- Change from bcryptjs to bcrypt to match installed dependency
- Fixes "Cannot find module 'bcryptjs'" error when creating admin user
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Major fixes for production deployment issues:
1. Migration System:
- Add safe migration runner that handles existing schema
- Create migration helper functions for idempotent operations
- Auto-detect existing tables and mark migrations as applied
- Handle "relation already exists" errors gracefully
2. Production Initialization:
- Create init-production.sh script for proper startup sequence
- Fix directory creation and permissions
- Add admin user creation from environment variables
- Ensure proper service initialization order
3. Documentation:
- Add comprehensive PRODUCTION_DEPLOYMENT_GUIDE.md
- Add MIGRATION_ERROR_FIX.md for immediate issue resolution
- Document all known production issues and solutions
- Include backup/restore procedures
4. Safety Improvements:
- Add migrate:safe npm script for production use
- Update wait-for-db.sh to use safe migrations in production
- Add proper error handling and logging
This resolves the "relation already exists" error and prevents similar
issues in future deployments. The safe migration system can handle both
fresh installations and existing databases.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix "no pg_hba.conf entry" error by disabling SSL for Docker network
- Use scram-sha-256 authentication method for better security
- Update knexfile.js to support SSL configuration via environment variable
- Add documentation about PostgreSQL connection requirements
The PostgreSQL container now accepts connections from the Docker network
without requiring SSL, which is appropriate for internal container communication.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix database connection error "getaddrinfo ENOTFOUND postgres"
- Add wait-for-db.sh script to ensure PostgreSQL is ready before starting
- Fix email processor initialization timing issue
- Add missing storage path environment variables
- Add database dependency to backend service
- Enhance health check endpoint with database connectivity check
- Update production database defaults to match docker-compose
- Install postgresql-client in Docker image for health checks
- Document all required environment variables in .env.example
Fixes immediate production deployment failures and ensures proper service startup order.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add pg package required for production PostgreSQL connections
- Fixes "Cannot find module 'pg'" error in production deployment
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix database configuration to use PostgreSQL in production
- Add knexfile.js to support both SQLite (dev) and PostgreSQL (prod)
- Create admin user creation script (scripts/create-admin.js)
- Clean up docker-compose files:
- Remove redundant docker-compose.yml and docker-compose.local.yml
- Create docker-compose.dev.yml for development
- Update docker-compose.prod.yml with proper DB configuration
- Clean up environment files:
- Update .env.example for development
- Update .env.production.example with proper settings
- Remove redundant .env.local
- Update backend .env.example with database configuration options
- Create comprehensive DEPLOYMENT.md with admin setup instructions
- Fix production database name consistency (picpeak instead of photoapp)
- Configure custom Content Security Policy for React app compatibility
- Add Permissions-Policy header to disable unnecessary browser features
- Set HSTS to 1 year with preload flag for better transport security
- Update referrer policy to strict-origin-when-cross-origin
- Restrict CORS localhost origins to development environment only
- Production deployments now only allow configured FRONTEND_URL and ADMIN_URL
- Addresses security headers configuration issues from security scan
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Security Enhancements:
- Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries
- Add LIKE pattern escaping to prevent SQL injection in search functionality
- Implement account lockout protection (5 failed attempts = 30 min lockout)
- Add comprehensive login attempt tracking and audit trail
- Enhance JWT tokens with issuer validation, IP tracking, and password change detection
- Add logout endpoint and session management
- Prevent user enumeration with generic error messages
Database Changes:
- Add login_attempts table for authentication tracking
- Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled)
New Security Features:
- Brute force protection with configurable lockout duration
- Automatic cleanup of old login attempts
- Enhanced authentication middleware with stricter validation
- Monitoring scripts for security health checks
All fixes are backward compatible and production-ready with rollback plans included.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
BREAKING CHANGE: Admin password is now auto-generated on first setup
Security improvements:
- Remove hardcoded 'admin123' password completely
- Generate secure random password on first installation
- Save credentials to ADMIN_CREDENTIALS.txt (git-ignored)
- Force password change on first login
- Implement strong password requirements (12+ chars, mixed case, numbers, special)
- Add password strength validation
- Increase bcrypt rounds from 10 to 12
New features:
- Password generator utility with secure random generation
- Human-readable password format (e.g., SwiftEagle3847\!)
