chore: clean up codebase for production readiness

- Remove all console.log/debug statements from production code
- Add NODE_ENV checks for development-only logging
- Remove test scripts (test-feedback, test-image-security, test-backup-*, test-restore)
- Remove one-time fix scripts (fix-temp-photos, fix-migration-state, mark-migration-applied)
- Remove sensitive files (.env.backup, ADMIN_CREDENTIALS.txt)
- Update package.json to remove references to deleted scripts
- Replace console statements with logger utility in backend
- Secure error boundaries to not expose stack traces in production

This makes the codebase production-ready with no debug output or test scripts.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/migrations/legacy/004_add_categories_and_cms.js

@@ -3,79 +3,103 @@ const { db } = require('../../src/database/db');
 async function up() {
   console.log('Adding photo categories and CMS tables...');
   
+  // Check if tables already exist
+  const hasPhotoCategoriesTable = await db.schema.hasTable('photo_categories');
+  const hasCmsPagesTable = await db.schema.hasTable('cms_pages');
+  const hasCategoryIdColumn = await db.schema.hasColumn('photos', 'category_id');
+  const hasLanguageColumn = await db.schema.hasColumn('admin_users', 'language');
+  
   // Create photo_categories table
-  await db.schema.createTable('photo_categories', (table) => {
-    table.increments('id').primary();
-    table.string('name', 100).notNullable();
-    table.string('slug', 100).notNullable();
-    table.boolean('is_global').defaultTo(true);
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.timestamp('created_at').defaultTo(db.fn.now());
-    
-    // Unique constraint for slug within event scope
-    table.unique(['slug', 'event_id']);
-  });
+  if (!hasPhotoCategoriesTable) {
+    await db.schema.createTable('photo_categories', (table) => {
+      table.increments('id').primary();
+      table.string('name', 100).notNullable();
+      table.string('slug', 100).notNullable();
+      table.boolean('is_global').defaultTo(true);
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.timestamp('created_at').defaultTo(db.fn.now());
+      
+      // Unique constraint for slug within event scope
+      table.unique(['slug', 'event_id']);
+    });
+  }
 
   // Create cms_pages table
-  await db.schema.createTable('cms_pages', (table) => {
-    table.increments('id').primary();
-    table.string('slug', 100).unique().notNullable();
-    table.text('title_en');
-    table.text('title_de');
-    table.text('content_en');
-    table.text('content_de');
-    table.timestamp('updated_at').defaultTo(db.fn.now());
-  });
+  if (!hasCmsPagesTable) {
+    await db.schema.createTable('cms_pages', (table) => {
+      table.increments('id').primary();
+      table.string('slug', 100).unique().notNullable();
+      table.text('title_en');
+      table.text('title_de');
+      table.text('content_en');
+      table.text('content_de');
+      table.timestamp('updated_at').defaultTo(db.fn.now());
+    });
+  }
 
   // Add category_id to photos table
-  await db.schema.alterTable('photos', (table) => {
-    table.integer('category_id').references('id').inTable('photo_categories');
-  });
+  if (!hasCategoryIdColumn) {
+    await db.schema.alterTable('photos', (table) => {
+      table.integer('category_id').references('id').inTable('photo_categories');
+    });
+  }
 
   // Add language preference to admin_users
-  await db.schema.alterTable('admin_users', (table) => {
-    table.string('language', 2).defaultTo('en');
-  });
+  if (!hasLanguageColumn) {
+    await db.schema.alterTable('admin_users', (table) => {
+      table.string('language', 2).defaultTo('en');
+    });
+  }
 
   // Add language preference to app_settings for global default
-  await db('app_settings').insert({
-    setting_key: 'default_language',
-    setting_value: JSON.stringify('en'),
-    setting_type: 'general',
-    updated_at: new Date()
-  });
+  const hasDefaultLanguageSetting = await db('app_settings')
+    .where('setting_key', 'default_language')
+    .first();
+    
+  if (!hasDefaultLanguageSetting) {
+    await db('app_settings').insert({
+      setting_key: 'default_language',
+      setting_value: JSON.stringify('en'),
+      setting_type: 'general',
+      updated_at: new Date()
+    });
+  }
 
