Fix mobile overlay and deps per #43

DEPLOYMENT_GUIDE.md

@@ -7,9 +7,9 @@ This guide covers multiple deployment options for PicPeak, from simple local set
 For the easiest installation without Docker or complex configurations, use our **unified setup script**:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/picpeak-setup.sh -o picpeak-setup.sh && \
-chmod +x picpeak-setup.sh && \
-sudo ./picpeak-setup.sh
+curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/setup.sh -o setup.sh && \
+chmod +x setup.sh && \
+sudo ./setup.sh
 ```
 
 This automated script handles everything including:
@@ -219,17 +219,14 @@ Update `.env` with:
 - **URL Configuration** (for backend CORS):
   - `FRONTEND_URL` - Frontend origin (use full URL with scheme, no trailing slash)
     - Example (Docker): `http://localhost:3000`
-- `ADMIN_URL` - Admin origin (same as `FRONTEND_URL` for Docker; full URL, no trailing slash)
-  - Example (Docker): `http://localhost:3000`
+  - `ADMIN_URL` - Admin origin (same as `FRONTEND_URL` for Docker; full URL, no trailing slash)
+    - Example (Docker): `http://localhost:3000`
   
   Notes:
   - Do not include trailing `/` (e.g., use `http://host:3000`, not `http://host:3000/`).
   - Always include the scheme (`http://` or `https://`).
   - The backend compares origins strictly for CORS; malformed values will cause login requests to fail with 500.
 
-#### Authentication Security
-- Configure login attempt thresholds from **Admin → Settings → Security**. Defaults are 5 failed attempts per IP within 15 minutes, resulting in a 30 minute lockout.
-
 #### External Database Example
 To use an external PostgreSQL instead of the bundled container, set the following in `.env` and ensure the `postgres` service is disabled or removed:
 
@@ -427,10 +424,10 @@ If you lose your admin credentials after the first login, you'll need to manuall
 
 ```bash
 # Native reinstall example
-sudo ./picpeak-setup.sh --native --force-admin-password-reset
+sudo ./setup.sh --native --force-admin-password-reset
 
 # Docker reinstall example
-sudo ./picpeak-setup.sh --docker --force-admin-password-reset
+sudo ./setup.sh --docker --force-admin-password-reset
 ```
 
 The flag calls `scripts/reset-admin-password.js` in non-interactive mode, writes a fresh random password into `data/ADMIN_CREDENTIALS.txt`, and prints the new credentials at the end of the installer run.

README.md

@@ -85,8 +85,6 @@ Note on Docker file permissions (PUID/PGID)
 
 - 📘 [**Deployment Guide**](DEPLOYMENT_GUIDE.md) - Detailed installation instructions
   - Includes the new [External Media Library](DEPLOYMENT_GUIDE.md#external-media-library) reference mode
-- 📚 [**Admin API (OpenAPI)**](docs/picpeak-admin-api.openapi.yaml) - Machine-readable documentation for event automation endpoints
-- 🛠️ [**Admin API Quickstart**](docs/admin-api-quickstart.md) - Step-by-step authentication and testing guide for the documented endpoints
 - 🤝 [**Contributing**](CONTRIBUTING.md) - How to contribute
 - 📜 [**License**](LICENSE) - MIT License
 - 🔒 [**Security**](SECURITY.md) - Security policies

SIMPLE_SETUP.md

@@ -8,9 +8,9 @@ This guide provides easy installation instructions for PicPeak on Linux servers
 
 ```bash
 # Download and run the unified setup script
-curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/picpeak-setup.sh -o picpeak-setup.sh && \
-chmod +x picpeak-setup.sh && \
-sudo ./picpeak-setup.sh
+curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/setup.sh -o setup.sh && \
+chmod +x setup.sh && \
+sudo ./setup.sh
 ```
 
 The script will automatically detect your environment and recommend the best installation method.
@@ -21,7 +21,7 @@ The script will automatically detect your environment and recommend the best ins
 Best for: Most users, easy updates, isolated environment
 
 ```bash
-sudo ./picpeak-setup.sh --docker
+sudo ./setup.sh --docker
 ```
 
 **Pros:**
@@ -38,7 +38,7 @@ sudo ./picpeak-setup.sh --docker
 Best for: Resource-constrained systems, Raspberry Pi, direct control
 
 ```bash
-sudo ./picpeak-setup.sh --native
+sudo ./setup.sh --native
 ```
 
 **Pros:**
@@ -73,7 +73,7 @@ sudo ./picpeak-setup.sh --native
 
 ### Interactive Mode (Default)
 ```bash
-sudo ./picpeak-setup.sh
+sudo ./setup.sh
 ```
 
 The script will prompt you to choose:
@@ -87,7 +87,7 @@ The script will prompt you to choose:
 
 #### Docker with full configuration:
 ```bash
-sudo ./picpeak-setup.sh --docker --unattended \
+sudo ./setup.sh --docker --unattended \
   --domain photos.example.com \
   --email admin@example.com \
   --admin-password SecurePass123 \
@@ -100,7 +100,7 @@ sudo ./picpeak-setup.sh --docker --unattended \
 
 #### Native with minimal configuration:
 ```bash
-sudo ./picpeak-setup.sh --native --unattended \
+sudo ./setup.sh --native --unattended \
   --email admin@example.com \
   --admin-password SecurePass123
 ```
@@ -293,7 +293,7 @@ sudo systemctl restart picpeak-backend picpeak-workers
 
 # Update PicPeak
 # (reruns migrations to pick up schema fixes for native installs)
-sudo ./picpeak-setup.sh --update
+sudo ./setup.sh --update
 ```
 
 ## ⚙️ Configuration
@@ -385,14 +385,14 @@ docker compose pull
 docker compose up -d
 
 # Native
-sudo ./picpeak-setup.sh --update
+sudo ./setup.sh --update
 ```
 
 ### Uninstall
 
 ```bash
 # Will prompt for confirmation and data removal options
-sudo ./picpeak-setup.sh --uninstall
+sudo ./setup.sh --uninstall
 ```
 
 ## 🐛 Troubleshooting
@@ -508,13 +508,13 @@ sudo systemctl restart picpeak-backend
 ### Home/Office Network
 ```bash
 # Simple local setup without domain
-sudo ./picpeak-setup.sh --native --email admin@local.com
+sudo ./setup.sh --native --email admin@local.com
 ```
 
 ### Public Website with HTTPS
 ```bash
 # Full production setup
-sudo ./picpeak-setup.sh --docker \
+sudo ./setup.sh --docker \
   --domain photos.company.com \
   --email admin@company.com \
   --enable-ssl
@@ -523,7 +523,7 @@ sudo ./picpeak-setup.sh --docker \
 ### Raspberry Pi Setup
 ```bash
 # Optimized for ARM devices
-sudo ./picpeak-setup.sh --native \
+sudo ./setup.sh --native \
   --port 8080 \
   --email pi@local.com
 ```

backend/__tests__/integration/adminPhotos.reference.test.js

@@ -0,0 +1,207 @@
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const express = require('express');
+const request = require('supertest');
+
+describe('Admin photos in reference mode', () => {
+  let tmpDir;
+  let storagePath;
+  let db;
+  let app;
+  let categoryId;
+
+  const resetModules = () => {
+    jest.resetModules();
+    jest.clearAllMocks();
+  };
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-admin-photos-'));
+    storagePath = path.join(tmpDir, 'storage');
+    await fs.promises.mkdir(storagePath, { recursive: true });
+
+    process.env.NODE_ENV = 'test';
+    process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'data', 'photo_sharing_test.db');
+    await fs.promises.mkdir(path.dirname(process.env.TEST_DATABASE_PATH), { recursive: true });
+    try {
+      await fs.promises.unlink(process.env.TEST_DATABASE_PATH);
+    } catch (_) {
+      /* ignore */
+    }
+    process.env.STORAGE_PATH = storagePath;
+
+    resetModules();
+
+    jest.doMock('../../src/middleware/auth', () => ({
+      adminAuth: (req, _res, next) => {
+        req.admin = { id: 1, username: 'tester' };
+        next();
+      }
+    }));
+
+    jest.doMock('../../src/services/imageProcessor', () => ({
+      generateThumbnail: jest.fn().mockResolvedValue('thumbnails/mock-thumb.jpg'),
+      ensureThumbnail: jest.fn()
+    }));
+
+    jest.doMock('../../src/middleware/uploadValidation', () => ({
+      validateUploadedFiles: (_req, _res, next) => next()
+    }));
+
+    jest.doMock('../../src/utils/fileSecurityUtils', () => {
+      const actual = jest.requireActual('../../src/utils/fileSecurityUtils');
+      return {
+        ...actual,
+        validateFileType: () => true,
+        createFileUploadValidator: () => (_req, _res, next) => next()
+      };
+    });
+
+    jest.doMock('../../src/utils/logger', () => ({
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn()
+    }));
+
+    const dbModule = require('../../src/database/db');
+    db = dbModule.db;
+
+    await db.schema.dropTableIfExists('photo_feedback');
+    await db.schema.dropTableIfExists('photos');
+    await db.schema.dropTableIfExists('photo_categories');
+    await db.schema.dropTableIfExists('events');
+
+    await db.schema.createTable('events', (table) => {
+      table.increments('id').primary();
+      table.string('slug').notNullable();
+      table.string('event_name').notNullable();
+      table.string('source_mode').notNullable();
+      table.string('external_path');
+    });
+
+    await db.schema.createTable('photo_categories', (table) => {
+      table.increments('id').primary();
+      table.string('name').notNullable();
+      table.string('slug').notNullable();
+      table.boolean('is_global').defaultTo(true);
+      table.integer('event_id');
+    });
+
+    await db.schema.createTable('photos', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').notNullable();
+      table.string('filename').notNullable();
+      table.string('path').notNullable();
+      table.string('thumbnail_path');
+      table.string('type').notNullable();
+      table.integer('size_bytes');
+      table.integer('category_id');
+      table.string('source_origin');
+      table.string('external_relpath');
+      table.datetime('uploaded_at').defaultTo(db.fn.now());
+      table.float('average_rating').defaultTo(0);
+      table.integer('like_count').defaultTo(0);
+      table.integer('favorite_count').defaultTo(0);
+    });
+
+    await db.schema.createTable('photo_feedback', (table) => {
+      table.increments('id');
+      table.integer('photo_id');
+      table.string('feedback_type');
+      table.boolean('is_approved');
+      table.boolean('is_hidden');
+    });
+
+    await db('events').insert({
+      id: 1,
+      slug: 'test-event',
+      event_name: 'Test Event',
+      source_mode: 'reference',
+      external_path: 'external/library'
+    });
+
+    const insertedCategory = await db('photo_categories').insert({
+      name: 'Highlights',
+      slug: 'highlights',
+      is_global: true
+    });
+    categoryId = Array.isArray(insertedCategory) ? insertedCategory[0] : insertedCategory;
+
+    const router = require('../../src/routes/adminPhotos');
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/events', router);
+  });
+
+  afterAll(async () => {
+    if (db) {
+      await db.destroy();
+    }
+    resetModules();
+    delete process.env.TEST_DATABASE_PATH;
+    delete process.env.STORAGE_PATH;
+    if (tmpDir) {
+      await fs.promises.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it('stores managed uploads with category information and managed origin', async () => {
+    const uploadResponse = await request(app)
+      .post(`/api/admin/events/1/upload`)
+      .field('category_id', String(categoryId))
+      .attach('photos', Buffer.from('fake image data'), 'photo.jpg');
+
+    expect(uploadResponse.status).toBe(200);
+    expect(uploadResponse.body).toHaveProperty('photos');
+    expect(Array.isArray(uploadResponse.body.photos)).toBe(true);
+
+    const photo = await db('photos').first();
+    expect(photo).toBeTruthy();
+    expect(photo.category_id).toBe(categoryId);
+    expect(photo.source_origin).toBe('managed');
+    expect(photo.external_relpath).toBeNull();
+  });
+
+  it('returns numeric category metadata when listing photos', async () => {
+    await db('photos').insert({
+      event_id: 1,
+      filename: 'external.jpg',
+      path: 'test-event/external.jpg',
+      thumbnail_path: null,
+      type: 'individual',
+      size_bytes: 123,
+      source_origin: 'external',
+      external_relpath: 'individual/external.jpg'
+    });
+
+    const response = await request(app)
+      .get(`/api/admin/events/1/photos`)
+      .expect(200);
+
+    expect(Array.isArray(response.body.photos)).toBe(true);
+    const managedPhoto = response.body.photos.find((p) => p.category_id === categoryId);
+    expect(managedPhoto).toBeTruthy();
+    expect(managedPhoto.category_name).toBe('Highlights');
+
+    const filtered = await request(app)
+      .get(`/api/admin/events/1/photos`)
+      .query({ category_id: String(categoryId) })
+      .expect(200);
+
+    expect(filtered.body.photos.every((p) => p.category_id === categoryId)).toBe(true);
+  });
+
+  it('normalizes category updates', async () => {
+    const photo = await db('photos').first();
+
+    await request(app)
+      .patch(`/api/admin/events/1/photos/${photo.id}`)
+      .send({ category_id: '0' })
+      .expect(200);
+
+    const updated = await db('photos').where({ id: photo.id }).first();
+    expect(updated.category_id).toBeNull();
+  });
+});

backend/__tests__/services/photoResolver.test.js

@@ -66,6 +66,16 @@ describe('resolvePhotoFilePath', () => {
     expect(result).toBe(path.join('/mock/external', 'picsum-demo/individual', 'look-02.jpg'));
   });
 
+  it('falls back to managed storage when external metadata is missing', () => {
+    const event = { slug: 'fashion-show', source_mode: 'reference', external_path: 'picsum-demo' };
+    const photo = { path: 'fashion-show/new-upload.jpg' };
+
+    const result = resolvePhotoFilePath(event, photo);
+
+    expect(resolveExternalPath).not.toHaveBeenCalled();
+    expect(result).toBe(path.join(backendRoot, 'storage', 'events/active', 'fashion-show', 'new-upload.jpg'));
+  });
+
   it('throws when external photo is missing relative path data', () => {
     const event = { slug: 'fashion-show', source_mode: 'reference', external_path: 'picsum-demo' };
     const photo = { source_origin: 'external' };

backend/dependencies-backend.json

@@ -1831,8 +1831,8 @@
       }
     },
     "nodemailer": {
-      "version": "7.0.7",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.7.tgz",
+      "version": "6.10.1",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-6.10.1.tgz",
       "overridden": false
     },
     "nodemon": {
@@ -2086,8 +2086,8 @@
               "version": "4.0.1"
             },
             "tar-fs": {
-              "version": "2.1.4",
-              "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
+              "version": "2.1.3",
+              "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
               "overridden": false
             },
             "tunnel-agent": {

backend/migrations/core/045_add_max_files_per_upload_setting.js

@@ -1,48 +0,0 @@
-const { DEFAULT_MAX_FILES_PER_UPLOAD, MAX_ALLOWED_FILES_PER_UPLOAD } = require('../../src/services/uploadSettings');
-
-exports.up = async function up(knex) {
-  const settingKey = 'general_max_files_per_upload';
-
-  const existing = await knex('app_settings')
-    .where({ setting_key: settingKey })
-    .first();
-
-  if (existing) {
-    // Normalize existing value into allowed bounds
-    let parsedValue;
-    try {
-      parsedValue = existing.setting_value != null ? JSON.parse(existing.setting_value) : null;
-    } catch {
-      parsedValue = existing.setting_value;
-    }
-
-    const numeric = Number(parsedValue);
-    let normalized = DEFAULT_MAX_FILES_PER_UPLOAD;
-    if (Number.isFinite(numeric) && numeric >= 1) {
-      normalized = Math.min(MAX_ALLOWED_FILES_PER_UPLOAD, Math.floor(numeric));
-    }
-
-    if (normalized !== numeric) {
-      await knex('app_settings')
-        .where({ setting_key: settingKey })
-        .update({
-          setting_value: JSON.stringify(normalized),
-          updated_at: new Date()
-        });
-    }
-    return;
-  }
-
-  await knex('app_settings').insert({
-    setting_key: settingKey,
-    setting_value: JSON.stringify(DEFAULT_MAX_FILES_PER_UPLOAD),
-    setting_type: 'general',
-    updated_at: new Date()
-  });
-};
-
-exports.down = async function down(knex) {
-  await knex('app_settings')
-    .where({ setting_key: 'general_max_files_per_upload' })
-    .del();
-};

backend/migrations/core/046_add_customer_contact_fields.js

@@ -1,44 +0,0 @@
-const { addColumnIfNotExists } = require('../helpers');
-
-exports.up = async function up(knex) {
-  await addColumnIfNotExists(knex, 'events', 'customer_name', (table) => {
-    table.string('customer_name');
-  });
-
-  await addColumnIfNotExists(knex, 'events', 'customer_email', (table) => {
-    table.string('customer_email');
-  });
-
-  // Backfill new columns from legacy host_* fields
-  const client = knex?.client?.config?.client;
-
-  if (client === 'pg') {
-    await knex.raw(`
-      UPDATE events
-      SET customer_name = COALESCE(customer_name, host_name),
-          customer_email = COALESCE(customer_email, host_email)
-    `);
-  } else {
-    // SQLite fallback
-    await knex('events').update({
-      customer_name: knex.raw('COALESCE(customer_name, host_name)'),
-      customer_email: knex.raw('COALESCE(customer_email, host_email)')
-    });
-  }
-};
-
-exports.down = async function down(knex) {
-  const hasCustomerName = await knex.schema.hasColumn('events', 'customer_name');
-  if (hasCustomerName) {
-    await knex.schema.alterTable('events', (table) => {
-      table.dropColumn('customer_name');
-    });
-  }
-
-  const hasCustomerEmail = await knex.schema.hasColumn('events', 'customer_email');
-  if (hasCustomerEmail) {
-    await knex.schema.alterTable('events', (table) => {
-      table.dropColumn('customer_email');
-    });
-  }
-};

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "picpeak-backend",
-  "version": "1.1.14",
+  "version": "1.1.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "picpeak-backend",
-      "version": "1.1.14",
+      "version": "1.1.5",
       "dependencies": {
         "@aws-sdk/client-s3": "^3.850.0",
         "@aws-sdk/lib-storage": "^3.850.0",
@@ -5154,6 +5154,29 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/encoding": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
+      "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "iconv-lite": "^0.6.2"
+      }
+    },
+    "node_modules/encoding/node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/end-of-stream": {
       "version": "1.4.5",
       "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "picpeak-backend",
-  "version": "1.1.14",
+  "version": "1.1.5",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "scripts": {
@@ -55,10 +55,5 @@
     "mock-fs": "^5.5.0",
     "nodemon": "^3.1.10",
     "supertest": "^6.3.3"
-  },
-  "overrides": {
-    "prebuild-install": {
-      "tar-fs": "2.1.4"
-    }
   }
 }

backend/src/database/db.js

@@ -3,7 +3,6 @@ const path = require('path');
 const knex = require('knex');
 const knexConfig = require('../../knexfile');
 const logger = require('../utils/logger');
-const { extractShareToken } = require('../utils/shareLinkUtils');
 
 // Ensure SQLite directory exists when using file-based DB (native installs)
 try {
@@ -64,16 +63,12 @@ async function initializeDatabase() {
       table.string('event_type').notNullable();
       table.string('event_name').notNullable();
       table.date('event_date').notNullable();
-      table.string('customer_name');
-      table.string('customer_email');
       table.string('host_email').notNullable();
-      table.string('host_name');
       table.string('admin_email').notNullable();
       table.string('password_hash').notNullable();
       table.text('welcome_message');
       table.text('color_theme');
       table.string('share_link').unique().notNullable();
-      table.string('share_token').unique();
       table.datetime('created_at').defaultTo(db.fn.now());
       table.datetime('expires_at').notNullable();
       table.boolean('is_active').defaultTo(true);
@@ -104,16 +99,12 @@ async function initializeDatabase() {
             event_type TEXT NOT NULL,
             event_name TEXT NOT NULL,
             event_date DATE NOT NULL,
-            customer_name TEXT,
-            customer_email TEXT,
-            host_name TEXT,
             host_email TEXT NOT NULL,
             admin_email TEXT NOT NULL,
             password_hash TEXT NOT NULL,
             welcome_message TEXT,
             color_theme TEXT,
             share_link TEXT UNIQUE NOT NULL,
-            share_token TEXT UNIQUE,
             created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
             expires_at DATETIME NOT NULL,
             is_active BOOLEAN DEFAULT 1,
@@ -166,37 +157,6 @@ async function initializeDatabase() {
     }
   }
 
-  const hasShareTokenColumn = await db.schema.hasColumn('events', 'share_token');
-  if (!hasShareTokenColumn) {
-    await db.schema.table('events', (table) => {
-      table.string('share_token').unique();
-    });
-  }
-
-  const hasHostNameColumn = await db.schema.hasColumn('events', 'host_name');
-  if (!hasHostNameColumn) {
-    await db.schema.table('events', (table) => {
-      table.string('host_name');
-    });
-  }
-
-  try {
-    const eventsWithoutToken = await db('events')
-      .whereNull('share_token')
-      .select('id', 'share_link');
-
-    for (const event of eventsWithoutToken) {
-      const token = extractShareToken(event.share_link);
-      if (token) {
-        await db('events')
-          .where({ id: event.id })
-          .update({ share_token: token });
-      }
-    }
-  } catch (error) {
-    logger.warn('Share token backfill skipped', { error: error.message });
-  }
-
   // Photo metadata table
   const hasPhotosTable = await db.schema.hasTable('photos');
   if (!hasPhotosTable) {

backend/src/routes/__tests__/adminAuth.test.js

@@ -0,0 +1,99 @@
+const request = require('supertest');
+const express = require('express');
+
+const buildChain = ({ firstResult, updateResult } = {}) => {
+  const chain = {
+    where: jest.fn().mockReturnThis(),
+    whereNot: jest.fn().mockReturnThis(),
+    select: jest.fn().mockReturnThis(),
+    update: jest.fn().mockResolvedValue(updateResult ?? 1),
+    first: jest.fn().mockResolvedValue(firstResult),
+  };
+  return chain;
+};
+
+jest.mock('../../database/db', () => {
+  const dbMock = jest.fn();
+  dbMock.raw = jest.fn();
+  dbMock.__setImplementations = (...chains) => {
+    dbMock.mockReset();
+    chains.forEach((chain) => {
+      dbMock.mockImplementationOnce(() => chain);
+    });
+  };
+  return {
+    db: dbMock,
+    logActivity: jest.fn().mockResolvedValue(undefined),
+  };
+});
+
+jest.mock('../../middleware/auth-enhanced-v2', () => ({
+  adminAuth: (_req, _res, next) => {
+    _req.admin = { id: 1, username: 'admin' };
+    next();
+  },
+}));
+
+const { db, logActivity } = require('../../database/db');
+const adminAuthRouter = require('../adminAuth');
+
+describe('adminAuth profile updates', () => {
+  const app = express();
+  app.use(express.json());
+  app.use('/auth/admin', adminAuthRouter);
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('updates the admin profile', async () => {
+    const updatedUser = {
+      id: 1,
+      username: 'newadmin',
+      email: 'newadmin@example.com',
+      must_change_password: false,
+    };
+
+    db.__setImplementations(
+      buildChain({ firstResult: null }),          // email check
+      buildChain({ firstResult: null }),          // username check
+      buildChain({ updateResult: 1 }),            // update
+      buildChain({ firstResult: updatedUser }),   // fetch updated user
+    );
+
+    const response = await request(app)
+      .put('/auth/admin/profile')
+      .send({ username: updatedUser.username, email: updatedUser.email })
+      .expect(200);
+
+    expect(response.body).toEqual({ user: updatedUser });
+    expect(logActivity).toHaveBeenCalledWith(
+      'admin_profile_updated',
+      { admin_id: 1, updated_fields: ['username', 'email'] },
+      null,
+      { type: 'admin', id: 1, name: updatedUser.username }
+    );
+  });
+
+  it('rejects email conflicts', async () => {
+    db.__setImplementations(
+      buildChain({ firstResult: { id: 2 } })
+    );
+
+    const response = await request(app)
+      .put('/auth/admin/profile')
+      .send({ username: 'newadmin', email: 'taken@example.com' })
+      .expect(409);
+
+    expect(response.body).toEqual({ error: 'Email is already in use by another admin' });
+  });
+
+  it('validates input', async () => {
+    const response = await request(app)
+      .put('/auth/admin/profile')
+      .send({ username: '', email: 'not-an-email' })
+      .expect(400);
+
+    expect(response.body.errors).toBeDefined();
+  });
+});

backend/src/routes/__tests__/adminNotifications.test.js

@@ -0,0 +1,67 @@
+const request = require('supertest');
+const express = require('express');
+
+jest.mock('../../database/db', () => {
+  const deleteMock = jest.fn().mockResolvedValue(5);
+  const chain = {
+    select: jest.fn().mockReturnThis(),
+    leftJoin: jest.fn().mockReturnThis(),
+    orderBy: jest.fn().mockReturnThis(),
+    limit: jest.fn().mockReturnThis(),
+    whereNull: jest.fn().mockReturnThis(),
+    whereNotNull: jest.fn().mockReturnThis(),
+    where: jest.fn().mockReturnThis(),
+    update: jest.fn().mockReturnThis(),
+    delete: deleteMock,
+    count: jest.fn().mockReturnThis(),
+    first: jest.fn().mockResolvedValue({ count: 0 }),
+  };
+
+  const dbMock = jest.fn(() => chain);
+  dbMock.raw = jest.fn();
+  dbMock.__chain = chain;
+  dbMock.__deleteMock = deleteMock;
+  return { db: dbMock };
+});
+
+jest.mock('../../middleware/auth-enhanced-v2', () => ({
+  adminAuth: (_req, _res, next) => next(),
+}));
+
+const { db } = require('../../database/db');
+const notificationsRouter = require('../adminNotifications');
+
+describe('adminNotifications routes', () => {
+  const app = express();
+  app.use(express.json());
+  app.use('/admin/notifications', notificationsRouter);
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('clears all notifications', async () => {
+    db.__deleteMock.mockResolvedValueOnce(8);
+
+    const response = await request(app)
+      .delete('/admin/notifications/clear-all')
+      .expect(200);
+
+    expect(db).toHaveBeenCalledWith('activity_logs');
+    expect(db.__deleteMock).toHaveBeenCalledTimes(1);
+    expect(response.body).toEqual({
+      message: 'All notifications cleared',
+      deletedCount: 8,
+    });
+  });
+
+  it('handles database errors when clearing notifications', async () => {
+    db.__deleteMock.mockRejectedValueOnce(new Error('boom'));
+
+    const response = await request(app)
+      .delete('/admin/notifications/clear-all')
+      .expect(500);
+
+    expect(response.body).toEqual({ error: 'Failed to clear notifications' });
+  });
+});

backend/src/routes/adminAuth.js

@@ -8,93 +8,6 @@ const { validatePasswordStrength } = require('../utils/passwordGenerator');
 const router = express.Router();
 
 // Change password
-router.get('/profile', adminAuth, async (req, res) => {
-  try {
-    const admin = await db('admin_users')
-      .where('id', req.admin.id)
-      .select('id', 'username', 'email', 'last_login', 'last_login_ip', 'created_at', 'updated_at', 'must_change_password as mustChangePassword')
-      .first();
-
-    if (!admin) {
-      return res.status(404).json({ error: 'Admin user not found' });
-    }
-
-    res.json(admin);
-  } catch (error) {
-    console.error('Admin profile fetch error:', error);
-    res.status(500).json({ error: 'Failed to fetch admin profile' });
-  }
-});
-
-router.put('/profile', [
-  adminAuth,
-  body('username')
-    .trim()
-    .isLength({ min: 3, max: 50 })
-    .withMessage('Username must be between 3 and 50 characters'),
-  body('email')
-    .trim()
-    .isEmail()
-    .withMessage('A valid email address is required')
-    .normalizeEmail()
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-
-    const username = req.body.username.trim();
-    const email = req.body.email.trim().toLowerCase();
-    const adminId = req.admin.id;
-
-    const existingUsername = await db('admin_users')
-      .where('username', username)
-      .whereNot('id', adminId)
-      .first();
-
-    if (existingUsername) {
-      return res.status(409).json({ error: 'Username is already in use' });
-    }
-
-    const existingEmail = await db('admin_users')
-      .where('email', email)
-      .whereNot('id', adminId)
-      .first();
-
-    if (existingEmail) {
-      return res.status(409).json({ error: 'Email address is already in use' });
-    }
-
-    await db('admin_users')
-      .where('id', adminId)
-      .update({
-        username,
-        email,
-        updated_at: new Date()
-      });
-
-    await logActivity('admin_profile_updated',
-      { username, email },
-      null,
-      { type: 'admin', id: adminId, name: req.admin.username }
-    );
-
-    const updatedAdmin = await db('admin_users')
-      .where('id', adminId)
-      .select('id', 'username', 'email', 'must_change_password as mustChangePassword')
-      .first();
-
-    res.json({
-      message: 'Admin profile updated successfully',
-      user: updatedAdmin
-    });
-  } catch (error) {
-    console.error('Admin profile update error:', error);
-    res.status(500).json({ error: 'Failed to update admin profile' });
-  }
-});
-
 router.post('/change-password', [
   adminAuth,
   body('currentPassword').notEmpty().withMessage('Current password is required'),
@@ -159,6 +72,68 @@ router.post('/change-password', [
   }
 });
 
+// Update admin profile
+router.put('/profile', [
+  adminAuth,
+  body('username').trim().notEmpty().withMessage('Username is required'),
+  body('email').trim().isEmail().withMessage('Valid email is required')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { username, email } = req.body;
+    const userId = req.admin.id;
+
+    // Check for email conflicts
+    const existingEmail = await db('admin_users')
+      .where('email', email)
+      .whereNot('id', userId)
+      .first();
+
+    if (existingEmail) {
+      return res.status(409).json({ error: 'Email is already in use by another admin' });
+    }
+
+    // Check username conflict (if multiple admins are supported)
+    const existingUsername = await db('admin_users')
+      .where('username', username)
+      .whereNot('id', userId)
+      .first();
+
+    if (existingUsername) {
+      return res.status(409).json({ error: 'Username is already in use by another admin' });
+    }
+
+    await db('admin_users')
+      .where('id', userId)
+      .update({
+        username,
+        email,
+        updated_at: new Date()
+      });
+
+    const updatedUser = await db('admin_users')
+      .select('id', 'username', 'email', 'must_change_password')
+      .where('id', userId)
+      .first();
+
+    await logActivity(
+      'admin_profile_updated',
+      { admin_id: userId, updated_fields: ['username', 'email'] },
+      null,
+      { type: 'admin', id: userId, name: username }
+    );
+
+    res.json({ user: updatedUser });
+  } catch (error) {
+    console.error('Admin profile update error:', error);
+    res.status(500).json({ error: 'Failed to update admin profile' });
+  }
+});
+
 // Logout
 router.post('/logout', adminAuth, async (req, res) => {
   try {

backend/src/routes/adminEvents-enhanced.js

@@ -2,14 +2,13 @@
 // Only the relevant parts are shown - merge with existing adminEvents.js
 
 const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
-const { buildShareLinkVariants } = require('../services/shareLinkService');
 
 // Enhanced event creation with password validation
 router.post('/', adminAuth, [
   body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
   body('event_name').notEmpty().trim(),
   body('event_date').isDate(),
-  body('customer_email').isEmail().normalizeEmail(),
+  body('host_email').isEmail().normalizeEmail(),
   body('admin_email').isEmail().normalizeEmail(),
   body('password').notEmpty(), // Remove the weak isLength validation
   body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
