24 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Paul Nothaft	6033461be1	feat: add Apple Liquid Glass templates, image security settings, and automated releases ... ## New Features - Apple Liquid Glass CSS template with iOS 26-inspired design - Liquid Glass Dark theme with neon accents - Image Security settings tab with per-event protection levels - Release Please automation for versioning and changelog ## Improvements - Update CSS template migration with final working templates - Add search placeholder visibility fix for glass themes - Update README roadmap (Download Protection, Gallery Templates, Filtering & Export now implemented) ## Infrastructure - Add release-please.yml workflow for automated releases - Add release-please-config.json and manifest - Update docker-build.yml with Release Please integration comments - Add comprehensive CHANGELOG.md ## Cleanup - Add working/planning docs to .gitignore (CLAUDE.md, test-*.md, feature-*.md, etc.) - Remove internal planning documents from git tracking (kept locally) ## Files Added - .github/workflows/release-please.yml - .release-please-manifest.json - release-please-config.json - CHANGELOG.md - frontend/src/features/settings/tabs/ImageSecurityTab.tsx	2026-01-03 23:35:23 +01:00
Paul Nothaft	f3c2cee362	security: Fix critical vulnerabilities and harden application ... ## Security Fixes ### CRITICAL: Command Injection (adminBackup.js) - Replaced exec() with spawn() using argument arrays - Added input sanitization for host, user, and ssh_key - Added regex validation for hostname/IP format - Added username format validation - Added SSH key file existence check - Prevents shell metacharacter injection attacks ### HIGH: Hardcoded Password (set-admin-password.js) - Removed hardcoded 'admin123' password - Now requires password as CLI argument or env variable - Added password strength validation (8+ chars, mixed case, numbers, special chars) - Added --help flag with usage instructions - Invalidates existing sessions on password change ### MEDIUM: XSS Vulnerability (WelcomeMessageEditor.tsx) - Added DOMPurify sanitization to getPreviewHtml() - Strips all HTML tags before rendering preview - Prevents script injection in admin preview ### LOW: Sample Password Exposure (EmailConfigPage.tsx) - Replaced plaintext sample password with masked placeholder - Uses '••••••••' instead of realistic password ## Dependency Updates - Fixed npm audit vulnerabilities (jws, qs, express) - Backend: 0 vulnerabilities - Frontend: 0 vulnerabilities	2026-01-03 10:12:01 +01:00
Paul Nothaft	0da45e699a	feat: Add CSS template system with custom gallery styling support ... ## Changes ### CSS Template System - Added CSS class hooks to gallery components for custom template targeting - Gallery sidebar, header, footer, and photo cards can now be styled via CSS templates - CSS variables on :root allow themes to override colors, effects, and spacing ### Gallery Component CSS Classes Added - `.gallery-page` - Main gallery container - `.gallery-header` - Top header bar - `.gallery-sidebar` - Filter/download sidebar - `.gallery-sidebar-header`, `.gallery-sidebar-title`, `.gallery-sidebar-close` - `.gallery-sidebar-content`, `.gallery-sidebar-section` - `.gallery-sidebar-search-input`, `.gallery-sidebar-search-icon` - `.gallery-sidebar-backdrop` - Mobile overlay - `.gallery-btn`, `.gallery-btn-download` - Sidebar buttons - `.gallery-footer` - Footer section - `.photo-card`, `.photo-grid` - Photo display elements ### CSS Templates (Database) - Elegant Dark (id=1): Dark navy theme with light text and red accents - Liquid Glass Light (id=2): iOS 26 frosted glass effect with gradient background ### Bug Fixes - Fixed CSS variables not inheriting (moved from .gallery-page to :root) - Fixed sidebar position breaking layout (removed position: relative override) - Fixed Elegant Dark sidebar text visibility (white on white issue) ### Other Changes - Settings page refactoring and cleanup - i18n locale updates for new gallery features - Vite proxy port configuration fix - Admin auth route improvements - CSS templates service updates	2026-01-03 08:59:01 +01:00
