screenshot: admin github button (#778)

2026-07-10 09:50:18 +02:00
commit e94e440858
1160 changed files with 291466 additions and 0 deletions
@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+/**
+ * Script to check storage directory structure and verify files
+ * Usage: node scripts/check-storage.js [eventSlug]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+
+async function checkDirectory(dirPath, description) {
+  try {
+    await fs.access(dirPath);
+    const stats = await fs.stat(dirPath);
+    const files = await fs.readdir(dirPath);
+    console.log(`✓ ${description}: ${dirPath}`);
+    console.log(`  - Files/Folders: ${files.length}`);
+    console.log(`  - Permissions: ${(stats.mode & parseInt('777', 8)).toString(8)}`);
+    return true;
+  } catch (error) {
+    console.log(`✗ ${description}: ${dirPath} - ${error.message}`);
+    return false;
+  }
+}
+
+async function checkStorageStructure(eventSlug = null) {
+  console.log('Checking storage structure...');
+  console.log(`Storage base path: ${STORAGE_PATH}\n`);
+  
+  // Check main directories
+  await checkDirectory(STORAGE_PATH, 'Storage root');
+  await checkDirectory(path.join(STORAGE_PATH, 'events'), 'Events directory');
+  await checkDirectory(path.join(STORAGE_PATH, 'events/active'), 'Active events');
+  await checkDirectory(path.join(STORAGE_PATH, 'events/archived'), 'Archived events');
+  await checkDirectory(path.join(STORAGE_PATH, 'thumbnails'), 'Thumbnails');
+  await checkDirectory(path.join(STORAGE_PATH, 'uploads'), 'Uploads');
+  
+  console.log('\n---\n');
+  
+  // If event slug provided, check specific event
+  if (eventSlug) {
+    console.log(`Checking specific event: ${eventSlug}`);
+    
+    const event = await db('events').where('slug', eventSlug).first();
+    if (!event) {
+      console.log(`✗ Event not found in database: ${eventSlug}`);
+      return;
+    }
+    
+    console.log(`✓ Event found in database:`);
+    console.log(`  - ID: ${event.id}`);
+    console.log(`  - Name: ${event.event_name}`);
+    console.log(`  - Active: ${event.is_active}`);
+    console.log(`  - Archived: ${event.is_archived}`);
+    
+    // Check event directory
+    const eventDir = path.join(STORAGE_PATH, 'events/active', eventSlug);
+    const eventExists = await checkDirectory(eventDir, 'Event directory');
+    
+    if (eventExists) {
+      const files = await fs.readdir(eventDir);
+      console.log(`  - Photo files: ${files.filter(f => /\.(jpg|jpeg|png|gif)$/i.test(f)).length}`);
+    }
+    
+    // Check photos in database
+    const photos = await db('photos').where('event_id', event.id).select('id', 'filename', 'path', 'thumbnail_path');
+    console.log(`\nDatabase photos: ${photos.length}`);
+    
+    // Check if photo files exist
+    let existingPhotos = 0;
+    let missingPhotos = 0;
+    let existingThumbnails = 0;
+    let missingThumbnails = 0;
+    
+    for (const photo of photos) {
+      const photoPath = path.join(STORAGE_PATH, 'events/active', photo.path);
+      try {
+        await fs.access(photoPath);
+        existingPhotos++;
+      } catch {
+        missingPhotos++;
+        console.log(`  ✗ Missing photo: ${photo.path}`);
+      }
+      
+      if (photo.thumbnail_path) {
+        const thumbPath = path.join(STORAGE_PATH, photo.thumbnail_path.replace(/^\//, ''));
+        try {
+          await fs.access(thumbPath);
+          existingThumbnails++;
+        } catch {
+          missingThumbnails++;
+          console.log(`  ✗ Missing thumbnail: ${photo.thumbnail_path}`);
+        }
+      }
+    }
+    
+    console.log(`\nFile check summary:`);
+    console.log(`  - Photos: ${existingPhotos} exist, ${missingPhotos} missing`);
+    console.log(`  - Thumbnails: ${existingThumbnails} exist, ${missingThumbnails} missing`);
+  } else {
+    // List all event directories
+    try {
+      const activeDir = path.join(STORAGE_PATH, 'events/active');
+      const eventDirs = await fs.readdir(activeDir);
+      console.log(`Active event directories: ${eventDirs.length}`);
+      for (const dir of eventDirs.slice(0, 10)) {
+        console.log(`  - ${dir}`);
+      }
+      if (eventDirs.length > 10) {
+        console.log(`  ... and ${eventDirs.length - 10} more`);
+      }
+    } catch (error) {
+      console.log('Could not list event directories:', error.message);
+    }
+  }
+}
+
+// Parse command line arguments
+const eventSlug = process.argv[2] || null;
+
+// Run the script
+checkStorageStructure(eventSlug).then(async () => {
+  await db.destroy();
+  console.log('\nStorage check complete');
+}).catch(async error => {
+  console.error('Error:', error);
+  await db.destroy();
+  process.exit(1);
+});
@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+
+/**
+ * Script to clean up orphaned and temporary thumbnails
+ * Usage: node scripts/cleanup-thumbnails.js [--dry-run]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function cleanupThumbnails(dryRun = false) {
+  console.log('Starting thumbnail cleanup...');
+  console.log(`Thumbnails directory: ${THUMBNAILS_DIR}`);
+  console.log(`Mode: ${dryRun ? 'DRY RUN' : 'LIVE'}\n`);
+  
+  try {
+    // Get all thumbnail files
+    const files = await fs.readdir(THUMBNAILS_DIR);
+    console.log(`Found ${files.length} files in thumbnails directory`);
+    
+    // Get all valid thumbnail paths from database
+    const validThumbnails = await db('photos')
+      .whereNotNull('thumbnail_path')
+      .select('thumbnail_path');
+    
+    const validPaths = new Set(
+      validThumbnails.map(t => path.basename(t.thumbnail_path))
+    );
+    
+    console.log(`Found ${validPaths.size} valid thumbnails in database\n`);
+    
+    let tempCount = 0;
+    let orphanedCount = 0;
+    let validCount = 0;
+    let deletedCount = 0;
+    
+    for (const file of files) {
+      // Skip directories
+      const filePath = path.join(THUMBNAILS_DIR, file);