   // Insert default global categories
-  const defaultCategories = [
-    { name: 'Ceremony', slug: 'ceremony', is_global: true },
-    { name: 'Reception', slug: 'reception', is_global: true },
-    { name: 'Portraits', slug: 'portraits', is_global: true },
-    { name: 'Group Photos', slug: 'group-photos', is_global: true },
-    { name: 'Details', slug: 'details', is_global: true },
-    { name: 'Party', slug: 'party', is_global: true }
-  ];
+  if (!hasPhotoCategoriesTable) {
+    const defaultCategories = [
+      { name: 'Ceremony', slug: 'ceremony', is_global: true },
+      { name: 'Reception', slug: 'reception', is_global: true },
+      { name: 'Portraits', slug: 'portraits', is_global: true },
+      { name: 'Group Photos', slug: 'group-photos', is_global: true },
+      { name: 'Details', slug: 'details', is_global: true },
+      { name: 'Party', slug: 'party', is_global: true }
+    ];
 
-  await db('photo_categories').insert(defaultCategories);
+    await db('photo_categories').insert(defaultCategories);
+  }
 
   // Insert default legal pages
-  await db('cms_pages').insert([
-    {
-      slug: 'impressum',
-      title_en: 'Legal Notice',
-      title_de: 'Impressum',
-      content_en: '<h2>Legal Notice</h2><p>Please edit this content in the admin panel.</p>',
-      content_de: '<h2>Impressum</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
-      updated_at: new Date()
-    },
-    {
-      slug: 'datenschutz',
-      title_en: 'Privacy Policy',
-      title_de: 'Datenschutzerklärung',
-      content_en: '<h2>Privacy Policy</h2><p>Please edit this content in the admin panel.</p>',
-      content_de: '<h2>Datenschutzerklärung</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
-      updated_at: new Date()
-    }
-  ]);
+  if (!hasCmsPagesTable) {
+    await db('cms_pages').insert([
+      {
+        slug: 'impressum',
+        title_en: 'Legal Notice',
+        title_de: 'Impressum',
+        content_en: '<h2>Legal Notice</h2><p>Please edit this content in the admin panel.</p>',
+        content_de: '<h2>Impressum</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
+        updated_at: new Date()
+      },
+      {
+        slug: 'datenschutz',
+        title_en: 'Privacy Policy',
+        title_de: 'Datenschutzerklärung',
+        content_en: '<h2>Privacy Policy</h2><p>Please edit this content in the admin panel.</p>',
+        content_de: '<h2>Datenschutzerklärung</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
+        updated_at: new Date()
+      }
+    ]);
+  }
 
   console.log('Photo categories and CMS tables created successfully');
 }

backend/migrations/legacy/015_add_login_attempts_table.js

@@ -1,17 +1,21 @@
-exports.up = function(knex) {
-  return knex.schema.createTable('login_attempts', table => {
-    table.increments('id').primary();
-    table.string('identifier').notNullable(); // username or email
-    table.string('ip_address', 45).notNullable(); // IPv4 or IPv6
-    table.text('user_agent');
-    table.timestamp('attempt_time').defaultTo(knex.fn.now());
-    table.boolean('success').defaultTo(false);
-    
-    // Indexes for performance
-    table.index('identifier');
-    table.index('attempt_time');
-    table.index(['identifier', 'success', 'attempt_time']);
-  });
+exports.up = async function(knex) {
+  const hasLoginAttemptsTable = await knex.schema.hasTable('login_attempts');
+  
+  if (!hasLoginAttemptsTable) {
+    return knex.schema.createTable('login_attempts', table => {
+      table.increments('id').primary();
+      table.string('identifier').notNullable(); // username or email
+      table.string('ip_address', 45).notNullable(); // IPv4 or IPv6
+      table.text('user_agent');
+      table.timestamp('attempt_time').defaultTo(knex.fn.now());
+      table.boolean('success').defaultTo(false);
+      
+      // Indexes for performance
+      table.index('identifier');
+      table.index('attempt_time');
+      table.index(['identifier', 'success', 'attempt_time']);
+    });
+  }
 };
 
