Add video support, media filters, and translations

Fix security vulnerabilities detected by Trivy

.claudedocs/scans/security-20250713.md

@@ -1,286 +0,0 @@
-# Security Scan Report - Wedding Photo Sharing Application
-**Date**: July 13, 2025  
-**Scanner**: Claude Security Audit with --security --validate flags  
-**Overall Risk Level**: MEDIUM-HIGH  
-
-## Executive Summary
-
-The wedding photo sharing application demonstrates strong security fundamentals with comprehensive input validation, proper authentication mechanisms, and good file security practices. However, several critical issues require immediate attention, particularly around hardcoded secrets, token storage, and Content Security Policy configuration.
-
-### Security Score: 6.5/10
-
-**Strengths**: Excellent input validation, parameterized queries, file security, rate limiting  
-**Critical Issues**: Hardcoded JWT secrets, localStorage token storage, weak CSP, console logging in production
-
----
-
-## 🔴 CRITICAL FINDINGS (Immediate Action Required)
-
-### 1. Hardcoded JWT Secret in Development
-- **Location**: Backend `.env` file
-- **Risk**: Token forgery, authentication bypass
-- **Impact**: Complete authentication compromise
-- **Remediation**: 
-  ```bash
-  # Generate secure secret
-  openssl rand -base64 32
-  # Never commit to repository
-  echo ".env" >> .gitignore
-  ```
-
-### 2. Gallery Tokens in localStorage
-- **Location**: Frontend `api.ts` and auth contexts
-- **Risk**: XSS token theft
-- **Impact**: Gallery access compromise
-- **Remediation**: Move to httpOnly cookies:
-  ```typescript
-  Cookies.set(`gallery_token_${slug}`, token, {
-    httpOnly: true,
-    secure: true,
-    sameSite: 'strict'
-  });
-  ```
-
-### 3. Weak Content Security Policy
-- **Location**: Frontend `nginx.conf`
-- **Risk**: XSS, code injection
-- **Current**: `unsafe-inline` and `unsafe-eval` allowed
-- **Remediation**: Implement strict CSP (see detailed recommendations below)
-
----
-
-## 🟠 HIGH SEVERITY FINDINGS
-
-### 1. Console Logging in Production
-- **Locations**: 61 instances across frontend
-- **Risk**: Information disclosure
-- **Impact**: Leaking sensitive data, debugging info
-- **Remediation**: Implement environment-aware logging
-
-### 2. Token Revocation Vulnerability
-- **Location**: Backend `tokenRevocation.js`
-- **Risk**: Token manipulation
-- **Impact**: Bypass revocation checks
-- **Remediation**: Verify token signature before decoding
-
-### 3. Source Maps in Production
-- **Location**: Frontend build configuration
-- **Risk**: Source code exposure
-- **Impact**: Reveals application structure
-- **Remediation**: Disable in production builds
-
-### 4. Missing Security Headers
-- **Location**: nginx configuration
-- **Missing**: HSTS, Permissions-Policy
-- **Impact**: Various client-side attacks
-- **Remediation**: Add comprehensive security headers
-
----
-
-## 🟡 MEDIUM SEVERITY FINDINGS
-
-### 1. Rate Limiting Bypass Potential
-- **Location**: Backend rate limiter
-- **Risk**: DoS attacks
-- **Current**: JWT validation in rate limiter
-- **Remediation**: Use IP-based limiting only
-
-### 2. Incomplete SQL Injection Protection
-- **Location**: Complex dashboard queries
-- **Risk**: Potential injection in edge cases
-- **Current**: Mostly parameterized
-- **Remediation**: Use query builder exclusively
-
-### 3. Session Management
-- **Issue**: No gallery token invalidation on password change
-- **Risk**: Persistent access after compromise
-- **Remediation**: Implement token revocation
-
-### 4. Path Traversal in Gallery Slugs
-- **Location**: Frontend gallery routes
-- **Risk**: Directory traversal attempts
-- **Remediation**: Validate and sanitize slugs
-
----
-
-## 🟢 LOW SEVERITY FINDINGS
-
-### 1. Verbose Error Messages
-- **Location**: Multiple API endpoints
-- **Risk**: Information disclosure
-- **Remediation**: Generic client errors, detailed server logs
-
-### 2. Weak Gallery Passwords
-- **Current**: zxcvbn score 2/4 allowed
-- **Risk**: Brute force attacks
-- **Remediation**: Increase to score 3/4
-
-### 3. Missing File Size Validation
-- **Location**: Frontend upload components
-- **Risk**: DoS via large uploads
-- **Remediation**: Add client-side size checks
-
----
-
-## ✅ SECURITY STRENGTHS
-
-### Authentication & Authorization
-- JWT with proper expiration (24h/7d)
-- Token type validation
-- IP tracking and validation
-- Password change detection
-- Token revocation system
-- Bcrypt with 12 rounds
-- zxcvbn password strength checking
-
-### Input Validation & SQL Security
-- express-validator on all endpoints
-- Parameterized queries via Knex
-- SQL injection protection utilities
-- Path traversal prevention
-- Comprehensive input sanitization
-
-### File Security
-- Magic number verification
-- MIME type validation
-- Safe filename generation
-- Directory traversal protection
-- File extension whitelist
-
-### Rate Limiting & DoS Protection
-- General: 100 req/15min
-- Auth endpoints: 5 req/15min
-- Account lockout after failed attempts
-- Suspicious activity detection
-
-### Frontend Security
-- React's built-in XSS protection
-- DOMPurify for HTML content
-- No eval() or innerHTML usage
-- Proper error boundaries
-- ReCAPTCHA integration
-
----
-
-## 📊 DEPENDENCY ANALYSIS
-
-### Current Status
-- **Backend**: 0 vulnerabilities (691 packages)
-- **Frontend**: 0 vulnerabilities (434 packages)
-
-### Recommended Updates
-1. **bcrypt** 5.1.1 → 6.0.0 (performance, compatibility)
-2. **helmet** 7.2.0 → 8.1.0 (new security features)
-3. **@tiptap** 2.x → 3.x (security improvements)
-
-### Supply Chain Assessment
-- All major dependencies from trusted sources
-- No typosquatting detected
-- Regular maintenance observed
-- MIT/ISC/Apache licenses only
-
----
-
-## 🛠️ REMEDIATION PLAN
-
-### Phase 1: Critical (Within 24 hours)
-1. Replace hardcoded JWT secret with secure random value
-2. Move gallery tokens from localStorage to httpOnly cookies
-3. Implement strict CSP without unsafe-eval
-4. Remove or wrap console.log statements
-
-### Phase 2: High Priority (Within 1 week)
-1. Disable source maps in production
-2. Add missing security headers (HSTS, Permissions-Policy)
-3. Fix token revocation vulnerability
-4. Update critical dependencies (bcrypt, helmet)
-
-### Phase 3: Medium Priority (Within 1 month)
-1. Implement comprehensive logging strategy
-2. Add gallery slug validation
-3. Enhance rate limiting logic
-4. Implement session invalidation on password change
-
-### Phase 4: Ongoing
-1. Weekly dependency scanning
-2. Implement security testing in CI/CD
-3. Regular penetration testing
-4. Security awareness training
-
----
-
-## 🔒 RECOMMENDED CSP CONFIGURATION
-
-```nginx
-add_header Content-Security-Policy "
-  default-src 'self';
-  script-src 'self' 'nonce-{RANDOM}' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/;
-  style-src 'self' 'unsafe-inline';
-  img-src 'self' data: blob: https:;
-  font-src 'self';
-  connect-src 'self' https://analytics.domain.com;
-  frame-src https://www.google.com/recaptcha/;
-  object-src 'none';
-  base-uri 'self';
-  form-action 'self';
-  frame-ancestors 'none';
-  upgrade-insecure-requests;
-" always;
-```
-
----
-
-## 🚀 SECURITY IMPROVEMENTS ROADMAP
-
-### Immediate Implementation
-```bash
-# 1. Generate secure secrets
-openssl rand -base64 32 > jwt-secret.txt
-
-# 2. Update dependencies
-cd backend && npm install bcrypt@^6.0.0 helmet@^8.1.0
-cd ../frontend && npm update
-
-# 3. Add security scanning
-npm install -D npm-audit-resolver
-```
-
-### CI/CD Integration
-```yaml
-# Add to CI pipeline
-- name: Security Scan
-  run: |
-    npm audit --audit-level=moderate
-    npm run test:security
-```
-
-### Monitoring & Alerting
-1. Implement fail2ban for repeated auth failures
-2. Set up log analysis for suspicious patterns
-3. Configure alerts for security events
-4. Regular vulnerability scanning
-
----
-
-## 📋 COMPLIANCE CHECKLIST
-
-- [ ] OWASP Top 10 addressed
-- [ ] GDPR compliance (data minimization, right to erasure)
-- [ ] Security headers implemented
-- [ ] Dependency scanning automated
-- [ ] Incident response plan documented
-- [ ] Security documentation maintained
-- [ ] Regular security reviews scheduled
-
----
-
-## 🎯 CONCLUSION
-
-The wedding photo sharing application has a solid security foundation with excellent input validation and authentication mechanisms. However, operational security practices need immediate attention. The critical issues around secret management and token storage must be addressed before production deployment.
-
-Implementing the recommended fixes will raise the security score from 6.5/10 to approximately 8.5/10, providing a robust and secure platform for wedding photo sharing.
-
----
-
-*Generated by Claude Security Scanner v1.0*  
-*Next scan recommended: After Phase 1 remediation completion*

.drone.yml

@@ -1,114 +0,0 @@
-kind: pipeline
-type: docker
-name: default
-
-steps:
-  # Build Backend Docker Image
-  - name: build-backend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-backend
-      tags: 
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_BRANCH}-latest
-      dockerfile: backend/Dockerfile
-      context: backend/
-      registry: registry.local.nothaft.cloud
-      build_args:
-        - VERSION=${DRONE_TAG:-dev}
-      
-  # Build Frontend Docker Image
-  - name: build-frontend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-frontend
-      tags: 
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_BRANCH}-latest
-      dockerfile: frontend/Dockerfile
-      context: frontend/
-      registry: registry.local.nothaft.cloud
-      build_args:
-        - VERSION=${DRONE_TAG:-dev}
-        - VITE_API_URL=${VITE_API_URL:-/api}
-
-trigger:
-  branch:
-    - main
-    - develop
-  event:
-    - push
-    - pull_request
-
----
-kind: pipeline
-type: docker
-name: release
-
-steps:
-  # Build Backend Release
-  - name: build-backend-release
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-backend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: backend/Dockerfile
-      context: backend/
-      registry: registry.local.nothaft.cloud
-      
-  # Build Frontend Release
-  - name: build-frontend-release
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-frontend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: frontend/Dockerfile
-      context: frontend/
-      registry: registry.local.nothaft.cloud
-
-  # -------- NEW: Publish Docker images to GitHub Container Registry --------
-  - name: push-backend-ghcr
-    image: plugins/docker
-    settings:
-      repo: ghcr.io/the-luap/picpeak-backend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: backend/Dockerfile
-      context: backend/
-      registry: ghcr.io
-      username:
-        from_secret: GITHUB_USERNAME
-      password:
-        from_secret: GITHUB_TOKEN
-      build_args:
-        - VERSION=${DRONE_TAG}
-
-  - name: push-frontend-ghcr
-    image: plugins/docker
-    settings:
-      repo: ghcr.io/the-luap/picpeak-frontend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: frontend/Dockerfile
-      context: frontend/
-      registry: ghcr.io
-      username:
-        from_secret: GITHUB_USERNAME
-      password:
-        from_secret: GITHUB_TOKEN
-      build_args:
-        - VERSION=${DRONE_TAG}
-        - VITE_API_URL=${VITE_API_URL:-/api}
-
-
-trigger:
-  event:
-    - tag

.env.example

@@ -1,47 +1,77 @@
-# PicPeak Development Environment Configuration
-# Copy this file to .env for local development
+# PicPeak Environment Configuration
+# Copy this file to .env and update with your values
 
-# SECURITY WARNING: This configuration is for development only!
-# For production, use .env.production.example
+# Environment
+NODE_ENV=production
 
-# JWT Secret (Change in production!)
-# Generate secure secret with: openssl rand -base64 32
-JWT_SECRET=dev-secret-DO-NOT-USE-IN-PRODUCTION
+# JWT Secret (generate with: openssl rand -base64 64)
+JWT_SECRET=your_very_long_random_jwt_secret_here
 
-# Application URLs (Docker Compose development setup)
-ADMIN_URL=http://localhost:3005
-FRONTEND_URL=http://localhost:3005
-BACKEND_URL=http://localhost:3001
+# Database Configuration (PostgreSQL)
+DATABASE_CLIENT=pg
+DB_USER=picpeak
+# IMPORTANT: Avoid $ character in passwords - Docker Compose interprets it as variable substitution
+# If you must use $, escape it as $$ (e.g., Pass$$word instead of Pass$word)
+DB_PASSWORD=your_secure_postgres_password_here
+DB_NAME=picpeak_prod
 
-# Database Configuration (SQLite for development)
-DATABASE_CLIENT=sqlite3
-DATABASE_PATH=./data/photo_sharing.db
+# Redis Configuration
+# IMPORTANT: Same warning applies - avoid $ or escape as $$
+REDIS_PASSWORD=your_secure_redis_password_here
 
-# Email Configuration (Mailhog for development)
-# Access Mailhog UI at: http://localhost:8025
-SMTP_HOST=mailhog
-SMTP_PORT=1025
+# Admin Account (initial setup)
+ADMIN_USERNAME=admin
+ADMIN_EMAIL=admin@yourdomain.com
+
+# Email Configuration
+# For Gmail: use app-specific password
+# For SendGrid: SMTP_USER=apikey, SMTP_PASS=your-api-key
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
 SMTP_SECURE=false
-SMTP_USER=
-SMTP_PASS=
-EMAIL_FROM=noreply@localhost
+SMTP_USER=your-email@gmail.com
+SMTP_PASS=your-app-specific-password
+EMAIL_FROM=noreply@yourdomain.com
 
-# Backend Port Configuration
-PORT=3001
+# Application URLs
+# Use full origin with scheme, no trailing slash.
+# Admin UI is served by the frontend at /admin.
+FRONTEND_URL=https://yourdomain.com
+ADMIN_URL=https://yourdomain.com
 
-# Optional: Umami Analytics Backend Config
-# NOTE: Primary configuration through Admin UI > Settings > Analytics
-# These are fallback values for server-side tracking
-# UMAMI_URL=https://analytics.example.com
-# UMAMI_WEBSITE_ID=your-website-id
-# UMAMI_HASH_SALT=your-hash-salt
+# Frontend API base
+# For pre-built images and production behind a reverse proxy, keep '/api'.
+# If you rebuild the frontend yourself, you may set a full URL at build time.
+VITE_API_URL=/api
 
-# Development Features
-NODE_ENV=development
-LOG_LEVEL=debug
+# Port Configuration (optional)
+# BACKEND_PORT=3001
+# FRONTEND_PORT=3000
+# DB_PORT=5432
+# REDIS_PORT=6379
 
-# Admin Setup Notes:
-# 1. Run 'npm run migrate' in backend folder
-# 2. Admin credentials will be auto-generated
-# 3. Check ADMIN_CREDENTIALS.txt for login details
-# 4. Change password on first login (required)
+# Timezone
+TZ=UTC
+
+# Runtime user mapping for Docker (optional)
+# Set these to your host user's UID/GID to avoid permission issues on bind mounts.
+# Run `id -u` and `id -g` on host to get values. Defaults to 1001.
+PUID=1001
+PGID=1001
+
+# Analytics (Optional - Umami)
+VITE_UMAMI_URL=
+VITE_UMAMI_WEBSITE_ID=
+VITE_UMAMI_SHARE_URL=
+
+# Storage variables (host paths)
+# These control where data is stored on the host. Defaults are local folders.
+APP_STORAGE=./storage
+APP_DATA=./data
+LOGS=./logs
+
+# Note on FRONTEND_API_URL (documentation only):
+# When using pre-built frontend images, runtime env vars cannot override the built JS.
+# Do NOT rely on FRONTEND_API_URL in Compose. Instead, keep VITE_API_URL=/api and
+# let the frontend Nginx proxy /api to the backend. Only if you rebuild the frontend
+# should you change VITE_API_URL at build time.

.env.production.example

@@ -1,100 +0,0 @@
-# PicPeak Production Configuration
-# Copy this file to .env and update with your production values
-
-# ============================================
-# CRITICAL SECURITY - MUST CHANGE ALL VALUES!
-# ============================================
-
-# JWT Secret - REQUIRED (minimum 32 characters)
-# Generate with: openssl rand -base64 32
-JWT_SECRET=CHANGE-THIS-PRODUCTION-SECRET-USE-OPENSSL-COMMAND
-
-# Application URLs - REQUIRED (your actual domain)
-FRONTEND_URL=https://your-domain.com
-BACKEND_URL=https://your-domain.com
-ADMIN_URL=https://your-domain.com
-
-# ============================================
-# DATABASE CONFIGURATION - REQUIRED
-# ============================================
-
-# PostgreSQL Configuration (Recommended for production)
-DATABASE_CLIENT=pg
-DB_HOST=postgres  # or your database host
-DB_PORT=5432
-DB_NAME=picpeak
-DB_USER=picpeak
-DB_PASSWORD=CHANGE-THIS-SECURE-DATABASE-PASSWORD
-
-# ============================================
-# EMAIL CONFIGURATION - REQUIRED
-# ============================================
-
-# Example: Gmail with App Password
-# SMTP_HOST=smtp.gmail.com
-# SMTP_PORT=587
-# SMTP_SECURE=false
-# SMTP_USER=your-email@gmail.com
-# SMTP_PASS=your-16-char-app-password
-# EMAIL_FROM=Your Name <your-email@gmail.com>
-
-# Example: SendGrid
-SMTP_HOST=smtp.sendgrid.net
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=apikey
-SMTP_PASS=YOUR-SENDGRID-API-KEY
-EMAIL_FROM=PicPeak <noreply@your-domain.com>
-
-# ============================================
-# ADMIN SETUP - AUTO-GENERATED
-# ============================================
-# NOTE: Admin credentials are automatically generated during setup
-# DO NOT set ADMIN_EMAIL or ADMIN_PASSWORD anymore!
-# Run 'npm run migrate' and check ADMIN_CREDENTIALS.txt
-
-# ============================================
-# OPTIONAL CONFIGURATION
-# ============================================
-
-# Umami Analytics (Optional - Fallback values)
-# Primary config via Admin UI > Settings > Analytics
-# UMAMI_URL=https://analytics.your-domain.com
-# UMAMI_WEBSITE_ID=your-website-id
-# UMAMI_HASH_SALT=your-hash-salt
-
-# Frontend Analytics (Optional - Fallback values)
-# VITE_UMAMI_URL=https://analytics.your-domain.com
-# VITE_UMAMI_WEBSITE_ID=your-website-id
-# VITE_UMAMI_SHARE_URL=https://analytics.your-domain.com/share/xyz/gallery
-
-# ============================================
-# PERFORMANCE & SECURITY TUNING
-# ============================================
-
-NODE_ENV=production
-PORT=3001
-LOG_LEVEL=info
-
-# Security Settings (Defaults are secure)
-BCRYPT_ROUNDS=12
-SESSION_TIMEOUT_MINUTES=60
-RATE_LIMIT_WINDOW_MS=900000     # 15 minutes
-RATE_LIMIT_MAX_REQUESTS=100      # per window
-
-# Connection Pool (Adjust based on load)
-DB_POOL_MIN=5
-DB_POOL_MAX=25
-
-# ============================================
-# DOCKER COMPOSE SPECIFIC
-# ============================================
-
-# Traefik Configuration (if using Traefik)
-DOMAIN=your-domain.com
-LETSENCRYPT_EMAIL=admin@your-domain.com
-
-# Volume Paths (Docker)
-STORAGE_PATH=/app/storage
-EVENTS_PATH=/app/storage/events
-ARCHIVE_PATH=/app/storage/events/archived

.gitattributes-github

@@ -1,12 +0,0 @@
-# Files to exclude from GitHub mirror
-.env* export-ignore
-docker-compose.prod.yml export-ignore
-.claudedocs/ export-ignore
-backend/data/ export-ignore
-backend/storage/ export-ignore
-backend/.env* export-ignore
-frontend/.env* export-ignore
-secrets/ export-ignore
-*.key export-ignore
-*.pem export-ignore
-.gitea/ export-ignore

.gitea/workflows/mirror-to-github.yml

@@ -1,99 +0,0 @@
-name: Mirror to GitHub
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:  # Allow manual triggering
-
-jobs:
-  mirror:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0  # Full history for proper mirroring
-
-      - name: Setup Git
-        run: |
-          git config --global user.name "the-luap"
-          git config --global user.email "paul-nothaft@hotmail.de"
-
-      - name: Remove sensitive files and directories
-        run: |
-          echo "Current files before cleanup:"
-          ls -la | head -10 || true
-          echo "..."
-          
-          # Remove sensitive files/directories if they exist
-          echo "Removing sensitive files..."
-          rm -rf .env || true
-          rm -rf backend/.env* || true
-          rm -rf frontend/.env* || true
-          rm -rf docker-compose.prod.yml || true
-          rm -rf .claudedocs/ || true
-          rm -rf backend/data/ || true
-          rm -rf backend/storage/ || true
-          rm -rf .gitea/ || true
-          rm -rf scripts/install-gitea-runner.sh || true
-          rm -rf .drone* || true
-          rm -rf .github-mirror-exclude || true
-          rm -rf .gitattributes-github || true
-          rm -rf photo-sharing-prd.md || true
-          rm -rf CLAUDE.md || true
-          rm -rf PRODUCTION_DEPLOYMENT_GUIDE.md || true
-          rm -rf logs/ || true
-          rm -rf frontend/.claudedocs/ || true
-          rm -rf test-maintenance.sh || true
-          rm -rf storage/ || true
-          
-          echo "Sensitive files removal completed"
-          
-          # Add and commit the cleanup if there are changes
-          git add -A
-          if ! git diff --cached --quiet; then
-            git commit -m "chore: remove sensitive files for GitHub mirror"
-            echo "✅ Committed cleanup of sensitive files"
-          else
-            echo "✅ No sensitive files to remove"
-          fi
-          
-          echo "Final file structure (top level):"
-          ls -la | head -10 || true
-
-      - name: Check GitHub token
-        env:
-          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
-        run: |
-          if [ -z "$GITHUBTOKEN" ]; then
-            echo "ERROR: GITHUBTOKEN secret is not set!"
-            exit 1
-          else
-            echo "GitHub token is available (length: ${#GITHUBTOKEN})"
-          fi
-
-      - name: Push to GitHub
-        env:
-          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
-        run: |
-          # Remove existing github remote if it exists
-          git remote remove github || true
-          
-          # Add GitHub remote
-          git remote add github https://x-access-token:${GITHUBTOKEN}@github.com/the-luap/picpeak.git
-          
-          # Verify remote was added
-          echo "GitHub remote added:"
-          git remote -v
-          
-          # Push to GitHub main branch
-          echo "Pushing to GitHub..."
-          git push github main --force
-          echo "✅ Push to GitHub completed!"
-
-      - name: Workflow completed
-        run: |
-          echo "✅ Mirror to GitHub workflow completed successfully!"
-          echo "📊 Repository mirrored to: https://github.com/the-luap/picpeak"
-          echo "🔒 Sensitive files have been removed from the mirror"

.gitea/workflows/test.yml

@@ -1,52 +0,0 @@
-name: Test and Lint
-
-on:
-  push:
-    branches: [ main, develop ]
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  backend-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-      
-      - name: Install backend dependencies
-        working-directory: ./backend
-        run: npm ci
-      
-      - name: Run backend linting
-        working-directory: ./backend
-        run: npm run lint || true  # Continue on lint errors for now
-      
-      - name: Run backend tests
-        working-directory: ./backend
-        run: npm test || true  # Continue on test failures for now
-  
-  frontend-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-      
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm ci --legacy-peer-deps
-      
-      - name: Run frontend linting
-        working-directory: ./frontend
-        run: npm run lint || true  # Continue on lint errors for now
-      
-      - name: Build frontend
-        working-directory: ./frontend
-        run: npm run build

.gitea/workflows/version-and-release.yml

@@ -1,267 +0,0 @@
-name: Version and Release
-
-on:
-  push:
-    branches: [ main ]
-    paths-ignore:
-      - '**.md'
-      - '.gitea/**'
-      - '.drone.yml'
-
-jobs:
-  version-bump:
-    runs-on: ubuntu-latest
-    outputs:
-      new_version: ${{ steps.version.outputs.new_version }}
-      version_changed: ${{ steps.version.outputs.version_changed }}
-      component_changed: ${{ steps.version.outputs.component_changed }}
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITEA_TOKEN || github.token }}
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-      
-      - name: Configure Git
-        run: |
-          git config --global user.name 'Gitea Actions Bot'
-          git config --global user.email 'actions@gitea.local'
-      
-      - name: Detect changes and bump version
-        id: version
-        run: |
-          set -e  # Exit on error
-          
-          echo "=== Debug Info ==="
-          echo "GitHub event before: ${{ github.event.before }}"
-          echo "GitHub SHA: ${{ github.sha }}"
-          echo "Current directory: $(pwd)"
-          echo "Git log (last 5): $(git log --oneline -5)"
-          
-          # Get the commit range for changed files
-          if [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ] && [ "${{ github.event.before }}" != "" ]; then
-            COMMIT_RANGE="${{ github.event.before }}..${{ github.sha }}"
-            echo "Using commit range: $COMMIT_RANGE"
-            CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
-          else
-            # First commit or no previous commit, check against HEAD~1 if it exists
-            if git rev-parse HEAD~1 >/dev/null 2>&1; then
-              COMMIT_RANGE="HEAD~1..HEAD"
-              echo "Using commit range: $COMMIT_RANGE"
-              CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
-            else
-              echo "First commit detected, checking all files"
-              CHANGED_FILES=$(git ls-files)
-            fi
-          fi
-          
-          echo "Changed files:"
-          echo "$CHANGED_FILES"
-          
-          # Check what changed (using echo to pipe to grep to avoid grep exit codes)
-          BACKEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^backend/' || echo "0")
-          FRONTEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^frontend/' || echo "0")
-          ROOT_CHANGED=$(echo "$CHANGED_FILES" | grep -c -E '^(package\.json|docker-compose|Dockerfile|scripts/)' || echo "0")
-          
-          echo "Backend files changed: $BACKEND_CHANGED"
-          echo "Frontend files changed: $FRONTEND_CHANGED"
-          echo "Root files changed: $ROOT_CHANGED"
-          
-          # Get current versions
-          BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "1.0.0")
-          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "1.0.0")
-          
-          echo "Current backend version: $BACKEND_VERSION"
-          echo "Current frontend version: $FRONTEND_VERSION"
-          
-          # Determine what to update based on changes
-          BACKEND_UPDATE=false
-          FRONTEND_UPDATE=false
-          COMPONENT_CHANGED="none"
-          
-          if [ "$ROOT_CHANGED" -gt 0 ]; then
-            # Root changes affect both components
-            BACKEND_UPDATE=true
-            FRONTEND_UPDATE=true
-            COMPONENT_CHANGED="both"
-            SOURCE_VERSION=$BACKEND_VERSION
-            echo "Root changes detected - updating both components"
-          elif [ "$BACKEND_CHANGED" -gt 0 ] && [ "$FRONTEND_CHANGED" -gt 0 ]; then
-            # Both components changed
-            BACKEND_UPDATE=true
-            FRONTEND_UPDATE=true
-            COMPONENT_CHANGED="both"
-            # Use the higher version as source
-            if [ "$(printf '%s\n' "$BACKEND_VERSION" "$FRONTEND_VERSION" | sort -V | tail -n1)" = "$BACKEND_VERSION" ]; then
-              SOURCE_VERSION=$BACKEND_VERSION
-            else
-              SOURCE_VERSION=$FRONTEND_VERSION
-            fi
-            echo "Both backend and frontend changed - updating both"
-          elif [ "$BACKEND_CHANGED" -gt 0 ]; then
-            # Only backend changed
-            BACKEND_UPDATE=true
-            COMPONENT_CHANGED="backend"
-            SOURCE_VERSION=$BACKEND_VERSION
-            echo "Only backend changed - updating backend"
-          elif [ "$FRONTEND_CHANGED" -gt 0 ]; then
-            # Only frontend changed
-            FRONTEND_UPDATE=true
-            COMPONENT_CHANGED="frontend"
-            SOURCE_VERSION=$FRONTEND_VERSION
-            echo "Only frontend changed - updating frontend"
-          else
-            echo "No relevant changes detected"
-            echo "version_changed=false" >> $GITHUB_OUTPUT
-            echo "component_changed=none" >> $GITHUB_OUTPUT
-            echo "new_version=" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-          
-          echo "Component changed: $COMPONENT_CHANGED"
-          echo "Source version: $SOURCE_VERSION"
-          echo "Backend update: $BACKEND_UPDATE"
-          echo "Frontend update: $FRONTEND_UPDATE"
-          
-          # Calculate new version
-          IFS='.' read -r -a version_parts <<< "$SOURCE_VERSION"
-          MAJOR="${version_parts[0]}"
-          MINOR="${version_parts[1]}"
-          PATCH="${version_parts[2]}"
-          
-          # Increment patch version
-          NEW_PATCH=$((PATCH + 1))
-          NEW_VERSION="$MAJOR.$MINOR.$NEW_PATCH"
-          
-          echo "New version: $NEW_VERSION"
-          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
-          echo "component_changed=$COMPONENT_CHANGED" >> $GITHUB_OUTPUT
-          
-          # Update versions in package.json files
-          if [ "$BACKEND_UPDATE" = true ]; then
-            echo "Updating backend version to $NEW_VERSION"
-            cd backend && npm version $NEW_VERSION --no-git-tag-version
-            cd ..
-          fi
-          
-          if [ "$FRONTEND_UPDATE" = true ]; then
-            echo "Updating frontend version to $NEW_VERSION"
-            cd frontend && npm version $NEW_VERSION --no-git-tag-version
-            cd ..
-          fi
-          
-          # Check if there are changes to commit
-          if [[ -n $(git status --porcelain) ]]; then
-            echo "version_changed=true" >> $GITHUB_OUTPUT
-          else
-            echo "version_changed=false" >> $GITHUB_OUTPUT
-          fi
-      
-      - name: Commit version bump
-        if: steps.version.outputs.version_changed == 'true'
-        run: |
-          set -e  # Exit on any error
-          
-          # First, ensure we have the latest changes
-          echo "Fetching latest changes..."
-          git fetch origin main
-          
-          # Check if we're behind and need to update
-          LOCAL=$(git rev-parse HEAD)
-          REMOTE=$(git rev-parse origin/main)
-          
-          if [ "$LOCAL" != "$REMOTE" ]; then
-            echo "Local is behind remote, pulling changes..."
-            git pull origin main --no-rebase
-          fi
-          
-          COMPONENT="${{ steps.version.outputs.component_changed }}"
-          
-          if [ "$COMPONENT" = "both" ]; then
-            git add backend/package.json backend/package-lock.json frontend/package.json frontend/package-lock.json
-            git commit -m "chore: bump version to ${{ steps.version.outputs.new_version }} (backend + frontend)"
-          elif [ "$COMPONENT" = "backend" ]; then
-            git add backend/package.json backend/package-lock.json
-            git commit -m "chore: bump backend version to ${{ steps.version.outputs.new_version }}"
-          elif [ "$COMPONENT" = "frontend" ]; then
-            git add frontend/package.json frontend/package-lock.json
-            git commit -m "chore: bump frontend version to ${{ steps.version.outputs.new_version }}"
-          fi
-          
-          # Pull latest changes before pushing to avoid conflicts
-          echo "Pulling latest changes from origin/main..."
-          if ! git pull --rebase origin main; then
-            echo "Rebase failed, attempting to resolve..."
-            # If rebase fails, abort and try a regular merge
-            git rebase --abort || true
-            git pull origin main --no-rebase
-          fi
-          
-          # Push the changes with retry logic
-          echo "Pushing version bump..."
-          PUSH_SUCCESS=false
-          
-          for i in 1 2 3; do
-            echo "Push attempt $i of 3..."
-            
-            # Try to push
-            if git push origin main 2>&1; then
-              echo "Successfully pushed version bump on attempt $i"
-              PUSH_SUCCESS=true
-              break
-            else
-              echo "Push failed on attempt $i"
-              
-              if [ $i -lt 3 ]; then
-                echo "Waiting 5 seconds before retry..."
-                sleep 5
-                
-                echo "Pulling latest changes..."
-                git fetch origin main
-                
-                # Try rebase first, fall back to merge
-                if ! git rebase origin/main; then
-                  echo "Rebase failed, trying merge..."
-                  git rebase --abort 2>/dev/null || true
-                  git pull origin main --no-rebase
-                fi
-              fi
-            fi
-          done
-          
-          if [ "$PUSH_SUCCESS" = "false" ]; then
-            echo "ERROR: Failed to push after 3 attempts"
-            exit 1
-          fi
-      
-      - name: Create Git tag
-        if: steps.version.outputs.version_changed == 'true'
-        run: |
-          COMPONENT="${{ steps.version.outputs.component_changed }}"
-          
-          if [ "$COMPONENT" = "both" ]; then
-            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend + frontend)"
-          elif [ "$COMPONENT" = "backend" ]; then
-            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend)"
-          elif [ "$COMPONENT" = "frontend" ]; then
-            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (frontend)"
-          fi
-          
-          git tag -a "v${{ steps.version.outputs.new_version }}" -m "$TAG_MESSAGE"
-          git push origin "v${{ steps.version.outputs.new_version }}"
-  
-  trigger-drone:
-    needs: version-bump
-    if: needs.version-bump.outputs.version_changed == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Trigger Drone Build
-        run: |
-          echo "Version bumped to ${{ needs.version-bump.outputs.new_version }}"
-          echo "Component(s) changed: ${{ needs.version-bump.outputs.component_changed }}"
-          echo "Drone will automatically trigger on the new tag"
-          # Drone CI will automatically trigger on the tag push event

