Fix brand theme application and add comprehensive translations

- Fixed theme not being reflected on gallery and admin login pages
- Created GlobalThemeProvider to apply themes globally
- Updated gallery and admin login pages to use dynamic CSS variables
- Added complete translations for all admin sections in English and German:
  - Notifications management
  - Event view and creation
  - Photo upload functionality
  - Category management
  - Archive page view
  - Analytics dashboard
  - Branding and theme settings
  - System settings
  - CMS page management
  - Email configuration
- Fixed admin photo management display issues
- Fixed photo upload category assignment
- Added password reset functionality for galleries
- Improved error handling and user feedback

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/middleware/maintenance.js

@@ -0,0 +1,73 @@
+const { db } = require('../database/db');
+
+// Cache maintenance mode status to avoid DB queries on every request
+let maintenanceMode = false;
+let lastCheck = 0;
+const CACHE_DURATION = 60000; // 1 minute
+
+async function checkMaintenanceMode() {
+  const now = Date.now();
+  
+  // Use cached value if recent
+  if (now - lastCheck < CACHE_DURATION) {
+    return maintenanceMode;
+  }
+  
+  try {
+    const setting = await db('app_settings')
+      .where('setting_key', 'general_maintenance_mode')
+      .where('setting_type', 'general')
+      .first();
+    
+    maintenanceMode = setting ? (setting.setting_value === 'true' || setting.setting_value === true) : false;
+    lastCheck = now;
+    
+    return maintenanceMode;
+  } catch (error) {
+    console.error('Error checking maintenance mode:', error);
+    return false;
+  }
+}
+
+// Middleware to enforce maintenance mode
+async function maintenanceMiddleware(req, res, next) {
+  // Skip maintenance check for certain paths
+  const skipPaths = [
+    '/api/admin/login',
+    '/api/admin/auth/login',
+    '/api/public/settings',
+    '/health'
+  ];
+  
+  // Allow static assets (uploads, favicons, logos)
+  const isStaticAsset = req.path.startsWith('/uploads/') || 
+                       req.path.startsWith('/favicons/') || 
+                       req.path.startsWith('/logos/');
+  
+  // Allow admin routes if admin is authenticated
+  const isAdminRoute = req.path.startsWith('/api/admin');
+  const hasAdminAuth = req.headers.authorization?.startsWith('Bearer ');
+  
+  if (skipPaths.includes(req.path) || isStaticAsset || (isAdminRoute && hasAdminAuth)) {
+    return next();
+  }
+  
+  const inMaintenance = await checkMaintenanceMode();
+  
+  if (inMaintenance && !isAdminRoute) {
+    return res.status(503).json({
+      error: 'Service Unavailable',
+      message: 'The system is currently undergoing maintenance. Please try again later.',
+      maintenance: true
+    });
+  }
+  
+  next();
+}
+
+// Function to clear cache when settings change
+function clearMaintenanceCache() {
+  lastCheck = 0;
+}
+
+module.exports = { maintenanceMiddleware, clearMaintenanceCache };

backend/src/middleware/photoAuth.js

@@ -4,7 +4,17 @@ const { db } = require('../database/db');
 
 async function photoAuth(req, res, next) {
   try {
-    const eventSlug = req.path.split('/')[1];
+    // Extract event slug from the path
+    let eventSlug;
+    
+    // For thumbnails, we need to parse the filename to get the event info
+    if (req.path.startsWith('/thumb_')) {
+      // For now, we'll rely on JWT token for thumbnail access
+      eventSlug = null;
+    } else {
+      // For regular photos, the slug is the first part of the path
+      eventSlug = req.path.split('/')[1];
+    }
     
     // First check for JWT token (from gallery access)
     const authHeader = req.headers.authorization;
@@ -13,17 +23,32 @@ async function photoAuth(req, res, next) {
       try {
         const decoded = jwt.verify(token, process.env.JWT_SECRET);
         
-        // Check if it's a gallery token for this event
-        if (decoded.type === 'gallery' && decoded.eventSlug === eventSlug) {
-          const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
-          if (event) {
-            req.event = event;
-            return next();
+        // Check if it's a gallery token
+        if (decoded.type === 'gallery') {
+          // For thumbnails, we accept any valid gallery token
+          if (!eventSlug) {
+            const event = await db('events').where({ slug: decoded.eventSlug, is_active: true }).first();
+            if (event) {
+              req.event = event;
+              return next();
+            }
+          }
+          // For regular photos, check if token matches the event
+          else if (decoded.eventSlug === eventSlug) {
+            const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
+            if (event) {
+              req.event = event;
+              return next();
+            }
           }
         }
         
