+    // Check password doesn't contain email
+    if (userData.email) {
+      const emailUser = userData.email.split('@')[0];
+      if (password.toLowerCase().includes(emailUser.toLowerCase())) {
+        result.valid = false;
+        result.errors.push('Password must not contain parts of your email');
+      }
+    }
+  }
+  
+  return result;
+}
+
+/**
+ * Generate a secure random password
+ * @param {Object} options - Generation options
+ * @returns {string} - Generated password
+ */
+function generateSecurePassword(options = {}) {
+  const config = {
+    length: options.length || 16,
+    includeUppercase: options.includeUppercase !== false,
+    includeLowercase: options.includeLowercase !== false,
+    includeNumbers: options.includeNumbers !== false,
+    includeSpecialChars: options.includeSpecialChars !== false,
+    excludeAmbiguous: options.excludeAmbiguous !== false
+  };
+  
+  let charset = '';
+  
+  if (config.includeLowercase) {
+    charset += config.excludeAmbiguous ? 'abcdefghjkmnpqrstuvwxyz' : 'abcdefghijklmnopqrstuvwxyz';
+  }
+  
+  if (config.includeUppercase) {
+    charset += config.excludeAmbiguous ? 'ABCDEFGHJKLMNPQRSTUVWXYZ' : 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+  }
+  
+  if (config.includeNumbers) {
+    charset += config.excludeAmbiguous ? '23456789' : '0123456789';
+  }
+  
+  if (config.includeSpecialChars) {
+    charset += '!@#$%^&*()_+-=[]{}|;:,.<>?';
+  }
+  
+  if (charset.length === 0) {
+    throw new Error('At least one character type must be included');
+  }
+  
+  // Generate password
+  const crypto = require('crypto');
+  let password = '';
+  
+  for (let i = 0; i < config.length; i++) {
+    const randomIndex = crypto.randomInt(charset.length);
+    password += charset[randomIndex];
+  }
+  
+  // Ensure password meets requirements
+  const validation = validatePassword(password);
+  if (!validation.valid) {
+    // Recursively generate until we get a valid password
+    return generateSecurePassword(options);
+  }
+  
+  return password;
+}
+
+/**
+ * Get bcrypt rounds configuration
+ * @returns {number} - Number of bcrypt rounds to use
+ */
+function getBcryptRounds() {
+  return PASSWORD_CONFIG.bcryptRounds;
+}
+
+/**
+ * Log password validation failures for security monitoring
+ * @param {string} context - Context of validation failure
+ * @param {Array} errors - Validation errors
+ * @param {Object} metadata - Additional metadata
+ */
+function logPasswordValidationFailure(context, errors, metadata = {}) {
+  logger.warn('Password validation failed', {
+    context,
+    errorCount: errors.length,
+    errors: errors.slice(0, 3), // Log first 3 errors only
+    ...metadata
+  });
+}
+
+module.exports = {
+  validatePassword,
+  validatePasswordInContext,
+  generateSecurePassword,
+  getBcryptRounds,
+  logPasswordValidationFailure,
+  PASSWORD_CONFIG
+};