.github-mirror-exclude

@@ -1,24 +0,0 @@
-# Exclude patterns for GitHub mirror
-.env
-.env.*
-.env*
-docker-compose.prod.yml
-docker-compose.traefik.yml
-.claudedocs/
-backend/data/
-backend/storage/
-backend/.env*
-frontend/.env*
-secrets/
-*.key
-*.pem
-.gitea/
-node_modules/
-dist/
-build/
-*.log
-.DS_Store
-deploy/
-certbot/
-nginx/
-photo-sharing-prd.md

.github/workflows/README-DOCKER.md

@@ -0,0 +1,213 @@
+# Docker Build and Push Workflow
+
+This GitHub Actions workflow automatically builds and pushes Docker images for both the backend and frontend to GitHub Container Registry (ghcr.io).
+
+## Features
+
+- 🔧 **Automatic builds** on push to main/develop branches, PRs, and releases
+- 🏗️ **Multi-architecture support** (linux/amd64 and linux/arm64)
+- 🏷️ **Smart tagging** based on branches, versions, and commits
+- 🔒 **Security scanning** with Trivy vulnerability scanner
+- 💾 **Build caching** for faster subsequent builds
+- 📊 **Build summaries** in GitHub Actions UI
+
+## Authentication
+
+The workflow uses the built-in `GITHUB_TOKEN` for authentication with GitHub Container Registry. No additional setup or personal access tokens are required.
+
+### Required Permissions
+
+The workflow automatically sets the necessary permissions:
+- `contents: read` - To checkout the repository
+- `packages: write` - To push images to ghcr.io
+- `security-events: write` - To upload security scan results
+
+## Image Tags
+
+Images are automatically tagged based on the trigger event:
+
+| Event | Tags Generated |
+|-------|---------------|
+| Push to main | `latest`, `main`, `main-<short-sha>` |
+| Push to develop | `develop`, `develop-<short-sha>` |
+| Pull Request | `pr-<number>` |
+| Release (v1.2.3) | `1.2.3`, `1.2`, `1`, `latest` |
+| Manual trigger | Based on branch + optional push |
+
+## Usage
+
+### Pull Images
+
+Once published, images can be pulled using:
+
+```bash
+# Pull backend image
+docker pull ghcr.io/the-luap/picpeak/backend:latest
+
+# Pull frontend image
+docker pull ghcr.io/the-luap/picpeak/frontend:latest
+
+# Pull specific version
+docker pull ghcr.io/the-luap/picpeak/backend:v1.0.0
+
+# Pull for specific architecture
+docker pull --platform linux/arm64 ghcr.io/the-luap/picpeak/backend:latest
+```
+
+### Using in Docker Compose
+
+```yaml
+version: '3.8'
+
+services:
+  backend:
+    image: ghcr.io/the-luap/picpeak/backend:latest
+    environment:
+      - NODE_ENV=production
+    ports:
+      - "3001:3000"
+
+  frontend:
+    image: ghcr.io/the-luap/picpeak/frontend:latest
+    ports:
+      - "80:80"
+```
+
+### Using in Kubernetes
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: picpeak-backend
+spec:
+  replicas: 3
+  template:
+    spec:
+      containers:
+      - name: backend
+        image: ghcr.io/the-luap/picpeak/backend:latest
+        imagePullPolicy: Always
+```
+
+## Manual Workflow Trigger
+
+You can manually trigger the workflow from the Actions tab:
+
+1. Go to Actions → "Build and Push Docker Images"
+2. Click "Run workflow"
+3. Select branch and whether to push images
+4. Click "Run workflow"
+
+## Security Scanning
+
+The workflow includes Trivy vulnerability scanning that:
+- Scans for CRITICAL and HIGH severity vulnerabilities
+- Uploads results to GitHub Security tab
+- Available under Security → Code scanning alerts
+
+## Build Optimization
+
+The workflow uses several optimization techniques:
+
+1. **GitHub Actions Cache**: Speeds up builds by caching layers
+2. **Multi-stage builds**: Reduces final image size
+3. **Parallel builds**: Backend and frontend build simultaneously
+4. **Smart rebuilds**: Only rebuilds changed components
+
+## Troubleshooting
+
+### Permission Denied Errors
+
+If you encounter permission errors when pushing images:
+
+1. **First-time setup**: The first push creates a private package. You may need to:
+   - Go to your package settings at `https://github.com/users/YOUR_USERNAME/packages`
+   - Link the package to your repository
+   - Set package visibility (public/private)
+
+2. **Organization repositories**: Ensure the organization allows GitHub Actions to create packages
+
+### Build Failures
+
+Check the workflow logs in the Actions tab for detailed error messages. Common issues:
+- Missing dependencies in package.json
+- Dockerfile syntax errors
+- Network issues during package installation
+
+### Image Not Found
+
+If images aren't visible after successful push:
+- Check package visibility settings
+- Ensure you're authenticated to pull private images:
+  ```bash
+  echo $GITHUB_TOKEN | docker login ghcr.io -u YOUR_USERNAME --password-stdin
+  ```
+
+## Package Management
+
+### View Packages
+
+Your Docker images are available at:
+- Backend: `https://github.com/users/the-luap/packages/container/package/picpeak%2Fbackend`
+- Frontend: `https://github.com/users/the-luap/packages/container/package/picpeak%2Ffrontend`
+
+### Delete Old Versions
+
+To save storage, you can delete old versions:
+1. Go to package settings
+2. Click on "Manage versions"
+3. Select versions to delete
+4. Click "Delete selected versions"
+
+### Set Retention Policy
+
+Configure automatic cleanup in package settings:
+1. Go to package settings
+2. Click on "Manage Actions access"
+3. Set retention days for untagged versions
+
+## Best Practices
+
+1. **Use semantic versioning** for releases (e.g., v1.2.3)
+2. **Test images locally** before pushing to production
+3. **Monitor security alerts** from Trivy scans
+4. **Clean up old images** regularly to save storage
+5. **Use specific tags** in production (avoid `latest`)
+
+## Advanced Configuration
+
+### Custom Registry
+
+To use a different registry, update the workflow:
+
+```yaml
+env:
+  REGISTRY: docker.io  # or your custom registry
+  BACKEND_IMAGE_NAME: yourusername/picpeak-backend
+```
+
+### Additional Platforms
+
+To build for more platforms:
+
+```yaml
+platforms: linux/amd64,linux/arm64,linux/arm/v7
+```
+
+### Custom Build Arguments
+
+Add build arguments in the workflow:
+
+```yaml
+build-args: |
+  NODE_VERSION=20
+  API_URL=${{ secrets.API_URL }}
+```
+
+## Related Documentation
+
+- [GitHub Container Registry Docs](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry)
+- [Docker Build Action](https://github.com/docker/build-push-action)
+- [Trivy Security Scanner](https://github.com/aquasecurity/trivy)
+- [Multi-platform Builds](https://docs.docker.com/build/building/multi-platform/)

.github/workflows/docker-build.yml

@@ -0,0 +1,251 @@
+name: Build and Push Docker Images
+
+on:
+  push:
+    branches: [ main, develop ]
+    tags: [ 'v*.*.*' ]
+  pull_request:
+    branches: [ main ]
+  release:
+    types: [ published ]
+  workflow_dispatch:
+    inputs:
+      push:
+        description: 'Push images to registry'
+        required: false
+        default: 'false'
+        type: choice
+        options:
+          - 'true'
+          - 'false'
+
+env:
+  REGISTRY: ghcr.io
+  BACKEND_IMAGE_NAME: ${{ github.repository }}/backend
+  FRONTEND_IMAGE_NAME: ${{ github.repository }}/frontend
+
+jobs:
+  build-backend:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      security-events: write
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Determine build platforms
+      id: platforms
+      run: |
+        # For PRs, build only amd64 to avoid QEMU emulation issues with Sharp
+        # For main/develop/tags, build multi-arch
+        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
+        else
+          echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      with:
+        platforms: ${{ steps.platforms.outputs.platforms }}
+
+    - name: Log in to Container Registry
+      if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
+      id: login-ghcr
+      continue-on-error: true
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Extract metadata for Backend
+      id: meta-backend
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}
+        labels: |
+          org.opencontainers.image.title=PicPeak Backend
+          org.opencontainers.image.description=PicPeak photo sharing platform backend service
+          org.opencontainers.image.vendor=PicPeak
+          maintainer=${{ github.repository_owner }}
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=semver,pattern={{version}}
+          type=semver,pattern={{major}}.{{minor}}
+          type=semver,pattern={{major}}
+          type=sha,format=short
+          type=raw,value=latest,enable={{is_default_branch}}
+
+    - name: Build and push Backend Docker image
+      uses: docker/build-push-action@v5
+      with:
+        context: ./backend
+        file: ./backend/Dockerfile
+        # Always build; only push when registry login succeeded
+        push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
+        tags: ${{ steps.meta-backend.outputs.tags }}
+        labels: ${{ steps.meta-backend.outputs.labels }}
+        platforms: ${{ steps.platforms.outputs.platforms }}
+        cache-from: type=gha,scope=backend
+        cache-to: type=gha,mode=max,scope=backend
+        build-args: |
+          CACHEBUST=${{ github.run_number }}
+          BUILD_DATE=${{ github.event.head_commit.timestamp }}
+          VCS_REF=${{ github.sha }}
+          VERSION=${{ steps.meta-backend.outputs.version }}
+
+    - name: Run Trivy vulnerability scanner
+      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}:${{ steps.meta-backend.outputs.version }}
+        format: 'sarif'
+        output: 'trivy-backend.sarif'
+        severity: 'CRITICAL,HIGH'
+        timeout: '10m'
+
+    - name: Upload Trivy scan results to GitHub Security tab
+      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: 'trivy-backend.sarif'
+        category: 'backend-vulnerabilities'
+
+  build-frontend:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      security-events: write
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Determine build platforms
+      id: platforms
+      run: |
+        # For PRs, build only amd64 to avoid QEMU emulation issues
+        # For main/develop/tags, build multi-arch
+        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
+        else
+          echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      with:
+        platforms: ${{ steps.platforms.outputs.platforms }}
+
+    - name: Log in to Container Registry
+      if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
+      id: login-ghcr
+      continue-on-error: true
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Extract metadata for Frontend
+      id: meta-frontend
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}
+        labels: |
+          org.opencontainers.image.title=PicPeak Frontend
+          org.opencontainers.image.description=PicPeak photo sharing platform frontend application
+          org.opencontainers.image.vendor=PicPeak
+          maintainer=${{ github.repository_owner }}
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=semver,pattern={{version}}
+          type=semver,pattern={{major}}.{{minor}}
+          type=semver,pattern={{major}}
+          type=sha,format=short
+          type=raw,value=latest,enable={{is_default_branch}}
+
+    - name: Build and push Frontend Docker image
+      uses: docker/build-push-action@v5
+      with:
+        context: ./frontend
+        file: ./frontend/Dockerfile
+        # Always build; only push when registry login succeeded
+        push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
+        tags: ${{ steps.meta-frontend.outputs.tags }}
+        labels: ${{ steps.meta-frontend.outputs.labels }}
+        platforms: ${{ steps.platforms.outputs.platforms }}
+        cache-from: type=gha,scope=frontend
+        cache-to: type=gha,mode=max,scope=frontend
+        build-args: |
+          CACHEBUST=${{ github.run_number }}
+          BUILD_DATE=${{ github.event.head_commit.timestamp }}
+          VCS_REF=${{ github.sha }}
+          VERSION=${{ steps.meta-frontend.outputs.version }}
+
+    - name: Run Trivy vulnerability scanner
+      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}:${{ steps.meta-frontend.outputs.version }}
+        format: 'sarif'
+        output: 'trivy-frontend.sarif'
+        severity: 'CRITICAL,HIGH'
+        timeout: '10m'
+
+    - name: Upload Trivy scan results to GitHub Security tab
+      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: 'trivy-frontend.sarif'
+        category: 'frontend-vulnerabilities'
+
+  # Note: The publish-manifest job is not needed since docker/build-push-action@v5
+  # automatically creates multi-arch manifests when building for multiple platforms.
+  # The images are already properly tagged and include all architectures.
+
+  summary:
+    needs: [build-backend, build-frontend]
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    
+    steps:
+    - name: Build Summary
+      run: |
+        echo "## 🐳 Docker Build Summary" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        
+        if [[ "${{ needs.build-backend.result }}" == "success" ]]; then
+          echo "✅ **Backend**: Successfully built" >> $GITHUB_STEP_SUMMARY
+        else
+          echo "❌ **Backend**: Build failed" >> $GITHUB_STEP_SUMMARY
+        fi
+        
+        if [[ "${{ needs.build-frontend.result }}" == "success" ]]; then
+          echo "✅ **Frontend**: Successfully built" >> $GITHUB_STEP_SUMMARY
+        else
+          echo "❌ **Frontend**: Build failed" >> $GITHUB_STEP_SUMMARY
+        fi
+        
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "### 📦 Images" >> $GITHUB_STEP_SUMMARY
+        echo "- Backend: \`${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
+        echo "- Frontend: \`${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
+        
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "### 🏷️ Tags" >> $GITHUB_STEP_SUMMARY
+        echo "Images are tagged based on:" >> $GITHUB_STEP_SUMMARY
+        echo "- Branch name (for branch pushes)" >> $GITHUB_STEP_SUMMARY
+        echo "- PR number (for pull requests)" >> $GITHUB_STEP_SUMMARY
+        echo "- Version tags (for releases)" >> $GITHUB_STEP_SUMMARY
+        echo "- Short SHA with branch prefix" >> $GITHUB_STEP_SUMMARY
+        echo "- \`latest\` (for main branch)" >> $GITHUB_STEP_SUMMARY

.gitignore

@@ -11,6 +11,9 @@ yarn-error.log*
 .env.test.local
 .env.production.local
 
+# Docker override file
+docker-compose.override.yml
+
 # Security - Never commit credentials
 ADMIN_CREDENTIALS.txt
 ADMIN_PASSWORD_RESET.txt
@@ -59,4 +62,23 @@ test-archiver/
 !data/.gitkeep
 !logs/.gitkeep
 
-PRODUCTION_DEPLOYMENT_GUIDE.md
+# development files
+backend/.swarm/
+.claudedocs/
+backend/data/
+backend/docs/
+backend/logs/
+logs/
+storage/
+data/
+certbot/
+
+# Ignore local contributor guide copy
+AGENTS.md
+CLAUDE.md
+
+# Local artifacts from browser tooling
+.playwright-mcp/
+
+# Local SQLite files in backend
+backend/*.sqlite*

BACKUP_VERSION_TRACKING.md

@@ -1,152 +0,0 @@
-# Backup Version Tracking Implementation
-
-## Overview
-Version tracking has been added to the backup system to ensure safe restoration by tracking application versions, Node.js versions, and database schema versions at the time of backup.
-
-## Implementation Details
-
-### 1. Database Schema Changes (Migration 034)
-
-Added version tracking columns to backup tables:
-
-#### `database_backup_runs` table:
-- `app_version` - Application version from package.json
-- `node_version` - Node.js runtime version
-- `db_schema_version` - Latest migration name
-- `environment_info` - JSON with additional environment details
-
-#### `backup_runs` table:
-- `app_version` - Application version
-- `node_version` - Node.js version
-- `db_schema_version` - Database schema version
-- `manifest_info` - Summary of manifest information
-
-#### New `restore_history` table:
-Tracks all restore attempts with comprehensive version information:
-- Backup versions vs current versions
-- Compatibility check results
-- Warnings and errors
-- Restore outcome
-
-### 2. Version Information Captured
-
-During each backup, the system now records:
-- **Application Version**: From `package.json` (e.g., "1.0.77")
-- **Node.js Version**: Runtime version (e.g., "v18.17.0")
-- **Database Schema**: Latest migration file (e.g., "034_add_version_to_backups.js")
-- **Environment Info**: Platform, architecture, environment mode
-
-### 3. Backup Services Updated
-
-#### Database Backup Service (`databaseBackup.js`):
-- Records version info when creating backups
-- Includes versions in statistics JSON
-- New method: `checkVersionCompatibility()` for restore safety
-- New method: `getCurrentSchemaVersion()` to track migrations
-
-#### File Backup Service (`backupService.js`):
-- Records version info in backup_runs table
-- Integrates with manifest system
-- Stores manifest summary with version details
-
-### 4. Existing Manifest System
-
-The `backupManifest.js` already provides comprehensive version tracking:
-- Application version and Node.js version
-- System information (OS, platform, architecture)
-- Database schema version
-- Detailed file and database metadata
-
-### 5. Version Compatibility Checking
-
-When restoring, the system can now:
-- Compare backup version vs current version
-- Detect major/minor version differences
-- Identify schema mismatches
-- Provide warnings and recommendations
-
-### 6. Configuration Settings
-
-New backup settings for version control:
-- `backup_require_version_match` - Enforce exact version matching
-- `backup_allow_minor_version_mismatch` - Allow same major version
-- `backup_warn_on_version_mismatch` - Show warnings on mismatch
-- `backup_check_schema_compatibility` - Validate schema versions
-
-## Usage
-
-### Creating Backups
-Backups automatically capture version information - no changes needed to existing backup workflows.
-
-### Checking Version Before Restore
-
-1. **For Database Backups**:
-```javascript
-const compatibility = await databaseBackupService.checkVersionCompatibility({
-  app_version: '1.0.75',
-  node_version: 'v16.14.0',
-  db_schema_version: '032_add_feedback.js'
-});
-
-if (!compatibility.compatible) {
-  console.error('Version mismatch:', compatibility.errors);
-}
-```
-
-2. **For File Backups**:
-Check the manifest file which contains all version information:
-```bash
-cat /backup/path/manifest-backup-20250122-123456.json | jq '.application'
-```
-
-### Restore History
-All restore attempts are logged in the `restore_history` table with:
-- Version compatibility results
-- Warnings encountered
-- Success/failure status
-- Who performed the restore
-
-## Best Practices
-
-1. **Always Check Compatibility**: Before restoring, verify version compatibility
-2. **Document Version Changes**: Keep changelog updated with breaking changes
-3. **Test Restores**: Regularly test restore procedures in staging
-4. **Monitor Warnings**: Even if compatible, review warnings before proceeding
-5. **Keep Backups Organized**: Label backups with version info in filename
-
-## Migration Instructions
-
-1. Run the new migration:
-```bash
-cd backend
-npm run migrate
-```
-
-2. Existing backups will show "unknown" for version fields
-3. New backups will automatically include version information
-4. The system remains backward compatible with old backups
-
-## Troubleshooting
-
-### Version Mismatch Errors
-- Check current app version: `cat backend/package.json | grep version`
-- Check Node version: `node --version`
-- Check latest migration: `SELECT name FROM knex_migrations ORDER BY id DESC LIMIT 1`
-
-### Restore Failures
-- Review `restore_history` table for detailed error messages
-- Check version compatibility warnings
-- Consider using same version environment for critical restores
-
-## Future Enhancements
-
-1. **Automated Version Matching**: Docker containers with specific versions
-2. **Migration Rollback**: Support for downgrading schema safely
-3. **Version Matrix**: Compatibility matrix for different version combinations
-4. **Restore Wizard**: UI for guided restore with compatibility checks
-
----
-
-**Implementation Date**: January 2025
-**Current Version**: 1.0.77
-**Status**: Production Ready

CLAUDE.md

@@ -1,365 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Product Overview
-
-A secure photo sharing platform designed for weddings and events, enabling photographers to share time-limited, password-protected galleries. The platform features automatic expiration, archiving, and a scrappbook.de-inspired modern, minimalist UI.
-
-## Architecture Overview
-
-- **Backend**: Node.js/Express API with SQLite/PostgreSQL, file-based photo storage
-- **Frontend**: React SPA with scrappbook.de-style design (requires implementation)
-- **Storage**: File-based with active/archived separation
-- **Services**: Background workers for email, archiving, file watching, and expiration monitoring
-- **Analytics**: Umami integration for engagement tracking
-
-## Essential Commands
-
-### Backend Development
-```bash
-cd backend
-npm install               # Install dependencies
-npm run migrate          # Initialize database schema
-npm run dev              # Start with hot-reload (port 3001)
-npm test                 # Run Jest tests
-npm run lint             # ESLint checks
-```
-
-### Running a Single Test
-```bash
-cd backend
-npm test -- path/to/test.test.js
-npm test -- --testNamePattern="test name"
-```
-
-### Production
-```bash
-docker-compose -f docker-compose.prod.yml up -d  # Production deployment
-pm2 start ecosystem.config.js                     # Alternative: PM2 deployment
-```
-
-**⚠️ CRITICAL PRODUCTION NOTICE:**
-- Production runs on a SEPARATE SERVER - never assume local changes affect production
-- ALWAYS request production server details before any troubleshooting
-- NO trial-and-error approaches in production - data loss is unacceptable
-- Every change must be thoroughly analyzed and tested locally first
-
-## Key Product Requirements (from PRD)
-
-### Core Features
-1. **File-Based System**: Drop photos in folders → automatic gallery creation
-2. **Automatic Expiration**: Default 30 days, with 7-day warning emails
-3. **Password Protection**: Secure access with customizable passwords
-4. **Automatic Archiving**: ZIP compression and storage after expiration
-5. **Email Notifications**: Creation, warning, and expiration notifications
-6. **Analytics**: Umami tracking for views, downloads, and engagement
-
-### Folder Structure
-```
-/events/
-  ├── active/
-  │   ├── wedding-smith-jones-2024-06-15/
-  │   │   ├── collages/
-  │   │   └── individual/
-  │   └── birthday-emma-2024-07-20/
-  └── archived/
-      └── wedding-smith-jones-2024-06-15.zip
-```
-
-## Frontend Implementation Requirements
-
-### Design Style (scrappbook.de-inspired)
-- **Color Palette**: Primary green (#5C8762), neutral backgrounds
-- **Typography**: Clean, modern sans-serif (Noto Sans or similar)
-- **Layout**: Minimalist, modular sections with grid-based photo displays
-- **Aesthetic**: Professional yet approachable, photographer-focused
-
-### Key Frontend Components to Build
-1. **Landing Page**: Password entry with event preview
-2. **Gallery View**: 
-   - Responsive photo grid with lazy loading
-   - Toggle between collages/individual photos
-   - Prominent expiration banner
-   - Download urgency indicators
-3. **Photo Lightbox**: Full-screen viewing with zoom
-4. **Mobile-First**: Responsive design with touch gestures
-5. **Personalization**: Dynamic theming per event type
-
-### User Experience Priorities
-- Clear expiration warnings (sticky banner)
-- One-click "Download All" for urgent galleries
-- Smooth image loading with skeleton screens
-- Intuitive navigation between photo categories
-- Professional presentation matching photographer branding
-
-## Key Architecture Patterns
-
-### Authentication Flow
-- JWT-based with separate tokens for admin and gallery access
-- Gallery tokens include event-specific claims
-- Auth middleware: `backend/src/middleware/auth.js`
-  - `adminAuth` - Admin panel protection
-  - `photoAuth` - Protected photo access  
-  - `verifyGalleryAccess` - Gallery-specific validation
-
-### Database Schema (Knex/SQLite)
-Main tables:
-- `events` - Gallery metadata with expiration, custom messages, themes
-- `photos` - Photo records linked to events
-- `access_logs` - IP-based usage tracking
-- `email_queue` - Async email processing
-- `admin_users` - Admin authentication
-
-### Service Architecture
-Background services run as separate processes:
-- **emailService**: Processes email queue with retry logic
-- **archiveService**: Creates ZIP archives of expired events
-- **expirationChecker**: Cron job for expiration warnings
-- **fileWatcher**: Monitors for new photo uploads
-- **backupService**: Scheduled backups with checksum-based change detection
-
-### API Structure
-- `/api/admin/*` - Admin panel endpoints (requires adminAuth)
-- `/api/gallery/*` - Public gallery endpoints  
-- `/api/auth/*` - Authentication endpoints
-- Rate limiting: 100 req/15min (general), 5 req/15min (auth)
-
-## Critical Implementation Notes
-
-1. **Security**: All gallery access requires valid JWT with event-specific claims
-2. **Expiration**: Events auto-expire based on `expires_at`, with 7-day email warnings
-3. **Email Queue**: Async processing with retry logic, check `email_queue` table
-4. **File Processing**: Sharp library for thumbnail generation (300x300)
-5. **Frontend Status**: Only skeleton exists - requires full implementation based on PRD
-6. **Umami Analytics**: Track password entries, downloads, views, expiration warnings
-
-## Troubleshooting Guidelines
-
-### Before ANY Production Troubleshooting:
-1. **ALWAYS request specific details**:
-   - Production server URL/IP
-   - Current error messages/logs
-   - Recent changes or deployments
-   - Affected users/galleries
-   - Time of issue occurrence
-
-2. **Thorough Analysis Required**:
-   - Use detailed thinking/analysis for EVERY troubleshooting task
-   - Review all related code before suggesting changes
-   - Consider all potential side effects
-   - Never make assumptions about production environment
-
-3. **Safe Troubleshooting Steps**:
-   - First, reproduce issue in local/dev environment
-   - Analyze logs without modifying production
-   - Create detailed action plan before any changes
-   - Always have rollback strategy ready
-   - Document every step taken
-
-### Common Issues & Safe Approaches:
-- **Email not sending**: Check email_queue table, SMTP settings, service status
-- **Photos not loading**: Verify file permissions, storage paths, nginx config
-- **Gallery access issues**: Check JWT tokens, expiration dates, access_logs
-- **Performance problems**: Analyze with monitoring tools first, never experiment
-
-### Data Safety Rules:
-- NEVER delete or modify production data without explicit backup confirmation
-- ALWAYS verify backups exist before any data operations
-- NO direct database modifications without transaction safety
-- Log all actions for audit trail
-
-## Environment Variables
-
-### Backend (.env)
-- `JWT_SECRET` - Token signing
-- `ADMIN_URL`, `FRONTEND_URL` - CORS origins
-- `SMTP_*` - Email configuration
-- `DB_*` - PostgreSQL credentials (production)
-- `UMAMI_URL` - Umami instance URL (for server-side tracking)
-- `UMAMI_WEBSITE_ID` - Website ID from Umami
-
-### Frontend (.env)
-- `VITE_API_URL` - Backend API URL
-- `VITE_UMAMI_URL` - Umami analytics URL
-- `VITE_UMAMI_WEBSITE_ID` - Website ID from Umami
-- `VITE_UMAMI_SHARE_URL` - (Optional) Public share URL for embedded dashboard
-
-## Testing Approach
-- Jest with Supertest for API testing
-- Test files in `__tests__` directories
-- Database migrations run before tests
-- Mock email sending in tests
-
-## Umami Analytics Integration
-
-The frontend includes comprehensive Umami analytics integration for tracking user behavior and gallery performance.
-
-### Tracked Events:
-- **Gallery Events**:
-  - `gallery_password_entry` - Password attempts (success/failure)
-  - `gallery_photo_view` - Individual photo views
-  - `gallery_photo_download` - Single photo downloads
-  - `gallery_bulk_download` - Bulk/all photo downloads
-  - `gallery_expired` - Expired gallery access attempts
-- **Admin Events**:
-  - `admin_login` - Admin authentication
-  - `admin_event_created` - New event creation
-  - `admin_event_archived` - Event archiving
-  - `admin_event_deleted` - Event deletion
-  - `admin_settings_updated` - Settings changes
-- **User Behavior**:
-  - Search queries (with debouncing)
-  - Expiration warning views
-  - Page views with automatic tracking
-
-### Setup:
-1. Install Umami (self-hosted or cloud)
-2. Create a website in Umami dashboard
-3. Set environment variables:
-   ```
-   VITE_UMAMI_URL=https://your-umami-instance.com
-   VITE_UMAMI_WEBSITE_ID=your-website-id
-   VITE_UMAMI_SHARE_URL=https://your-umami-instance.com/share/...
-   ```
-
-### Analytics Dashboard:
-- Admin panel includes analytics page at `/admin/analytics`
-- Summary view with key metrics
-- Option to embed full Umami dashboard
-- Real-time event tracking
-
-## Accessibility & Performance Features
-
-### Accessibility (WCAG 2.1 AA Compliance)
-- **Error Boundaries**: Graceful error handling with recovery options
-- **Skip Links**: Skip to main content for keyboard navigation
-- **ARIA Labels**: Proper labeling for screen readers
-- **Focus Management**: Focus trap in modals, visible focus indicators
-- **Keyboard Navigation**: Full keyboard support in gallery lightbox (arrows, escape, +/-, d for download)
-- **Loading States**: Skeleton screens instead of spinners for better UX
-- **Offline Support**: Visual indicator when offline
-- **Form Validation**: Accessible error messages with aria-describedby
-
-### Performance Optimizations
-- **Lazy Loading**: Images load on scroll with Intersection Observer
-- **Skeleton Screens**: Instant visual feedback during loading
-- **Error Recovery**: Component-level error boundaries prevent full page crashes
-- **Optimistic Updates**: Immediate UI updates with background sync
-- **Debounced Search**: Prevents excessive API calls
-- **Analytics**: Non-blocking Umami integration
-
-### Component Library Enhancements
-- `<ErrorBoundary>` - Catches and displays errors gracefully
-- `<PageErrorBoundary>` - Full-page error recovery
-- `<Skeleton>` - Flexible skeleton loader with variants
-- `<OfflineIndicator>` - Network status monitoring
-- `<SkipLink>` - Accessibility navigation
-- `useFocusTrap` - Modal focus management hook
-- `useOnlineStatus` - Network status hook
-
-## Theme System & Branding
-
-### Theme Features
-- **Dynamic Theming**: CSS variables for runtime theme switching
-- **Preset Themes**: Default, Wedding, Birthday, Corporate, Minimal
-- **Customization Options**:
-  - Primary/Accent/Background/Text colors
-  - Font family selection
-  - Border radius (none, sm, md, lg)
-  - Custom logo upload
-  - Custom CSS injection
-- **Event-Specific Themes**: Override global theme per gallery
-- **Live Preview**: Real-time theme changes in admin panel
-
-### Theme Context API
-```typescript
-const { theme, setTheme, setThemeByName } = useTheme();
-```
-
-### Branding Settings
-- Company name, tagline, and support email
-- Custom footer text
-- Optional watermarking on downloads
-- Logo upload for gallery header
-
-### CSS Variables
-```css
---color-primary: #5C8762;
---color-primary-light: #7aa583;
---color-primary-dark: #4a6f4f;
---color-accent: #22c55e;
---color-background: #fafafa;
---color-text: #171717;
---font-family: 'Inter', sans-serif;
---border-radius: 0.5rem;
-```
-
-## Backup Service
-
-### Overview
-The backup service provides automated, scheduled backups of all photo data with checksum-based change detection to minimize transfer overhead.
-
-### Features
-- **Multiple Destinations**: Local directory, remote server (rsync), S3-compatible storage
-- **Change Detection**: SHA256 checksums track file changes, only modified files are backed up
-- **Scheduled Execution**: Configurable cron-based scheduling (default: 2 AM daily)
-- **Email Notifications**: Alerts on backup failure, optional success notifications
-- **Retention Management**: Automatic cleanup of old backup runs based on retention policy
-- **Progress Tracking**: Database storage of backup history, file states, and statistics
-
-### Configuration
-Backup settings are stored in `app_settings` table with `backup_` prefix:
-- `backup_enabled`: Enable/disable the service
-- `backup_schedule`: Cron expression (e.g., '0 2 * * *')
-- `backup_destination_type`: 'local', 'rsync', or 's3'
-- `backup_retention_days`: How long to keep backup history
-- `backup_include_archived`: Whether to backup archived events
-- `backup_exclude_patterns`: File patterns to exclude
-
-### API Endpoints
-- `GET /api/admin/backup/config` - Get current configuration
-- `PUT /api/admin/backup/config` - Update configuration
-- `GET /api/admin/backup/status` - Get backup status and history
-- `POST /api/admin/backup/run` - Trigger manual backup
-- `POST /api/admin/backup/test-connection` - Test destination connectivity
-
-### Testing
-Run backup service test: `npm run test-backup`
-
-### Database Tables
-- `backup_runs`: Tracks each backup execution with statistics
-- `backup_file_states`: Stores file checksums for change detection
-
-## Success Metrics (from PRD)
-- Time to generate gallery: <2 minutes
-- Guest satisfaction: >90%
-- System uptime: 99.9%
-- Email delivery rate: >98%
-- Successful archiving: 100%
-
-## Documentation & Development Practices
-
-### Documentation Guidelines:
-- **NEVER create new documentation files for simple tasks**
-- **ALWAYS update existing documentation (like this CLAUDE.md)**
-- Only create new .md files when explicitly requested
-- Avoid creating temporary scripts for one-off tasks
-
-### Development Best Practices:
-- Test all changes thoroughly in local environment first
-- Use version control for all changes
-- Keep commits atomic and well-described
-- Review impact on all integrated services
-- Consider backward compatibility
-- Update tests when changing functionality
-
-### Production Deployment Checklist:
-- [ ] All tests passing locally
-- [ ] Linting and type checks pass
-- [ ] Database migrations tested with rollback plan
-- [ ] Environment variables documented
-- [ ] Backup strategy confirmed
-- [ ] Monitoring alerts configured
-- [ ] Rollback procedure documented
-- [ ] Stakeholders notified of maintenance window

CODE_OF_CONDUCT.md

@@ -20,7 +20,7 @@ We are committed to providing a welcoming and inspiring community for all photog
 
 ## Enforcement
 
-Instances of unacceptable behavior may be reported to the project team at conduct@example.com. All complaints will be reviewed and investigated promptly and fairly.
+Instances of unacceptable behavior may be reported by [opening an issue](https://github.com/the-luap/picpeak/issues/new?labels=conduct) on GitHub. All complaints will be reviewed and investigated promptly and fairly.
 