+      const stats = await fs.stat(filePath);
+      if (stats.isDirectory()) continue;
+      
+      // Check if it's a temporary file
+      if (file.startsWith('thumb_temp_')) {
+        tempCount++;
+        console.log(`Temporary file: ${file}`);
+        
+        if (!dryRun) {
+          try {
+            await fs.unlink(filePath);
+            deletedCount++;
+          } catch (error) {
+            console.error(`  Failed to delete: ${error.message}`);
+          }
+        }
+      }
+      // Check if it's an orphaned thumbnail
+      else if (!validPaths.has(file)) {
+        orphanedCount++;
+        console.log(`Orphaned file: ${file}`);
+        
+        if (!dryRun) {
+          try {
+            await fs.unlink(filePath);
+            deletedCount++;
+          } catch (error) {
+            console.error(`  Failed to delete: ${error.message}`);
+          }
+        }
+      } else {
+        validCount++;
+      }
+    }
+    
+    console.log('\n--- Summary ---');
+    console.log(`Total files: ${files.length}`);
+    console.log(`Valid thumbnails: ${validCount}`);
+    console.log(`Temporary files: ${tempCount}`);
+    console.log(`Orphaned files: ${orphanedCount}`);
+    if (!dryRun) {
+      console.log(`Deleted files: ${deletedCount}`);
+    } else {
+      console.log(`Files to be deleted: ${tempCount + orphanedCount}`);
+    }
+    
+  } catch (error) {
+    console.error('Error during cleanup:', error);
+    process.exit(1);
+  }
+}
+
+// Parse command line arguments
+const dryRun = process.argv.includes('--dry-run');
+
+// Run the cleanup
+cleanupThumbnails(dryRun).then(async () => {
+  await db.destroy();
+  console.log('\nCleanup complete');
+}).catch(async error => {
+  console.error('Cleanup failed:', error);
+  await db.destroy();
+  process.exit(1);
+});
@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+
+/**
+ * Script to create an admin user
+ * Usage: node scripts/create-admin.js --email [email protected] --username admin --password yourpassword
+ * 
+ * If no password is provided, a random one will be generated and displayed
+ */
+
+require('dotenv').config();
+const bcrypt = require('bcrypt');
+const { db } = require('../src/database/db');
+const crypto = require('crypto');
+
+// Parse command line arguments
+const args = process.argv.slice(2);
+const getArg = (name) => {
+  const index = args.findIndex(arg => arg === `--${name}`);
+  return index !== -1 && args[index + 1] ? args[index + 1] : null;
+};
+
+const email = getArg('email');
+const username = getArg('username') || email?.split('@')[0] || 'admin';
+let password = getArg('password');
+
+// Validate email
+if (!email) {
+  console.error('Error: Email is required. Use --email [email protected]');
+  process.exit(1);
+}
+
+// Generate password if not provided
+if (!password) {
+  password = crypto.randomBytes(12).toString('base64').slice(0, 16);
+  console.log(`Generated password: ${password}`);
+  console.log('Please save this password securely!');
+}
+
+async function createAdmin() {
+  try {
+    // Check if user already exists
+    const existingUser = await db('admin_users')
+      .where('email', email)
+      .orWhere('username', username)
+      .first();
+
+    // Hash password
+    const passwordHash = await bcrypt.hash(password, 10);
+
+    if (existingUser) {
+      // Update existing user's password
+      await db('admin_users')
+        .where('id', existingUser.id)
+        .update({
+          password_hash: passwordHash,
+          updated_at: new Date()
+        });
+
+      console.log(`✅ Admin user updated successfully!`);
+      console.log(`   Email: ${existingUser.email}`);
+      console.log(`   Username: ${existingUser.username}`);
+      console.log(`   Password has been reset to the provided value`);
+      console.log(`   Login URL: ${process.env.ADMIN_URL || 'http://localhost:3000'}/admin/login`);
+    } else {
+      // Create new admin user
+      await db('admin_users').insert({
+        username,
+        email,
+        password_hash: passwordHash,
+        is_active: true,
+        created_at: new Date(),
+        updated_at: new Date()
+      });
+
+      console.log(`✅ Admin user created successfully!`);
+      console.log(`   Email: ${email}`);
+      console.log(`   Username: ${username}`);
+      console.log(`   Login URL: ${process.env.ADMIN_URL || 'http://localhost:3000'}/admin/login`);
+    }
+    
+    process.exit(0);
+  } catch (error) {
+    console.error('Error creating admin user:', error.message);
+    process.exit(1);
+  }
+}
+
+createAdmin();
@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+/**
+ * Generate the OpenAPI spec from JSDoc annotations in src/routes/v1/* and
+ * write it as YAML + JSON to ../docs/. Used by scripts/sync-api-docs.sh
+ * to keep the picpeak-docs site in lockstep with the running API.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+// Need yaml — runtime require so the script fails clearly with an
+// install hint instead of an opaque MODULE_NOT_FOUND.
+let yaml;
+try {
+  yaml = require('js-yaml');
+} catch {
+  console.error('generate-openapi: missing dependency `js-yaml`. Run `npm install --save-dev js-yaml` in /backend.');
+  process.exit(2);
+}
+
+const { getOpenApiSpec } = require('../src/openapi/spec');
+
+const outDir = path.resolve(__dirname, '../../docs');
+fs.mkdirSync(outDir, { recursive: true });
+
+const spec = getOpenApiSpec();
+fs.writeFileSync(path.join(outDir, 'openapi.json'), JSON.stringify(spec, null, 2));
+fs.writeFileSync(path.join(outDir, 'openapi.yaml'), yaml.dump(spec, { lineWidth: 100 }));
+
+console.log(`Wrote openapi.json + openapi.yaml to ${outDir}`);
@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+
+/**
+ * Script to generate pre-watermarked versions for existing photos
+ * This is a one-time migration script to populate watermarks for photos
+ * that existed before the pre-generation feature was implemented.