@@ -17,7 +16,7 @@ router.post('/', adminAuth, [
   body('color_theme').optional().trim(),
   body('allow_user_uploads').optional().isBoolean().toBoolean(),
   body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
-  body('customer_name').notEmpty().trim()
+  body('host_name').notEmpty().trim()
 ], async (req, res) => {
   try {
     console.log('Create event request body:', req.body);
@@ -31,8 +30,8 @@ router.post('/', adminAuth, [
       event_type,
       event_name,
       event_date,
-      customer_name,
-      customer_email,
+      host_name,
+      host_email,
       admin_email,
       password,
       welcome_message = '',
@@ -66,9 +65,9 @@ router.post('/', adminAuth, [
       counter++;
     }
     
-    // Generate share link based on configured style
+    // Generate share link
     const shareToken = crypto.randomBytes(16).toString('hex');
-    const { shareUrl, shareLinkToStore } = await buildShareLinkVariants({ slug, shareToken });
+    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
     
     // Hash password with configurable rounds
     const password_hash = await bcrypt.hash(password, getBcryptRounds());
@@ -89,16 +88,13 @@ router.post('/', adminAuth, [
       event_type,
       event_name,
       event_date,
-      customer_name,
-      customer_email,
-      host_name: customer_name,
-      host_email: customer_email,
+      host_name,
+      host_email,
       admin_email,
       password_hash,
       welcome_message,
       color_theme,
-      share_link: shareLinkToStore,
-      share_token: shareToken,
+      share_link: shareLink,
       expires_at: expires_at.toISOString(),
       created_at: new Date().toISOString(),
       allow_user_uploads,
@@ -125,4 +121,4 @@ router.post('/', adminAuth, [
     console.error('Error creating event:', error);
     res.status(500).json({ error: 'Failed to create event' });
   }
-});
+});

backend/src/routes/adminEvents.js

@@ -14,7 +14,6 @@ const { escapeLikePattern } = require('../utils/sqlSecurity');
 // formatDate import removed - dates are formatted by email processor
 const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
 const logger = require('../utils/logger');
-const { buildShareLinkVariants } = require('../services/shareLinkService');
 
 const parseBooleanInput = (value, defaultValue = true) => {
   if (value === undefined || value === null) {
@@ -38,67 +37,12 @@ const parseBooleanInput = (value, defaultValue = true) => {
   return defaultValue;
 };
 
-const getCustomerNameFromPayload = (payload = {}) => {
-  if (typeof payload.customer_name === 'string') {
-    const trimmed = payload.customer_name.trim();
-    return trimmed || null;
-  }
-  return null;
-};
-
-const getCustomerEmailFromPayload = (payload = {}) => {
-  if (typeof payload.customer_email === 'string') {
-    const trimmed = payload.customer_email.trim();
-    return trimmed || null;
-  }
-  return null;
-};
-
-const mapEventForApi = (event) => {
-  if (!event || typeof event !== 'object') {
-    return event;
-  }
-
-  const {
-    host_name,
-    host_email,
-    customer_name,
-    customer_email,
-    ...rest
-  } = event;
-
-  return {
-    ...rest,
-    customer_name: customer_name ?? host_name ?? null,
-    customer_email: customer_email ?? host_email ?? null
-  };
-};
-
-let customerColumnCache = null;
-const hasCustomerContactColumns = async () => {
-  if (customerColumnCache === true) {
-    return true;
-  }
-
-  try {
-    const hasColumn = await db.schema.hasColumn('events', 'customer_email');
-    if (hasColumn) {
-      customerColumnCache = true;
-    }
-    return hasColumn;
-  } catch (error) {
-    logger.debug('Failed to detect customer_email column', { error: error.message });
-    return false;
-  }
-};
-
 // Create new event
 router.post('/', adminAuth, [
   body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
   body('event_name').notEmpty().trim(),
   body('event_date').isDate(),
-  body('customer_name').notEmpty().trim(),
-  body('customer_email').isEmail().normalizeEmail(),
+  body('host_email').isEmail().normalizeEmail(),
   body('admin_email').isEmail().normalizeEmail(),
   body('require_password').optional().isBoolean(),
   body('password').optional().isString().custom((value, { req }) => {
@@ -129,6 +73,7 @@ router.post('/', adminAuth, [
   body('color_theme').optional().trim(),
   body('allow_user_uploads').optional().isBoolean().toBoolean(),
   body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
+  body('host_name').notEmpty().trim(),
   body('allow_downloads').optional().isBoolean(),
   body('disable_right_click').optional().isBoolean(),
   body('watermark_downloads').optional().isBoolean(),
@@ -146,6 +91,8 @@ router.post('/', adminAuth, [
       event_type,
       event_name,
       event_date,
+      host_name,
+      host_email,
       admin_email,
       password,
       welcome_message = '',
@@ -168,16 +115,7 @@ router.post('/', adminAuth, [
       moderate_comments = true,
       show_feedback_to_guests = true
     } = req.body;
-
-    const customerName = getCustomerNameFromPayload(req.body);
-    const customerEmail = getCustomerEmailFromPayload(req.body);
-
-    const customerColumnsAvailable = await hasCustomerContactColumns();
-
-    if (!customerName || !customerEmail) {
-      return res.status(400).json({ error: 'customer_name and customer_email are required' });
-    }
-
+    
     const requirePassword = parseBooleanInput(requirePasswordInput, true);
 
     // Debug logging
@@ -195,6 +133,7 @@ router.post('/', adminAuth, [
     });
     
     let passwordValidation = null;
+    let galleryPassword = password;
 
     if (requirePassword) {
       passwordValidation = await validatePasswordInContext(password, 'gallery', {
@@ -209,6 +148,8 @@ router.post('/', adminAuth, [
           feedback: passwordValidation.feedback
         });
       }
+    } else {
+      galleryPassword = '';
     }
     
     // Generate unique slug
@@ -226,9 +167,11 @@ router.post('/', adminAuth, [
       counter++;
     }
     
-    // Generate share link respecting configured format
+    // Generate share link
     const shareToken = crypto.randomBytes(16).toString('hex');
-    const { sharePath, shareUrl, shareLinkToStore } = await buildShareLinkVariants({ slug, shareToken });
+    const sharePath = `/gallery/${slug}/${shareToken}`;
+    const frontendBase = (process.env.FRONTEND_URL || '').replace(/\/$/, '');
+    const shareLink = frontendBase ? `${frontendBase}${sharePath}` : sharePath;
     
     // Hash password with configurable rounds (random placeholder when not required)
     const password_hash = requirePassword
@@ -258,15 +201,13 @@ router.post('/', adminAuth, [
       event_type,
       event_name,
       event_date,
-      ...(customerColumnsAvailable ? { customer_name: customerName, customer_email: customerEmail } : {}),
-      host_name: customerName,
-      host_email: customerEmail,
+      host_name,
+      host_email,
       admin_email,
       password_hash,
       welcome_message,
       color_theme,
-      share_link: shareLinkToStore,
-      share_token: shareToken,
+      share_link: shareLink,
       expires_at: expires_at.toISOString(),
       created_at: new Date().toISOString(),
       allow_user_uploads,
@@ -310,15 +251,13 @@ router.post('/', adminAuth, [
     
     await db('email_queue').insert({
       event_id: eventId,
-      recipient_email: customerEmail,
+      recipient_email: host_email,
       email_type: 'gallery_created',
       email_data: JSON.stringify({
-        customer_name: customerName,
-        customer_email: customerEmail,
-        host_name: customerName || (customerEmail ? customerEmail.split('@')[0] : null),
+        host_name: host_name,
         event_name,
         event_date: event_date,  // Pass raw date - will be formatted by email processor
-        gallery_link: shareUrl,
+        gallery_link: shareLink,
         gallery_password: requirePassword ? password : 'No password required',
         expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
         welcome_message: welcome_message || ''
@@ -333,10 +272,8 @@ router.post('/', adminAuth, [
       slug,
       event_name,
       event_type,
-      customer_name: customerName,
-      customer_email: customerEmail,
       require_password: requirePassword,
-      share_link: shareUrl,
+      share_link: shareLink,
       expires_at: expires_at.toISOString(),
       created_at: new Date().toISOString()
     });
@@ -419,7 +356,7 @@ router.get('/', adminAuth, async (req, res) => {
       created_at: event.created_at ? new Date(event.created_at).toISOString() : null,
       expires_at: event.expires_at ? new Date(event.expires_at).toISOString() : null,
       archived_at: event.archived_at ? new Date(event.archived_at).toISOString() : null
-    })).map(mapEventForApi);
+    }));
 
     res.json({
       events: eventsWithCounts,
@@ -481,7 +418,7 @@ router.get('/:id', adminAuth, async (req, res) => {
       .where('event_id', id)
       .countDistinct('ip_address as uniqueVisitors');
 
-    res.json(mapEventForApi({
+    res.json({
       ...event,
       photo_count: parseInt(photoCount) || 0,
       total_size: parseInt(totalSize) || 0,
@@ -489,7 +426,7 @@ router.get('/:id', adminAuth, async (req, res) => {
       total_downloads: parseInt(totalDownloads) || 0,
       unique_visitors: parseInt(uniqueVisitors) || 0,
       recent_photos: recentPhotos
-    }));
+    });
   } catch (error) {
     console.error('Error fetching event:', error);
     res.status(500).json({ error: 'Failed to fetch event details' });
@@ -505,8 +442,7 @@ router.put('/:id', adminAuth, [
   body('welcome_message').optional({ nullable: true, checkFalsy: true }).trim(),
   body('color_theme').optional({ nullable: true }),
   body('allow_user_uploads').optional().isBoolean(),
-  body('customer_name').optional().trim().notEmpty(),
-  body('customer_email').optional().isEmail().normalizeEmail(),
+  body('host_name').optional().trim().notEmpty(),
   body('upload_category_id').optional().custom((value) => {
     // Accept null, undefined, or integer values
     if (value === null || value === undefined) return true;
@@ -545,39 +481,6 @@ router.put('/:id', adminAuth, [
 
     const { id } = req.params;
     const updates = { ...req.body };
-    const customerColumnsAvailable = await hasCustomerContactColumns();
-
-    if (Object.prototype.hasOwnProperty.call(updates, 'host_name') || Object.prototype.hasOwnProperty.call(updates, 'host_email')) {
-      return res.status(400).json({ error: 'host_name and host_email are no longer supported. Use customer_name and customer_email instead.' });
-    }
-
-    if (Object.prototype.hasOwnProperty.call(updates, 'customer_name')) {
-      const nextName = getCustomerNameFromPayload(updates);
-      if (nextName) {
-        if (customerColumnsAvailable) {
-          updates.customer_name = nextName;
-        } else {
-          delete updates.customer_name;
-        }
-        updates.host_name = nextName;
-      } else {
-        delete updates.customer_name;
-      }
-    }
-
-    if (Object.prototype.hasOwnProperty.call(updates, 'customer_email')) {
-      const nextEmail = getCustomerEmailFromPayload(updates);
-      if (nextEmail) {
-        if (customerColumnsAvailable) {
-          updates.customer_email = nextEmail;
-        } else {
-          delete updates.customer_email;
-        }
-        updates.host_email = nextEmail;
-      } else {
-        delete updates.customer_email;
-      }
-    }
 
     const hasRequirePasswordUpdate = Object.prototype.hasOwnProperty.call(updates, 'require_password');
     let requirePasswordUpdate;
@@ -812,13 +715,10 @@ router.post('/:id/reset-password', adminAuth, async (req, res) => {
 
     // Queue email notification if requested
     if (sendEmail) {
-      const recipientEmail = event.customer_email || event.host_email;
-      const recipientName = event.customer_name || event.host_name || (recipientEmail ? recipientEmail.split('@')[0] : null);
-
-      await queueEmail(id, recipientEmail, 'gallery_created', {
-        customer_name: recipientName,
-        customer_email: recipientEmail,
-        host_name: recipientName,
+      // For password reset, we'll need to create a template or use a different approach
+      // For now, let's use the gallery_created template with updated password
+      await queueEmail(id, event.host_email, 'gallery_created', {
+        host_name: event.host_email.split('@')[0],
         event_name: event.event_name,
         event_date: event.event_date,  // Pass raw date - will be formatted by email processor
         gallery_link: event.share_link,
@@ -873,13 +773,8 @@ router.post('/:id/resend-email', adminAuth, async (req, res) => {
     // Dates will be formatted by the email processor based on recipient language
     
     // Queue the email
-    const recipientEmail = event.customer_email || event.host_email;
-    const recipientName = event.customer_name || event.host_name || (recipientEmail ? recipientEmail.split('@')[0] : null);
-
-    await queueEmail(id, recipientEmail, 'gallery_created', {
-      customer_name: recipientName,
-      customer_email: recipientEmail,
-      host_name: recipientName,
+    await queueEmail(id, event.host_email, 'gallery_created', {
+      host_name: event.host_name || event.host_email.split('@')[0],
       event_name: event.event_name,
       event_date: event.event_date,  // Pass raw date - will be formatted by email processor
       gallery_link: event.share_link,
@@ -894,7 +789,7 @@ router.post('/:id/resend-email', adminAuth, async (req, res) => {
     try {
       await logActivity('email_resent', {
         email_type: 'gallery_created',
-        recipient: recipientEmail,
+        recipient: event.host_email,
         ip_address: req.ip || '0.0.0.0',
         user_agent: req.get('user-agent') || 'Unknown'
       }, id, {

backend/src/routes/adminNotifications.js

@@ -103,51 +103,14 @@ router.delete('/clear-old', adminAuth, async (req, res) => {
     // Use database-agnostic date calculation
     const thirtyDaysAgo = new Date();
     thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
-
-    let deletedCount = 0;
-    const client = db?.client?.config?.client;
-
-    if (client === 'pg') {
-      const primaryResult = await db.raw(
-        `
-          WITH deleted AS (
-            DELETE FROM activity_logs
-            WHERE read_at IS NOT NULL OR created_at < ?
-            RETURNING id
-          )
-          SELECT COUNT(*)::int AS count FROM deleted
-        `,
-        [thirtyDaysAgo.toISOString()]
-      );
-      deletedCount = primaryResult.rows?.[0]?.count || 0;
-
-      if (deletedCount === 0) {
-        const fallbackResult = await db.raw(
-          `
-            WITH deleted AS (
-              DELETE FROM activity_logs
-              RETURNING id
-            )
-            SELECT COUNT(*)::int AS count FROM deleted
-          `
-        );
-        deletedCount = fallbackResult.rows?.[0]?.count || 0;
-      }
-    } else {
-      deletedCount = await db('activity_logs')
-        .where(function () {
-          this.whereNotNull('read_at')
-            .orWhere('created_at', '<', thirtyDaysAgo);
-        })
-        .delete();
-
-      if (deletedCount === 0) {
-        deletedCount = await db('activity_logs').delete();
-      }
-    }
+    
+    const deletedCount = await db('activity_logs')
+      .whereNotNull('read_at')
+      .where('created_at', '<', thirtyDaysAgo)
+      .delete();
 
     res.json({ 
-      message: deletedCount > 0 ? 'Old notifications cleared' : 'No notifications to clear',
+      message: 'Old notifications cleared',
       deletedCount 
     });
   } catch (error) {
@@ -156,4 +119,18 @@ router.delete('/clear-old', adminAuth, async (req, res) => {
   }
 });
 
+// Delete all notifications
+router.delete('/clear-all', adminAuth, async (req, res) => {
+  try {
+    const deletedCount = await db('activity_logs').delete();
+    res.json({
+      message: 'All notifications cleared',
+      deletedCount
+    });
+  } catch (error) {
+    console.error('Clear all notifications error:', error);
+    res.status(500).json({ error: 'Failed to clear notifications' });
+  }
+});
+
 module.exports = router;

backend/src/routes/adminPhotos.js

@@ -8,12 +8,29 @@ const { generateThumbnail, ensureThumbnail } = require('../services/imageProcess
 const { generatePhotoFilename } = require('../utils/filenameSanitizer');
 const { escapeLikePattern } = require('../utils/sqlSecurity');
 const { validateUploadedFiles } = require('../middleware/uploadValidation');
-const { getMaxFilesPerUpload } = require('../services/uploadSettings');
 const router = express.Router();
 
 // Get storage path from environment or default
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 
+const parseCategoryId = (value) => {
+  if (value === undefined || value === null) return null;
+  if (typeof value === 'number' && Number.isInteger(value)) {
+    return value === 0 ? null : value;
+  }
+  if (typeof value === 'string') {
+    const trimmed = value.trim();
+    if (!trimmed || trimmed === 'null') return null;
+    if (/^\d+$/.test(trimmed)) {
+      const parsed = parseInt(trimmed, 10);
+      if (!Number.isNaN(parsed)) {
+        return parsed === 0 ? null : parsed;
+      }
+    }
+  }
+  return null;
+};
+
 // Configure multer for file uploads
 // IMPORTANT: Using synchronous functions to prevent file corruption
 const storage = multer.diskStorage({
@@ -49,7 +66,7 @@ const upload = multer({
   storage: storage,
   limits: {
     fileSize: 50 * 1024 * 1024, // 50MB limit per file
-    files: 2000, // Hard safety ceiling; actual limit enforced dynamically
+    files: 500, // Maximum 500 files
     // Set a reasonable field size limit to prevent memory issues
     fieldSize: 10 * 1024 * 1024, // 10MB for non-file fields
     // Add part size limits to prevent incomplete uploads
@@ -100,25 +117,17 @@ const uploadTimeout = (timeout = 300000) => { // 5 minutes default
 };
 
 // Upload photos for an event
-// Max file count is configurable via general settings
-router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), async (req, res, next) => { // 10 minute timeout
-  let maxFilesPerUpload;
-  try {
-    maxFilesPerUpload = await getMaxFilesPerUpload();
-  } catch (error) {
-    console.error('Failed to resolve max files per upload:', error);
-    return res.status(500).json({ error: 'Unable to determine upload limits' });
-  }
-
-  upload.array('photos', maxFilesPerUpload)(req, res, (err) => {
+// Increased limit to 500 files, but recommend chunked uploads for better performance
+router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, next) => { // 10 minute timeout
+  upload.array('photos', 500)(req, res, (err) => {
     if (err) {
       console.error('Multer error:', err);
       if (err instanceof multer.MulterError) {
         if (err.code === 'LIMIT_FILE_SIZE') {
           return res.status(400).json({ error: 'File too large. Maximum size is 50MB per file.' });
         }
-        if (err.code === 'LIMIT_FILE_COUNT' || err.code === 'LIMIT_UNEXPECTED_FILE') {
-          return res.status(400).json({ error: `Too many files. Maximum ${maxFilesPerUpload} files per upload.` });
+        if (err.code === 'LIMIT_FILE_COUNT') {
+          return res.status(400).json({ error: 'Too many files. Maximum 500 files per upload.' });
         }
         return res.status(400).json({ error: `Upload error: ${err.message}` });
       }
@@ -167,16 +176,16 @@ router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), async (req, re
     }
     
     // Parse category_id to number if provided
-    const parsedCategoryId = category_id ? parseInt(category_id, 10) : null;
+    const numericCategoryId = parseCategoryId(category_id);
     
     // Determine photo type from category_id parameter (for backwards compatibility)
     let photoType = 'individual'; // default
     let categoryName = 'individual';
     
-    if (parsedCategoryId === 1 || category_id === 'collage') {
+    if (numericCategoryId === 1 || category_id === 'collage') {
       photoType = 'collage';
       categoryName = 'collages';
-    } else if (parsedCategoryId === 2 || category_id === 'individual') {
+    } else if (numericCategoryId === 2 || category_id === 'individual') {
       photoType = 'individual';
       categoryName = 'individual';
     }
@@ -248,7 +257,9 @@ router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), async (req, re
               path: relativePath,
               thumbnail_path: null, // Will generate after successful commit
               type: photoType,
-              size_bytes: tempStats.size // Use actual file size from stat
+              size_bytes: tempStats.size, // Use actual file size from stat
+              category_id: numericCategoryId,
+              source_origin: 'managed'
             };
             
             batchPhotos.push(photoData);
@@ -484,9 +495,11 @@ router.patch('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
     }
     
     // Update photo
+    const normalizedCategoryId = parseCategoryId(category_id);
+
     await db('photos')
       .where({ id: photoId })
-      .update({ category_id: category_id || null });
+      .update({ category_id: normalizedCategoryId });
     
     res.json({ message: 'Photo updated successfully' });
   } catch (error) {
@@ -587,7 +600,7 @@ router.post('/:eventId/photos/bulk-update', adminAuth, async (req, res) => {
     // Update photos
     const updateData = {};
     if (updates.category_id !== undefined) {
-      updateData.category_id = updates.category_id || null;
+      updateData.category_id = parseCategoryId(updates.category_id);
     }
     
     await db('photos')
@@ -641,14 +654,22 @@ router.get('/:eventId/photos', adminAuth, async (req, res) => {
     const { category_id, type, search, sort = 'date', order = 'desc' } = req.query;
     
     let query = db('photos')
+      .leftJoin('photo_categories as pc', 'pc.id', 'photos.category_id')
       .where({ 'photos.event_id': eventId })
-      .select('photos.*');
+      .select(
+        'photos.*',
+        'pc.name as category_display_name',
+        'pc.slug as category_display_slug'
+      );
     
     // Filter by type (individual/collage) - category_id maps to type
     if (category_id !== undefined) {
-      if (category_id === '' || category_id === '0') {
-        // For backwards compatibility, empty category means no filter
-        // Don't filter anything
+      if (category_id === '') {
+        // No filter when empty string is provided
+      } else if (category_id === '0') {
+        query = query.whereNull('photos.category_id');
+      } else if (/^\d+$/.test(category_id)) {
+        query = query.where('photos.category_id', parseInt(category_id, 10));
       } else if (category_id === 'individual' || category_id === 'collage') {
         query = query.where({ 'photos.type': category_id });
       }
@@ -674,7 +695,11 @@ router.get('/:eventId/photos', adminAuth, async (req, res) => {
     }
     
     const photos = await query.orderBy(orderByColumn, order);
-    
+
+    if (photos.length === 0) {
+      return res.json({ photos: [] });
+    }
+
     // Get comment counts separately
     const commentCounts = await db('photo_feedback')
       .whereIn('photo_id', photos.map(p => p.id))
@@ -699,9 +724,11 @@ router.get('/:eventId/photos', adminAuth, async (req, res) => {
         // Always expose a thumbnail URL; backend will generate on demand if missing
         thumbnail_url: `/admin/photos/${eventId}/thumbnail/${photo.id}`,
         type: photo.type,
-        category_id: photo.type,
-        category_name: photo.type === 'individual' ? 'Individual Photos' : 'Collages',
-        category_slug: photo.type,
+        category_id: photo.category_id !== null && photo.category_id !== undefined
+          ? Number(photo.category_id)
+          : null,
+        category_name: photo.category_display_name || (photo.type === 'individual' ? 'Individual Photos' : 'Collages'),
+        category_slug: photo.category_display_slug || photo.type,
         size: photo.size_bytes,
         uploaded_at: photo.uploaded_at,
         // Feedback data

backend/src/routes/adminSettings.js

@@ -18,10 +18,7 @@ const {
   getRawPublicSiteSettings,
 } = require('../services/publicSiteService');
 const { sanitizeCss } = require('../utils/cssSanitizer');
-const { clearShareLinkSettingsCache } = require('../services/shareLinkService');
-const { resetSecurityConfigCache } = require('../utils/authSecurity');
 const router = express.Router();
-const { clearMaxFilesPerUploadCache, MAX_ALLOWED_FILES_PER_UPLOAD } = require('../services/uploadSettings');
 
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 
@@ -475,24 +472,9 @@ router.put('/theme', adminAuth, async (req, res) => {
 router.put('/general', adminAuth, async (req, res) => {
   try {
     const settings = { ...req.body };
-    let uploadLimitTouched = false;
 
     const publicSiteKeysTouched = Object.keys(settings).some((key) => key.startsWith('general_public_site_'));
 
-    if (Object.prototype.hasOwnProperty.call(settings, 'general_max_files_per_upload')) {
-      uploadLimitTouched = true;
-      const rawValue = Number(settings.general_max_files_per_upload);
-      const normalizedValue = Number.isFinite(rawValue) ? Math.floor(rawValue) : NaN;
-
-      if (!Number.isInteger(normalizedValue) || normalizedValue < 1 || normalizedValue > MAX_ALLOWED_FILES_PER_UPLOAD) {
-        return res.status(400).json({
-          error: `general_max_files_per_upload must be an integer between 1 and ${MAX_ALLOWED_FILES_PER_UPLOAD}`
-        });
-      }
-
-      settings.general_max_files_per_upload = normalizedValue;
-    }
-
     if (publicSiteKeysTouched) {
       if (Object.prototype.hasOwnProperty.call(settings, 'general_public_site_custom_css')) {
         settings.general_public_site_custom_css = sanitizeCss(settings.general_public_site_custom_css || '');
@@ -547,12 +529,6 @@ router.put('/general', adminAuth, async (req, res) => {
     if (publicSiteKeysTouched) {
       clearPublicSiteCache();
     }
-    if (uploadLimitTouched) {
-      clearMaxFilesPerUploadCache();
-    }
-    if (Object.prototype.hasOwnProperty.call(settings, 'general_short_gallery_urls')) {
-      clearShareLinkSettingsCache();
-    }
 
     // Log activity
     await db('activity_logs').insert({
@@ -591,8 +567,6 @@ router.put('/security', adminAuth, async (req, res) => {
         });
     }
 
-    resetSecurityConfigCache();
-
     // Log activity
     await db('activity_logs').insert({
       activity_type: 'security_settings_updated',

backend/src/routes/auth-enhanced-v2.js

@@ -12,14 +12,13 @@ const {
   checkSuspiciousActivity,
   getGenericAuthError
 } = require('../utils/authSecurity');
-const {
+const { 
   validatePasswordInContext,
   getBcryptRounds,
   logPasswordValidationFailure
 } = require('../utils/passwordValidation');
 const { endSession } = require('../middleware/sessionTimeout');
 const logger = require('../utils/logger');
-const { getClientIp } = require('../utils/requestIp');
 const router = express.Router();
 
 // Admin login with enhanced security
@@ -34,7 +33,7 @@ router.post('/admin/login', [
     }
     
     const { username, password, recaptchaToken } = req.body;
-    const ipAddress = getClientIp(req);
+    const ipAddress = req.ip || req.connection.remoteAddress;
     const userAgent = req.headers['user-agent'] || '';
     
     // Check account lockout first
@@ -176,7 +175,7 @@ router.post('/admin/change-password', [
     logger.info('Admin password changed', {
       userId: adminId,
       username: admin.username,
-      ip: ipAddress
+      ip: req.ip
     });
     
     res.json({ 
@@ -230,14 +229,14 @@ router.post('/gallery/verify', [
     }
     
     const { slug, password, recaptchaToken } = req.body;
-    const ipAddress = getClientIp(req);
+    const ipAddress = req.ip || req.connection.remoteAddress;
     const userAgent = req.headers['user-agent'] || '';
     
     const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
     const requiresPassword = !(event && (event.require_password === false || event.require_password === 0 || event.require_password === '0'));
 
     if (requiresPassword) {
-      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`, ipAddress);
+      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
       if (lockoutStatus.isLocked) {
         logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
         return res.status(423).json({ 

backend/src/routes/auth-enhanced.js

@@ -22,8 +22,6 @@ const {
   getAdminTokenFromRequest,
   getGalleryTokenFromRequest,
 } = require('../utils/tokenUtils');
-const { getEventShareToken, resolveShareIdentifier } = require('../services/shareLinkService');
-const { getClientIp } = require('../utils/requestIp');
 const router = express.Router();
 
 // Admin login with enhanced security
@@ -38,7 +36,7 @@ router.post('/admin/login', [
     }
     
     const { username, password, recaptchaToken } = req.body;
-    const ipAddress = getClientIp(req);
+    const ipAddress = req.ip || req.connection.remoteAddress;
     const userAgent = req.headers['user-agent'] || '';
     
     // Check account lockout first
@@ -173,7 +171,7 @@ router.post('/gallery/verify', [
     }
     
     const { slug, password, recaptchaToken } = req.body;
-    const ipAddress = getClientIp(req);
+    const ipAddress = req.ip || req.connection.remoteAddress;
     const userAgent = req.headers['user-agent'] || '';
     const event = await db('events')
       .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
@@ -187,7 +185,7 @@ router.post('/gallery/verify', [
     const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
 
     if (requiresPassword) {
-      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`, ipAddress);
+      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
       if (lockoutStatus.isLocked) {
         logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
         return res.status(423).json({ 
@@ -283,25 +281,21 @@ router.post('/gallery/share-login', [
     }
 
     const { slug, token } = req.body;
-    const ipAddress = getClientIp(req);
+    const ipAddress = req.ip || req.connection.remoteAddress;
     const userAgent = req.headers['user-agent'] || '';
 
-    let event = await db('events')
+    const event = await db('events')
       .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
       .first();
 
-    if (!event) {
-      const resolved = await resolveShareIdentifier(slug);
-      if (resolved?.event) {
-        event = resolved.event;
-      }
-    }
-
     if (!event) {
       return res.status(404).json({ error: 'Gallery not found' });
     }
 
-    const expectedToken = getEventShareToken(event);
+    let expectedToken = event.share_link;
+    if (expectedToken && expectedToken.includes('/')) {
+      expectedToken = expectedToken.split('/').pop();
+    }
 
     if (!expectedToken || token !== expectedToken) {
       return res.status(401).json({ error: 'Invalid or expired share link' });
@@ -318,7 +312,7 @@ router.post('/gallery/share-login', [
       issuer: 'picpeak-auth'
     });
 
-    await trackSuccessfulLogin(`gallery:${event.slug}:share`, ipAddress, userAgent);
+    await trackSuccessfulLogin(`gallery:${slug}:share`, ipAddress, userAgent);
     setGalleryAuthCookies(res, jwtToken, event.slug);
 
     const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');

backend/src/routes/events.js

@@ -9,7 +9,6 @@ const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const fs = require('fs').promises;
 const path = require('path');
 const router = express.Router();
-const { buildShareLinkVariants } = require('../services/shareLinkService');
 
 const parseBooleanInput = (value, defaultValue = true) => {