 ## Attribution
 

CONTRIBUTING.md

@@ -153,8 +153,8 @@ picpeak/
 
 ## 📮 Contact
 
-- Create an issue for bugs or features
-- Join discussions for questions
-- Email: picpeak@example.com for security issues
+- Create an [issue](https://github.com/the-luap/picpeak/issues) for bugs or features
+- Join [discussions](https://github.com/the-luap/picpeak/discussions) for questions
+- Security issues: Open a [security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub
 
 Thank you for contributing! 🎉

DEPLOYMENT.md

@@ -1,220 +0,0 @@
-# 🚀 PicPeak Deployment Guide
-
-This guide will help you deploy PicPeak in production. The entire process takes about 10-15 minutes.
-
-## 📋 Prerequisites
-
-- A server with Docker and Docker Compose installed
-- A domain name (for SSL certificates)
-- SMTP credentials for sending emails
-- Basic command line knowledge
-
-## 🏃 Quick Deploy (Recommended)
-
-### 1. Clone and Configure
-
-```bash
-# Clone the repository
-git clone https://github.com/the-luap/picpeak.git
-cd picpeak
-
-# Copy environment template
-cp .env.production.example .env
-
-# Generate a secure JWT secret
-echo "JWT_SECRET=$(openssl rand -base64 32)" >> .env
-
-# Edit configuration
-nano .env
-```
-
-### 2. Required Environment Variables
-
-Edit your `.env` file with these essential settings:
-
-```env
-# Application URLs
-FRONTEND_URL=https://your-domain.com
-BACKEND_URL=https://your-domain.com
-
-# Email Configuration (Required for notifications)
-SMTP_HOST=smtp.gmail.com
-SMTP_PORT=587
-SMTP_USER=your-email@gmail.com
-SMTP_PASS=your-app-password
-SMTP_FROM=your-email@gmail.com
-
-# Admin Configuration
-ADMIN_EMAIL=admin@your-domain.com
-ADMIN_PASSWORD=your-secure-password
-
-# Database (PostgreSQL for production)
-DATABASE_CLIENT=pg
-DB_HOST=postgres
-DB_NAME=picpeak
-DB_USER=picpeak
-DB_PASSWORD=secure-db-password
-```
-
-### 3. Deploy with Docker Compose
-
-```bash
-# Start all services
-docker-compose -f docker-compose.prod.yml up -d
-
-# Check logs
-docker-compose logs -f
-
-# Access your site at https://your-domain.com
-```
-
-## 🔧 Configuration Options
-
-### Storage Settings
-
-```env
-# Storage paths (default: ./storage)
-STORAGE_PATH=./storage
-ARCHIVE_PATH=./storage/archives
-
-# Gallery expiration (days)
-DEFAULT_EXPIRATION_DAYS=30
-WARNING_DAYS_BEFORE_EXPIRY=7
-```
-
-### Security Settings
-
-```env
-# Session timeout (minutes)
-SESSION_TIMEOUT=60
-
-# Rate limiting
-RATE_LIMIT_WINDOW_MS=900000  # 15 minutes
-RATE_LIMIT_MAX_REQUESTS=100
-```
-
-### Analytics (Optional)
-
-```env
-# Umami Analytics
-VITE_UMAMI_URL=https://analytics.your-domain.com
-VITE_UMAMI_WEBSITE_ID=your-website-id
-```
-
-## 🔒 SSL/TLS Setup
-
-The production Docker Compose includes automatic SSL via Let's Encrypt:
-
-1. **Ensure your domain points to your server**
-2. **Update nginx configuration**:
-   ```bash
-   nano nginx/nginx.conf
-   # Replace your-domain.com with your actual domain
-   ```
-3. **Start services** - Certbot will automatically obtain certificates
-
-## 📁 Directory Structure
-
-After deployment, your directory structure will be:
-
-```
-picpeak/
-├── backend/          # API server
-├── frontend/         # React app
-├── storage/          # Photo storage
-│   ├── events/       # Active galleries
-│   │   ├── active/   # Current photos
-│   │   └── archived/ # Expired galleries
-│   ├── thumbnails/   # Generated thumbnails
-│   └── uploads/      # User uploads
-├── data/            # Database files
-└── logs/            # Application logs
-```
-
-## 🔄 Maintenance
-
-### Backup
-
-```bash
-# Backup database and photos
-./scripts/backup.sh
-
-# Backups are stored in ./backups/
-```
-
-### Update
-
-```bash
-# Pull latest changes
-git pull
-
-# Rebuild and restart
-docker-compose -f docker-compose.prod.yml up -d --build
-```
-
-### Logs
-
-```bash
-# View all logs
-docker-compose logs
-
-# View specific service
-docker-compose logs backend
-docker-compose logs frontend
-```
-
-## 🚨 Troubleshooting
-
-### Common Issues
-
-**Photos not appearing:**
-- Check storage permissions: `chmod -R 755 storage/`
-- Verify file watcher is running: `docker-compose logs backend | grep watcher`
-
-**Email not sending:**
-- Test SMTP settings: Admin Panel → Settings → Email → Send Test
-- Check email queue: Admin Panel → System → Email Queue
-
-**Can't access admin panel:**
-- Default login: Use email/password from `.env`
-- Reset password: `docker exec picpeak-backend npm run reset-admin`
-
-### Health Check
-
-```bash
-# Check service status
-docker-compose ps
-
-# Test backend API
-curl https://your-domain.com/api/health
-
-# Check disk space
-df -h storage/
-```
-
-## 🐳 Alternative Deployment Methods
-
-### Using Docker Swarm
-
-For high availability deployments, see [Docker Swarm Setup](deploy/README.md).
-
-### Manual Installation
-
-If you prefer not to use Docker:
-
-1. Install Node.js 18+
-2. Install PostgreSQL
-3. Clone repository
-4. Install dependencies: `npm install` in both `/backend` and `/frontend`
-5. Build frontend: `cd frontend && npm run build`
-6. Start services with PM2
-
-## 📞 Support
-
-- 📘 [Documentation](https://github.com/the-luap/picpeak)
-- 🐛 [Report Issues](https://github.com/the-luap/picpeak/issues)
-- 💬 [Discussions](https://github.com/the-luap/picpeak/discussions)
-
----
-
-**Need help?** Open an issue on GitHub and we'll assist you!

DEPLOYMENT_GUIDE.md

@@ -0,0 +1,822 @@
+# 🚀 PicPeak Deployment Guide
+
+This guide covers multiple deployment options for PicPeak, from simple local setups to production-ready configurations.
+
+## 🎯 Quick Start - Simple Setup (Recommended for Beginners)
+
+For the easiest installation without Docker or complex configurations, use our **unified setup script**:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/picpeak-setup.sh -o picpeak-setup.sh && \
+chmod +x picpeak-setup.sh && \
+sudo ./picpeak-setup.sh
+```
+
+This automated script handles everything including:
+- Choice between Docker or Native installation
+- OS detection and dependency installation
+- Database setup and service configuration
+- SSL/HTTPS setup (optional)
+
+Perfect for:
+- Small to medium deployments
+- Local or VPS installations  
+- Users new to server management
+- Quick testing and evaluation
+
+👉 **See [SIMPLE_SETUP.md](./SIMPLE_SETUP.md) for detailed instructions.**
+
+---
+
+## 🐳 Docker Compose Deployment
+
+### Option 1: Using Pre-built Images (Recommended)
+
+PicPeak provides official Docker images via GitHub Container Registry for quick deployment without building:
+
+```bash
+# Clone repository for configuration files
+git clone https://github.com/the-luap/picpeak.git
+cd picpeak
+
+# Copy and configure environment
+cp .env.example .env
+nano .env  # Edit with your values
+
+# Use pre-built images deployment
+docker compose -f docker-compose.production.yml up -d
+```
+
+The production compose file uses:
+- **Backend**: `ghcr.io/the-luap/picpeak/backend:latest`
+- **Frontend**: `ghcr.io/the-luap/picpeak/frontend:latest`
+
+Available tags:
+- `latest` - Latest stable release
+- `main` - Latest main branch build
+- `develop` - Development branch (may be unstable)
+- `v1.0.0` - Specific version tags
+
+### Option 2: Building from Source
+
+If you need to customize the application or the pre-built images aren't available, you can build locally:
+
+## 📋 Table of Contents
+
+- [Prerequisites](#prerequisites)
+- [Quick Start](#quick-start)
+- [Configuration](#configuration)
+- [Deployment](#deployment)
+- [First Login](#first-login)
+- [Reverse Proxy Setup](#reverse-proxy-setup)
+- [Maintenance](#maintenance)
+- [Troubleshooting](#troubleshooting)
+ - [External Media Library](#external-media-library)
+
+## Prerequisites
+
+- Docker and Docker Compose installed
+- Domain name (for production)
+- SMTP server credentials for emails
+- At least 2GB RAM and 20GB storage
+
+## 🚀 Quick Start
+
+### Method 1: Using Pre-built Images (Fastest)
+
+1. **Clone the repository for configs**
+   ```bash
+   git clone https://github.com/the-luap/picpeak.git
+   cd picpeak
+   ```
+
+2. **Set up environment**
+   ```bash
+   cp .env.example .env
+   nano .env  # Edit with your values
+   ```
+
+3. **Create required directories**
+   ```bash
+   mkdir -p events/active events/archived data logs backup storage
+   chmod -R 755 events data logs backup storage
+   ```
+
+4. **Deploy using pre-built images**
+   ```bash
+   docker compose -f docker-compose.production.yml up -d
+   ```
+
+5. **Check logs**
+   ```bash
+   docker compose -f docker-compose.production.yml logs -f
+   ```
+
+## External Media Library
+
+PicPeak can reference an existing, read‑only media library mounted into the backend container. This avoids copying originals into PicPeak storage.
+
+- Map your host library path to the container as read‑only in `docker-compose.production.yml`:
+  - Add volume under `backend`: `- ${EXTERNAL_MEDIA}:/external-media:ro`
+  - Add backend env: `EXTERNAL_MEDIA_ROOT=/external-media`
+- In `.env`, set:
+  - `EXTERNAL_MEDIA=/mnt/photos` (example host path)
+  - `EXTERNAL_MEDIA_ROOT=/external-media`
+
+Usage:
+- In Admin → Events, set “Source Mode” to “Reference (external folder)”, select a folder under `/external-media`, then import to index and generate thumbnails. Originals stay in your library.
+
+Backups and Archives:
+- Backups only include data under `STORAGE_PATH` and exclude external originals. The backup manifest includes `metadata.external_references = { excluded: true, events: N, photos: M }` and the Admin UI surfaces a warning.
+- Archiving reference events creates a manifest‑only ZIP and deletes thumbnails for that event. External originals are never moved or deleted.
+
+Local (npm) setup (no Docker):
+
+1. Create or choose a folder that contains your external originals, e.g. `/Users/you/Pictures/picpeak-external` (macOS/Linux) or `C:\\Pictures\\picpeak-external` (Windows).
+2. In `backend/.env` (or your shell), set:
+   - `EXTERNAL_MEDIA_ROOT=/absolute/path/to/picpeak-external`
+   - Ensure `STORAGE_PATH` points to your PicPeak storage (defaults to `./storage`).
+3. Start services from source:
+   - Backend: `cd backend && npm install && npm run migrate && JWT_SECRET=... npm start`
+   - Frontend: `cd frontend && npm install && npm run dev` (or build + serve)
+4. In Admin → Events:
+   - Create an event, set “Source Mode” to “Reference (external folder)”.
+   - Use the folder picker to browse under your `EXTERNAL_MEDIA_ROOT` and select the subfolder to reference.
+   - Click “Import from selected folder” to index files and generate thumbnails on demand.
+
+Notes:
+- PicPeak only reads from `EXTERNAL_MEDIA_ROOT`; it never modifies or deletes your originals there.
+- Thumbnails are generated under `STORAGE_PATH/thumbnails` and are included in backups; originals in `EXTERNAL_MEDIA_ROOT` are excluded.
+- On Windows, use absolute paths (e.g., `C:\\Photos\\Library`) for `EXTERNAL_MEDIA_ROOT`.
+
+### Method 2: Building from Source
+
+1. **Clone the repository**
+   ```bash
+   git clone https://github.com/the-luap/picpeak.git
+   cd picpeak
+   ```
+
+2. **Set up environment**
+   ```bash
+   cp .env.example .env
+   nano .env  # Edit with your values
+   ```
+
+3. **Create required directories**
+   ```bash
+   mkdir -p events/active events/archived data logs backup storage
+   chmod -R 755 events data logs backup storage
+   ```
+
+4. **Build and deploy**
+   ```bash
+   docker compose build
+   docker compose up -d
+   ```
+
+5. **Check logs**
+   ```bash
+   docker compose logs -f
+   ```
+
+## 🔧 Configuration
+
+### Essential Environment Variables
+
+Generate secure values:
+```bash
+# JWT Secret
+openssl rand -base64 64
+
+# Database Password (avoid $ character - see warning below)
+openssl rand -base64 32 | tr -d '$'
+
+# Redis Password (avoid $ character - see warning below)
+openssl rand -base64 32 | tr -d '$'
+```
+
+⚠️ **PASSWORD WARNING**: Docker Compose interprets `$` as variable substitution. Either:
+- Avoid `$` in passwords (recommended - use the commands above)
+- Escape `$` as `$$` (e.g., `Pass$$word` instead of `Pass$word`)
+- Quote the entire value: `DB_PASSWORD='Pass$word'` (less reliable)
+
+### Public Landing Page
+
+- `npm run migrate` now seeds three general settings: `general_public_site_enabled`, `general_public_site_html`, and `general_public_site_custom_css` so existing installs stay disabled by default.
+- Configure the feature from **Admin → CMS Pages**. The landing page panel exposes the toggle, HTML editor, optional CSS overrides, preview, and a reset-to-default action.
+- All HTML and CSS submitted through the UI is sanitized server-side. Scripts, inline event handlers, disallowed attributes, `@import` rules, and `javascript:` URLs are stripped before content is cached or rendered.
+- Resetting via the UI (or calling `POST /api/admin/settings/public-site/reset`) restores the bundled template and clears custom CSS.
+- The landing page response is cached in-memory. Override the default 60s cache window by setting `PUBLIC_SITE_CACHE_TTL_MS` (milliseconds) in your environment if you need faster cache busting.
+- When the toggle is off PicPeak continues to serve the SPA/login redirect at `/`, preserving legacy behaviour until you explicitly enable the feature.
+
+### Backend Configuration (.env)
+Update `.env` with:
+- `JWT_SECRET` - Authentication secret (REQUIRED - generate a secure random value)
+- `DB_PASSWORD` - PostgreSQL password
+- `REDIS_PASSWORD` - Redis password
+- `SMTP_*` - Email configuration
+- **URL Configuration** (for backend CORS):
+  - `FRONTEND_URL` - Frontend origin (use full URL with scheme, no trailing slash)
+    - Example (Docker): `http://localhost:3000`
+- `ADMIN_URL` - Admin origin (same as `FRONTEND_URL` for Docker; full URL, no trailing slash)
+  - Example (Docker): `http://localhost:3000`
+  
+  Notes:
+  - Do not include trailing `/` (e.g., use `http://host:3000`, not `http://host:3000/`).
+  - Always include the scheme (`http://` or `https://`).
+  - The backend compares origins strictly for CORS; malformed values will cause login requests to fail with 500.
+
+#### Authentication Security
+- Configure login attempt thresholds from **Admin → Settings → Security**. Defaults are 5 failed attempts per IP within 15 minutes, resulting in a 30 minute lockout.
+
+#### External Database Example
+To use an external PostgreSQL instead of the bundled container, set the following in `.env` and ensure the `postgres` service is disabled or removed:
+
+```env
+DB_HOST=db.example.com
+DB_PORT=5432
+DB_USER=picpeak
+DB_PASSWORD=change_me
+DB_NAME=picpeak_prod
+```
+
+Compose uses these values via `env_file: .env`. The backend service also defaults `DB_HOST=${DB_HOST:-postgres}` so if you don’t set `DB_HOST` it will use the bundled `postgres` container.
+
+### Frontend Configuration (frontend/.env)
+Create `frontend/.env` from `frontend/.env.example`:
+```bash
+cp frontend/.env.example frontend/.env
+```
+
+Update `frontend/.env` with:
+- `VITE_API_URL` - Backend API URL
+  - Docker (pre-built images) and production behind reverse proxy: `/api` (recommended; avoids CORS and matches the frontend Nginx proxy in the image)
+  - Local dev (Vite): `http://localhost:3001` or `/api` if proxying through a dev proxy
+
+Note: When using pre-built frontend images, runtime container env does not change the already-built JS. Prefer the default `/api` and let the frontend Nginx proxy forward to the backend.
+
+⚠️ **IMPORTANT PORT CONFIGURATION**: 
+- The frontend runs on port **3000** in Docker (exposed via nginx)
+- The backend API runs on port **3001**
+- The frontend `.env` file MUST point to the correct backend port (3001)
+- Default `.env.example` is configured for Docker deployment
+
+### Email Configuration Examples
+
+#### Gmail
+```env
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=your-email@gmail.com
+SMTP_PASS=your-app-specific-password
+```
+
+#### SendGrid
+```env
+SMTP_HOST=smtp.sendgrid.net
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=apikey
+SMTP_PASS=your-sendgrid-api-key
+```
+
+## 📦 Deployment
+
+### Using Pre-built Images (Fastest)
+
+```bash
+# Pull latest images from GitHub Container Registry
+docker pull ghcr.io/the-luap/picpeak/backend:latest
+docker pull ghcr.io/the-luap/picpeak/frontend:latest
+
+# Start services using production compose file
+docker compose -f docker-compose.production.yml up -d
+
+# View running containers
+docker compose ps
+```
+
+### Building from Source (For Customization)
+
+```bash
+# Build images locally
+docker compose build
+
+# Or build with no cache for clean build
+docker compose build --no-cache
+
+# Start all services
+docker compose up -d
+
+# View running containers
+docker compose ps
+```
+
+### Access Points
+
+By default, services are exposed on:
+- Frontend (UI + Admin): http://localhost:3000 (admin at `/admin`)
+- Backend/API: http://localhost:3001 (API only; no UI routes)
+- PostgreSQL: localhost:5432 (if needed)
+- Redis: localhost:6379 (if needed)
+
+### Initial Admin Setup
+
+When deploying for the first time, an admin account is automatically created with a secure, randomly generated password. This password is displayed in the Docker logs during initialization and **must be changed** on first login.
+
+#### Finding the Auto-Generated Admin Password
+
+The admin password is automatically generated during the first startup and displayed in the backend container logs. Here's how to find it:
+
+**Option 1: Search Docker logs for admin password** (recommended)
+```bash
+# Find the auto-generated admin password in logs
+docker compose logs backend | grep "Admin password"
+```
+
+You should see output like:
+```
+✅ Admin password generated: BraveTiger6231!
+```
+
+**Option 2: View the complete initialization logs**
+```bash
+# View the complete admin setup logs
+docker compose logs backend | grep -A 10 "Admin user created"
+```
+
+**Option 3: Check the saved credentials file**
+```bash
+# The password is also saved in the backend container
+docker exec picpeak-backend cat data/ADMIN_CREDENTIALS.txt
+```
+
+**Option 4: Use the helper script**
+```bash
+# Show current admin username and email (password is hidden)
+docker exec picpeak-backend node scripts/show-admin-credentials.js
+
+# Reset the admin password to a new random password
+docker exec picpeak-backend node scripts/show-admin-credentials.js --reset
+```
+
+#### Important Security Notes
+
+- **Login requires the email address**, not username
+- The admin password is only displayed once during initial setup
+- **Password change is MANDATORY** on first login - the system will force you to change it
+- If you lose the password before first login, use the `--reset` option to generate a new one
+- New password requirements: minimum 12 characters, mixed case, numbers, and special characters
+
+## 🔐 First Login
+
+After deployment, you must complete the first login process which includes mandatory password change for security.
+
+### Step 1: Locate Your Admin Password
+
+1. **Find the auto-generated password** from the credentials file:
+   ```bash
+   # Docker deployment
+   docker compose exec backend cat /app/data/ADMIN_CREDENTIALS.txt
+   
+   # Or directly from the host (if you have access)
+   cat data/ADMIN_CREDENTIALS.txt
+   ```
+
+2. **Note the admin email** (default: `admin@example.com` unless customized)
+
+### Step 2: Access Admin Panel
+
+1. Navigate to your frontend domain and open the admin section:
+   - `http://your-domain.com/admin` (behind reverse proxy)
+   - `http://localhost:3000/admin` (Docker local)
+   
+   The backend at `:3001` serves API only and does not serve the admin UI.
+2. Login using:
+   - **Email**: `admin@example.com` (or your custom admin email)
+   - **Password**: The auto-generated password from the logs
+
+### Step 3: Mandatory Password Change
+
+Upon first login, the system will **automatically redirect** you to change your password:
+
+1. **You cannot skip this step** - it's enforced for security
+2. Enter the current auto-generated password
+3. Create a new secure password meeting these requirements:
+   - Minimum 12 characters
+   - At least one uppercase letter
+   - At least one lowercase letter
+   - At least one number
+   - At least one special character (!@#$%^&*)
+
+### Security Best Practices for New Password
+
+- **Use a unique password** not used elsewhere
+- **Consider a password manager** for generation and storage
+- **Include mixed characters**: `MySecureP@ssw0rd2024!`
+- **Avoid personal information** (names, dates, etc.)
+- **Save securely** - you cannot recover this password easily
+
+### If You Lose Access
+
+If you lose your admin credentials after the first login, you'll need to manually reset the password in the database or create a new admin user through the database.
+
+**Note**: The credentials file (`ADMIN_CREDENTIALS.txt`) is only created during initial deployment and contains the first admin password. After changing the password, this file becomes outdated but is kept for reference. If you need to regenerate the password and file during a reinstall, re-run the installer with the `--force-admin-password-reset` flag:
+
+```bash
+# Native reinstall example
+sudo ./picpeak-setup.sh --native --force-admin-password-reset
+
+# Docker reinstall example
+sudo ./picpeak-setup.sh --docker --force-admin-password-reset
+```
+
+The flag calls `scripts/reset-admin-password.js` in non-interactive mode, writes a fresh random password into `data/ADMIN_CREDENTIALS.txt`, and prints the new credentials at the end of the installer run.
+
+#### Configuring Admin Email
+
+By default, the admin email is `admin@example.com`. To use a different email address, set it in your `.env` file before first deployment:
+
+```env
+# .env
+ADMIN_EMAIL=your-email@yourdomain.com
+```
+
+**Note**: This only works on first deployment. To change the admin email after deployment, you'll need to update it in the database or create a new admin user through the admin panel.
+
+## 🔒 Reverse Proxy Setup
+
+For production deployments, you should use a reverse proxy for SSL/HTTPS. The application exposes ports directly, allowing you to use any reverse proxy solution.
+
+### Option 1: Nginx
+
+Install nginx and create `/etc/nginx/sites-available/picpeak`:
+
+```nginx
+server {
+    listen 80;
+    server_name your-domain.com;
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name your-domain.com;
+
+    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;
+
+    # Frontend
+    location / {
+        proxy_pass http://localhost:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Frontend (serves UI and /admin/*)
+    location / {
+        proxy_pass http://localhost:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Backend API and protected resources
+    location /api {
+        proxy_pass http://localhost:3001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+    location ~ ^/(photos|thumbnails|uploads) {
+        proxy_pass http://localhost:3001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+```
+
+Enable the site:
+```bash
+sudo ln -s /etc/nginx/sites-available/picpeak /etc/nginx/sites-enabled/
+sudo nginx -t
+sudo systemctl reload nginx
+```
+
+### Option 2: Traefik
+
+Add labels to `docker-compose.override.yml`:
+
+```yaml
+version: '3.8'
+
+services:
+  frontend:
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.picpeak.rule=Host(`your-domain.com`)"
+      - "traefik.http.routers.picpeak.entrypoints=websecure"
+      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
+      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
+
+  backend:
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.picpeak-api.rule=Host(`your-domain.com`) && PathPrefix(`/api`)"
+      - "traefik.http.routers.picpeak-api.entrypoints=websecure"
+      - "traefik.http.routers.picpeak-api.tls.certresolver=letsencrypt"
+      - "traefik.http.services.picpeak-api.loadbalancer.server.port=3001"
+```
+
+### Option 3: Caddy
+
+Create a `Caddyfile`:
+
+```caddyfile
+your-domain.com {
+    # Frontend
+    handle /* {
+        reverse_proxy localhost:3000
+    }
+
+    # Backend API and admin
+    handle /api/* {
+        reverse_proxy localhost:3001
+    }
+    
+    handle /admin/* {
+        reverse_proxy localhost:3001
+    }
+
+    # Protected resources
+    handle /photos/* {
+        reverse_proxy localhost:3001
+    }
+
+    handle /thumbnails/* {
+        reverse_proxy localhost:3001
+    }
+
+    handle /uploads/* {
+        reverse_proxy localhost:3001
+    }
+}
+```
+
+### SSL Certificates
+
+For any reverse proxy, you can use Let's Encrypt:
+
+```bash
+# With Certbot
+sudo certbot certonly --webroot -w /var/www/certbot -d your-domain.com
+
+# Or use your reverse proxy's built-in ACME support
+```
+
+## 🔧 Maintenance
+
+### Viewing Logs
+
+```bash
+# All services
+docker compose logs -f
+
+# Specific service
+docker compose logs -f backend
+docker compose logs -f frontend
+```
+
+### Backup
+
+#### Manual Backup
+```bash
+# Database backup
+docker exec picpeak-postgres pg_dump -U picpeak picpeak_prod > backup/db_$(date +%Y%m%d_%H%M%S).sql
+
+# Files backup
+tar -czf backup/photos_$(date +%Y%m%d_%H%M%S).tar.gz events/
+```
+
+#### Automated Backup
+The application includes a built-in backup service. Configure it in the admin panel:
+1. Login to admin panel
+2. Go to Settings → Backup
+3. Configure destination and schedule
+4. Enable backup service
+
+### Updates
+
+#### Method 1: Using Pre-built Images (Recommended)
+
+```bash
+# Pull latest changes (for configuration updates)
+git pull
+
+# Pull latest images from GitHub Container Registry
+docker compose -f docker-compose.production.yml pull
+
+# Restart with new images
+docker compose -f docker-compose.production.yml down
+docker compose -f docker-compose.production.yml up -d
+
+# Verify services are healthy
+docker compose -f docker-compose.production.yml ps
+```
+
+#### Method 2: Building from Source
+
+```bash
+# Pull latest changes
+git pull
+
+# Rebuild and restart
+docker compose down
+docker compose build --no-cache
+docker compose up -d
+
+# Verify services are healthy
+docker compose ps
+```
+
+#### Specific Version Updates
+
+To use a specific version of the images:
+
+```bash
+# Edit docker-compose.production.yml to specify version tags
+# Change: ghcr.io/the-luap/picpeak/backend:latest
+# To:     ghcr.io/the-luap/picpeak/backend:v1.0.0
+
+# Then pull and restart
+docker compose -f docker-compose.production.yml pull
+docker compose -f docker-compose.production.yml up -d
+```
+
+### Database Migrations
+
+Migrations run automatically on startup, but you can run them manually:
+
+```bash
+docker exec picpeak-backend npm run migrate
+```
+
+## 🚨 Troubleshooting
+
+### Common Issues
+
+#### 502 Bad Gateway / Login Failures
+**This is the most common deployment issue!** Usually caused by misconfigured URLs or network problems:
+
+1. **CORS Configuration Errors**:
+   ```bash
+   # WRONG - Missing port will cause CORS errors
+   FRONTEND_URL=http://10.0.252.12
+   
+   # CORRECT - Include the port you're accessing from
+   FRONTEND_URL=http://10.0.252.12:3000
+   ```
+   
+   The backend validates Origin headers against `FRONTEND_URL` for CORS. If they don't match exactly, you'll get 500 errors on login.
+
+2. **After Container Restarts**:
+   - Nginx may have cached old container IPs
+   - Solution: `docker restart picpeak-frontend`
+   - Always wait 30-60 seconds for health checks
+
+3. **Backend Not Starting After Migrations**:
+   - The logs may only show migrations completed
+   - Check if server is actually running: `docker exec picpeak-backend ps aux | grep node`
+   - Should see `node server.js` process
+
+4. **Login After Fresh Install**:
+   - Check backend logs for auto-generated admin password: `docker compose logs backend | grep "Admin password"`
+   - Email: `admin@example.com` (or your custom admin email from .env)
+   - Password: Auto-generated and shown in logs (e.g., `BraveTiger6231!`)
+   - Remember: Password MUST be changed on first login
+
+5. **Complete Fix Sequence**:
+   ```bash
+   # 1. Fix your .env file URLs
+   # 2. Full restart
+   docker-compose down
+   docker-compose up -d
+   
+   # 3. Wait for healthy status
+   sleep 60
+   docker ps  # All should show (healthy)
+   
+   # 4. Test backend directly
+   curl http://localhost:3001/health
+   
+   # 5. Test through frontend
+   curl http://localhost:3000/api/public/settings
+   ```
+
+#### Port Already in Use
+```bash
+# Check what's using the port
+sudo lsof -i :3000
+sudo lsof -i :3001
+
+# Change ports in .env
+FRONTEND_PORT=3002
+BACKEND_PORT=3003
+```
+
+#### Docker Compose Variable Substitution Errors
+If you see warnings like:
+```
+WARN[0000] The "fgbf" variable is not set. Defaulting to a blank string.
+```
+
+This means your password contains `$` which Docker Compose interprets as a variable. Solutions:
+1. **Best**: Generate passwords without `$`: `openssl rand -base64 32 | tr -d '$'`
+2. **Alternative**: Escape `$` as `$$` in your .env file
+3. **Example**: `DB_PASSWORD=Pass@#$$fgbf` instead of `DB_PASSWORD=Pass@#$fgbf`
+
+#### Permission Errors
+```bash
+# Fix ownership
+sudo chown -R 1000:1000 events data logs backup storage
+chmod -R 755 events data logs backup storage
+```
+
+#### Database Connection Issues
+```bash
+# Check if database is running
+docker compose ps
+docker compose logs postgres
+
+# Test connection
+docker exec picpeak-postgres pg_isready
+```
+
+#### Email Not Sending
+- Verify SMTP settings in .env
+- Check email queue: `docker exec picpeak-backend psql -U picpeak -d picpeak_prod -c "SELECT * FROM email_queue ORDER BY created_at DESC LIMIT 10;"`
+- For Gmail, use app-specific password
+- Check logs: `docker compose logs backend | grep email`
+
+### Health Checks
+
+```bash
+# Backend health
+curl http://localhost:3001/api/health
+
+# Frontend health
+curl http://localhost:3000
+
+# Database health
+docker exec picpeak-postgres pg_isready
+```
+
+### Useful Commands
+
+```bash
+# Enter backend container
+docker exec -it picpeak-backend sh
+
+# Enter database
+docker exec -it picpeak-postgres psql -U picpeak picpeak_prod
+
+# Reset admin password
+docker exec picpeak-backend node scripts/show-admin-credentials.js --reset
+
+# Check disk usage
+df -h
+du -sh events/ storage/ backup/
+
+# View running processes
+docker compose top
+```
+
+## Security Recommendations
+
+1. **Use HTTPS**: Always use a reverse proxy with SSL in production
+2. **Firewall**: Only expose necessary ports (80, 443)
+3. **Secure passwords**: Use strong, unique passwords for all services
+4. **Regular updates**: Keep Docker images and system packages updated
+5. **Backup strategy**: Set up automated backups and test restoration
+6. **Monitor logs**: Regularly check logs for suspicious activity
+7. **Rate limiting**: The app includes built-in rate limiting, configure as needed
+
+## Support
+
+For issues and questions:
+- Check logs first: `docker compose logs`
+- Review documentation in the repository
+- Check existing issues on GitHub
+- Create a new issue with:
+  - Error messages
+  - Log output
+  - Environment details (without secrets)
+  - Steps to reproduce