+ *
+ * Usage: node scripts/generate-watermarks.js [eventId]
+ *
+ * Options:
+ *   eventId - Optional: Only generate watermarks for a specific event
+ *
+ * Examples:
+ *   node scripts/generate-watermarks.js          # Generate for all photos
+ *   node scripts/generate-watermarks.js 5        # Generate for event ID 5
+ */
+
+const path = require('path');
+const { db } = require('../src/database/db');
+const watermarkService = require('../src/services/watermarkService');
+const watermarkGeneratorService = require('../src/services/watermarkGeneratorService');
+
+async function generateWatermarks(eventId = null) {
+  try {
+    console.log('='.repeat(60));
+    console.log('PicPeak Watermark Generation Script');
+    console.log('='.repeat(60));
+
+    // Check if watermarking is enabled
+    const settings = await watermarkService.getWatermarkSettings();
+
+    if (!settings || !settings.enabled) {
+      console.log('\nWatermarking is currently DISABLED in settings.');
+      console.log('Enable watermarking in Admin > Branding settings first.');
+      console.log('Exiting without generating watermarks.');
+      process.exit(0);
+    }
+
+    console.log('\nWatermark Settings:');
+    console.log(`  Enabled: ${settings.enabled}`);
+    console.log(`  Position: ${settings.position}`);
+    console.log(`  Opacity: ${settings.opacity}%`);
+    console.log(`  Size: ${settings.size}%`);
+    console.log(`  Logo: ${settings.logoPath || '(using text fallback)'}`);
+
+    // Build query
+    let query = db('photos')
+      .join('events', 'photos.event_id', 'events.id')
+      .whereNull('photos.watermark_path')
+      .whereNot(function() {
+        this.where('photos.media_type', 'video')
+          .orWhere('photos.mime_type', 'like', 'video/%');
+      })
+      .select(
+        'photos.id',
+        'photos.filename',
+        'photos.event_id',
+        'events.event_name'
+      );
+
+    if (eventId) {
+      query = query.where('photos.event_id', eventId);
+      console.log(`\nFiltering to event ID: ${eventId}`);
+    }
+
+    const photos = await query;
+
+    if (photos.length === 0) {
+      console.log('\nNo photos found without watermarks.');
+      if (eventId) {
+        console.log(`(Checked event ID: ${eventId})`);
+      }
+      console.log('All photos already have pre-generated watermarks or watermarking is disabled.');
+      process.exit(0);
+    }
+
+    console.log(`\nFound ${photos.length} photos without watermarks.`);
+
+    // Group by event for display
+    const eventCounts = {};
+    photos.forEach(p => {
+      eventCounts[p.event_name] = (eventCounts[p.event_name] || 0) + 1;
+    });
+
+    console.log('\nPhotos by event:');
+    Object.entries(eventCounts).forEach(([name, count]) => {
+      console.log(`  ${name}: ${count} photos`);
+    });
+
+    console.log('\nStarting watermark generation...\n');
+
+    let successCount = 0;
+    let failCount = 0;
+    const startTime = Date.now();
+
+    // Process photos with progress display
+    for (let i = 0; i < photos.length; i++) {
+      const photo = photos[i];
+      const progress = Math.round(((i + 1) / photos.length) * 100);
+
+      process.stdout.write(`\r[${progress}%] Processing photo ${i + 1}/${photos.length}: ${photo.filename.substring(0, 30)}...`);
+
+      try {
+        const result = await watermarkGeneratorService.generateForPhoto(photo.id);
+
+        if (result.success) {
+          successCount++;
+        } else {
+          failCount++;
+          console.log(`\n  Failed: ${photo.filename} - ${result.error}`);
+        }
+      } catch (error) {
+        failCount++;
+        console.log(`\n  Error: ${photo.filename} - ${error.message}`);
+      }
+    }
+
+    const duration = ((Date.now() - startTime) / 1000).toFixed(1);
+
+    console.log('\n');
+    console.log('='.repeat(60));
+    console.log('Watermark Generation Complete');
+    console.log('='.repeat(60));
+    console.log(`  Total processed: ${photos.length}`);
+    console.log(`  Successful: ${successCount}`);
+    console.log(`  Failed: ${failCount}`);
+    console.log(`  Duration: ${duration} seconds`);
+    console.log(`  Average: ${(photos.length / parseFloat(duration)).toFixed(1)} photos/second`);
+
+    if (failCount > 0) {
+      console.log('\nSome watermarks failed to generate. Check the errors above.');
+      console.log('You can re-run this script to retry failed photos.');
+    }
+
+    process.exit(failCount > 0 ? 1 : 0);
+  } catch (error) {
+    console.error('\nFatal error:', error.message);
+    console.error(error.stack);
+    process.exit(1);
+  }
+}
+
+// Parse command line arguments
+const args = process.argv.slice(2);
+const eventId = args[0] ? parseInt(args[0], 10) : null;
+
+if (args[0] && isNaN(eventId)) {
+  console.error('Error: eventId must be a number');
+  console.log('Usage: node scripts/generate-watermarks.js [eventId]');
+  process.exit(1);
+}
+
+// Run the script
+generateWatermarks(eventId)
+  .then(() => {
+    process.exit(0);
+  })
+  .catch(error => {
+    console.error('Unhandled error:', error);
+    process.exit(1);
+  });
@@ -0,0 +1,259 @@
+#!/usr/bin/env node
+/**
+ * migrate-storage.js
+ *
+ * One-shot migration tool to copy every PicPeak content file from the local
+ * filesystem (the legacy STORAGE_PATH) to a configured S3-compatible bucket.
+ *
+ * Reads the relative path of each known asset from the database:
+ *   photos.path
+ *   photos.thumbnail_path
+ *   photos.hero_path
+ *   photos.watermark_path
+ *   events.archive_path
+ *   events.download_zip_path
+ *
+ * For each, streams from local fs → S3, skipping files whose sha256 already
+ * matches a previously uploaded object (idempotent — safe to re-run).
+ *
+ * Does NOT flip STORAGE_BACKEND. After the migration completes clean, the
+ * operator updates their environment + restarts the backend explicitly.
+ *
+ * Usage:
+ *   node backend/scripts/migrate-storage.js                # live migration
+ *   node backend/scripts/migrate-storage.js --dry-run      # report only, no uploads
+ *   node backend/scripts/migrate-storage.js --failures-csv=/path/to/failures.csv
+ *   node backend/scripts/migrate-storage.js --concurrency=4
+ *
+ * Required env (S3 destination — same vars the backend reads with STORAGE_BACKEND=s3):
+ *   STORAGE_S3_BUCKET, STORAGE_S3_REGION, STORAGE_S3_ACCESS_KEY, STORAGE_S3_SECRET_KEY
+ *   STORAGE_S3_ENDPOINT (optional — for MinIO/R2/etc.)
+ *   STORAGE_S3_PREFIX (optional)
+ *
+ * STORAGE_PATH must point at the live local storage root. Postgres connection
+ * uses the same DB env vars the backend uses.