- Password reset script for existing installations
- Comprehensive admin setup documentation
- Must-change-password flag in database
Migration guide:
- New installations: Check ADMIN_CREDENTIALS.txt for generated password
- Existing installations: Run scripts/reset-admin-password.js
- All users must change password on first login after update
This fixes a critical vulnerability where all installations used the same
default admin password, allowing unauthorized access.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
BREAKING CHANGE: Server now requires JWT_SECRET environment variable to be set
Security fixes:
- Remove hardcoded JWT secret fallback 'your-secret-key' from protectedImages.js
- Add startup validation to ensure JWT_SECRET is properly configured
- Reject insecure default values and short secrets
- Server will refuse to start without proper JWT_SECRET
This fixes a critical vulnerability where the application would use a publicly
known secret if JWT_SECRET was not set, completely compromising authentication.
Migration guide: docs/JWT_SECRET_MIGRATION.md
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add clickable gallery links in all email templates
- Include application logo in email header and footer (custom or PicPeak default)
- Redesign emails with professional styling matching gallery login page
- Gray background with white content box
- PicPeak green header with centered logo
- Clean typography and proper spacing
- Responsive design for mobile devices
- Styled call-to-action buttons
- Footer with branding and copyright
- Update email processor to fetch branding settings dynamically
- Use proper API URLs for logo images in emails
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix photo upload cross-device link error
- Changed fs.rename to fs.copyFile + fs.unlink to handle Docker volume mounts
- This fixes EXDEV errors when uploading photos from /tmp to storage
- Improve gallery login error handling
- Add console logging for debugging
- Prevent form refresh with stopPropagation
- Show specific error messages based on status codes
- Keep password field populated on error for retry
- Map 404 to gallery not found message
- Enhanced upload error messages
- Show specific error message for each failed file
- Display backend error messages in toast notifications
These fixes resolve:
1. Photo uploads failing silently with cross-device link errors
2. Login errors not displaying and form refreshing
3. Upload errors not showing user-friendly messages
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix user upload feature not showing in gallery
- Add allow_user_uploads and upload_category_id to auth response
- These fields are required for the gallery to show the upload button
- Improve gallery login error messages
- Add specific translations for wrong password vs rate limiting
- Map backend error messages to user-friendly translations
- Added auth.wrongPassword and auth.tooManyAttempts keys
- Gallery pages already have full translation support
- GalleryPage and GalleryView use i18n properly
- All text is translated based on selected language
These fixes resolve:
1. User upload button not showing even when enabled
2. Generic error messages for wrong passwords
3. No feedback for rate limiting
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix system version endpoint to read package.json using fs instead of require
- Prevents MODULE_NOT_FOUND error in Docker container
- Uses path.join to find package.json reliably
- Fix event creation email queue error
- Change email_type from 'creation' to 'gallery_created' to match template key
- Update email_data to include all required template variables
- Added missing created_at and updated_at columns to email_queue table
- Fix file watcher duplicate photo insertion
- Add check to prevent re-inserting existing photos on backend restart
These fixes resolve:
1. 500 error when accessing /api/admin/system/version
2. 500 error when creating new events
3. Email queue processing errors
4. Photo duplication issue
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix gallery-specific authentication for images
- Update AuthenticatedImage component to use gallery-specific tokens
- Add isGallery prop to distinguish between admin and gallery contexts
- Update PhotoGrid and PhotoLightbox to pass isGallery prop
- Fix photo duplication issue in fileWatcher service
- Add check to prevent duplicate photo entries when backend restarts
- File watcher now verifies if photo exists before inserting
- Cleaned up 176 duplicate photos from database
These fixes resolve:
1. Gallery images not loading due to auth token errors
2. Photo count increasing without new uploads due to duplicates
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add version display above storage consumption in admin sidebar
- Fix storage consumption to stick to bottom of window using flexbox
- Add user upload settings to events (allow uploads, category selection)
- Enhance disk space tab to comprehensive system status view
- Add localized date formatting for German/English language support
- Remove quick actions from dashboard for cleaner interface
- Create user photo upload functionality for galleries
- Add database migration for user upload settings
- Update all TypeScript types and interfaces
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add language columns to email_templates table (subject_en/de, body_html_en/de, body_text_en/de)
- Update adminEmail.js routes to support language-specific templates
- Create EmailProcessor service to handle language selection based on recipient
- Update EmailConfigPage component with language tabs similar to CMS pages
- Add German translations for all email templates
- Update all email queue usage to use proper template keys