PRODUCTION_DEPLOYMENT_GUIDE.md

@@ -1,378 +0,0 @@
-# Production Deployment Guide
-
-This comprehensive guide addresses all production deployment scenarios and common issues.
-
-## Pre-Deployment Checklist
-
-### 1. Environment Variables
-Create a `.env` file with ALL required variables:
-
-```bash
-# CRITICAL - Must change these!
-JWT_SECRET=<generate-with-openssl-rand-base64-32>
-DB_PASSWORD=<strong-password>
-
-# Application URLs (your actual domain)
-ADMIN_URL=https://yourdomain.com
-FRONTEND_URL=https://yourdomain.com
-BACKEND_URL=https://yourdomain.com
-
-# Database (PostgreSQL)
-DATABASE_CLIENT=pg
-DB_HOST=postgres  # or external host
-DB_PORT=5432
-DB_USER=picpeak
-DB_NAME=picpeak
-
-# Email Configuration (required for notifications)
-SMTP_HOST=smtp.gmail.com
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=your-email@gmail.com
-SMTP_PASS=your-app-password  # Use app-specific password
-EMAIL_FROM=PicPeak <noreply@yourdomain.com>
-
-# Port Configuration
-PORT=3001
-
-# Performance Tuning
-DB_POOL_MIN=5
-DB_POOL_MAX=25
-NODE_ENV=production
-LOG_LEVEL=info
-
-# Optional: Umami Analytics (configured via Admin UI)
-# UMAMI_URL=https://analytics.yourdomain.com
-# UMAMI_WEBSITE_ID=your-website-id
-```
-
-### 2. Generate Secrets
-
-```bash
-# Generate JWT Secret (REQUIRED)
-openssl rand -base64 32
-
-# Generate Database Password
-openssl rand -base64 24
-```
-
-## Frontend Configuration
-
-For production deployment behind a reverse proxy:
-
-### Frontend Environment
-```bash
-# frontend/.env.production
-VITE_API_URL=/api  # Uses relative path for reverse proxy
-
-# Optional: Umami fallback (primary config via Admin UI)
-# VITE_UMAMI_URL=https://analytics.yourdomain.com
-# VITE_UMAMI_WEBSITE_ID=your-website-id
-```
-
-This ensures all API calls use the same domain/protocol as the frontend.
-
-### Nginx Proxy Configuration
-
-The frontend nginx configuration already includes proper proxy settings for:
-- `/api` → Backend API
-- `/photos` → Protected photo access
-- `/thumbnails` → Thumbnail images
-- `/uploads` → Public uploads (logos, favicons)
-
-All static assets are served through the nginx proxy, inheriting authentication headers.
-
-## Deployment Steps
-
-### 1. Initial Setup
-
-```bash
-# Clone repository
-git clone https://github.com/the-luap/wedding-photo-sharing.git
-cd wedding-photo-sharing
-
-# Create required directories
-mkdir -p storage/events/active storage/events/archived storage/thumbnails storage/uploads
-mkdir -p data logs
-mkdir -p certbot/conf certbot/www
-
-# Set permissions (important!)
-chmod -R 755 storage data logs
-```
-
-### 2. Fix Docker Volume Permissions
-
-Create `docker-compose.override.yml` for local volume configuration:
-
-```yaml
-version: '3.8'
-
-services:
-  backend:
-    volumes:
-      - ./storage:/app/storage:delegated
-      - ./data:/app/data:delegated
-      - ./logs:/app/logs:delegated
-    user: "1001:1001"  # nodejs user
-
-  db:
-    volumes:
-      - ./postgres-data:/var/lib/postgresql/data
-```
-
-### 3. Build and Deploy
-
-```bash
-# Build images
-docker-compose -f docker-compose.prod.yml build
-
-# Start services
-docker-compose -f docker-compose.prod.yml up -d
-
-# Check logs
-docker-compose -f docker-compose.prod.yml logs -f backend
-```
-
-### 4. Initial Admin Setup
-
-The admin user is automatically created during database migration:
-
-```bash
-# Run migrations (this creates admin user)
-docker-compose -f docker-compose.prod.yml exec backend npm run migrate
-
-# Admin credentials will be displayed in console and saved to ADMIN_CREDENTIALS.txt
-# Example output:
-# ========================================
-# ✅ Admin user created successfully!
-# ========================================
-# Username: admin
-# Password: SwiftEagle3847!
-# 
-# ⚠️  IMPORTANT: Change password on first login
-# ========================================
-
-# Retrieve credentials if needed
-docker-compose -f docker-compose.prod.yml exec backend cat ADMIN_CREDENTIALS.txt
-```
-
-**Important**: You MUST change the auto-generated password on first login.
-
-### 5. Configure Email (if using database config)
-
-1. Login to admin panel: https://yourdomain.com/admin
-2. Go to Settings > Email Configuration
-3. Enter SMTP details
-4. Test email sending
-
-## Common Issues and Solutions
-
-### Issue 1: Migration Failures
-
-**Error**: "relation already exists"
-
-**Solution**: The safe migration runner handles this automatically. If issues persist:
-
-```bash
-# Reset migrations tracking
-docker-compose -f docker-compose.prod.yml exec db psql -U picpeak -d picpeak
-
-# In PostgreSQL:
-DROP TABLE IF EXISTS migrations;
-\q
-
-# Re-run migrations
-docker-compose -f docker-compose.prod.yml exec backend npm run migrate:safe
-```
-
-### Issue 2: Permission Denied Errors
-
-**Error**: "EACCES: permission denied"
-
-**Solution**: Fix container permissions:
-
-```bash
-# Stop containers
-docker-compose -f docker-compose.prod.yml down
-
-# Fix permissions on host
-sudo chown -R 1001:1001 storage data logs
-
-# Restart
-docker-compose -f docker-compose.prod.yml up -d
-```
-
-### Issue 3: Database Connection Failed
-
-**Error**: "no pg_hba.conf entry"
-
-**Solution**: Already fixed in docker-compose.prod.yml with:
-- SSL disabled for internal Docker network
-- Proper authentication method (scram-sha-256)
-
-### Issue 4: Frontend Can't Connect to Backend
-
-**Error**: CORS errors or connection refused
-
-**Solution**: Ensure environment variables match:
-- Backend: `FRONTEND_URL` must match your frontend URL
-- Frontend: `VITE_API_URL` must be set during build
-
-### Issue 5: Email Not Sending
-
-**Solution**: Check email configuration:
-
-```bash
-# Check backend logs
-docker-compose -f docker-compose.prod.yml logs backend | grep email
-
-# Verify SMTP settings
-# Gmail users: Use app password, not regular password
-# Enable "Less secure app access" or use OAuth2
-```
-
-## SSL/HTTPS Setup
-
-### Option 1: Using Traefik (Recommended)
-
-Add these labels to your docker-compose override:
-
-```yaml
-services:
-  frontend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak.rule=Host(`yourdomain.com`)"
-      - "traefik.http.routers.picpeak.entrypoints=websecure"
-      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
-```
-
-### Option 2: Using Certbot
-
-1. Update `nginx/sites-enabled/default` with your domain
-2. Run certbot:
-
-```bash
-# Initial certificate
-docker-compose -f docker-compose.prod.yml run --rm certbot certonly \
-  --webroot --webroot-path=/var/www/certbot \
-  -d yourdomain.com -d www.yourdomain.com
-
-# Auto-renewal is handled by the certbot container
-```
-
-## Monitoring
-
-### Health Checks
-
-```bash
-# Backend health
-curl http://localhost/api/health
-
-# Database connection
-docker-compose -f docker-compose.prod.yml exec backend \
-  psql -U picpeak -d picpeak -c "SELECT 1"
-```
-
-### Logs
-
-```bash
-# All services
-docker-compose -f docker-compose.prod.yml logs -f
-
-# Specific service
-docker-compose -f docker-compose.prod.yml logs -f backend
-```
-
-## Backup and Restore
-
-### Backup
-
-```bash
-#!/bin/bash
-# backup.sh
-DATE=$(date +%Y%m%d_%H%M%S)
-BACKUP_DIR="./backups/$DATE"
-
-mkdir -p $BACKUP_DIR
-
-# Database
-docker-compose -f docker-compose.prod.yml exec -T db \
-  pg_dump -U picpeak picpeak > $BACKUP_DIR/database.sql
-
-# Files
-tar -czf $BACKUP_DIR/storage.tar.gz storage/
-
-echo "Backup completed: $BACKUP_DIR"
-```
-
-### Restore
-
-```bash
-# Database
-docker-compose -f docker-compose.prod.yml exec -T db \
-  psql -U picpeak picpeak < ./backups/20240713_120000/database.sql
-
-# Files
-tar -xzf ./backups/20240713_120000/storage.tar.gz
-```
-
-## Production Best Practices
-
-1. **Always use named volumes** in production for better data persistence
-2. **Set up monitoring** with Prometheus/Grafana
-3. **Enable backups** with automated scripts
-4. **Use a reverse proxy** (Nginx) for SSL termination
-5. **Implement rate limiting** at the Nginx level
-6. **Regular updates** - Keep Docker images updated
-7. **Log rotation** - Configure log rotation for application logs
-
-## Troubleshooting Commands
-
-```bash
-# Check running containers
-docker-compose -f docker-compose.prod.yml ps
-
-# Restart a service
-docker-compose -f docker-compose.prod.yml restart backend
-
-# View real-time logs
-docker-compose -f docker-compose.prod.yml logs -f --tail=100
-
-# Execute commands in container
-docker-compose -f docker-compose.prod.yml exec backend sh
-
-# Database shell
-docker-compose -f docker-compose.prod.yml exec db psql -U picpeak
-
-# Clean restart
-docker-compose -f docker-compose.prod.yml down
-docker-compose -f docker-compose.prod.yml up -d
-```
-
-## Security Checklist
-
-- [ ] Strong JWT_SECRET (min 32 chars)
-- [ ] Strong database password
-- [ ] Admin password changed from auto-generated one
-- [ ] SSL/HTTPS enabled
-- [ ] Firewall configured (only 80/443 open)
-- [ ] Regular security updates
-- [ ] Backup encryption
-- [ ] Access logs monitored
-- [ ] Rate limiting enabled (built-in)
-- [ ] File upload restrictions configured
-- [ ] Password complexity requirements configured (Admin > Settings)
-- [ ] Session timeout configured (default 60 min)
-- [ ] Umami analytics configured (if using)
-- [ ] SMTP credentials secured with app-specific password
-
-## Support
-
-For issues not covered here:
-1. Check application logs
-2. Review error messages carefully
-3. Ensure all environment variables are set
-4. Verify file permissions
-5. Check Docker daemon logs

README.md

@@ -28,11 +28,13 @@ Unlike expensive SaaS solutions, PicPeak gives you:
 
 ### For Photographers
 - 📁 **Drag & Drop Upload** - Simply drop photos into folders
+- 🔗 **External Media (Reference Mode)** - Browse and import from a read‑only external folder library without copying originals
 - ⏰ **Auto-Expiring Galleries** - Set expiration dates (default: 30 days)
 - 🔐 **Password Protection** - Secure client galleries
 - 📧 **Automated Emails** - Creation confirmations and expiration warnings
 - 📊 **Analytics Dashboard** - Track views, downloads, and engagement
 - 🎨 **Custom Themes** - Match your brand perfectly
+- 🌐 **Public Landing Page** - Publish a curated marketing page when guests visit your root URL
 
 ### For Clients
 - 🖼️ **Beautiful Galleries** - Clean, modern interface
@@ -40,10 +42,12 @@ Unlike expensive SaaS solutions, PicPeak gives you:
 - ⬇️ **Bulk Downloads** - Download all photos with one click
 - 🔍 **Smart Search** - Find photos quickly
 - 📤 **Guest Uploads** - Optional client photo uploads
+- 🛡️ **Download Protection** - Advanced image protection with watermarking and right-click prevention
 