+ */
+
+require('dotenv').config();
+const fs = require('fs');
+const fsp = require('fs').promises;
+const path = require('path');
+const crypto = require('crypto');
+
+const { db } = require('../src/database/db');
+const LocalFsStorage = require('../src/services/storage/LocalFsStorage');
+const S3StorageBackend = require('../src/services/storage/S3StorageBackend');
+const logger = require('../src/utils/logger');
+
+function parseArgs(argv) {
+  const args = { dryRun: false, concurrency: 4, failuresCsv: '/tmp/migrate-storage-failures.csv' };
+  for (const arg of argv) {
+    if (arg === '--dry-run') args.dryRun = true;
+    else if (arg.startsWith('--concurrency=')) args.concurrency = Math.max(1, parseInt(arg.split('=')[1], 10) || 4);
+    else if (arg.startsWith('--failures-csv=')) args.failuresCsv = arg.split('=')[1];
+    else if (arg === '--help' || arg === '-h') {
+      console.log('Usage: node migrate-storage.js [--dry-run] [--concurrency=N] [--failures-csv=PATH]');
+      process.exit(0);
+    }
+  }
+  return args;
+}
+
+function buildLocalSource() {
+  const root = process.env.STORAGE_PATH;
+  if (!root) {
+    throw new Error('STORAGE_PATH must be set to the local storage root.');
+  }
+  return new LocalFsStorage({ root });
+}
+
+function buildS3Destination() {
+  const required = ['STORAGE_S3_BUCKET', 'STORAGE_S3_ACCESS_KEY', 'STORAGE_S3_SECRET_KEY'];
+  const missing = required.filter((v) => !process.env[v]);
+  if (missing.length) {
+    throw new Error(`Missing S3 env vars: ${missing.join(', ')}`);
+  }
+  return new S3StorageBackend({
+    bucket: process.env.STORAGE_S3_BUCKET,
+    region: process.env.STORAGE_S3_REGION || 'us-east-1',
+    endpoint: process.env.STORAGE_S3_ENDPOINT,
+    accessKeyId: process.env.STORAGE_S3_ACCESS_KEY,
+    secretAccessKey: process.env.STORAGE_S3_SECRET_KEY,
+    prefix: process.env.STORAGE_S3_PREFIX,
+    forcePathStyle: process.env.STORAGE_S3_FORCE_PATH_STYLE === 'true' ? true : undefined,
+    sslEnabled: process.env.STORAGE_S3_SSL !== 'false',
+  });
+}
+
+async function sha256OfFile(localPath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const stream = fs.createReadStream(localPath);
+    stream.on('data', (chunk) => hash.update(chunk));
+    stream.on('end', () => resolve(hash.digest('hex')));
+    stream.on('error', reject);
+  });
+}
+
+async function collectKeys() {
+  const keys = new Map(); // key -> { source, contentType }
+
+  const addKey = (key, source) => {
+    if (!key) return;
+    const normalized = key.replace(/\\/g, '/').replace(/^\/+/, '');
+    if (!normalized) return;
+    if (!keys.has(normalized)) keys.set(normalized, { source });
+  };
+
+  // photos: path (events/active/{slug}/{filename}), thumbnail_path, hero_path, watermark_path
+  const photoBatch = await db('photos').select('id', 'path', 'thumbnail_path', 'hero_path', 'watermark_path');
+  for (const p of photoBatch) {
+    if (p.path) {
+      const photoKey = p.path.startsWith('events/active/') ? p.path : path.posix.join('events/active', p.path);
+      addKey(photoKey, `photos.path[${p.id}]`);
+    }
+    addKey(p.thumbnail_path, `photos.thumbnail_path[${p.id}]`);
+    addKey(p.hero_path, `photos.hero_path[${p.id}]`);
+    addKey(p.watermark_path, `photos.watermark_path[${p.id}]`);
+  }
+
+  // events: archive_path, download_zip_path
+  const eventBatch = await db('events').select('id', 'archive_path', 'download_zip_path');
+  for (const e of eventBatch) {
+    addKey(e.archive_path, `events.archive_path[${e.id}]`);
+    addKey(e.download_zip_path, `events.download_zip_path[${e.id}]`);
+  }
+
+  return keys;
+}
+
+async function migrateOne(key, meta, { source, dest, dryRun }) {
+  // Source must exist on local disk.
+  const localPath = source.resolveLocalPath(key);
+  let localStat;
+  try {
+    localStat = await fsp.stat(localPath);
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      return { key, status: 'missing-locally', source: meta.source };
+    }
+    throw err;
+  }
+
+  // Idempotent skip: if S3 already has matching size + sha256.
+  const remoteStat = await dest.stat(key);
+  if (remoteStat && remoteStat.size === localStat.size) {
+    // sha256 match check via metadata is expensive; we trust size match for now.
+    // Operators paranoid about content drift can `rm` the bucket and re-run.
+    return { key, status: 'already-uploaded', source: meta.source };
+  }
+
+  if (dryRun) {
+    return { key, status: 'would-upload', source: meta.source, size: localStat.size };
+  }
+
+  await dest.putFromFile(key, localPath);
+
+  const verify = await dest.stat(key);
+  if (!verify || verify.size !== localStat.size) {
+    return { key, status: 'size-mismatch-after-upload', source: meta.source, expected: localStat.size, got: verify?.size };
+  }
+
+  return { key, status: 'uploaded', source: meta.source, size: localStat.size };
+}
+
+async function processWithConcurrency(items, concurrency, fn) {
+  const results = [];
+  let i = 0;
+  const workers = Array.from({ length: concurrency }, async () => {
+    while (true) {
+      const idx = i++;
+      if (idx >= items.length) return;
+      const [key, meta] = items[idx];
+      try {
+        const r = await fn(key, meta);
+        results.push(r);
+      } catch (err) {
+        results.push({ key, status: 'error', source: meta.source, error: err.message });
+      }
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+
+function formatCsvCell(v) {
+  if (v == null) return '';
+  const s = String(v);
+  if (s.includes(',') || s.includes('"') || s.includes('\n')) {
+    return `"${s.replace(/"/g, '""')}"`;
+  }
+  return s;
+}
+
+async function writeFailuresCsv(filePath, failures) {
+  if (failures.length === 0) {
+    // Touch an empty file with header so callers see a deterministic outcome.