Paul Nothaft	97455ab047	Fix date parsing bug and Vite proxy port configuration ... - Add safeParseDate helper to handle dates that may be strings, Date objects, or timestamps - Replace all parseISO(event.*) calls with safeParseDate() to prevent "dateString.split is not a function" errors - Fix Vite proxy target from port 3002 to 3001 to match backend server port	2026-01-02 10:49:42 +01:00
Paul Nothaft	fbd7b67016	refactor: Add Photo and Settings service layers ... Phase 2.2: Photo service layer - Create backend/src/services/photoService.js - Functions: getPhotosForEvent, getPhotoById, getPhotoCount - Functions: updatePhoto, deletePhoto, bulkDeletePhotos - Functions: updateSortOrder, moveToCategory, setHeroPhoto - Support for soft delete and hard delete with file cleanup Phase 2.3: Settings service layer - Create backend/src/services/settingsService.js - Functions: getAllSettings, getSetting, getSettingsByPrefix - Functions: updateSetting, updateSettings, deleteSetting - Functions: getPublicSettings, getBrandingSettings, getEmailSettings - Type-aware setting parsing (boolean, number, json, string) All core service layers are now established for: - Events (CRUD, slug generation, expiration) - Photos (CRUD, categories, sorting, hero) - Settings (typed get/set, prefix queries) Routes can be incrementally migrated to use these services.	2026-01-02 10:16:55 +01:00
Paul Nothaft	3424bd22ee	refactor: Phase 1 code consolidation and service layer setup ... Phase 1.1: Shared parsers utility - Create backend/src/utils/parsers.js with parseBooleanInput, parseStringInput, etc. - Create frontend/src/utils/parsers.ts with TypeScript equivalents - Update routes to import from shared parsers Phase 1.2: Auth routes consolidation - Merge auth.js, auth-enhanced.js, auth-enhanced-v2.js into single auth.js - Add password change and password strength endpoints - Consolidate middleware (auth.js with token revocation support) - Update all imports across 14+ route files Phase 1.3: CreateEvent page consolidation - Remove duplicate CreateEventPage.tsx (basic version) - Rename CreateEventPageEnhanced.tsx to CreateEventPage.tsx - Update exports and imports Phase 1.4: CMS page consolidation - Remove duplicate CMSPage.tsx (basic version) - Rename CMSPageEnhanced.tsx to CMSPage.tsx - Update exports and imports Phase 1.5: Multer config factory - Create backend/src/config/multerConfig.js - Centralized upload configuration with presets for photos, logos, favicons - Reusable helpers: createDiskStorage, createFileFilter, uploadTimeoutMiddleware Phase 2.1: Event service layer - Create backend/src/services/eventService.js - Move event business logic out of routes - Functions: createEvent, getAllEvents, updateEvent, deleteEvent, extendExpiration	2026-01-02 10:12:24 +01:00
Paul Nothaft	77a4bfd499	feat: implement 4 new features with bug fixes and refactoring plan ... ## Features Implemented ### 1. Event Rename Functionality - Add EventRenameDialog component with live slug preview - Create eventRenameService for safe event renaming - Add slug_redirects table for old URL redirects - Support optional email notification on rename - Fix date formatting in slug (YYYY-MM-DD format) ### 2. Optional Event Contact Fields - Add settings to make customer name/email/admin email optional - Create migration for field requirement settings - Update CreateEventPage forms to show "(optional)" labels - Fix boolean parsing in publicSettings.js ### 3. Photo Filtering & Export - Add PhotoFilterPanel with rating/likes/favorites/comments filters - Create PhotoExportMenu with ZIP/metadata/XMP export options - Add photoExportService with Lightroom XMP sidecar generation - Create photoFilterBuilder utility for query construction - Wire up photo selection to export button via onSelectionChange ### 4. Custom CSS Gallery Templates - Add CssTemplateEditor component with 3 template slots - Create cssSanitizer utility blocking XSS vectors - Add gallery CSS endpoint for template delivery - Integrate Custom CSS tab into Settings page - Include default "Elegant Dark" template ## Bug Fixes - Fix event rename date formatting (was showing full Date string) - Fix common.optional translation key missing in locales - Fix photo export button staying disabled when photos selected - Fix authService import missing in SettingsPage ## Documentation - Add comprehensive REFACTORING_PLAN.md for codebase improvement - Add test specification documents for all features - Add feature documentation for CSS templates ## Database Migrations - 049_add_slug_redirects.js - 050_add_optional_event_fields_settings.js - 051_add_photo_filter_indexes.js - 052_add_css_templates.js	2026-01-02 09:56:19 +01:00