 ### Technical Excellence
 - 🐳 **Docker Ready** - Deploy in minutes
 - 🔄 **Auto-Processing** - Automatic thumbnail generation
+- 🗂️ **Reference Library Support** - Point PicPeak at `EXTERNAL_MEDIA_ROOT` to reference existing originals, index quickly, and generate thumbnails on demand
 - 💾 **Smart Storage** - Automatic archiving of expired galleries
 - 🛡️ **Security First** - JWT auth, rate limiting, CORS protection
 - 📈 **Scalable** - From small studios to large agencies
@@ -69,14 +73,37 @@ docker-compose up -d
 # Access at http://localhost:3005
 ```
 
+Note on Docker file permissions (PUID/PGID)
+- When using bind mounts (e.g., `./storage`, `./data`, `./logs`, `./events`), ensure the container user can write to these host folders. The backend runs as a non‑root user by default.
+- Set `PUID` and `PGID` in your `.env` to match your host user’s UID/GID (run `id -u` and `id -g` on the host). Compose maps the container user to these values.
+- Example in `.env`:
+  - `PUID=1000`
+  - `PGID=1000`
+- Without this, creating events, uploads, thumbnails, or logs can fail with “Permission denied”.
+
 ## 📖 Documentation
 
-- 📘 [**Deployment Guide**](DEPLOYMENT.md) - Detailed installation instructions
+- 📘 [**Deployment Guide**](DEPLOYMENT_GUIDE.md) - Detailed installation instructions
+  - Includes the new [External Media Library](DEPLOYMENT_GUIDE.md#external-media-library) reference mode
+- 📚 [**Admin API (OpenAPI)**](docs/picpeak-admin-api.openapi.yaml) - Machine-readable documentation for event automation endpoints
+- 🛠️ [**Admin API Quickstart**](docs/admin-api-quickstart.md) - Step-by-step authentication and testing guide for the documented endpoints
 - 🤝 [**Contributing**](CONTRIBUTING.md) - How to contribute
 - 📜 [**License**](LICENSE) - MIT License
 - 🔒 [**Security**](SECURITY.md) - Security policies
 - 📋 [**Code of Conduct**](CODE_OF_CONDUCT.md) - Community guidelines
 
+## 🌐 Public Landing Page
+
+Spotlight your studio with a customizable marketing page at `/`:
+
+- Head to **Admin → CMS Pages** to enable the public landing page toggle.
+- Edit the provided HTML template (rich sections, hero, testimonials) and optional CSS overrides.
+- The preview renders in a sandboxed iframe so you can iterate safely before publishing.
+- PicPeak sanitizes stored HTML and CSS server-side—scripts, iframes, and unsafe attributes are stripped automatically.
+- Use **Reset to default** anytime to restore the bundled template.
+- The backend caches the rendered landing page for 60 seconds by default; override with `PUBLIC_SITE_CACHE_TTL_MS` if you need a different TTL.
+- When the landing page is disabled PicPeak continues to serve the admin SPA/login exactly as before.
+
 ## 🎯 Use Cases
 
 Perfect for:
@@ -138,7 +165,7 @@ PicPeak takes security seriously:
 - 📝 Activity logging
 - 🔒 Secure file access
 
-Found a security issue? Please email security@example.com
+Found a security issue? Please open a [security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub
 
 ## 📸 Screenshots
 
@@ -177,13 +204,27 @@ Organize and manage your photo galleries with intuitive event management tools.
 
 We're constantly improving PicPeak and welcome contributions from our community! If you have ideas for new features or want to help implement existing ones, please open an issue or submit a pull request. Your contributions help make PicPeak better for everyone.
 
+### 🚧 Beta Features (Use at your own risk)
+
+These features are currently in beta testing and may have limited functionality or stability:
+
+| Feature | Description | Status |
+|---------|-------------|--------|
+| **Download Protection** | Advanced image protection system with canvas rendering, invisible watermarking, and right-click prevention to protect your photos from unauthorized downloads | 🧪 Beta |
+| **Simple Deployment Script** | One-click deployment script for quick server setup with automated configuration and dependency installation | 🧪 Beta |
+
+### 📋 Future Enhancements
+
 | Feature | Description | Priority | Status |
 |---------|-------------|----------|---------|
 | **Backup & Restore** | Comprehensive backup system with S3/MinIO support, automated scheduling, and safe restore functionality | High | ✅ Implemented |
+| **External Media Library (Reference Mode)** | Use an external folder library as a read‑only source with import and on‑demand thumbnail generation | High | ✅ Implemented |
 | **Gallery Templates** | Additional gallery layouts and themes (masonry, slideshow, story-style) for different event types | Medium | 🔄 Open |
 | **Face Recognition** | AI-powered face detection to help guests find their photos and create automatic person-based albums | Low | 🔄 Open |
-| **Gallery Feedback** | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | 🔄 Open |
+| **Gallery Feedback** | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | ✅ Implemented |
 | **Video Support** | Upload and display videos alongside photos in galleries with streaming support | Low | 🔄 Open |
+| **Multiple Administrators** | Support for multiple admin accounts with role-based permissions and activity tracking | Low | 📋 Planned |
+| **Filtering & Export Options** | Add filters to show only rated, liked, or marked photos and export filtered selections for Capture One or Lightroom workflows | Low | 🔄 Open |
 
 **Status Legend:** ✅ Implemented | 🚧 In Progress | 🔄 Open | 📋 Planned
 
@@ -191,6 +232,16 @@ We're constantly improving PicPeak and welcome contributions from our community!
 
 PicPeak is inspired by the best features of commercial platforms while remaining completely open source. Special thanks to all contributors who make this project possible.
 
+### 🤖 AI-Assisted Development
+
+This project was generated with the assistance of AI technology, but has been:
+- ✅ **Fully tested end-to-end** by human developers
+- 🔒 **Security audited** with comprehensive security checks
+- 👨‍💻 **Human-reviewed** for code quality and best practices
+- 🧪 **Production-tested** in real-world scenarios
+
+We believe in transparent development practices and the responsible use of AI as a tool to accelerate development while maintaining high standards of quality and security.
+
 ## 📄 License
 
 PicPeak is released under the [MIT License](LICENSE). Use it freely for personal or commercial projects.
@@ -198,7 +249,7 @@ PicPeak is released under the [MIT License](LICENSE). Use it freely for personal
 ## 🚀 Ready to Get Started?
 
 1. ⭐ **Star this repository** to show your support
-2. 📖 Read the [Deployment Guide](DEPLOYMENT.md)
+2. 📖 Read the [Deployment Guide](DEPLOYMENT_GUIDE.md)
 3. 🐛 Report issues or request features
 4. 🤝 Join our community and contribute!
 
@@ -208,6 +259,6 @@ PicPeak is released under the [MIT License](LICENSE). Use it freely for personal
   Made with ❤️ by photographers, for photographers
   <br>
   <a href="https://github.com/the-luap/picpeak">GitHub</a> •
-  <a href="DEPLOYMENT.md">Documentation</a> •
+  <a href="DEPLOYMENT_GUIDE.md">Documentation</a> •
   <a href="https://github.com/the-luap/picpeak/issues">Support</a>
-</p>
+</p>

SECURITY.md

@@ -15,11 +15,14 @@ We take the security of PicPeak seriously. If you have discovered a security vul
 
 ### 1. **Do NOT create a public GitHub issue**
 
-### 2. Email us at security@example.com with:
-- Description of the vulnerability
-- Steps to reproduce
-- Potential impact
-- Suggested fix (if any)
+### 2. Report the vulnerability by:
+- Opening a [security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub
+- Mark it clearly as "SECURITY" in the title
+- Include:
+  - Description of the vulnerability
+  - Steps to reproduce
+  - Potential impact
+  - Suggested fix (if any)
 
 ### 3. You can expect:
 - Acknowledgment within 48 hours
@@ -79,7 +82,7 @@ We believe in responsible disclosure. Once a vulnerability is fixed:
 
 ## Contact
 
-- Security issues: security@example.com
-- General support: https://github.com/the-luap/picpeak/issues
+- Security issues: [Create a security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub
+- General support: [GitHub Issues](https://github.com/the-luap/picpeak/issues)
 
 Thank you for helping keep PicPeak and its users safe!

SIMPLE_SETUP.md

@@ -0,0 +1,544 @@
+# 🚀 PicPeak Simple Setup Guide
+
+This guide provides easy installation instructions for PicPeak on Linux servers with both Docker and non-Docker options.
+
+## 📋 Quick Start
+
+### One-Line Installation
+
+```bash
+# Download and run the unified setup script
+curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/picpeak-setup.sh -o picpeak-setup.sh && \
+chmod +x picpeak-setup.sh && \
+sudo ./picpeak-setup.sh
+```
+
+The script will automatically detect your environment and recommend the best installation method.
+
+## 🎯 Installation Methods
+
+### Method 1: Docker Installation (Recommended)
+Best for: Most users, easy updates, isolated environment
+
+```bash
+sudo ./picpeak-setup.sh --docker
+```
+
+**Pros:**
+- ✅ Easier installation and updates
+- ✅ Better isolation from system
+- ✅ Consistent environment across platforms
+- ✅ Built-in PostgreSQL and Redis
+
+**Cons:**
+- ❌ Requires more resources (~4GB RAM recommended)
+- ❌ Additional Docker overhead
+
+### Method 2: Native Installation
+Best for: Resource-constrained systems, Raspberry Pi, direct control
+
+```bash
+sudo ./picpeak-setup.sh --native
+```
+
+**Pros:**
+- ✅ Lower resource usage (~1GB RAM minimum)
+- ✅ Direct system control
+- ✅ No Docker overhead
+- ✅ Better for ARM devices
+
+**Cons:**
+- ❌ More complex setup
+- ❌ System dependencies required
+- ❌ Manual update process
+
+## 📋 System Requirements
+
+### Minimum Requirements
+- **OS**: Ubuntu 20.04+, Debian 11+, Fedora 38+, RHEL/CentOS 8+, Raspberry Pi OS
+- **RAM**: 
+  - Docker: 2GB minimum (4GB recommended)
+  - Native: 1GB minimum (2GB recommended)
+- **Storage**: 2GB for application + space for photos
+- **Network**: Port 3001 (or 80/443 with proxy)
+
+### Supported Platforms
+- ✅ Ubuntu 20.04, 22.04, 24.04
+- ✅ Debian 11, 12
+- ✅ Raspberry Pi OS (32-bit and 64-bit)
+- ✅ Fedora 38, 39, 40
+- ✅ RHEL/CentOS/Rocky/AlmaLinux 8, 9
+
+## 🛠️ Installation Options
+
+### Interactive Mode (Default)
+```bash
+sudo ./picpeak-setup.sh
+```
+
+The script will prompt you to choose:
+1. Installation method (Docker or Native)
+2. Admin email and password
+3. Domain configuration (optional)
+4. Email server settings (optional)
+5. SSL/HTTPS setup (optional)
+
+### Unattended Installation
+
+#### Docker with full configuration:
+```bash
+sudo ./picpeak-setup.sh --docker --unattended \
+  --domain photos.example.com \
+  --email admin@example.com \
+  --admin-password SecurePass123 \
+  --smtp-host smtp.gmail.com \
+  --smtp-port 587 \
+  --smtp-user your-email@gmail.com \
+  --smtp-pass your-app-password \
+  --enable-ssl
+```
+
+#### Native with minimal configuration:
+```bash
+sudo ./picpeak-setup.sh --native --unattended \
+  --email admin@example.com \
+  --admin-password SecurePass123
+```
+
+### Command Line Options
+
+| Option | Description | Example |
+|--------|-------------|---------|
+| `--docker` | Use Docker installation | `--docker` |
+| `--native` | Use native installation | `--native` |
+| `--unattended` | Run without prompts | `--unattended` |
+| `--domain` | Domain for HTTPS setup | `--domain photos.example.com` |
+| `--email` | Admin email address | `--email admin@example.com` |
+| `--admin-password` | Set admin password | `--admin-password MySecurePass` |
+| `--smtp-host` | SMTP server hostname | `--smtp-host smtp.gmail.com` |
+| `--smtp-port` | SMTP server port | `--smtp-port 587` |
+| `--smtp-user` | SMTP username | `--smtp-user user@gmail.com` |
+| `--smtp-pass` | SMTP password | `--smtp-pass app-password` |
+| `--enable-ssl` | Enable HTTPS with Let's Encrypt | `--enable-ssl` |
+| `--port` | Custom port (native only) | `--port 8080` |
+| `--update` | Update existing installation | `--update` |
+| `--uninstall` | Remove installation | `--uninstall` |
+| `--help` | Show help message | `--help` |
+
+## 🏗️ What Gets Installed
+
+### Docker Installation
+```
+~/picpeak/                    # Or custom directory
+├── docker-compose.yml        # Service definitions
+├── .env                      # Configuration
+├── storage/
+│   └── events/              # Photo storage
+│       ├── active/          # Current galleries
+│       └── archived/        # Expired galleries
+├── logs/                    # Application logs
+└── backup/                  # Backup directory
+```
+
+**Services:**
+- PicPeak Backend (Node.js application)
+- PostgreSQL Database
+- Redis Cache
+- Nginx Reverse Proxy (optional)
+- Background Workers
+
+### Native Installation
+```
+/opt/picpeak/                # Installation directory
+├── backend/                 # Application code
+├── events/                  # Photo storage
+│   ├── active/             # Current galleries
+│   └── archived/           # Expired galleries
+├── logs/                   # Application logs
+└── config/                 # Configuration files
+```
+
+**Services (systemd):**
+- `picpeak-backend` - Main application
+- `picpeak-workers` - Background workers
+- `caddy` - Web server (optional)
+
+## 🌐 Access Methods
+
+### Direct Access (Simplest)
+- Docker: `http://your-server:3000` (frontend and admin at `/admin`)
+- Backend/API: `http://your-server:3001` (API only; no UI routes)
+  
+For native installs, serve the built frontend (e.g., with nginx or Caddy) and access the admin at `/admin` on the frontend domain.
+
+### With Domain & HTTPS
+If configured during setup:
+- `https://your-domain.com` - Gallery frontend
+- `https://your-domain.com/admin` - Admin panel
+
+### Behind Existing Proxy
+Add to your Nginx/Apache configuration (split frontend vs backend):
+```nginx
+# Frontend (UI + /admin/*)
+location / {
+    proxy_pass http://localhost:3000;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection 'upgrade';
+    proxy_set_header Host $host;
+    proxy_cache_bypass $http_upgrade;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+
+# Backend API and protected resources
+location /api {
+    proxy_pass http://localhost:3001;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection 'upgrade';
+    proxy_set_header Host $host;
+    proxy_cache_bypass $http_upgrade;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    client_max_body_size 100M;
+}
+location ~ ^/(photos|thumbnails|uploads) {
+    proxy_pass http://localhost:3001;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+```
+
+## 📁 Managing Galleries
+
+### Creating a Gallery
+
+#### Method 1: Via Admin Panel (Recommended)
+1. Login to admin panel
+2. Click "Create New Event"
+3. Configure settings and upload photos
+
+#### Method 2: File System
+```bash
+# Docker installation
+mkdir -p ~/picpeak/storage/events/active/wedding-smith-2024
+cp /path/to/photos/* ~/picpeak/storage/events/active/wedding-smith-2024/
+
+# Native installation
+sudo mkdir -p /opt/picpeak/events/active/wedding-smith-2024
+sudo cp /path/to/photos/* /opt/picpeak/events/active/wedding-smith-2024/
+sudo chown -R picpeak:picpeak /opt/picpeak/events/active/wedding-smith-2024
+```
+
+### Gallery Structure
+```
+wedding-smith-2024/
+├── collages/        # Group photos
+├── individual/      # Individual photos
+└── thumbnails/      # Auto-generated thumbnails
+```
+
+## 🔧 Service Management
+
+### Docker Installation
+
+```bash
+cd ~/picpeak
+
+# Check status
+docker compose ps
+
+# View logs
+docker compose logs -f
+
+# Stop services
+docker compose down
+
+# Start services
+docker compose up -d
+
+# Restart services
+docker compose restart
+
+# Update PicPeak
+docker compose pull
+docker compose up -d
+```
+
+### Native Installation
+
+```bash
+# Check status
+sudo systemctl status picpeak-backend
+sudo systemctl status picpeak-workers
+
+# View logs
+sudo journalctl -u picpeak-backend -f
+sudo journalctl -u picpeak-workers -f
+
+# Start services
+sudo systemctl start picpeak-backend picpeak-workers
+
+# Stop services
+sudo systemctl stop picpeak-backend picpeak-workers
+
+# Restart services
+sudo systemctl restart picpeak-backend picpeak-workers
+
+# Update PicPeak
+# (reruns migrations to pick up schema fixes for native installs)
+sudo ./picpeak-setup.sh --update
+```
+
+## ⚙️ Configuration
+
+### Docker Configuration
+Edit `~/picpeak/.env`:
+```bash
+nano ~/picpeak/.env
+docker compose restart
+```
+
+### Native Configuration
+Edit `/opt/picpeak/app/backend/.env`:
+```bash
+sudo nano /opt/picpeak/app/backend/.env
+sudo systemctl restart picpeak-backend
+```
+
+### Key Settings
+
+| Setting | Description | Default |
+|---------|-------------|---------|
+| `JWT_SECRET` | Token signing secret | Auto-generated |
+| `ADMIN_EMAIL` | Admin email | admin@example.com |
+| `ADMIN_PASSWORD` | Admin password | Auto-generated |
+| `PHOTOS_DIR` | Photo storage path | Varies by method |
+| `SMTP_ENABLED` | Email notifications | false |
+| `DEFAULT_EXPIRY_DAYS` | Gallery expiration | 30 |
+
+## 📧 Email Configuration
+
+### Gmail Setup
+1. Enable 2-Factor Authentication
+2. Generate App Password
+3. Configure:
+```env
+SMTP_ENABLED=true
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=your-email@gmail.com
+SMTP_PASS=your-app-password
+SMTP_FROM=noreply@yourdomain.com
+```
+
+### SendGrid Setup
+1. Sign up at sendgrid.com (100 emails/day free)
+2. Create API key
+3. Configure:
+```env
+SMTP_ENABLED=true
+SMTP_HOST=smtp.sendgrid.net
+SMTP_PORT=587
+SMTP_USER=apikey
+SMTP_PASS=your-sendgrid-api-key
+SMTP_FROM=verified-sender@yourdomain.com
+```
+
+## 🔄 Maintenance
+
+### Backups
+
+#### Docker:
+```bash
+# Backup script included
+cd ~/picpeak
+./backup.sh
+
+# Manual backup
+docker exec picpeak-postgres pg_dump -U picpeak picpeak > backup.sql
+tar -czf photos-backup.tar.gz storage/events/
+```
+
+#### Native:
+```bash
+# Database backup
+sudo cp /opt/picpeak/app/backend/data/photo_sharing.db /backup/database-$(date +%Y%m%d).sqlite
+
+# Photos backup
+sudo tar -czf /backup/photos-$(date +%Y%m%d).tar.gz /opt/picpeak/events/
+```
+
+### Updates
+
+```bash
+# Docker
+cd ~/picpeak
+docker compose pull
+docker compose up -d
+
+# Native
+sudo ./picpeak-setup.sh --update
+```
+
+### Uninstall
+
+```bash
+# Will prompt for confirmation and data removal options
+sudo ./picpeak-setup.sh --uninstall
+```
+
+## 🐛 Troubleshooting
+
+### Common Issues
+
+#### Service Won't Start
+```bash
+# Docker
+docker compose logs backend
+docker compose down && docker compose up -d
+
+# Native
+sudo journalctl -u picpeak-backend -n 50
+sudo systemctl restart picpeak-backend
+```
+
+#### Can't Access Admin Panel
+1. Check firewall:
+```bash
+# Ubuntu/Debian
+sudo ufw allow 3001
+
+# RHEL/CentOS
+sudo firewall-cmd --add-port=3001/tcp --permanent
+sudo firewall-cmd --reload
+```
+
+2. Verify service:
+```bash
+# Docker
+curl http://localhost:3001/api/health
+
+# Native
+sudo systemctl is-active picpeak-backend
+```
+
+#### Photos Not Showing
+```bash
+# Check permissions (Native)
+sudo chown -R picpeak:picpeak /opt/picpeak/events/
+sudo chmod -R 755 /opt/picpeak/events/
+
+# Check permissions (Docker)
+ls -la ~/picpeak/storage/events/
+```
+
+#### Reset Admin Password
+
+```bash
+# Docker
+docker exec picpeak-backend node scripts/reset-admin-password.js
+
+# Native
+cd /opt/picpeak/app/backend
+sudo -u picpeak node scripts/reset-admin-password.js
+```
+
+### Getting Help
+
+1. **Check logs:**
+   - Docker: `docker compose logs -f`
+   - Native: `sudo journalctl -u picpeak-backend -f`
+   - Installation: `/tmp/picpeak-setup-*.log`
+
+2. **Documentation:**
+   - [Full Documentation](https://github.com/the-luap/picpeak)
+   - [Deployment Guide](./DEPLOYMENT_GUIDE.md)
+
+3. **Support:**
+   - [GitHub Issues](https://github.com/the-luap/picpeak/issues)
+   - Include: Error messages, system info (`uname -a`), installation method
+
+## 🔒 Security Best Practices
+
+### Essential Security
+1. **Change default admin password immediately**
+2. **Use HTTPS for production** (Let's Encrypt included)
+3. **Configure firewall** (only open necessary ports)
+4. **Regular updates** (system and PicPeak)
+5. **Automated backups** (configure in admin panel)
+
+### Advanced Security
+- Use VPN for admin panel access
+- Configure fail2ban for brute force protection
+- Enable audit logging
+- Regular security scans
+- Implement IP whitelisting
+
+## 📊 Performance Optimization
+
+### Docker Optimization
+```yaml
+# Adjust in docker-compose.yml
+services:
+  backend:
+    deploy:
+      resources:
+        limits:
+          cpus: '2'
+          memory: 2G
+```
+
+### Native Optimization
+```bash
+# Increase Node.js memory
+echo "NODE_OPTIONS=--max-old-space-size=2048" >> /opt/picpeak/app/backend/.env
+sudo systemctl restart picpeak-backend
+```
+
+## 🎯 Quick Setup Examples
+
+### Home/Office Network
+```bash
+# Simple local setup without domain
+sudo ./picpeak-setup.sh --native --email admin@local.com
+```
+
+### Public Website with HTTPS
+```bash
+# Full production setup
+sudo ./picpeak-setup.sh --docker \
+  --domain photos.company.com \
+  --email admin@company.com \
+  --enable-ssl
+```
+
+### Raspberry Pi Setup
+```bash
+# Optimized for ARM devices
+sudo ./picpeak-setup.sh --native \
+  --port 8080 \
+  --email pi@local.com
+```
+
+## ✅ Post-Installation Checklist
+
+- [ ] Admin password changed
+- [ ] Email configuration tested
+- [ ] First test gallery created
+- [ ] Backup schedule configured
+- [ ] Firewall rules applied
+- [ ] SSL certificate working (if applicable)
+- [ ] Monitoring setup
+- [ ] Documentation bookmarked
+
+---
+
+**PicPeak Setup v1.0** | [Documentation](https://github.com/the-luap/picpeak) | [Support](https://github.com/the-luap/picpeak/issues)

backend/.env.example

@@ -12,6 +12,7 @@ JWT_SECRET=your-very-secure-jwt-secret-at-least-32-characters-long-example123456
 # URLs (adjust for your domain)
 ADMIN_URL=https://photos.example.com
 FRONTEND_URL=https://photos.example.com
+BACKEND_URL=https://photos.example.com  # Or https://api.photos.example.com if separate
 
 # Database Configuration
 DATABASE_CLIENT=pg

backend/Dockerfile

@@ -1,7 +1,15 @@
-FROM node:18-alpine AS builder
+FROM node:20-alpine AS builder
 
-# Add build argument for cache busting
+# Add build arguments
 ARG CACHEBUST=1
+ARG BUILD_DATE
+ARG VCS_REF
+ARG VERSION
+
+# Add labels for GitHub Container Registry
+LABEL org.opencontainers.image.source="https://github.com/the-luap/picpeak"
+LABEL org.opencontainers.image.description="PicPeak Backend Service"
+LABEL org.opencontainers.image.licenses="MIT"
 
 WORKDIR /app
 
@@ -15,10 +23,13 @@ RUN npm ci --only=production
 COPY . .
 
 # Production stage
-FROM node:18-alpine
+FROM node:20-alpine
 
 WORKDIR /app
 
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+
 # Install dumb-init for proper signal handling and postgresql-client for database checks
 RUN apk add --no-cache dumb-init postgresql-client
 

backend/Dockerfile.dev

@@ -1,7 +1,10 @@
-FROM node:18-alpine
+FROM node:20-alpine
 
 WORKDIR /app
 
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+
 # Install dumb-init for proper signal handling
 RUN apk add --no-cache dumb-init
 

backend/__tests__/adminSettings.logo.test.js

@@ -0,0 +1,184 @@
+const fs = require('fs');
+const fsPromises = fs.promises;
+const os = require('os');
+const path = require('path');
+const express = require('express');
+const request = require('supertest');
+
+describe('Admin settings logo upload flow', () => {
+  let tmpDir;
+  let router;
+  let app;
+  let settingsStore;
+
+  const resetModules = () => {
+    jest.resetModules();
+    jest.clearAllMocks();
+  };
+
+  beforeEach(async () => {
+    resetModules();
+
+    tmpDir = await fsPromises.mkdtemp(path.join(os.tmpdir(), 'picpeak-logo-'));
+    process.env.STORAGE_PATH = tmpDir;
+
+    settingsStore = new Map();
+
+    const buildQuery = (table) => {
+      const filters = [];
+      const applyFilters = (rows) => {
+        if (filters.length === 0) {
+          return rows;
+        }
+        return rows.filter((row) =>
+          filters.every(({ column, value }) => row[column] === value)
+        );
+      };
+
+      const makeRow = (row) => ({ ...row });
+
+      return {
+        where(column, value) {
+          filters.push({ column, value });
+          return this;
+        },
+        first() {
+          if (table === 'app_settings') {
+            const rows = applyFilters(Array.from(settingsStore.values()).map(makeRow));
+            return Promise.resolve(rows[0]);
+          }
+          return Promise.resolve(undefined);
+        },
+        select() {
+          return Promise.resolve([]);
+        },
+        sum() {
+          return Promise.resolve({ total: 0 });
+        },
+        join() {
+          return this;
+        },
+        groupBy() {
+          return this;
+        },
+        orderBy() {
+          return this;
+        },
+        limit() {
+          return this;
+        },
+        insert(payload) {
+          const rows = Array.isArray(payload) ? payload : [payload];
+          const upsert = (row, overrides = {}) => {
+            if (table === 'app_settings') {
+              const key = row.setting_key;
+              const existing = settingsStore.get(key) || {};
+              settingsStore.set(key, { ...existing, ...row, ...overrides });
+            }
+            return Promise.resolve();
+          };
+
+          return {
+            onConflict() {
+              return {
+                merge(overrides) {
+                  return Promise.all(rows.map((row) => upsert(row, overrides))).then(() => undefined);
+                }
+              };
+            }
+          };
+        }
+      };
+    };
+
+    const dbMock = jest.fn((table) => buildQuery(table));
+    dbMock.raw = jest.fn();
+    dbMock.transaction = async (handler) => handler({
+      commit: async () => {},
+      rollback: async () => {}
+    });
+
+    jest.doMock('../src/database/db', () => ({
+      db: dbMock,
+      logActivity: jest.fn()
+    }));
+
+    jest.doMock('../src/middleware/auth', () => ({
+      adminAuth: (req, res, next) => {
+        req.admin = { id: 1, username: 'tester' };
+        next();
+      }
+    }));
+
+    jest.doMock('../src/services/publicSiteService', () => ({
+      clearPublicSiteCache: jest.fn(),
+      getDefaultPublicSitePayload: jest.fn(),
+      getRawPublicSiteSettings: jest.fn().mockResolvedValue({})
+    }));
+
+    jest.doMock('../src/services/rateLimitService', () => ({
+      clearSettingsCache: jest.fn()
+    }));
+
+    jest.doMock('../src/middleware/maintenance', () => ({
+      maintenanceMiddleware: (req, res, next) => next(),
+      clearMaintenanceCache: jest.fn()
+    }));
+
+    router = require('../src/routes/adminSettings');
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/settings', router);
+  });
+
+  afterEach(async () => {
+    resetModules();
+    if (tmpDir) {
+      await fsPromises.rm(tmpDir, { recursive: true, force: true });
+      tmpDir = null;
+    }
+    delete process.env.STORAGE_PATH;
+  });
+
+  it('stores logo uploads under STORAGE_PATH and deletes on branding reset', async () => {
+    const fileBuffer = Buffer.from('fake image data');
+
+    const uploadResponse = await request(app)
+      .post('/api/admin/settings/logo')
+      .attach('logo', fileBuffer, 'logo.png');
+
+    expect(uploadResponse.status).toBe(200);
+    expect(uploadResponse.body).toHaveProperty('logoUrl');
+    const logoUrl = uploadResponse.body.logoUrl;
+    expect(logoUrl.startsWith('/uploads/logos/')).toBe(true);
+
+    const storedPath = path.join(tmpDir, logoUrl.replace('/uploads/', 'uploads/'));
+    await expect(fsPromises.access(storedPath)).resolves.toBeUndefined();
+
+    await request(app)
+      .put('/api/admin/settings/branding')
+      .send({
+        company_name: 'Test Co',
+        company_tagline: 'Tagline',
+        support_email: 'test@example.com',
+        footer_text: 'Footer',
+        watermark_enabled: false,
+        watermark_position: 'bottom-right',
+        watermark_opacity: 0.5,
+        watermark_size: 'medium',
+        favicon_url: null,
+        logo_url: '',
+        watermark_logo_url: null,
+        logo_size: 'medium',
+        logo_max_height: 120,
+        logo_position: 'left',
+        logo_display_header: true,
+        logo_display_hero: false,
+        logo_display_mode: 'default'
+      })
+      .expect(200);
+
+    await expect(fsPromises.access(storedPath)).rejects.toThrow();
+  });
+});

backend/__tests__/integration/adminPhotos.reference.test.js

@@ -0,0 +1,207 @@
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const express = require('express');
+const request = require('supertest');
+
+describe('Admin photos in reference mode', () => {
+  let tmpDir;
+  let storagePath;
+  let db;
+  let app;
+  let categoryId;
+
+  const resetModules = () => {
+    jest.resetModules();
+    jest.clearAllMocks();
+  };
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-admin-photos-'));
+    storagePath = path.join(tmpDir, 'storage');
+    await fs.promises.mkdir(storagePath, { recursive: true });
+
+    process.env.NODE_ENV = 'test';
+    process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'data', 'photo_sharing_test.db');
+    await fs.promises.mkdir(path.dirname(process.env.TEST_DATABASE_PATH), { recursive: true });
+    try {
+      await fs.promises.unlink(process.env.TEST_DATABASE_PATH);
+    } catch (_) {
+      /* ignore */
+    }
+    process.env.STORAGE_PATH = storagePath;
+
+    resetModules();
+
+    jest.doMock('../../src/middleware/auth', () => ({
+      adminAuth: (req, _res, next) => {
+        req.admin = { id: 1, username: 'tester' };
+        next();
+      }
+    }));
+
+    jest.doMock('../../src/services/imageProcessor', () => ({
+      generateThumbnail: jest.fn().mockResolvedValue('thumbnails/mock-thumb.jpg'),
+      ensureThumbnail: jest.fn()
+    }));
+
+    jest.doMock('../../src/middleware/uploadValidation', () => ({
+      validateUploadedFiles: (_req, _res, next) => next()
+    }));
+
+    jest.doMock('../../src/utils/fileSecurityUtils', () => {
+      const actual = jest.requireActual('../../src/utils/fileSecurityUtils');
+      return {
+        ...actual,
+        validateFileType: () => true,
+        createFileUploadValidator: () => (_req, _res, next) => next()
+      };
+    });
+
+    jest.doMock('../../src/utils/logger', () => ({
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn()
+    }));
+
+    const dbModule = require('../../src/database/db');
+    db = dbModule.db;
+
+    await db.schema.dropTableIfExists('photo_feedback');
+    await db.schema.dropTableIfExists('photos');
+    await db.schema.dropTableIfExists('photo_categories');
+    await db.schema.dropTableIfExists('events');
+
+    await db.schema.createTable('events', (table) => {
+      table.increments('id').primary();
+      table.string('slug').notNullable();
+      table.string('event_name').notNullable();
+      table.string('source_mode').notNullable();
+      table.string('external_path');
+    });
+
+    await db.schema.createTable('photo_categories', (table) => {
+      table.increments('id').primary();
+      table.string('name').notNullable();
+      table.string('slug').notNullable();
+      table.boolean('is_global').defaultTo(true);
+      table.integer('event_id');
+    });
+
+    await db.schema.createTable('photos', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').notNullable();
+      table.string('filename').notNullable();
+      table.string('path').notNullable();
+      table.string('thumbnail_path');
+      table.string('type').notNullable();
+      table.integer('size_bytes');
+      table.integer('category_id');
+      table.string('source_origin');
+      table.string('external_relpath');
+      table.datetime('uploaded_at').defaultTo(db.fn.now());
+      table.float('average_rating').defaultTo(0);
+      table.integer('like_count').defaultTo(0);
+      table.integer('favorite_count').defaultTo(0);
+    });
+
+    await db.schema.createTable('photo_feedback', (table) => {
+      table.increments('id');
+      table.integer('photo_id');
+      table.string('feedback_type');
+      table.boolean('is_approved');
+      table.boolean('is_hidden');
+    });
+
+    await db('events').insert({
+      id: 1,
+      slug: 'test-event',
+      event_name: 'Test Event',
+      source_mode: 'reference',
+      external_path: 'external/library'
+    });
+
+    const insertedCategory = await db('photo_categories').insert({
+      name: 'Highlights',
+      slug: 'highlights',
+      is_global: true
+    });
+    categoryId = Array.isArray(insertedCategory) ? insertedCategory[0] : insertedCategory;
+
+    const router = require('../../src/routes/adminPhotos');
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/events', router);
+  });
+
+  afterAll(async () => {
+    if (db) {
+      await db.destroy();
+    }
+    resetModules();
+    delete process.env.TEST_DATABASE_PATH;
+    delete process.env.STORAGE_PATH;
+    if (tmpDir) {
+      await fs.promises.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it('stores managed uploads with category information and managed origin', async () => {
+    const uploadResponse = await request(app)
+      .post(`/api/admin/events/1/upload`)
+      .field('category_id', String(categoryId))
+      .attach('photos', Buffer.from('fake image data'), 'photo.jpg');
+
+    expect(uploadResponse.status).toBe(200);
+    expect(uploadResponse.body).toHaveProperty('photos');
+    expect(Array.isArray(uploadResponse.body.photos)).toBe(true);
+
+    const photo = await db('photos').first();
+    expect(photo).toBeTruthy();
+    expect(photo.category_id).toBe(categoryId);
+    expect(photo.source_origin).toBe('managed');
+    expect(photo.external_relpath).toBeNull();
+  });
+
+  it('returns numeric category metadata when listing photos', async () => {
+    await db('photos').insert({
+      event_id: 1,
+      filename: 'external.jpg',
+      path: 'test-event/external.jpg',
+      thumbnail_path: null,
+      type: 'individual',
+      size_bytes: 123,
+      source_origin: 'external',
+      external_relpath: 'individual/external.jpg'
+    });
+
+    const response = await request(app)
+      .get(`/api/admin/events/1/photos`)
+      .expect(200);
+
+    expect(Array.isArray(response.body.photos)).toBe(true);
+    const managedPhoto = response.body.photos.find((p) => p.category_id === categoryId);
+    expect(managedPhoto).toBeTruthy();
+    expect(managedPhoto.category_name).toBe('Highlights');
+
+    const filtered = await request(app)
+      .get(`/api/admin/events/1/photos`)
+      .query({ category_id: String(categoryId) })
+      .expect(200);
+
+    expect(filtered.body.photos.every((p) => p.category_id === categoryId)).toBe(true);
+  });
+
+  it('normalizes category updates', async () => {
+    const photo = await db('photos').first();
+
+    await request(app)
+      .patch(`/api/admin/events/1/photos/${photo.id}`)
+      .send({ category_id: '0' })
+      .expect(200);
+
+    const updated = await db('photos').where({ id: photo.id }).first();
+    expect(updated.category_id).toBeNull();
+  });
+});

backend/__tests__/integration/backup-s3.test.js

@@ -1,4 +1,4 @@
-const { describe, it, expect, jest, beforeAll, afterAll, beforeEach, afterEach } = require('@jest/globals');
+const { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach } = require('@jest/globals');
 const { S3Client, CreateBucketCommand, DeleteBucketCommand, ListObjectsV2Command, DeleteObjectsCommand } = require('@aws-sdk/client-s3');
 const path = require('path');
 const fs = require('fs').promises;
@@ -503,4 +503,4 @@ describe('S3 Backup Integration Tests', () => {
       console.error('Failed to cleanup S3 objects:', error);
     }
   }
-});
+});

backend/__tests__/services/backupService.enhanced.test.js

@@ -1,4 +1,4 @@
-const { describe, it, expect, jest, beforeEach, afterEach } = require('@jest/globals');
+const { describe, it, expect, beforeEach, afterEach } = require('@jest/globals');
 const mockFs = require('mock-fs');
 const path = require('path');
 const crypto = require('crypto');
@@ -748,4 +748,4 @@ describe('Enhanced Backup Service Tests', () => {
       );
     });
   });
-});
+});

backend/__tests__/services/photoResolver.test.js

@@ -0,0 +1,85 @@
+const path = require('path');
+const mockPath = path;
+
+jest.mock('../../src/services/externalMediaService', () => ({
+  resolveExternalPath: jest.fn((event, relPath) => mockPath.join('/mock/external', event.external_path || '', relPath || '')),
+}));
+
+const { resolveExternalPath } = require('../../src/services/externalMediaService');
+const { resolvePhotoFilePath } = require('../../src/services/photoResolver');
+
+describe('resolvePhotoFilePath', () => {
+  const backendRoot = path.resolve(__dirname, '../../');
+  const originalStoragePath = process.env.STORAGE_PATH;
+
+  beforeEach(() => {
+    process.env.STORAGE_PATH = path.join(backendRoot, 'storage');
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterAll(() => {
+    if (typeof originalStoragePath === 'string') {
+      process.env.STORAGE_PATH = originalStoragePath;
+    } else {
+      delete process.env.STORAGE_PATH;
+    }
+  });
+
+  it('returns absolute path for managed photos with legacy slug paths', () => {
+    const event = { slug: 'wedding-party', source_mode: 'managed' };
+    const photo = { path: 'wedding-party/hero.jpg' };
+
+    const result = resolvePhotoFilePath(event, photo);
+
+    expect(result).toBe(path.join(backendRoot, 'storage', 'events/active', 'wedding-party', 'hero.jpg'));
+  });
+
+  it('normalizes prefixed managed paths without duplicating segments', () => {
+    const event = { slug: 'wedding-party', source_mode: 'managed' };
+    const photo = { path: 'events/active/wedding-party/hero.jpg' };
+
+    const result = resolvePhotoFilePath(event, photo);
+
+    expect(result).toBe(path.join(backendRoot, 'storage', 'events/active', 'wedding-party', 'hero.jpg'));
+  });
+
+  it('delegates external photos to external media resolver', () => {
+    const event = { slug: 'fashion-show', source_mode: 'reference', external_path: 'picsum-demo' };
+    const photo = { source_origin: 'external', external_relpath: 'individual/look-01.jpg' };
+
+    const result = resolvePhotoFilePath(event, photo);
+
+    expect(resolveExternalPath).toHaveBeenCalledWith(event, 'individual/look-01.jpg');
+    expect(result).toBe(path.join('/mock/external', 'picsum-demo', 'individual', 'look-01.jpg'));
+  });
+
+  it('deduplicates folder names when event external path already ends with segment', () => {
+    const event = { slug: 'fashion-show', source_mode: 'reference', external_path: 'picsum-demo/individual' };
+    const photo = { source_origin: 'external', external_relpath: 'individual/look-02.jpg' };
+
+    const result = resolvePhotoFilePath(event, photo);
+
+    expect(resolveExternalPath).toHaveBeenCalledWith(event, 'look-02.jpg');
+    expect(result).toBe(path.join('/mock/external', 'picsum-demo/individual', 'look-02.jpg'));
+  });
+
+  it('falls back to managed storage when external metadata is missing', () => {
+    const event = { slug: 'fashion-show', source_mode: 'reference', external_path: 'picsum-demo' };
+    const photo = { path: 'fashion-show/new-upload.jpg' };
+
+    const result = resolvePhotoFilePath(event, photo);
+
+    expect(resolveExternalPath).not.toHaveBeenCalled();
+    expect(result).toBe(path.join(backendRoot, 'storage', 'events/active', 'fashion-show', 'new-upload.jpg'));
+  });
+
+  it('throws when external photo is missing relative path data', () => {
+    const event = { slug: 'fashion-show', source_mode: 'reference', external_path: 'picsum-demo' };
+    const photo = { source_origin: 'external' };
+
+    expect(() => resolvePhotoFilePath(event, photo)).toThrow('Missing external_relpath for external photo');
+  });
+});

backend/dependencies-backend.json

@@ -1831,8 +1831,8 @@
       }
     },
     "nodemailer": {
-      "version": "6.10.1",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-6.10.1.tgz",
+      "version": "7.0.7",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.7.tgz",
       "overridden": false
     },
     "nodemon": {
@@ -2086,8 +2086,8 @@
               "version": "4.0.1"
             },
             "tar-fs": {
-              "version": "2.1.3",
-              "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
+              "version": "2.1.4",
+              "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
               "overridden": false
             },
             "tunnel-agent": {