backend/src/utils/rateLimitSecurity.js

@@ -0,0 +1,119 @@
+/**
+ * Rate Limiting Security Utilities
+ * Provides secure rate limiting that prevents bypass attempts
+ */
+
+const jwt = require('jsonwebtoken');
+const logger = require('./logger');
+
+/**
+ * Safely check if a request has a valid admin token
+ * Used to determine if rate limiting should be skipped
+ * 
+ * IMPORTANT: This prevents the bypass vulnerability where
+ * invalid tokens could skip rate limiting
+ * 
+ * @param {Object} req - Express request object
+ * @returns {boolean} - True only if token is valid AND admin type
+ */
+function hasValidAdminToken(req) {
+  try {
+    // Only check admin paths
+    if (!req.path.startsWith('/api/admin/')) {
+      return false;
+    }
+
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return false;
+    }
+
+    const token = authHeader.substring(7); // Remove 'Bearer ' prefix
+    
+    // Critical: Verify token is valid before skipping rate limit
+    // This prevents invalid tokens from bypassing rate limiting
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    
+    // Additional validation
+    if (!decoded || typeof decoded !== 'object') {
+      return false;
+    }
+    
+    // Must be admin type to skip rate limiting
+    if (decoded.type !== 'admin') {
+      logger.warn('Non-admin token attempted to bypass rate limit', {
+        path: req.path,
+        tokenType: decoded.type,
+        ip: req.ip
+      });
+      return false;
+    }
+    
+    // Optional: Check token age (prevent old tokens)
+    const tokenAge = Date.now() - (decoded.iat * 1000);
+    const maxAge = 24 * 60 * 60 * 1000; // 24 hours
+    
+    if (tokenAge > maxAge) {
+      logger.warn('Old admin token attempted to bypass rate limit', {
+        path: req.path,
+        tokenAge: Math.floor(tokenAge / 1000 / 60) + ' minutes',
+        ip: req.ip
+      });
+      return false;
+    }
+    
+    // Valid admin token - can skip rate limiting
+    return true;
+    
+  } catch (error) {
+    // Any error means token is invalid
+    // Log attempts with invalid tokens (potential attacks)
+    if (error.name === 'JsonWebTokenError') {
+      logger.warn('Invalid token attempted to bypass rate limit', {
+        path: req.path,
+        error: error.message,
+        ip: req.ip
+      });
+    }
+    
+    // Apply rate limiting for any invalid token
+    return false;
+  }
+}
+
+/**
+ * Create a skip function for rate limiter that prevents bypass
+ * @returns {Function} Skip function for express-rate-limit
+ */
+function createSecureSkipFunction() {
+  return (req) => {
+    // In development, be more lenient with public settings
+    if (process.env.NODE_ENV === 'development' && req.path === '/api/public/settings') {
+      return true;
+    }
+    
+    // Only skip for valid admin tokens
+    return hasValidAdminToken(req);
+  };
+}
+
+/**
+ * Log rate limit hits for security monitoring
+ * @param {Object} req - Express request object
+ * @param {Object} res - Express response object
+ */
+function logRateLimitHit(req, res) {
+  logger.warn('Rate limit exceeded', {
+    ip: req.ip,
+    path: req.path,
+    userAgent: req.headers['user-agent'],
+    remaining: res.getHeader('X-RateLimit-Remaining'),
+    limit: res.getHeader('X-RateLimit-Limit')
+  });
+}
+
+module.exports = {
+  hasValidAdminToken,
+  createSecureSkipFunction,
+  logRateLimitHit
+};

backend/src/utils/sqlSecurity.js

@@ -0,0 +1,117 @@
+/**
+ * SQL Security Utilities
+ * Provides safe methods for handling user input in SQL queries
+ */
+
+/**
+ * Validate and sanitize days parameter for date range queries
+ * @param {any} days - The days parameter from user input
+ * @returns {number} Safe integer between 1 and 365
+ */
+function sanitizeDays(days) {
+  const parsed = parseInt(days);
+  
+  // Check if it's a valid number
+  if (isNaN(parsed)) {
+    return 7; // Default to 7 days
+  }
+  
+  // Ensure it's within reasonable bounds
+  if (parsed < 1) {
+    return 1;
+  }
+  
+  if (parsed > 365) {
+    return 365; // Maximum 1 year
+  }
+  
+  return parsed;
+}
+
+/**
+ * Escape special characters in LIKE queries
+ * @param {string} input - The search string from user input
+ * @returns {string} Escaped string safe for LIKE queries
+ */
+function escapeLikePattern(input) {
+  if (!input || typeof input !== 'string') {
+    return '';
+  }
+  
+  // Escape special LIKE pattern characters
+  // In SQL LIKE patterns:
+  // % matches any sequence of characters
+  // _ matches any single character
+  // \ is the escape character
+  return input
+    .replace(/\\/g, '\\\\') // Escape backslashes first
+    .replace(/%/g, '\\%')   // Escape percent signs
+    .replace(/_/g, '\\_')   // Escape underscores
+    .replace(/'/g, '\'\'');   // Escape single quotes for safety
+}
+
+/**
+ * Create a safe date range condition using Knex
+ * @param {object} query - Knex query builder instance
+ * @param {string} column - The timestamp column name
+ * @param {number} days - Number of days to go back
+ * @returns {object} Modified query with safe date range condition
+ */
+function addDateRangeCondition(query, column, days) {
+  const safeDays = sanitizeDays(days);
+  const startDate = new Date();
+  startDate.setDate(startDate.getDate() - safeDays);
+  
+  // Use Knex's built-in date comparison which handles parameterization
+  return query.where(column, '>=', startDate.toISOString());
+}
+
+/**
+ * Create a safe LIKE condition using Knex
+ * @param {object} query - Knex query builder instance
+ * @param {string} column - The column to search
+ * @param {string} pattern - The search pattern
+ * @returns {object} Modified query with safe LIKE condition
+ */
+function addLikeCondition(query, column, pattern) {
+  if (!pattern || typeof pattern !== 'string') {
+    return query;
+  }
+  
+  const escapedPattern = escapeLikePattern(pattern);
+  // Knex handles parameterization of the LIKE value
+  return query.where(column, 'like', `%${escapedPattern}%`);
+}
+
+/**
+ * Validate sort column against whitelist
+ * @param {string} column - The column name to sort by
+ * @param {string[]} allowedColumns - Array of allowed column names
+ * @param {string} defaultColumn - Default column if invalid
+ * @returns {string} Safe column name
+ */
+function validateSortColumn(column, allowedColumns, defaultColumn) {
+  if (!column || !allowedColumns.includes(column)) {
+    return defaultColumn;
+  }
+  return column;
+}
+
+/**
+ * Validate sort order
+ * @param {string} order - The sort order (asc/desc)
+ * @returns {string} Safe sort order
+ */
+function validateSortOrder(order) {
+  const lowerOrder = (order || '').toLowerCase();
+  return lowerOrder === 'asc' ? 'asc' : 'desc';
+}
+
+module.exports = {
+  sanitizeDays,
+  escapeLikePattern,
+  addDateRangeCondition,
+  addLikeCondition,
+  validateSortColumn,
+  validateSortOrder
+};

