87 Commits

Include renames

Author	SHA1	Message	Date
Paul Nothaft	4272618b3f	fix(security): resolve all npm audit vulnerabilities ... Frontend (6 → 0 vulnerabilities): - axios: update to fix DoS via __proto__ key in mergeConfig (CVE-2026-25639) - swiper: update to fix prototype pollution (critical) - rollup: update to fix arbitrary file write via path traversal - minimatch: update to fix multiple ReDoS vulnerabilities - ajv: update to fix ReDoS with $data option - markdown-it: update to fix ReDoS Backend (32 → 0 vulnerabilities): - multer: update to fix DoS via incomplete cleanup and resource exhaustion - minimatch: update to fix multiple ReDoS vulnerabilities - Add npm overrides for transitive dependencies: - fast-xml-parser >=5.3.8 (fixes XSS, DoS, stack overflow via AWS SDK) - qs >=6.14.2 (fixes arrayLimit bypass DoS via Express) - tar >=7.5.8 (fixes path traversal and hardlink attacks via sqlite3) Docker: - Pin nginx base image to 1.27-alpine in Dockerfile.prod - Update security comments in backend Dockerfile - Existing apk upgrade --no-cache ensures OpenSSL/libexpat CVEs are patched at build time (OpenSSL 3.5.5, Alpine 3.23.3)	2026-03-02 10:36:47 +01:00
Paul Nothaft	6491184402	chore: add dependencies for Gallery Premium/Story layouts ... Add missing npm packages required for new gallery layouts: - yet-another-react-lightbox: lightbox component - framer-motion: animations - photoswipe: photo gallery - swiper: carousel/slider	2026-02-06 21:43:09 +01:00
Paul Nothaft	608bbd50e7	feat: add justified layout modes and aspect-ratio-aware mosaic (#146) ... - Add Flickr justified-layout and react-photo-album as masonry mode options - Implement aspect-ratio-aware mosaic layout that dynamically selects patterns based on photo orientations to minimize cropping - Add 9 mosaic pattern types optimized for different orientation combinations - Add theme customizer options for masonry mode selection (columns/rows/flickr/justified) - Add i18n translations for new layout options	2026-01-28 22:31:34 +01:00
Paul Nothaft	8097a0cb53	fix: update packages to fix security vulnerabilities ... - react-router-dom 6.30.2 → 6.30.3 (XSS via Open Redirects) - react-router 6.30.2 → 6.30.3 - @remix-run/router 1.23.1 → 1.23.2 - lodash 4.17.21 → 4.17.23 (Prototype Pollution)	2026-01-27 11:40:18 +01:00
Paul Nothaft	892e47d017	feat: add multi-administrator support with RBAC and fix backup/restore for S3 ... ## Multi-Administrator System - Add role-based access control (RBAC) with predefined roles (Super Admin, Admin, Editor, Viewer) - Add granular permissions system for all admin operations - Add admin user management page with invite functionality - Add email invitation system for new administrators - Add permission middleware protecting all admin routes - Add PermissionGate component for frontend permission checks - Track event creator (created_by) for audit purposes ## Backup & Restore Fixes - Fix S3 backup: endpoint URL handling, manifest loading, field name compatibility - Fix S3 restore: add list-backups endpoint, transform S3 config from frontend format - Fix PostgreSQL compatibility: add .returning('id') for insert operations - Fix disk space check: use df command, handle unknown space gracefully - Fix dry-run validation to not block on warnings - Fix req.user → req.admin in restore routes ## Database Migrations - 054: Add roles table with predefined roles - 055: Add permissions table - 056: Add role_permissions junction table - 057: Add role_id to admin_users - 058: Add admin_invitations table - 059: Add admin email templates - 060: Add created_by to events table ## Other Improvements - Update .gitignore to exclude planning docs and local backup directory - Remove SQLite database file from tracking - Add i18n translations for user management (EN/DE)	2026-01-07 17:10:46 +01:00
Paul Nothaft	3424bd22ee	refactor: Phase 1 code consolidation and service layer setup ... Phase 1.1: Shared parsers utility - Create backend/src/utils/parsers.js with parseBooleanInput, parseStringInput, etc. - Create frontend/src/utils/parsers.ts with TypeScript equivalents - Update routes to import from shared parsers Phase 1.2: Auth routes consolidation - Merge auth.js, auth-enhanced.js, auth-enhanced-v2.js into single auth.js - Add password change and password strength endpoints - Consolidate middleware (auth.js with token revocation support) - Update all imports across 14+ route files Phase 1.3: CreateEvent page consolidation - Remove duplicate CreateEventPage.tsx (basic version) - Rename CreateEventPageEnhanced.tsx to CreateEventPage.tsx - Update exports and imports Phase 1.4: CMS page consolidation - Remove duplicate CMSPage.tsx (basic version) - Rename CMSPageEnhanced.tsx to CMSPage.tsx - Update exports and imports Phase 1.5: Multer config factory - Create backend/src/config/multerConfig.js - Centralized upload configuration with presets for photos, logos, favicons - Reusable helpers: createDiskStorage, createFileFilter, uploadTimeoutMiddleware Phase 2.1: Event service layer - Create backend/src/services/eventService.js - Move event business logic out of routes - Functions: createEvent, getAllEvents, updateEvent, deleteEvent, extendExpiration	2026-01-02 10:12:24 +01:00