   if (value === undefined || value === null) {
@@ -33,66 +32,12 @@ const parseBooleanInput = (value, defaultValue = true) => {
   return defaultValue;
 };
 
-const getCustomerNameFromPayload = (payload = {}) => {
-  if (typeof payload.customer_name === 'string') {
-    const trimmed = payload.customer_name.trim();
-    return trimmed || null;
-  }
-  return null;
-};
-
-const getCustomerEmailFromPayload = (payload = {}) => {
-  if (typeof payload.customer_email === 'string') {
-    const trimmed = payload.customer_email.trim();
-    return trimmed || null;
-  }
-  return null;
-};
-
-const mapEventForApi = (event) => {
-  if (!event || typeof event !== 'object') {
-    return event;
-  }
-
-  const {
-    host_name,
-    host_email,
-    customer_name,
-    customer_email,
-    ...rest
-  } = event;
-
-  return {
-    ...rest,
-    customer_name: customer_name ?? host_name ?? null,
-    customer_email: customer_email ?? host_email ?? null
-  };
-};
-
-let customerColumnCache = null;
-const hasCustomerContactColumns = async () => {
-  if (customerColumnCache === true) {
-    return true;
-  }
-
-  try {
-    const hasColumn = await db.schema.hasColumn('events', 'customer_email');
-    if (hasColumn) {
-      customerColumnCache = true;
-    }
-    return hasColumn;
-  } catch (error) {
-    return false;
-  }
-};
-
 // Create new event
 router.post('/', adminAuth, [
   body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
   body('event_name').notEmpty(),
   body('event_date').isDate(),
-  body('customer_name').notEmpty().trim(),
-  body('customer_email').isEmail().normalizeEmail(),
+  body('host_email').isEmail(),
   body('admin_email').isEmail(),
   body('require_password').optional().isBoolean(),
   body('password').optional().isString().custom((value, { req }) => {
@@ -117,6 +62,7 @@ router.post('/', adminAuth, [
       event_type,
       event_name,
       event_date,
+      host_email,
       admin_email,
       password,
       require_password: requirePasswordInput = true,
@@ -125,15 +71,6 @@ router.post('/', adminAuth, [
       expiration_days = 30
     } = req.body;
 
-    const customerEmail = getCustomerEmailFromPayload(req.body);
-    const customerName = getCustomerNameFromPayload(req.body);
-
-    if (!customerName || !customerEmail) {
-      return res.status(400).json({ error: 'customer_name and customer_email are required' });
-    }
-
-    const customerColumnsAvailable = await hasCustomerContactColumns();
-
     const requirePassword = parseBooleanInput(requirePasswordInput, true);
 
     if (requirePassword) {
@@ -161,9 +98,12 @@ router.post('/', adminAuth, [
       counter++;
     }
     
-    // Generate share link variants (auto-detects short URL preference)
+    // Generate share link (just slug/token, not full URL)
     const shareToken = crypto.randomBytes(16).toString('hex');
-    const { sharePath, shareUrl, shareLinkToStore } = await buildShareLinkVariants({ slug, shareToken });
+    const sharePath = `/gallery/${slug}/${shareToken}`;
+    const frontendBase = (process.env.FRONTEND_URL || '').replace(/\/$/, '');
+    const fullShareLink = frontendBase ? `${frontendBase}${sharePath}` : sharePath;
+    const shareLinkSlug = `${slug}/${shareToken}`;
     
     // Hash password (or placeholder when not required)
     const password_hash = requirePassword
@@ -186,15 +126,12 @@ router.post('/', adminAuth, [
       event_type,
       event_name,
       event_date,
-      ...(customerColumnsAvailable ? { customer_name: customerName, customer_email: customerEmail } : {}),
-      host_name: customerName,
-      host_email: customerEmail,
+      host_email,
       admin_email,
       password_hash,
       welcome_message,
       color_theme,
-      share_link: shareLinkToStore,
-      share_token: shareToken,
+      share_link: shareLinkSlug,
       expires_at,
       require_password: formatBoolean(requirePassword)
     }).returning('id');
@@ -204,13 +141,11 @@ router.post('/', adminAuth, [
     
     // Queue creation email
     const { queueEmail } = require('../services/emailProcessor');
-    await queueEmail(eventId, customerEmail, 'gallery_created', {
-      customer_name: customerName,
-      customer_email: customerEmail,
-      host_name: customerName,
+    await queueEmail(eventId, host_email, 'gallery_created', {
+      host_name: host_email.split('@')[0], // Extract name from email
       event_name,
       event_date: event_date,  // Pass raw date - will be formatted by email processor
-      gallery_link: shareUrl,
+      gallery_link: fullShareLink,
       gallery_password: requirePassword ? password : 'No password required',
       expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
       welcome_message: welcome_message || ''
@@ -219,11 +154,9 @@ router.post('/', adminAuth, [
     res.json({
       id: eventId,
       slug,
-      share_link: shareUrl,
+      share_link: fullShareLink,
       expires_at,
-      require_password: requirePassword,
-      customer_name: customerName,
-      customer_email: customerEmail
+      require_password: requirePassword
     });
   } catch (error) {
     console.error(error);
@@ -252,27 +185,17 @@ router.get('/', adminAuth, async (req, res) => {
       event.photo_count = photoCount.count;
     }
     
-    res.json(events.map(mapEventForApi));
+    res.json(events);
   } catch (error) {
     res.status(500).json({ error: 'Failed to fetch events' });
   }
 });
 
 // Update event
-router.put('/:id', adminAuth, [
-  body('customer_name').optional().trim().notEmpty(),
-  body('customer_email').optional().isEmail().normalizeEmail(),
-  body('require_password').optional().isBoolean()
-], async (req, res) => {
+router.put('/:id', adminAuth, async (req, res) => {
   try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-
     const { id } = req.params;
     const updates = { ...req.body };
-    const customerColumnsAvailable = await hasCustomerContactColumns();
     
     // Don't allow updating certain fields
     delete updates.id;
@@ -280,38 +203,6 @@ router.put('/:id', adminAuth, [
     delete updates.created_at;
     delete updates.password_confirmation;
 
-    if (Object.prototype.hasOwnProperty.call(updates, 'host_name') || Object.prototype.hasOwnProperty.call(updates, 'host_email')) {
-      return res.status(400).json({ error: 'host_name and host_email are no longer supported. Use customer_name and customer_email instead.' });
-    }
-
-    if (Object.prototype.hasOwnProperty.call(updates, 'customer_name')) {
-      const nextName = getCustomerNameFromPayload(updates);
-      if (nextName) {
-        if (customerColumnsAvailable) {
-          updates.customer_name = nextName;
-        } else {
-          delete updates.customer_name;
-        }
-        updates.host_name = nextName;
-      } else {
-        delete updates.customer_name;
-      }
-    }
-
-    if (Object.prototype.hasOwnProperty.call(updates, 'customer_email')) {
-      const nextEmail = getCustomerEmailFromPayload(updates);
-      if (nextEmail) {
-        if (customerColumnsAvailable) {
-          updates.customer_email = nextEmail;
-        } else {
-          delete updates.customer_email;
-        }
-        updates.host_email = nextEmail;
-      } else {
-        delete updates.customer_email;
-      }
-    }
-
     const hasRequirePasswordUpdate = Object.prototype.hasOwnProperty.call(updates, 'require_password');
     let requirePasswordUpdate;
     if (hasRequirePasswordUpdate) {

backend/src/routes/gallery.js

@@ -9,41 +9,10 @@ const { verifyGalleryAccess } = require('../middleware/gallery');
 const secureImageService = require('../services/secureImageService');
 const logger = require('../utils/logger');
 const { resolvePhotoFilePath } = require('../services/photoResolver');
-const { getEventShareToken, resolveShareIdentifier, buildShareLinkVariants } = require('../services/shareLinkService');
 
 // Get storage path from environment or default
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
 
-// Resolve gallery identifier (slug or token) to canonical data
-router.get('/resolve/:identifier', async (req, res) => {
-  try {
-    const { identifier } = req.params;
-    const result = await resolveShareIdentifier(identifier);
-
-    if (!result) {
-      return res.status(404).json({ error: 'Gallery not found' });
-    }
-
-    const { event, matchType, shareToken } = result;
-    const linkVariants = await buildShareLinkVariants({ slug: event.slug, shareToken });
-    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
-
-    res.json({
-      slug: event.slug,
-      token: shareToken,
-      matchType,
-      share_link: event.share_link,
-      share_path: linkVariants.sharePath,
-      share_url: linkVariants.shareUrl,
-      short_enabled: linkVariants.shortEnabled,
-      requires_password: requiresPassword
-    });
-  } catch (error) {
-    logger.error('Error resolving gallery identifier:', error);
-    res.status(500).json({ error: 'Failed to resolve gallery link' });
-  }
-});
-
 // Verify share token
 router.get('/:slug/verify-token/:token', async (req, res) => {
   try {
@@ -51,14 +20,15 @@ router.get('/:slug/verify-token/:token', async (req, res) => {
     
     const event = await db('events')
       .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
-      .select('id', 'share_link', 'share_token')
+      .select('id', 'share_link')
       .first();
     
     if (!event) {
       return res.status(404).json({ error: 'Gallery not found' });
     }
     
-    const expectedToken = getEventShareToken(event);
+    // Extract token from share link and verify
+    const expectedToken = event.share_link.split('/').pop();
     if (token !== expectedToken) {
       return res.status(404).json({ error: 'Invalid gallery link' });
     }
@@ -86,7 +56,6 @@ router.get('/:slug/info', async (req, res) => {
         'is_active',
         'is_archived',
         'share_link',
-        'share_token',
         'allow_downloads',
         'disable_right_click',
         'watermark_downloads',
@@ -107,8 +76,12 @@ router.get('/:slug/info', async (req, res) => {
     
     // If token provided, verify it matches the share link
     if (token) {
-      const expectedToken = getEventShareToken(event);
-      if (!expectedToken || token !== expectedToken) {
+      let expectedToken = event.share_link;
+      // Handle both formats: full URL or just token
+      if (event.share_link && event.share_link.includes('/')) {
+        expectedToken = event.share_link.split('/').pop();
+      }
+      if (token !== expectedToken) {
         return res.status(404).json({ error: 'Invalid gallery link' });
       }
     }

backend/src/services/expirationChecker.js

@@ -58,15 +58,11 @@ async function queueExpirationWarning(event) {
   const daysRemaining = Math.ceil((new Date(event.expires_at) - new Date()) / (1000 * 60 * 60 * 24));
   
   // Determine language based on email domain
-  const recipientEmail = event.customer_email || event.host_email;
-  const recipientName = event.customer_name || event.host_name || (recipientEmail ? recipientEmail.split('@')[0] : null);
-  const emailLang = recipientEmail && recipientEmail.endsWith('.de') ? 'de' : 'en';
+  const emailLang = event.host_email.endsWith('.de') ? 'de' : 'en';
   
-  // Queue email to customer
-  await queueEmail(event.id, recipientEmail, 'expiration_warning', {
-    customer_name: recipientName,
-    customer_email: recipientEmail,
-    host_name: recipientName,
+  // Queue email to host
+  await queueEmail(event.id, event.host_email, 'expiration_warning', {
+    host_name: event.host_name || event.host_email.split('@')[0],
     event_name: event.event_name,
     days_remaining: daysRemaining.toString(),
     expiration_date: await formatDate(event.expires_at, emailLang),
@@ -82,14 +78,9 @@ async function handleExpiredEvent(event) {
     await db('events').where('id', event.id).update({ is_active: formatBoolean(false) });
     
     // Queue expiration emails
-    const recipientEmail = event.customer_email || event.host_email;
-    const recipientName = event.customer_name || event.host_name || (recipientEmail ? recipientEmail.split('@')[0] : null);
-
-    await queueEmail(event.id, recipientEmail, 'gallery_expired', {
+    await queueEmail(event.id, event.host_email, 'gallery_expired', {
       event_name: event.event_name,
-      admin_email: event.admin_email,
-      customer_name: recipientName,
-      customer_email: recipientEmail
+      admin_email: event.admin_email
     });
     
     // Also notify admin

backend/src/services/photoResolver.js

@@ -12,8 +12,10 @@ const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '.
 function resolvePhotoFilePath(event, photo) {
   if (!event || !photo) throw new Error('resolvePhotoFilePath requires event and photo');
 
-  const mode = (event.source_mode || photo.source_origin || 'managed');
-  if (mode === 'reference' || photo.source_origin === 'external') {
+  const isExternal = photo.source_origin === 'external' ||
+    (!!photo.external_relpath && (event.source_mode === 'reference' || event.source_mode === 'external'));
+
+  if (isExternal) {
     if (!photo.external_relpath) {
       throw new Error('Missing external_relpath for external photo');
     }

backend/src/services/shareLinkService.js

@@ -1,181 +0,0 @@
-const { db } = require('../database/db');
-const { formatBoolean } = require('../utils/dbCompat');
-const { extractShareToken, isPotentialShareToken, buildSharePath } = require('../utils/shareLinkUtils');
-
-const SETTING_KEY = 'general_short_gallery_urls';
-const CACHE_TTL_MS = 60_000;
-
-let cachedSetting = null;
-let cacheExpiresAt = 0;
-
-const parseSettingValue = (rawValue) => {
-  if (rawValue === undefined || rawValue === null) {
-    return null;
-  }
-
-  if (typeof rawValue === 'boolean') {
-    return rawValue;
-  }
-
-  if (typeof rawValue === 'number') {
-    return rawValue !== 0;
-  }
-
-  if (typeof rawValue === 'string') {
-    const trimmed = rawValue.trim();
-    if (!trimmed) {
-      return null;
-    }
-
-    try {
-      const parsed = JSON.parse(trimmed);
-      return parseSettingValue(parsed);
-    } catch {
-      const normalized = trimmed.toLowerCase();
-      if (normalized === 'true' || normalized === '1' || normalized === 'yes') {
-        return true;
-      }
-      if (normalized === 'false' || normalized === '0' || normalized === 'no') {
-        return false;
-      }
-      return null;
-    }
-  }
-
-  if (typeof rawValue === 'object') {
-    try {
-      return parseSettingValue(JSON.parse(JSON.stringify(rawValue)));
-    } catch {
-      return null;
-    }
-  }
-
-  return null;
-};
-
-const getRawSettingValue = async () => {
-  try {
-    const setting = await db('app_settings').where({ setting_key: SETTING_KEY }).first();
-    return setting?.setting_value ?? null;
-  } catch (error) {
-    console.error('Failed to read gallery URL setting:', error.message);
-    return null;
-  }
-};
-
-const isShortGalleryUrlsEnabled = async () => {
-  if (cachedSetting !== null && Date.now() < cacheExpiresAt) {
-    return cachedSetting;
-  }
-
-  const rawValue = await getRawSettingValue();
-  const parsed = parseSettingValue(rawValue);
-  cachedSetting = parsed === null ? false : Boolean(parsed);
-  cacheExpiresAt = Date.now() + CACHE_TTL_MS;
-  return cachedSetting;
-};
-
-const clearShareLinkSettingsCache = () => {
-  cachedSetting = null;
-  cacheExpiresAt = 0;
-};
-
-const buildShareLinkVariants = async ({ slug, shareToken }) => {
-  if (!shareToken) {
-    throw new Error('shareToken is required to build share link variants');
-  }
-
-  const shortEnabled = await isShortGalleryUrlsEnabled();
-  const sharePath = buildSharePath(slug, shareToken, shortEnabled);
-  const frontendBase = (process.env.FRONTEND_URL || '').replace(/\/$/, '');
-  const shareUrl = frontendBase ? `${frontendBase}${sharePath}` : sharePath;
-
-  return {
-    shortEnabled,
-    sharePath,
-    shareUrl,
-    shareLinkToStore: sharePath
-  };
-};
-
-const getEventShareToken = (event) => {
-  if (!event) {
-    return null;
-  }
-
-  if (event.share_token) {
-    return event.share_token;
-  }
-
-  return extractShareToken(event.share_link);
-};
-
-const ACTIVE_EVENT_FILTER = {
-  is_active: formatBoolean(true),
-  is_archived: formatBoolean(false)
-};
-
-const resolveShareIdentifier = async (identifier) => {
-  if (!identifier) {
-    return null;
-  }
-
-  const trimmed = String(identifier).trim();
-  if (!trimmed) {
-    return null;
-  }
-
-  const baseQuery = db('events')
-    .select(
-      'id',
-      'slug',
-      'share_link',
-      'share_token',
-      'require_password',
-      'event_name',
-      'event_type',
-      'event_date',
-      'expires_at',
-      'is_active',
-      'is_archived'
-    )
-    .where(ACTIVE_EVENT_FILTER);
-
-  let event = await baseQuery.clone().where({ slug: trimmed }).first();
-  if (event) {
-    return { event, matchType: 'slug', shareToken: getEventShareToken(event) };
-  }
-
-  event = await baseQuery.clone().where({ share_token: trimmed }).first();
-  if (event) {
-    return { event, matchType: 'token', shareToken: getEventShareToken(event) };
-  }
-
-  event = await baseQuery.clone().where({ share_link: trimmed }).first();
-  if (event) {
-    return { event, matchType: 'link', shareToken: getEventShareToken(event) };
-  }
-
-  event = await baseQuery.clone().where('share_link', 'like', `%/${trimmed}`).first();
-  if (event) {
-    return { event, matchType: 'link_partial', shareToken: getEventShareToken(event) };
-  }
-
-  // As a final fallback, if identifier looks like a token but we did not match via share_token
-  if (isPotentialShareToken(trimmed)) {
-    event = await baseQuery.clone().whereRaw('LOWER(share_token) = ?', [trimmed.toLowerCase()]).first();
-    if (event) {
-      return { event, matchType: 'token_case_insensitive', shareToken: getEventShareToken(event) };
-    }
-  }
-
-  return null;
-};
-
-module.exports = {
-  isShortGalleryUrlsEnabled,
-  clearShareLinkSettingsCache,
-  buildShareLinkVariants,
-  getEventShareToken,
-  resolveShareIdentifier
-};

backend/src/services/uploadSettings.js

@@ -1,87 +0,0 @@
-const { db } = require('../database/db');
-
-const DEFAULT_MAX_FILES_PER_UPLOAD = 500;
-const MAX_ALLOWED_FILES_PER_UPLOAD = 2000;
-const CACHE_TTL_MS = 60_000;
-
-let cachedValue = DEFAULT_MAX_FILES_PER_UPLOAD;
-let cacheExpiresAt = 0;
-
-const parseSettingValue = (setting) => {
-  if (!setting || setting.setting_value == null) {
-    return null;
-  }
-
-  let rawValue = setting.setting_value;
-
-  if (typeof rawValue === 'string') {
-    try {
-      rawValue = JSON.parse(rawValue);
-    } catch {
-      // keep original string
-    }
-  }
-
-  if (typeof rawValue === 'string') {
-    const trimmed = rawValue.trim();
-    if (trimmed === '') {
-      return null;
-    }
-    const parsed = Number(trimmed);
-    return Number.isFinite(parsed) ? parsed : null;
-  }
-
-  if (typeof rawValue === 'number') {
-    return rawValue;
-  }
-
-  return null;
-};
-
-const normalizeLimit = (value) => {
-  if (!Number.isFinite(value)) {
-    return DEFAULT_MAX_FILES_PER_UPLOAD;
-  }
-
-  const intValue = Math.floor(value);
-  if (intValue < 1) {
-    return DEFAULT_MAX_FILES_PER_UPLOAD;
-  }
-  if (intValue > MAX_ALLOWED_FILES_PER_UPLOAD) {
-    return MAX_ALLOWED_FILES_PER_UPLOAD;
-  }
-  return intValue;
-};
-
-const getMaxFilesPerUpload = async () => {
-  if (Date.now() < cacheExpiresAt) {
-    return cachedValue;
-  }
-
-  try {
-    const setting = await db('app_settings')
-      .where({ setting_key: 'general_max_files_per_upload' })
-      .first();
-
-    const parsedValue = normalizeLimit(parseSettingValue(setting));
-    cachedValue = parsedValue;
-    cacheExpiresAt = Date.now() + CACHE_TTL_MS;
-    return parsedValue;
-  } catch (error) {
-    console.error('Failed to read max files per upload setting:', error.message);
-    cachedValue = DEFAULT_MAX_FILES_PER_UPLOAD;
-    cacheExpiresAt = Date.now() + CACHE_TTL_MS;
-    return DEFAULT_MAX_FILES_PER_UPLOAD;
-  }
-};
-
-const clearMaxFilesPerUploadCache = () => {
-  cacheExpiresAt = 0;
-};
-
-module.exports = {
-  getMaxFilesPerUpload,
-  clearMaxFilesPerUploadCache,
-  DEFAULT_MAX_FILES_PER_UPLOAD,
-  MAX_ALLOWED_FILES_PER_UPLOAD
-};

backend/src/utils/authSecurity.js

@@ -7,140 +7,10 @@ const { db } = require('../database/db');
 const { formatBoolean } = require('./dbCompat');
 const logger = require('./logger');
 
-const DEFAULT_SECURITY_CONFIG = Object.freeze({
-  maxAttempts: 5,
-  lockoutDurationMs: 30 * 60 * 1000, // 30 minutes
-  attemptWindowMs: 15 * 60 * 1000 // 15 minutes
-});
-
-const SECURITY_CONFIG_CACHE_MS = 60 * 1000; // 1 minute cache
-let cachedSecurityConfig = { ...DEFAULT_SECURITY_CONFIG };
-let cachedConfigFetchedAt = 0;
-
-function parseStoredValue(rawValue) {
-  if (rawValue === undefined || rawValue === null) {
-    return undefined;
-  }
-
-  if (typeof rawValue !== 'string') {
-    return rawValue;
-  }
-
-  try {
-    return JSON.parse(rawValue);
-  } catch (error) {
-    logger.warn(`Unable to parse stored security setting value "${rawValue}", using raw string.`);
-    return rawValue;
-  }
-}
-
-function normalizePositiveInteger(name, value, fallback, options = {}) {
-  if (value === undefined || value === null || value === '') {
-    return fallback;
-  }
-
-  const numericValue = Number(value);
-
-  if (!Number.isFinite(numericValue)) {
-    logger.warn(`Invalid numeric value for ${name}: ${value}. Falling back to default (${fallback}).`);
-    return fallback;
-  }
-
-  let adjustedValue = Math.floor(numericValue);
-
-  if (options.min !== undefined && adjustedValue < options.min) {
-    logger.warn(`Value for ${name} below minimum (${options.min}). Clamping to minimum.`);
-    adjustedValue = options.min;
-  }
-
-  if (options.max !== undefined && adjustedValue > options.max) {
-    logger.warn(`Value for ${name} exceeds maximum (${options.max}). Clamping to maximum.`);
-    adjustedValue = options.max;
-  }
-
-  if (adjustedValue <= 0) {
-    logger.warn(`Value for ${name} must be positive. Falling back to default (${fallback}).`);
-    return fallback;
-  }
-
-  return adjustedValue;
-}
-
-async function loadSecurityConfigFromSettings() {
-  const rows = await db('app_settings').whereIn('setting_key', [
-    'security_max_login_attempts',
-    'security_lockout_duration_minutes',
-    'security_attempt_window_minutes'
-  ]);
-
-  const config = { ...DEFAULT_SECURITY_CONFIG };
-
-  rows.forEach(row => {
-    const value = parseStoredValue(row.setting_value);
-
-    switch (row.setting_key) {
-      case 'security_max_login_attempts': {
-        config.maxAttempts = normalizePositiveInteger(
-          'security_max_login_attempts',
-          value,
-          DEFAULT_SECURITY_CONFIG.maxAttempts,
-          { min: 1, max: 50 }
-        );
-        break;
-      }
-      case 'security_lockout_duration_minutes': {
-        const minutes = normalizePositiveInteger(
-          'security_lockout_duration_minutes',
-          value,
-          DEFAULT_SECURITY_CONFIG.lockoutDurationMs / (60 * 1000),
-          { min: 1, max: 24 * 60 }
-        );
-        config.lockoutDurationMs = minutes * 60 * 1000;
-        break;
-      }
-      case 'security_attempt_window_minutes': {
-        const minutes = normalizePositiveInteger(
-          'security_attempt_window_minutes',
-          value,
-          DEFAULT_SECURITY_CONFIG.attemptWindowMs / (60 * 1000),
-          { min: 1, max: 24 * 60 }
-        );
-        config.attemptWindowMs = minutes * 60 * 1000;
-        break;
-      }
-      default:
-        break;
-    }
-  });
-
-  return config;
-}
-
-async function getSecurityConfig(options = {}) {
-  const now = Date.now();
-  const forceRefresh = options.forceRefresh === true;
-
-  if (!forceRefresh && cachedSecurityConfig && (now - cachedConfigFetchedAt) < SECURITY_CONFIG_CACHE_MS) {
-    return cachedSecurityConfig;
-  }
-
-  try {
-    const config = await loadSecurityConfigFromSettings();
-    cachedSecurityConfig = config;
-    cachedConfigFetchedAt = now;
-    return cachedSecurityConfig;
-  } catch (error) {
-    logger.error('Error loading security configuration:', error);
-    cachedSecurityConfig = { ...DEFAULT_SECURITY_CONFIG };
-    cachedConfigFetchedAt = now;
-    return cachedSecurityConfig;
-  }
-}
-
-function resetSecurityConfigCache() {
-  cachedSecurityConfig = { ...DEFAULT_SECURITY_CONFIG };
-  cachedConfigFetchedAt = 0;
-}
+// Configuration constants
+const MAX_LOGIN_ATTEMPTS = 5;
+const LOCKOUT_DURATION = 30 * 60 * 1000; // 30 minutes in milliseconds
+const ATTEMPT_WINDOW = 15 * 60 * 1000; // 15 minutes window for counting attempts
 
 /**
  * Track failed login attempt
@@ -189,8 +59,6 @@ async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
     if (!tableExists) {
       return;
     }
-
-    const { attemptWindowMs } = await getSecurityConfig();
     
     await db('login_attempts').insert({
       identifier,
@@ -201,7 +69,7 @@ async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
     });
 
     // Clear old failed attempts for this user
-    const cutoffTime = new Date(Date.now() - attemptWindowMs);
+    const cutoffTime = new Date(Date.now() - ATTEMPT_WINDOW);
     await db('login_attempts')
       .where('identifier', identifier)
       .where('success', formatBoolean(false))
@@ -215,39 +83,30 @@ async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
 /**
  * Check if account is locked due to too many failed attempts
  * @param {string} identifier - Username or email
- * @param {string} [ipAddress] - Optional IP address scope
  * @returns {Promise<{isLocked: boolean, remainingTime?: number}>}
  */
-async function checkAccountLockout(identifier, ipAddress) {
+async function checkAccountLockout(identifier) {
   try {
     // Check if table exists first
     const tableExists = await db.schema.hasTable('login_attempts');
     if (!tableExists) {
       return { isLocked: false };
     }
-
-    const { attemptWindowMs, maxAttempts, lockoutDurationMs } = await getSecurityConfig();
     
-    const recentWindow = new Date(Date.now() - attemptWindowMs);
+    const recentWindow = new Date(Date.now() - ATTEMPT_WINDOW);
     
     // Get recent failed attempts
-    const failedAttemptsQuery = db('login_attempts')
+    const failedAttempts = await db('login_attempts')
       .where('identifier', identifier)
       .where('success', formatBoolean(false))
-      .where('attempt_time', '>=', recentWindow.toISOString());
-
-    if (ipAddress) {
-      failedAttemptsQuery.andWhere('ip_address', ipAddress);
-    }
-
-    const failedAttempts = await failedAttemptsQuery
+      .where('attempt_time', '>=', recentWindow.toISOString())
       .orderBy('attempt_time', 'desc')
-      .limit(maxAttempts);
+      .limit(MAX_LOGIN_ATTEMPTS);
 
-    if (failedAttempts.length >= maxAttempts) {
+    if (failedAttempts.length >= MAX_LOGIN_ATTEMPTS) {
       // Check if still within lockout period
       const oldestAttempt = failedAttempts[failedAttempts.length - 1];
-      const lockoutEnd = new Date(oldestAttempt.attempt_time).getTime() + lockoutDurationMs;
+      const lockoutEnd = new Date(oldestAttempt.attempt_time).getTime() + LOCKOUT_DURATION;
       const now = Date.now();
 
       if (now < lockoutEnd) {
@@ -357,6 +216,6 @@ module.exports = {
   checkSuspiciousActivity,
   getGenericAuthError,
   initializeCleanupJob,
-  getSecurityConfig,
-  resetSecurityConfigCache
-};
+  MAX_LOGIN_ATTEMPTS,
+  LOCKOUT_DURATION
+};

backend/src/utils/requestIp.js

@@ -1,36 +0,0 @@
-/**
- * Resolve the originating client IP address, accounting for reverse proxies.
- * Returns the first entry from X-Forwarded-For when available, otherwise falls back
- * to Express/Node connection properties.
- * @param {import('express').Request} req
- * @returns {string}
- */
-function getClientIp(req) {
-  if (!req) {
-    return '';
-  }
-
-  const forwardedFor = req.headers['x-forwarded-for'];
-
-  if (typeof forwardedFor === 'string' && forwardedFor.length > 0) {
-    const [firstIp] = forwardedFor.split(',').map(part => part.trim()).filter(Boolean);
-    if (firstIp) {
-      return firstIp;
-    }
-  } else if (Array.isArray(forwardedFor) && forwardedFor.length > 0) {
-    const [firstIp] = forwardedFor;
-    if (firstIp) {
-      return firstIp.trim();
-    }
-  }
-
-  return (
-    req.ip ||
-    req.connection?.remoteAddress ||
-    req.socket?.remoteAddress ||
-    req.connection?.socket?.remoteAddress ||
-    ''
-  );
-}
-
-module.exports = { getClientIp };

backend/src/utils/shareLinkUtils.js

@@ -1,63 +0,0 @@
-const SHARE_TOKEN_REGEX = /^[0-9a-fA-F]{32}$/;
-
-/**
- * Extracts the share token portion from a stored share link.
- * Supports full URLs, absolute paths, and legacy slug/token formats.
- * @param {string|null|undefined} shareLink
- * @returns {string|null}
- */
-function extractShareToken(shareLink) {
-  if (!shareLink) {
-    return null;
-  }
-
-  const trimmed = String(shareLink).trim();
-  if (!trimmed) {
-    return null;
-  }
-
-  // Remove protocol + host when a full URL is stored
-  const path = trimmed.replace(/^https?:\/\/[^/]+/i, '');
-  const segments = path.split('/').filter(Boolean);
-  if (segments.length === 0) {
-    return null;
-  }
-
-  const candidate = segments[segments.length - 1];
-  return candidate || null;
-}
-
-/**
- * Returns true if the provided identifier looks like a generated share token.
- * @param {string|null|undefined} identifier
- * @returns {boolean}
- */
-function isPotentialShareToken(identifier) {
-  if (!identifier) {
-    return false;
-  }
-  return SHARE_TOKEN_REGEX.test(String(identifier).trim());
-}
-
-/**
- * Builds the gallery share path depending on whether short URLs are enabled.
- * @param {string} slug
- * @param {string} shareToken
- * @param {boolean} useShort
- * @returns {string}
- */
-function buildSharePath(slug, shareToken, useShort) {
-  if (!shareToken) {
-    throw new Error('shareToken is required to build share path');
-  }
-  if (useShort || !slug) {
-    return `/gallery/${shareToken}`;
-  }
-  return `/gallery/${slug}/${shareToken}`;
-}
-
-module.exports = {
-  extractShareToken,
-  isPotentialShareToken,
-  buildSharePath
-};

backend/wait-for-db.sh

@@ -3,19 +3,45 @@
 
 set -e
 
-host="$DB_HOST"
+host="${DB_HOST:-postgres}"
 port="${DB_PORT:-5432}"
 user="${DB_USER:-picpeak}"
+target_db="${DB_NAME:-picpeak}"
+default_db="${DB_CHECK_DB:-postgres}"
+
+sanitize_identifier() {
+  printf '%s' "$1" | sed "s/'/''/g"
+}
 
 echo "Waiting for PostgreSQL at $host:$port..."
 
-# Wait for PostgreSQL to be ready
-until PGPASSWORD=$DB_PASSWORD psql -h "$host" -p "$port" -U "$user" -d "${DB_NAME:-picpeak}" -c '\q' 2>/dev/null; do
+# Wait for PostgreSQL server to accept connections (using the default database)
+until PGPASSWORD="$DB_PASSWORD" psql -h "$host" -p "$port" -U "$user" -d "$default_db" -c '\q' >/dev/null 2>&1; do
   >&2 echo "PostgreSQL is unavailable - sleeping"
   sleep 2
 done
 
->&2 echo "PostgreSQL is up - executing command"
+>&2 echo "PostgreSQL is up - verifying target database \"$target_db\""
+
+# Ensure the target database exists (helps when volumes are reused or DB_NAME is customised)
+db_exists=$(PGPASSWORD="$DB_PASSWORD" psql -h "$host" -p "$port" -U "$user" -d "$default_db" -tAc "SELECT 1 FROM pg_database WHERE datname = '$(sanitize_identifier "$target_db")'" 2>/dev/null || echo 0)
+
+if [ "$db_exists" != "1" ]; then
+  >&2 echo "Database \"$target_db\" not found. Attempting to create..."
+  if ! PGPASSWORD="$DB_PASSWORD" psql -h "$host" -p "$port" -U "$user" -d "$default_db" -c "CREATE DATABASE \"$target_db\";" >/dev/null 2>&1; then
+    >&2 echo "Failed to create database \"$target_db\". Please ensure it exists and is accessible."