- Add missing email templates (gallery_expired, archive_complete)
- Integrate email processor service into main server startup
The system now automatically selects the appropriate language (English/German) based on the recipient's email domain or preferences.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Added default_language field to general settings state in SettingsPage
- Replaced LanguageSelector component with simple select dropdown on settings page
- Fixed public settings endpoint to read general_default_language from database
- Language setting now properly saved when clicking Save Settings button
- Setting is correctly used by gallery login page and legal pages
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add skip function to rate limiter that bypasses limits for authenticated admins
- Verify JWT token to identify admin users
- Admin users can now make unlimited API requests
- Other users still subject to rate limits (100 requests per 15 minutes)
- Update BrandingPage to save settings to database instead of localStorage
- Add public settings endpoint for galleries to fetch branding/theme
- Update GalleryView to apply branding settings in footer
- Apply theme settings from database to gallery pages
- Support event-specific themes that override global settings
- Ensure watermark and all branding settings are stored in database
- Update frontend settings service to use correct /api/admin/settings/general route
- Fix all req.user to req.admin references in adminSettings.js
- Ensures settings can be saved without authentication errors
- Remove created_at field from email_queue insert (table uses scheduled_at)
- Let scheduled_at use its default value from database schema
This fixes the 500 error that occurred when creating events due to
trying to insert a non-existent column.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix req.user undefined error by using req.admin from middleware
- Return proper ISO date strings in event creation response
- Include created_at in response for frontend navigation
This fixes the 500 error when creating events and ensures the frontend
receives the expected data format for navigation.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Convert Unix timestamps to ISO strings before sending to frontend
- Store dates as ISO strings in database during event creation
- Fix created_at, expires_at, and archived_at date conversions
This resolves the "Invalid time value" error that occurred when viewing
the events page due to SQLite returning dates as Unix timestamps.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Frontend fixes:
- Disable verbatimModuleSyntax in TypeScript config to fix module imports
- Add displayName to critical React components for better production debugging
- Configure Vite build with manual chunks for better code splitting
- Enable sourcemaps for production debugging
Backend fixes:
- Remove updated_at field from events table insert (column doesn't exist)
- Fix SQL error that was causing 500 errors on event creation
These changes resolve:
- React error #130 that occurred during login and event creation
- 500 Internal Server Error when creating new events
- Better error tracking in production builds
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fixed malformed JSX structure in App.tsx Routes configuration
- Added missing service exports in services/index.ts
- Added ErrorBoundary wrappers to all admin routes for consistency
- Fixed indentation and nesting issues in route definitions
This resolves the login and event creation errors.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fixed all Card components to use padding prop instead of className
- Updated padding values: p-4 -> sm, p-6 -> md, p-8 -> lg
- This resolves the React element type invalid error
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fixed frontend API URL configuration to use correct port 3002
- Fixed create event functionality by adding proper endpoint and fixing JSON parsing
- Fixed email settings save functionality by importing logActivity correctly
- Fixed admin settings save functionality by using api client instead of direct fetch
- Implemented password change functionality with modal and backend endpoint
- Added updated_at column to admin_users table
- Fixed all mock data issues - now using real backend data throughout
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Create adminEvents.js router to handle /api/admin/events endpoints
- Mount events router in admin.js to fix 404 errors
- Fix admin layout CSS - changed from static to flex layout
- Update AdminSidebar positioning from static to relative
- Add missing PUT endpoints for general and security settings
- Fix frontend environment variables in docker-compose.local.yml
- Add build args to Dockerfile.dev for environment variables
- Update CORS to accept requests from all dev servers
- Remove unused imports from SettingsPage
This fixes:
- Events page 404 error
- Admin layout misalignment (sidebar and content on different rows)
- Settings page not loading
- CORS issues between frontend and backend
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add database tables for email configs, settings, and activity logs
- Create backend endpoints for dashboard stats, analytics, archives, email config, and settings
- Create frontend service layer (admin, archive, email, settings services)
- Update AdminDashboard to use real statistics and activity data
- Update AnalyticsPage to fetch real analytics from backend
- Update ArchivesPage with pagination and real archive operations
- Update EmailConfigPage to manage real SMTP config and templates
- Remove all mock data and replace with API calls throughout admin interface
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Gitea Actions Bot
paul