+    await fsp.writeFile(filePath, 'key,source,status,error\n');
+    return;
+  }
+  const lines = ['key,source,status,error'];
+  for (const f of failures) {
+    lines.push([f.key, f.source, f.status, f.error || ''].map(formatCsvCell).join(','));
+  }
+  await fsp.writeFile(filePath, lines.join('\n') + '\n');
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+
+  logger.info(`migrate-storage starting (dry-run=${args.dryRun}, concurrency=${args.concurrency})`);
+
+  const source = buildLocalSource();
+  await source.init();
+
+  const dest = buildS3Destination();
+  await dest.init();
+
+  logger.info('collecting key list from database…');
+  const keys = await collectKeys();
+  logger.info(`found ${keys.size} unique keys to process`);
+
+  const items = Array.from(keys.entries());
+  const results = await processWithConcurrency(items, args.concurrency, (key, meta) =>
+    migrateOne(key, meta, { source, dest, dryRun: args.dryRun })
+  );
+
+  const counts = results.reduce((acc, r) => {
+    acc[r.status] = (acc[r.status] || 0) + 1;
+    return acc;
+  }, {});
+
+  console.log('\n=== migrate-storage summary ===');
+  for (const [status, count] of Object.entries(counts).sort()) {
+    console.log(`  ${status.padEnd(28)} ${count}`);
+  }
+
+  const failureStatuses = new Set(['error', 'missing-locally', 'size-mismatch-after-upload']);
+  const failures = results.filter((r) => failureStatuses.has(r.status));
+  await writeFailuresCsv(args.failuresCsv, failures);
+
+  if (failures.length > 0) {
+    console.log(`\nWrote ${failures.length} failures to ${args.failuresCsv}`);
+    console.log('Re-run with --dry-run to triage; fix sources or remove DB rows that point at missing files.');
+    process.exitCode = 1;
+  } else if (args.dryRun) {
+    console.log(`\nDry-run complete. Re-run without --dry-run to perform the migration.`);
+    console.log(`(Empty failures CSV written to ${args.failuresCsv}.)`);
+  } else {
+    console.log(`\nMigration complete. Update STORAGE_BACKEND=s3 + restart the backend to switch over.`);
+  }
+
+  await db.destroy();
+}
+
+main().catch(async (err) => {
+  console.error('migrate-storage failed:', err);
+  try { await db.destroy(); } catch (_) { /* ignore */ }
+  process.exit(2);
+});
@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const path = require('path');
+
+const fsp = fs.promises;
+
+async function pathExists(location) {
+  try {
+    await fsp.access(location);
+    return true;
+  } catch (error) {
+    if (error && error.code === 'ENOENT') {
+      return false;
+    }
+    throw error;
+  }
+}
+
+async function moveFile(source, destination) {
+  await fsp.mkdir(path.dirname(destination), { recursive: true });
+  try {
+    await fsp.rename(source, destination);
+  } catch (error) {
+    if (error.code === 'EXDEV') {
+      await fsp.copyFile(source, destination);
+      await fsp.unlink(source);
+    } else if (error.code === 'EEXIST') {
+      console.warn(`Destination already exists, leaving original in place: ${destination}`);
+      return;
+    } else {
+      throw error;
+    }
+  }
+}
+
+async function migrate() {
+  const backendRoot = path.resolve(__dirname, '..');
+  const defaultStorage = path.resolve(backendRoot, '../storage');
+  const targetStorage = path.resolve(process.env.STORAGE_PATH || defaultStorage);
+  const legacyUploadsRoot = path.resolve(backendRoot, 'storage/uploads');
+  const targetUploadsRoot = path.join(targetStorage, 'uploads');
+
+  if (legacyUploadsRoot === targetUploadsRoot) {
+    console.log('Legacy uploads directory already matches target STORAGE_PATH. Nothing to migrate.');
+    return;
+  }
+
+  if (!fs.existsSync(legacyUploadsRoot)) {
+    console.log(`Legacy uploads directory not found at ${legacyUploadsRoot}. Nothing to migrate.`);
+    return;
+  }
+
+  const categories = ['logos', 'favicons'];
+  let migratedCounter = 0;
+
+  for (const category of categories) {
+    const legacyDir = path.join(legacyUploadsRoot, category);
+    if (!fs.existsSync(legacyDir)) {
+      continue;
+    }
+
+    const targetDir = path.join(targetUploadsRoot, category);
+    await fsp.mkdir(targetDir, { recursive: true });
+
+    const entries = await fsp.readdir(legacyDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isFile()) {
+        continue;
+      }
+
+      const sourcePath = path.join(legacyDir, entry.name);
+      const destinationPath = path.join(targetDir, entry.name);
+
+      if (await pathExists(destinationPath)) {
+        console.warn(`Skipping ${sourcePath} because ${destinationPath} already exists.`);
+        continue;
+      }
+
+      await moveFile(sourcePath, destinationPath);
+      migratedCounter += 1;
+    }
+
+    const remaining = await fsp.readdir(legacyDir);
+    if (remaining.length === 0) {
+      await fsp.rm(legacyDir, { recursive: true, force: true });
+    }
+  }
+
+  if (migratedCounter === 0) {
+    console.log('No legacy logo or favicon files needed migration.');
+    return;
+  }
+
+  console.log(`Migrated ${migratedCounter} files into ${targetUploadsRoot}.`);
+  console.log('If the database still references legacy absolute paths, they will be cleaned up automatically on the next upload.');
+}
+
+migrate().catch((error) => {
+  console.error('Migration failed:', error);
+  process.exitCode = 1;
+});
@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+
+/**
+ * Script to regenerate all thumbnails with new square dimensions
+ * This fixes the blurry thumbnail issue by creating proper 300x300 square thumbnails
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+const { generateThumbnail } = require('../src/services/imageProcessor');
+const logger = require('../src/utils/logger');
+
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+
+async function regenerateAllThumbnails() {
+  try {
+    console.log('Starting thumbnail regeneration with square dimensions...');
+    
+    // First, ensure the new thumbnail settings are in the database
+    const settings = [
+      { key: 'thumbnail_width', value: '300' },
+      { key: 'thumbnail_height', value: '300' },
+      { key: 'thumbnail_fit', value: 'cover' },
+      { key: 'thumbnail_quality', value: '85' },
+      { key: 'thumbnail_format', value: 'jpeg' }
+    ];
+    
+    for (const setting of settings) {
+      const exists = await db('app_settings').where('key', setting.key).first();
+      if (!exists) {
+        await db('app_settings').insert({
+          ...setting,
+          description: `Thumbnail ${setting.key.replace('thumbnail_', '')}`,
+          created_at: db.fn.now(),
+          updated_at: db.fn.now()
+        });
+        console.log(`Added setting: ${setting.key} = ${setting.value}`);
+      }
+    }
+    
+    // Get all photos
