Initial commit - Project start (July 17, 2025)

Original: feat: enhance security logging and ensure rate limit blocks are properly tracked

- Add comprehensive logging for rate limit blocks with full request details
  - IP address (with proper proxy detection), user agent, headers, timestamps
  - Rate limit info (current count, limit, remaining, reset time)
  - Separate tracking for auth vs general endpoints

- Enhance authentication failure logging
  - JWT validation failures with detailed error info
  - Admin auth attempts without token
  - Failed token validation with user context
  - All events include IP, path, method, user agent

- Improve Winston logger configuration for production
  - Add automatic log rotation (10MB errors, 50MB combined)
  - Create separate security.log for auth/rate limit events
  - Ensure logs directory exists automatically
  - Add structured JSON format for log aggregation
  - Support container logging with LOG_TO_CONSOLE env var

- Create comprehensive documentation
  - Security logging guide with examples
  - Monitoring recommendations
  - Configuration reference

- Add test script to verify logging functionality

All rate limit settings remain configurable via admin panel:
- Window duration, max requests, auth limits
- Skip authenticated requests option
- Public endpoints only option

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

frontend/src/utils/cleanupGalleryAuth.ts

@@ -0,0 +1,8 @@
+// Cleanup function to remove old gallery authentication data
+export const cleanupOldGalleryAuth = () => {
+  // Remove old global gallery authentication
+  localStorage.removeItem('gallery_event');
+  
+  // Remove old gallery token from cookies if it exists
+  document.cookie = 'gallery_token=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;';
+};

frontend/src/utils/photoUrl.ts

@@ -0,0 +1,28 @@
+import { Photo } from '../types';
+
+interface PhotoUrlOptions {
+  slug: string;
+  photo: Photo;
+  watermarkEnabled?: boolean;
+  token?: string;
+}
+
+/**
+ * Get the appropriate URL for a photo, using watermarked endpoint if enabled
+ */
+export function getPhotoUrl({ slug, photo, watermarkEnabled = false, token }: PhotoUrlOptions): string {
+  if (watermarkEnabled && token) {
+    // Use the watermarked photo endpoint
+    return `/gallery/${slug}/photo/${photo.id}`;
+  }
+  
+  // Use the static photo URL
+  return photo.url;
+}
+
+/**
+ * Get the download URL for a photo
+ */
+export function getPhotoDownloadUrl(slug: string, photoId: number): string {
+  return `/gallery/${slug}/download/${photoId}`;
+}

frontend/src/utils/url.ts

@@ -0,0 +1,46 @@
+/**
+ * Utility functions for URL handling in production environments
+ */
+
+/**
+ * Get the base API URL, preferring relative URLs for production
+ * @returns The API base URL
+ */
+export const getApiBaseUrl = (): string => {
+  // If VITE_API_URL is explicitly set, use it
+  if (import.meta.env.VITE_API_URL && import.meta.env.VITE_API_URL !== '/api') {
+    return import.meta.env.VITE_API_URL;
+  }
+  
+  // In production, use relative URL
+  return '/api';
+};
+
+/**
+ * Build a full URL for resources (images, files, etc.)
+ * In production, this will use the current origin
+ * @param path - The resource path
+ * @returns The full URL
+ */
+export const buildResourceUrl = (path: string): string => {
+  // Remove leading slash if present
+  const cleanPath = path.startsWith('/') ? path.slice(1) : path;
+  
+  // If we have an explicit API URL that's not relative, use it
+  const apiUrl = import.meta.env.VITE_API_URL;
+  if (apiUrl && apiUrl !== '/api' && apiUrl.startsWith('http')) {
+    const baseUrl = apiUrl.replace(/\/api\/?$/, ''); // Remove /api suffix if present
+    return `${baseUrl}/${cleanPath}`;
+  }
+  
+  // In production (relative API), use current origin
+  return `${window.location.origin}/${cleanPath}`;
+};
+
+/**
+ * Check if we're in production mode (using relative URLs)
+ * @returns True if in production mode
+ */
+export const isProductionMode = (): boolean => {
+  return !import.meta.env.VITE_API_URL || import.meta.env.VITE_API_URL === '/api';
+};