backend/jest.setup.js

@@ -1,4 +1,10 @@
 beforeAll(() => {
   process.env.NODE_ENV = 'test';
   process.env.JWT_SECRET = 'test-secret';
+  if (!process.env.SKIP_S3_TESTS) {
+    process.env.SKIP_S3_TESTS = 'true';
+  }
+  if (!process.env.STORAGE_PATH) {
+    process.env.STORAGE_PATH = '/storage';
+  }
 });

backend/knexfile.js

@@ -3,6 +3,54 @@ require('dotenv').config();
 const path = require('path');
 
 // Database configuration for different environments
+const resolveSqliteFilename = (filenameEnv) => {
+  const fallback = path.join(__dirname, './data/photo_sharing.db');
+
+  if (!filenameEnv) {
+    return fallback;
+  }
+
+  const trimmed = String(filenameEnv).trim();
+  if (!trimmed) {
+    return fallback;
+  }
+
+  let resolved;
+  if (path.isAbsolute(trimmed)) {
+    resolved = trimmed;
+  } else if (trimmed.startsWith('./') || trimmed.startsWith('../')) {
+    resolved = path.resolve(__dirname, trimmed);
+  } else {
+    resolved = path.join(__dirname, trimmed);
+  }
+
+  const normalized = path.normalize(resolved);
+  const baseSuffix = path.relative(path.parse(__dirname).root, path.normalize(__dirname));
+  const duplicatePattern = `${path.sep}${baseSuffix}${path.sep}${baseSuffix}`;
+
+  if (normalized.includes(duplicatePattern)) {
+    return normalized.replace(duplicatePattern, `${path.sep}${baseSuffix}`);
+  }
+
+  return normalized;
+};
+
+const sqliteConnection = (filenameEnv) => ({
+  filename: resolveSqliteFilename(filenameEnv)
+});
+
+const baseSqliteConfig = {
+  client: 'sqlite3',
+  connection: sqliteConnection(),
+  useNullAsDefault: true,
+  migrations: {
+    directory: './migrations'
+  },
+  seeds: {
+    directory: './seeds'
+  }
+};
+
 const config = {
   development: {
     client: process.env.DATABASE_CLIENT || 'sqlite3',
@@ -13,7 +61,7 @@ const config = {
       password: process.env.DB_PASSWORD || 'postgres',
       database: process.env.DB_NAME || 'photo_sharing'
     } : {
-      filename: path.join(__dirname, process.env.DATABASE_PATH || './data/photo_sharing.db')
+      filename: resolveSqliteFilename(process.env.DATABASE_PATH || './data/photo_sharing.db')
     },
     useNullAsDefault: process.env.DATABASE_CLIENT !== 'pg',
     migrations: {
@@ -24,36 +72,65 @@ const config = {
     }
   },
 
+  test: (() => {
+    const client = process.env.DATABASE_CLIENT || 'sqlite3';
+    const isPostgres = client === 'pg';
+
+    return {
+      ...baseSqliteConfig,
+      client,
+      useNullAsDefault: !isPostgres,
+      connection: isPostgres
+        ? {
+            host: process.env.DB_HOST || 'localhost',
+            port: process.env.DB_PORT || 5432,
+            user: process.env.DB_USER || 'postgres',
+            password: process.env.DB_PASSWORD || 'postgres',
+            database: process.env.DB_NAME || 'photo_sharing_test'
+          }
+        : sqliteConnection(process.env.TEST_DATABASE_PATH || './data/photo_sharing_test.db')
+    };
+  })(),
+
   production: {
     client: process.env.DATABASE_CLIENT || 'pg',
-    connection: {
-      host: process.env.DB_HOST || 'db',
-      port: process.env.DB_PORT || 5432,
-      user: process.env.DB_USER || 'picpeak',
-      password: process.env.DB_PASSWORD,
-      database: process.env.DB_NAME || 'picpeak',
-      ssl: process.env.DB_SSL === 'true' ? { rejectUnauthorized: false } : false,
-      // Connection stability settings
-      connectionTimeoutMillis: 30000,
-      idleTimeoutMillis: 30000,
-      keepAlive: true,
-      keepAliveInitialDelayMillis: 0
-    },
-    pool: {
-      min: 5,
-      max: 25,
-      acquireTimeoutMillis: 60000,
-      createTimeoutMillis: 60000,
-      idleTimeoutMillis: 30000,
-      reapIntervalMillis: 1000,
-      createRetryIntervalMillis: 200,
-      propagateCreateError: false
-    },
+    // Support both Postgres and SQLite in production based on DATABASE_CLIENT
+    connection: (process.env.DATABASE_CLIENT || 'pg') === 'pg'
+      ? {
+          host: process.env.DB_HOST || 'db',
+          port: process.env.DB_PORT || 5432,
+          user: process.env.DB_USER || 'picpeak',
+          password: process.env.DB_PASSWORD,
+          database: process.env.DB_NAME || 'picpeak',
+          ssl: process.env.DB_SSL === 'true' ? { rejectUnauthorized: false } : false,
+          // Connection stability settings
+          connectionTimeoutMillis: 30000,
+          idleTimeoutMillis: 30000,
+          keepAlive: true,
+          keepAliveInitialDelayMillis: 0
+        }
+      : {
+          filename: resolveSqliteFilename(process.env.DATABASE_PATH || './data/photo_sharing.db')
+        },
+    useNullAsDefault: (process.env.DATABASE_CLIENT || 'pg') !== 'pg',
+    pool: (process.env.DATABASE_CLIENT || 'pg') === 'pg'
+      ? {
+          min: 5,
+          max: 25,
+          acquireTimeoutMillis: 60000,
+          createTimeoutMillis: 60000,
+          idleTimeoutMillis: 30000,
+          reapIntervalMillis: 1000,
+          createRetryIntervalMillis: 200,
+          propagateCreateError: false
+        }
+      : undefined,
     migrations: {
       directory: './migrations'
     },
     acquireConnectionTimeout: 60000
   }
 };
+const env = process.env.NODE_ENV || 'development';
 
-module.exports = config[process.env.NODE_ENV || 'development'];
+module.exports = config[env] || config.development;

backend/migrations/004_add_categories_and_cms.js

@@ -1,101 +0,0 @@
-const { db } = require('../src/database/db');
-
-async function up() {
-  console.log('Adding photo categories and CMS tables...');
-  
-  // Create photo_categories table
-  await db.schema.createTable('photo_categories', (table) => {
-    table.increments('id').primary();
-    table.string('name', 100).notNullable();
-    table.string('slug', 100).notNullable();
-    table.boolean('is_global').defaultTo(true);
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.timestamp('created_at').defaultTo(db.fn.now());
-    
-    // Unique constraint for slug within event scope
-    table.unique(['slug', 'event_id']);
-  });
-
-  // Create cms_pages table
-  await db.schema.createTable('cms_pages', (table) => {
-    table.increments('id').primary();
-    table.string('slug', 100).unique().notNullable();
-    table.text('title_en');
-    table.text('title_de');
-    table.text('content_en');
-    table.text('content_de');
-    table.timestamp('updated_at').defaultTo(db.fn.now());
-  });
-
-  // Add category_id to photos table
-  await db.schema.alterTable('photos', (table) => {
-    table.integer('category_id').references('id').inTable('photo_categories');
-  });
-
-  // Add language preference to admin_users
-  await db.schema.alterTable('admin_users', (table) => {
-    table.string('language', 2).defaultTo('en');
-  });
-
-  // Add language preference to app_settings for global default
-  await db('app_settings').insert({
-    setting_key: 'default_language',
-    setting_value: 'en',
-    setting_type: 'general',
-    updated_at: new Date()
-  });
-
-  // Insert default global categories
-  const defaultCategories = [
-    { name: 'Ceremony', slug: 'ceremony', is_global: true },
-    { name: 'Reception', slug: 'reception', is_global: true },
-    { name: 'Portraits', slug: 'portraits', is_global: true },
-    { name: 'Group Photos', slug: 'group-photos', is_global: true },
-    { name: 'Details', slug: 'details', is_global: true },
-    { name: 'Party', slug: 'party', is_global: true }
-  ];
-
-  await db('photo_categories').insert(defaultCategories);
-
-  // Insert default legal pages
-  await db('cms_pages').insert([
-    {
-      slug: 'impressum',
-      title_en: 'Legal Notice',
-      title_de: 'Impressum',
-      content_en: '<h2>Legal Notice</h2><p>Please edit this content in the admin panel.</p>',
-      content_de: '<h2>Impressum</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
-      updated_at: new Date()
-    },
-    {
-      slug: 'datenschutz',
-      title_en: 'Privacy Policy',
-      title_de: 'Datenschutzerklärung',
-      content_en: '<h2>Privacy Policy</h2><p>Please edit this content in the admin panel.</p>',
-      content_de: '<h2>Datenschutzerklärung</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
-      updated_at: new Date()
-    }
-  ]);
-
-  console.log('Photo categories and CMS tables created successfully');
-}
-
-async function down() {
-  // Remove language from app_settings
-  await db('app_settings').where('setting_key', 'default_language').delete();
-  
-  // Drop columns
-  await db.schema.alterTable('admin_users', (table) => {
-    table.dropColumn('language');
-  });
-  
-  await db.schema.alterTable('photos', (table) => {
-    table.dropColumn('category_id');
-  });
-  
-  // Drop tables
-  await db.schema.dropTableIfExists('cms_pages');
-  await db.schema.dropTableIfExists('photo_categories');
-}
-
-module.exports = { up, down };

backend/migrations/011_add_user_upload_settings.js

@@ -1,23 +0,0 @@
-exports.up = async function(knex) {
-  // Add user upload settings to events table
-  await knex.schema.alterTable('events', function(table) {
-    table.boolean('allow_user_uploads').defaultTo(false);
-    table.integer('upload_category_id').references('id').inTable('photo_categories').onDelete('SET NULL');
-  });
-  
-  // Add uploaded_by field to photos table to track who uploaded
-  await knex.schema.alterTable('photos', function(table) {
-    table.string('uploaded_by').defaultTo('admin'); // 'admin' or guest identifier
-  });
-};
-
-exports.down = async function(knex) {
-  await knex.schema.alterTable('events', function(table) {
-    table.dropColumn('allow_user_uploads');
-    table.dropColumn('upload_category_id');
-  });
-  
-  await knex.schema.alterTable('photos', function(table) {
-    table.dropColumn('uploaded_by');
-  });
-};

backend/migrations/015_add_login_attempts_table.js

@@ -1,19 +0,0 @@
-exports.up = function(knex) {
-  return knex.schema.createTable('login_attempts', table => {
-    table.increments('id').primary();
-    table.string('identifier').notNullable(); // username or email
-    table.string('ip_address', 45).notNullable(); // IPv4 or IPv6
-    table.text('user_agent');
-    table.timestamp('attempt_time').defaultTo(knex.fn.now());
-    table.boolean('success').defaultTo(false);
-    
-    // Indexes for performance
-    table.index('identifier');
-    table.index('attempt_time');
-    table.index(['identifier', 'success', 'attempt_time']);
-  });
-};
-
-exports.down = function(knex) {
-  return knex.schema.dropTableIfExists('login_attempts');
-};

backend/migrations/016_add_auth_security_columns.js

@@ -1,25 +0,0 @@
-exports.up = function(knex) {
-  return knex.schema.table('admin_users', table => {
-    // Add password change tracking
-    table.timestamp('password_changed_at').nullable();
-    
-    // Add last login IP for security monitoring
-    table.string('last_login_ip', 45).nullable();
-    
-    // Add account security flags
-    table.boolean('two_factor_enabled').defaultTo(false);
-    table.string('two_factor_secret').nullable();
-    
-    // Add index for performance
-    table.index('password_changed_at');
-  });
-};
-
-exports.down = function(knex) {
-  return knex.schema.table('admin_users', table => {
-    table.dropColumn('password_changed_at');
-    table.dropColumn('last_login_ip');
-    table.dropColumn('two_factor_enabled');
-    table.dropColumn('two_factor_secret');
-  });
-};

backend/migrations/017_add_token_revocation_tables.js

@@ -1,34 +0,0 @@
-exports.up = function(knex) {
-  return knex.schema
-    // Table for individual token revocations
-    .createTable('revoked_tokens', table => {
-      table.increments('id').primary();
-      table.string('token_id').notNullable().unique(); // JWT ID or generated ID
-      table.integer('user_id').nullable(); // User who owned the token
-      table.string('token_type', 20); // admin, gallery, etc.
-      table.timestamp('revoked_at').defaultTo(knex.fn.now());
-      table.timestamp('expires_at').notNullable(); // When token would have expired
-      table.string('reason', 100); // password_change, logout, compromised, etc.
-      table.text('metadata'); // Additional JSON data
-      
-      // Indexes for performance
-      table.index('token_id');
-      table.index('user_id');
-      table.index('expires_at'); // For cleanup
-    })
-    // Table for user-level revocations (revoke all tokens before a certain time)
-    .createTable('user_token_revocations', table => {
-      table.integer('user_id').primary();
-      table.timestamp('revoked_at').notNullable();
-      table.string('reason', 100);
-      
-      // Index for quick lookups
-      table.index('revoked_at');
-    });
-};
-
-exports.down = function(knex) {
-  return knex.schema
-    .dropTableIfExists('user_token_revocations')
-    .dropTableIfExists('revoked_tokens');
-};

backend/migrations/033_add_gallery_feedback.js

@@ -1,129 +0,0 @@
-// No helpers needed for boolean values
-
-exports.up = async function(knex) {
-  console.log('Adding gallery feedback tables...');
-  
-  // Create event_feedback_settings table
-  await knex.schema.createTable('event_feedback_settings', (table) => {
-    table.increments('id').primary();
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.boolean('feedback_enabled').defaultTo(false);
-    table.boolean('allow_ratings').defaultTo(true);
-    table.boolean('allow_likes').defaultTo(true);
-    table.boolean('allow_comments').defaultTo(false);
-    table.boolean('allow_favorites').defaultTo(true);
-    table.boolean('require_name_email').defaultTo(false);
-    table.boolean('moderate_comments').defaultTo(true);
-    table.boolean('show_feedback_to_guests').defaultTo(true);
-    table.timestamp('created_at').defaultTo(knex.fn.now());
-    table.timestamp('updated_at').defaultTo(knex.fn.now());
-    table.unique(['event_id']);
-  });
-
-  // Create photo_feedback table
-  await knex.schema.createTable('photo_feedback', (table) => {
-    table.increments('id').primary();
-    table.integer('photo_id').references('id').inTable('photos').onDelete('CASCADE');
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.string('feedback_type', 20).notNullable();
-    table.integer('rating');
-    table.text('comment_text');
-    table.string('guest_name', 100);
-    table.string('guest_email', 255);
-    table.string('guest_identifier', 64);
-    table.string('ip_address', 45);
-    table.text('user_agent');
-    table.boolean('is_approved').defaultTo(true);
-    table.boolean('is_hidden').defaultTo(false);
-    table.timestamp('created_at').defaultTo(knex.fn.now());
-    table.timestamp('updated_at').defaultTo(knex.fn.now());
-    
-    // Add indexes
-    table.index(['photo_id']);
-    table.index(['event_id']);
-    table.index(['feedback_type']);
-    table.index(['guest_identifier']);
-    
-    // Add check constraint for rating (PostgreSQL)
-    if (knex.client.config.client === 'pg') {
-      table.check('?? >= 1 AND ?? <= 5', ['rating', 'rating']);
-    }
-  });
-
-  // Create feedback_rate_limits table
-  await knex.schema.createTable('feedback_rate_limits', (table) => {
-    table.increments('id').primary();
-    table.string('identifier', 64).notNullable();
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.string('action_type', 20).notNullable();
-    table.integer('action_count').defaultTo(1);
-    table.timestamp('window_start').defaultTo(knex.fn.now());
-    
-    // Add indexes
-    table.index(['identifier', 'event_id', 'action_type']);
-    table.index(['window_start']);
-  });
-
-  // Create feedback_word_filters table
-  await knex.schema.createTable('feedback_word_filters', (table) => {
-    table.increments('id').primary();
-    table.string('word', 100).notNullable();
-    table.string('severity', 20).defaultTo('moderate');
-    table.boolean('is_active').defaultTo(true);
-    table.timestamp('created_at').defaultTo(knex.fn.now());
-    table.unique(['word']);
-  });
-
-  // Add feedback summary columns to photos table
-  await knex.schema.alterTable('photos', (table) => {
-    table.integer('feedback_count').defaultTo(0);
-    table.integer('like_count').defaultTo(0);
-    table.decimal('average_rating', 3, 2).defaultTo(0);
-    table.integer('favorite_count').defaultTo(0);
-  });
-
-  // Add feedback notification settings to app_settings
-  await knex('app_settings').insert([
-    {
-      setting_key: 'feedback_notification_email',
-      setting_value: JSON.stringify(''),
-      setting_type: 'feedback'
-    },
-    {
-      setting_key: 'feedback_rate_limits',
-      setting_value: JSON.stringify({
-        rating: { max: 100, window: 3600 }, // 100 ratings per hour
-        comment: { max: 20, window: 3600 }, // 20 comments per hour
-        like: { max: 200, window: 3600 } // 200 likes per hour
-      }),
-      setting_type: 'feedback'
-    }
-  ]);
-  
-  console.log('Gallery feedback tables created successfully');
-};
-
-exports.down = async function(knex) {
-  console.log('Removing gallery feedback tables...');
-  
-  // Remove feedback settings from app_settings
-  await knex('app_settings')
-    .whereIn('setting_key', ['feedback_notification_email', 'feedback_rate_limits'])
-    .delete();
-
-  // Remove feedback columns from photos table
-  await knex.schema.alterTable('photos', (table) => {
-    table.dropColumn('feedback_count');
-    table.dropColumn('like_count');
-    table.dropColumn('average_rating');
-    table.dropColumn('favorite_count');
-  });
-
-  // Drop tables in reverse order
-  await knex.schema.dropTableIfExists('feedback_word_filters');
-  await knex.schema.dropTableIfExists('feedback_rate_limits');
-  await knex.schema.dropTableIfExists('photo_feedback');
-  await knex.schema.dropTableIfExists('event_feedback_settings');
-  
-  console.log('Gallery feedback tables removed');
-};

backend/migrations/041_add_logo_customization_settings.js

@@ -0,0 +1,89 @@
+exports.up = async function(knex) {
+  console.log('Running migration: 041_add_logo_customization_settings');
+  
+  // Add default logo customization settings
+  const logoSettings = [
+    {
+      setting_key: 'branding_logo_size',
+      setting_value: JSON.stringify('medium'),
+      setting_type: 'branding',
+      description: 'Logo size: small, medium, large, xlarge, or custom',
+      created_at: new Date(),
+      updated_at: new Date()
+    },
+    {
+      setting_key: 'branding_logo_max_height',
+      setting_value: JSON.stringify(48),
+      setting_type: 'branding', 
+      description: 'Maximum logo height in pixels (used when size is custom)',
+      created_at: new Date(),
+      updated_at: new Date()
+    },
+    {
+      setting_key: 'branding_logo_position',
+      setting_value: JSON.stringify('left'),
+      setting_type: 'branding',
+      description: 'Logo position in header: left, center, right',
+      created_at: new Date(),
+      updated_at: new Date()
+    },
+    {
+      setting_key: 'branding_logo_display_header',
+      setting_value: JSON.stringify(true),
+      setting_type: 'branding',
+      description: 'Show logo in gallery header',
+      created_at: new Date(),
+      updated_at: new Date()
+    },
+    {
+      setting_key: 'branding_logo_display_hero',
+      setting_value: JSON.stringify(true),
+      setting_type: 'branding',
+      description: 'Show logo in hero section (for non-grid layouts)',
+      created_at: new Date(),
+      updated_at: new Date()
+    },
+    {
+      setting_key: 'branding_logo_display_mode',
+      setting_value: JSON.stringify('logo_and_text'),
+      setting_type: 'branding',
+      description: 'Display mode: logo_only, text_only, logo_and_text',
+      created_at: new Date(),
+      updated_at: new Date()
+    }
+  ];
+
+  // Insert settings that don't already exist
+  for (const setting of logoSettings) {
+    const exists = await knex('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await knex('app_settings').insert(setting);
+      console.log(`Added setting: ${setting.setting_key}`);
+    } else {
+      console.log(`Setting already exists: ${setting.setting_key}`);
+    }
+  }
+
+  console.log('Migration 041_add_logo_customization_settings completed');
+};
+
+exports.down = async function(knex) {
+  console.log('Rolling back migration: 041_add_logo_customization_settings');
+  
+  // Remove the logo customization settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'branding_logo_size',
+      'branding_logo_max_height',
+      'branding_logo_position',
+      'branding_logo_display_header',
+      'branding_logo_display_hero',
+      'branding_logo_display_mode'
+    ])
+    .del();
+  
+  console.log('Rollback of 041_add_logo_customization_settings completed');
+};

backend/migrations/README.md

@@ -0,0 +1,46 @@
+# Database Migrations
+
+This directory contains database migrations for the Wedding Photo Sharing platform.
+
+## Directory Structure
+
+### `/core`
+Essential migrations that are always run for new deployments. These include:
+- `init.js` - Initial database schema creation
+- Backup service tables (029-035)
+- Gallery feedback tables (033)
+
+### `/legacy`
+Migrations needed only when upgrading from older versions. New deployments can skip these as the core schema already includes all necessary tables and columns.
+
+## For New Deployments
+
+If you're deploying this application for the first time:
+1. The `initializeDatabase()` function in `src/database/db.js` will create all necessary tables
+2. Only migrations in the `/core` directory will be run
+3. This ensures a clean, optimized database schema
+
+## For Existing Deployments
+
+If you're upgrading from an older version:
+1. All migrations (both core and legacy) will be run in sequence
+2. The migration system tracks which migrations have been applied
+3. Only new migrations will be executed
+
+## Running Migrations
+
+```bash
+# Development
+npm run migrate
+
+# Production
+npm run migrate:prod
+```
+
+## Note on Duplicate Migration Numbers
+
+The legacy directory contains renamed duplicates:
+- `014_add_host_name_to_events_duplicate.js` (was duplicate of 014)
+- `027_add_rate_limit_settings_duplicate.js` (was duplicate of 027)
+
+These have been renamed to avoid conflicts while preserving the migration history.

backend/migrations/core/001_init.js

@@ -1,33 +1,39 @@
 const bcrypt = require('bcrypt');
-const { db, initializeDatabase } = require('../src/database/db');
-const { generateReadablePassword } = require('../src/utils/passwordGenerator');
+const { initializeDatabase } = require('../../src/database/db');
+const { generateReadablePassword } = require('../../src/utils/passwordGenerator');
 const fs = require('fs').promises;
 const path = require('path');
 
-async function runMigrations() {
-  console.log('Running database migrations...');
+exports.up = async function(knex) {
+  console.log('Initializing database schema...');
   
   try {
     // Initialize tables
     await initializeDatabase();
     
     // Create default admin user if none exists
-    const adminExists = await db('admin_users').first();
+    const adminExists = await knex('admin_users').first();
     if (!adminExists) {
       // Generate a secure random password
       const generatedPassword = generateReadablePassword();
       const passwordHash = await bcrypt.hash(generatedPassword, 12); // Increased rounds for better security
       
-      await db('admin_users').insert({
-        username: 'admin',
-        email: 'admin@example.com',
+      // Get admin credentials from environment or use defaults
+      const adminUsername = process.env.ADMIN_USERNAME || 'admin';
+      const adminEmail = process.env.ADMIN_EMAIL || 'admin@example.com';
+      
+      await knex('admin_users').insert({
+        username: adminUsername,
+        email: adminEmail,
         password_hash: passwordHash,
-        must_change_password: true, // Flag for forcing password change
+        must_change_password: true,
         created_at: new Date()
       });
       
-      // Save the generated password to a file for the user to retrieve
-      const setupInfoPath = path.join(__dirname, '..', '..', 'ADMIN_CREDENTIALS.txt');
+      // Try to save credentials to file, but don't fail if we can't
+      const dataDir = path.join(__dirname, '..', '..', 'data');
+      const setupInfoPath = path.join(dataDir, 'ADMIN_CREDENTIALS.txt');
+      
       const setupInfo = `
 ========================================
 PicPeak Admin Credentials
@@ -35,39 +41,49 @@ PicPeak Admin Credentials
 
 Your admin account has been created with these credentials:
 
-Username: admin
+Email: ${adminEmail}
 Password: ${generatedPassword}
 
 IMPORTANT SECURITY NOTES:
-1. You MUST change this password on first login
+1. Please change this password after first login
 2. This file will be created only once
 3. Store these credentials securely
 4. Delete this file after noting the password
 
 Login URL: ${process.env.ADMIN_URL || 'http://localhost:3001'}/admin
 
+Login with the email address shown above
+
 Generated on: ${new Date().toISOString()}
 ========================================
 `;
       
-      await fs.writeFile(setupInfoPath, setupInfo, 'utf8');
+      try {
+        // Try to create directory and write file
+        await fs.mkdir(dataDir, { recursive: true });
+        await fs.writeFile(setupInfoPath, setupInfo, 'utf8');
+        console.log(`📁 Credentials also saved to: data/ADMIN_CREDENTIALS.txt`);
+      } catch (error) {
+        // If we can't write the file, that's okay - credentials are shown in console
+        console.log('⚠️  Could not save credentials to file (permission denied)');
+        console.log('   Please copy the credentials shown above');
+      }
       
       console.log('\n========================================');
       console.log('✅ Admin user created successfully!');
       console.log('========================================');
-      console.log('Username: admin');
+      console.log(`Email: ${adminEmail}`);
       console.log(`Password: ${generatedPassword}`);
       console.log('\n⚠️  IMPORTANT:');
       console.log('1. Save these credentials securely');
-      console.log('2. You will be required to change the password on first login');
-      console.log('3. Credentials are also saved in: ADMIN_CREDENTIALS.txt');
+      console.log('2. Please change the password after first login');
       console.log('========================================\n');
     }
     
     // Create default email templates if none exist
-    const templateExists = await db('email_templates').first();
+    const templateExists = await knex('email_templates').first();
     if (!templateExists) {
-      await db('email_templates').insert([
+      await knex('email_templates').insert([
         {
           template_key: 'gallery_created',
           subject: 'Your Photo Gallery is Ready!',
@@ -101,9 +117,9 @@ Generated on: ${new Date().toISOString()}
     }
 
     // Create default email config if none exists
-    const emailConfig = await db('email_configs').first();
+    const emailConfig = await knex('email_configs').first();
     if (!emailConfig) {
-      await db('email_configs').insert({
+      await knex('email_configs').insert({
         smtp_host: process.env.SMTP_HOST || 'mailhog',
         smtp_port: process.env.SMTP_PORT || 1025,
         smtp_secure: process.env.SMTP_SECURE === 'true',
@@ -116,11 +132,13 @@ Generated on: ${new Date().toISOString()}
     }
 
     console.log('Migrations completed successfully');
-    process.exit(0);
   } catch (error) {
-    console.error('Migration failed:', error);
-    process.exit(1);
+    console.error('Initial setup failed:', error);
+    throw error;
   }
-}
+};
 
-runMigrations();
+exports.down = async function(knex) {
+  // This migration cannot be rolled back as it creates the initial schema
+  console.log('Initial setup cannot be rolled back');
+};

backend/migrations/core/029_add_backup_service_tables.js

@@ -1,4 +1,4 @@
-const { db } = require('../src/database/db');
+const { db } = require('../../src/database/db');
 
 async function up() {
   console.log('Adding backup service tables and settings...');
@@ -156,9 +156,8 @@ async function up() {
   const backupEmailTemplates = [
     {
       template_key: 'backup_failed',
-      subject_en: 'Backup Failed - Immediate Attention Required',
-      subject_de: 'Backup fehlgeschlagen - Sofortige Aufmerksamkeit erforderlich',
-      body_html_en: `<h2>Backup Failed</h2>
+      subject: 'Backup Failed - Immediate Attention Required',
+      body_html: `<h2>Backup Failed</h2>
 <p>The scheduled backup has failed and requires immediate attention.</p>
 <p><strong>Error Details:</strong></p>
 <ul>
@@ -167,24 +166,13 @@ async function up() {
   <li>Error: {{error_message}}</li>
 </ul>
 <p>Please check the system logs for more details and resolve the issue as soon as possible.</p>`,
-      body_html_de: `<h2>Backup fehlgeschlagen</h2>
-<p>Das geplante Backup ist fehlgeschlagen und erfordert sofortige Aufmerksamkeit.</p>
-<p><strong>Fehlerdetails:</strong></p>
-<ul>
-  <li>Startzeit: {{start_time}}</li>
-  <li>Backup-Typ: {{backup_type}}</li>
-  <li>Fehler: {{error_message}}</li>
-</ul>
-<p>Bitte überprüfen Sie die Systemprotokolle für weitere Details und beheben Sie das Problem so schnell wie möglich.</p>`,
-      body_text_en: 'Backup Failed\n\nThe scheduled backup has failed and requires immediate attention.\n\nStart Time: {{start_time}}\nBackup Type: {{backup_type}}\nError: {{error_message}}\n\nPlease check the system logs for more details.',
-      body_text_de: 'Backup fehlgeschlagen\n\nDas geplante Backup ist fehlgeschlagen und erfordert sofortige Aufmerksamkeit.\n\nStartzeit: {{start_time}}\nBackup-Typ: {{backup_type}}\nFehler: {{error_message}}\n\nBitte überprüfen Sie die Systemprotokolle für weitere Details.',
+      body_text: 'Backup Failed\n\nThe scheduled backup has failed and requires immediate attention.\n\nStart Time: {{start_time}}\nBackup Type: {{backup_type}}\nError: {{error_message}}\n\nPlease check the system logs for more details.',
       variables: JSON.stringify(['start_time', 'backup_type', 'error_message'])
     },
     {
       template_key: 'backup_completed',
-      subject_en: 'Backup Completed Successfully',
-      subject_de: 'Backup erfolgreich abgeschlossen',
-      body_html_en: `<h2>Backup Completed</h2>
+      subject: 'Backup Completed Successfully',
+      body_html: `<h2>Backup Completed</h2>
 <p>The scheduled backup has been completed successfully.</p>
 <p><strong>Backup Summary:</strong></p>
 <ul>
@@ -194,18 +182,7 @@ async function up() {
   <li>Total Size: {{total_size}}</li>
   <li>Backup Type: {{backup_type}}</li>
 </ul>`,
-      body_html_de: `<h2>Backup abgeschlossen</h2>
-<p>Das geplante Backup wurde erfolgreich abgeschlossen.</p>
-<p><strong>Backup-Zusammenfassung:</strong></p>
-<ul>
-  <li>Startzeit: {{start_time}}</li>
-  <li>Dauer: {{duration}}</li>
-  <li>Gesicherte Dateien: {{files_count}}</li>
-  <li>Gesamtgröße: {{total_size}}</li>
-  <li>Backup-Typ: {{backup_type}}</li>
-</ul>`,
-      body_text_en: 'Backup Completed\n\nThe scheduled backup has been completed successfully.\n\nStart Time: {{start_time}}\nDuration: {{duration}}\nFiles Backed Up: {{files_count}}\nTotal Size: {{total_size}}\nBackup Type: {{backup_type}}',
-      body_text_de: 'Backup abgeschlossen\n\nDas geplante Backup wurde erfolgreich abgeschlossen.\n\nStartzeit: {{start_time}}\nDauer: {{duration}}\nGesicherte Dateien: {{files_count}}\nGesamtgröße: {{total_size}}\nBackup-Typ: {{backup_type}}',
+      body_text: 'Backup Completed\n\nThe scheduled backup has been completed successfully.\n\nStart Time: {{start_time}}\nDuration: {{duration}}\nFiles Backed Up: {{files_count}}\nTotal Size: {{total_size}}\nBackup Type: {{backup_type}}',
       variables: JSON.stringify(['start_time', 'duration', 'files_count', 'total_size', 'backup_type'])
     }
   ];

backend/migrations/core/030_add_database_backup_tables.js

@@ -1,4 +1,4 @@
-const { db } = require('../src/database/db');
+const { db } = require('../../src/database/db');
 
 async function up() {
   console.log('Adding database backup tables and settings...');
@@ -96,9 +96,8 @@ async function up() {
   const databaseBackupEmailTemplates = [
     {
       template_key: 'database_backup_failed',
-      subject_en: 'Database Backup Failed - Critical Alert',
-      subject_de: 'Datenbank-Backup fehlgeschlagen - Kritische Warnung',
-      body_html_en: `<h2>Database Backup Failed</h2>
+      subject: 'Database Backup Failed - Critical Alert',
+      body_html: `<h2>Database Backup Failed</h2>
 <p>The scheduled database backup has failed and requires immediate attention.</p>
 <p><strong>Error Details:</strong></p>
 <ul>
@@ -107,24 +106,13 @@ async function up() {
   <li>Error: {{error_message}}</li>
 </ul>
 <p>This is a critical issue that could affect disaster recovery. Please investigate immediately.</p>`,
-      body_html_de: `<h2>Datenbank-Backup fehlgeschlagen</h2>
-<p>Das geplante Datenbank-Backup ist fehlgeschlagen und erfordert sofortige Aufmerksamkeit.</p>
-<p><strong>Fehlerdetails:</strong></p>
-<ul>
-  <li>Backup-Typ: {{backup_type}}</li>
-  <li>Zeitstempel: {{timestamp}}</li>
-  <li>Fehler: {{error_message}}</li>
-</ul>
-<p>Dies ist ein kritisches Problem, das die Disaster-Recovery beeinträchtigen könnte. Bitte untersuchen Sie es sofort.</p>`,
-      body_text_en: 'Database Backup Failed\n\nThe scheduled database backup has failed.\n\nBackup Type: {{backup_type}}\nTimestamp: {{timestamp}}\nError: {{error_message}}\n\nThis is critical - please investigate immediately.',
-      body_text_de: 'Datenbank-Backup fehlgeschlagen\n\nDas geplante Datenbank-Backup ist fehlgeschlagen.\n\nBackup-Typ: {{backup_type}}\nZeitstempel: {{timestamp}}\nFehler: {{error_message}}\n\nDies ist kritisch - bitte sofort untersuchen.',
+      body_text: 'Database Backup Failed\n\nThe scheduled database backup has failed.\n\nBackup Type: {{backup_type}}\nTimestamp: {{timestamp}}\nError: {{error_message}}\n\nThis is critical - please investigate immediately.',
       variables: JSON.stringify(['backup_type', 'timestamp', 'error_message'])
     },
     {
       template_key: 'database_backup_completed',
-      subject_en: 'Database Backup Completed Successfully',
-      subject_de: 'Datenbank-Backup erfolgreich abgeschlossen',
-      body_html_en: `<h2>Database Backup Completed</h2>
+      subject: 'Database Backup Completed Successfully',
+      body_html: `<h2>Database Backup Completed</h2>
 <p>The scheduled database backup has been completed successfully.</p>
 <p><strong>Backup Summary:</strong></p>
 <ul>
@@ -134,18 +122,7 @@ async function up() {
   <li>Compression Ratio: {{compression_ratio}}</li>
   <li>File Path: {{file_path}}</li>
 </ul>`,
-      body_html_de: `<h2>Datenbank-Backup abgeschlossen</h2>
-<p>Das geplante Datenbank-Backup wurde erfolgreich abgeschlossen.</p>
-<p><strong>Backup-Zusammenfassung:</strong></p>
-<ul>
-  <li>Backup-Typ: {{backup_type}}</li>
-  <li>Dauer: {{duration}}</li>
-  <li>Dateigröße: {{file_size}}</li>
-  <li>Komprimierungsverhältnis: {{compression_ratio}}</li>
-  <li>Dateipfad: {{file_path}}</li>
-</ul>`,
-      body_text_en: 'Database Backup Completed\n\nThe scheduled database backup has been completed successfully.\n\nBackup Type: {{backup_type}}\nDuration: {{duration}}\nFile Size: {{file_size}}\nCompression Ratio: {{compression_ratio}}\nFile Path: {{file_path}}',
-      body_text_de: 'Datenbank-Backup abgeschlossen\n\nDas geplante Datenbank-Backup wurde erfolgreich abgeschlossen.\n\nBackup-Typ: {{backup_type}}\nDauer: {{duration}}\nDateigröße: {{file_size}}\nKomprimierungsverhältnis: {{compression_ratio}}\nDateipfad: {{file_path}}',
+      body_text: 'Database Backup Completed\n\nThe scheduled database backup has been completed successfully.\n\nBackup Type: {{backup_type}}\nDuration: {{duration}}\nFile Size: {{file_size}}\nCompression Ratio: {{compression_ratio}}\nFile Path: {{file_path}}',
       variables: JSON.stringify(['backup_type', 'duration', 'file_size', 'compression_ratio', 'file_path'])
     }
   ];

backend/migrations/core/031_add_backup_manifest_columns.js

@@ -1,5 +1,5 @@
-const { db } = require('../src/database/db');
-const logger = require('../src/utils/logger');
+const { db } = require('../../src/database/db');
+const logger = require('../../src/utils/logger');
 
 async function up() {
   console.log('Adding backup manifest columns...');

backend/migrations/core/032_add_restore_runs_table.js

@@ -5,7 +5,9 @@
  */
 exports.up = async function(knex) {
   // Create restore_runs table
-  await knex.schema.createTable('restore_runs', table => {
+  const hasRestoreRunsTable = await knex.schema.hasTable('restore_runs');
+  if (!hasRestoreRunsTable) {
+    await knex.schema.createTable('restore_runs', table => {
     table.increments('id').primary();
     
     // Timing
@@ -44,10 +46,13 @@ exports.up = async function(knex) {
     
     table.index(['status', 'started_at']);
     table.index(['restore_type', 'started_at']);
-  });
+    });
+  }
   
   // Create restore_file_operations table for tracking individual file operations
-  await knex.schema.createTable('restore_file_operations', table => {
+  const hasRestoreFileOperationsTable = await knex.schema.hasTable('restore_file_operations');
+  if (!hasRestoreFileOperationsTable) {
+    await knex.schema.createTable('restore_file_operations', table => {
     table.increments('id').primary();
     
     table.integer('restore_run_id').notNullable()
@@ -67,10 +72,13 @@ exports.up = async function(knex) {
     
     table.index(['restore_run_id', 'status']);
     table.index(['file_path']);
-  });
+    });
+  }
   
   // Create restore_validation_results table
-  await knex.schema.createTable('restore_validation_results', table => {
+  const hasRestoreValidationResultsTable = await knex.schema.hasTable('restore_validation_results');
+  if (!hasRestoreValidationResultsTable) {
+    await knex.schema.createTable('restore_validation_results', table => {
     table.increments('id').primary();
     
     table.integer('restore_run_id').notNullable()
@@ -86,10 +94,11 @@ exports.up = async function(knex) {
     table.timestamp('validated_at').notNullable().defaultTo(knex.fn.now());
     
     table.index(['restore_run_id', 'validation_type']);
-  });
+    });
+  }
   
   // Add restore-related settings to app_settings
-  await knex('app_settings').insert([
+  const restoreSettings = [
     {
       setting_key: 'restore_allow_force',
       setting_value: JSON.stringify(false),
@@ -120,15 +129,24 @@ exports.up = async function(knex) {
       setting_value: '30',
       setting_type: 'restore'
     }
-  ]);
+  ];
+
+  for (const setting of restoreSettings) {
+    const exists = await knex('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await knex('app_settings').insert(setting);
+    }
+  }
   
   // Add new email templates for restore notifications
   const emailTemplates = [
     {
       template_key: 'restore_completed',
-      subject_en: '✅ Restore Completed Successfully',
-      subject_de: '✅ Wiederherstellung erfolgreich abgeschlossen',
-      body_html_en: `<h2>Restore Operation Completed</h2>
+      subject: '✅ Restore Completed Successfully',
+      body_html: `<h2>Restore Operation Completed</h2>
 <p>A restore operation has completed successfully.</p>
 
 <h3>Details:</h3>
@@ -141,20 +159,7 @@ exports.up = async function(knex) {
 </ul>
 
 <p>Please verify that all systems are functioning correctly after the restore.</p>`,
-      body_html_de: `<h2>Wiederherstellungsvorgang abgeschlossen</h2>
-<p>Ein Wiederherstellungsvorgang wurde erfolgreich abgeschlossen.</p>
-
-<h3>Details:</h3>
-<ul>
-  <li><strong>Wiederherstellungstyp:</strong> {{restore_type}}</li>
-  <li><strong>Dauer:</strong> {{duration}}</li>
-  <li><strong>Wiederhergestellte Dateien:</strong> {{files_restored}}</li>
-  <li><strong>Backup-ID:</strong> {{backup_id}}</li>
-  <li><strong>Zeitstempel:</strong> {{timestamp}}</li>
-</ul>
-
-<p>Bitte überprüfen Sie, ob alle Systeme nach der Wiederherstellung ordnungsgemäß funktionieren.</p>`,
-      body_text_en: `Restore Operation Completed
+      body_text: `Restore Operation Completed
 
 A restore operation has completed successfully.
 
@@ -166,25 +171,12 @@ Details:
 - Timestamp: {{timestamp}}
 
 Please verify that all systems are functioning correctly after the restore.`,
-      body_text_de: `Wiederherstellungsvorgang abgeschlossen
-
-Ein Wiederherstellungsvorgang wurde erfolgreich abgeschlossen.
-
-Details:
-- Wiederherstellungstyp: {{restore_type}}
-- Dauer: {{duration}}