+    const photos = await db('photos')
+      .select('id', 'event_id', 'path', 'filename')
+      .orderBy('id');
+    
+    console.log(`Found ${photos.length} photos to process`);
+    
+    let successCount = 0;
+    let errorCount = 0;
+    let skippedCount = 0;
+    
+    for (let i = 0; i < photos.length; i++) {
+      const photo = photos[i];
+      const progress = Math.round((i + 1) / photos.length * 100);
+      
+      try {
+        const storagePath = getStoragePath();
+        const originalPath = path.join(storagePath, 'events/active', photo.path);
+        
+        // Check if original file exists
+        try {
+          await fs.access(originalPath);
+        } catch (err) {
+          console.log(`[${progress}%] Skipping photo ${photo.id} - original file not found`);
+          skippedCount++;
+          continue;
+        }
+        
+        // Regenerate thumbnail with new square dimensions
+        const thumbnailPath = await generateThumbnail(originalPath, { regenerate: true });
+        
+        if (thumbnailPath) {
+          // Update database with new thumbnail path
+          await db('photos')
+            .where({ id: photo.id })
+            .update({ 
+              thumbnail_path: thumbnailPath,
+              updated_at: db.fn.now()
+            });
+          
+          successCount++;
+          console.log(`[${progress}%] ✓ Regenerated thumbnail for ${photo.filename}`);
+        } else {
+          errorCount++;
+          console.error(`[${progress}%] ✗ Failed to generate thumbnail for ${photo.filename}`);
+        }
+      } catch (error) {
+        errorCount++;
+        console.error(`[${progress}%] ✗ Error processing photo ${photo.id}:`, error.message);
+      }
+    }
+    
+    console.log('\n=== Regeneration Complete ===');
+    console.log(`✓ Success: ${successCount} thumbnails`);
+    console.log(`✗ Errors: ${errorCount} thumbnails`);
+    console.log(`⊘ Skipped: ${skippedCount} thumbnails (original files not found)`);
+    console.log(`Total processed: ${photos.length} photos`);
+    
+    process.exit(0);
+  } catch (error) {
+    console.error('Fatal error during thumbnail regeneration:', error);
+    process.exit(1);
+  }
+}
+
+// Run the script
+regenerateAllThumbnails();
@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+
+/**
+ * Script to regenerate missing thumbnails for photos in the database
+ * Usage: node scripts/regenerate-thumbnails.js [eventId]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const sharp = require('sharp');
+const { db } = require('../src/database/db');
+
+// Configuration
+const THUMBNAIL_SIZE = 300;
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function ensureDirectoryExists(dirPath) {
+  try {
+    await fs.access(dirPath);
+  } catch {
+    await fs.mkdir(dirPath, { recursive: true });
+    console.log(`Created directory: ${dirPath}`);
+  }
+}
+
+async function generateThumbnail(photoPath, thumbnailPath) {
+  try {
+    await sharp(photoPath)
+      .resize(THUMBNAIL_SIZE, THUMBNAIL_SIZE, {
+        fit: 'cover',
+        position: 'center'
+      })
+      .jpeg({ quality: 80 })
+      .toFile(thumbnailPath);
+    
+    return true;
+  } catch (error) {
+    console.error(`Failed to generate thumbnail for ${photoPath}:`, error.message);
+    return false;
+  }
+}
+
+async function regenerateThumbnails(eventId = null) {
+  try {
+    console.log('Starting thumbnail regeneration...');
+    console.log(`Storage path: ${STORAGE_PATH}`);
+    console.log(`Thumbnails directory: ${THUMBNAILS_DIR}`);
+    
+    // Ensure thumbnails directory exists
+    await ensureDirectoryExists(THUMBNAILS_DIR);
+    
+    // Build query
+    let query = db('photos')
+      .join('events', 'photos.event_id', 'events.id')
+      .select(
+        'photos.id',
+        'photos.filename',
+        'photos.path',
+        'photos.thumbnail_path',
+        'events.slug as event_slug'
+      );
+    
+    if (eventId) {
+      query = query.where('photos.event_id', eventId);
+      console.log(`Filtering for event ID: ${eventId}`);
+    }
+    
+    const photos = await query;
+    console.log(`Found ${photos.length} photos to process`);
+    
+    let successCount = 0;
+    let skipCount = 0;
+    let errorCount = 0;
+    
+    for (const photo of photos) {
+      const photoPath = path.join(STORAGE_PATH, 'events/active', photo.path);
+      const thumbnailFilename = `thumb_${photo.filename}`;
+      const thumbnailPath = path.join(THUMBNAILS_DIR, thumbnailFilename);
+      
+      try {
+        // Check if photo file exists
+        await fs.access(photoPath);
+        
+        // Check if thumbnail already exists
+        try {
+          await fs.access(thumbnailPath);
+          console.log(`Thumbnail already exists for ${photo.filename}, skipping...`);
+          skipCount++;
+          continue;
+        } catch {
+          // Thumbnail doesn't exist, generate it
+        }
+        
+        console.log(`Generating thumbnail for ${photo.filename}...`);
+        const success = await generateThumbnail(photoPath, thumbnailPath);
+        
+        if (success) {
+          // Update database with thumbnail path
+          await db('photos')
+            .where('id', photo.id)
+            .update({
+              thumbnail_path: `thumbnails/${thumbnailFilename}`
+            });
+          
+          successCount++;
+          console.log(`✓ Generated thumbnail for ${photo.filename}`);
+        } else {
+          errorCount++;
+        }
+      } catch (error) {
+        console.error(`✗ Photo file not found: ${photoPath}`);
+        errorCount++;
+      }
+    }
+    
+    console.log('\nThumbnail regeneration complete!');
+    console.log(`- Successfully generated: ${successCount}`);
+    console.log(`- Skipped (already exist): ${skipCount}`);
+    console.log(`- Errors: ${errorCount}`);
+    console.log(`- Total processed: ${photos.length}`);
+    
+  } catch (error) {
+    console.error('Error during thumbnail regeneration:', error);
+    process.exit(1);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Parse command line arguments
+const eventId = process.argv[2] ? parseInt(process.argv[2]) : null;
+
+// Run the script
+regenerateThumbnails(eventId).then(() => {
+  console.log('Script completed successfully');
+  process.exit(0);
+}).catch(error => {
+  console.error('Script failed:', error);
+  process.exit(1);
+});
@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+/**
+ * reset-admin-mfa.js — disable two-factor auth for a locked-out admin (#738).
+ *
+ * Break-glass recovery for when an admin loses their authenticator AND their
+ * recovery codes. Clears the MFA state so the admin can log in with just their
+ * password and re-enroll from Settings.