paul	7c7498385f	Regenerate frontend package-lock to match package.json	2025-11-28 18:44:38 +01:00
Claude	5f1affafd8	Update frontend package-lock.json for npm compatibility ... Regenerate lock file to include missing esbuild platform dependencies required by newer npm versions.	2025-11-28 17:54:56 +01:00
paul	9a75f1c929	Add video support, media filters, and translations	2025-11-28 13:29:44 +01:00
paul	bce5f749b1	Merge remote-tracking branch 'upstream/main'	2025-11-25 22:43:48 +02:00
Claude	f327f4cbcd	Update package-lock.json files to sync with security overrides	2025-11-25 20:40:29 +00:00
paul	a971eee7b9	Merge remote-tracking branch 'origin/main'	2025-11-25 22:03:02 +02:00
paul	8e8dd358bf	Merge remote-tracking branch 'upstream/main'	2025-11-25 22:02:23 +02:00
Gitea Actions Bot	f29e9db99d	chore: bump version to 1.1.15 (backend + frontend)	2025-10-29 11:30:46 +00:00
paul	69538b86ea	Fix mobile overlay and deps per #43	2025-10-29 12:19:43 +01:00
paul	f6f1c31369	Fix mobile overlay and deps per #43	2025-10-29 11:11:53 +01:00
Gitea Actions Bot	b76e45cb54	chore: bump version to 1.1.14 (backend + frontend)	2025-10-20 12:41:34 +00:00
Gitea Actions Bot	07759a0e40	chore: bump version to 1.1.13 (backend + frontend)	2025-10-15 05:29:19 +00:00
Gitea Actions Bot	8c690155bf	chore: bump frontend version to 1.1.12	2025-10-13 18:19:57 +00:00
Gitea Actions Bot	f20472ca26	chore: bump version to 1.1.11 (backend + frontend)	2025-10-12 19:23:19 +00:00
Gitea Actions Bot	87f4526220	chore: bump version to 1.1.10 (backend + frontend)	2025-10-12 19:18:37 +00:00
Gitea Actions Bot	d42a11680f	chore: bump version to 1.1.9 (backend + frontend)	2025-10-06 13:18:43 +00:00
Gitea Actions Bot	38dd74b893	chore: bump version to 1.1.8 (backend + frontend)	2025-10-03 05:19:52 +00:00
paul	775e417e55	Fix admin reference mode regressions	2025-10-02 23:39:17 +02:00
Gitea Actions Bot	45e835a51a	chore: bump frontend version to 1.1.7	2025-09-27 06:14:25 +00:00
Gitea Actions Bot	afc00090cf	chore: bump frontend version to 1.1.6	2025-09-27 06:11:45 +00:00
Gitea Actions Bot	fb739f221d	chore: bump version to 1.1.4 (backend + frontend)	2025-09-24 15:39:34 +00:00
Gitea Actions Bot	9d2726b3d3	chore: bump frontend version to 1.1.1	2025-09-22 12:41:16 +00:00
paul	39d2244e1e	chore: switch versioning workflows to manual triggers	2025-09-19 22:31:55 +02:00
Gitea Actions Bot	eb626be22c	chore: bump version to 1.0.130 (backend + frontend)	2025-09-19 14:47:37 +00:00
Gitea Actions Bot	e51347d0a1	chore: bump version to 1.0.128 (backend + frontend)	2025-09-18 14:05:43 +00:00
paul	71e7179145	Harden auth cookies and fix native schema for event creation	2025-09-18 15:59:26 +02:00
Gitea Actions Bot	1d8be3d840	chore: bump frontend version to 1.0.127	2025-09-17 21:40:18 +00:00
Gitea Actions Bot	ed2a278da2	chore: bump frontend version to 1.0.126	2025-09-17 21:22:44 +00:00
Gitea Actions Bot	eb3751cb52	chore: bump frontend version to 1.0.125	2025-09-14 15:08:14 +00:00
Gitea Actions Bot	0d77a3a0a8	chore: bump version to 1.0.124 (backend + frontend)	2025-09-14 14:25:37 +00:00
Gitea Actions Bot	aa9b3a0227	chore: bump version to 1.0.123 (backend + frontend)	2025-09-14 13:53:37 +00:00
Gitea Actions Bot	05ebaaeedb	chore: bump version to 1.0.122 (backend + frontend)	2025-09-09 18:54:09 +00:00
Gitea Actions Bot	6a4b549d9f	chore: bump version to 1.0.121 (backend + frontend)	2025-09-09 18:45:28 +00:00
Gitea Actions Bot	8404125ff0	chore: bump version to 1.0.117 (backend + frontend)	2025-09-09 17:10:38 +00:00
Gitea Actions Bot	9fd6b44487	chore: bump version to 1.0.116 (backend + frontend)	2025-09-09 15:47:41 +00:00
Gitea Actions Bot	f2abb40987	chore: bump version to 1.0.115 (backend + frontend)	2025-09-09 15:32:47 +00:00
Gitea Actions Bot	4aa0ff705f	chore: bump version to 1.0.114 (backend + frontend)	2025-09-09 15:25:05 +00:00
Gitea Actions Bot	448882cfef	chore: bump version to 1.0.113 (backend + frontend)	2025-09-09 13:31:10 +00:00
Gitea Actions Bot	798f6211e0	chore: bump version to 1.0.112 (backend + frontend)	2025-09-09 09:46:52 +00:00
Gitea Actions Bot	afeb35a446	chore: bump version to 1.0.111 (backend + frontend)	2025-09-06 07:22:38 +00:00
Gitea Actions Bot	78ab0ad2e9	chore: bump version to 1.0.110 (backend + frontend)	2025-09-05 22:06:43 +00:00
Gitea Actions Bot	1d826accdc	chore: bump version to 1.0.109 (backend + frontend)	2025-09-05 13:07:58 +00:00
Gitea Actions Bot	f7a8765f58	chore: bump version to 1.0.108 (backend + frontend)	2025-09-02 15:46:57 +00:00
Gitea Actions Bot	88659f1fa6	chore: bump frontend version to 1.0.107	2025-09-02 14:14:52 +00:00