+    exit 1
+  fi
+  >&2 echo "Database \"$target_db\" created successfully."
+fi
+
+# Wait until the target database itself is ready to accept connections
+until PGPASSWORD="$DB_PASSWORD" psql -h "$host" -p "$port" -U "$user" -d "$target_db" -c '\q' >/dev/null 2>&1; do
+  >&2 echo "Waiting for database \"$target_db\" to accept connections..."
+  sleep 2
+done
+
+>&2 echo "Target database \"$target_db\" is ready."
 
 # Run migrations (use safe runner in production)
 echo "Running database migrations..."
@@ -26,4 +52,4 @@ else
 fi
 
 # Execute the main command
-exec "$@"
+exec "$@"

docker-compose.yml

@@ -101,7 +101,7 @@ services:
       context: ./frontend
       dockerfile: Dockerfile
       args:
-        - VITE_API_URL=${VITE_API_URL:-http://localhost:3001/api}
+        - VITE_API_URL=${VITE_API_URL:-/api}
         - VITE_UMAMI_URL=${VITE_UMAMI_URL:-}
         - VITE_UMAMI_WEBSITE_ID=${VITE_UMAMI_WEBSITE_ID:-}
         - VITE_UMAMI_SHARE_URL=${VITE_UMAMI_SHARE_URL:-}

docs/ADMIN_SETUP_GUIDE.md

@@ -109,7 +109,7 @@ If ADMIN_CREDENTIALS.txt is missing:
 - File is created in the backend directory root
 - File might have been deleted for security (as recommended)
 - Regenerate it by running `node scripts/reset-admin-password.js --force --credentials-file data/ADMIN_CREDENTIALS.txt`
-- When using the unified `picpeak-setup.sh` installer for a reinstall, append `--force-admin-password-reset` to have the script perform the reset automatically
+- When using the unified `setup.sh` installer for a reinstall, append `--force-admin-password-reset` to have the script perform the reset automatically
 
 ## Best Practices
 

docs/admin-api-quickstart.md

@@ -1,147 +0,0 @@
-# PicPeak Admin API Quickstart
-
-This guide explains how to authenticate against the PicPeak Admin API, use the OpenAPI documentation, and exercise the three automation endpoints (`create event`, `photo upload`, `resend email`) that now ship with machine-readable docs.
-
-> **Prerequisites**
->
-> - PicPeak backend running (Docker or local `node backend/server.js`)
-> - An admin account (see `data/ADMIN_CREDENTIALS.txt` for the seeded defaults)
-> - API base URL (defaults to `http://localhost:3001/api`)
-
----
-
-## 1. Obtain an Admin API Token
-
-1. Determine whether reCAPTCHA is enabled in **Admin → Settings → Security**. If disabled (the default), you can skip the `recaptchaToken` field shown below.
-2. Authenticate with your admin username/email and password:
-
-```bash
-curl --fail --silent --show-error \
-  -X POST "http://localhost:3001/api/auth/admin/login" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "username": "admin",
-    "password": "BoldTiger5872%",
-    "recaptchaToken": ""
-  }' | jq
-```
-
-Successful responses look like:
-
-```json
-{
-  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
-  "user": {
-    "id": 1,
-    "username": "admin",
-    "email": "admin@example.com",
-    "mustChangePassword": false
-  }
-}
-```
-
-- PicPeak also sets the `admin_token` cookie; however, when scripting you typically pass the token in an `Authorization: Bearer <token>` header.
-- Tokens expire after 24 hours. Log in again to refresh them.
-
----
-
-## 2. Use the OpenAPI Documentation
-
-The machine-readable spec lives at `docs/picpeak-admin-api.openapi.yaml`. You can:
-
-- Preview it interactively with Redocly:
-
-  ```bash
-  npx --yes @redocly/cli preview-docs docs/picpeak-admin-api.openapi.yaml
-  ```
-
-- Import it into Postman, Insomnia, or VS Code REST client.
-- Validate changes as part of CI with:
-
-  ```bash
-  npx --yes @apidevtools/swagger-cli@4.0.4 validate docs/picpeak-admin-api.openapi.yaml
-  ```
-
-Keep this file in sync whenever the backend endpoints evolve.
-
----
-
-## 3. Call the Key Admin Endpoints
-
-Below are minimal `curl` examples that rely on the bearer token captured earlier.
-
-### 3.1 Create an Event
-
-```bash
-API_URL="http://localhost:3001/api"
-TOKEN="REPLACE_WITH_JWT"
-
-curl --fail --silent --show-error \
-  -X POST "$API_URL/admin/events" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "event_type": "wedding",
-    "event_name": "Emily & Jordan Celebration",
-    "event_date": "2025-06-07",
-    "customer_name": "Emily Carter",
-    "customer_email": "emily@example.com",
-    "admin_email": "studio@example.com",
-    "require_password": true,
-    "password": "Shutter123",
-    "expiration_days": 45
-  }' | jq
-```
-
-### 3.2 Upload Photos to the Event
-
-```bash
-EVENT_ID=512
-
-curl --fail --silent --show-error \
-  -X POST "$API_URL/admin/events/$EVENT_ID/upload" \
-  -H "Authorization: Bearer $TOKEN" \
-  -F "photos=@/path/to/DSC_2031.jpg" \
-  -F "photos=@/path/to/DSC_2032.jpg" \
-  -F "category_id=individual" | jq
-```
-
-- Files must be JPEG/PNG/WebP, each ≤ 50 MB.
-- The per-request file count respects the `general_max_files_per_upload` admin setting (default 500).
-
-### 3.3 Resend the Gallery Email
-
-```bash
-curl --fail --silent --show-error \
-  -X POST "$API_URL/admin/events/$EVENT_ID/resend-email" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: application/json" \
-  -d '{"password": "Shutter123"}' | jq
-```
-
-Omit `"password"` to send the standard security message instead.
-
----
-
-## 4. Quick Testing Checklist
-
-- ✅ Login succeeds and returns a token (HTTP 200).
-- ✅ Creating an event returns `id`, `slug`, and `share_link`.
-- ✅ Uploading more files than allowed returns HTTP 400 with a helpful message.
-- ✅ Resending email for a missing event returns HTTP 404.
-- ✅ `swagger-cli validate` passes after any spec edits.
-
-Automate these checks using your preferred test harness or CI pipeline to catch regressions early.
-
----
-
-## 5. Migrating From `host_*`
-
-- Run backend migrations to add the new `customer_name` / `customer_email` columns: `npm --prefix backend run migrate` (or your existing deployment flow). The migration copies legacy data automatically, so upgrades remain seamless.
-- All admin APIs now require the `customer_*` fields. Older `host_*` payloads are rejected, which makes downstream client issues obvious during testing instead of silently dropping data.
-- API responses still mirror `customer_*` even if migrations have not run yet (the server falls back to legacy columns until the upgrade is complete), so existing frontends can move over incrementally.
-- Once every consumer writes and reads the new fields, you can safely plan the removal of the legacy `host_*` columns in a future release.
-
----
-
-Need deeper integration examples or language-specific SDKs? Import the OpenAPI spec into code generators such as `openapi-generator` or `orval` to scaffold API clients quickly.

docs/picpeak-admin-api.openapi.yaml

@@ -1,584 +0,0 @@
-openapi: 3.1.0
-info:
-  title: PicPeak Admin API
-  version: 1.1.11
-  summary: High-level administrative endpoints for creating events, uploading photos, and resending gallery access emails.
-  description: |
-    This document describes the core administrative endpoints that power PicPeak automations.
-    It focuses on the three workflows requested by integrators:
-
-    1. Creating events with customer access credentials.
-    2. Uploading photos in bulk to an event gallery.
-    3. Resending the customer-facing gallery email.
-
-    The specification follows the latest [OpenAPI 3.1](https://spec.openapis.org/oas/v3.1.0) best practices
-    and is intended to be kept in sync with backend changes.
-  contact:
-    name: PicPeak Maintainers
-    url: https://github.com/the-luap/picpeak
-servers:
-  - url: https://api.picpeak.example.com/api
-    description: Example production deployment
-  - url: http://localhost:3001/api
-    description: Local development
-tags:
-  - name: Admin Events
-    description: Administrative endpoints for managing event galleries.
-components:
-  securitySchemes:
-    CookieAuth:
-      type: apiKey
-      in: cookie
-      name: admin_token
-      description: >
-        Session cookie issued by the admin authentication flow. When present, the backend mirrors
-        it into the `Authorization` header automatically.
-    BearerAuth:
-      type: http
-      scheme: bearer
-      bearerFormat: JWT
-      description: >
-        JSON Web Token created by the admin login endpoint. You can also pass the token explicitly
-        as `Authorization: Bearer <token>` instead of using the admin cookie.
-  parameters:
-    EventId:
-      name: eventId
-      in: path
-      description: Numeric identifier of the event.
-      required: true
-      schema:
-        type: integer
-        minimum: 1
-      example: 341
-  schemas:
-    ErrorResponse:
-      type: object
-      properties:
-        error:
-          type: string
-          description: Human readable error message.
-        details:
-          type: string
-          nullable: true
-          description: Additional context (when available).
-      required:
-        - error
-      example:
-        error: Invalid token
-    ValidationErrorItem:
-      type: object
-      properties:
-        type:
-          type: string
-          nullable: true
-          description: Validation error type reported by express-validator.
-        msg:
-          type: string
-        path:
-          type: string
-          description: Dot-delimited path to the invalid field.
-        value:
-          description: Value that failed validation.
-        location:
-          type: string
-          description: Location of the invalid value (always `body` for these endpoints).
-      required:
-        - msg
-        - path
-        - location
-      example:
-        type: field
-        msg: Event date must be a valid ISO 8601 date
-        path: event_date
-        value: 2025/05/01
-        location: body
-    ValidationErrorResponse:
-      type: object
-      properties:
-        errors:
-          type: array
-          items:
-            $ref: '#/components/schemas/ValidationErrorItem'
-      required:
-        - errors
-      example:
-        errors:
-          - type: field
-            msg: Customer email must be a valid address
-            path: customer_email
-            value: example@invalid
-            location: body
-    CreateEventRequest:
-      type: object
-      required:
-        - event_type
-        - event_name
-        - event_date
-        - customer_name
-        - customer_email
-        - admin_email
-      properties:
-        event_type:
-          type: string
-          description: Type of event. Controls default theme and copy in the UI.
-          enum: [wedding, birthday, corporate, other]
-        event_name:
-          type: string
-          minLength: 1
-          description: Display name for the gallery shown to end customers.
-        event_date:
-          type: string
-          format: date
-          description: Event date (YYYY-MM-DD). Used to calculate the default expiration.
-        customer_name:
-          type: string
-          minLength: 1
-          description: Name of the customer receiving gallery access.
-        customer_email:
-          type: string
-          format: email
-          description: Email address of the customer who will receive the gallery link.
-        admin_email:
-          type: string
-          format: email
-          description: Admin contact email included in notification messages.
-        require_password:
-          type: boolean
-          default: true
-          description: When true, the gallery requires `password`; when false a random placeholder is stored.
-        password:
-          type: string
-          minLength: 6
-          description: >
-            Gallery password issued to the customer. Required when `require_password` is `true`.
-            Left unset to auto-generate a placeholder when password protection is disabled.
-        expiration_days:
-          type: integer
-          minimum: 1
-          maximum: 365
-          default: 30
-          description: Number of days after the event date before the gallery expires.
-        welcome_message:
-          type: string
-          description: Optional welcome message displayed in the gallery.
-        color_theme:
-          type: string
-          nullable: true
-          description: Optional theme identifier or CSS color settings.
-        allow_user_uploads:
-          type: boolean
-          default: false
-          description: Allow gallery guests to upload their own photos.
-        upload_category_id:
-          type: integer
-          nullable: true
-          description: ID of the default category for user uploads.
-        allow_downloads:
-          type: boolean
-          default: true
-          description: Allow guests to download photos.
-        disable_right_click:
-          type: boolean
-          default: false
-          description: Disable right-click in the gallery view.
-        watermark_downloads:
-          type: boolean
-          default: false
-          description: Enable watermarking on downloaded images.
-        watermark_text:
-          type: string
-          nullable: true
-          description: Custom watermark text when `watermark_downloads` is true.
-        feedback_enabled:
-          type: boolean
-          default: false
-          description: Enable the feedback module for this gallery.
-        allow_ratings:
-          type: boolean
-          default: true
-        allow_likes:
-          type: boolean
-          default: true
-        allow_comments:
-          type: boolean
-          default: true
-        allow_favorites:
-          type: boolean
-          default: true
-        require_name_email:
-          type: boolean
-          default: false
-          description: Require guests to provide name and email when leaving feedback.
-        moderate_comments:
-          type: boolean
-          default: true
-          description: Hold guest comments for moderation.
-        show_feedback_to_guests:
-          type: boolean
-          default: true
-          description: Display aggregated feedback metrics back to guests.
-      example:
-        event_type: wedding
-        event_name: Emily & Jordan Celebration
-        event_date: 2025-06-07
-        customer_name: Emily Carter
-        customer_email: emily@example.com
-        admin_email: studio@example.com
-        require_password: true
-        password: Shutter123
-        expiration_days: 45
-        welcome_message: >
-          We loved capturing your day! Use the password below to view and download your photos.
-        allow_user_uploads: false
-        allow_downloads: true
-        feedback_enabled: true
-        allow_comments: true
-        show_feedback_to_guests: true
-    EventSummary:
-      type: object
-      properties:
-        id:
-          type: integer
-          description: Database identifier of the newly created event.
-        slug:
-          type: string
-          description: Unique slug used to build the gallery URL.
-        event_name:
-          type: string
-        event_type:
-          type: string
-          enum: [wedding, birthday, corporate, other]
-        customer_name:
-          type: string
-          nullable: true
-          description: Name of the customer associated with the event.
-        customer_email:
-          type: string
-          format: email
-          nullable: true
-          description: Email address of the customer associated with the event.
-        require_password:
-          type: boolean
-        share_link:
-          type: string
-          description: Absolute or relative URL guests can use to reach the gallery.
-        expires_at:
-          type: string
-          format: date-time
-          description: ISO 8601 timestamp when the gallery expires.
-        created_at:
-          type: string
-          format: date-time
-          description: ISO 8601 timestamp when the event was created.
-      required:
-        - id
-        - slug
-        - event_name
-        - event_type
-        - require_password
-        - share_link
-        - expires_at
-        - created_at
-      example:
-        id: 512
-        slug: wedding-emily-jordan-2025-06-07
-        event_name: Emily & Jordan Celebration
-        event_type: wedding
-        customer_name: Emily Carter
-        customer_email: emily@example.com
-        require_password: true
-        share_link: https://app.picpeak.io/gallery/wedding-emily-jordan-2025-06-07/2f3c8a4d90bb11ef9b2e0242ac120002
-        expires_at: 2025-07-22T00:00:00.000Z
-        created_at: 2025-05-01T14:32:45.000Z
-    UploadPhotosResponse:
-      type: object
-      properties:
-        message:
-          type: string
-        photos:
-          type: array
-          items:
-            $ref: '#/components/schemas/UploadedPhotoSummary'
-          description: Metadata for each photo that was persisted successfully.
-        totalFiles:
-          type: integer
-          minimum: 0
-          description: Total number of files included in the request (valid + invalid).
-        successCount:
-          type: integer
-          minimum: 0
-        failureCount:
-          type: integer
-          minimum: 0
-        errors:
-          type: array
-          items:
-            $ref: '#/components/schemas/UploadFailure'
-          description: Present when some files failed validation or processing.
-      required:
-        - message
-        - photos
-        - totalFiles
-        - successCount
-        - failureCount
-      example:
-        message: Uploaded 18 of 20 photos. 2 failed.
-        photos:
-          - id: 9821
-            filename: DSC_2031.jpg
-            size: 4812096
-            category_id: 2
-          - id: 9822
-            filename: DSC_2032.jpg
-            size: 5216743
-            category_id: 2
-        totalFiles: 20
-        successCount: 18
-        failureCount: 2
-        errors:
-          - filename: DSC_2020.raw
-            error: Only JPEG, PNG and WebP images are allowed
-          - filename: portrait.png
-            error: File is empty
-    UploadedPhotoSummary:
-      type: object
-      properties:
-        id:
-          type: integer
-        filename:
-          type: string
-        size:
-          type: integer
-          description: File size in bytes.
-        category_id:
-          type: integer
-          nullable: true
-      required:
-        - id
-        - filename
-        - size
-      example:
-        id: 9821
-        filename: DSC_2031.jpg
-        size: 4812096
-        category_id: 2
-    UploadFailure:
-      type: object
-      properties:
-        filename:
-          type: string
-        error:
-          type: string
-      required:
-        - filename
-        - error
-      example:
-        filename: DSC_2031.gif
-        error: Only JPEG, PNG and WebP images are allowed
-    ResendEmailRequest:
-      type: object
-      properties:
-        password:
-          type: string
-          minLength: 1
-          description: >
-            Optional plain-text password to include in the email. When omitted a security notice
-            placeholder is inserted because the stored hash cannot be reversed.
-      example:
-        password: Shutter123
-    ResendEmailResponse:
-      type: object
-      properties:
-        success:
-          type: boolean
-        message:
-          type: string
-      required:
-        - success
-        - message
-      example:
-        success: true
-        message: Creation email has been queued for sending
-paths:
-  /admin/events:
-    post:
-      tags: [Admin Events]
-      operationId: createAdminEvent
-      summary: Create a new event
-      description: >
-        Creates a new event, provisions storage folders, stores the gallery password, and queues
-        the initial gallery email for the customer. Requires admin authentication.
-      security:
-        - CookieAuth: []
-        - BearerAuth: []
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CreateEventRequest'
-            examples:
-              weddingExample:
-                summary: Wedding with password protection
-                value:
-                  event_type: wedding
-                  event_name: Emily & Jordan Celebration
-                  event_date: 2025-06-07
-                  customer_name: Emily Carter
-                  customer_email: emily@example.com
-                  admin_email: studio@example.com
-                  require_password: true
-                  password: Shutter123
-                  expiration_days: 45
-                  welcome_message: >
-                    We loved capturing your day! Use the password below to view and download your photos.
-                  allow_user_uploads: false
-                  allow_downloads: true
-                  feedback_enabled: true
-                  allow_comments: true
-                  show_feedback_to_guests: true
-      responses:
-        '200':
-          description: Event created successfully.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/EventSummary'
-        '400':
-          description: Validation failed. At least one field is invalid or missing.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ValidationErrorResponse'
-        '401':
-          description: Authentication required or token invalid.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '500':
-          description: Unexpected server error while creating the event.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-  /admin/events/{eventId}/upload:
-    post:
-      tags: [Admin Events]
-      operationId: uploadEventPhotos
-      summary: Upload photos to an event gallery
-      description: |
-        Uploads one or more photos to the specified event. Files are validated, moved into the
-        event storage directory, and thumbnails are generated asynchronously.
-
-        The maximum number of files per upload is controlled via the `general_max_files_per_upload`
-        setting (default 500, capped at 2000). Files exceeding 50 MB are rejected.
-      security:
-        - CookieAuth: []
-        - BearerAuth: []
-      parameters:
-        - $ref: '#/components/parameters/EventId'
-      requestBody:
-        required: true
-        content:
-          multipart/form-data:
-            schema:
-              type: object
-              properties:
-                photos:
-                  type: array
-                  description: >
-                    One or more image files (JPEG, PNG, WebP). Each file must be <= 50 MB.
-                  items:
-                    type: string
-                    format: binary
-                category_id:
-                  oneOf:
-                    - type: integer
-                    - type: string
-                  description: >
-                    Optional category assignment. Accepts numeric IDs or the string values `collage`
-                    and `individual` for backward compatibility.
-              required:
-                - photos
-            encoding:
-              photos:
-                style: form
-                explode: false
-      responses:
-        '200':
-          description: Upload completed. Failed files (if any) are listed in the response.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UploadPhotosResponse'
-        '400':
-          description: Request failed validation (invalid files, too many files, etc.).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '401':
-          description: Authentication required or token invalid.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '404':
-          description: The referenced event does not exist.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '500':
-          description: Unexpected server error while processing uploads.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-  /admin/events/{eventId}/resend-email:
-    post:
-      tags: [Admin Events]
-      operationId: resendEventEmail
-      summary: Resend the gallery access email to the customer
-      description: >
-        Queues the standard `gallery_created` email for the event's customer. Useful when resending
-        credentials to the customer or communicating an updated password. Requires admin authentication.
-      security:
-        - CookieAuth: []
-        - BearerAuth: []
-      parameters:
-        - $ref: '#/components/parameters/EventId'
-      requestBody:
-        required: false
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/ResendEmailRequest'
-            example:
-              password: NewSecurePassword!
-      responses:
-        '200':
-          description: Email successfully queued for delivery.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ResendEmailResponse'
-        '401':
-          description: Authentication required or token invalid.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '404':
-          description: Event not found.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '500':
-          description: Unexpected server error while queuing the email.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'

frontend/package.json

@@ -1,14 +1,15 @@
 {
   "name": "picpeak-frontend",
   "private": true,
-  "version": "1.1.14",
+  "version": "1.1.7",
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "node ./scripts/build.js",
-    "build:check": "tsc -b && node ./scripts/build.js",
+    "build": "cross-env ROLLUP_USE_NODE_JS=true vite build",
+    "build:check": "tsc -b && cross-env ROLLUP_USE_NODE_JS=true vite build",
     "lint": "eslint .",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "test": "vitest run src/components/admin/__tests__/ThemeCustomizerEnhanced.test.tsx"
   },
   "dependencies": {
     "@tanstack/react-query": "^5.0.0",
@@ -47,6 +48,9 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.29.0",
+    "@testing-library/jest-dom": "^6.6.3",
+    "@testing-library/react": "^16.1.0",
+    "@testing-library/user-event": "^14.6.1",
     "@types/react": "^18.3.12",
     "@types/react-dom": "^18.3.1",
     "@vitejs/plugin-react": "^4.5.3",
@@ -56,14 +60,12 @@
     "eslint-plugin-react-hooks": "^5.2.0",
     "eslint-plugin-react-refresh": "^0.4.20",
     "globals": "^16.2.0",
+    "jsdom": "^25.0.1",
     "postcss": "^8.4.21",
     "tailwindcss": "^3.3.0",
     "typescript": "~5.8.3",
     "typescript-eslint": "^8.34.1",
     "vite": "^7.1.12",
     "vitest": "^3.2.4"
-  },
-  "optionalDependencies": {
-    "@rollup/rollup-linux-x64-gnu": "^4.45.1"
   }
 }

frontend/scripts/build.js

@@ -1,93 +0,0 @@
-#!/usr/bin/env node
-import { execSync } from 'node:child_process';
-import { resolve, join } from 'node:path';
-import process from 'node:process';
-import { promises as fs } from 'node:fs';
-import { pipeline } from 'node:stream/promises';
-import { createWriteStream } from 'node:fs';
-import https from 'node:https';
-
-const TARGET_NODE_VERSION = '20.19.1';
-const env = { ...process.env, ROLLUP_USE_NODE_JS: 'true' };
-const viteBin = resolve(process.cwd(), 'node_modules', 'vite', 'bin', 'vite.js');
-
-async function ensureNodeBinary(version) {
-  const platformMap = {
-    linux: 'linux',
-    darwin: 'darwin',
-    win32: 'win'
-  };
-  const archMap = {
-    x64: 'x64',
-    arm64: 'arm64'
-  };
-
-  const platform = platformMap[process.platform];
-  const arch = archMap[process.arch];
-
-  if (!platform || !arch) {
-    throw new Error(`Unsupported platform/architecture combination: ${process.platform} ${process.arch}`);
-  }
-
-  if (platform === 'win') {
-    throw new Error('Automatic Node.js download is not supported on Windows runners. Please upgrade Node.js to >=20.19 manually.');
-  }
-
-  const cacheDir = join(process.cwd(), 'node_modules', '.cache', `node-v${version}-${platform}-${arch}`);
-  const nodeBinary = join(cacheDir, `node-v${version}-${platform}-${arch}`, 'bin', 'node');
-
-  try {
-    await fs.access(nodeBinary);
-    return nodeBinary;
-  } catch {
-    // continue with download
-  }
-
-  await fs.mkdir(cacheDir, { recursive: true });
-  const archiveExt = platform === 'win' ? 'zip' : 'tar.xz';
-  const archiveName = `node-v${version}-${platform}-${arch}.${archiveExt}`;
-  const archivePath = join(cacheDir, archiveName);
-  const downloadUrl = `https://nodejs.org/dist/v${version}/${archiveName}`;
-
-  await downloadFile(downloadUrl, archivePath);
-
-  if (archiveExt === 'tar.xz') {
-    execSync(`tar -xf "${archivePath}" -C "${cacheDir}"`, { stdio: 'inherit' });
-  } else {
-    throw new Error('ZIP extraction not implemented. Please upgrade Node.js manually.');
-  }
-
-  await fs.rm(archivePath, { force: true });
-  return nodeBinary;
-}
-
-async function downloadFile(url, destination) {
-  await new Promise((resolvePromise, rejectPromise) => {
-    const fileStream = createWriteStream(destination);
-    https.get(url, (response) => {
-      if (response.statusCode && response.statusCode >= 400) {
-        rejectPromise(new Error(`Failed to download ${url}: HTTP ${response.statusCode}`));
-        return;
-      }
-      pipeline(response, fileStream).then(resolvePromise).catch(rejectPromise);
-    }).on('error', rejectPromise);
-  });
-}
-
-async function main() {
-  console.log(`Node.js ${process.version} detected; forcing Rollup's JavaScript fallback for compatibility.`);
-
-  if (!process.env.USE_DOWNLOADED_NODE) {
-    const [major] = process.versions.node.split('.').map(Number);
-    if (major < 20) {
-      const nodeBinary = await ensureNodeBinary(TARGET_NODE_VERSION);
-      const childEnv = { ...env, USE_DOWNLOADED_NODE: '1' };
-      execSync(`"${nodeBinary}" "${viteBin}" build`, { stdio: 'inherit', env: childEnv });
-      return;
-    }
-  }
-
-  execSync(`node "${viteBin}" build`, { stdio: 'inherit', env });
-}
-
-await main();

frontend/src/components/admin/AdminHeader.tsx

@@ -55,12 +55,12 @@ export const AdminHeader: React.FC<AdminHeaderProps> = ({ onMenuClick }) => {
     },
   });
 
-  // Clear old notifications mutation
-  const clearOldMutation = useMutation({
-    mutationFn: notificationsService.clearOldNotifications,
+  // Clear notifications mutation
+  const clearAllMutation = useMutation({
+    mutationFn: notificationsService.clearAllNotifications,
     onSuccess: (data) => {
       queryClient.invalidateQueries({ queryKey: ['notifications'] });
-      toast.success(t('admin.notificationToasts.clearedOld', { count: data.deletedCount }));
+      toast.success(t('admin.notificationToasts.clearedAll', { count: data.deletedCount }));
     },
   });
 
@@ -128,12 +128,12 @@ export const AdminHeader: React.FC<AdminHeaderProps> = ({ onMenuClick }) => {
                         </button>
                       )}
                       <button
-                        onClick={() => clearOldMutation.mutate()}
+                        onClick={() => clearAllMutation.mutate()}
                         className="text-xs text-neutral-600 hover:text-neutral-700 flex items-center gap-1"
-                        title={t('admin.clearOld')}
+                        title={t('admin.clearAll')}
                       >
                         <Trash2 className="w-3 h-3" />
-                        {t('admin.clearOld')}
+                        {t('admin.clearAll')}
                       </button>
                     </div>
                   </div>

frontend/src/components/admin/PhotoUpload.tsx

@@ -6,7 +6,6 @@ import { api } from '../../config/api';
 import { toast } from 'react-toastify';
 import { useQuery } from '@tanstack/react-query';
 import { categoriesService } from '../../services/categories.service';
-import { settingsService } from '../../services/settings.service';
 import { useTranslation } from 'react-i18next';
 
 interface PhotoUploadProps {
@@ -14,9 +13,6 @@ interface PhotoUploadProps {
   onUploadComplete?: () => void;
 }
 
-const DEFAULT_MAX_FILES_PER_UPLOAD = 500;
-const MAX_FILES_PER_UPLOAD_LIMIT = 2000;
-
 export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadComplete }) => {
   const { t } = useTranslation();
   const [isUploading, setIsUploading] = useState(false);
@@ -33,22 +29,6 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
     queryFn: () => categoriesService.getEventCategories(eventId),
   });
 
-  const { data: settings } = useQuery({
-    queryKey: ['admin-settings'],
-    queryFn: () => settingsService.getAllSettings(),
-  });
-
-  const maxFilesPerUpload = React.useMemo(() => {
-    const rawValue = settings?.general_max_files_per_upload;
-    const parsed = Number(rawValue);
-    if (!Number.isFinite(parsed)) {
-      return DEFAULT_MAX_FILES_PER_UPLOAD;
-    }
-    return Math.min(MAX_FILES_PER_UPLOAD_LIMIT, Math.max(1, Math.floor(parsed)));
-  }, [settings]);
-
-  const remainingSlots = Math.max(maxFilesPerUpload - selectedFiles.length, 0);
-
   const handleFileSelect = (e: React.ChangeEvent<HTMLInputElement>) => {
     const files = Array.from(e.target.files || []);
     const imageFiles = files.filter(file => 
@@ -57,19 +37,13 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
     
     // Check total file count with existing files
     const totalFiles = selectedFiles.length + imageFiles.length;
-    if (totalFiles > maxFilesPerUpload) {
-      const allowedNewFiles = maxFilesPerUpload - selectedFiles.length;
+    if (totalFiles > 500) {
+      const allowedNewFiles = 500 - selectedFiles.length;
       if (allowedNewFiles <= 0) {
-        toast.error(
-          t('upload.maxFilesReached', { limit: maxFilesPerUpload }) ||
-          `Maximum ${maxFilesPerUpload} files allowed`
-        );
+        toast.error(t('upload.maxFilesReached') || 'Maximum 500 files allowed');
         return;
       }
-      toast.warning(
-        t('upload.someFilesSkipped', { allowed: allowedNewFiles, limit: maxFilesPerUpload }) ||
-        `Only ${allowedNewFiles} more files can be added (limit ${maxFilesPerUpload})`
-      );
+      toast.warning(t('upload.someFilesSkipped') || `Only ${allowedNewFiles} more files can be added (500 max)`);
       setSelectedFiles(prev => [...prev, ...imageFiles.slice(0, allowedNewFiles)]);
       return;
     }
@@ -85,11 +59,8 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
     if (selectedFiles.length === 0) return;
     
     // Validate file count
-    if (selectedFiles.length > maxFilesPerUpload) {
-      toast.error(
-        t('upload.tooManyFiles', { limit: maxFilesPerUpload }) ||
-        `Maximum ${maxFilesPerUpload} files can be uploaded at once`
-      );
+    if (selectedFiles.length > 500) {
+      toast.error(t('upload.tooManyFiles') || 'Maximum 500 files can be uploaded at once');
       return;
     }
 
@@ -97,7 +68,7 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
     setUploadProgress(0);
 
     // For large uploads, chunk the files to prevent memory issues
-    const CHUNK_SIZE = Math.max(1, Math.min(50, maxFilesPerUpload)); // Upload up to 50 (or limit) files at a time
+    const CHUNK_SIZE = 50; // Upload 50 files at a time
     const chunks = [];
     
     for (let i = 0; i < selectedFiles.length; i += CHUNK_SIZE) {
@@ -216,21 +187,7 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
           {t('upload.clickToUpload')}
         </p>
         <p className="text-sm text-neutral-500">