Paul Nothaft	64ceb20431	Add planning document for photo filtering and export feature ... Comprehensive feature plan for filtering photos by guest feedback (ratings, likes, favorites) and exporting selections for professional photo editing workflows. Export formats supported: - TXT: Simple filename list for Lightroom filter paste - CSV: Spreadsheet with metadata columns - XMP: Sidecar files with ratings/labels for Lightroom/Capture One - ZIP: Original photos with folder organization - JSON: Structured metadata for automation Key features: - Admin filter UI with rating thresholds and feedback toggles - AND/OR filter logic - Quick presets (Guest Picks, Top Rated, Most Popular) - Photo selection with batch actions - XMP rating mapping (PicPeak 1-5 → XMP 1-5 + color labels) - Background job support for large exports - Export settings dialog with customization options Research references: - Adobe XMP/Lightroom metadata standards - Capture One EIP format - IPTC Photo Metadata Standard - ExifTool capabilities	2026-01-02 00:00:00 +01:00
Paul Nothaft	e0204aeeee	Add planning document for optional event contact fields ... Addresses GitHub issue #60 - making customer name, customer email, and admin email fields optional when creating events. This feature adds three new admin settings: - event_require_customer_name (default: true) - event_require_customer_email (default: true) - event_require_admin_email (default: true) Implementation includes: - Database migration for new app_settings entries - Backend conditional validation in event creation - Frontend settings UI with toggle switches - Dynamic form validation based on settings - Warning messages for email-related settings - Graceful handling of empty contact fields Maintains backward compatibility with default behavior unchanged.	2026-01-01 23:52:07 +01:00
Paul Nothaft	7df481f7ea	Add planning document for event rename feature ... This document outlines the implementation plan for allowing administrators to rename gallery events with full Option B implementation: - Database updates (events, photos, new slug_redirects table) - File system changes (folders and photo files) - New API endpoint: POST /api/admin/events/:id/rename - Frontend UI components (button, dialog, progress indicator) - Email notification option for resending invitation - Slug redirect support for backward compatibility - Transaction handling with rollback mechanism The feature includes: - Rename button on event detail page - Confirmation dialog with new name input - Real-time slug preview - Checkbox to resend invitation email - Progress indicator during operation - Redirect to renamed event on success	2026-01-01 23:50:28 +01:00
Paul Nothaft	5b5e431b08	Implement per-IP gallery lockouts and UI controls (#42)	2025-10-20 14:35:23 +02:00
Paul Nothaft	31fd64c83c	Add short gallery URL toggle and token support (#38)	2025-10-15 07:21:09 +02:00
Paul Nothaft	775c5159ea	Add customer contact fields and admin API docs (refs #41)	2025-10-14 18:29:21 +02:00
Paul Nothaft	8f297e25c4	Make photo upload limit configurable via admin settings (#40)	2025-10-14 16:27:44 +02:00
Paul Nothaft	ccb65b892b	Rename setup script and bump installer version (#39)	2025-10-14 15:48:55 +02:00
Paul Nothaft	52f8f1f738	Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)	2025-10-13 21:11:38 +02:00
Paul Nothaft	e731e7b47c	Address tar-fs CVE-2025-59343	2025-10-13 21:09:52 +02:00
Paul Nothaft	2bccb1a439	Handle pre-existing docker app dir (#32)	2025-10-13 20:59:50 +02:00
Paul Nothaft	df10fc677e	Send gallery image requests with bearer token fallback (#31)	2025-10-13 20:29:07 +02:00
Paul Nothaft	1b1e4f715d	Rename event owner fields to customer (#37)	2025-10-13 20:09:28 +02:00
Paul Nothaft	68eb9ba552	Clarify event owner labeling in UI (#37)	2025-10-13 20:02:52 +02:00
Paul Nothaft	7040865154	Fix admin password reset guidance in setup.sh (#34)	2025-10-13 19:58:07 +02:00
Paul Nothaft	013be18d98	fix: clear notifications via API (#35)	2025-10-13 17:41:06 +02:00
Paul Nothaft	3c2a79a31a	feat: allow admin email updates in UI (#36)	2025-10-13 17:21:03 +02:00