-- Wiederhergestellte Dateien: {{files_restored}}
-- Backup-ID: {{backup_id}}
-- Zeitstempel: {{timestamp}}
-
-Bitte überprüfen Sie, ob alle Systeme nach der Wiederherstellung ordnungsgemäß funktionieren.`,
       variables: JSON.stringify(['restore_type', 'duration', 'files_restored', 'backup_id', 'timestamp'])
     },
     {
       template_key: 'restore_failed',
-      subject_en: '❌ Restore Operation Failed',
-      subject_de: '❌ Wiederherstellungsvorgang fehlgeschlagen',
-      body_html_en: `<h2>Restore Operation Failed</h2>
+      subject: '❌ Restore Operation Failed',
+      body_html: `<h2>Restore Operation Failed</h2>
 <p>A restore operation has failed and requires attention.</p>
 
 <h3>Details:</h3>
@@ -197,20 +189,7 @@ Bitte überprüfen Sie, ob alle Systeme nach der Wiederherstellung ordnungsgemä
 <p>Please check the system logs for more details and take appropriate action.</p>
 
 <p><strong>Important:</strong> If a pre-restore backup was created, it may be used for recovery.</p>`,
-      body_html_de: `<h2>Wiederherstellungsvorgang fehlgeschlagen</h2>
-<p>Ein Wiederherstellungsvorgang ist fehlgeschlagen und erfordert Ihre Aufmerksamkeit.</p>
-
-<h3>Details:</h3>
-<ul>
-  <li><strong>Wiederherstellungstyp:</strong> {{restore_type}}</li>
-  <li><strong>Fehler:</strong> {{error_message}}</li>
-  <li><strong>Zeitstempel:</strong> {{timestamp}}</li>
-</ul>
-
-<p>Bitte überprüfen Sie die Systemprotokolle für weitere Details und ergreifen Sie entsprechende Maßnahmen.</p>
-
-<p><strong>Wichtig:</strong> Falls ein Backup vor der Wiederherstellung erstellt wurde, kann es zur Wiederherstellung verwendet werden.</p>`,
-      body_text_en: `Restore Operation Failed
+      body_text: `Restore Operation Failed
 
 A restore operation has failed and requires attention.
 
@@ -222,23 +201,19 @@ Details:
 Please check the system logs for more details and take appropriate action.
 
 Important: If a pre-restore backup was created, it may be used for recovery.`,
-      body_text_de: `Wiederherstellungsvorgang fehlgeschlagen
-
-Ein Wiederherstellungsvorgang ist fehlgeschlagen und erfordert Ihre Aufmerksamkeit.
-
-Details:
-- Wiederherstellungstyp: {{restore_type}}
-- Fehler: {{error_message}}
-- Zeitstempel: {{timestamp}}
-
-Bitte überprüfen Sie die Systemprotokolle für weitere Details und ergreifen Sie entsprechende Maßnahmen.
-
-Wichtig: Falls ein Backup vor der Wiederherstellung erstellt wurde, kann es zur Wiederherstellung verwendet werden.`,
       variables: JSON.stringify(['restore_type', 'error_message', 'timestamp'])
     }
   ];
   
-  await knex('email_templates').insert(emailTemplates);
+  for (const template of emailTemplates) {
+    const exists = await knex('email_templates')
+      .where('template_key', template.template_key)
+      .first();
+    
+    if (!exists) {
+      await knex('email_templates').insert(template);
+    }
+  }
 };
 
 exports.down = async function(knex) {

backend/migrations/core/033_add_gallery_feedback.js

@@ -0,0 +1,152 @@
+// No helpers needed for boolean values
+
+exports.up = async function(knex) {
+  console.log('Adding gallery feedback tables...');
+  
+  // Check if tables and columns already exist
+  const hasEventFeedbackSettingsTable = await knex.schema.hasTable('event_feedback_settings');
+  const hasPhotoFeedbackTable = await knex.schema.hasTable('photo_feedback');
+  const hasFeedbackRateLimitsTable = await knex.schema.hasTable('feedback_rate_limits');
+  const hasFeedbackWordFiltersTable = await knex.schema.hasTable('feedback_word_filters');
+  const hasFeedbackCountColumn = await knex.schema.hasColumn('photos', 'feedback_count');
+  
+  // Create event_feedback_settings table
+  if (!hasEventFeedbackSettingsTable) {
+    await knex.schema.createTable('event_feedback_settings', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.boolean('feedback_enabled').defaultTo(false);
+      table.boolean('allow_ratings').defaultTo(true);
+      table.boolean('allow_likes').defaultTo(true);
+      table.boolean('allow_comments').defaultTo(false);
+      table.boolean('allow_favorites').defaultTo(true);
+      table.boolean('require_name_email').defaultTo(false);
+      table.boolean('moderate_comments').defaultTo(true);
+      table.boolean('show_feedback_to_guests').defaultTo(true);
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+      table.timestamp('updated_at').defaultTo(knex.fn.now());
+      table.unique(['event_id']);
+    });
+  }
+
+  // Create photo_feedback table
+  if (!hasPhotoFeedbackTable) {
+    await knex.schema.createTable('photo_feedback', (table) => {
+      table.increments('id').primary();
+      table.integer('photo_id').references('id').inTable('photos').onDelete('CASCADE');
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.string('feedback_type', 20).notNullable();
+      table.integer('rating');
+      table.text('comment_text');
+      table.string('guest_name', 100);
+      table.string('guest_email', 255);
+      table.string('guest_identifier', 64);
+      table.string('ip_address', 45);
+      table.text('user_agent');
+      table.boolean('is_approved').defaultTo(true);
+      table.boolean('is_hidden').defaultTo(false);
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+      table.timestamp('updated_at').defaultTo(knex.fn.now());
+      
+      // Add indexes
+      table.index(['photo_id']);
+      table.index(['event_id']);
+      table.index(['feedback_type']);
+      table.index(['guest_identifier']);
+      
+      // Add check constraint for rating (PostgreSQL)
+      if (knex.client.config.client === 'pg') {
+        table.check('?? >= 1 AND ?? <= 5', ['rating', 'rating']);
+      }
+    });
+  }
+
+  // Create feedback_rate_limits table
+  if (!hasFeedbackRateLimitsTable) {
+    await knex.schema.createTable('feedback_rate_limits', (table) => {
+      table.increments('id').primary();
+      table.string('identifier', 64).notNullable();
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.string('action_type', 20).notNullable();
+      table.integer('action_count').defaultTo(1);
+      table.timestamp('window_start').defaultTo(knex.fn.now());
+      
+      // Add indexes
+      table.index(['identifier', 'event_id', 'action_type']);
+      table.index(['window_start']);
+    });
+  }
+
+  // Create feedback_word_filters table
+  if (!hasFeedbackWordFiltersTable) {
+    await knex.schema.createTable('feedback_word_filters', (table) => {
+      table.increments('id').primary();
+      table.string('word', 100).notNullable();
+      table.string('severity', 20).defaultTo('moderate');
+      table.boolean('is_active').defaultTo(true);
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+      table.unique(['word']);
+    });
+  }
+
+  // Add feedback summary columns to photos table
+  if (!hasFeedbackCountColumn) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.integer('feedback_count').defaultTo(0);
+      table.integer('like_count').defaultTo(0);
+      table.decimal('average_rating', 3, 2).defaultTo(0);
+      table.integer('favorite_count').defaultTo(0);
+    });
+  }
+
+  // Add feedback notification settings to app_settings
+  const hasFeedbackNotificationEmail = await knex('app_settings')
+    .where('setting_key', 'feedback_notification_email')
+    .first();
+    
+  if (!hasFeedbackNotificationEmail) {
+    await knex('app_settings').insert([
+      {
+        setting_key: 'feedback_notification_email',
+        setting_value: JSON.stringify(''),
+        setting_type: 'feedback'
+      },
+      {
+        setting_key: 'feedback_rate_limits',
+        setting_value: JSON.stringify({
+          rating: { max: 100, window: 3600 }, // 100 ratings per hour
+          comment: { max: 20, window: 3600 }, // 20 comments per hour
+          like: { max: 200, window: 3600 } // 200 likes per hour
+        }),
+        setting_type: 'feedback'
+      }
+    ]);
+  }
+  
+  console.log('Gallery feedback tables created successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing gallery feedback tables...');
+  
+  // Remove feedback settings from app_settings
+  await knex('app_settings')
+    .whereIn('setting_key', ['feedback_notification_email', 'feedback_rate_limits'])
+    .delete();
+
+  // Remove feedback columns from photos table
+  await knex.schema.alterTable('photos', (table) => {
+    table.dropColumn('feedback_count');
+    table.dropColumn('like_count');
+    table.dropColumn('average_rating');
+    table.dropColumn('favorite_count');
+  });
+
+  // Drop tables in reverse order
+  await knex.schema.dropTableIfExists('feedback_word_filters');
+  await knex.schema.dropTableIfExists('feedback_rate_limits');
+  await knex.schema.dropTableIfExists('photo_feedback');
+  await knex.schema.dropTableIfExists('event_feedback_settings');
+  
+  console.log('Gallery feedback tables removed');
+};

backend/migrations/core/034_add_version_to_backups.js

@@ -1,4 +1,4 @@
-const { db } = require('../src/database/db');
+const { db } = require('../../src/database/db');
 
 async function up() {
   console.log('Adding version tracking to backup tables...');

backend/migrations/core/035_enhance_backup_system.js

@@ -1,4 +1,4 @@
-const { db } = require('../src/database/db');
+const { db } = require('../../src/database/db');
 
 async function up() {
   console.log('Enhancing backup system...');

backend/migrations/core/036_fix_missing_columns.js

@@ -0,0 +1,87 @@
+// Fix missing columns identified in GitHub issues
+
+exports.up = async function(knex) {
+  console.log('Adding missing columns to database tables...');
+  
+  // Add must_change_password column to admin_users table
+  const hasMustChangePassword = await knex.schema.hasColumn('admin_users', 'must_change_password');
+  if (!hasMustChangePassword) {
+    console.log('Adding must_change_password column to admin_users table...');
+    await knex.schema.table('admin_users', (table) => {
+      table.boolean('must_change_password').defaultTo(false);
+    });
+  }
+  
+  // Add password_changed_at column to admin_users table
+  const hasPasswordChangedAt = await knex.schema.hasColumn('admin_users', 'password_changed_at');
+  if (!hasPasswordChangedAt) {
+    console.log('Adding password_changed_at column to admin_users table...');
+    await knex.schema.table('admin_users', (table) => {
+      table.datetime('password_changed_at');
+    });
+  }
+  
+  // Add require_moderation column to event_feedback_settings table
+  const hasEventFeedbackSettings = await knex.schema.hasTable('event_feedback_settings');
+  if (hasEventFeedbackSettings) {
+    const hasRequireModeration = await knex.schema.hasColumn('event_feedback_settings', 'require_moderation');
+    if (!hasRequireModeration) {
+      console.log('Adding require_moderation column to event_feedback_settings table...');
+      await knex.schema.table('event_feedback_settings', (table) => {
+        table.boolean('require_moderation').defaultTo(true);
+      });
+    }
+  }
+  
+  // Add host_name column to events table if missing
+  const hasHostName = await knex.schema.hasColumn('events', 'host_name');
+  if (!hasHostName) {
+    console.log('Adding host_name column to events table...');
+    await knex.schema.table('events', (table) => {
+      table.string('host_name');
+    });
+  }
+  
+  console.log('Missing columns have been added successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing added columns...');
+  
+  // Remove must_change_password column from admin_users table
+  const hasMustChangePassword = await knex.schema.hasColumn('admin_users', 'must_change_password');
+  if (hasMustChangePassword) {
+    await knex.schema.table('admin_users', (table) => {
+      table.dropColumn('must_change_password');
+    });
+  }
+  
+  // Remove password_changed_at column from admin_users table
+  const hasPasswordChangedAt = await knex.schema.hasColumn('admin_users', 'password_changed_at');
+  if (hasPasswordChangedAt) {
+    await knex.schema.table('admin_users', (table) => {
+      table.dropColumn('password_changed_at');
+    });
+  }
+  
+  // Remove require_moderation column from event_feedback_settings table
+  const hasEventFeedbackSettings = await knex.schema.hasTable('event_feedback_settings');
+  if (hasEventFeedbackSettings) {
+    const hasRequireModeration = await knex.schema.hasColumn('event_feedback_settings', 'require_moderation');
+    if (hasRequireModeration) {
+      await knex.schema.table('event_feedback_settings', (table) => {
+        table.dropColumn('require_moderation');
+      });
+    }
+  }
+  
+  // Remove host_name column from events table
+  const hasHostName = await knex.schema.hasColumn('events', 'host_name');
+  if (hasHostName) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('host_name');
+    });
+  }
+  
+  console.log('Columns removed');
+};

backend/migrations/core/037_add_download_controls.js

@@ -0,0 +1,69 @@
+// Add download control features to events table
+
+exports.up = async function(knex) {
+  console.log('Adding download control columns to events table...');
+  
+  // Add download control columns to events table
+  const hasAllowDownloads = await knex.schema.hasColumn('events', 'allow_downloads');
+  if (!hasAllowDownloads) {
+    await knex.schema.table('events', (table) => {
+      table.boolean('allow_downloads').defaultTo(true);
+      table.boolean('disable_right_click').defaultTo(false);
+      table.boolean('watermark_downloads').defaultTo(false);
+      table.text('watermark_text');
+    });
+  }
+  
+  // Add download control settings to app_settings
+  const downloadSettingExists = await knex('app_settings')
+    .where('setting_key', 'default_allow_downloads')
+    .first();
+    
+  if (!downloadSettingExists) {
+    await knex('app_settings').insert([
+      {
+        setting_key: 'default_allow_downloads',
+        setting_value: JSON.stringify(true),
+        setting_type: 'gallery'
+      },
+      {
+        setting_key: 'default_disable_right_click',
+        setting_value: JSON.stringify(false),
+        setting_type: 'gallery'
+      },
+      {
+        setting_key: 'default_watermark_downloads',
+        setting_value: JSON.stringify(false),
+        setting_type: 'gallery'
+      }
+    ]);
+  }
+  
+  console.log('Download control features added successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing download control columns...');
+  
+  // Remove app settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'default_allow_downloads',
+      'default_disable_right_click', 
+      'default_watermark_downloads'
+    ])
+    .delete();
+  
+  // Remove columns from events table
+  const hasAllowDownloads = await knex.schema.hasColumn('events', 'allow_downloads');
+  if (hasAllowDownloads) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('allow_downloads');
+      table.dropColumn('disable_right_click');
+      table.dropColumn('watermark_downloads');
+      table.dropColumn('watermark_text');
+    });
+  }
+  
+  console.log('Download control columns removed');
+};

backend/migrations/core/038_add_enhanced_image_protection.js

@@ -0,0 +1,128 @@
+// Add enhanced image protection features
+
+exports.up = async function(knex) {
+  console.log('Adding enhanced image protection features...');
+  
+  // Add protection columns to events table
+  const hasProtectionLevel = await knex.schema.hasColumn('events', 'protection_level');
+  if (!hasProtectionLevel) {
+    await knex.schema.table('events', (table) => {
+      table.enum('protection_level', ['basic', 'standard', 'enhanced', 'maximum']).defaultTo('standard');
+      table.integer('image_quality').defaultTo(85);
+      table.boolean('add_fingerprint').defaultTo(true);
+      table.boolean('enable_devtools_protection').defaultTo(true);
+      table.boolean('use_canvas_rendering').defaultTo(false);
+      table.integer('fragmentation_level').defaultTo(3);
+      table.boolean('overlay_protection').defaultTo(true);
+    });
+  }
+  
+  // Create image access logs table
+  const hasImageAccessLogs = await knex.schema.hasTable('image_access_logs');
+  if (!hasImageAccessLogs) {
+    await knex.schema.createTable('image_access_logs', (table) => {
+      table.increments('id').primary();
+      table.integer('photo_id').unsigned().notNullable();
+      table.integer('event_id').unsigned().notNullable();
+      table.string('client_ip', 45).notNullable();
+      table.text('user_agent');
+      table.string('access_type', 20).defaultTo('view'); // view, download, suspicious
+      table.string('client_fingerprint', 32).notNullable();
+      table.timestamp('accessed_at').defaultTo(knex.fn.now());
+      table.json('metadata'); // Additional security metadata
+      
+      table.foreign('photo_id').references('id').inTable('photos').onDelete('CASCADE');
+      table.foreign('event_id').references('id').inTable('events').onDelete('CASCADE');
+      
+      table.index(['photo_id', 'accessed_at']);
+      table.index(['client_fingerprint', 'accessed_at']);
+      table.index(['client_ip', 'accessed_at']);
+    });
+  }
+  
+  // Add protection settings to app_settings
+  const protectionSettingExists = await knex('app_settings')
+    .where('setting_key', 'default_protection_level')
+    .first();
+    
+  if (!protectionSettingExists) {
+    await knex('app_settings').insert([
+      {
+        setting_key: 'default_protection_level',
+        setting_value: JSON.stringify('standard'),
+        setting_type: 'security'
+      },
+      {
+        setting_key: 'default_image_quality',
+        setting_value: JSON.stringify(85),
+        setting_type: 'security'
+      },
+      {
+        setting_key: 'enable_devtools_protection',
+        setting_value: JSON.stringify(true),
+        setting_type: 'security'
+      },
+      {
+        setting_key: 'max_image_requests_per_minute',
+        setting_value: JSON.stringify(30),
+        setting_type: 'security'
+      },
+      {
+        setting_key: 'suspicious_activity_threshold',
+        setting_value: JSON.stringify(10),
+        setting_type: 'security'
+      },
+      {
+        setting_key: 'enable_canvas_rendering',
+        setting_value: JSON.stringify(false),
+        setting_type: 'security'
+      },
+      {
+        setting_key: 'default_fragmentation_level',
+        setting_value: JSON.stringify(3),
+        setting_type: 'security'
+      }
+    ]);
+  }
+  
+  console.log('Enhanced image protection features added successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing enhanced image protection features...');
+  
+  // Remove app settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'default_protection_level',
+      'default_image_quality',
+      'enable_devtools_protection',
+      'max_image_requests_per_minute',
+      'suspicious_activity_threshold',
+      'enable_canvas_rendering',
+      'default_fragmentation_level'
+    ])
+    .delete();
+  
+  // Drop image access logs table
+  const hasImageAccessLogs = await knex.schema.hasTable('image_access_logs');
+  if (hasImageAccessLogs) {
+    await knex.schema.dropTable('image_access_logs');
+  }
+  
+  // Remove protection columns from events table
+  const hasProtectionLevel = await knex.schema.hasColumn('events', 'protection_level');
+  if (hasProtectionLevel) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('protection_level');
+      table.dropColumn('image_quality');
+      table.dropColumn('add_fingerprint');
+      table.dropColumn('enable_devtools_protection');
+      table.dropColumn('use_canvas_rendering');
+      table.dropColumn('fragmentation_level');
+      table.dropColumn('overlay_protection');
+    });
+  }
+  
+  console.log('Enhanced image protection features removed');
+};

backend/migrations/core/039_add_security_logging.js

@@ -0,0 +1,117 @@
+// Add security logging and monitoring tables
+
+exports.up = async function(knex) {
+  console.log('Adding security logging and monitoring tables...');
+  
+  // Create security logs table for general security events
+  const hasSecurityLogs = await knex.schema.hasTable('security_logs');
+  if (!hasSecurityLogs) {
+    await knex.schema.createTable('security_logs', (table) => {
+      table.increments('id').primary();
+      table.string('event_type', 50).notNullable(); // rate_limit_exceeded, suspicious_activity, etc.
+      table.string('client_ip', 45).notNullable();
+      table.string('client_fingerprint', 32);
+      table.text('user_agent');
+      table.string('request_path');
+      table.string('request_method', 10);
+      table.json('details'); // Additional event details
+      table.timestamp('timestamp').defaultTo(knex.fn.now());
+      
+      // Indexes for performance
+      table.index(['event_type', 'timestamp']);
+      table.index(['client_ip', 'timestamp']);
+      table.index(['client_fingerprint', 'timestamp']);
+    });
+  }
+  
+  // Add security monitoring settings to app_settings
+  const securitySettings = [
+    {
+      setting_key: 'security_monitoring_enabled',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'max_image_requests_per_5_minutes',
+      setting_value: JSON.stringify(100),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'max_image_requests_per_hour',
+      setting_value: JSON.stringify(500),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'block_suspicious_ips',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'log_security_events_to_db',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'auto_block_threshold',
+      setting_value: JSON.stringify(5),
+      setting_type: 'security'
+    }
+  ];
+
+  for (const setting of securitySettings) {
+    const exists = await knex('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+      
+    if (!exists) {
+      await knex('app_settings').insert(setting);
+    }
+  }
+  
+  // Add mime_type column to photos table if it doesn't exist
+  const hasMimeType = await knex.schema.hasColumn('photos', 'mime_type');
+  if (!hasMimeType) {
+    await knex.schema.table('photos', (table) => {
+      table.string('mime_type', 100);
+    });
+    
+    // Update existing photos with default mime type
+    await knex('photos')
+      .whereNull('mime_type')
+      .update({ mime_type: 'image/jpeg' });
+  }
+  
+  console.log('Security logging and monitoring tables added successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing security logging and monitoring tables...');
+  
+  // Remove security settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'security_monitoring_enabled',
+      'max_image_requests_per_5_minutes', 
+      'max_image_requests_per_hour',
+      'block_suspicious_ips',
+      'log_security_events_to_db',
+      'auto_block_threshold'
+    ])
+    .delete();
+  
+  // Drop security logs table
+  const hasSecurityLogs = await knex.schema.hasTable('security_logs');
+  if (hasSecurityLogs) {
+    await knex.schema.dropTable('security_logs');
+  }
+  
+  // Remove mime_type column from photos table
+  const hasMimeType = await knex.schema.hasColumn('photos', 'mime_type');
+  if (hasMimeType) {
+    await knex.schema.table('photos', (table) => {
+      table.dropColumn('mime_type');
+    });
+  }
+  
+  console.log('Security logging and monitoring tables removed');
+};

backend/migrations/core/040_add_thumbnail_settings.js

@@ -0,0 +1,33 @@
+exports.up = async function(knex) {
+  // Add thumbnail settings to app_settings table
+  const thumbnailSettings = [
+    { setting_key: 'thumbnail_width', setting_value: 300, setting_type: 'number' },
+    { setting_key: 'thumbnail_height', setting_value: 300, setting_type: 'number' },
+    { setting_key: 'thumbnail_fit', setting_value: JSON.stringify('cover'), setting_type: 'string' },
+    { setting_key: 'thumbnail_quality', setting_value: 85, setting_type: 'number' },
+    { setting_key: 'thumbnail_format', setting_value: JSON.stringify('jpeg'), setting_type: 'string' }
+  ];
+
+  for (const setting of thumbnailSettings) {
+    const exists = await knex('app_settings').where('setting_key', setting.setting_key).first();
+    if (!exists) {
+      await knex('app_settings').insert({
+        ...setting,
+        updated_at: knex.fn.now()
+      });
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  // Remove thumbnail settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'thumbnail_width',
+      'thumbnail_height', 
+      'thumbnail_fit',
+      'thumbnail_quality',
+      'thumbnail_format'
+    ])
+    .del();
+};

backend/migrations/core/041_add_external_media.js

@@ -0,0 +1,54 @@
+/**
+ * Migration 041: Add external media reference support
+ * - events.source_mode: 'managed' | 'reference'
+ * - events.external_path: relative path under external media root
+ * - photos.source_origin: 'managed' | 'external'
+ * - photos.external_relpath: relative path within event.external_path
+ */
+
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function(knex) {
+  console.log('Running migration: 041_add_external_media');
+
+  // events.source_mode (default 'managed')
+  await addColumnIfNotExists(knex, 'events', 'source_mode', (table) => {
+    table.string('source_mode').notNullable().defaultTo('managed');
+  });
+
+  // events.external_path (nullable)
+  await addColumnIfNotExists(knex, 'events', 'external_path', (table) => {
+    table.text('external_path');
+  });
+
+  // photos.source_origin (default 'managed')
+  await addColumnIfNotExists(knex, 'photos', 'source_origin', (table) => {
+    table.string('source_origin').notNullable().defaultTo('managed');
+  });
+
+  // photos.external_relpath (nullable)
+  await addColumnIfNotExists(knex, 'photos', 'external_relpath', (table) => {
+    table.text('external_relpath');
+  });
+
+  // Helpful index for queries
+  try {
+    if (knex.client.config.client === 'pg') {
+      await knex.raw("CREATE INDEX IF NOT EXISTS photos_event_source_idx ON photos (event_id, source_origin)");
+    } else {
+      await knex.schema.alterTable('photos', (table) => {
+        table.index(['event_id', 'source_origin'], 'photos_event_source_idx');
+      });
+    }
+  } catch (e) {
+    console.log('Index creation skipped or failed (may already exist):', e.message);
+  }
+
+  console.log('Migration 041_add_external_media completed');
+};
+
+exports.down = async function(knex) {
+  console.log('Rollback: 041_add_external_media');
+  // Keep columns (safe rollback not removing data). Intentionally no-op.
+};
+

backend/migrations/core/042_backfill_event_upload_columns.js

@@ -0,0 +1,51 @@
+const logger = require('../../src/utils/logger');
+
+async function ensureColumn(knex, tableName, columnName, alterFn) {
+  const exists = await knex.schema.hasColumn(tableName, columnName);
+  if (!exists) {
+    logger.info(`Adding column ${tableName}.${columnName}`);
+    await knex.schema.table(tableName, alterFn);
+  }
+}
+
+exports.up = async function(knex) {
+  await ensureColumn(knex, 'events', 'host_name', (table) => {
+    table.string('host_name');
+  });
+
+  await ensureColumn(knex, 'events', 'allow_user_uploads', (table) => {
+    table.boolean('allow_user_uploads').defaultTo(false);
+  });
+
+  await ensureColumn(knex, 'events', 'upload_category_id', (table) => {
+    table.integer('upload_category_id');
+  });
+
+  await ensureColumn(knex, 'events', 'allow_downloads', (table) => {
+    table.boolean('allow_downloads').defaultTo(true);
+  });
+
+  await ensureColumn(knex, 'events', 'disable_right_click', (table) => {
+    table.boolean('disable_right_click').defaultTo(false);
+  });
+
+  await ensureColumn(knex, 'events', 'watermark_downloads', (table) => {
+    table.boolean('watermark_downloads').defaultTo(false);
+  });
+
+  await ensureColumn(knex, 'events', 'watermark_text', (table) => {
+    table.text('watermark_text');
+  });
+
+  await ensureColumn(knex, 'events', 'hero_photo_id', (table) => {
+    table.integer('hero_photo_id').references('id').inTable('photos').onDelete('SET NULL');
+  });
+
+  await ensureColumn(knex, 'photos', 'uploaded_by', (table) => {
+    table.string('uploaded_by').defaultTo('admin');
+  });
+};
+
+exports.down = async function() {
+  // Non destructive migration; no rollback
+};

backend/migrations/core/043_add_public_site_settings.js

@@ -0,0 +1,46 @@
+const {
+  DEFAULT_PUBLIC_SITE_HTML,
+} = require('../../src/constants/publicSiteDefaults');
+
+exports.up = async function(knex) {
+  const defaults = [
+    {
+      setting_key: 'general_public_site_enabled',
+      setting_value: JSON.stringify(false),
+      setting_type: 'general'
+    },
+    {
+      setting_key: 'general_public_site_html',
+      setting_value: JSON.stringify(DEFAULT_PUBLIC_SITE_HTML.trim()),
+      setting_type: 'general'
+    },
+    {
+      setting_key: 'general_public_site_custom_css',
+      setting_value: JSON.stringify(''),
+      setting_type: 'general'
+    }
+  ];
+
+  for (const setting of defaults) {
+    const exists = await knex('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+
+    if (!exists) {
+      await knex('app_settings').insert({
+        ...setting,
+        updated_at: knex.fn.now()
+      });
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'general_public_site_enabled',
+      'general_public_site_html',
+      'general_public_site_custom_css'
+    ])
+    .del();
+};

backend/migrations/core/044_add_event_password_toggle.js

@@ -0,0 +1,18 @@
+exports.up = async function (knex) {
+  const hasColumn = await knex.schema.hasColumn('events', 'require_password');
+  if (!hasColumn) {
+    await knex.schema.table('events', (table) => {
+      table.boolean('require_password').notNullable().defaultTo(true);
+    });
+    await knex('events').update({ require_password: true });
+  }
+};
+
+exports.down = async function (knex) {
+  const hasColumn = await knex.schema.hasColumn('events', 'require_password');
+  if (hasColumn) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('require_password');
+    });
+  }
+};

backend/migrations/core/045_add_max_files_per_upload_setting.js

@@ -0,0 +1,48 @@
+const { DEFAULT_MAX_FILES_PER_UPLOAD, MAX_ALLOWED_FILES_PER_UPLOAD } = require('../../src/services/uploadSettings');
+
+exports.up = async function up(knex) {
+  const settingKey = 'general_max_files_per_upload';
+
+  const existing = await knex('app_settings')
+    .where({ setting_key: settingKey })
+    .first();
+
+  if (existing) {
+    // Normalize existing value into allowed bounds
+    let parsedValue;
+    try {
+      parsedValue = existing.setting_value != null ? JSON.parse(existing.setting_value) : null;
+    } catch {
+      parsedValue = existing.setting_value;
+    }
+
+    const numeric = Number(parsedValue);
+    let normalized = DEFAULT_MAX_FILES_PER_UPLOAD;
+    if (Number.isFinite(numeric) && numeric >= 1) {
+      normalized = Math.min(MAX_ALLOWED_FILES_PER_UPLOAD, Math.floor(numeric));
+    }
+
+    if (normalized !== numeric) {
+      await knex('app_settings')
+        .where({ setting_key: settingKey })
+        .update({
+          setting_value: JSON.stringify(normalized),
+          updated_at: new Date()
+        });
+    }
+    return;
+  }
+
+  await knex('app_settings').insert({
+    setting_key: settingKey,
+    setting_value: JSON.stringify(DEFAULT_MAX_FILES_PER_UPLOAD),
+    setting_type: 'general',
+    updated_at: new Date()
+  });
+};
+
+exports.down = async function down(knex) {
+  await knex('app_settings')
+    .where({ setting_key: 'general_max_files_per_upload' })
+    .del();
+};

backend/migrations/core/046_add_customer_contact_fields.js

@@ -0,0 +1,44 @@
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function up(knex) {
+  await addColumnIfNotExists(knex, 'events', 'customer_name', (table) => {
+    table.string('customer_name');
+  });
+
+  await addColumnIfNotExists(knex, 'events', 'customer_email', (table) => {
+    table.string('customer_email');
+  });
+
+  // Backfill new columns from legacy host_* fields
+  const client = knex?.client?.config?.client;
+
+  if (client === 'pg') {
+    await knex.raw(`
+      UPDATE events
+      SET customer_name = COALESCE(customer_name, host_name),
+          customer_email = COALESCE(customer_email, host_email)
+    `);
+  } else {
+    // SQLite fallback
+    await knex('events').update({
+      customer_name: knex.raw('COALESCE(customer_name, host_name)'),
+      customer_email: knex.raw('COALESCE(customer_email, host_email)')
+    });
+  }
+};
+
+exports.down = async function down(knex) {
+  const hasCustomerName = await knex.schema.hasColumn('events', 'customer_name');
+  if (hasCustomerName) {
+    await knex.schema.alterTable('events', (table) => {
+      table.dropColumn('customer_name');
+    });
+  }
+
+  const hasCustomerEmail = await knex.schema.hasColumn('events', 'customer_email');
+  if (hasCustomerEmail) {
+    await knex.schema.alterTable('events', (table) => {
+      table.dropColumn('customer_email');
+    });
+  }
+};

backend/migrations/core/047_add_tls_reject_unauthorized.js

@@ -0,0 +1,18 @@
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function up(knex) {
+  // Add tls_reject_unauthorized column to email_configs table
+  // Default is true (validate certificates), false means ignore SSL/TLS certificate errors
+  await addColumnIfNotExists(knex, 'email_configs', 'tls_reject_unauthorized', (table) => {
+    table.boolean('tls_reject_unauthorized').defaultTo(true);
+  });
+};
+
+exports.down = async function down(knex) {
+  const hasColumn = await knex.schema.hasColumn('email_configs', 'tls_reject_unauthorized');
+  if (hasColumn) {
+    await knex.schema.alterTable('email_configs', (table) => {
+      table.dropColumn('tls_reject_unauthorized');
+    });
+  }
+};

backend/migrations/legacy/004_add_categories_and_cms.js

@@ -0,0 +1,125 @@
+const { db } = require('../../src/database/db');
+
+async function up() {
+  console.log('Adding photo categories and CMS tables...');
+  
+  // Check if tables already exist
+  const hasPhotoCategoriesTable = await db.schema.hasTable('photo_categories');
+  const hasCmsPagesTable = await db.schema.hasTable('cms_pages');
+  const hasCategoryIdColumn = await db.schema.hasColumn('photos', 'category_id');
+  const hasLanguageColumn = await db.schema.hasColumn('admin_users', 'language');
+  
+  // Create photo_categories table
+  if (!hasPhotoCategoriesTable) {
+    await db.schema.createTable('photo_categories', (table) => {
+      table.increments('id').primary();
+      table.string('name', 100).notNullable();
+      table.string('slug', 100).notNullable();
+      table.boolean('is_global').defaultTo(true);
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.timestamp('created_at').defaultTo(db.fn.now());
+      
+      // Unique constraint for slug within event scope
+      table.unique(['slug', 'event_id']);
+    });
+  }
+
+  // Create cms_pages table
+  if (!hasCmsPagesTable) {
+    await db.schema.createTable('cms_pages', (table) => {
+      table.increments('id').primary();
+      table.string('slug', 100).unique().notNullable();
+      table.text('title_en');
+      table.text('title_de');
+      table.text('content_en');
+      table.text('content_de');
+      table.timestamp('updated_at').defaultTo(db.fn.now());
+    });
+  }
+
+  // Add category_id to photos table
+  if (!hasCategoryIdColumn) {
+    await db.schema.alterTable('photos', (table) => {
+      table.integer('category_id').references('id').inTable('photo_categories');
+    });
+  }
+
+  // Add language preference to admin_users
+  if (!hasLanguageColumn) {
+    await db.schema.alterTable('admin_users', (table) => {
+      table.string('language', 2).defaultTo('en');
+    });
+  }
+
+  // Add language preference to app_settings for global default
+  const hasDefaultLanguageSetting = await db('app_settings')
+    .where('setting_key', 'default_language')
+    .first();
+    
+  if (!hasDefaultLanguageSetting) {
+    await db('app_settings').insert({
+      setting_key: 'default_language',
+      setting_value: JSON.stringify('en'),
+      setting_type: 'general',
+      updated_at: new Date()
+    });
+  }
+
+  // Insert default global categories
+  if (!hasPhotoCategoriesTable) {
+    const defaultCategories = [
+      { name: 'Ceremony', slug: 'ceremony', is_global: true },
+      { name: 'Reception', slug: 'reception', is_global: true },
+      { name: 'Portraits', slug: 'portraits', is_global: true },
+      { name: 'Group Photos', slug: 'group-photos', is_global: true },
+      { name: 'Details', slug: 'details', is_global: true },
+      { name: 'Party', slug: 'party', is_global: true }
+    ];
+
+    await db('photo_categories').insert(defaultCategories);
+  }
+
+  // Insert default legal pages
+  if (!hasCmsPagesTable) {
+    await db('cms_pages').insert([
+      {
+        slug: 'impressum',
+        title_en: 'Legal Notice',
+        title_de: 'Impressum',
+        content_en: '<h2>Legal Notice</h2><p>Please edit this content in the admin panel.</p>',
+        content_de: '<h2>Impressum</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
+        updated_at: new Date()
+      },
+      {
+        slug: 'datenschutz',
+        title_en: 'Privacy Policy',
+        title_de: 'Datenschutzerklärung',
+        content_en: '<h2>Privacy Policy</h2><p>Please edit this content in the admin panel.</p>',
+        content_de: '<h2>Datenschutzerklärung</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
+        updated_at: new Date()
+      }
+    ]);
+  }
+
+  console.log('Photo categories and CMS tables created successfully');
+}
+
+async function down() {
+  // Remove language from app_settings
+  await db('app_settings').where('setting_key', 'default_language').delete();
+  
+  // Drop columns
+  await db.schema.alterTable('admin_users', (table) => {
+    table.dropColumn('language');
+  });
+  
+  await db.schema.alterTable('photos', (table) => {
+    table.dropColumn('category_id');
+  });
+  
+  // Drop tables
+  await db.schema.dropTableIfExists('cms_pages');
+  await db.schema.dropTableIfExists('photo_categories');
+}
+
+module.exports = { up, down };

backend/migrations/legacy/011_add_user_upload_settings.js

@@ -0,0 +1,56 @@
+exports.up = async function(knex) {
+  // Add user upload settings to events table (check if columns exist first)
+  const hasAllowUserUploads = await knex.schema.hasColumn('events', 'allow_user_uploads');
+  if (!hasAllowUserUploads) {
+    console.log('Adding allow_user_uploads column to events table...');
+    await knex.schema.alterTable('events', function(table) {
+      table.boolean('allow_user_uploads').defaultTo(false);
+    });
+  } else {
+    console.log('Column allow_user_uploads already exists in events table, skipping...');
+  }
+
+  const hasUploadCategoryId = await knex.schema.hasColumn('events', 'upload_category_id');
+  if (!hasUploadCategoryId) {
+    console.log('Adding upload_category_id column to events table...');
+    await knex.schema.alterTable('events', function(table) {
+      table.integer('upload_category_id').references('id').inTable('photo_categories').onDelete('SET NULL');
+    });
+  } else {
+    console.log('Column upload_category_id already exists in events table, skipping...');
+  }
+
+  // Add uploaded_by field to photos table to track who uploaded
+  const hasUploadedBy = await knex.schema.hasColumn('photos', 'uploaded_by');
+  if (!hasUploadedBy) {
+    console.log('Adding uploaded_by column to photos table...');
+    await knex.schema.alterTable('photos', function(table) {
+      table.string('uploaded_by').defaultTo('admin'); // 'admin' or guest identifier
+    });
+  } else {
+    console.log('Column uploaded_by already exists in photos table, skipping...');
+  }
+};
+
+exports.down = async function(knex) {
+  const hasAllowUserUploads = await knex.schema.hasColumn('events', 'allow_user_uploads');
+  if (hasAllowUserUploads) {
+    await knex.schema.alterTable('events', function(table) {
+      table.dropColumn('allow_user_uploads');
+    });
+  }
+
+  const hasUploadCategoryId = await knex.schema.hasColumn('events', 'upload_category_id');
+  if (hasUploadCategoryId) {
+    await knex.schema.alterTable('events', function(table) {
+      table.dropColumn('upload_category_id');
+    });
+  }
+
+  const hasUploadedBy = await knex.schema.hasColumn('photos', 'uploaded_by');
+  if (hasUploadedBy) {
+    await knex.schema.alterTable('photos', function(table) {
+      table.dropColumn('uploaded_by');
+    });
+  }
+};

backend/migrations/legacy/014_add_host_name_to_events_duplicate.js

@@ -1,4 +1,4 @@
-const { db } = require('../src/database/db');
+const { db } = require('../../src/database/db');
 
 async function up() {