-          {t('upload.fileRequirements', { limit: maxFilesPerUpload })}
-        </p>
-        <p
-          className={clsx(
-            "text-xs mt-2",
-            remainingSlots === 0 ? "text-red-600" : "text-neutral-500"
-          )}
-        >
-          {remainingSlots === 0
-            ? t('upload.limitReached', { limit: maxFilesPerUpload })
-            : t('upload.limitInfo', {
-                selected: selectedFiles.length,
-                limit: maxFilesPerUpload,
-                remaining: remainingSlots,
-              })}
+          {t('upload.fileRequirements')}
         </p>
         <input
           ref={fileInputRef}

frontend/src/components/admin/ThemeCustomizerEnhanced.tsx

@@ -14,6 +14,8 @@ interface ThemeCustomizerEnhancedProps {
   isPreviewMode?: boolean;
   showGalleryLayouts?: boolean;
   hideActions?: boolean;
+  onApply?: (theme: ThemeConfig, metadata: { presetName: string }) => Promise<void> | void;
+  isApplying?: boolean;
 }
 
 const layoutIcons: Record<GalleryLayoutType, React.ReactNode> = {
@@ -34,7 +36,9 @@ export const ThemeCustomizerEnhanced: React.FC<ThemeCustomizerEnhancedProps> = (
   onPresetChange,
   isPreviewMode = false,
   showGalleryLayouts = true,
-  hideActions = false
+  hideActions = false,
+  onApply,
+  isApplying = false
 }) => {
   const { t } = useTranslation();
   const [localTheme, setLocalTheme] = useState<ThemeConfig>(value);
@@ -80,8 +84,13 @@ export const ThemeCustomizerEnhanced: React.FC<ThemeCustomizerEnhancedProps> = (
     }
   };
 
-  const handleApply = () => {
-    onChange({ ...localTheme, customCss });
+  const handleApply = async () => {
+    const themeWithCss = { ...localTheme, customCss };
+    onChange(themeWithCss);
+
+    if (onApply) {
+      await onApply(themeWithCss, { presetName: selectedPreset });
+    }
   };
 
   const handleReset = () => {
@@ -587,11 +596,12 @@ export const ThemeCustomizerEnhanced: React.FC<ThemeCustomizerEnhancedProps> = (
             variant="primary"
             leftIcon={<Palette className="w-4 h-4" />}
             onClick={handleApply}
+            disabled={isApplying}
           >
-            {t('branding.applyTheme')}
+            {isApplying ? t('common.applying', 'Applying...') : t('branding.applyTheme')}
           </Button>
         </div>
       )}
     </div>
   );
-};
+};

frontend/src/components/admin/__tests__/ThemeCustomizerEnhanced.test.tsx

@@ -0,0 +1,70 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { ThemeCustomizerEnhanced } from '../ThemeCustomizerEnhanced';
+import type { ThemeConfig } from '../../../types/theme.types';
+
+vi.mock('react-i18next', async () => {
+  const actual = await vi.importActual<typeof import('react-i18next')>('react-i18next');
+  return {
+    ...actual,
+    useTranslation: () => ({
+      t: (_key: string, fallback?: string) => fallback ?? _key
+    })
+  };
+});
+
+describe('ThemeCustomizerEnhanced', () => {
+  const baseTheme: ThemeConfig = {
+    primaryColor: '#000000',
+    accentColor: '#ffffff',
+    backgroundColor: '#eeeeee',
+    textColor: '#111111',
+    galleryLayout: 'grid',
+    gallerySettings: {
+      spacing: 'normal'
+    }
+  };
+
+  it('invokes onApply when Apply Theme is clicked', async () => {
+    const user = userEvent.setup();
+    const handleChange = vi.fn();
+    const handleApply = vi.fn().mockResolvedValue(undefined);
+
+    render(
+      <ThemeCustomizerEnhanced
+        value={baseTheme}
+        onChange={handleChange}
+        presetName="default"
+        onApply={handleApply}
+      />
+    );
+
+    const applyButton = screen.getByRole('button', { name: /branding\.applyTheme/i });
+    await user.click(applyButton);
+
+    expect(handleChange).toHaveBeenCalled();
+    expect(handleApply).toHaveBeenCalledTimes(1);
+    expect(handleApply).toHaveBeenCalledWith(
+      expect.objectContaining({ primaryColor: '#000000' }),
+      expect.objectContaining({ presetName: 'default' })
+    );
+  });
+
+  it('disables the Apply button while applying', () => {
+    const handleChange = vi.fn();
+
+    render(
+      <ThemeCustomizerEnhanced
+        value={baseTheme}
+        onChange={handleChange}
+        presetName="default"
+        isApplying={true}
+      />
+    );
+
+    const applyButton = screen.getByRole('button', { name: /applying/i });
+    expect(applyButton).toBeDisabled();
+  });
+});

frontend/src/components/common/AuthenticatedImage.tsx

@@ -1,11 +1,5 @@
 import React, { useState, useEffect } from 'react';
 import { buildResourceUrl } from '../../utils/url';
-import {
-  getActiveGallerySlug,
-  getGalleryToken,
-  inferGallerySlugFromLocation,
-  resolveSlugFromRequestUrl,
-} from '../../utils/galleryAuthStorage';
 
 interface AuthenticatedImageProps extends React.ImgHTMLAttributes<HTMLImageElement> {
   src: string;
@@ -58,6 +52,7 @@ export const AuthenticatedImage: React.FC<AuthenticatedImageProps> = ({
 }) => {
   const unusedProps = {
     protectFromDownload,
+    slug,
     photoId,
     requiresToken,
     secureUrlTemplate,
@@ -81,8 +76,7 @@ export const AuthenticatedImage: React.FC<AuthenticatedImageProps> = ({
   const [isLoading, setIsLoading] = useState(true);
 
   useEffect(() => {
-    let aborted = false;
-    const objectUrls: string[] = [];
+    let objectUrl: string | null = null;
 
     // Determine which token to use based on context
     if (!src) {
@@ -94,79 +88,37 @@ export const AuthenticatedImage: React.FC<AuthenticatedImageProps> = ({
     setIsLoading(true);
     setError(false);
 
-    const resolveSlug = (candidateSrc?: string): string | null => {
-      if (slug) {
-        return slug;
-      }
-      const fromUrl = candidateSrc ? resolveSlugFromRequestUrl(candidateSrc) : null;
-      if (fromUrl) {
-        return fromUrl;
-      }
-      return getActiveGallerySlug() || inferGallerySlugFromLocation();
-    };
-
-    const fetchWithAuth = async (rawUrl: string | undefined | null): Promise<string> => {
-      if (!rawUrl) {
-        throw new Error('No URL provided');
-      }
-
-      // Build full URL for the image
-      const fullImageUrl = rawUrl.startsWith('/admin')
-        ? buildResourceUrl(`/api${rawUrl}`)
-        : rawUrl.startsWith('/')
-          ? buildResourceUrl(rawUrl)
-          : rawUrl;
-
-      const headers: Record<string, string> = {};
-      const slugForRequest = resolveSlug(rawUrl);
-      const token = getGalleryToken(slugForRequest);
-      if (token) {
-        headers.Authorization = `Bearer ${token}`;
-      }
-
-      const response = await fetch(fullImageUrl, {
-        credentials: 'include',
-        headers: Object.keys(headers).length ? headers : undefined,
-      });
-
-      if (!response.ok) {
-        throw new Error(`Failed to fetch image: ${response.status} ${response.statusText}`);
-      }
-
-      const blob = await response.blob();
-      const objectUrl = URL.createObjectURL(blob);
-      objectUrls.push(objectUrl);
-      return objectUrl;
-    };
-
+    // Create a new URL with auth header
     const fetchImage = async () => {
       try {
-        const primaryUrl = await fetchWithAuth(src);
-        if (!aborted) {
-          setImageSrc(primaryUrl);
-          setError(false);
+        // Use the src as-is since it should already be the correct endpoint
+        let imageUrl = src;
+        
+        // Build full URL for the image
+        // For API paths that start with /admin, we need to prepend /api
+        const fullImageUrl = imageUrl.startsWith('/admin') 
+          ? buildResourceUrl(`/api${imageUrl}`)
+          : imageUrl.startsWith('/') 
+          ? buildResourceUrl(imageUrl) 
+          : imageUrl;
+        
+        // Fetch authenticated image
+        const response = await fetch(fullImageUrl, {
+          credentials: 'include'
+        });
+
+        if (!response.ok) {
+          throw new Error(`Failed to fetch image: ${response.status} ${response.statusText}`);
         }
-      } catch (err) {
+
+        const blob = await response.blob();
+        objectUrl = URL.createObjectURL(blob);
+        setImageSrc(objectUrl);
         setIsLoading(false);
-        if (fallbackSrc && fallbackSrc !== src) {
-          try {
-            const fallbackUrl = await fetchWithAuth(fallbackSrc);
-            if (!aborted) {
-              setImageSrc(fallbackUrl);
-              setError(false);
-            }
-            return;
-          } catch (fallbackError) {
-            // Swallow and mark error below
-          }
-        }
-        if (!aborted) {
-          setError(true);
-          setImageSrc('');
-        }
-        return;
-      }
-      if (!aborted) {
+      } catch (err) {
+        // Image loading failed - use fallback
+        setError(true);
+        setImageSrc(fallbackSrc || '');
         setIsLoading(false);
       }
     };
@@ -175,11 +127,11 @@ export const AuthenticatedImage: React.FC<AuthenticatedImageProps> = ({
 
     // Cleanup function
     return () => {
-      aborted = true;
-      objectUrls.forEach((url) => URL.revokeObjectURL(url));
+      if (objectUrl) {
+        URL.revokeObjectURL(objectUrl);
+      }
     };
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [src, fallbackSrc, slug]);
+  }, [src, fallbackSrc, useWatermark, isGallery]);
 
   if (isLoading) {
     return (

frontend/src/components/gallery/layouts/HeroGalleryLayout.tsx

@@ -1,4 +1,4 @@
-import React, { useState, useEffect } from 'react';
+import React, { useState, useEffect, useRef, useCallback } from 'react';
 import { Download, Maximize2, Check, ChevronDown, Calendar, Clock, Heart, MessageSquare } from 'lucide-react';
 import { parseISO } from 'date-fns';
 import { useTranslation } from 'react-i18next';
@@ -50,6 +50,12 @@ export const HeroGalleryLayout: React.FC<HeroGalleryLayoutProps> = ({
   const overlayOpacity = gallerySettings.heroOverlayOpacity || 0.3;
   const [likedIds, setLikedIds] = useState<Set<number>>(new Set());
   const canQuickComment = Boolean(feedbackEnabled && feedbackOptions?.allowComments && onOpenPhotoWithFeedback);
+  const gridRef = useRef<HTMLDivElement | null>(null);
+  const handleScrollToGrid = useCallback(() => {
+    if (gridRef.current) {
+      gridRef.current.scrollIntoView({ behavior: 'smooth', block: 'start' });
+    }
+  }, []);
 
   // If an override is provided, always use it and skip initialization logic
   useEffect(() => {
@@ -163,30 +169,40 @@ export const HeroGalleryLayout: React.FC<HeroGalleryLayoutProps> = ({
         
         {/* Scroll Indicator */}
         <div className="absolute bottom-8 left-1/2 transform -translate-x-1/2 animate-bounce">
-          <ChevronDown className="w-8 h-8 text-white drop-shadow-lg" />
+          <button
+            type="button"
+            onClick={handleScrollToGrid}
+            className="rounded-full border border-white/30 bg-white/10 p-3 text-white transition focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-white focus-visible:ring-offset-2 hover:bg-white/20"
+            aria-label={t('gallery.scrollToGallery', 'Scroll to gallery')}
+          >
+            <ChevronDown className="w-8 h-8 drop-shadow-lg" />
+          </button>
         </div>
       </div>
 
       {/* Grid Section */}
-      <div className="grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-5 gap-4">
+      <div
+        ref={gridRef}
+        className="grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-5 gap-4"
+      >
         {remainingPhotos.map((photo) => {
           const actualIndex = photos.findIndex(p => p.id === photo.id);
           return (
             <div
               key={photo.id}
-              className="relative group cursor-pointer aspect-square"
+              className="relative group cursor-pointer overflow-hidden rounded-lg"
               onClick={() => onPhotoClick(actualIndex)}
             >
               <AuthenticatedImage
                 src={photo.thumbnail_url || photo.url}
                 alt={photo.filename}
-                className="w-full h-full object-cover rounded-lg transition-transform duration-300 group-hover:scale-105"
+                className="w-full h-auto object-cover transition-transform duration-300 group-hover:scale-105"
                 loading="lazy"
                 isGallery={true}
                 protectFromDownload={!allowDownloads}
               />
-              
-              <div className="absolute inset-0 bg-black/40 opacity-0 group-hover:opacity-100 transition-opacity duration-200 rounded-lg flex items-center justify-center gap-2">
+
+              <div className="absolute inset-0 bg-black/40 opacity-0 group-hover:opacity-100 transition-opacity duration-200 flex items-center justify-center gap-2">
                 {!isSelectionMode && (
                   <>
                     <button

frontend/src/config/api.ts

@@ -5,6 +5,7 @@ import {
   inferGallerySlugFromLocation,
   resolveSlugFromRequestUrl,
 } from '../utils/galleryAuthStorage';
+import { getApiBaseUrl } from '../utils/url';
 
 // Maintenance mode callback
 let maintenanceModeCallback: ((enabled: boolean) => void) | null = null;
@@ -15,7 +16,7 @@ export const setMaintenanceModeCallback = (callback: (enabled: boolean) => void)
 
 // Create axios instance
 export const api = axios.create({
-  baseURL: import.meta.env.VITE_API_URL || '/api',
+  baseURL: getApiBaseUrl(),
   headers: {
     'Content-Type': 'application/json',
   },

frontend/src/contexts/AdminAuthContext.tsx

@@ -13,7 +13,7 @@ interface AdminAuthContextType {
   error: string | null;
   mustChangePassword: boolean;
   updatePasswordChanged: () => void;
-  updateUserProfile: (updates: Partial<AdminUser>) => void;
+  updateProfile: (user: AdminUser) => void;
 }
 
 const AdminAuthContext = createContext<AdminAuthContextType | undefined>(undefined);
@@ -105,15 +105,9 @@ export const AdminAuthProvider: React.FC<AdminAuthProviderProps> = ({ children }
     }
   };
 
-  const updateUserProfile = (updates: Partial<AdminUser>) => {
-    setUser((prev) => {
-      if (!prev) {
-        return prev;
-      }
-      const nextUser = { ...prev, ...updates };
-      sessionStorage.setItem('admin_user', JSON.stringify(nextUser));
-      return nextUser;
-    });
+  const updateProfile = (updatedUser: AdminUser) => {
+    setUser(updatedUser);
+    sessionStorage.setItem('admin_user', JSON.stringify(updatedUser));
   };
 
   return (
@@ -127,7 +121,7 @@ export const AdminAuthProvider: React.FC<AdminAuthProviderProps> = ({ children }
         error,
         mustChangePassword,
         updatePasswordChanged,
-        updateUserProfile,
+        updateProfile,
       }}
     >
       {children}

frontend/src/contexts/GalleryAuthContext.tsx

@@ -1,6 +1,5 @@
-import React, { createContext, useContext, useState, useEffect, useRef } from 'react';
+import React, { createContext, useContext, useState, useEffect } from 'react';
 import type { ReactNode } from 'react';
-import { useLocation } from 'react-router-dom';
 import { api } from '../config/api';
 import { authService, galleryService } from '../services';
 import { cleanupOldGalleryAuth } from '../utils/cleanupGalleryAuth';
@@ -62,133 +61,52 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
   const [event, setEvent] = useState<GalleryEvent | null>(null);
   const [isLoading, setIsLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
-  const [routeError, setRouteError] = useState<string | null>(null);
-  const location = useLocation();
-  const [routeInfo, setRouteInfo] = useState<{ slug: string | null; token?: string; identifier: string | null; ready: boolean }>({
-    slug: null,
-    token: undefined,
-    identifier: null,
-    ready: false,
-  });
-  const lastResolvedIdentifier = useRef<string | null>(null);
+
+  // Get current gallery slug from URL
+  const getCurrentGallerySlug = () => {
+    const pathParts = window.location.pathname.split('/');
+    if (pathParts[1] === 'gallery' && pathParts[2]) {
+      return pathParts[2];
+    }
+    return null;
+  };
 
   useEffect(() => {
     cleanupOldGalleryAuth();
-  }, []);
 
-  useEffect(() => {
-    let cancelled = false;
-
-    const parseRoute = async () => {
-      const segments = location.pathname.split('/').filter(Boolean);
-
-      if (segments[0] !== 'gallery') {
-        if (!cancelled) {
-          setRouteInfo({ slug: null, token: undefined, identifier: null, ready: true });
-          setRouteError(null);
-        }
-        return;
-      }
-
-      const identifier = segments[1] || null;
-      const tokenSegment = segments[2];
-
-      if (!identifier) {
-        if (!cancelled) {
-          setRouteInfo({ slug: null, token: undefined, identifier: null, ready: true });
-        }
-        return;
-      }
-
-      const looksLikeToken = /^[0-9a-fA-F]{32}$/.test(identifier) && !tokenSegment;
-
-      if (looksLikeToken) {
-        if (lastResolvedIdentifier.current === identifier) {
-          setRouteInfo(prev => ({
-            slug: prev.slug,
-            token: prev.token,
-            identifier,
-            ready: true,
-          }));
-          setRouteError(null);
-          return;
-        }
-
-        try {
-          const resolved = await galleryService.resolveIdentifier(identifier);
-          if (cancelled) return;
-          lastResolvedIdentifier.current = identifier;
-          setRouteInfo({
-            slug: resolved.slug,
-            token: resolved.token,
-            identifier,
-            ready: true,
-          });
-          setRouteError(null);
-        } catch (err: any) {
-          if (cancelled) return;
-          lastResolvedIdentifier.current = identifier;
-          setRouteInfo({
-            slug: null,
-            token: undefined,
-            identifier,
-            ready: true,
-          });
-          setRouteError(err?.response?.data?.error || 'Unable to resolve gallery link');
-        }
-      } else {
-        lastResolvedIdentifier.current = null;
-        setRouteInfo({
-          slug: identifier,
-          token: tokenSegment,
-          identifier,
-          ready: true,
-        });
-        setRouteError(null);
-      }
-    };
-
-    setRouteInfo(prev => ({ ...prev, ready: false }));
-    parseRoute();
-
-    return () => {
-      cancelled = true;
-    };
-  }, [location.pathname]);
-
-  useEffect(() => {
-    if (!routeInfo.ready) {
-      return;
-    }
-
-    if (!routeInfo.slug) {
+    const slugAtMount = getCurrentGallerySlug();
+    if (slugAtMount) {
+      setActiveGallerySlug(slugAtMount);
+    } else {
       clearActiveGallerySlug();
-      setIsAuthenticated(false);
-      setEvent(null);
-      setIsLoading(false);
-      return;
-    }
-
-    const currentSlug = routeInfo.slug;
-    setActiveGallerySlug(currentSlug);
-
-    const storedEvent = sessionStorage.getItem(`gallery_event_${currentSlug}`);
-    if (storedEvent) {
-      try {
-        const parsed = JSON.parse(storedEvent);
-        if (parsed && parsed.id) {
-          const normalizedStored = normalizeEvent(parsed);
-          setEvent(normalizedStored);
-          if (normalizedStored) {
-            sessionStorage.setItem(`gallery_event_${currentSlug}`, JSON.stringify(normalizedStored));
-          }
-        }
-      } catch {
-        sessionStorage.removeItem(`gallery_event_${currentSlug}`);
-      }
     }
 
     const initialise = async () => {
+      const currentSlug = getCurrentGallerySlug();
+
+      if (!currentSlug) {
+        setIsLoading(false);
+        return;
+      }
+
+      setActiveGallerySlug(currentSlug);
+
+      const storedEvent = sessionStorage.getItem(`gallery_event_${currentSlug}`);
+      if (storedEvent) {
+        try {
+          const parsed = JSON.parse(storedEvent);
+          if (parsed && parsed.id) {
+            const normalizedStored = normalizeEvent(parsed);
+            setEvent(normalizedStored);
+            if (normalizedStored) {
+              sessionStorage.setItem(`gallery_event_${currentSlug}`, JSON.stringify(normalizedStored));
+            }
+          }
+        } catch (err) {
+          sessionStorage.removeItem(`gallery_event_${currentSlug}`);
+        }
+      }
+
       try {
         setIsLoading(true);
         const sessionResponse = await api.get<{ valid: boolean; type: string; eventSlug?: string }>(
@@ -200,6 +118,7 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
           setIsAuthenticated(true);
 
           if (!storedEvent) {
+            // Fetch gallery details to hydrate context
             const galleryData = await galleryService.getGalleryPhotos(currentSlug);
             if (galleryData?.event) {
               const normalizedEvent = normalizeEvent(galleryData.event);
@@ -213,10 +132,14 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
           return;
         }
 
-        if (routeInfo.token) {
-          const verify = await galleryService.verifyToken(currentSlug, routeInfo.token);
+        // If no active session, check for share token in URL
+        const parts = window.location.pathname.split('/');
+        const urlToken = parts.length >= 5 ? parts[4] : (parts.length >= 4 ? parts[3] : undefined);
+
+        if (urlToken) {
+          const verify = await galleryService.verifyToken(currentSlug, urlToken);
           if (verify?.valid) {
-            const response = await authService.shareLinkLogin(currentSlug, routeInfo.token);
+            const response = await authService.shareLinkLogin(currentSlug, urlToken);
             if (response?.event) {
               const normalizedEvent = normalizeEvent(response.event);
               setEvent(normalizedEvent);
@@ -233,33 +156,29 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
           }
         }
 
+        // No valid session found
         setIsAuthenticated(false);
         sessionStorage.removeItem(`gallery_event_${currentSlug}`);
         setEvent(null);
         clearGalleryToken(currentSlug);
-      } catch (initialiseError: any) {
+      } catch (error) {
         setIsAuthenticated(false);
         sessionStorage.removeItem(`gallery_event_${currentSlug}`);
         setEvent(null);
         clearGalleryToken(currentSlug);
-        if (initialiseError?.response?.data?.error) {
-          setError(initialiseError.response.data.error);
-        }
       } finally {
         setIsLoading(false);
       }
     };
 
     initialise();
-
     return () => {
       clearActiveGallerySlug();
     };
-  }, [routeInfo]);
+  }, []);
 
   const login = async (slug: string, password?: string, recaptchaToken?: string | null) => {
     try {
-      setRouteError(null);
       setError(null);
       setIsLoading(true);
       const response = await authService.verifyGalleryPassword(slug, password, recaptchaToken);
@@ -271,6 +190,7 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
       }
       setActiveGallerySlug(slug);
 
+      // Store event data for quick reloads (non-sensitive)
       if (normalizedEvent) {
         sessionStorage.setItem(`gallery_event_${slug}`, JSON.stringify(normalizedEvent));
       }
@@ -283,7 +203,7 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
   };
 
   const logout = () => {
-    const currentSlug = routeInfo.slug;
+    const currentSlug = getCurrentGallerySlug();
     if (currentSlug) {
       sessionStorage.removeItem(`gallery_event_${currentSlug}`);
       clearGalleryToken(currentSlug);
@@ -302,7 +222,7 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
         login,
         logout,
         isLoading,
-        error: routeError ?? error,
+        error,
       }}
     >
       {children}

frontend/src/hooks/useGallery.ts

@@ -2,18 +2,12 @@ import { useQuery, useMutation } from '@tanstack/react-query';
 import { galleryService } from '../services';
 import { toast } from 'react-toastify';
 
-export const useGalleryInfo = (slug?: string, token?: string, enabled: boolean = true) => {
+export const useGalleryInfo = (slug: string, token?: string) => {
   return useQuery({
     queryKey: ['gallery-info', slug, token],
-    queryFn: () => {
-      if (!slug) {
-        throw new Error('Gallery slug is required');
-      }
-      return galleryService.getGalleryInfo(slug, token);
-    },
+    queryFn: () => galleryService.getGalleryInfo(slug, token),
     retry: 1,
     staleTime: 5 * 60 * 1000, // 5 minutes
-    enabled: Boolean(slug) && enabled,
   });
 };
 

frontend/src/i18n/locales/de.json

@@ -48,7 +48,7 @@
     "noCategory": "Keine Kategorie",
     "eventSpecific": "(Veranstaltungsspezifisch)",
     "clickToUpload": "Klicken zum Hochladen oder per Drag & Drop",
-    "fileRequirements": "JPEG, PNG oder WebP (max. 50MB pro Datei, {{limit}} Dateien pro Upload)",
+    "fileRequirements": "JPEG, PNG oder WebP (max. 50MB pro Datei)",
     "selectedFiles": "Ausgewählte Dateien",
     "uploading": "Wird hochgeladen...",
     "uploadComplete": "Upload abgeschlossen!",
@@ -59,11 +59,9 @@
     "externalImportInfo": "Alle Bilder aus dem ausgewählten Ordner werden importiert.",
     "selectExternalFolder": "Externen Ordner unter /external-media auswählen",
     "importFromSelectedFolder": "Ausgewählten Ordner importieren",
-    "maxFilesReached": "Maximal {{limit}} Dateien erlaubt",
-    "someFilesSkipped": "Nur {{allowed}} weitere Dateien erlaubt (Limit {{limit}})",
-    "tooManyFiles": "Maximal {{limit}} Dateien können gleichzeitig hochgeladen werden",
-    "limitInfo": "{{selected}} von {{limit}} Dateien ausgewählt ({{remaining}} verbleibend)",
-    "limitReached": "Upload-Limit erreicht ({{limit}} Dateien pro Vorgang)",
+    "maxFilesReached": "Maximal 500 Dateien erlaubt",
+    "someFilesSkipped": "Einige Dateien wurden übersprungen (500 Dateien Limit)",
+    "tooManyFiles": "Maximal 500 Dateien können gleichzeitig hochgeladen werden",
     "uploadingChunks": "Lade {{count}} Dateien in {{total}} Teilen hoch..."
   },
   "navigation": {
@@ -568,8 +566,8 @@
     "eventName": "Veranstaltungsname",
     "eventType": "Veranstaltungstyp",
     "eventDate": "Veranstaltungsdatum",
-    "hostEmail": "E-Mail des Kunden",
-    "hostName": "Name des Kunden",
+    "hostEmail": "Gastgeber-E-Mail",
+    "hostName": "Name des Gastgebers",
     "hostNamePlaceholder": "Max Mustermann",
     "adminEmail": "Admin-E-Mail",
     "expirationDate": "Ablaufdatum",
@@ -591,8 +589,8 @@
     "eventExpired": "Diese Veranstaltung ist abgelaufen",
     "eventExpiresIn": "Diese Veranstaltung läuft in {{days}} Tagen ab",
     "guestsNoAccess": "Gäste können nicht mehr auf die Galerie zugreifen. Erwägen Sie, diese Veranstaltung zu archivieren.",
-    "warningEmailsSent": "Warn-E-Mails wurden an den Kunden gesendet.",
-    "warningEmailsHaveBeenSent": "Warn-E-Mails wurden an den Kunden gesendet.",
+    "warningEmailsSent": "Warn-E-Mails wurden an den Gastgeber gesendet.",
+    "warningEmailsHaveBeenSent": "Warn-E-Mails wurden an den Gastgeber gesendet.",
     "extendSevenDays": "Um 7 Tage verlängern",
     "overview": "Übersicht",
     "photos": "Fotos",
@@ -633,7 +631,7 @@
     "organizeCategoriesInfo": "Organisieren Sie Ihre Fotos in Kategorien. Kategorien helfen Gästen, bestimmte Fototypen zu navigieren und zu finden.",
     "categoriesTip": "Tipp: Kategorien sind spezifisch für jede Veranstaltung. Sie können auch globale Kategorien in den Einstellungen erstellen.",
     "contactInformation": "Kontaktinformationen",
-    "hostEmailHelp": "Der Kunde erhält Benachrichtigungen zur Galerie-Erstellung und zum Ablauf",
+    "hostEmailHelp": "Erhält Benachrichtigungen zur Galerie-Erstellung und zum Ablauf",
     "adminEmailHelp": "Erhält Systembenachrichtigungen und Archivbestätigungen",
     "securityAccess": "Sicherheit & Zugriff",
     "galleryPassword": "Galerie-Passwort",
@@ -688,7 +686,7 @@
     "eventNamePlaceholder": "z.B. Max & Maria's Hochzeit",
     "welcomeMessageOptional": "Willkommensnachricht (Optional)",
     "welcomeMessagePlaceholder": "Willkommen zu unserem besonderen Tag! Laden Sie diese Erinnerungen gerne herunter und teilen Sie sie...",
-    "hostEmailPlaceholder": "kunde@beispiel.de",
+    "hostEmailPlaceholder": "gastgeber@beispiel.de",
     "adminEmailPlaceholder": "admin@beispiel.de",
     "securityAndAccess": "Sicherheit & Zugriff",
     "accessAndSecurity": "Zugriff & Sicherheit",
@@ -775,16 +773,12 @@
       "defaultExpirationHelp": "Wie lange Galerien standardmäßig aktiv bleiben",
       "maxFileSize": "Max. Dateigröße (MB)",
       "maxFileSizeHelp": "Maximale Größe pro hochgeladenem Foto",
-      "maxFilesPerUpload": "Max. Dateien pro Upload",
-      "maxFilesPerUploadHelp": "Maximale Anzahl an Fotos pro Upload-Vorgang (1-{{max}}).",
       "allowedFileTypes": "Erlaubte Dateitypen",
       "allowedFileTypesHelp": "Kommagetrennte Liste von Dateierweiterungen",
       "featureToggles": "Funktionsschalter",
       "enableWatermark": "Wasserzeichen auf Fotos aktivieren",
       "enableAnalytics": "Analytics-Tracking aktivieren",
       "enableRegistration": "Selbstregistrierung für Admins erlauben",
-      "enableShortGalleryUrls": "Kurze Galerie-Links verwenden",
-      "enableShortGalleryUrlsHelp": "Entfernt den Veranstaltungs-Slug aus neuen Freigabelinks und lässt bestehende Links weiterhin funktionieren.",
       "maintenanceMode": "Wartungsmodus aktivieren",
       "language": "Sprache",
       "defaultLanguage": "Standardsprache",
@@ -797,18 +791,7 @@
       "saveGeneralSettings": "Allgemeine Einstellungen speichern",
       "dateTimeFormat": "Datums- & Zeitformat",
       "dateFormat": "Datumsformat",
-      "dateFormatHelp": "Wie Daten in E-Mails und in der gesamten Anwendung angezeigt werden",
-      "accountSection": "Admin-Konto",
-      "accountUsername": "Admin-Benutzername",
-      "accountUsernameHelp": "Wird im Admin-Bereich angezeigt und in Aktivitätsprotokollen verwendet.",
-      "accountUsernameRequired": "Benutzername ist erforderlich",
-      "accountUsernameLength": "Benutzername muss mindestens 3 Zeichen lang sein",
-      "accountEmail": "Admin-E-Mail",
-      "accountEmailHelp": "Wird für die Anmeldung und für Sicherheitsbenachrichtigungen verwendet.",
-      "accountEmailRequired": "E-Mail-Adresse ist erforderlich",
-      "accountEmailInvalid": "Bitte eine gültige E-Mail-Adresse eingeben",
-      "accountSaveButton": "Kontodaten speichern",
-      "accountSaveSuccess": "Kontodaten aktualisiert"
+      "dateFormatHelp": "Wie Daten in E-Mails und in der gesamten Anwendung angezeigt werden"
     },
     "publicSite": {
       "tabLabel": "Öffentliche Seite",
@@ -892,11 +875,7 @@
       "sessionTimeout": "Sitzungs-Timeout (Minuten)",
       "sessionTimeoutHelp": "Admin-Sitzungs-Timeout in Minuten",
       "maxLoginAttempts": "Max. Anmeldeversuche",
-      "maxLoginAttemptsHelp": "Maximale fehlgeschlagene Anmeldeversuche pro IP vor Sperrung",
-      "attemptWindowMinutes": "Versuchsfenster (Minuten)",
-      "attemptWindowMinutesHelp": "Zeitraum, in dem fehlgeschlagene Anmeldeversuche gezählt werden",
-      "lockoutDurationMinutes": "Sperrdauer (Minuten)",
-      "lockoutDurationMinutesHelp": "Wie lange Galerie oder Konto nach zu vielen Fehlern gesperrt bleiben",
+      "maxLoginAttemptsHelp": "Maximale fehlgeschlagene Anmeldeversuche vor Sperrung",
       "enable2FA": "Zwei-Faktor-Authentifizierung für Admins aktivieren",
       "recaptchaSettings": "reCAPTCHA-Einstellungen",
       "enableRecaptcha": "reCAPTCHA für Anmeldeformulare aktivieren",
@@ -1101,7 +1080,7 @@
     "viewAllNotifications": "Alle Benachrichtigungen anzeigen",
     "noNotifications": "Keine neuen Benachrichtigungen",
     "markAllRead": "Alle als gelesen markieren",
-    "clearOld": "Alte löschen",
+    "clearAll": "Alle löschen",
     "close": "Schließen",
     "noNotificationsMessage": "Keine Benachrichtigungen",
     "notificationMessages": {
@@ -1134,11 +1113,13 @@
       "archiveDownloaded": "Archiv für \"{{eventName}}\" heruntergeladen",
       "archiveDeleted": "Archiv für \"{{eventName}}\" gelöscht",
       "archiveRestored": "Archiv für \"{{eventName}}\" wiederhergestellt",
-      "systemActivity": "Systemaktivität: {{type}}"
+      "systemActivity": "Systemaktivität: {{type}}",
+      "adminProfileUpdated": "Admin-Profil aktualisiert von {{actorName}}"
     },
     "notificationToasts": {
       "markedAllRead": "Alle Benachrichtigungen als gelesen markiert",
-      "clearedOld": "{{count}} alte Benachrichtigungen gelöscht"
+      "clearedAll": "{{count}} Benachrichtigungen gelöscht",
+      "profileUpdated": "Admin-Profil aktualisiert"
     },
     "viewAllNotifications": "Alle Benachrichtigungen anzeigen",
     "noNotifications": "Keine neuen Benachrichtigungen",
@@ -1146,6 +1127,16 @@
     "markAllAsRead": "Alle als gelesen markieren",
     "notificationSettings": "Benachrichtigungseinstellungen",
     "changePassword": "Passwort ändern",
+    "accountSettings": {
+      "title": "Admin-Konto",
+      "description": "Aktualisiere die Zugangsdaten für die PicPeak-Administration.",
+      "username": "Benutzername",
+      "usernamePlaceholder": "Admin",
+      "email": "E-Mail",
+      "emailPlaceholder": "admin@example.com",
+      "updateButton": "Profil aktualisieren"
+    },
+    "profileUpdateError": "Admin-Profil konnte nicht aktualisiert werden. Bitte versuche es erneut.",
     "loadingDashboard": "Dashboard wird geladen...",
     "activeEvents": "Aktive Veranstaltungen",
     "expiringSoon": "Demnächst ablaufend",
@@ -1371,8 +1362,8 @@
   },
   "validation": {
     "eventNameRequired": "Veranstaltungsname ist erforderlich",
-    "hostEmailRequired": "Die E-Mail des Kunden ist erforderlich",
-    "hostNameRequired": "Der Name des Kunden ist erforderlich",
+    "hostEmailRequired": "Gastgeber-E-Mail ist erforderlich",
+    "hostNameRequired": "Der Name des Gastgebers ist erforderlich",
     "adminEmailRequired": "Admin-E-Mail ist erforderlich",
     "invalidEmailFormat": "Ungültiges E-Mail-Format",
     "passwordRequired": "Passwort ist erforderlich",

frontend/src/i18n/locales/en.json

@@ -48,7 +48,7 @@
     "noCategory": "No category",
     "eventSpecific": "(Event specific)",
     "clickToUpload": "Click to upload or drag and drop",
-    "fileRequirements": "JPEG, PNG or WebP (max 50MB per file, {{limit}} files per upload)",
+    "fileRequirements": "JPEG, PNG or WebP (max 50MB per file)",
     "selectedFiles": "Selected files",
     "uploading": "Uploading...",
     "uploadComplete": "Upload complete!",
@@ -59,11 +59,9 @@
     "externalImportInfo": "All pictures from the selected folder will be imported.",
     "selectExternalFolder": "Select external folder under /external-media",
     "importFromSelectedFolder": "Import from selected folder",
-    "maxFilesReached": "Maximum {{limit}} files allowed",
-    "someFilesSkipped": "Only {{allowed}} more files can be added (limit {{limit}})",
-    "tooManyFiles": "Maximum {{limit}} files can be uploaded at once",
-    "limitInfo": "{{selected}} of {{limit}} files selected ({{remaining}} remaining)",
-    "limitReached": "Upload limit reached ({{limit}} files per batch)",
+    "maxFilesReached": "Maximum 500 files allowed",
+    "someFilesSkipped": "Some files were skipped (500 file limit)",
+    "tooManyFiles": "Maximum 500 files can be uploaded at once",
     "uploadingChunks": "Uploading {{count}} files in {{total}} batches..."