+ *
+ * Usage (inside the running backend container):
+ *   docker compose exec backend node scripts/reset-admin-mfa.js --email [email protected]
+ *   docker compose exec backend node scripts/reset-admin-mfa.js --all --yes
+ *
+ * Flags:
+ *   --email <addr>   target a single admin by email (or --username <name>)
+ *   --all            reset MFA for EVERY admin (full lockout / break-glass)
+ *   --yes            non-interactive (skip the confirmation prompt)
+ */
+
+const readline = require('readline');
+const { db, logActivity } = require('../src/database/db');
+
+const args = process.argv.slice(2);
+const hasFlag = (f) => args.includes(f);
+const getOption = (name) => {
+  const i = args.indexOf(`--${name}`);
+  return i !== -1 && i + 1 < args.length ? args[i + 1] : null;
+};
+
+const force = hasFlag('--yes') || hasFlag('--force') || hasFlag('--non-interactive');
+const all = hasFlag('--all');
+const email = getOption('email');
+const username = getOption('username');
+
+const MFA_CLEAR = {
+  two_factor_enabled: false,
+  two_factor_secret: null,
+  two_factor_recovery_codes: null,
+  two_factor_enrolled_at: null,
+  updated_at: new Date(),
+};
+
+function ask(prompt) {
+  if (force) return Promise.resolve('yes');
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => rl.question(prompt, (a) => { rl.close(); resolve(a); }));
+}
+
+async function main() {
+  console.log('\n========================================');
+  console.log('PicPeak Admin MFA Reset Tool');
+  console.log('========================================\n');
+
+  if (!all && !email && !username) {
+    console.error('❌ Specify a target: --email <addr>, --username <name>, or --all');
+    console.log('   e.g. node scripts/reset-admin-mfa.js --email [email protected]');
+    process.exit(1);
+  }
+
+  // Resolve target admins.
+  let targets;
+  if (all) {
+    targets = await db('admin_users').select('id', 'username', 'email', 'two_factor_enabled');
+  } else {
+    const q = db('admin_users');
+    if (email) q.where({ email });
+    if (username) q.where({ username });
+    targets = await q.select('id', 'username', 'email', 'two_factor_enabled');
+  }
+
+  if (targets.length === 0) {
+    console.error('❌ No matching admin user found.');
+    process.exit(1);
+  }
+
+  const enrolled = targets.filter((t) => t.two_factor_enabled === true || t.two_factor_enabled === 1);
+  console.log(`Matched ${targets.length} admin(s); ${enrolled.length} currently have MFA enabled:`);
+  for (const t of targets) {
+    const flag = (t.two_factor_enabled === true || t.two_factor_enabled === 1) ? 'MFA ON' : 'mfa off';
+    console.log(`  - ${t.username} <${t.email}>  [${flag}]`);
+  }
+
+  const confirm = await ask('\nDisable MFA for the above? (yes/no): ');
+  const normalized = String(confirm).trim().toLowerCase();
+  if (normalized !== 'yes' && normalized !== 'y') {
+    console.log('\n❌ Cancelled. No changes made.');
+    process.exit(0);
+  }
+
+  const ids = targets.map((t) => t.id);
+  const updated = await db('admin_users').whereIn('id', ids).update(MFA_CLEAR);
+
+  for (const t of targets) {
+    try {
+      await logActivity('admin_mfa_reset_cli',
+        { admin_id: t.id, via: 'cli' },
+        null,
+        { type: 'system', id: 0, name: 'reset-admin-mfa.js' }
+      );
+    } catch (_) { /* activity log is best-effort */ }
+  }
+
+  console.log(`\n✅ MFA disabled for ${updated} admin(s). They can now log in with just their password and re-enroll from Settings → Security.`);
+  process.exit(0);
+}
+
+main().catch((err) => {
+  console.error('❌ Failed to reset MFA:', err.message);
+  process.exit(1);
+});
@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+
+const bcrypt = require('bcrypt');
+const { db } = require('../src/database/db');
+const { generateReadablePassword } = require('../src/utils/passwordGenerator');
+const fs = require('fs').promises;
+const path = require('path');
+const readline = require('readline');
+
+const args = process.argv.slice(2);
+const hasFlag = (flag) => args.includes(flag);
+const getOption = (name) => {
+  const index = args.indexOf(`--${name}`);
+  if (index !== -1 && index + 1 < args.length) {
+    return args[index + 1];
+  }
+  return null;
+};
+
+const force = hasFlag('--force') || hasFlag('--yes') || hasFlag('--non-interactive');
+const credentialsFileArg = getOption('credentials-file');
+const resolvedCredentialsFile = credentialsFileArg
+  ? path.resolve(process.cwd(), credentialsFileArg)
+  : path.join(__dirname, '..', '..', 'ADMIN_PASSWORD_RESET.txt');
+
+const rl = force ? null : readline.createInterface({
+  input: process.stdin,
+  output: process.stdout
+});
+
+async function ask(prompt) {
+  if (force) {
+    return 'yes';
+  }
+
+  return new Promise((resolve) => {
+    rl.question(prompt, resolve);
+  });
+}
+
+async function resetAdminPassword() {
+  console.log('\n========================================');
+  console.log('PicPeak Admin Password Reset Tool');
+  console.log('========================================\n');
+
+  try {
+    // Check if admin user exists
+    const admin = await db('admin_users')
+      .where({ username: 'admin' })
+      .first();
+
+    if (!admin) {
+      console.error('❌ No admin user found in the database.');
+      console.log('Run migrations first: npm run migrate');
+      process.exit(1);
+    }
+
+    console.log('Found admin user:', admin.username);
+    console.log('Email:', admin.email);
+    if (!force) {
+      console.log('\nThis will reset the password for this admin account.');
+    }
+
+    const confirm = await ask('\nDo you want to continue? (yes/no): ');
+
+    if (!force) {
+      const normalized = confirm.trim().toLowerCase();
+      if (normalized !== 'yes' && normalized !== 'y') {
+        console.log('\n❌ Password reset cancelled.');
+        process.exit(0);
+      }
+    }
+
+    // Generate new password
+    const newPassword = generateReadablePassword();
+    const passwordHash = await bcrypt.hash(newPassword, 12);
+
+    // Update the admin user
+    await db('admin_users')
+      .where({ username: 'admin' })
+      .update({
+        password_hash: passwordHash,
+        must_change_password: true,
+        updated_at: new Date()
+      });
+
+    // Save to file
+    const credentialsDir = path.dirname(resolvedCredentialsFile);
+    await fs.mkdir(credentialsDir, { recursive: true });
+
+    const adminUrl = `${process.env.ADMIN_URL || 'http://localhost:3001'}/admin`;
+    const resetInfo = `
+========================================
+PicPeak Admin Credentials
+========================================
+
+Your admin account has been reset with these credentials:
+
+Username: ${admin.username}
+Email: ${admin.email}
+Password: ${newPassword}
+
+IMPORTANT SECURITY NOTES:
+1. You MUST change this password after first login
+2. This file contains sensitive information
+3. Delete this file after noting the password
+
+Login URL: ${adminUrl}
+
+Reset performed on: ${new Date().toISOString()}
+========================================
+`;