         // Check if it's an admin token (admins can view all photos)
         if (decoded.type === 'admin') {
+          if (!eventSlug) {
+            // For thumbnails with admin token, allow access
+            return next();
+          }
           const event = await db('events').where({ slug: eventSlug }).first();
           if (event) {
             req.event = event;
@@ -42,6 +67,11 @@ async function photoAuth(req, res, next) {
       return res.status(401).json({ error: 'Authentication required' });
     }
     
+    // If no eventSlug (thumbnails), we require JWT token
+    if (!eventSlug) {
+      return res.status(401).json({ error: 'Authentication required for thumbnails' });
+    }
+    
     const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
     if (!event) {
       return res.status(404).json({ error: 'Gallery not found' });

backend/src/middleware/sessionTimeout.js

@@ -0,0 +1,122 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+
+// In-memory session tracking (in production, use Redis)
+const sessions = new Map();
+
+// Default session timeout (60 minutes)
+const DEFAULT_SESSION_TIMEOUT = 60 * 60 * 1000;
+
+// Clean up expired sessions every 5 minutes
+setInterval(() => {
+  const now = Date.now();
+  for (const [token, lastActivity] of sessions.entries()) {
+    if (now - lastActivity > DEFAULT_SESSION_TIMEOUT) {
+      sessions.delete(token);
+    }
+  }
+}, 5 * 60 * 1000);
+
+async function getSessionTimeout() {
+  try {
+    const setting = await db('app_settings')
+      .where('setting_key', 'security_session_timeout_minutes')
+      .first();
+    
+    if (setting && setting.setting_value) {
+      const minutes = parseInt(JSON.parse(setting.setting_value));
+      return minutes * 60 * 1000; // Convert to milliseconds
+    }
+  } catch (error) {
+    console.error('Error getting session timeout:', error);
+  }
+  
+  return DEFAULT_SESSION_TIMEOUT;
+}
+
+async function sessionTimeoutMiddleware(req, res, next) {
+  // Skip for non-authenticated routes
+  if (!req.headers.authorization) {
+    return next();
+  }
+  
+  const token = req.headers.authorization.split(' ')[1];
+  if (!token) {
+    return next();
+  }
+  
+  try {
+    // Verify token is valid
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    
+    // Check if this is an admin token
+    if (!decoded.id) {
+      return next();
+    }
+    
+    const now = Date.now();
+    const lastActivity = sessions.get(token);
+    const timeout = await getSessionTimeout();
+    
+    // If session exists, check if it's expired
+    if (lastActivity) {
+      if (now - lastActivity > timeout) {
+        sessions.delete(token);
+        return res.status(401).json({ 
+          error: 'Session expired', 
+          code: 'SESSION_TIMEOUT' 
+        });
+      }
+    }
+    
+    // Update last activity
+    sessions.set(token, now);
+    
+    // Clean up old token if user has a new one
+    // This prevents memory leaks from token renewals
+    const userId = decoded.id;
+    for (const [oldToken, _] of sessions.entries()) {
+      if (oldToken !== token) {
+        try {
+          const oldDecoded = jwt.verify(oldToken, process.env.JWT_SECRET);
+          if (oldDecoded.id === userId) {
+            sessions.delete(oldToken);
+          }
+        } catch (e) {
+          // Token is invalid, remove it
+          sessions.delete(oldToken);
+        }
+      }
+    }
+    
+    next();
+  } catch (error) {
+    // Token is invalid
+    next();
+  }
+}
+
+// Function to end a session
+function endSession(token) {
+  sessions.delete(token);
+}
+
+// Function to get active sessions count
+function getActiveSessions() {
+  const now = Date.now();
+  let active = 0;
+  
+  for (const [_, lastActivity] of sessions.entries()) {
+    if (now - lastActivity <= DEFAULT_SESSION_TIMEOUT) {
+      active++;
+    }
+  }
+  
+  return active;
+}
+
+module.exports = { 
+  sessionTimeoutMiddleware, 
+  endSession,
+  getActiveSessions 
+};