   },
   "navigation": {
@@ -227,7 +225,7 @@
     "eventNamePlaceholder": "e.g., John & Jane's Wedding",
     "welcomeMessageOptional": "Welcome Message (Optional)",
     "welcomeMessagePlaceholder": "Welcome to our special day! Feel free to download and share these memories...",
-    "hostEmailPlaceholder": "customer@example.com",
+    "hostEmailPlaceholder": "host@example.com",
     "adminEmailPlaceholder": "admin@example.com",
     "securityAndAccess": "Security & Access",
     "accessAndSecurity": "Access & Security",
@@ -253,8 +251,8 @@
     "eventName": "Event Name",
     "eventType": "Event Type",
     "eventDate": "Event Date",
-    "hostEmail": "Customer Email",
-    "hostName": "Customer Name",
+    "hostEmail": "Host Email",
+    "hostName": "Host Name",
     "hostNamePlaceholder": "John Smith",
     "adminEmail": "Admin Email",
     "adminNotificationEmail": "Admin Notification Email",
@@ -277,7 +275,7 @@
     "eventExpired": "This event has expired",
     "eventExpiresIn": "This event expires in {{days}} days",
     "guestsNoAccess": "Guests can no longer access the gallery. Consider archiving this event.",
-    "warningEmailsSent": "Warning emails have been sent to the customer.",
+    "warningEmailsSent": "Warning emails have been sent to the host.",
     "overview": "Overview",
     "photos": "Photos",
     "categories": "Categories",
@@ -317,7 +315,7 @@
     "organizeCategoriesInfo": "Organize your photos into categories. Categories help guests navigate and find specific types of photos.",
     "categoriesTip": "Tip: Categories are specific to each event. You can also create global categories in Settings.",
     "contactInformation": "Contact Information",
-    "hostEmailHelp": "Customer will receive gallery creation and expiration notifications",
+    "hostEmailHelp": "Will receive gallery creation and expiration notifications",
     "adminEmailHelp": "Will receive system notifications and archive confirmations",
     "securityAccess": "Security & Access",
     "galleryPassword": "Gallery Password",
@@ -408,13 +406,13 @@
     "tryAgain": "Try Again",
     "eventExpiredMessage": "This event has expired",
     "guestsCannotAccessGallery": "Guests can no longer access the gallery. Consider archiving this event.",
-    "warningEmailsHaveBeenSent": "Warning emails have been sent to the customer.",
+    "warningEmailsHaveBeenSent": "Warning emails have been sent to the host.",
     "extendSevenDays": "Extend 7 Days",
     "overview": "Overview",
     "eventInformation": "Event Information",
     "welcomeMessageLabel": "Welcome Message",
     "noWelcomeMessageSet": "No welcome message set",
-    "hostEmail": "Customer Email",
+    "hostEmail": "Host Email",
     "adminEmail": "Admin Email",
     "createdOn": "Created",
     "expires": "Expires",
@@ -455,16 +453,12 @@
       "defaultExpirationHelp": "How long galleries remain active by default",
       "maxFileSize": "Max File Size (MB)",
       "maxFileSizeHelp": "Maximum size per uploaded photo",
-      "maxFilesPerUpload": "Max Files per Upload",
-      "maxFilesPerUploadHelp": "Maximum number of photos allowed in a single upload batch (1-{{max}}).",
       "allowedFileTypes": "Allowed File Types",
       "allowedFileTypesHelp": "Comma-separated list of file extensions",
       "featureToggles": "Feature Toggles",
       "enableWatermark": "Enable watermark on photos",
       "enableAnalytics": "Enable analytics tracking",
       "enableRegistration": "Allow self-registration for admins",
-      "enableShortGalleryUrls": "Use short gallery URLs",
-      "enableShortGalleryUrlsHelp": "Removes the event slug from new share links while keeping existing links working.",
       "maintenanceMode": "Enable maintenance mode",
       "language": "Language",
       "defaultLanguage": "Default Language",
@@ -477,18 +471,7 @@
       "saveGeneralSettings": "Save General Settings",
       "dateTimeFormat": "Date & Time Format",
       "dateFormat": "Date Format",
-      "dateFormatHelp": "How dates are displayed in emails and throughout the application",
-      "accountSection": "Admin Account",
-      "accountUsername": "Admin Username",
-      "accountUsernameHelp": "Displayed in the admin interface and used in activity logs.",
-      "accountUsernameRequired": "Username is required",
-      "accountUsernameLength": "Username must be at least 3 characters",
-      "accountEmail": "Admin Email",
-      "accountEmailHelp": "Used for login and receiving security notifications.",
-      "accountEmailRequired": "Email address is required",
-      "accountEmailInvalid": "Enter a valid email address",
-      "accountSaveButton": "Save account details",
-      "accountSaveSuccess": "Account details updated"
+      "dateFormatHelp": "How dates are displayed in emails and throughout the application"
     },
     "publicSite": {
       "tabLabel": "Public Site",
@@ -572,11 +555,7 @@
       "sessionTimeout": "Session Timeout (minutes)",
       "sessionTimeoutHelp": "Admin session timeout in minutes",
       "maxLoginAttempts": "Max Login Attempts",
-      "maxLoginAttemptsHelp": "Maximum failed login attempts per IP before lockout",
-      "attemptWindowMinutes": "Attempt Window (minutes)",
-      "attemptWindowMinutesHelp": "How long to look back when counting failed login attempts",
-      "lockoutDurationMinutes": "Lockout Duration (minutes)",
-      "lockoutDurationMinutesHelp": "How long the gallery or account stays locked after too many failures",
+      "maxLoginAttemptsHelp": "Maximum failed login attempts before lockout",
       "enable2FA": "Enable two-factor authentication for admins",
       "recaptchaSettings": "reCAPTCHA Settings",
       "enableRecaptcha": "Enable reCAPTCHA for login forms",
@@ -839,7 +818,7 @@
     "viewAllNotifications": "View all notifications",
     "noNotifications": "No new notifications",
     "markAllRead": "Mark all read",
-    "clearOld": "Clear old",
+    "clearAll": "Clear all",
     "close": "Close",
     "noNotificationsMessage": "No notifications",
     "notificationMessages": {
@@ -872,16 +851,28 @@
       "archiveDownloaded": "Archive downloaded for \"{{eventName}}\"",
       "archiveDeleted": "Archive deleted for \"{{eventName}}\"",
       "archiveRestored": "Archive restored for \"{{eventName}}\"",
-      "systemActivity": "System activity: {{type}}"
+      "systemActivity": "System activity: {{type}}",
+      "adminProfileUpdated": "Admin profile updated by {{actorName}}"
     },
     "notificationToasts": {
       "markedAllRead": "All notifications marked as read",
-      "clearedOld": "Cleared {{count}} old notifications"
+      "clearedAll": "Cleared {{count}} notifications",
+      "profileUpdated": "Admin profile updated"
     },
     "markAsRead": "Mark as read",
     "markAllAsRead": "Mark all as read",
     "notificationSettings": "Notification Settings",
     "changePassword": "Change Password",
+    "accountSettings": {
+      "title": "Admin account",
+      "description": "Update the credentials used to sign in to PicPeak.",
+      "username": "Username",
+      "usernamePlaceholder": "Admin",
+      "email": "Email",
+      "emailPlaceholder": "admin@example.com",
+      "updateButton": "Update profile"
+    },
+    "profileUpdateError": "Unable to update admin profile. Please try again.",
     "loadingDashboard": "Loading dashboard...",
     "activeEvents": "Active Events",
     "expiringSoon": "Expiring Soon",
@@ -976,8 +967,8 @@
   },
   "validation": {
     "eventNameRequired": "Event name is required",
-    "hostEmailRequired": "Customer email is required",
-    "hostNameRequired": "Customer name is required",
+    "hostEmailRequired": "Host email is required",
+    "hostNameRequired": "Host name is required",
     "adminEmailRequired": "Admin email is required",
     "invalidEmailFormat": "Invalid email format",
     "passwordRequired": "Password is required",

frontend/src/pages/GalleryPage.tsx

@@ -11,14 +11,13 @@ import { useGalleryAuth, useTheme } from '../contexts';
 import { useGalleryInfo } from '../hooks/useGallery';
 import { GalleryView } from '../components/gallery';
 import { analyticsService } from '../services/analytics.service';
-import { galleryService } from '../services';
 import { api } from '../config/api';
 import { GALLERY_THEME_PRESETS } from '../types/theme.types';
 import { buildResourceUrl } from '../utils/url';
 import { isGalleryPublic, normalizeRequirePassword } from '../utils/accessControl';
 
 export const GalleryPage: React.FC = () => {
-  const { slug: rawSlug, token: rawToken } = useParams<{ slug: string; token?: string }>();
+  const { slug, token } = useParams<{ slug: string; token?: string }>();
   const { isAuthenticated, login, event } = useGalleryAuth();
   const { t, i18n } = useTranslation();
   const { format } = useLocalizedDate();
@@ -28,82 +27,10 @@ export const GalleryPage: React.FC = () => {
   const [loginError, setLoginError] = useState<string | null>(null);
   const [recaptchaToken, setRecaptchaToken] = useState<string | null>(null);
   const [autoLoginAttempted, setAutoLoginAttempted] = useState(false);
-  const [resolvedSlug, setResolvedSlug] = useState<string | null>(() => {
-    if (rawSlug && !rawToken && /^[0-9a-fA-F]{32}$/.test(rawSlug)) {
-      return null;
-    }
-    return rawSlug || null;
-  });
-  const [resolvedToken, setResolvedToken] = useState<string | undefined>(rawToken);
-  const [isResolvingIdentifier, setIsResolvingIdentifier] = useState<boolean>(() =>
-    Boolean(rawSlug && !rawToken && /^[0-9a-fA-F]{32}$/.test(rawSlug))
-  );
-  const [identifierError, setIdentifierError] = useState<string | null>(null);
-  const lastResolvedIdentifier = React.useRef<string | null>(null);
 
-  React.useEffect(() => {
-    let cancelled = false;
-
-    const looksLikeToken = Boolean(rawSlug && !rawToken && /^[0-9a-fA-F]{32}$/.test(rawSlug));
-
-    if (!rawSlug) {
-      lastResolvedIdentifier.current = null;
-      setResolvedSlug(null);
-      setResolvedToken(rawToken);
-      setIsResolvingIdentifier(false);
-      setIdentifierError(null);
-    } else if (!looksLikeToken) {
-      lastResolvedIdentifier.current = null;
-      setResolvedSlug(rawSlug);
-      setResolvedToken(rawToken);
-      setIsResolvingIdentifier(false);
-      setIdentifierError(null);
-    } else if (lastResolvedIdentifier.current !== rawSlug) {
-      setIsResolvingIdentifier(true);
-      setIdentifierError(null);
-
-      galleryService.resolveIdentifier(rawSlug)
-        .then((data) => {
-          if (cancelled) return;
-          lastResolvedIdentifier.current = rawSlug;
-          setResolvedSlug(data.slug);
-          setResolvedToken(data.token);
-          setIdentifierError(null);
-        })
-        .catch((error: any) => {
-          if (cancelled) return;
-          lastResolvedIdentifier.current = rawSlug;
-          setResolvedSlug(null);
-          setResolvedToken(undefined);
-          const message = error?.response?.data?.error || 'Unable to resolve gallery link';
-          setIdentifierError(message);
-        })
-        .finally(() => {
-          if (!cancelled) {
-            setIsResolvingIdentifier(false);
-          }
-        });
-    } else {
-      setIsResolvingIdentifier(false);
-    }
-
-    return () => {
-      cancelled = true;
-    };
-  }, [rawSlug, rawToken]);
-
-  const canFetchGalleryInfo = Boolean(resolvedSlug) && !isResolvingIdentifier;
-  const {
-    data: galleryInfo,
-    isLoading: isLoadingInfoQuery,
-    error: infoError
-  } = useGalleryInfo(canFetchGalleryInfo ? resolvedSlug ?? undefined : undefined, resolvedToken, canFetchGalleryInfo);
-  const isLoadingInfo = isLoadingInfoQuery || isResolvingIdentifier;
+  // Fetch gallery info (public data)
+  const { data: galleryInfo, isLoading: isLoadingInfo, error: infoError } = useGalleryInfo(slug!, token);
   const requiresPassword = normalizeRequirePassword(galleryInfo?.requires_password, true);
-
-  React.useEffect(() => {
-    setAutoLoginAttempted(false);
-  }, [resolvedSlug]);
   
   // Fetch branding settings
   const { data: settingsData } = useQuery({
@@ -164,14 +91,14 @@ export const GalleryPage: React.FC = () => {
   }, [galleryInfo, settingsData, isAuthenticated, setTheme]);
 
   React.useEffect(() => {
-    if (!resolvedSlug || isResolvingIdentifier) {
+    if (!slug) {
       return;
     }
 
     if (galleryInfo && isGalleryPublic(galleryInfo.requires_password) && !isAuthenticated && !autoLoginAttempted) {
       setAutoLoginAttempted(true);
       setIsLoggingIn(true);
-      login(resolvedSlug, '')
+      login(slug, '')
         .then(() => {
           setLoginError(null);
         })
@@ -185,7 +112,7 @@ export const GalleryPage: React.FC = () => {
           setIsLoggingIn(false);
         });
     }
-  }, [galleryInfo, isAuthenticated, autoLoginAttempted, login, resolvedSlug, isResolvingIdentifier]);
+  }, [galleryInfo, isAuthenticated, autoLoginAttempted, login, slug]);
 
   // Calculate days until expiration
   const daysUntilExpiration = galleryInfo
@@ -204,16 +131,11 @@ export const GalleryPage: React.FC = () => {
     try {
       setIsLoggingIn(true);
       setLoginError(null);
-      if (!resolvedSlug) {
-        setLoginError(t('errors.galleryNotFound'));
-        return;
-      }
-
-      await login(resolvedSlug, requiresPassword ? password : '', recaptchaToken);
+      await login(slug!, requiresPassword ? password : '', recaptchaToken);
       
       if (requiresPassword) {
         analyticsService.trackGalleryEvent('password_entry', {
-          gallery: resolvedSlug,
+          gallery: slug,
           success: true
         });
       }
@@ -236,7 +158,7 @@ export const GalleryPage: React.FC = () => {
       // Track failed password entry
       if (requiresPassword) {
         analyticsService.trackGalleryEvent('password_entry', {
-          gallery: resolvedSlug ?? rawSlug ?? 'unknown',
+          gallery: slug,
           success: false,
           statusCode
         });
@@ -260,59 +182,6 @@ export const GalleryPage: React.FC = () => {
     );
   }
 
-  if (identifierError && !resolvedSlug && !isResolvingIdentifier) {
-    return (
-      <div className="min-h-screen" style={{ backgroundColor: 'var(--color-background, #fafafa)' }}>
-        <div className="min-h-screen flex flex-col">
-          {settingsData?.branding_logo_url && (
-            <div className="p-8 text-center">
-              <img
-                src={buildResourceUrl(settingsData.branding_logo_url)}
-                alt={settingsData.branding_company_name || 'Company Logo'}
-                className="h-16 w-auto object-contain mx-auto"
-              />
-            </div>
-          )}
-
-          <div className="flex-1 flex items-center justify-center">
-            <Card className="max-w-md w-full mx-4">
-              <CardContent className="text-center py-12">
-                <AlertCircle className="w-16 h-16 text-red-500 mx-auto mb-4" />
-                <h2 className="text-xl font-semibold mb-2">
-                  {t('errors.galleryNotFound')}
-                </h2>
-                <p className="text-neutral-600">
-                  {identifierError}
-                </p>
-              </CardContent>
-            </Card>
-          </div>
-
-          <div className="p-8 text-center">
-            <div className="flex items-center justify-center gap-4">
-              <Link
-                to="/impressum"
-                className="text-xs text-neutral-500 hover:text-neutral-700 transition-colors"
-              >
-                {t('legal.impressum')}
-              </Link>
-              <span className="text-xs text-neutral-400">|</span>
-              <Link
-                to="/datenschutz"
-                className="text-xs text-neutral-500 hover:text-neutral-700 transition-colors"
-              >
-                {t('legal.datenschutz')}
-              </Link>
-            </div>
-            <p className="text-xs mt-2 text-neutral-500">
-              Powered by <span className="font-semibold">PicPeak</span>
-            </p>
-          </div>
-        </div>
-      </div>
-    );
-  }
-
   // Show error state
   if (infoError) {
     // Check if it's an archived gallery error
@@ -430,11 +299,9 @@ export const GalleryPage: React.FC = () => {
     );
   }
 
-  const gallerySlugForView = resolvedSlug ?? rawSlug ?? '';
-
   // Show gallery view if authenticated
   if (isAuthenticated && event) {
-    return <GalleryView slug={gallerySlugForView} event={event} />;
+    return <GalleryView slug={slug!} event={event} />;
   }
 
   // Show login form

frontend/src/pages/admin/AdminLoginPage.tsx

@@ -68,7 +68,6 @@ export const AdminLoginPage: React.FC = () => {
 
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault();
-    toast.dismiss();
     
     if (!validateForm()) {
       return;

frontend/src/pages/admin/CreateEventPage.tsx

@@ -25,7 +25,7 @@ interface FormData {
   event_type: string;
   event_name: string;
   event_date: string;
-  customer_email: string;
+  host_email: string;
   admin_email: string;
   require_password: boolean;
   password: string;
@@ -122,7 +122,7 @@ export const CreateEventPage: React.FC = () => {
     event_type: 'wedding',
     event_name: '',
     event_date: format(new Date(), 'yyyy-MM-dd'),
-    customer_email: '',
+    host_email: '',
     admin_email: '',
     require_password: true,
     password: '',
@@ -198,10 +198,10 @@ export const CreateEventPage: React.FC = () => {
       newErrors.event_name = t('validation.eventNameRequired');
     }
 
-    if (!formData.customer_email) {
-      newErrors.customer_email = t('validation.hostEmailRequired');
-    } else if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(formData.customer_email)) {
-      newErrors.customer_email = t('validation.invalidEmailFormat');
+    if (!formData.host_email) {
+      newErrors.host_email = t('validation.hostEmailRequired');
+    } else if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(formData.host_email)) {
+      newErrors.host_email = t('validation.invalidEmailFormat');
     }
 
     if (!formData.admin_email) {
@@ -245,8 +245,7 @@ export const CreateEventPage: React.FC = () => {
       event_type: formData.event_type,
       event_name: formData.event_name,
       event_date: formData.event_date,
-      customer_name: formData.customer_email.split('@')[0],
-      customer_email: formData.customer_email,
+      host_email: formData.host_email,
       admin_email: formData.admin_email,
       require_password: formData.require_password,
       password: formData.require_password ? formData.password : undefined,
@@ -389,17 +388,17 @@ export const CreateEventPage: React.FC = () => {
           <h2 className="text-lg font-semibold text-neutral-900 mb-4">{t('events.contactInformation')}</h2>
           
           <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
-            {/* Customer Email */}
+            {/* Host Email */}
             <div>
-              <label htmlFor="customer_email" className="block text-sm font-medium text-neutral-700 mb-1">
+              <label htmlFor="host_email" className="block text-sm font-medium text-neutral-700 mb-1">
                 {t('events.hostEmail')}
               </label>
               <Input
-                id="customer_email"
+                id="host_email"
                 type="email"
-                value={formData.customer_email}
-                onChange={handleInputChange('customer_email')}
-                error={errors.customer_email}
+                value={formData.host_email}
+                onChange={handleInputChange('host_email')}
+                error={errors.host_email}
                 placeholder={t('events.hostEmailPlaceholder')}
                 leftIcon={<Mail className="w-5 h-5 text-neutral-400" />}
               />

frontend/src/pages/admin/CreateEventPageEnhanced.tsx

@@ -27,8 +27,8 @@ interface FormData {
   event_type: string;
   event_name: string;
   event_date: string;
-  customer_name: string;
-  customer_email: string;
+  host_name: string;
+  host_email: string;
   admin_email: string;
   require_password: boolean;
   password: string;
@@ -86,8 +86,8 @@ export const CreateEventPageEnhanced: React.FC = () => {
     event_type: 'wedding',
     event_name: '',
     event_date: new Date().toISOString().split('T')[0], // Initialize with ISO date format
-    customer_name: '',
-    customer_email: '',
+    host_name: '',
+    host_email: '',
     admin_email: '',
     require_password: true,
     password: '',
@@ -184,14 +184,14 @@ export const CreateEventPageEnhanced: React.FC = () => {
       newErrors.event_date = t('validation.eventDateRequired');
     }
 
-    if (!formData.customer_name) {
-      newErrors.customer_name = t('validation.hostNameRequired');
+    if (!formData.host_name) {
+      newErrors.host_name = t('validation.hostNameRequired');
     }
 
-    if (!formData.customer_email) {
-      newErrors.customer_email = t('validation.hostEmailRequired');
-    } else if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(formData.customer_email)) {
-      newErrors.customer_email = t('validation.invalidEmailFormat');
+    if (!formData.host_email) {
+      newErrors.host_email = t('validation.hostEmailRequired');
+    } else if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(formData.host_email)) {
+      newErrors.host_email = t('validation.invalidEmailFormat');
     }
 
     if (!formData.admin_email) {
@@ -236,8 +236,8 @@ export const CreateEventPageEnhanced: React.FC = () => {
       event_type: formData.event_type,
       event_name: formData.event_name,
       event_date: formData.event_date,
-      customer_name: formData.customer_name,
-      customer_email: formData.customer_email,
+      host_name: formData.host_name,
+      host_email: formData.host_email,
       admin_email: formData.admin_email,
       require_password: formData.require_password,
       password: formData.require_password ? formData.password : undefined,
@@ -472,9 +472,9 @@ export const CreateEventPageEnhanced: React.FC = () => {
                 <Input
                   label={t('events.hostName')}
                   placeholder={t('events.hostNamePlaceholder')}
-                  value={formData.customer_name}
-                  onChange={handleInputChange('customer_name')}
-                  error={errors.customer_name}
+                  value={formData.host_name}
+                  onChange={handleInputChange('host_name')}
+                  error={errors.host_name}
                   leftIcon={<Calendar className="w-5 h-5" />}
                 />
 
@@ -482,9 +482,9 @@ export const CreateEventPageEnhanced: React.FC = () => {
                   type="email"
                   label={t('events.hostEmail')}
                   placeholder={t('events.hostEmailPlaceholder')}
-                  value={formData.customer_email}
-                  onChange={handleInputChange('customer_email')}
-                  error={errors.customer_email}
+                  value={formData.host_email}
+                  onChange={handleInputChange('host_email')}
+                  error={errors.host_email}
                   leftIcon={<Mail className="w-5 h-5" />}
                 />
               </div>

frontend/src/pages/admin/EventDetailsPage.tsx

@@ -122,7 +122,7 @@ export const EventDetailsPage: React.FC = () => {
     allow_user_uploads: boolean;
     upload_category_id: number | null;
     hero_photo_id: number | null;
-    customer_name: string;
+    host_name: string;
     source_mode: 'managed' | 'reference';
     external_path: string;
     require_password: boolean;
@@ -138,7 +138,7 @@ export const EventDetailsPage: React.FC = () => {
     allow_user_uploads: false,
     upload_category_id: null,
     hero_photo_id: null,
-    customer_name: '',
+    host_name: '',
     source_mode: 'managed',
     external_path: '',
     require_password: true,
@@ -236,6 +236,28 @@ export const EventDetailsPage: React.FC = () => {
     },
   });
 
+  const applyThemeMutation = useMutation({
+    mutationFn: async ({ theme, presetName }: { theme: ThemeConfig; presetName: string }) => {
+      if (!id) {
+        throw new Error('Missing event identifier');
+      }
+
+      const colorThemeValue = presetName && presetName !== 'custom'
+        ? presetName
+        : JSON.stringify(theme);
+
+      return eventsService.updateEvent(parseInt(id), { color_theme: colorThemeValue });
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['admin-event', id] });
+      toast.success(t('branding.themeApplied', 'Theme updated'));
+    },
+    onError: (error: any) => {
+      const message = error?.response?.data?.error || t('branding.themeApplyError', 'Failed to apply theme');
+      toast.error(message);
+    }
+  });
+
   // Archive mutation
   const archiveMutation = useMutation({
     mutationFn: () => eventsService.archiveEvent(parseInt(id!)),
@@ -282,7 +304,7 @@ export const EventDetailsPage: React.FC = () => {
       allow_user_uploads: event.allow_user_uploads || false,
       upload_category_id: event.upload_category_id || null,
       hero_photo_id: event.hero_photo_id || null,
-      customer_name: event.customer_name || '',
+      host_name: event.host_name || '',
       source_mode: event.source_mode === 'reference' ? 'reference' : 'managed',
       external_path: event.external_path || '',
       require_password: normalizeRequirePassword(event.require_password),
@@ -389,8 +411,8 @@ export const EventDetailsPage: React.FC = () => {
     updateData.external_path = editForm.source_mode === 'reference'
       ? externalPathToSave
       : null;
-    if (editForm.customer_name !== undefined && editForm.customer_name !== null) {
-      updateData.customer_name = editForm.customer_name;
+    if (editForm.host_name !== undefined && editForm.host_name !== null) {
+      updateData.host_name = editForm.host_name;
     }
 
     if (editForm.new_password) {
@@ -665,8 +687,8 @@ export const EventDetailsPage: React.FC = () => {
                   </label>
                   <Input
                     type="text"
-                    value={editForm.customer_name}
-                    onChange={(e) => setEditForm(prev => ({ ...prev, customer_name: e.target.value }))}
+                    value={editForm.host_name}
+                    onChange={(e) => setEditForm(prev => ({ ...prev, host_name: e.target.value }))}
                     placeholder={t('events.hostNamePlaceholder')}
                   />
                 </div>
@@ -881,14 +903,14 @@ export const EventDetailsPage: React.FC = () => {
                 <div>
                   <dt className="text-sm font-medium text-neutral-500">{t('events.hostName')}</dt>
                   <dd className="mt-1 text-sm text-neutral-900">
-                    {event.customer_name || <span className="text-neutral-400">{t('common.notSet')}</span>}
+                    {event.host_name || <span className="text-neutral-400">{t('common.notSet')}</span>}
                   </dd>
                 </div>
                 
                 <div className="grid grid-cols-2 gap-4">
                   <div>
                     <dt className="text-sm font-medium text-neutral-500">{t('events.hostEmail')}</dt>
-                  <dd className="mt-1 text-sm text-neutral-900">{event.customer_email}</dd>
+                    <dd className="mt-1 text-sm text-neutral-900">{event.host_email}</dd>
                   </div>
                   
                   <div>
@@ -1124,6 +1146,20 @@ export const EventDetailsPage: React.FC = () => {
                 }}
                 isPreviewMode={false}
                 showGalleryLayouts={true}
+                onApply={async (theme, { presetName }) => {
+                  const resolvedPreset = presetName || 'custom';
+                  setCurrentTheme(theme);
+                  setCurrentPresetName(resolvedPreset);
+
+                  const themeValue = resolvedPreset !== 'custom'
+                    ? resolvedPreset
+                    : JSON.stringify(theme);
+
+                  setEditForm(prev => ({ ...prev, color_theme: themeValue }));
+
+                  await applyThemeMutation.mutateAsync({ theme, presetName: resolvedPreset });
+                }}
+                isApplying={applyThemeMutation.isPending}
               />
             </Card>
           )}

frontend/src/pages/admin/EventsListPage.tsx

@@ -159,7 +159,7 @@ export const EventsListPage: React.FC = () => {
       events = events.filter(e => 
         e.event_name.toLowerCase().includes(term) ||
         e.event_type.toLowerCase().includes(term) ||
-        (e.customer_email || '').toLowerCase().includes(term)
+        e.host_email.toLowerCase().includes(term)
       );
     }
     
@@ -428,7 +428,7 @@ export const EventsListPage: React.FC = () => {
                       <td className="px-6 py-4">
                         <div>
                           <p className="text-sm font-medium text-neutral-900">{event.event_name}</p>
-                          <p className="text-xs text-neutral-500">{event.customer_email}</p>
+                          <p className="text-xs text-neutral-500">{event.host_email}</p>
                           <div className="mt-1">
                             <span
                               className={`inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium ${

frontend/src/pages/admin/SettingsPage.tsx

@@ -1,6 +1,6 @@
-import React, { useState } from 'react';
-import {
-  Save,
+import React, { useEffect, useState } from 'react';
+import { 
+  Save, 
   Database,
   Globe,
   Key,
@@ -10,9 +10,7 @@ import {
   CheckCircle,
   Clock,
   HardDrive,
-  Activity,
-  Mail,
-  User
+  Activity
 } from 'lucide-react';
 import { toast } from 'react-toastify';
 
@@ -21,12 +19,11 @@ import { CategoryManager } from '../../components/admin/CategoryManager';
 import { WordFilterManager } from '../../components/admin/WordFilterManager';
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
 import { settingsService } from '../../services/settings.service';
-import { adminService } from '../../services/admin.service';
+import { authService } from '../../services/auth.service';
 import { useTranslation } from 'react-i18next';
 import { useAdminAuth } from '../../contexts';
 