   // Check if host_name column already exists

backend/migrations/legacy/015_add_login_attempts_table.js

@@ -0,0 +1,23 @@
+exports.up = async function(knex) {
+  const hasLoginAttemptsTable = await knex.schema.hasTable('login_attempts');
+  
+  if (!hasLoginAttemptsTable) {
+    return knex.schema.createTable('login_attempts', table => {
+      table.increments('id').primary();
+      table.string('identifier').notNullable(); // username or email
+      table.string('ip_address', 45).notNullable(); // IPv4 or IPv6
+      table.text('user_agent');
+      table.timestamp('attempt_time').defaultTo(knex.fn.now());
+      table.boolean('success').defaultTo(false);
+      
+      // Indexes for performance
+      table.index('identifier');
+      table.index('attempt_time');
+      table.index(['identifier', 'success', 'attempt_time']);
+    });
+  }
+};
+
+exports.down = function(knex) {
+  return knex.schema.dropTableIfExists('login_attempts');
+};

backend/migrations/legacy/016_add_auth_security_columns.js

@@ -0,0 +1,36 @@
+exports.up = async function(knex) {
+  // Check if columns already exist to avoid conflicts
+  const hasPasswordChangedAt = await knex.schema.hasColumn('admin_users', 'password_changed_at');
+  const hasLastLoginIp = await knex.schema.hasColumn('admin_users', 'last_login_ip');
+  const hasTwoFactorEnabled = await knex.schema.hasColumn('admin_users', 'two_factor_enabled');
+  const hasTwoFactorSecret = await knex.schema.hasColumn('admin_users', 'two_factor_secret');
+  
+  return knex.schema.table('admin_users', table => {
+    // Add password change tracking
+    if (!hasPasswordChangedAt) {
+      table.timestamp('password_changed_at').nullable();
+    }
+    
+    // Add last login IP for security monitoring  
+    if (!hasLastLoginIp) {
+      table.string('last_login_ip', 45).nullable();
+    }
+    
+    // Add account security flags
+    if (!hasTwoFactorEnabled) {
+      table.boolean('two_factor_enabled').defaultTo(false);
+    }
+    if (!hasTwoFactorSecret) {
+      table.string('two_factor_secret').nullable();
+    }
+  });
+};
+
+exports.down = function(knex) {
+  return knex.schema.table('admin_users', table => {
+    table.dropColumn('password_changed_at');
+    table.dropColumn('last_login_ip');
+    table.dropColumn('two_factor_enabled');
+    table.dropColumn('two_factor_secret');
+  });
+};

backend/migrations/legacy/017_add_token_revocation_tables.js

@@ -0,0 +1,63 @@
+exports.up = async function(knex) {
+  // Check if tables already exist to avoid conflicts
+  const hasRevokedTokensTable = await knex.schema.hasTable('revoked_tokens');
+  const hasUserTokenRevocationsTable = await knex.schema.hasTable('user_token_revocations');
+  
+  // Create revoked_tokens table if it doesn't exist
+  if (!hasRevokedTokensTable) {
+    await knex.schema.createTable('revoked_tokens', table => {
+      table.increments('id').primary();
+      table.string('token_id').notNullable().unique(); // JWT ID or generated ID
+      table.integer('user_id').nullable(); // User who owned the token
+      table.string('token_type', 20); // admin, gallery, etc.
+      table.timestamp('revoked_at').defaultTo(knex.fn.now());
+      table.timestamp('expires_at').notNullable(); // When token would have expired
+      table.string('reason', 100); // password_change, logout, compromised, etc.
+      table.text('metadata'); // Additional JSON data
+      
+      // Indexes for performance
+      table.index('token_id');
+      table.index('user_id');
+      table.index('expires_at'); // For cleanup
+    });
+  }
+  
+  // Create user_token_revocations table if it doesn't exist
+  if (!hasUserTokenRevocationsTable) {
+    await knex.schema.createTable('user_token_revocations', table => {
+      table.integer('user_id').primary();
+      table.timestamp('revoked_at').notNullable();
+      table.string('reason', 100);
+      
+      // Index for quick lookups
+      table.index('revoked_at');
+    });
+  }
+  
+  // Add any missing indexes if tables already existed
+  if (hasRevokedTokensTable) {
+    try {
+      // Try to add indexes if they don't exist (PostgreSQL syntax)
+      await knex.raw('CREATE INDEX IF NOT EXISTS "revoked_tokens_token_id_index" ON "revoked_tokens" ("token_id")');
+      await knex.raw('CREATE INDEX IF NOT EXISTS "revoked_tokens_user_id_index" ON "revoked_tokens" ("user_id")');
+      await knex.raw('CREATE INDEX IF NOT EXISTS "revoked_tokens_expires_at_index" ON "revoked_tokens" ("expires_at")');
+    } catch (error) {
+      // For SQLite compatibility, ignore errors if indexes already exist
+      console.log('Note: Some indexes may already exist, continuing...');
+    }
+  }
+  
+  if (hasUserTokenRevocationsTable) {
+    try {
+      await knex.raw('CREATE INDEX IF NOT EXISTS "user_token_revocations_revoked_at_index" ON "user_token_revocations" ("revoked_at")');
+    } catch (error) {
+      console.log('Note: Some indexes may already exist, continuing...');
+    }
+  }
+};
+
+exports.down = function(knex) {
+  return knex.schema
+    .dropTableIfExists('user_token_revocations')
+    .dropTableIfExists('revoked_tokens');
+};

backend/migrations/run-migrations-safe.js

@@ -27,8 +27,12 @@ async function isMigrationApplied(filename) {
 
 // Mark migration as applied without running it (for existing schema)
 async function markMigrationAsApplied(filename) {
-  await db('migrations').insert({ filename });
-  console.log(`Marked migration ${filename} as applied`);
+  // Check if already marked to avoid duplicate key error
+  const isApplied = await isMigrationApplied(filename);
+  if (!isApplied) {
+    await db('migrations').insert({ filename });
+    console.log(`Marked migration ${filename} as applied`);
+  }
 }
 
 // Detect existing schema and mark migrations as applied
@@ -36,12 +40,14 @@ async function detectExistingSchema() {
   console.log('Detecting existing schema...');
   
   const tableChecks = [
-    { table: 'events', migration: 'init.js' },
-    { table: 'photos', migration: 'init.js' },
+    { table: 'events', migration: '001_init.js' },
+    { table: 'photos', migration: '001_init.js' },
     { table: 'photo_categories', migration: '004_add_categories_and_cms.js' },
     { table: 'cms_pages', migration: '004_add_categories_and_cms.js' },
     { table: 'login_attempts', migration: '015_add_login_attempts_table.js' },
     { table: 'token_blacklist', migration: '017_add_token_revocation_tables.js' },
+    { table: 'backup_runs', migration: '029_add_backup_service_tables.js' },
+    { table: 'gallery_feedback', migration: '033_add_gallery_feedback.js' },
   ];
   
   for (const check of tableChecks) {
@@ -56,13 +62,14 @@ async function detectExistingSchema() {
 }
 
 // Run a single migration safely
-async function runMigrationSafely(filename) {
+async function runMigrationSafely(filepath) {
   try {
-    const migrationPath = path.join(__dirname, filename);
+    const migrationPath = path.join(__dirname, filepath);
     const migration = require(migrationPath);
+    const filename = path.basename(filepath);
     
     if (migration.up) {
-      console.log(`Running migration: ${filename}`);
+      console.log(`Running migration: ${filepath}`);
       
       // Run migration in a transaction if possible
       if (db.client.config.client === 'pg') {
@@ -74,14 +81,14 @@ async function runMigrationSafely(filename) {
       }
       
       await db('migrations').insert({ filename });
-      console.log(`Migration ${filename} completed successfully`);
+      console.log(`Migration ${filepath} completed successfully`);
     }
   } catch (error) {
     // Check if error is because schema already exists
     if (error.code === '42P07' || // PostgreSQL: relation already exists
         error.code === 'SQLITE_ERROR' && error.message.includes('already exists')) {
-      console.log(`Migration ${filename} - schema already exists, marking as applied`);
-      await markMigrationAsApplied(filename);
+      console.log(`Migration ${filepath} - schema already exists, marking as applied`);
+      await markMigrationAsApplied(path.basename(filepath));
     } else {
       throw error;
     }
@@ -101,26 +108,81 @@ async function runMigrations() {
     // Create migrations tracking table
     await ensureMigrationsTable();
     
-    // Detect and mark existing schema
-    await detectExistingSchema();
+    // Check if essential tables exist to determine if this is truly a new deployment
+    const hasEventsTable = await db.schema.hasTable('events');
+    const hasPhotosTable = await db.schema.hasTable('photos');
+    const hasAdminTable = await db.schema.hasTable('admin_users');
+    const hasActivityLogsTable = await db.schema.hasTable('activity_logs');
     
-    // Get all migration files
-    const files = await fs.readdir(__dirname);
-    const migrationFiles = files
-      .filter(f => f.match(/^\d{3}_.*\.js$/) || f === 'init.js')
-      .sort((a, b) => {
-        // Ensure init.js runs first
-        if (a === 'init.js') return -1;
-        if (b === 'init.js') return 1;
-        return a.localeCompare(b);
-      });
+    // Get applied migrations
+    const appliedMigrations = await db('migrations').select('filename');
+    const appliedFilenames = appliedMigrations.map(m => m.filename);
+    
+    // Check if this is a new deployment
+    // It's new if no essential tables exist OR no migrations have been applied
+    const hasEssentialTables = hasEventsTable && hasPhotosTable && hasAdminTable && hasActivityLogsTable;
+    const isDatabaseEmpty = !hasEventsTable && !hasPhotosTable && !hasAdminTable && !hasActivityLogsTable;
+    const isNewDeployment = isDatabaseEmpty || (appliedFilenames.length === 0 && !hasEssentialTables);
+    
+    // Only detect existing schema for truly existing deployments
+    if (!isNewDeployment) {
+      await detectExistingSchema();
+    }
+    
+    // Get migration files from appropriate directories
+    let migrationFiles = [];
+    
+    if (isNewDeployment) {
+      // For new deployments, only run core migrations
+      console.log('New deployment detected - running core migrations only');
+      const coreDir = path.join(__dirname, 'core');
+      const coreFiles = await fs.readdir(coreDir);
+      migrationFiles = coreFiles
+        .filter(f => f.match(/^\d{3}_.*\.js$/))
+        .map(f => path.join('core', f))
+        .sort((a, b) => {
+          const baseA = path.basename(a);
+          const baseB = path.basename(b);
+          const numA = parseInt(baseA.split('_')[0]);
+          const numB = parseInt(baseB.split('_')[0]);
+          return numA - numB;
+        });
+    } else {
+      // For existing deployments, run all migrations (legacy + core)
+      console.log('Existing deployment detected - checking all migrations');
+      
+      // Get legacy migrations
+      const legacyDir = path.join(__dirname, 'legacy');
+      const legacyFiles = await fs.readdir(legacyDir);
+      const legacyMigrations = legacyFiles
+        .filter(f => f.match(/^\d{3}_.*\.js$/))
+        .map(f => path.join('legacy', f));
+      
+      // Get core migrations
+      const coreDir = path.join(__dirname, 'core');
+      const coreFiles = await fs.readdir(coreDir);
+      const coreMigrations = coreFiles
+        .filter(f => f.match(/^\d{3}_.*\.js$/))
+        .map(f => path.join('core', f));
+      
+      // Combine and sort by number
+      migrationFiles = [...legacyMigrations, ...coreMigrations]
+        .sort((a, b) => {
+          const baseA = path.basename(a);
+          const baseB = path.basename(b);
+          const numA = parseInt(baseA.split('_')[0]);
+          const numB = parseInt(baseB.split('_')[0]);
+          return numA - numB;
+        });
+    }
     
     // Run pending migrations
     let pendingCount = 0;
     let skippedCount = 0;
     
     for (const file of migrationFiles) {
-      const isApplied = await isMigrationApplied(file);
+      const filename = path.basename(file);
+      const isApplied = appliedFilenames.includes(filename);
       if (!isApplied) {
         await runMigrationSafely(file);
         pendingCount++;
@@ -167,4 +229,4 @@ if (require.main === module) {
   waitAndRun();
 }
 
-module.exports = { runMigrations };
+module.exports = { runMigrations };

backend/migrations/run-migrations.js

@@ -22,15 +22,16 @@ async function getAppliedMigrations() {
 }
 
 // Run a single migration
-async function runMigration(filename) {
-  const migrationPath = path.join(__dirname, filename);
+async function runMigration(filepath) {
+  const migrationPath = path.join(__dirname, filepath);
   const migration = require(migrationPath);
+  const filename = path.basename(filepath);
   
   if (migration.up) {
-    console.log(`Running migration: ${filename}`);
+    console.log(`Running migration: ${filepath}`);
     await migration.up(db);
     await db('migrations').insert({ filename });
-    console.log(`Migration ${filename} completed`);
+    console.log(`Migration ${filepath} completed`);
   }
 }
 
@@ -50,19 +51,62 @@ async function runMigrations() {
     // Create migrations table
     await createMigrationsTable();
     
-    // Get all migration files
-    const files = await fs.readdir(__dirname);
-    const migrationFiles = files
-      .filter(f => f.match(/^\d{3}_.*\.js$/))
-      .sort();
-    
     // Get applied migrations
     const appliedMigrations = await getAppliedMigrations();
     
+    // Check if this is a new deployment (no migrations have been applied)
+    const isNewDeployment = appliedMigrations.length === 0;
+    
+    // Get migration files from appropriate directories
+    let migrationFiles = [];
+    
+    if (isNewDeployment) {
+      // For new deployments, only run core migrations
+      console.log('New deployment detected - running core migrations only');
+      const coreDir = path.join(__dirname, 'core');
+      const coreFiles = await fs.readdir(coreDir);
+      migrationFiles = coreFiles
+        .filter(f => f.match(/^\d{3}_.*\.js$/))
+        .map(f => path.join('core', f))
+        .sort((a, b) => {
+          const baseA = path.basename(a);
+          const baseB = path.basename(b);
+          const numA = parseInt(baseA.split('_')[0]);
+          const numB = parseInt(baseB.split('_')[0]);
+          return numA - numB;
+        });
+    } else {
+      // For existing deployments, run all migrations (legacy + core)
+      console.log('Existing deployment detected - checking all migrations');
+      
+      // Get legacy migrations
+      const legacyDir = path.join(__dirname, 'legacy');
+      const legacyFiles = await fs.readdir(legacyDir);
+      const legacyMigrations = legacyFiles
+        .filter(f => f.match(/^\d{3}_.*\.js$/))
+        .map(f => path.join('legacy', f));
+      
+      // Get core migrations
+      const coreDir = path.join(__dirname, 'core');
+      const coreFiles = await fs.readdir(coreDir);
+      const coreMigrations = coreFiles
+        .filter(f => f.match(/^\d{3}_.*\.js$/))
+        .map(f => path.join('core', f));
+      
+      // Combine and sort by number
+      migrationFiles = [...legacyMigrations, ...coreMigrations]
+        .sort((a, b) => {
+          const numA = parseInt(path.basename(a).split('_')[0]);
+          const numB = parseInt(path.basename(b).split('_')[0]);
+          return numA - numB;
+        });
+    }
+    
     // Run pending migrations
     let pendingCount = 0;
     for (const file of migrationFiles) {
-      if (!appliedMigrations.includes(file)) {
+      const filename = path.basename(file);
+      if (!appliedMigrations.includes(filename)) {
         await runMigration(file);
         pendingCount++;
       }

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "picpeak-backend",
-  "version": "1.0.93",
+  "version": "1.1.15",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "scripts": {
@@ -8,11 +8,8 @@
     "dev": "nodemon server.js",
     "migrate": "node migrations/run-migrations.js",
     "migrate:safe": "node migrations/run-migrations-safe.js",
-    "fix-temp-photos": "node scripts/fix-temp-photos.js",
     "test": "jest",
-    "lint": "eslint src/",
-    "test-backup": "node scripts/test-backup-service.js",
-    "test-restore": "node scripts/test-restore-service.js"
+    "lint": "eslint src/"
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.850.0",
@@ -20,9 +17,10 @@
     "@aws-sdk/s3-request-presigner": "^3.850.0",
     "adm-zip": "^0.5.16",
     "archiver": "^5.3.1",
-    "axios": "^1.10.0",
+    "axios": "^1.12.2",
     "bcrypt": "6.0.0",
     "chokidar": "4.0.3",
+    "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
     "dotenv": "^16.0.3",
     "express": "^4.18.2",
@@ -35,15 +33,16 @@
     "i18next-browser-languagedetector": "^8.2.0",
     "i18next-http-backend": "^3.0.2",
     "joi": "^17.9.1",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.1.1",
     "jsonwebtoken": "^9.0.0",
     "knex": "^2.4.2",
     "mime-types": "^3.0.1",
     "multer": "^2.0.2",
     "node-cron": "^3.0.2",
-    "nodemailer": "7.0.5",
+    "nodemailer": "^7.0.10",
     "pg": "^8.16.3",
     "react-i18next": "^15.6.0",
+    "sanitize-html": "^2.17.0",
     "sharp": "0.34.3",
     "sqlite3": "^5.1.6",
     "uuid": "^11.1.0",
@@ -53,7 +52,16 @@
   "devDependencies": {
     "eslint": "^8.40.0",
     "jest": "^29.5.0",
+    "mock-fs": "^5.5.0",
     "nodemon": "^3.1.10",
     "supertest": "^6.3.3"
+  },
+  "overrides": {
+    "prebuild-install": {
+      "tar-fs": "2.1.4"
+    },
+    "glob": "^11.1.0",
+    "body-parser": "^2.2.1",
+    "js-yaml": "^4.1.1"
   }
 }

backend/scripts/check-db-issues.js

@@ -1,60 +0,0 @@
-require('dotenv').config();
-const { db } = require('../src/database/db');
-
-async function checkDatabaseIssues() {
-  console.log('Checking database issues...\n');
-  
-  try {
-    // Check email_templates table structure
-    console.log('1. Checking email_templates table structure:');
-    const emailTemplateColumns = await db('email_templates').columnInfo();
-    console.log('Columns:', Object.keys(emailTemplateColumns));
-    
-    // Check if any templates exist
-    const templateCount = await db('email_templates').count('* as count');
-    console.log('Template count:', templateCount[0].count);
-    
-    // Check for specific template
-    const galleryCreatedTemplate = await db('email_templates')
-      .where('template_key', 'gallery_created')
-      .first();
-    console.log('gallery_created template exists:', !!galleryCreatedTemplate);
-    
-    // Check activity_logs table
-    console.log('\n2. Checking activity_logs table:');
-    const activityLogColumns = await db('activity_logs').columnInfo();
-    console.log('Columns:', Object.keys(activityLogColumns));
-    
-    // Check migrations table
-    console.log('\n3. Checking migrations status:');
-    const migrations = await db('migrations')
-      .orderBy('id', 'desc')
-      .limit(10);
-    console.log('Latest migrations:');
-    migrations.forEach(m => console.log(`  - ${m.filename}`));
-    
-    // Test a simple query from notifications route
-    console.log('\n4. Testing notifications query:');
-    try {
-      const notifications = await db('activity_logs')
-        .select(
-          'activity_logs.*',
-          'events.event_name'
-        )
-        .leftJoin('events', 'activity_logs.event_id', 'events.id')
-        .orderBy('activity_logs.created_at', 'desc')
-        .limit(5);
-      console.log(`Found ${notifications.length} notifications`);
-    } catch (error) {
-      console.error('Notifications query failed:', error.message);
-    }
-    
-  } catch (error) {
-    console.error('Error:', error);
-  } finally {
-    await db.destroy();
-    process.exit(0);
-  }
-}
-
-checkDatabaseIssues();

backend/scripts/check-db-schema.js

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-
-const sqlite3 = require('sqlite3').verbose();
-
-// Connect to the database
-const dbPath = '/app/data/photo_sharing.db';
-console.log(`Connecting to database at: ${dbPath}`);
-
-const db = new sqlite3.Database(dbPath, sqlite3.OPEN_READONLY, (err) => {
-  if (err) {
-    console.error('Error opening database:', err.message);
-    process.exit(1);
-  }
-  console.log('Connected to the SQLite database.\n');
-});
-
-// Get schema for events table
-console.log('=== EVENTS TABLE SCHEMA ===');
-db.all("PRAGMA table_info(events)", [], (err, rows) => {
-  if (err) {
-    console.error('Error getting events schema:', err.message);
-  } else {
-    rows.forEach(row => {
-      console.log(`${row.name} (${row.type})`);
-    });
-  }
-  
-  console.log('\n=== PHOTOS TABLE SCHEMA ===');
-  // Get schema for photos table
-  db.all("PRAGMA table_info(photos)", [], (err, rows) => {
-    if (err) {
-      console.error('Error getting photos schema:', err.message);
-    } else {
-      rows.forEach(row => {
-        console.log(`${row.name} (${row.type})`);
-      });
-    }
-    
-    // Close the database
-    db.close();
-  });
-});

backend/scripts/check-email-environment.js

@@ -1,131 +0,0 @@
-const { db } = require('../src/database/db');
-
-async function checkEmailEnvironment() {
-  console.log('=== Email Environment Check ===\n');
-  
-  // 1. Check environment variables
-  console.log('1. Environment Variables:');
-  const envVars = [
-    'SMTP_HOST',
-    'SMTP_PORT',
-    'SMTP_USER',
-    'SMTP_PASS',
-    'SMTP_FROM',
-    'SMTP_SECURE',
-    'EMAIL_PROCESSOR_ENABLED',
-    'NODE_ENV'
-  ];
-  
-  envVars.forEach(varName => {
-    const value = process.env[varName];
-    if (varName.includes('PASS')) {
-      console.log(`   ${varName}: ${value ? '***' : 'NOT SET'}`);
-    } else {
-      console.log(`   ${varName}: ${value || 'NOT SET'}`);
-    }
-  });
-  
-  // 2. Check database configuration
-  console.log('\n2. Database Email Configuration:');
-  try {
-    const emailConfig = await db('email_configs').first();
-    if (emailConfig) {
-      console.log('   Email configuration found in database:');
-      console.log(`   - SMTP Host: ${emailConfig.smtp_host}`);
-      console.log(`   - SMTP Port: ${emailConfig.smtp_port}`);
-      console.log(`   - SMTP User: ${emailConfig.smtp_user || 'NOT SET'}`);
-      console.log(`   - SMTP Secure: ${emailConfig.smtp_secure}`);
-      console.log(`   - From Address: ${emailConfig.smtp_from}`);
-    } else {
-      console.log('   ⚠️  No email configuration found in database!');
-      console.log('   This will prevent the email processor from initializing.');
-    }
-  } catch (error) {
-    console.log(`   ❌ Error reading email configuration: ${error.message}`);
-  }
-  
-  // 3. Check if the email processor should be disabled
-  console.log('\n3. Email Processor Status:');
-  const isDisabled = process.env.EMAIL_PROCESSOR_ENABLED === 'false';
-  if (isDisabled) {
-    console.log('   ⚠️  Email processor is DISABLED via EMAIL_PROCESSOR_ENABLED=false');
-  } else {
-    console.log('   ✅ Email processor is enabled (default)');
-  }
-  
-  // 4. Check pending emails
-  console.log('\n4. Email Queue Status:');
-  try {
-    const pending = await db('email_queue')
-      .where('status', 'pending')
-      .count('* as count')
-      .first();
-    
-    const failed = await db('email_queue')
-      .where('status', 'failed')
-      .where('retry_count', '>=', 3)
-      .count('* as count')
-      .first();
-    
-    const sent = await db('email_queue')
-      .where('status', 'sent')
-      .count('* as count')
-      .first();
-    
-    console.log(`   - Pending emails: ${pending.count}`);
-    console.log(`   - Failed emails (max retries): ${failed.count}`);
-    console.log(`   - Sent emails: ${sent.count}`);
-  } catch (error) {
-    console.log(`   ❌ Error querying email queue: ${error.message}`);
-  }
-  
-  // 5. Test database connection
-  console.log('\n5. Database Connection:');
-  try {
-    await db.raw('SELECT 1');
-    console.log('   ✅ Database connection successful');
-  } catch (error) {
-    console.log(`   ❌ Database connection failed: ${error.message}`);
-  }
-  
-  // 6. Check for any recent errors
-  console.log('\n6. Recent Email Errors:');
-  try {
-    const recentErrors = await db('email_queue')
-      .whereNotNull('error_message')
-      .orderBy('id', 'desc')
-      .limit(3)
-      .select('id', 'email_type', 'error_message', 'retry_count');
-    
-    if (recentErrors.length > 0) {
-      recentErrors.forEach((email, index) => {
-        console.log(`   ${index + 1}. Email ID ${email.id} (${email.email_type}):`);
-        console.log(`      Retries: ${email.retry_count}`);
-        console.log(`      Error: ${email.error_message}`);
-      });
-    } else {
-      console.log('   No recent errors found');
-    }
-  } catch (error) {
-    console.log(`   ❌ Error querying recent errors: ${error.message}`);
-  }
-  
-  console.log('\n=== Environment check complete ===');
-  console.log('\nRecommendations:');
-  
-  const emailConfig = await db('email_configs').first().catch(() => null);
-  if (!emailConfig) {
-    console.log('❗ Configure email settings in the admin panel or add email_configs record');
-  }
-  
-  if (!process.env.SMTP_HOST && !emailConfig) {
-    console.log('❗ Set SMTP environment variables or configure in database');
-  }
-  
-  await db.destroy();
-}
-
-checkEmailEnvironment().catch(error => {
-  console.error('Fatal error:', error);
-  process.exit(1);
-});

backend/scripts/check-email-processor.js

@@ -1,157 +0,0 @@
-const { db } = require('../src/database/db');
-const winston = require('winston');
-
-// Create a simple console logger
-const logger = winston.createLogger({
-  format: winston.format.simple(),
-  transports: [new winston.transports.Console()]
-});
-
-async function checkEmailProcessor() {
-  try {
-    logger.info('=== Email Processor Diagnostic Check ===\n');
-    
-    // 1. Check pending emails
-    logger.info('1. Checking pending emails in queue...');
-    const pendingEmails = await db('email_queue')
-      .where('status', 'pending')
-      .where('retry_count', '<', 3)
-      .orderBy('created_at', 'asc');
-    
-    logger.info(`Found ${pendingEmails.length} pending emails\n`);
-    
-    if (pendingEmails.length > 0) {
-      logger.info('Pending email details:');
-      pendingEmails.forEach((email, index) => {
-        logger.info(`\nEmail ${index + 1}:`);
-        logger.info(`  ID: ${email.id}`);
-        logger.info(`  Type: ${email.email_type}`);
-        logger.info(`  Recipient: ${email.recipient_email}`);
-        logger.info(`  Event ID: ${email.event_id}`);
-        logger.info(`  Status: ${email.status}`);
-        logger.info(`  Retry Count: ${email.retry_count}`);
-        logger.info(`  Scheduled At: ${email.scheduled_at}`);
-        logger.info(`  Created At: ${email.created_at}`);
-        logger.info(`  Error: ${email.error_message || 'None'}`);
-        
-        // Check if email_data needs parsing
-        logger.info(`  Email Data Type: ${typeof email.email_data}`);
-        if (email.email_data) {
-          try {
-            const data = typeof email.email_data === 'string' 
-              ? JSON.parse(email.email_data) 
-              : email.email_data;
-            logger.info(`  Email Data Keys: ${Object.keys(data).join(', ')}`);
-          } catch (e) {
-            logger.error(`  Failed to parse email_data: ${e.message}`);
-          }
-        }
-      });
-    }
-    
-    // 2. Check failed emails
-    logger.info('\n\n2. Checking failed emails...');
-    const failedEmails = await db('email_queue')
-      .where('status', 'failed')
-      .orderBy('created_at', 'desc')
-      .limit(5);
-    
-    logger.info(`Found ${failedEmails.length} failed emails (showing last 5)\n`);
-    
-    if (failedEmails.length > 0) {
-      failedEmails.forEach((email, index) => {
-        logger.info(`\nFailed Email ${index + 1}:`);
-        logger.info(`  ID: ${email.id}`);
-        logger.info(`  Type: ${email.email_type}`);
-        logger.info(`  Retry Count: ${email.retry_count}`);
-        logger.info(`  Error: ${email.error_message || 'No error message'}`);
-        logger.info(`  Last Attempt: ${email.sent_at || 'Never'}`);
-      });
-    }
-    
-    // 3. Check if email processor should be running
-    logger.info('\n\n3. Checking email processor configuration...');
-    
-    // Check environment variables
-    const emailConfig = {
-      SMTP_HOST: process.env.SMTP_HOST,
-      SMTP_PORT: process.env.SMTP_PORT,
-      SMTP_USER: process.env.SMTP_USER,
-      SMTP_FROM: process.env.SMTP_FROM,
-      SMTP_SECURE: process.env.SMTP_SECURE,
-      EMAIL_PROCESSOR_ENABLED: process.env.EMAIL_PROCESSOR_ENABLED || 'true'
-    };
-    
-    logger.info('Email configuration:');
-    Object.entries(emailConfig).forEach(([key, value]) => {
-      if (key === 'SMTP_USER') {
-        logger.info(`  ${key}: ${value ? '***' : 'NOT SET'}`);
-      } else {
-        logger.info(`  ${key}: ${value || 'NOT SET'}`);
-      }
-    });
-    
-    // 4. Test email processor functionality
-    logger.info('\n\n4. Testing email processor functionality...');
-    
-    // Import the email processor
-    const { processEmailQueue, testEmailConnection } = require('../src/services/emailProcessor');
-    
-    // Test email connection
-    logger.info('Testing email connection...');
-    try {
-      const connectionTest = await testEmailConnection();
-      logger.info(`Email connection test: ${connectionTest ? 'SUCCESS' : 'FAILED'}`);
-    } catch (error) {
-      logger.error(`Email connection test failed: ${error.message}`);
-    }
-    
-    // Try to process queue once manually
-    if (pendingEmails.length > 0) {
-      logger.info('\n\n5. Attempting to process email queue manually...');
-      try {
-        await processEmailQueue();
-        logger.info('Manual queue processing completed');
-        
-        // Check status after processing
-        const stillPending = await db('email_queue')
-          .where('status', 'pending')
-          .where('retry_count', '<', 3)
-          .count('* as count')
-          .first();
-        
-        logger.info(`Emails still pending after processing: ${stillPending.count}`);
-      } catch (error) {
-        logger.error(`Error processing queue: ${error.message}`);
-        logger.error(`Stack trace: ${error.stack}`);
-      }
-    }
-    
-    // 5. Check for any recent successful emails
-    logger.info('\n\n6. Checking recent successful emails...');
-    const recentSuccess = await db('email_queue')
-      .where('status', 'sent')
-      .orderBy('sent_at', 'desc')
-      .limit(3);
-    
-    if (recentSuccess.length > 0) {
-      logger.info(`Last ${recentSuccess.length} successful emails:`);
-      recentSuccess.forEach((email, index) => {
-        logger.info(`  ${index + 1}. Type: ${email.email_type}, Sent: ${email.sent_at}`);
-      });
-    } else {
-      logger.info('No successfully sent emails found');
-    }
-    
-    logger.info('\n\n=== Diagnostic check complete ===');
-    
-  } catch (error) {
-    logger.error('Error running diagnostic check:', error);
-  } finally {
-    await db.destroy();
-    process.exit(0);
-  }
-}
-
-// Run the check
-checkEmailProcessor();

backend/scripts/check-email-templates.js

@@ -1,66 +0,0 @@
-const { db } = require('../src/database/db');
-
-async function checkEmailTemplates() {
-  try {
-    console.log('=== Email Templates Check ===\n');
-    
-    // 1. Check table columns
-    console.log('1. Checking email_templates table structure...');
-    
-    // Check which columns exist
-    const columnChecks = [
-      'subject', 'subject_en', 'subject_de',
-      'body_html', 'body_html_en', 'body_html_de',
-      'body_text', 'body_text_en', 'body_text_de'
-    ];
-    
-    const existingColumns = [];
-    for (const col of columnChecks) {
-      const exists = await db.schema.hasColumn('email_templates', col);
-      if (exists) existingColumns.push(col);
-    }
-    
-    console.log('   Existing columns:', existingColumns.join(', '));
-    
-    // 2. Get all templates
-    console.log('\n2. Current email templates:');
-    const templates = await db('email_templates').select('*');
-    
-    for (const template of templates) {
-      console.log(`\n   Template: ${template.template_key}`);
-      console.log('   -------------------');
-      
-      // Check which fields have content
-      const fields = ['subject', 'subject_en', 'subject_de', 
-                     'body_html', 'body_html_en', 'body_html_de',
-                     'body_text', 'body_text_en', 'body_text_de'];
-      
-      for (const field of fields) {
-        if (template[field]) {
-          const preview = template[field].substring(0, 50) + '...';
-          console.log(`   ${field}: ${preview}`);
-        }
-      }
-      
-      // Check for German translations
-      const hasGermanSubject = template.subject_de || template.body_html_de;
-      console.log(`   Has German translation: ${hasGermanSubject ? 'YES' : 'NO'}`);
-    }
-    
-    // 3. Summary
-    console.log('\n3. Summary:');
-    const totalTemplates = templates.length;
-    const templatesWithGerman = templates.filter(t => t.subject_de || t.body_html_de).length;
-    console.log(`   Total templates: ${totalTemplates}`);
-    console.log(`   Templates with German: ${templatesWithGerman}`);
-    console.log(`   Missing German: ${totalTemplates - templatesWithGerman}`);
-    
-    await db.destroy();
-  } catch (error) {
-    console.error('Error:', error);
-    await db.destroy();
-    process.exit(1);
-  }
-}
-
-checkEmailTemplates();

backend/scripts/check-german-templates.js

@@ -1,53 +0,0 @@
-const { db } = require('../src/database/db');
-
-async function checkGermanTemplates() {
-  try {
-    console.log('=== German Email Template Content Check ===\n');
-    
-    const templates = await db('email_templates').select('*');
-    
-    for (const template of templates) {
-      console.log(`\nTemplate: ${template.template_key}`);
-      console.log('=====================================');
-      
-      // Check German subject
-      console.log('\nGERMAN SUBJECT:');
-      console.log(template.subject_de || 'MISSING');
-      
-      // Check if German HTML body has English content
-      console.log('\nGERMAN HTML BODY:');
-      const germanHtml = template.body_html_de || '';
-      
-      // Check for English phrases in German template
-      const englishPhrases = [
-        'Dear', 'Gallery', 'has been', 'Your photo', 'successfully',
-        'Details:', 'Link:', 'Password:', 'Expires:', 'Event Date:',
-        'Thank you', 'Best regards', 'View Gallery', 'days'
-      ];
-      
-      const foundEnglish = englishPhrases.filter(phrase => 
-        germanHtml.toLowerCase().includes(phrase.toLowerCase())
-      );
-      
-      if (foundEnglish.length > 0) {
-        console.log('⚠️  Found English phrases in German template:', foundEnglish.join(', '));
-      }
-      
-      // Show first 500 chars of German HTML
-      console.log(germanHtml.substring(0, 500) + '...\n');
-      
-      // Check German text body
-      console.log('GERMAN TEXT BODY:');
-      const germanText = template.body_text_de || '';
-      console.log(germanText.substring(0, 300) + '...\n');
-    }
-    
-    await db.destroy();
-  } catch (error) {
-    console.error('Error:', error);
-    await db.destroy();
-    process.exit(1);
-  }
-}
-
-checkGermanTemplates();

backend/scripts/create-test-event.js

@@ -1,58 +0,0 @@
-const path = require('path');
-require('dotenv').config({ path: path.join(__dirname, '../.env') });
-const { db } = require('../src/database/db');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-const { v4: uuidv4 } = require('uuid');
-
-async function createTestEvent() {
-  try {
-    console.log('Creating test event...');
-    
-    // Hash a simple password
-    const passwordHash = await bcrypt.hash('test123', 10);
-    
-    // Generate share token
-    const shareToken = uuidv4().replace(/-/g, '');
-    const shareLink = `http://localhost:3005/gallery/wedding-test123-2025-07-07/${shareToken}`;
-    
-    // Create event
-    const eventData = {
-      slug: 'wedding-test123-2025-07-07',
-      event_type: 'wedding',
-      event_name: 'Test Wedding',
-      event_date: '2025-07-07',
-      host_email: 'host@example.com',
-      admin_email: 'admin@example.com',
-      password_hash: passwordHash,
-      welcome_message: 'Welcome to our test wedding gallery!',
-      color_theme: null, // Use global theme
-      is_active: 1,
-      expires_at: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),
-      share_link: shareLink
-    };
-    
-    // Delete existing event if it exists
-    await db('events').where('slug', eventData.slug).delete();
-    
-    // Insert new event
-    const insertResult = await db('events').insert(eventData).returning('id');
-    const eventId = insertResult[0]?.id || insertResult[0];
-    console.log('Event created with ID:', eventId);
-    
-    console.log('\nTest event created successfully!');
-    console.log('Event details:');
-    console.log('- Name:', eventData.event_name);
-    console.log('- Slug:', eventData.slug);
-    console.log('- Password:', 'test123');
-    console.log('- Share link:', shareLink);
-    console.log('\nYou can now access the gallery at the share link above');
-    
-    process.exit(0);
-  } catch (error) {
-    console.error('Error creating test event:', error);
-    process.exit(1);
-  }
-}
-
-createTestEvent();

backend/scripts/debug-500-errors.js

@@ -1,92 +0,0 @@
-require('dotenv').config();
-const { db } = require('../src/database/db');
-
-async function debugEndpoints() {
-  console.log('Debugging 500 errors...\n');
-  
-  try {
-    // Test email templates query
-    console.log('1. Testing email templates query:');
-    try {
-      const templates = await db('email_templates')
-        .select('*')
-        .orderBy('template_key');
-      
-      console.log(`Found ${templates.length} templates`);
-      if (templates.length > 0) {
-        console.log('First template columns:', Object.keys(templates[0]));
-        console.log('Template keys:', templates.map(t => t.template_key));
-      }
-    } catch (error) {
-      console.error('Email templates query failed:', error.message);
-      console.error('Error code:', error.code);
-    }
-    
-    // Test notifications query
-    console.log('\n2. Testing notifications query:');
-    try {
-      const notifications = await db('activity_logs')
-        .select(
-          'activity_logs.*',
-          'events.event_name'
-        )
-        .leftJoin('events', 'activity_logs.event_id', 'events.id')
-        .whereNull('activity_logs.read_at')
-        .orderBy('activity_logs.created_at', 'desc')
-        .limit(5);
-      
-      console.log(`Found ${notifications.length} unread notifications`);
-    } catch (error) {
-      console.error('Notifications query failed:', error.message);
-      console.error('Error code:', error.code);
-      
-      // Check if it's a column issue
-      if (error.message.includes('column')) {
-        console.log('\nChecking activity_logs columns:');
-        const columns = await db('activity_logs').columnInfo();
-        console.log('Columns:', Object.keys(columns));
-      }
-    }
-    
-    // Test specific template query
-    console.log('\n3. Testing specific template query (gallery_created):');
-    try {
-      const template = await db('email_templates')
-        .where('template_key', 'gallery_created')
-        .first();
-      
-      if (template) {
-        console.log('Template found:', template.template_key);
-        console.log('Has subject_en?', template.subject_en !== undefined);
-        console.log('Has subject?', template.subject !== undefined);
-      } else {
-        console.log('Template not found');
-      }
-    } catch (error) {
-      console.error('Template query failed:', error.message);
-    }
-    
-    // Check CMS pages
-    console.log('\n4. Checking CMS pages:');
-    try {
-      const pages = await db('cms_pages')
-        .select('slug', 'title', 'is_published')
-        .orderBy('slug');
-      
-      console.log(`Found ${pages.length} CMS pages:`);
-      pages.forEach(page => {
-        console.log(`  - ${page.slug}: ${page.title} (published: ${page.is_published})`);
-      });
-    } catch (error) {
-      console.error('CMS pages query failed:', error.message);
-    }
-    
-  } catch (error) {
-    console.error('General error:', error);
-  } finally {
-    await db.destroy();
-    process.exit(0);
-  }
-}
-
-debugEndpoints();