Fix language setting not being saved to database on admin settings page

- Added default_language field to general settings state in SettingsPage
- Replaced LanguageSelector component with simple select dropdown on settings page
- Fixed public settings endpoint to read general_default_language from database
- Language setting now properly saved when clicking Save Settings button
- Setting is correctly used by gallery login page and legal pages

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/middleware/gallery.js

@@ -0,0 +1,29 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+
+// Middleware to verify gallery access
+async function verifyGalleryAccess(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    const event = await db('events').where({ id: decoded.eventId, is_active: true }).first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    req.event = event;
+    next();
+  } catch (error) {
+    console.error('Error verifying gallery access:', error);
+    res.status(401).json({ error: 'Invalid token', details: error.message });
+  }
+}
+
+module.exports = {
+  verifyGalleryAccess
+};

backend/src/middleware/photoAuth.js

@@ -1,13 +1,45 @@
 const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
 
 async function photoAuth(req, res, next) {
   try {
     const eventSlug = req.path.split('/')[1];
+    
+    // First check for JWT token (from gallery access)
+    const authHeader = req.headers.authorization;
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+      const token = authHeader.replace('Bearer ', '');
+      try {
+        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+        
+        // Check if it's a gallery token for this event
+        if (decoded.type === 'gallery' && decoded.eventSlug === eventSlug) {
+          const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
+          if (event) {
+            req.event = event;
+            return next();
+          }
+        }
+        
+        // Check if it's an admin token (admins can view all photos)
+        if (decoded.type === 'admin') {
+          const event = await db('events').where({ slug: eventSlug }).first();
+          if (event) {
+            req.event = event;
+            return next();
+          }
+        }
+      } catch (err) {
+        // Token invalid, fall through to password check
+      }
+    }
+    
+    // Check for password header (legacy support)
     const password = req.headers['x-gallery-password'];
     
-    if (!password) {
-      return res.status(401).json({ error: 'Password required' });
+    if (!password && !authHeader) {
+      return res.status(401).json({ error: 'Authentication required' });
     }
     
     const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
@@ -15,20 +47,26 @@ async function photoAuth(req, res, next) {
       return res.status(404).json({ error: 'Gallery not found' });
     }
     
-    const validPassword = await bcrypt.compare(password, event.password_hash);
-    if (!validPassword) {
-      await db('access_logs').insert({
-        event_id: event.id,
-        ip_address: req.ip,
-        user_agent: req.headers['user-agent'],
-        action: 'login_fail'
-      });
-      return res.status(401).json({ error: 'Invalid password' });
+    if (password) {
+      const validPassword = await bcrypt.compare(password, event.password_hash);
+      if (!validPassword) {
+        await db('access_logs').insert({
+          event_id: event.id,
+          ip_address: req.ip,
+          user_agent: req.headers['user-agent'],
+          action: 'login_fail'
+        });
+        return res.status(401).json({ error: 'Invalid password' });
+      }
+    } else {
+      // No valid authentication
+      return res.status(401).json({ error: 'Invalid authentication' });
     }
     
     req.event = event;
     next();
   } catch (error) {
+    console.error('Photo auth error:', error);
     res.status(500).json({ error: 'Authentication error' });
   }
 }