 const BYTES_PER_GB = 1024 * 1024 * 1024;
-const MAX_FILES_PER_UPLOAD_LIMIT = 2000;
 
 const toBoolean = (value: unknown, defaultValue = false): boolean => {
   if (value === undefined || value === null) {
@@ -61,7 +58,23 @@ export const SettingsPage: React.FC = () => {
   const [activeTab, setActiveTab] = useState<'general' | 'status' | 'security' | 'categories' | 'analytics' | 'moderation'>('general');
   const queryClient = useQueryClient();
   const { t, i18n } = useTranslation();
-  const { updateUserProfile } = useAdminAuth();
+  const { user, updateProfile: updateAuthProfile } = useAdminAuth();
+
+  const [profileForm, setProfileForm] = useState({
+    username: user?.username ?? '',
+    email: user?.email ?? '',
+  });
+  const [profileError, setProfileError] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (user) {
+      setProfileForm({ username: user.username, email: user.email });
+    }
+  }, [user]);
+
+  const isProfileDirty = user
+    ? (profileForm.username !== user.username || profileForm.email !== user.email)
+    : Boolean(profileForm.username.trim() || profileForm.email.trim());
 
   // Fetch settings
   const { data: settings, isLoading } = useQuery({
@@ -69,11 +82,6 @@ export const SettingsPage: React.FC = () => {
     queryFn: () => settingsService.getAllSettings(),
   });
 
-  const { data: adminProfile, isLoading: adminProfileLoading } = useQuery({
-    queryKey: ['admin-profile'],
-    queryFn: () => adminService.getAdminProfile(),
-  });
-
   // Fetch storage info
   const { data: storageInfo } = useQuery({
     queryKey: ['admin-storage-info'],
@@ -89,18 +97,30 @@ export const SettingsPage: React.FC = () => {
     refetchInterval: 30000 // Refresh every 30 seconds
   });
 
+  const updateProfileMutation = useMutation({
+    mutationFn: authService.updateAdminProfile,
+    onSuccess: (updatedUser) => {
+      updateAuthProfile(updatedUser);
+      setProfileError(null);
+      toast.success(t('admin.notificationToasts.profileUpdated'));
+    },
+    onError: (error: any) => {
+      const message = error?.response?.data?.error || t('admin.profileUpdateError');
+      setProfileError(message);
+      toast.error(message);
+    },
+  });
+
   // General settings state
   const [generalSettings, setGeneralSettings] = useState({
     site_url: '',
     default_expiration_days: 30,
     max_file_size_mb: 50,
-    max_files_per_upload: 500,
     allowed_file_types: 'jpg,jpeg,png,gif,webp',
     enable_watermark: false,
     enable_analytics: true,
     enable_registration: false,
     maintenance_mode: false,
-    short_gallery_urls: false,
     default_language: 'en',
     date_format: { format: 'dd/MM/yyyy', locale: 'en-GB' }
   });
@@ -112,8 +132,6 @@ export const SettingsPage: React.FC = () => {
     enable_2fa: false,
     session_timeout_minutes: 60,
     max_login_attempts: 5,
-    attempt_window_minutes: 15,
-    lockout_duration_minutes: 30,
     enable_recaptcha: false,
     recaptcha_site_key: '',
     recaptcha_secret_key: ''
@@ -132,11 +150,6 @@ export const SettingsPage: React.FC = () => {
   const [capacityOverrideGb, setCapacityOverrideGb] = useState<number | ''>('');
   const [availableOverrideGb, setAvailableOverrideGb] = useState<number | ''>('');
   const [overrideDirty, setOverrideDirty] = useState(false);
-  const [accountForm, setAccountForm] = useState({
-    username: '',
-    email: ''
-  });
-  const [accountErrors, setAccountErrors] = useState<Record<string, string>>({});
 
   React.useEffect(() => {
     if (settings) {
@@ -150,16 +163,11 @@ export const SettingsPage: React.FC = () => {
         site_url: settings.general_site_url || '',
         default_expiration_days: toNumber(settings.general_default_expiration_days, 30),
         max_file_size_mb: toNumber(settings.general_max_file_size_mb, 50),
-        max_files_per_upload: Math.min(
-          MAX_FILES_PER_UPLOAD_LIMIT,
-          Math.max(1, toNumber(settings.general_max_files_per_upload, 500))
-        ),
         allowed_file_types: settings.general_allowed_file_types || 'jpg,jpeg,png,gif,webp',
         enable_watermark: toBoolean(settings.general_enable_watermark, false),
         enable_analytics: toBoolean(settings.general_enable_analytics, true),
         enable_registration: toBoolean(settings.general_enable_registration, false),
         maintenance_mode: toBoolean(settings.general_maintenance_mode, false),
-        short_gallery_urls: toBoolean(settings.general_short_gallery_urls, false),
         default_language: settings.general_default_language || 'en',
         date_format: settings.general_date_format 
           ? (typeof settings.general_date_format === 'string'
@@ -175,8 +183,6 @@ export const SettingsPage: React.FC = () => {
         enable_2fa: toBoolean(settings.security_enable_2fa, false),
         session_timeout_minutes: toNumber(settings.security_session_timeout_minutes, 60),
         max_login_attempts: toNumber(settings.security_max_login_attempts, 5),
-        attempt_window_minutes: toNumber(settings.security_attempt_window_minutes, 15),
-        lockout_duration_minutes: toNumber(settings.security_lockout_duration_minutes, 30),
         enable_recaptcha: toBoolean(settings.security_enable_recaptcha, false),
         recaptcha_site_key: settings.security_recaptcha_site_key ?? '',
         recaptcha_secret_key: settings.security_recaptcha_secret_key ?? ''
@@ -192,15 +198,6 @@ export const SettingsPage: React.FC = () => {
     }
   }, [settings, i18n]);
 
-  React.useEffect(() => {
-    if (adminProfile) {
-      setAccountForm({
-        username: adminProfile.username || '',
-        email: adminProfile.email || ''
-      });
-    }
-  }, [adminProfile]);
-
   React.useEffect(() => {
     if (!settings || overrideDirty) {
       return;
@@ -321,83 +318,6 @@ export const SettingsPage: React.FC = () => {
     }
   });
 
-  const updateAdminProfileMutation = useMutation({
-    mutationFn: (payload: { username: string; email: string }) => adminService.updateAdminProfile(payload),
-    onSuccess: (updatedUser) => {
-      toast.success(t('settings.general.accountSaveSuccess'));
-      setAccountErrors({});
-      setAccountForm({
-        username: updatedUser.username,
-        email: updatedUser.email
-      });
-      updateUserProfile(updatedUser);
-      queryClient.invalidateQueries({ queryKey: ['admin-profile'] });
-    },
-    onError: (error: any) => {
-      if (error.response?.data?.errors) {
-        const fieldErrors: Record<string, string> = {};
-        for (const err of error.response.data.errors) {
-          if (err.path === 'username') {
-            fieldErrors.username = err.msg;
-          }
-          if (err.path === 'email') {
-            fieldErrors.email = err.msg;
-          }
-        }
-        setAccountErrors(fieldErrors);
-        return;
-      }
-
-      if (error.response?.data?.error) {
-        toast.error(error.response.data.error);
-      } else {
-        toast.error(t('toast.saveError'));
-      }
-    }
-  });
-
-  const handleAccountChange = (field: 'username' | 'email') => (event: React.ChangeEvent<HTMLInputElement>) => {
-    const value = event.target.value;
-    setAccountForm((prev) => ({ ...prev, [field]: value }));
-    if (accountErrors[field]) {
-      setAccountErrors((prev) => ({ ...prev, [field]: '' }));
-    }
-  };
-
-  const handleAccountSubmit = (event: React.FormEvent<HTMLFormElement>) => {
-    event.preventDefault();
-
-    if (updateAdminProfileMutation.isPending) {
-      return;
-    }
-
-    const trimmedUsername = accountForm.username.trim();
-    const trimmedEmail = accountForm.email.trim();
-    const errors: Record<string, string> = {};
-
-    if (!trimmedUsername) {
-      errors.username = t('settings.general.accountUsernameRequired');
-    } else if (trimmedUsername.length < 3) {
-      errors.username = t('settings.general.accountUsernameLength');
-    }
-
-    if (!trimmedEmail) {
-      errors.email = t('settings.general.accountEmailRequired');
-    } else if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(trimmedEmail)) {
-      errors.email = t('settings.general.accountEmailInvalid');
-    }
-
-    if (Object.keys(errors).length > 0) {
-      setAccountErrors(errors);
-      return;
-    }
-
-    updateAdminProfileMutation.mutate({
-      username: trimmedUsername,
-      email: trimmedEmail
-    });
-  };
-
   const saveSoftLimitMutation = useMutation({
     mutationFn: async (limitBytes: number | null) => {
       return settingsService.updateSettings({
@@ -456,6 +376,19 @@ export const SettingsPage: React.FC = () => {
     }
   });
 
+  const handleProfileSubmit = (event: React.FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    if (!isProfileDirty || updateProfileMutation.isPending) {
+      return;
+    }
+
+    setProfileError(null);
+    updateProfileMutation.mutate({
+      username: profileForm.username.trim(),
+      email: profileForm.email.trim(),
+    });
+  };
+
   const handleSaveCapacityOverride = () => {
     if (saveCapacityOverrideMutation.isPending) {
       return;
@@ -580,61 +513,43 @@ export const SettingsPage: React.FC = () => {
       {activeTab === 'general' && (
         <div className="space-y-6">
           <Card padding="md">
-            <h2 className="text-lg font-semibold text-neutral-900 mb-4">{t('settings.general.accountSection')}</h2>
-            {adminProfileLoading ? (
-              <div className="py-8 flex justify-center">
-                <Loading size="md" />
+            <h2 className="text-lg font-semibold text-neutral-900 mb-2">{t('admin.accountSettings.title')}</h2>
+            <p className="text-sm text-neutral-500 mb-4">{t('admin.accountSettings.description')}</p>
+            <form className="space-y-4" onSubmit={handleProfileSubmit}>
+              <div>
+                <label className="block text-sm font-medium text-neutral-700 mb-1">
+                  {t('admin.accountSettings.username')}
+                </label>
+                <Input
+                  value={profileForm.username}
+                  onChange={(e) => setProfileForm(prev => ({ ...prev, username: e.target.value }))}
+                  placeholder={t('admin.accountSettings.usernamePlaceholder')}
+                  maxLength={120}
+                />
               </div>
-            ) : (
-              <form className="space-y-4" onSubmit={handleAccountSubmit}>
-                <div>
-                  <label htmlFor="admin-account-username" className="block text-sm font-medium text-neutral-700 mb-1">
-                    {t('settings.general.accountUsername')}
-                  </label>
-                  <Input
-                    id="admin-account-username"
-                    type="text"
-                    value={accountForm.username}
-                    onChange={handleAccountChange('username')}
-                    placeholder="admin"
-                    leftIcon={<User className="w-5 h-5 text-neutral-400" />}
-                    error={accountErrors.username}
-                  />
-                  <p className="text-xs text-neutral-500 mt-1">
-                    {t('settings.general.accountUsernameHelp')}
-                  </p>
-                </div>
-
-                <div>
-                  <label htmlFor="admin-account-email" className="block text-sm font-medium text-neutral-700 mb-1">
-                    {t('settings.general.accountEmail')}
-                  </label>
-                  <Input
-                    id="admin-account-email"
-                    type="email"
-                    value={accountForm.email}
-                    onChange={handleAccountChange('email')}
-                    placeholder="admin@example.com"
-                    leftIcon={<Mail className="w-5 h-5 text-neutral-400" />}
-                    error={accountErrors.email}
-                  />
-                  <p className="text-xs text-neutral-500 mt-1">
-                    {t('settings.general.accountEmailHelp')}
-                  </p>
-                </div>
-
-                <div className="pt-2">
-                  <Button
-                    type="submit"
-                    variant="primary"
-                    leftIcon={<Save className="w-5 h-5" />}
-                    isLoading={updateAdminProfileMutation.isPending}
-                  >
-                    {t('settings.general.accountSaveButton')}
-                  </Button>
-                </div>
-              </form>
-            )}
+              <div>
+                <label className="block text-sm font-medium text-neutral-700 mb-1">
+                  {t('admin.accountSettings.email')}
+                </label>
+                <Input
+                  type="email"
+                  value={profileForm.email}
+                  onChange={(e) => setProfileForm(prev => ({ ...prev, email: e.target.value }))}
+                  placeholder={t('admin.accountSettings.emailPlaceholder')}
+                />
+              </div>
+              {profileError && (
+                <p className="text-sm text-red-600">{profileError}</p>
+              )}
+              <div className="flex justify-end">
+                <Button
+                  type="submit"
+                  disabled={!isProfileDirty || updateProfileMutation.isPending}
+                >
+                  {updateProfileMutation.isPending ? t('common.saving') : t('admin.accountSettings.updateButton')}
+                </Button>
+              </div>
+            </form>
           </Card>
 
           <Card padding="md">
@@ -657,7 +572,7 @@ export const SettingsPage: React.FC = () => {
                 </p>
               </div>
 
-              <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">
+              <div className="grid grid-cols-2 gap-4">
                 <div>
                   <label className="block text-sm font-medium text-neutral-700 mb-1">
                     {t('settings.general.defaultExpiration')}
@@ -682,29 +597,6 @@ export const SettingsPage: React.FC = () => {
                     max="500"
                   />
                 </div>
-                <div>
-                  <label className="block text-sm font-medium text-neutral-700 mb-1">
-                    {t('settings.general.maxFilesPerUpload')}
-                  </label>
-                  <Input
-                    type="number"
-                    value={generalSettings.max_files_per_upload}
-                    onChange={(e) => {
-                      const parsed = parseInt(e.target.value, 10);
-                      setGeneralSettings(prev => ({
-                        ...prev,
-                        max_files_per_upload: Number.isFinite(parsed)
-                          ? Math.min(MAX_FILES_PER_UPLOAD_LIMIT, Math.max(1, parsed))
-                          : prev.max_files_per_upload
-                      }));
-                    }}
-                    min="1"
-                    max={MAX_FILES_PER_UPLOAD_LIMIT}
-                  />
-                  <p className="text-xs text-neutral-500 mt-1">
-                    {t('settings.general.maxFilesPerUploadHelp', { max: MAX_FILES_PER_UPLOAD_LIMIT })}
-                  </p>
-                </div>
               </div>
 
               <div>
@@ -767,21 +659,6 @@ export const SettingsPage: React.FC = () => {
                 />
                 <span className="ml-2 text-sm text-neutral-700">{t('settings.general.maintenanceMode')}</span>
               </label>
-
-              <div>
-                <label className="flex items-center">
-                  <input
-                    type="checkbox"
-                    checked={generalSettings.short_gallery_urls}
-                    onChange={(e) => setGeneralSettings(prev => ({ ...prev, short_gallery_urls: e.target.checked }))}
-                    className="w-4 h-4 text-primary-600 rounded focus:ring-primary-500"
-                  />
-                  <span className="ml-2 text-sm text-neutral-700">{t('settings.general.enableShortGalleryUrls')}</span>
-                </label>
-                <p className="text-xs text-neutral-500 ml-6 mt-1">
-                  {t('settings.general.enableShortGalleryUrlsHelp')}
-                </p>
-              </div>
             </div>
           </Card>
 
@@ -1350,7 +1227,7 @@ export const SettingsPage: React.FC = () => {
             <h2 className="text-lg font-semibold text-neutral-900 mb-4">{t('settings.security.sessionAuth')}</h2>
             
             <div className="space-y-4">
-              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+              <div className="grid grid-cols-2 gap-4">
                 <div>
                   <label className="block text-sm font-medium text-neutral-700 mb-1">
                     {t('settings.security.sessionTimeout')}
@@ -1358,41 +1235,11 @@ export const SettingsPage: React.FC = () => {
                   <Input
                     type="number"
                     value={securitySettings.session_timeout_minutes}
-                    onChange={(e) => setSecuritySettings(prev => ({ ...prev, session_timeout_minutes: parseInt(e.target.value, 10) || 60 }))}
+                    onChange={(e) => setSecuritySettings(prev => ({ ...prev, session_timeout_minutes: parseInt(e.target.value) || 60 }))}
                     min="5"
                     max="1440"
                   />
                 </div>
-                <div>
-                  <label className="block text-sm font-medium text-neutral-700 mb-1">
-                    {t('settings.security.attemptWindowMinutes')}
-                  </label>
-                  <Input
-                    type="number"
-                    value={securitySettings.attempt_window_minutes}
-                    onChange={(e) => setSecuritySettings(prev => ({ ...prev, attempt_window_minutes: parseInt(e.target.value, 10) || 15 }))}
-                    min="1"
-                    max="1440"
-                  />
-                  <p className="mt-1 text-sm text-neutral-600">
-                    {t('settings.security.attemptWindowMinutesHelp')}
-                  </p>
-                </div>
-                <div>
-                  <label className="block text-sm font-medium text-neutral-700 mb-1">
-                    {t('settings.security.lockoutDurationMinutes')}
-                  </label>
-                  <Input
-                    type="number"
-                    value={securitySettings.lockout_duration_minutes}
-                    onChange={(e) => setSecuritySettings(prev => ({ ...prev, lockout_duration_minutes: parseInt(e.target.value, 10) || 30 }))}
-                    min="1"
-                    max="1440"
-                  />
-                  <p className="mt-1 text-sm text-neutral-600">
-                    {t('settings.security.lockoutDurationMinutesHelp')}
-                  </p>
-                </div>
                 <div>
                   <label className="block text-sm font-medium text-neutral-700 mb-1">
                     {t('settings.security.maxLoginAttempts')}
@@ -1400,13 +1247,10 @@ export const SettingsPage: React.FC = () => {
                   <Input
                     type="number"
                     value={securitySettings.max_login_attempts}
-                    onChange={(e) => setSecuritySettings(prev => ({ ...prev, max_login_attempts: parseInt(e.target.value, 10) || 5 }))}
-                    min="1"
-                    max="50"
+                    onChange={(e) => setSecuritySettings(prev => ({ ...prev, max_login_attempts: parseInt(e.target.value) || 5 }))}
+                    min="3"
+                    max="10"
                   />
-                  <p className="mt-1 text-sm text-neutral-600">
-                    {t('settings.security.maxLoginAttemptsHelp')}
-                  </p>
                 </div>
               </div>
 

frontend/src/services/admin.service.ts

@@ -47,17 +47,6 @@ export interface Activity {
   createdAt: string;
 }
 
-export interface AdminProfile {
-  id: number;
-  username: string;
-  email: string;
-  mustChangePassword?: boolean;
-  last_login?: string | null;
-  last_login_ip?: string | null;
-  created_at?: string;
-  updated_at?: string;
-}
-
 export interface AnalyticsData {
   chartData: Array<{
     date: string;
@@ -141,15 +130,5 @@ export const adminService = {
   // Change password
   async changePassword(data: { currentPassword: string; newPassword: string }): Promise<void> {
     await api.post('/admin/auth/change-password', data);
-  },
-
-  async getAdminProfile(): Promise<AdminProfile> {
-    const response = await api.get<AdminProfile>('/admin/auth/profile');
-    return response.data;
-  },
-
-  async updateAdminProfile(data: { username: string; email: string }): Promise<AdminProfile> {
-    const response = await api.put<{ user: AdminProfile }>('/admin/auth/profile', data);
-    return response.data.user;
   }
 };

frontend/src/services/auth.service.ts

@@ -1,5 +1,5 @@
 import { api } from '../config/api';
-import type { LoginResponse, GalleryAuthResponse } from '../types';
+import type { LoginResponse, GalleryAuthResponse, AdminUser } from '../types';
 import { normalizeRequirePassword } from '../utils/accessControl';
 
 const normalizeGalleryResponse = (response: GalleryAuthResponse): GalleryAuthResponse => ({
@@ -61,4 +61,9 @@ export const authService = {
       // Ignore; cookie will naturally expire if removal fails
     }
   },
+
+  async updateAdminProfile(profile: { username: string; email: string }): Promise<AdminUser> {
+    const response = await api.put<{ user: AdminUser }>('/auth/admin/profile', profile);
+    return response.data.user;
+  },
 };

frontend/src/services/events.service.ts

@@ -2,27 +2,16 @@ import { api } from '../config/api';
 import type { Event } from '../types';
 import { normalizeRequirePassword } from '../utils/accessControl';
 
-const normalizeEvent = (event: Event): Event => {
-  const legacyHostName = (event as any)?.host_name;
-  const legacyHostEmail = (event as any)?.host_email;
-
-  const customerName = event.customer_name ?? legacyHostName ?? undefined;
-  const customerEmail = event.customer_email ?? legacyHostEmail ?? '';
-
-  return {
-    ...event,
-    customer_name: customerName,
-    customer_email: customerEmail,
-    require_password: normalizeRequirePassword((event as any)?.require_password, true),
-  };
-};
+const normalizeEvent = (event: Event): Event => ({
+  ...event,
+  require_password: normalizeRequirePassword((event as any)?.require_password, true),
+});
 
 interface CreateEventData {
   event_type: string;
   event_name: string;
   event_date: string;
-  customer_name?: string;
-  customer_email: string;
+  host_email: string;
   admin_email: string;
   require_password?: boolean;
   password?: string;
@@ -44,8 +33,7 @@ interface CreateEventData {
 interface UpdateEventData {
   event_name?: string;
   event_date?: string;
-  customer_name?: string;
-  customer_email?: string;
+  host_email?: string;
   admin_email?: string;
   require_password?: boolean;
   password?: string;

frontend/src/services/gallery.service.ts

@@ -1,5 +1,5 @@
 import { api } from '../config/api';
-import type { GalleryInfo, GalleryData, GalleryStats, ResolvedGalleryIdentifier } from '../types';
+import type { GalleryInfo, GalleryData, GalleryStats } from '../types';
 import { normalizeRequirePassword } from '../utils/accessControl';
 
 export const galleryService = {
@@ -119,9 +119,4 @@ export const galleryService = {
     const response = await api.get<GalleryStats>(`/gallery/${slug}/stats`);
     return response.data;
   },
-
-  async resolveIdentifier(identifier: string): Promise<ResolvedGalleryIdentifier> {
-    const response = await api.get<ResolvedGalleryIdentifier>(`/gallery/resolve/${identifier}`);
-    return response.data;
-  },
 };

frontend/src/services/notifications.service.ts

@@ -38,9 +38,9 @@ export const notificationsService = {
     await api.put('/admin/notifications/read-all');
   },
 
-  // Clear old notifications
-  async clearOldNotifications(): Promise<{ deletedCount: number }> {
-    const response = await api.delete('/admin/notifications/clear-old');
+  // Clear all notifications
+  async clearAllNotifications(): Promise<{ deletedCount: number }> {
+    const response = await api.delete('/admin/notifications/clear-all');
     return response.data;
   },
 
@@ -133,6 +133,10 @@ export const notificationsService = {
         return t('admin.notificationMessages.generalSettingsUpdated');
       case 'security_settings_updated':
         return t('admin.notificationMessages.securitySettingsUpdated');
+      case 'admin_profile_updated':
+        return t('admin.notificationMessages.adminProfileUpdated', {
+          actorName: notification.actorName,
+        });
       case 'theme_updated':
         return t('admin.notificationMessages.themeUpdated');
       case 'archive_downloaded':
@@ -184,6 +188,8 @@ export const notificationsService = {
       case 'security_settings_updated':
       case 'theme_updated':
         return { icon: 'Settings', color: 'text-gray-600' };
+      case 'admin_profile_updated':
+        return { icon: 'User', color: 'text-primary-600' };
       case 'email_template_updated':
       case 'email_config_updated':
         return { icon: 'Mail', color: 'text-teal-600' };
@@ -209,4 +215,4 @@ export const notificationsService = {
         return { icon: 'Bell', color: 'text-gray-600' };
     }
   }
-};
+};

frontend/src/types/index.ts

@@ -5,8 +5,8 @@ export interface Event {
   event_type: string;
   event_name: string;
   event_date: string;
-  customer_name?: string;
-  customer_email: string;
+  host_name?: string;
+  host_email: string;
   admin_email: string;
   welcome_message?: string;
   color_theme?: string;
@@ -111,17 +111,6 @@ export interface GalleryStats {
   unique_visitors: number;
 }
 
-export interface ResolvedGalleryIdentifier {
-  slug: string;
-  token: string;
-  matchType: string;
-  share_link: string;
-  share_path: string;
-  share_url: string;
-  short_enabled: boolean;
-  requires_password: boolean;
-}
-
 // Auth types
 export interface AdminUser {
   id: number;

frontend/src/utils/__tests__/url.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it, beforeEach, afterEach, vi } from 'vitest';
+import { getApiBaseUrl, buildResourceUrl } from '../url';
+const originalLocation = window.location;
+
+const setLocation = (origin: string) => {
+  const parsed = new URL(origin);
+  Object.defineProperty(window, 'location', {
+    value: {
+      origin: parsed.origin,
+      hostname: parsed.hostname,
+      href: parsed.href,
+    },
+    configurable: true,
+  });
+};
+
+describe('url utilities', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+    vi.unstubAllEnvs();
+    setLocation('https://example.com');
+  });
+
+  afterEach(() => {
+    Object.defineProperty(window, 'location', {
+      value: originalLocation,
+      configurable: true,
+    });
+  });
+
+  it('returns relative API base by default', () => {
+    vi.unstubAllEnvs();
+    expect(getApiBaseUrl()).toBe('/api');
+    expect(buildResourceUrl('/api/gallery/test')).toBe('https://example.com/api/gallery/test');
+  });
+
+  it('honours absolute API URLs for non-local hosts', () => {
+    vi.stubEnv('VITE_API_URL', 'https://api.picpeak.cloud/api');
+    expect(getApiBaseUrl()).toBe('https://api.picpeak.cloud/api');
+    expect(buildResourceUrl('/api/gallery/test')).toBe('https://api.picpeak.cloud/api/gallery/test');
+    expect(buildResourceUrl('/uploads/logo.png')).toBe('https://api.picpeak.cloud/uploads/logo.png');
+  });
+
+  it('falls back to relative when build-time URL is localhost but browser host is remote', () => {
+    vi.stubEnv('VITE_API_URL', 'http://localhost:3001/api');
+    setLocation('https://photos.example.com');
+    expect(getApiBaseUrl()).toBe('/api');
+    expect(buildResourceUrl('/api/gallery/test')).toBe('https://photos.example.com/api/gallery/test');
+    expect(buildResourceUrl('uploads/logo.png')).toBe('https://photos.example.com/uploads/logo.png');
+  });
+
+  it('keeps localhost API URL when browser is also localhost', () => {
+    vi.stubEnv('VITE_API_URL', 'http://127.0.0.1:3001/api');
+    setLocation('http://127.0.0.1:3000');
+    expect(getApiBaseUrl()).toBe('http://127.0.0.1:3001/api');
+    expect(buildResourceUrl('/api/gallery/test')).toBe('http://127.0.0.1:3001/api/gallery/test');
+  });
+});

frontend/src/utils/url.ts

@@ -2,39 +2,126 @@
  * Utility functions for URL handling in production environments
  */
 
+const ABSOLUTE_URL_REGEX = /^https?:\/\//i;
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]']);
+
+const isBrowser = typeof window !== 'undefined' && typeof window.location !== 'undefined';
+
+const normalizeBase = (value: string): string => value.replace(/\/+$/, '');
+
+const getEnvApiUrl = (): string | undefined => {
+  const raw = import.meta.env?.VITE_API_URL;
+  if (!raw || raw === '') {
+    return undefined;
+  }
+  if (raw === '/') {
+    return '/api';
+  }
+  return raw;
+};
+
+const isLocalHostname = (hostname: string): boolean => LOCAL_HOSTNAMES.has(hostname.toLowerCase());
+
+const shouldFallbackToRelative = (url: string): boolean => {
+  if (!ABSOLUTE_URL_REGEX.test(url)) {
+    return false;
+  }
+
+  if (!isBrowser) {
+    return false;
+  }
+
+  try {
+    const parsed = new URL(url);
+    const envHostIsLocal = isLocalHostname(parsed.hostname);
+    const browserHost = window.location.hostname?.toLowerCase?.() ?? '';
+    const browserHostIsLocal = isLocalHostname(browserHost);
+
+    // Only fallback when the build-time URL points to localhost/loopback
+    // but the runtime browser location is remote (non-local).
+    return envHostIsLocal && !browserHostIsLocal;
+  } catch {
+    return false;
+  }
+};
+
+const buildFromOrigin = (path: string): string => {
+  if (!isBrowser) {
+    return path;
+  }
+  const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+  return `${window.location.origin}${normalizedPath}`;
+};
+
 /**
- * Get the base API URL, preferring relative URLs for production
+ * Get the base API URL, preferring relative URLs for production and
+ * falling back to relative when the build was created with localhost
+ * endpoints but is being accessed from a remote browser.