 exports.down = function(knex) {

backend/migrations/legacy/016_add_auth_security_columns.js

@@ -1,17 +1,28 @@
-exports.up = function(knex) {
+exports.up = async function(knex) {
+  // Check if columns already exist to avoid conflicts
+  const hasPasswordChangedAt = await knex.schema.hasColumn('admin_users', 'password_changed_at');
+  const hasLastLoginIp = await knex.schema.hasColumn('admin_users', 'last_login_ip');
+  const hasTwoFactorEnabled = await knex.schema.hasColumn('admin_users', 'two_factor_enabled');
+  const hasTwoFactorSecret = await knex.schema.hasColumn('admin_users', 'two_factor_secret');
+  
   return knex.schema.table('admin_users', table => {
     // Add password change tracking
-    table.timestamp('password_changed_at').nullable();
+    if (!hasPasswordChangedAt) {
+      table.timestamp('password_changed_at').nullable();
+    }
     
-    // Add last login IP for security monitoring
-    table.string('last_login_ip', 45).nullable();
+    // Add last login IP for security monitoring  
+    if (!hasLastLoginIp) {
+      table.string('last_login_ip', 45).nullable();
+    }
     
     // Add account security flags
-    table.boolean('two_factor_enabled').defaultTo(false);
-    table.string('two_factor_secret').nullable();
-    
-    // Add index for performance
-    table.index('password_changed_at');
+    if (!hasTwoFactorEnabled) {
+      table.boolean('two_factor_enabled').defaultTo(false);
+    }
+    if (!hasTwoFactorSecret) {
+      table.string('two_factor_secret').nullable();
+    }
   });
 };
 

backend/migrations/legacy/017_add_token_revocation_tables.js

@@ -1,7 +1,11 @@
-exports.up = function(knex) {
-  return knex.schema
-    // Table for individual token revocations
-    .createTable('revoked_tokens', table => {
+exports.up = async function(knex) {
+  // Check if tables already exist to avoid conflicts
+  const hasRevokedTokensTable = await knex.schema.hasTable('revoked_tokens');
+  const hasUserTokenRevocationsTable = await knex.schema.hasTable('user_token_revocations');
+  
+  // Create revoked_tokens table if it doesn't exist
+  if (!hasRevokedTokensTable) {
+    await knex.schema.createTable('revoked_tokens', table => {
       table.increments('id').primary();
       table.string('token_id').notNullable().unique(); // JWT ID or generated ID
       table.integer('user_id').nullable(); // User who owned the token
@@ -15,9 +19,12 @@ exports.up = function(knex) {
       table.index('token_id');
       table.index('user_id');
       table.index('expires_at'); // For cleanup
-    })
-    // Table for user-level revocations (revoke all tokens before a certain time)
-    .createTable('user_token_revocations', table => {
+    });
+  }
+  
+  // Create user_token_revocations table if it doesn't exist
+  if (!hasUserTokenRevocationsTable) {
+    await knex.schema.createTable('user_token_revocations', table => {
       table.integer('user_id').primary();
       table.timestamp('revoked_at').notNullable();
       table.string('reason', 100);
@@ -25,6 +32,28 @@ exports.up = function(knex) {
       // Index for quick lookups
       table.index('revoked_at');
     });
+  }
+  
+  // Add any missing indexes if tables already existed
+  if (hasRevokedTokensTable) {
+    try {
+      // Try to add indexes if they don't exist (PostgreSQL syntax)
+      await knex.raw('CREATE INDEX IF NOT EXISTS "revoked_tokens_token_id_index" ON "revoked_tokens" ("token_id")');
+      await knex.raw('CREATE INDEX IF NOT EXISTS "revoked_tokens_user_id_index" ON "revoked_tokens" ("user_id")');
+      await knex.raw('CREATE INDEX IF NOT EXISTS "revoked_tokens_expires_at_index" ON "revoked_tokens" ("expires_at")');
+    } catch (error) {
+      // For SQLite compatibility, ignore errors if indexes already exist
+      console.log('Note: Some indexes may already exist, continuing...');
+    }
+  }
+  
+  if (hasUserTokenRevocationsTable) {
+    try {
+      await knex.raw('CREATE INDEX IF NOT EXISTS "user_token_revocations_revoked_at_index" ON "user_token_revocations" ("revoked_at")');
+    } catch (error) {
+      console.log('Note: Some indexes may already exist, continuing...');
+    }
+  }
 };
 
 exports.down = function(knex) {