+
+    await fs.writeFile(resolvedCredentialsFile, resetInfo, 'utf8');
+
+    console.log('\n✅ Password reset successful!\n');
+    console.log('========================================');
+    console.log('New Credentials:');
+    console.log('========================================');
+    console.log(`Username: ${admin.username}`);
+    console.log(`Email: ${admin.email}`);
+    console.log(`Password: ${newPassword}`);
+    console.log('\n⚠️  IMPORTANT:');
+    console.log('1. You will be required to change this password on next login');
+    console.log(`2. Credentials are also saved in: ${resolvedCredentialsFile}`);
+    console.log('3. Delete the file after noting the password');
+    console.log('========================================\n');
+
+  } catch (error) {
+    console.error('❌ Error resetting password:', error.message);
+    process.exit(1);
+  } finally {
+    if (rl) {
+      rl.close();
+    }
+    process.exit(0);
+  }
+}
+
+// Run the reset
+resetAdminPassword();
@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+
+/**
+ * Script to set/reset admin password
+ *
+ * Usage:
+ *   node set-admin-password.js <new-password>
+ *   node set-admin-password.js --env  (uses ADMIN_PASSWORD environment variable)
+ *
+ * Security: Password must be at least 8 characters with mixed case, numbers, and special characters
+ */
+
+const bcrypt = require('bcrypt');
+const path = require('path');
+require('dotenv').config({ path: path.join(__dirname, '../.env') });
+
+const knex = require('knex');
+const db = knex({
+  client: process.env.DB_CLIENT || 'pg',
+  connection: {
+    host: process.env.DB_HOST || 'localhost',
+    port: process.env.DB_PORT || 5432,
+    user: process.env.DB_USER || 'picpeak',
+    password: process.env.DB_PASSWORD || 'picpeak',
+    database: process.env.DB_NAME || 'picpeak_dev'
+  }
+});
+
+/**
+ * Validate password strength
+ */
+function validatePassword(password) {
+  if (!password || password.length < 8) {
+    return { valid: false, error: 'Password must be at least 8 characters long' };
+  }
+  if (!/[a-z]/.test(password)) {
+    return { valid: false, error: 'Password must contain at least one lowercase letter' };
+  }
+  if (!/[A-Z]/.test(password)) {
+    return { valid: false, error: 'Password must contain at least one uppercase letter' };
+  }
+  if (!/[0-9]/.test(password)) {
+    return { valid: false, error: 'Password must contain at least one number' };
+  }
+  if (!/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(password)) {
+    return { valid: false, error: 'Password must contain at least one special character' };
+  }
+  return { valid: true };
+}
+
+function printUsage() {
+  console.log(`
+Usage:
+  node set-admin-password.js <new-password>
+  node set-admin-password.js --env
+
+Options:
+  <new-password>  The new password to set (must meet security requirements)
+  --env           Use ADMIN_PASSWORD environment variable
+
+Security Requirements:
+  - At least 8 characters
+  - At least one lowercase letter
+  - At least one uppercase letter
+  - At least one number
+  - At least one special character (!@#$%^&*()_+-=[]{}|;':\",./<>?)
+
+Examples:
+  node set-admin-password.js "MySecure@Pass123"
+  ADMIN_PASSWORD="MySecure@Pass123" node set-admin-password.js --env
+`);
+}
+
+async function setAdminPassword() {
+  try {
+    // Get password from argument or environment
+    const args = process.argv.slice(2);
+    let password;
+
+    if (args.length === 0) {
+      console.error('❌ Error: No password provided\n');
+      printUsage();
+      process.exit(1);
+    }
+
+    if (args[0] === '--env') {
+      password = process.env.ADMIN_PASSWORD;
+      if (!password) {
+        console.error('❌ Error: ADMIN_PASSWORD environment variable not set');
+        process.exit(1);
+      }
+    } else if (args[0] === '--help' || args[0] === '-h') {
+      printUsage();
+      process.exit(0);
+    } else {
+      password = args[0];
+    }
+
+    // Validate password strength
+    const validation = validatePassword(password);
+    if (!validation.valid) {
+      console.error(`❌ Error: ${validation.error}`);
+      process.exit(1);
+    }
+
+    // Hash password
+    const hashedPassword = await bcrypt.hash(password, 12);
+
+    // Update database
+    const updated = await db('admin_users')
+      .where('username', 'admin')
+      .update({
+        password_hash: hashedPassword,
+        password_changed_at: new Date(),
+        updated_at: new Date()
+      });
+
+    if (updated === 0) {
+      console.error('❌ Error: Admin user not found');
+      process.exit(1);
+    }
+
+    console.log('✅ Admin password updated successfully');
+    console.log('   Note: All existing sessions have been invalidated');
+
+    await db.destroy();
+    process.exit(0);
+  } catch (error) {
+    console.error('❌ Error setting password:', error.message);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+setAdminPassword();
@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+
+/**
+ * Show or reset admin credentials
+ */
+
+const bcrypt = require('bcrypt');
+const { db } = require('../src/database/db');
+const { generateReadablePassword } = require('../src/utils/passwordGenerator');
+
+async function showAdminCredentials(resetPassword = false) {
+  try {
+    // Get admin user
+    const admin = await db('admin_users')
+      .where('username', 'admin')
+      .first();
+    
+    if (!admin) {
+      console.error('❌ No admin user found in database');
+      process.exit(1);
+    }
+    
+    console.log('\n========================================');
+    console.log('PicPeak Admin Credentials');
+    console.log('========================================');
+    console.log(`Username: ${admin.username}`);
+    console.log(`Email: ${admin.email}`);
+    
+    if (resetPassword) {
+      // Generate new password
+      const newPassword = generateReadablePassword();
+      const passwordHash = await bcrypt.hash(newPassword, 12);
+      
+      // Update password
+      await db('admin_users')
+        .where('id', admin.id)
+        .update({
+          password_hash: passwordHash,
+          must_change_password: true,
+          updated_at: new Date()
+        });
+
+      console.log(`Password: ${newPassword}`);
+      console.log('\n⚠️  IMPORTANT:');
+      console.log('1. Save this password securely - it will not be shown again');
+      console.log('2. You will be required to change it on next login');
+    } else {
+      console.log('Password: [hidden - use --reset flag to generate new password]');
+    }
+    
+    console.log('\nLogin URL: http://localhost:3001/admin');
+    console.log('========================================\n');
+    
+  } catch (error) {
+    console.error('Error:', error.message);
+    process.exit(1);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Check for reset flag
+const resetPassword = process.argv.includes('--reset');
+
+if (resetPassword) {
+  console.log('🔄 Resetting admin password...');
+}
+
+showAdminCredentials(resetPassword);