  * @returns The API base URL
  */
 export const getApiBaseUrl = (): string => {
-  // If VITE_API_URL is explicitly set, use it
-  if (import.meta.env.VITE_API_URL && import.meta.env.VITE_API_URL !== '/api') {
-    return import.meta.env.VITE_API_URL;
+  const envUrl = getEnvApiUrl();
+
+  if (envUrl && envUrl !== '/api') {
+    if (ABSOLUTE_URL_REGEX.test(envUrl) && shouldFallbackToRelative(envUrl)) {
+      return '/api';
+    }
+    return envUrl;
   }
-  
-  // In production, use relative URL
+
   return '/api';
 };
 
+const buildFromAbsoluteApi = (base: string, path: string): string => {
+  const trimmedBase = normalizeBase(base);
+
+  // When the path already targets /api we want to preserve the suffix
+  if (path.startsWith('/api')) {
+    const pathWithoutLeadingApi = path.replace(/^\/api/, '');
+    return `${trimmedBase}${pathWithoutLeadingApi}`;
+  }
+
+  // For non-API assets (uploads, thumbnails, etc.) drop any /api suffix
+  const origin = trimmedBase.replace(/\/api$/, '');
+  const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+  return `${origin}${normalizedPath}`;
+};
+
 /**
  * Build a full URL for resources (images, files, etc.)
- * In production, this will use the current origin
+ * In production, this will prefer the current origin unless an absolute
+ * API URL is explicitly configured and applicable.
  * @param path - The resource path
  * @returns The full URL
  */
 export const buildResourceUrl = (path: string): string => {
-  // Remove leading slash if present
-  const cleanPath = path.startsWith('/') ? path.slice(1) : path;
-  
-  // If we have an explicit API URL that's not relative, use it
-  const apiUrl = import.meta.env.VITE_API_URL;
-  if (apiUrl && apiUrl !== '/api' && apiUrl.startsWith('http')) {
-    const baseUrl = apiUrl.replace(/\/api\/?$/, ''); // Remove /api suffix if present
-    return `${baseUrl}/${cleanPath}`;
+  if (!path) {
+    return '';
   }
-  
-  // In production (relative API), use current origin
-  return `${window.location.origin}/${cleanPath}`;
+
+  // Absolute paths (http/https) should generally be respected,
+  // except when they point to localhost but we're running remotely.
+  if (ABSOLUTE_URL_REGEX.test(path)) {
+    if (!shouldFallbackToRelative(path)) {
+      return path;
+    }
+
+    try {
+      const parsed = new URL(path);
+      return buildFromOrigin(`${parsed.pathname}${parsed.search}${parsed.hash}`);
+    } catch {
+      return path;
+    }
+  }
+
+  const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+  const apiBase = getApiBaseUrl();
+
+  if (ABSOLUTE_URL_REGEX.test(apiBase)) {
+    return buildFromAbsoluteApi(apiBase, normalizedPath);
+  }
+
+  return buildFromOrigin(normalizedPath);
 };
 
 /**
@@ -42,5 +129,6 @@ export const buildResourceUrl = (path: string): string => {
  * @returns True if in production mode
  */
 export const isProductionMode = (): boolean => {
-  return !import.meta.env.VITE_API_URL || import.meta.env.VITE_API_URL === '/api';
-};
+  const apiBase = getApiBaseUrl();
+  return !ABSOLUTE_URL_REGEX.test(apiBase);
+};

frontend/vite.config.ts

@@ -19,6 +19,11 @@ const config: VitestUserConfig = {
     },
     sourcemap: true,
   },
+  test: {
+    environment: 'jsdom',
+    setupFiles: './vitest.setup.ts',
+    globals: true
+  },
   server: {
     port: 5173,
     host: true,

frontend/vitest.setup.ts

@@ -0,0 +1,7 @@
+import { expect, vi } from 'vitest';
+import * as matchers from '@testing-library/jest-dom/matchers';
+
+expect.extend(matchers);
+
+// Provide Jest-compatible globals for existing tests that rely on jest.fn
+(globalThis as any).jest = vi;

package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "picpeak",
+  "name": "wedding-photo-sharing",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
@@ -558,8 +558,7 @@
       "resolved": "https://registry.npmjs.org/devtools-protocol/-/devtools-protocol-0.0.1475386.tgz",
       "integrity": "sha512-RQ809ykTfJ+dgj9bftdeL2vRVxASAuGU+I9LEx9Ij5TXU5HrgAQVmzi72VA+mkzscE12uzlRv5/tWWv9R9J1SA==",
       "dev": true,
-      "license": "BSD-3-Clause",
-      "peer": true
+      "license": "BSD-3-Clause"
     },
     "node_modules/emoji-regex": {
       "version": "8.0.0",
@@ -1500,9 +1499,9 @@
       }
     },
     "node_modules/tar-fs": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
-      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
+      "integrity": "sha512-090nwYJDmlhwFwEW3QQl+vaNnxsO2yVsd45eTKRBzSzu+hlb1w2K9inVq5b0ngXuLVqQ4ApvsUHHnu/zQNkWAg==",
       "license": "MIT",
       "dependencies": {
         "chownr": "^1.1.1",

package.json

@@ -10,10 +10,5 @@
   "devDependencies": {
     "puppeteer": "^24.17.0",
     "@playwright/test": "^1.48.2"
-  },
-  "overrides": {
-    "prebuild-install": {
-      "tar-fs": "2.1.4"
-    }
   }
 }

playwright.config.ts

@@ -5,7 +5,7 @@ export default defineConfig({
   timeout: 60_000,
   retries: 0,
   use: {
-    baseURL: process.env.PLAYWRIGHT_BASE_URL || 'http://localhost:3000',
+    baseURL: 'http://localhost:3000',
     headless: true,
     viewport: { width: 1280, height: 800 },
     ignoreHTTPSErrors: true,
@@ -15,3 +15,4 @@ export default defineConfig({
     { name: 'mobile-chrome', use: { ...devices['Pixel 5'] } },
   ],
 });
+

scripts/setup.sh

@@ -2,7 +2,7 @@
 
 ################################################################################
 # PicPeak Unified Setup Script
-# Version: 2.1.0
+# Version: 2.0.0
 # Description: Universal installer for PicPeak with Docker and Native options
 # Supports: Ubuntu, Debian, Fedora, RHEL/CentOS, Raspberry Pi OS
 ################################################################################
@@ -11,7 +11,7 @@ set -euo pipefail
 IFS=$'\n\t'
 
 # Script configuration
-readonly SCRIPT_VERSION="2.1.0"
+readonly SCRIPT_VERSION="2.0.0"
 readonly APP_NAME="PicPeak"
 readonly REPO_URL="https://github.com/the-luap/picpeak.git"
 readonly NODE_VERSION="20"
@@ -64,19 +64,17 @@ FORCE_ADMIN_PASSWORD_RESET=false
 # Run a command as the application user, even if sudo is not available
 run_as_user() {
     local cmd="$*"
-    local current_dir_escaped
-    current_dir_escaped=$(printf '%q' "$(pwd)")
     if [[ "$(id -u)" -ne 0 ]]; then
-        # Already non-root; preserve working directory
-        bash -lc "cd $current_dir_escaped && $cmd"
+        # Already non-root; just run
+        bash -lc "$cmd"
         return $?
     fi
     if command_exists sudo; then
-        sudo -H -u "$NATIVE_APP_USER" bash -lc "cd $current_dir_escaped && $cmd"
+        sudo -H -u "$NATIVE_APP_USER" bash -lc "$cmd"
     elif command_exists runuser; then
-        runuser -u "$NATIVE_APP_USER" -- bash -lc "cd $current_dir_escaped && $cmd"
+        runuser -u "$NATIVE_APP_USER" -- bash -lc "$cmd"
     else
-        su -s /bin/bash - "$NATIVE_APP_USER" -c "cd $current_dir_escaped && $cmd"
+        su -s /bin/bash - "$NATIVE_APP_USER" -c "$cmd"
     fi
 }
 
@@ -385,40 +383,27 @@ setup_docker_installation() {
         app_dir="/home/$SUDO_USER/picpeak"
     fi
     
-    log_step "Creating application directory at $app_dir"
-    mkdir -p "$app_dir"/{storage/events/{active,archived},logs,backup,config,data,events}
-    
-    # Clone repository
-    log_step "Downloading PicPeak..."
+    log_step "Preparing application directory at $app_dir"
+    local app_parent_dir
+    app_parent_dir=$(dirname "$app_dir")
+    mkdir -p "$app_parent_dir"
+
     if [[ -d "$app_dir/.git" ]]; then
+        log_step "Existing PicPeak repository detected; pulling latest changes"
         cd "$app_dir"
-        git pull
-    elif [[ -d "$app_dir" ]]; then
-        if [[ -z "$(ls -A "$app_dir" 2>/dev/null)" ]]; then
-            log_warn "Existing directory $app_dir is empty but not a git repository; recreating it..."
-            rm -rf "$app_dir"
-            git clone "$REPO_URL" "$app_dir"
-        else
-            log_warn "Directory $app_dir already exists and is not a git repository."
-            if [[ "$UNATTENDED" == "true" ]]; then
-                local backup_dir="${app_dir}.backup-$(date +%Y%m%d-%H%M%S)"
-                log_warn "Unattended mode: backing up directory to $backup_dir and cloning a fresh copy."
-                mv "$app_dir" "$backup_dir"
-                git clone "$REPO_URL" "$app_dir"
-            else
-                if confirm "Replace existing directory $app_dir with a fresh clone? This will move the current contents to a backup folder." "y"; then
-                    local backup_dir="${app_dir}.backup-$(date +%Y%m%d-%H%M%S)"
-                    mv "$app_dir" "$backup_dir"
-                    log_step "Existing directory moved to $backup_dir"
-                    git clone "$REPO_URL" "$app_dir"
-                else
-                    die "Installation aborted because $app_dir already exists and is not a PicPeak git repository."
-                fi
-            fi
-        fi
+        git pull --rebase --autostash || git pull
     else
+        if [[ -d "$app_dir" && -n "$(find "$app_dir" -mindepth 1 -maxdepth 1 -print -quit 2>/dev/null)" ]]; then
+            die "Target directory $app_dir already exists and is not empty. Remove it or specify --install-dir before retrying."
+        fi
+
+        log_step "Cloning PicPeak..."
+        rm -rf "$app_dir"
         git clone "$REPO_URL" "$app_dir"
     fi
+
+    # Ensure storage layout exists after cloning
+    mkdir -p "$app_dir"/{storage/events/{active,archived},logs,backup,config,data,events}
     
     # Determine host user for container mapping (PUID/PGID)
     local host_uid host_gid
@@ -654,17 +639,14 @@ setup_native_installation() {
         apt)
             apt-get install -y build-essential python3
             ;;
-        dnf)
-            if ! $PACKAGE_MANAGER install -y @development-tools; then
-                log_warn "dnf @development-tools group install failed, retrying with legacy groupinstall syntax..."
+        dnf|yum)
+            if "$PACKAGE_MANAGER" --version 2>/dev/null | grep -Ei 'dnf( |-)5' >/dev/null; then
+                $PACKAGE_MANAGER install -y @development-tools
+            else
                 $PACKAGE_MANAGER groupinstall -y "Development Tools"
             fi
             $PACKAGE_MANAGER install -y python3
             ;;
-        yum)
-            $PACKAGE_MANAGER groupinstall -y "Development Tools"
-            $PACKAGE_MANAGER install -y python3
-            ;;
     esac
     
     # Create system user
@@ -985,17 +967,15 @@ configure_email() {
 }
 
 print_success_message() {
-    local app_dir port manual_reset_hint
+    local app_dir port
     
     if [[ "$INSTALL_METHOD" == "docker" ]]; then
         app_dir="$DOCKER_APP_DIR"
         [[ -n "${SUDO_USER:-}" ]] && app_dir="/home/$SUDO_USER/picpeak"
         port="${CUSTOM_PORT:-$DEFAULT_PORT}"
-        manual_reset_hint="cd $(printf %q "$app_dir") && docker compose exec -T backend node scripts/reset-admin-password.js --force --credentials-file data/ADMIN_CREDENTIALS.txt"
     else
         app_dir="$NATIVE_APP_DIR"
         port="${CUSTOM_PORT:-$DEFAULT_PORT}"
-        manual_reset_hint="cd $(printf %q "${NATIVE_APP_DIR}/app/backend") && sudo -H -u $(printf %q "$NATIVE_APP_USER") node scripts/reset-admin-password.js --force --credentials-file data/ADMIN_CREDENTIALS.txt"
     fi
     
     print_header "🎉 Installation Complete!"
@@ -1040,7 +1020,13 @@ print_success_message() {
         fi
       else
         echo -e "Email:    ${CYAN}$ADMIN_EMAIL${NC}"
-        echo -e "Password: ${YELLOW}(credentials file not found - rerun setup with --force-admin-password-reset or run '${manual_reset_hint}')${NC}"
+        local reset_hint
+        if [[ "$INSTALL_METHOD" == "docker" ]]; then
+          reset_hint="docker compose exec backend node scripts/reset-admin-password.js"
+        else
+          reset_hint="cd $NATIVE_APP_DIR/app/backend && node scripts/reset-admin-password.js"
+        fi
+        echo -e "Password: ${YELLOW}(credentials file not found - rerun setup with --force-admin-password-reset or run $reset_hint)${NC}"
       fi
     echo
     echo -e "${YELLOW}⚠️  IMPORTANT: Change the admin password on first login!${NC}"

tests/e2e/admin-account-settings.spec.ts

@@ -1,47 +0,0 @@
-import { test, expect } from '@playwright/test';
-
-const ADMIN_EMAIL = process.env.ADMIN_EMAIL || 'admin@example.com';
-const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || 'Admin!234';
-
-test('admin can update account email via settings page', async ({ page }, testInfo) => {
-  if (testInfo.project.name === 'mobile-chrome') {
-    test.skip('Account settings UI is validated on desktop viewport');
-  }
-
-  const newEmail = `admin+playwright-${Date.now()}@example.com`;
-
-  await page.goto('/admin/login');
-  await page.getByLabel(/Email|E-Mail/i).fill(ADMIN_EMAIL);
-  await page.getByLabel(/Password|Passwort/i).fill(ADMIN_PASSWORD);
-  await page.getByRole('button', { name: /Sign In|Log in|Anmelden/i }).click();
-  await expect(page.getByRole('heading', { name: /Dashboard|Übersicht/i })).toBeVisible({ timeout: 20000 });
-
-  await page.goto('/admin/settings');
-  const emailInput = page.getByLabel(/Admin (Email|E-Mail)/i);
-  const usernameInput = page.getByLabel(/Admin (Username|Benutzername)/i);
-
-  await expect(emailInput).toBeVisible();
-  const originalEmail = await emailInput.inputValue();
-  const originalUsername = await usernameInput.inputValue();
-
-  const saveButton = page.getByRole('button', { name: /(Save account details|Kontodaten speichern)/i });
-
-  const revertChanges = async () => {
-    await emailInput.fill(originalEmail);
-    await usernameInput.fill(originalUsername);
-    await saveButton.click();
-    await expect(emailInput).toHaveValue(originalEmail, { timeout: 10000 });
-    await expect(page.locator('.Toastify__toast').filter({ hasText: /(Account details updated|Kontodaten aktualisiert)/i })).toBeVisible({ timeout: 10000 });
-  };
-
-  try {
-    await emailInput.fill(newEmail);
-    await saveButton.click();
-
-    await expect(emailInput).toHaveValue(newEmail, { timeout: 10000 });
-    await expect(page.locator('.Toastify__toast').filter({ hasText: /(Account details updated|Kontodaten aktualisiert)/i })).toBeVisible({ timeout: 10000 });
-    await expect(page.getByText(newEmail, { exact: false })).toBeVisible();
-  } finally {
-    await revertChanges();
-  }
-});

tests/e2e/admin-create-event-ui.spec.ts

@@ -29,9 +29,9 @@ test('admin can create event via UI', async ({ page }) => {
   await expect(page.getByRole('heading', { name: /^Create$/i })).toBeVisible({ timeout: 10000 });
 
   await page.getByLabel(/Event Name/i).fill(eventName);
-  await page.getByLabel(/Customer Name/i).fill('Host User');
+  await page.getByLabel(/Host Name/i).fill('Host User');
   await page.getByLabel(/Event Date/i).fill('2025-12-31');
-  await page.getByLabel(/Customer Email/i).fill(hostEmail);
+  await page.getByLabel(/Host Email/i).fill(hostEmail);
   await page.getByLabel(/Admin Email/i).fill(ADMIN_EMAIL);
   await page.getByLabel(/Gallery Password/i).fill('UiPlay123!');
   await page.getByLabel(/Confirm Password/i).fill('UiPlay123!');

tests/e2e/auth-smoke.spec.ts

@@ -6,32 +6,23 @@ const ADMIN_EMAIL = process.env.ADMIN_EMAIL || 'admin@example.com';
 const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || 'Admin!234';
 const GALLERY_PASSWORD = process.env.GALLERY_PASSWORD || 'PlaywrightGallery123!';
 
-async function createEventWithPhotos(page: Page, adminToken?: string, attempt = 1) {
+async function createEventWithPhotos(page: Page) {
   const api = page.request;
-  let token = adminToken;
-
-  if (!token) {
-    const loginResponse = await api.post('/api/auth/admin/login', {
-      data: {
-        username: ADMIN_EMAIL,
-        password: ADMIN_PASSWORD,
-      },
-    });
-    expect(loginResponse.ok()).toBeTruthy();
-    const loginData = await loginResponse.json();
-    token = loginData.token;
-    expect(token).toBeTruthy();
-  }
+  const loginResponse = await api.post('/api/auth/admin/login', {
+    data: {
+      username: ADMIN_EMAIL,
+      password: ADMIN_PASSWORD,
+    },
+  });
+  expect(loginResponse.ok()).toBeTruthy();
+  const { token } = await loginResponse.json();
+  expect(token).toBeTruthy();
 
   const eventName = `Playwright Smoke ${Date.now()}`;
   const eventDate = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000)
     .toISOString()
     .slice(0, 10);
 
-  if (!token) {
-    throw new Error('Failed to acquire admin token');
-  }
-
   const eventResponse = await api.post('/api/admin/events', {
     headers: {
       Authorization: `Bearer ${token}`,
@@ -41,8 +32,6 @@ async function createEventWithPhotos(page: Page, adminToken?: string, attempt =
       event_type: 'wedding',
       event_name: eventName,
       event_date: eventDate,
-      customer_name: 'Playwright Host',
-      customer_email: 'host@example.com',
       host_name: 'Playwright Host',
       host_email: 'host@example.com',
       admin_email: ADMIN_EMAIL,
@@ -54,17 +43,7 @@ async function createEventWithPhotos(page: Page, adminToken?: string, attempt =
       watermark_downloads: false,
     },
   });
-  if (!eventResponse.ok()) {
-    const message = await eventResponse.text();
-    if (
-      attempt < 3 &&
-      /UNIQUE constraint failed: events\.slug/i.test(message || '')
-    ) {
-      await page.waitForTimeout(150);
-      return createEventWithPhotos(page, token, attempt + 1);
-    }
-    throw new Error(`Event creation failed: ${eventResponse.status()} ${message}`);
-  }
+  expect(eventResponse.ok()).toBeTruthy();
   const event = await eventResponse.json();
 
   const imagePath = path.join(process.cwd(), 'test-assets', 'img1.png');
@@ -88,83 +67,11 @@ async function createEventWithPhotos(page: Page, adminToken?: string, attempt =
     event,
     shareLink: event.share_link,
     slug: event.slug,
-    adminToken: token,
   };
 }
 
-async function updateShortGallerySetting(page: Page, adminToken: string, enabled: boolean) {
-  const response = await page.request.put('/api/admin/settings/general', {
-    headers: {
-      Authorization: `Bearer ${adminToken}`,
-      'Content-Type': 'application/json',
-    },
-    data: {
-      general_short_gallery_urls: enabled,
-    },
-  });
-  expect(response.ok()).toBeTruthy();
-}
-
-async function openGalleryShareLink(page: Page, shareLink: string) {
-  await page.context().clearCookies();
-  await page.goto(shareLink);
-  await page.waitForLoadState('domcontentloaded');
-
-  try {
-    await page.getByText(/Enter Gallery Password/i).first().waitFor({ timeout: 5000 });
-  } catch {
-    // No password prompt shown (public gallery)
-  }
-
-  let passwordEntered = false;
-  const passwordTextbox = page.getByRole('textbox', { name: /password/i }).first();
-  if (await passwordTextbox.count()) {
-    await passwordTextbox.fill(GALLERY_PASSWORD);
-    passwordEntered = true;
-  }
-
-  const galleryPasswordField = page.getByPlaceholder(/gallery password/i);
-  if (!passwordEntered && await galleryPasswordField.count()) {
-    await galleryPasswordField.fill(GALLERY_PASSWORD);
-    passwordEntered = true;
-  } else if (!passwordEntered) {
-    const genericPasswordField = page.getByPlaceholder(/password/i).first();
-    if (await genericPasswordField.count()) {
-      await genericPasswordField.fill(GALLERY_PASSWORD);
-      passwordEntered = true;
-    } else {
-      const labelledPasswordField = page.getByLabel(/password/i).first();
-      if (await labelledPasswordField.count()) {
-        await labelledPasswordField.fill(GALLERY_PASSWORD);
-        passwordEntered = true;
-      }
-    }
-  }
-
-  if (!passwordEntered) {
-    const fallbackPasswordField = page.locator('input').first();
-    if (await fallbackPasswordField.count()) {
-      await fallbackPasswordField.fill(GALLERY_PASSWORD);
-      passwordEntered = true;
-    }
-  }
-
-  const viewButton = page.getByRole('button', { name: /View Gallery/i });
-  if (await viewButton.count()) {
-    try {
-      await viewButton.click({ noWaitAfter: true, timeout: 2000 });
-    } catch {
-      // Already navigated into gallery view.
-    }
-  }
-
-  const tiles = page.locator('.relative.group');
-  await expect(tiles.first()).toBeVisible({ timeout: 20000 });
-  return tiles;
-}
-
 test('admin login and gallery viewing smoke test', async ({ page }) => {
-  const { shareLink, adminToken } = await createEventWithPhotos(page);
+  const { shareLink } = await createEventWithPhotos(page);
 
   // Admin UI login
   await page.goto('/admin/login');
@@ -176,39 +83,18 @@ test('admin login and gallery viewing smoke test', async ({ page }) => {
   }
   await expect(page.getByRole('heading', { name: /Dashboard/i })).toBeVisible({ timeout: 20000 });
 
-  let resetToken = adminToken;
-  try {
-    // Verify long-form share link works
-    const tiles = await openGalleryShareLink(page, shareLink);
-    await tiles.first().hover();
-    await tiles.first().getByRole('button', { name: /View full size/i }).click();
-    await expect(page.getByRole('button', { name: /Close/i })).toBeVisible();
-    await page.getByRole('button', { name: /Close/i }).click();
+  // Visit gallery share link and authenticate
+  await page.goto(shareLink);
+  const passwordField = page.getByPlaceholder(/gallery password/i);
+  await passwordField.fill(GALLERY_PASSWORD);
+  await page.getByRole('button', { name: /View Gallery/i }).click();
 
-    // Enable short gallery URLs
-    await updateShortGallerySetting(page, adminToken, true);
+  // Wait for photos grid to appear
+  const tiles = page.locator('.relative.group');
+  await expect(tiles.first()).toBeVisible({ timeout: 20000 });
 
-    const settingsResponse = await page.request.get('/api/admin/settings', {
-      headers: {
-        Authorization: `Bearer ${adminToken}`,
-      },
-    });
-    expect(settingsResponse.ok()).toBeTruthy();
-    const adminSettings = await settingsResponse.json();
-    expect(adminSettings.general_short_gallery_urls === true || adminSettings.general_short_gallery_urls === 'true').toBeTruthy();
-
-    const { shareLink: shortShareLink, event: shortEvent } = await createEventWithPhotos(page, adminToken);
-    expect(shortShareLink).toMatch(/\/gallery\/[0-9a-fA-F]{32}$/);
-    expect(shortShareLink).not.toContain(shortEvent.slug);
-
-    // Verify short share link works
-    await openGalleryShareLink(page, shortShareLink);
-
-    // Legacy share link should still work after enabling short URLs
-    await openGalleryShareLink(page, shareLink);
-  } finally {
-    await updateShortGallerySetting(page, resetToken, false).catch(() => {
-      /* noop */
-    });
-  }
+  // Open lightbox to ensure media renders
+  await tiles.first().hover();
+  await tiles.first().getByRole('button', { name: /View full size/i }).click();
+  await expect(page.getByRole('button', { name: /Close/i })).toBeVisible();
 });

tests/e2e/external-media-gallery.spec.ts

@@ -1,26 +1,10 @@
 import { test, expect } from '@playwright/test';
-import fs from 'fs';
-import path from 'path';
 
 const ADMIN_EMAIL = process.env.ADMIN_EMAIL || 'admin@example.com';
 const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || 'Admin!234';
 const GALLERY_PASSWORD = process.env.GALLERY_PASSWORD || 'ExternalMediaPass!1';
 
 async function createExternalGallery(page) {
-  const externalRoot = path.join(process.cwd(), 'storage', 'external-media', 'picsum-demo', 'individual');
-  if (!fs.existsSync(externalRoot)) {
-    fs.mkdirSync(externalRoot, { recursive: true });
-  }
-
-  const sampleImages = ['img1.png', 'img2.png'];
-  for (const imageName of sampleImages) {
-    const source = path.join(process.cwd(), 'test-assets', imageName);
-    const target = path.join(externalRoot, imageName);
-    if (!fs.existsSync(target)) {
-      fs.copyFileSync(source, target);
-    }
-  }
-
   const loginResponse = await page.request.post('/api/auth/admin/login', {
     data: {
       username: ADMIN_EMAIL,
@@ -46,8 +30,8 @@ async function createExternalGallery(page) {
       event_type: 'wedding',
       event_name: eventName,
       event_date: eventDate,
-      customer_name: 'External Host',
-      customer_email: 'host@example.com',
+      host_name: 'External Host',
+      host_email: 'host@example.com',
       admin_email: ADMIN_EMAIL,
       password: GALLERY_PASSWORD,
       expiration_days: 30,
@@ -88,10 +72,7 @@ async function createExternalGallery(page) {
     failOnStatusCode: false,
   });
 
-  if (!importResponse.ok()) {
-    const bodyText = await importResponse.text();
-    throw new Error(`Failed to import external media: ${importResponse.status()} ${bodyText}`);
-  }
+  expect(importResponse.ok()).toBeTruthy();
   const importBody = await importResponse.json();
   expect(importBody.imported).toBeGreaterThan(0);
 
@@ -132,13 +113,9 @@ test.describe('External media gallery behavior', () => {
     await page.waitForLoadState('domcontentloaded');
 
     const passwordField = page.getByPlaceholder(/gallery password/i).first();
-    if (await passwordField.count()) {
-      await passwordField.fill(GALLERY_PASSWORD);
-      const viewButton = page.getByRole('button', { name: /View Gallery/i });
-      if (await viewButton.count()) {
-        await viewButton.click({ noWaitAfter: true, timeout: 2000 });
-      }
-    }
+    await expect(passwordField).toBeVisible();
+    await passwordField.fill(GALLERY_PASSWORD);
+    await page.getByRole('button', { name: /View Gallery/i }).click();
 
     const tiles = page.locator('.relative.group');
     await expect(tiles.first()).toBeVisible({ timeout: 20000 });

tests/e2e/gallery-feedback-filter.spec.ts

@@ -43,8 +43,8 @@ async function createGalleryWithModeratedComments(page: Page): Promise<GallerySe
       event_type: 'wedding',
       event_name: eventName,
       event_date: eventDate,
-      customer_name: 'Playwright Host',
-      customer_email: 'host@example.com',
+      host_name: 'Playwright Host',
+      host_email: 'host@example.com',
       admin_email: ADMIN_EMAIL,
       password: GALLERY_PASSWORD,
       expiration_days: 30,

tests/e2e/gallery-grid-actions.spec.ts

@@ -32,8 +32,8 @@ async function ensureGalleryWithPhotos(page) {
       event_type: 'wedding',
       event_name: eventName,
       event_date: eventDate,
-      customer_name: 'Playwright Host',
-      customer_email: 'host@example.com',
+      host_name: 'Playwright Host',
+      host_email: 'host@example.com',
       admin_email: ADMIN_EMAIL,
       password: GALLERY_PASSWORD,
       expiration_days: 90,

tests/e2e/notifications-clear-old.spec.ts

@@ -1,93 +0,0 @@
-import { test, expect } from '@playwright/test';
-
-const ADMIN_EMAIL = process.env.ADMIN_EMAIL || 'admin@example.com';
-const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || 'Admin!234';
-
-test('clearing old notifications removes read entries', async ({ request }) => {
-  const loginResponse = await request.post('/api/auth/admin/login', {
-    data: {
-      username: ADMIN_EMAIL,
-      password: ADMIN_PASSWORD,
-    },
-  });
-  expect(loginResponse.ok()).toBeTruthy();
-  const { token } = await loginResponse.json();
-
-  const authHeaders = {
-    Authorization: `Bearer ${token}`,
-    'Content-Type': 'application/json',
-  };
-
-  const eventName = `Notification Clear ${Date.now()}`;
-  const eventDate = new Date().toISOString().slice(0, 10);
-
-  const createEventResponse = await request.post('/api/admin/events', {
-    headers: authHeaders,
-    data: {
-      event_type: 'wedding',
-      event_name: eventName,
-      event_date: eventDate,
-      customer_name: 'Notification Test',
-      customer_email: 'notify@example.com',
-      admin_email: ADMIN_EMAIL,
-      password: 'NotifyClearPass!1',
-      expiration_days: 30,
-      allow_user_uploads: false,
-      allow_downloads: true,
-      disable_right_click: false,
-      watermark_downloads: false,
-    },
-  });
-  expect(createEventResponse.ok()).toBeTruthy();
-  const createdEvent = await createEventResponse.json();
-  const eventId = createdEvent.id;
-
-  const collectedNotifications = async () => {
-    const notificationsResponse = await request.get('/api/admin/notifications', {
-      headers: authHeaders,
-      params: { includeRead: true, limit: 200 },
-    });
-    expect(notificationsResponse.ok()).toBeTruthy();
-    return notificationsResponse.json();
-  };
-
-  let notificationsPayload = await collectedNotifications();
-  const start = Date.now();
-  while (notificationsPayload.notifications.length === 0 && Date.now() - start < 5000) {
-    await new Promise((resolve) => setTimeout(resolve, 200));
-    notificationsPayload = await collectedNotifications();
-  }
-
-  const targetEventNotifications = notificationsPayload.notifications.filter(
-    (notification: any) => notification.eventId === eventId
-  );
-  expect(targetEventNotifications.length).toBeGreaterThan(0);
-
-  const markReadResponse = await request.put('/api/admin/notifications/read-all', {
-    headers: authHeaders,
-  });
-  expect(markReadResponse.ok()).toBeTruthy();
-
-  const postMarkPayload = await collectedNotifications();
-  const postMarkEventNotifications = postMarkPayload.notifications.filter(
-    (notification: any) => notification.eventId === eventId
-  );
-  const readNotificationIds = postMarkEventNotifications
-    .filter((notification: any) => notification.isRead)
-    .map((notification: any) => notification.id);
-  expect(readNotificationIds.length).toBeGreaterThan(0);
-
-  const clearResponse = await request.delete('/api/admin/notifications/clear-old', {
-    headers: { Authorization: `Bearer ${token}` },
-  });
-  expect(clearResponse.ok()).toBeTruthy();
-  const clearPayload = await clearResponse.json();
-  expect(clearPayload.deletedCount).toBeGreaterThanOrEqual(0);
-
-  const afterClearPayload = await collectedNotifications();
-  expect(Array.isArray(afterClearPayload.notifications)).toBe(true);
-  const remainingIds = new Set(afterClearPayload.notifications.map((notification: any) => notification.id));
-  readNotificationIds.forEach((id) => {
-    expect(remainingIds.has(id)).toBe(false);
-  });
-});