backend/src/utils/tokenRevocation.js

@@ -0,0 +1,133 @@
+/**
+ * Token Revocation System
+ * Provides ability to invalidate tokens before expiration
+ */
+
+const { db } = require('../database/db');
+const logger = require('./logger');
+
+/**
+ * Add a token to the revocation list
+ * @param {string} token - JWT token to revoke
+ * @param {string} reason - Reason for revocation
+ * @param {Object} metadata - Additional metadata
+ */
+async function revokeToken(token, reason, metadata = {}) {
+  try {
+    // Extract token info without full verification (it might be compromised)
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+      throw new Error('Invalid token format');
+    }
+    
+    // Decode payload
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+    
+    await db('revoked_tokens').insert({
+      token_id: payload.jti || `${payload.id}-${payload.iat}`, // JWT ID or fallback
+      user_id: payload.id,
+      token_type: payload.type,
+      revoked_at: new Date().toISOString(),
+      expires_at: new Date(payload.exp * 1000).toISOString(),
+      reason,
+      metadata: JSON.stringify(metadata)
+    });
+    
+    logger.info('Token revoked', {
+      userId: payload.id,
+      tokenType: payload.type,
+      reason
+    });
+    
+    return true;
+  } catch (error) {
+    logger.error('Failed to revoke token', error);
+    return false;
+  }
+}
+
+/**
+ * Check if a token is revoked
+ * @param {Object} decodedToken - Decoded JWT payload
+ * @returns {boolean} - True if token is revoked
+ */
+async function isTokenRevoked(decodedToken) {
+  try {
+    const tokenId = decodedToken.jti || `${decodedToken.id}-${decodedToken.iat}`;
+    
+    const revoked = await db('revoked_tokens')
+      .where('token_id', tokenId)
+      .orWhere((builder) => {
+        builder
+          .where('user_id', decodedToken.id)
+          .where('revoked_at', '<=', new Date(decodedToken.iat * 1000).toISOString());
+      })
+      .first();
+    
+    return !!revoked;
+  } catch (error) {
+    logger.error('Failed to check token revocation', error);
+    // Fail closed - treat as revoked if we can't check
+    return true;
+  }
+}
+
+/**
+ * Revoke all tokens for a user
+ * @param {number} userId - User ID
+ * @param {string} reason - Reason for revocation
+ */
+async function revokeAllUserTokens(userId, reason) {
+  try {
+    // This effectively revokes all tokens by setting a revocation time
+    // Any token issued before this time will be considered revoked
+    await db('user_token_revocations').insert({
+      user_id: userId,
+      revoked_at: new Date().toISOString(),
+      reason
+    }).onConflict('user_id').merge();
+    
+    logger.info('All user tokens revoked', { userId, reason });
+    return true;
+  } catch (error) {
+    logger.error('Failed to revoke user tokens', error);
+    return false;
+  }
+}
+
+/**
+ * Clean up expired revoked tokens
+ * Should be run periodically
+ */
+async function cleanupExpiredRevocations() {
+  try {
+    const deleted = await db('revoked_tokens')
+      .where('expires_at', '<', new Date().toISOString())
+      .delete();
+    
+    if (deleted > 0) {
+      logger.info(`Cleaned up ${deleted} expired token revocations`);
+    }
+  } catch (error) {
+    logger.error('Failed to cleanup revoked tokens', error);
+  }
+}
+
+/**
+ * Initialize cleanup job for expired revocations
+ */
+function initializeRevocationCleanup() {
+  // Run cleanup every 6 hours
+  setInterval(cleanupExpiredRevocations, 6 * 60 * 60 * 1000);
+  
+  // Run initial cleanup
+  cleanupExpiredRevocations();
+}
+
+module.exports = {
+  revokeToken,
+  isTokenRevoked,
+  revokeAllUserTokens,
+  cleanupExpiredRevocations,
+  initializeRevocationCleanup
+};